What is uTorrent.exe?

uTorrent.exe is part of µTorrent and developed by BitTorrent Inc. according to the uTorrent.exe version information.

uTorrent.exe's description is "µTorrent"

uTorrent.exe is digitally signed by BitTorrent Inc.

uTorrent.exe is usually located in the 'c:\users\%USERNAME%\appdata\roaming\utorrent\' folder.

Some of the anti-virus scanners at VirusTotal detected uTorrent.exe.

If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.

Vendor and version information [?]

The following is the available information on uTorrent.exe:

PropertyValue
Product nameµTorrent
Company nameBitTorrent Inc.
File descriptionµTorrent
Internal nameuTorrent.exe
Original filenameuTorrent.exe
Legal copyright©2019 BitTorrent, Inc. All Rights Reserved.
Product version3.5.5.45359
File version3.5.5.45359
Special buildrelease

Here's a screenshot of the file properties when displayed by Windows Explorer:

Product nameµTorrent
Company nameBitTorrent Inc.
File descriptionµTorrent
Internal nameuTorrent.exe
Original filenameuTorrent.exe
Legal copyright©2019 BitTorrent, Inc. All Rights R..
Product version3.5.5.45359
File version3.5.5.45359
Special buildrelease

Digital signatures [?]

uTorrent.exe has a valid digital signature.

PropertyValue
Signer nameBitTorrent Inc
Certificate issuer nameSymantec Class 3 SHA256 Code Signing CA
Certificate serial number0cf35369a9710762c36f6805fc9e45d6

VirusTotal report

2 of the 71 anti-virus programs at VirusTotal detected the uTorrent.exe file. That's a 3% detection rate.

ScannerDetection Name
Invincea heuristic
McAfee-GW-Edition BehavesLike.Win32.Sality.tc
2 of the 71 anti-virus programs detected the uTorrent.exe file.

Sandbox Report

The following information was gathered by executing the file inside Cuckoo Sandbox.

Summary

Successfully executed process in sandbox.

Summary

{
    "file_opened": [
        "C:\\Windows\\System32\\FWPUCLNT.DLL",
        "C:\\Windows\\System32\\mswsock.dll",
        "C:\\",
        "C:\\Windows\\SysWOW64\\wininet.dll",
        "C:\\Windows\\SysWOW64\\user32.dll",
        "C:\\Windows\\SysWOW64\\advapi32.dll",
        "C:\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll",
        "C:\\Windows\\SysWOW64\\setupapi.dll",
        "C:\\Windows\\SysWOW64\\msasn1.dll",
        "C:\\Windows\\SysWOW64\\sspicli.dll",
        "C:\\Windows\\System32\\RpcRtRemote.dll",
        "C:\\Windows\\System32\\riched20.dll",
        "C:\\Windows\\System32\\powrprof.dll",
        "C:\\Windows\\SysWOW64\\kernel32.dll",
        "C:\\Windows\\SysWOW64\\msvcrt.dll",
        "C:\\Windows\\System32\\winnsi.dll",
        "C:\\Windows\\SysWOW64\\shlwapi.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
        "C:\\Windows\\SysWOW64\\cfgmgr32.dll",
        "C:\\Windows\\System32\\secur32.dll",
        "C:\\Windows\\System32\\cryptsp.dll",
        "C:\\Windows\\SysWOW64\\bcryptprimitives.dll",
        "C:\\Windows\\System32\\dbghelp.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt58C2.tmp",
        "C:\\Windows\\System32\\dwmapi.dll",
        "C:\\Windows\\SysWOW64\\CRYPTBASE.dll",
        "C:\\Windows\\System32\\dhcpcsvc6.DLL",
        "C:\\Windows\\SysWOW64\\ole32.dll",
        "C:\\Windows\\SysWOW64\\nsi.dll",
        "C:\\Windows\\System32\\profapi.dll",
        "C:\\Windows\\SysWOW64\\crypt32.dll",
        "C:\\Windows\\System32\\IPHLPAPI.DLL",
        "C:\\Windows\\System32\\bcrypt.dll",
        "C:\\Windows\\System32\\wship6.dll",
        "C:\\Windows\\SysWOW64\\psapi.dll",
        "C:\\Windows\\System32\\wtsapi32.dll",
        "C:\\Windows\\SysWOW64\\shell32.dll",
        "C:\\Windows\\SysWOW64\\lpk.dll",
        "C:\\Windows\\System32\\version.dll",
        "C:\\Windows\\SysWOW64\\en-US\\WININET.dll.mui",
        "C:\\Windows\\System32\\rasadhlp.dll",
        "C:\\Windows\\SysWOW64\\wintrust.dll",
        "C:\\Windows\\System32\\NapiNSP.dll",
        "C:\\Windows\\SysWOW64\\devobj.dll",
        "C:\\Windows\\System32\\npmproxy.dll",
        "C:\\Windows\\System32\\userenv.dll",
        "C:\\Windows\\System32\\pnrpnsp.dll",
        "C:\\Windows\\System32\\rasman.dll",
        "C:\\Windows\\SysWOW64\\msctf.dll",
        "C:\\Windows\\System32\\SensApi.dll",
        "C:\\Windows\\SysWOW64\\clbcatq.dll",
        "C:\\Windows\\System32\\dhcpcsvc.dll",
        "C:\\Windows\\SysWOW64\\urlmon.dll",
        "C:\\Windows\\System32\\ncrypt.dll",
        "C:\\Windows\\SysWOW64\\ntdll.dll",
        "C:\\Windows\\SysWOW64\\usp10.dll",
        "C:\\Windows\\System32\\dnsapi.dll",
        "C:\\Windows\\SysWOW64\\iertutil.dll",
        "C:\\Windows\\SysWOW64\\ws2_32.dll",
        "C:\\Windows\\System32\\rasapi32.dll",
        "C:\\Windows\\SysWOW64\\gdi32.dll",
        "C:\\Windows\\SysWOW64\\sechost.dll",
        "C:\\Windows\\System32\\winrnr.dll",
        "C:\\Windows\\System32\\msimg32.dll",
        "C:\\Windows\\System32\\ntmarta.dll",
        "C:\\Windows\\SysWOW64\\comdlg32.dll",
        "C:\\Windows\\System32\\imm32.dll",
        "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[1].txt",
        "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
        "C:\\Windows\\System32\\rtutils.dll",
        "C:\\Windows\\System32\\netprofm.dll",
        "C:\\Windows\\System32\\imageres.dll",
        "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[2].txt",
        "C:\\Windows\\SysWOW64\\rpcrt4.dll",
        "C:\\Windows\\System32\\WSHTCPIP.DLL",
        "C:\\Windows\\System32\\rsaenh.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
        "C:\\Windows\\SysWOW64\\oleaut32.dll",
        "C:\\Windows\\SysWOW64\\Wldap32.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat",
        "C:\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll",
        "C:\\Windows\\System32\\nlaapi.dll",
        "C:\\Windows\\SysWOW64\\KERNELBASE.dll",
        "C:\\Windows\\System32\\uxtheme.dll"
    ],
    "regkey_opened": [
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PropertyBag",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\CertCheck\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
        "HKEY_LOCAL_MACHINE\\Software\\Wine",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562",
        "HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.44.3.4!7",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\TrustedPublisher\\Safer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_EXCLUDE_INVALID_CLIENT_CERT_KB929477",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DnsClient",
        "HKEY_CLASSES_ROOT\\CLSID\\{05eeb91a-aef7-4f8a-978f-fb83e7b03f8e}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_ALLOW_LONG_INTERNATIONAL_FILENAMES",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\0",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-internet-signup",
        "HKEY_CLASSES_ROOT\\CLSID\\{ef79f67a-6ad7-4715-a0f8-932fca442023}",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_DISABLE_NOTIFY_UNVERIFIED_SPN_KB2385266",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Internet Explorer",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Internet Explorer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\History",
        "HKEY_CURRENT_USER\\Software\\Wine",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\uTorrent",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_UNC_SAVEDFILECHECK",
        "HKEY_LOCAL_MACHINE\\Software",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\ietld",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllEncodeObject",
        "HKEY_CLASSES_ROOT\\CLSID\\{49C795C2-604A-4D18-AEB1-B3EBA27E5EA2}",
        "HKEY_CLASSES_ROOT\\CLSID\\{1d03a978-ac0c-4004-b9fd-9cf361c7bd3f}",
        "HKEY_CLASSES_ROOT\\CLSID\\{2d8d9acc-f6d7-4362-8876-a275ca929591}",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\feedplat",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-ns-proxy-autoconfig",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptCNGPKCS12GetMap",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\Signature\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Content",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0",
        "HKEY_CLASSES_ROOT\\CLSID\\{ad06fb5f-fef7-4a84-8c58-dca34f8e3d36}",
        "HKEY_CLASSES_ROOT\\CLSID\\{656461ef-40f6-4115-9ff1-bced9812ccbb}",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllEncodeObjectEx",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\PFX",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\Initialization\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_RETURN_FAILED_CONNECT_CONTENT_KB942615",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\3",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Ranges\\",
        "HKEY_CURRENT_USER\\Software\\Classes\\FalconBetaAccount",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PropertyBag",
        "HKEY_CURRENT_USER\\Software\\BitTorrent",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo",
        "HKEY_CLASSES_ROOT\\CLSID\\{D4027C7F-154A-4066-A1AD-4243D8127440}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\msasn1",
        "HKEY_CURRENT_USER\\Interface\\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\1",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\PrivacIE:",
        "HKEY_CURRENT_USER\\Interface\\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Security",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_USE_UTF8_FOR_BASIC_AUTH_KB967545",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\LDAP",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\DnsCache\\Parameters",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2008",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2009",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2004",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2005",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2006",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2007",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2000",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2001",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2002",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2003",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
        "HKEY_CLASSES_ROOT\\CLSID\\{3041D03E-FD4B-44E0-B742-2D9B88305F98}",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\4",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\RASAPI32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip6\\Parameters\\Winsock",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3",
        "HKEY_CLASSES_ROOT\\AutoProxyTypes",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\SystemCertificates\\TrustedPublisher\\Safer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.15",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.11",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.10",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.12",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\Security",
        "HKEY_LOCAL_MACHINE\\System\\Setup",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.16.4",
        "HKEY_CURRENT_USER\\Software\\Policies",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\DOMStore",
        "HKEY_CLASSES_ROOT\\CLSID\\{7473B6BD-4691-4744-A82B-7854EB3D70B6}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.1.1",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\WinTrust\\Trust Providers\\Software Publishing",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\KnownClasses",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings",
        "HKEY_CLASSES_ROOT\\CLSID\\{181f104b-b000-4010-bb18-41b8205f774d}",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Cookies",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Wpad",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_BUFFERBREAKING_818408",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\1",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\0",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\4",
        "HKEY_CLASSES_ROOT\\CLSID\\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\2",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\0",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllEncodePublicKeyAndParameters",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject",
        "HKEY_CLASSES_ROOT\\CLSID\\{c840e246-6b95-475e-9bd7-caa1c7eca9f2}",
        "HKEY_CLASSES_ROOT\\CLSID\\{db131c55-60c8-4adc-84dc-9e76ab06e2dc}",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN",
        "HKEY_CURRENT_USER\\Software\\uTorrentPurchases\\PurchasedKeys",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\Certificate\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
        "HKEY_CURRENT_USER\\Interface\\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptCNGInitHMAC",
        "HKEY_CURRENT_USER\\Interface\\{55272A00-42CB-11CE-8135-00AA004BB851}",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2221",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2222",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\Message\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\RETRY_HEADERONLYPOST_ONCONNECTIONRESET",
        "HKEY_CLASSES_ROOT\\CLSID\\{4ae0c3d6-f713-4eed-bc65-25dc3ffdaac1}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}",
        "HKEY_CURRENT_USER\\Software\\BitTorrentPersist",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\History",
        "HKEY_CURRENT_USER\\Software\\BitTorrent\\uTorrent",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\RASMANCS",
        "HKEY_CLASSES_ROOT\\CLSID\\{e0301295-ab3e-4af3-979f-3d453c5f9f48}",
        "HKEY_CLASSES_ROOT\\CLSID\\{7b6de06c-7013-4a87-957e-d27d7b977d21}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Cookies",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019040920190410",
        "HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\Progid",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.30",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Winsock\\Setup Migration\\Providers",
        "HKEY_CURRENT_USER\\Software\\uTorrentPlus",
        "HKEY_CLASSES_ROOT\\CLSID\\{91397D20-1446-11D4-8AF4-0040CA1127B6}",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001",
        "HKEY_CURRENT_USER\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_DISALLOW_NULL_IN_RESPONSE_HEADERS",
        "HKEY_CLASSES_ROOT\\CLSID\\{6DA66498-839A-42A7-8324-FF7D2A532835}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocHandler",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\LayoutIcon\\0409\\0000041d",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.47.1.1!7",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProtocolDefaults\\",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_COMPAT_USE_CONNECTION_BASED_NEGOTIATE_AUTH_KB2151543",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Shell\\RegisteredApplications\\UrlAssociations\\http\\OpenWithProgids",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\DirectUI",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\4",
        "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle",
        "HKEY_CLASSES_ROOT\\CLSID\\{F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_USE_CNAME_FOR_SPN_KB911149",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\3",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_CLASSES_ROOT\\.torrent",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Content",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\2",
        "HKEY_LOCAL_MACHINE\\Software\\Policies",
        "HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\shell\\open",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{55272A00-42CB-11CE-8135-00AA004BB851}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\DiagnosticPolicy\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.47.1.1!7",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice",
        "HKEY_CURRENT_USER\\Software\\AppDataLow\\Software\\Search Protection",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptCNGInitHMAC",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_DIGEST_NO_EXTRAS_IN_URI",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\TrustedPublisher\\Safer",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\",
        "HKEY_CURRENT_USER\\Software",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.16.1.1",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Network\\Location Awareness",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.28",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",
        "HKEY_CLASSES_ROOT\\CLSID\\{03ea5b10-2efa-4311-ac10-04427b02d663}",
        "HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\CurVer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.25",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.26",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.27",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.20",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_UNC_SAVEDFILECHECK",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.2.11",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllExportPrivateKeyInfoEx",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.2.12",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\2",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\LSA\\AccessProviders",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptCNGPKCS12GetMap",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Ranges\\",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_CLASSES_ROOT\\CLSID\\{B6AC5E3C-5CEB-4E72-B451-F0E1BA983C14}",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\Cleanup\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
        "HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\shell\\open\\command",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\crypt32",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip6",
        "HKEY_CURRENT_USER\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}",
        "HKEY_CLASSES_ROOT\\FirefoxURL-E7CF176E110C211B",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.2.4",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OleAut",
        "HKEY_CLASSES_ROOT\\CLSID\\{4E871705-D1F3-49D9-814F-1E46E85986B0}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.2.1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_SECURITY_FLAG_IGNORE_REVOCATION_KB2275828",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.2.3",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.2.2",
        "HKEY_CLASSES_ROOT\\CLSID\\{87775fdb-6972-41f9-ae51-8326e38cb206}",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_USE_IETLDLIST_FOR_DOMAIN_DETERMINATION",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Layers",
        "HKEY_CLASSES_ROOT\\CLSID\\{5BA8E555-8C08-4CC8-80E6-1F8CDD26AE3A}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodePublicKeyAndParameters",
        "HKEY_CLASSES_ROOT\\CLSID\\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_MIME_HANDLING",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\Progid",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllExportPrivateKeyInfoEx",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_INCLUDE_PORT_IN_SPN_KB908209",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2130",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.4",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\\ProxyStubClsid32",
        "HKEY_CLASSES_ROOT\\CLSID\\{29acf17c-1713-4286-8f40-bfd05f1e70c8}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{3697C5FA-60DD-4B56-92D4-74A569205C16}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Winsock\\Parameters",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Ranges\\",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.44.3.4!7",
        "HKEY_CLASSES_ROOT\\CLSID\\{e9df9360-97f8-4690-afe6-996c80790da4}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_CURRENT_USER",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache",
        "HKEY_CLASSES_ROOT\\CLSID\\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\",
        "HKEY_CURRENT_USER\\Software\\Classes\\.torrent",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Layers",
        "HKEY_CLASSES_ROOT\\CLSID\\{1fd59ce2-6236-467c-9539-3d8c93fea5e0}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.12.2.1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.12.2.2",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PropertyBag",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_ENABLE_PASSPORT_SESSION_STORE_KB948608",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\3",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_RELEASE_KEYS_ON_UNLOAD_KB975619",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}"
    ],
    "fetches_url": [
        "http:\/\/update.utorrent.com\/installstats.php?cl=uTorrent&v=111849775&h=r5l-vgQJK7gnDD9k&w=1DB10106&bu=0&pr=0&cmp=0&ocmp=0&showtbexists&pid=2660&cau=0&tbe=0&cd=0&view=win32",
        "http:\/\/update.utorrent.com\/installoffer.php?h=r5l-vgQJK7gnDD9k&v=111849775&w=1DB10106&l=en&c=US&w64=1&db=firefox&cl=uTorrent&tsub=1&svp=4",
        "http:\/\/update.utorrent.com\/installstats.php?cl=uTorrent&v=111849775&h=r5l-vgQJK7gnDD9k&w=1DB10106&bu=0&pr=0&cmp=0&ocmp=0&showinstall&pid=2660&cau=0&au=0&view=win32",
        "http:\/\/update.utorrent.com\/installstats.php?cl=uTorrent&v=111849775&h=r5l-vgQJK7gnDD9k&w=1DB10106&bu=0&pr=0&cmp=0&ocmp=0&showwarning&pid=2660&cau=0&view=win32"
    ],
    "guid": [
        "{a47979d2-c419-11d9-a5b4-001185ad2b89}",
        "{dcb00c01-570f-4a9b-8d69-199fdba5723b}",
        "{dcb00000-570f-4a9b-8d69-199fdba5723b}",
        "{d0074ffd-570f-4a9b-8d69-199fdba5723b}"
    ],
    "file_deleted": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt694F.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt58C2.tmp",
        "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[1].txt",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A2B.tmp"
    ],
    "regkey_written": [
        "HKEY_CURRENT_USER\\Software\\BitTorrent\\computerID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\EnableFileTracing",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\EnableConsoleTracing",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\EnableConsoleTracing",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadNetworkName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\FileDirectory",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\FileTracingMask",
        "HKEY_CURRENT_USER\\FalconBetaAccount\\remote_access_client_id",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\MaxFileSize",
        "HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\LanguageList",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\FileTracingMask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\ConsoleTracingMask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\FileDirectory",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyEnable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\EnableFileTracing",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionReason",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecision",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\ConsoleTracingMask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\MaxFileSize",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionTime",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadLastNetwork",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\SavedLegacySettings"
    ],
    "file_copied": [
        [
            "C:\\Users\\cuck\\AppData\\Local\\Temp\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
            "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates\\3.5.5_45359.exe"
        ]
    ],
    "connects_host": [
        "i-41.b-45359.bench.utorrent.com"
    ],
    "regkey_deleted": [
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyOverride",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL"
    ],
    "mutex": [
        "Local\\\u00b5Torrent4823DF041B09",
        "Local\\ZonesCounterMutex",
        "RasPbFile",
        "Local\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
        "Local\\ZoneAttributeCacheCounterMutex",
        "Local\\ZonesLockedCacheCounterMutex",
        "IESQMMUTEX_0_208",
        "Local\\ZonesCacheCounterMutex"
    ],
    "file_read": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin"
    ],
    "regkey_read": [
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\StreamResourceType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\SspiCli.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Initialization\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\ParsingName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\System32\\wshtcpip.dll",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Cookies\\CacheLimit",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\SysWOW64\\sechost.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Signature\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\ScavengeCacheFileLifeTime",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CertificateRevocation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.44.3.4!7\\Name",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\crypt32\\DiagMatchAnyMask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\ietld\\CachePrefix",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoProxyDetectType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\StreamResource",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\InfoTip",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019040920190410\\CacheRepair",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\CertCheck\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\DOMStore\\CachePrefix",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ConnectTimeOut",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\ParsingName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledProcesses\\3997CE90",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\BypassSSLNoCacheCheck",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerProxy",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7\\Name",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\FolderTypeID",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyEnable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\NSI.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Cookies\\PerUserItem",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\EnableConsoleTracing",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\LocalizedName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-ns-proxy-autoconfig\\FileExtensions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN\\*",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001\\ProfileImagePath",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0\\Flags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\History\\PerUserItem",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\HttpDefaultExpiryTimeSecs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\EnableFileTracing",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Users\\cuck\\AppData\\Local\\Temp\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\ietld\\CacheRepair",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Signature",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableNTLMPreAuth",
        "HKEY_CURRENT_USER\\Software\\BitTorrent\\computerID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\NoNetAutodial",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\RpcRtRemote.dll",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019040920190410\\CachePrefix",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableWorkerThreadHibernation",
        "HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@%SystemRoot%\\system32\\p2pcollab.dll,-8042",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CacheMode",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnOnHTTPSToHTTPRedirect",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019040920190410\\CacheLimit",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ScavengeCacheLowerBound",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DialupUseLanSettings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Description",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SecureProtocols",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\FileTracingMask",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Personal",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\MaxSockaddrLength",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DialupUseLanSettings",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2\\Flags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\ParentFolder",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip6\\WinSock 2.0 Provider ID",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld\\IETldDllVersionLow",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\CLBCatQ.DLL",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnOnZoneCrossing",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\CertCheck\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ShareCredsWithWinHttp",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Stream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableBranchCache",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\crypt32\\DiagLevel",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\feedplat\\CacheRepair",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\EnableConsoleTracing",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld\\IETldDllVersionHigh",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\msvcrt.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\SysWOW64\\ntdll.dll",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MigrateProxy",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnOnPost",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableNegotiate",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\System32\\winrnr.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\MSIMG32.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\IMM32.DLL",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\GlobalUserOffline",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\DOMStore\\CachePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.47.1.1!7\\Name",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\napinsp.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\VERSION.dll",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AlwaysDrainOnRedirect",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\DOMStore\\CacheLimit",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}\\Enable",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SendTimeOut",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SendTimeOut",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Category",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\SETUPAPI.dll",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\WS2_32.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyHttp1.1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Description",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-internet-signup\\Flags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableHttp1_1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\InitFolderHandler",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\UseOldHostResolutionOrder",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\DEVOBJ.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\FolderTypeID",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SecureProtocols",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\PrivacIE:\\CachePrefix",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalizedName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Category",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\RASAPI32.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParentFolder",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ReceiveTimeOut",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\dwmapi.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\Secur32.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\iertutil.dll",
        "HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\shell\\open\\command\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\KERNELBASE.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Roamable",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Content\\PerUserItem",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\Feature_ClientAuthCertFilter",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadOverride",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\InitFolderHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\CRYPT32.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Security",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\rtutils.dll",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld\\IETldVersionHigh",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\SessionStartTimeDefaultDeltaSecs",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019040920190410\\CacheOptions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\RPCRT4.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledSessions\\MachineThrottling",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MimeExclusionListForCache",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\My Music",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\feedplat\\CacheOptions",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\My Video",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MBCSServername",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MBCSAPIforCrack",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableCachingOfSSLPages",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\HeaderExclusionListForCache",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\ncrypt.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\WTSAPI32.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\rsaenh.dll",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\PerUserCookies",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PublishExpandedPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InitFolderHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\\*",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Roamable",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WpadSearchAllDomains",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnOnPostRedirect",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Hostname",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-ns-proxy-autoconfig\\Flags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\ScavengeCacheFileLimit",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\GDI32.dll",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\feedplat\\CacheLimit",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\COMCTL32.dll",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\AccessProviders\\MartaExtension",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnAlwaysOnPost",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Icon",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\WinTrust\\Trust Providers\\Software Publishing\\State",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3\\1A10",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\BypassHTTPNoCacheCheck",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Icon",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DnsCacheTimeout",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\SHELL32.dll",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DnsCacheEnabled",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\dhcpcsvc6.DLL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\CRYPTSP.dll",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\PrivacIE:\\CacheOptions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Cleanup\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Security",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InfoTip",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\NoCheckAutodialOverRide",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\LeashLegacyCookies",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\History\\CacheLimit",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DnsCacheEntries",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\mswsock.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPer1_0Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\FileDirectory",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\MSCTF.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_UNC_SAVEDFILECHECK\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Security\\Safety Warning Level",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\TcpAutotuning",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1\\Flags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\rasman.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\profapi.dll",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice\\Progid",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Stream",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld\\IETldVersionLow",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\EnableConsoleTracing",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisablePassport",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Content\\PerUserItem",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\COMDLG32.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Stream",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Cookies\\PerUserItem",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Icon",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SocketSendBufferLength",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\CTF\\EnableAnchorContext",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Attributes",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\ietld\\CacheLimit",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\System32\\npmproxy.dll",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\WLDAP32.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\UTF8ServerNameRes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PublishExpandedPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\kernel32.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\LPK.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalRedirectOnly",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxySettingsPerUser",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Parameters\\Transports",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\urlmon.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Attributes",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\DOMStore\\CacheRepair",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Signature\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyHttp1.1",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\uxtheme.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\ADVAPI32.dll",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\LocalRedirectOnly",
        "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Layout Hotkey",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\FtpDefaultExpiryTimeSecs",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyHttp1.1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Security",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableHttp1_1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\MaxFileSize",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\ietld\\CachePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\CRYPTBASE.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ConnectRetries",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\FromCacheTimeout",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DontUseDNSLoadBalancing",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\HelperDllName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResource",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ReceiveTimeOut",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyHttp1.1",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableAutodial",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PreCreate",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\feedplat\\CachePrefix",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\EnableFileTracing",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisplayScriptDownloadFailureUI",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\InfoTip",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\DHCPCSVC.DLL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\CFGMGR32.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\RelativePath",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\PrivacIE:\\CacheLimit",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\MinSockaddrLength",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\pnrpnsp.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\ole32.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\System32\\fwpuclnt.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Attributes",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DontUseDNSLoadBalancing",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Category",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigCustomUA",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\ConsoleTracingMask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\MSASN1.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\DNSAPI.dll",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadLastNetwork",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK\\*",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyOverride",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Content\\CacheLimit",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\System32\\wship6.dll",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\BadProxyExpiresTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\SysWOW64\\bcryptprimitives.dll",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPer1_0Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\StreamResource",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\ntmarta.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledSessions\\GlobalSession",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\wintrust.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\SHLWAPI.dll",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableHttp1_1",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\DOMStore\\CacheOptions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\LocalizedName",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\PrivacIE:\\CacheRepair",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\WININET.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_MIME_HANDLING\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\ConsoleTracingMask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\IPHLPAPI.DLL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\bcrypt.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResourceType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-internet-signup\\FileExtensions",
        "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Language Hotkey",
        "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Hotkey",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\SavedLegacySettings",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\UseDelayedAcceptance",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\UseHostnameAsAlias",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\System32\\netprofm.dll",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\PrivacIE:\\CachePath",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\IdnEnabled",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableWorkerThreadHibernation",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019040920190410\\CachePath",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxHttpRedirects",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Description",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\FileTracingMask",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\ScavengeCacheFileLimit",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\StreamResourceType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-internet-signup\\DllFile",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\NLAapi.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\LocalRedirectOnly",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_MIME_HANDLING\\*",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CertCacheNoValidate",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SendExtraCRLF",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{55272A00-42CB-11CE-8135-00AA004BB851}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\rasadhlp.dll",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\FileDirectory",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SyncMode5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\powrprof.dll",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\ScavengeCacheFileLimit",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\RelativePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerServer",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableKeepAlive",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Message\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3\\Flags",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\LdapClientIntegrity",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\Security\\DisableSecuritySettingsCheck",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\feedplat\\CachePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-internet-signup\\Default",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Cookies\\CachePrefix",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Certificate\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\BypassSSLNoCacheCheck",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ClientAuthBuiltInUI",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PreCreate",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\ietld\\CacheOptions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Cleanup\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_UNC_SAVEDFILECHECK\\*",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\USP10.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParsingName",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ConnectRetries",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\OLEAUT32.dll",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableBasicOverClearChannel",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
        "HKEY_CURRENT_USER\\Software\\BitTorrent\\StatsTesting",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Initialization\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\History\\PerUserItem",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\USERENV.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\USER32.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Roamable",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\KeepAliveTimeout",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Name",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-ns-proxy-autoconfig\\DllFile",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ServerInfoTimeout",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PreCreate",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Security\\DisableSecuritySettingsCheck",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\History\\CachePrefix",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\MaxFileSize",
        "HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@%SystemRoot%\\system32\\dnsapi.dll,-103",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableAutoProxyResultCache",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Certificate\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SecureProtocols",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Security_HKLM_only",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\PSAPI.DLL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\NoCheckAutodialOverRide",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\Riched20.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnOnBadCertRecving",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Content\\CachePrefix",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Message\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\WINNSI.DLL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableHttpTrace",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4\\Flags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\DBGHELP.DLL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\sensapi.dll",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Name",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SocketReceiveBufferLength",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\FolderTypeID",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ConnectTimeOut",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-ns-proxy-autoconfig\\Default",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Name",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PublishExpandedPath",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableReadRange",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\Mapping",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\ParentFolder",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\RelativePath",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\BypassHTTPNoCacheCheck"
    ],
    "file_created": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt58C2.tmp",
        "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[1].txt",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\45359-utorrent.9782.dmp",
        "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[2].txt",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat.new",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A2B.tmp.1573254788\\HTA\\install.1573254788.zip",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates.dat",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A2B.tmp",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A2B.tmp.1573254788\\index.hta.log",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt694F.tmp.new",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc.new",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt694F.tmp"
    ],
    "dll_loaded": [
        "DBGHELP.DLL",
        "version.dll",
        "COMDLG32.dll",
        "profapi.dll",
        "urlmon.dll",
        "kernel32",
        "C:\\Windows\\system32\\symsrv.dll",
        "ntdll",
        "api-ms-win-core-sysinfo-l1-2-1",
        "api-ms-win-core-localization-l1-2-1",
        "DNSAPI.dll",
        "C:\\Windows\\system32\\DUser.dll",
        "DHCPCSVC.DLL",
        "kernel32.dll",
        "gdiplus.dll",
        "ws2_32",
        "C:\\Windows\\system32\\ole32.dll",
        "dwmapi.dll",
        "ntdll.dll",
        "ntmarta.dll",
        "shlwapi.dll",
        "C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll",
        "api-ms-win-core-synch-l1-2-0",
        "iphlpapi",
        "OLEAUT32.DLL",
        "ncrypt.dll",
        "sensapi.dll",
        "Crypt32.dll",
        "Riched20.dll",
        "C:\\Windows\\system32\\napinsp.dll",
        "C:\\Windows\\syswow64\\MSCTF.dll",
        "WININET.dll",
        "powrprof.dll",
        "C:\\Windows\\System32\\wship6.dll",
        "C:\\Windows\\SysWOW64\\bcryptprimitives.dll",
        "dnsapi",
        "KERNEL32.DLL",
        "psapi.dll",
        "cryptbase.dll",
        "WTSAPI32.dll",
        "RASMAN.DLL",
        "Iphlpapi.dll",
        "advapi32.dll",
        "api-ms-win-security-systemfunctions-l1-1-0",
        "ole32.dll",
        "SHLWAPI.dll",
        "CRYPTSP.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\DBGHELP.DLL",
        "USER32.dll",
        "IMM32.dll",
        "API-MS-Win-Security-SDDL-L1-1-0.dll",
        "API-MS-WIN-Service-winsvc-L1-1-0.dll",
        "wintrust.dll",
        "rtutils.dll",
        "IPHLPAPI.DLL",
        "C:\\Windows\\SysWOW64\\oleaut32.dll",
        "wininet.dll",
        "C:\\Windows\\system32\\xmllite.dll",
        "RASAPI32.dll",
        "OLEAUT32.dll",
        "C:\\Windows\\system32\\pnrpnsp.dll",
        "comctl32",
        "SHELL32.dll",
        "RPCRT4.dll",
        "DnsApi.dll",
        "C:\\Windows\\System32\\winrnr.dll",
        "PSAPI.DLL",
        "comctl32.dll",
        "COMCTL32.dll",
        "DUser.dll",
        "C:\\Windows\\system32\\NLAapi.dll",
        "VERSION.dll",
        "Secur32.dll",
        "api-ms-win-core-fibers-l1-1-1",
        "GDI32.dll",
        "UxTheme.dll",
        "C:\\Windows\\system32\\mswsock.dll",
        "API-MS-WIN-Service-Management-L1-1-0.dll",
        "ADVAPI32.dll",
        "advapi32",
        "SETUPAPI.dll",
        "WS2_32.dll",
        "user32.dll",
        "MSIMG32.dll"
    ],
    "file_moved": [
        [
            "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc",
            "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc.old"
        ],
        [
            "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt694F.tmp.new",
            "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt694F.tmp"
        ],
        [
            "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc.new",
            "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc"
        ],
        [
            "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat",
            "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat.old"
        ],
        [
            "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat.new",
            "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat"
        ],
        [
            "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt694F.tmp",
            "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt694F.tmp.old"
        ]
    ],
    "file_written": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt58C2.tmp",
        "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[1].txt",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\45359-utorrent.9782.dmp",
        "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[2].txt",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates.dat",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat.new",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A2B.tmp.1573254788\\index.hta.log",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt694F.tmp.new",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc.new"
    ],
    "file_recreated": [
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates.dat",
        "\\Device\\KsecDD"
    ],
    "directory_created": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A2B.tmp.1573254788",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A2B.tmp.1573254788\\HTA\\",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates\\"
    ],
    "file_failed": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\sechost.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\rasadhlp.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\msctf.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wlpk.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\nsi.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\crypt32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\ole32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\mswsock.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wuser32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\DLL\\winnsi.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\profapi.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\msasn1.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\cryptsp.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\setupapi.pdb",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\current.btskin",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\msvcrt.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\bin\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\mswsock.pdb",
        "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[1].txt",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wtsapi32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\bin\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.dbg",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\msimg32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wkernel32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\rsaenh.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wntdll.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\advapi32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\MicrosoftWindowsGdiPlus-1.1.7601.17514-gdiplus.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wininet.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wsspicli.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\DLL\\dbghelp.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\devobj.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\cfgmgr32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wrpcrt4.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\winnsi.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\DLL\\winnsi.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wininet.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\DLL\\psapi.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\ole32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\msasn1.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wship6.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\secur32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\ole32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\shlwapi.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\cryptbase.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wkernelbase.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wkernelbase.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wshtcpip.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\crypt32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\msvcrt.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\secur32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wimm32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\comctl32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\usp10.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\comdlg32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dnsapi.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\advapi32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\setupapi.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\msctf.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\dnsapi.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\userenv.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\shell32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\bcrypt.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\bcrypt.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\MicrosoftWindowsGdiPlus-1.1.7601.17514-gdiplus.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wship6.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\oleaut32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\devobj.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\devobj.pdb",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates\\sua_pmr",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\webui.zip",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wkernel32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\urlmon.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\DLL\\dbghelp.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\bcryptprimitives.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\ws2_32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wrpcrt4.pdb",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\utorrent.lng",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wintrust.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wrpcrt4.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\DLL\\wimm32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wkernel32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\nsi.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\cryptsp.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\rasadhlp.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\ws2_32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wuser32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\shell32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\DLL\\psapi.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\cryptbase.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\bin\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\version.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\bcryptprimitives.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\oleaut32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\rsaenh.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wininet.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wuser32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wgdi32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\dnsapi.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wkernelbase.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\shlwapi.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\iertutil.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wuxtheme.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wshtcpip.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\msvcrt.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\iphlpapi.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\comdlg32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wsspicli.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\userenv.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\shell32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dbghelp.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\DLL\\iphlpapi.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\ncrypt.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wntdll.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wintrust.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\advapi32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\bin\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.dbg",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wtsapi32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\msimg32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\bcryptprimitives.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\cryptbase.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\version.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wgdi32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\profapi.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\msimg32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wtsapi32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\ncrypt.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\ws2_32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\iertutil.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wlpk.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\bcrypt.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\msasn1.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wuxtheme.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wshtcpip.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\MicrosoftWindowsGdiPlus-1.1.7601.17514-gdiplus.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\comctl32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\comdlg32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\urlmon.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\setupapi.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\sechost.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\nsi.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\msctf.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\usp10.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\cfgmgr32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.dbg",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\iertutil.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\DLL\\iphlpapi.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\ncrypt.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\userenv.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\profapi.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\version.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wlpk.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\psapi.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\cfgmgr32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wsspicli.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\usp10.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\rsaenh.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\mswsock.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wgdi32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\DLL\\wimm32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\cryptsp.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\rasadhlp.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\crypt32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wintrust.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wntdll.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\comctl32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\urlmon.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\secur32.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wuxtheme.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\shlwapi.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wship6.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\sechost.pdb",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin.lang.txt",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\oleaut32.pdb"
    ],
    "resolves_host": [
        "router.utorrent.com",
        "i-50.b-000.xyz.bench.utorrent.com",
        "update.utorrent.com",
        "cuckpc",
        "router.bittorrent.com",
        "download-lb.utorrent.com",
        "wpad"
    ],
    "connects_ip": [
        "127.0.0.1"
    ],
    "file_exists": [
        "C:\\Windows\\SysWOW64\\user32.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp",
        "C:\\Windows\\SysWOW64\\sspicli.dll",
        "C:\\Windows\\System32\\WSHTCPIP.DLL",
        "C:\\Windows\\System32\\dwmapi.dll",
        "C:\\Windows\\SysWOW64\\bcryptprimitives.dll",
        "C:\\Windows\\SysWOW64\\ole32.dll",
        "C:\\Windows\\System32\\profapi.dll",
        "C:\\Windows\\System32\\qagentrt.dll",
        "C:\\Windows\\System32\\IPHLPAPI.DLL",
        "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\",
        "C:\\Windows\\System32\\wtsapi32.dll",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\current.btskin",
        "C:\\Windows\\SysWOW64\\psapi.dll",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc.new",
        "C:\\Windows\\SysWOW64\\wintrust.dll",
        "C:\\Windows\\System32\\NapiNSP.dll",
        "C:\\Windows\\System32\\rasadhlp.dll",
        "C:\\Windows\\System32\\dbghelp.dll",
        "C:\\Windows\\SysWOW64\\usp10.dll",
        "C:\\Windows\\SysWOW64\\iertutil.dll",
        "C:\\Windows\\System32\\mswsock.dll",
        "C:\\Users\\cuck\\Videos",
        "C:\\Windows\\SysWOW64\\sechost.dll",
        "C:\\Windows\\System32\\wship6.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates\\3.5.5_45359.exe",
        "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[2].txt",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
        "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5",
        "C:\\Windows\\SysWOW64\\Wldap32.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\uTorrent.exe",
        "C:\\Windows\\SysWOW64\\CRYPTBASE.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini",
        "C:\\Windows\\System32\\RpcRtRemote.dll",
        "C:\\Users\\cuck\\Music",
        "C:\\Windows\\System32\\winnsi.dll",
        "C:\\Windows\\SysWOW64\\cfgmgr32.dll",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\dht_feed.dat",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\settings.dat",
        "C:\\Windows\\SysWOW64\\shell32.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\settings.dat.old",
        "C:\\Windows\\SysWOW64\\lpk.dll",
        "C:\\Windows\\System32\\version.dll",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates.dat.old",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates.dat.new",
        "C:\\Users\\cuck\\Documents",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\dht_feed.dat.new",
        "C:\\Windows\\SysWOW64\\urlmon.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History",
        "C:\\Windows\\System32\\dnsapi.dll",
        "C:\\Windows\\SysWOW64\\ws2_32.dll",
        "C:\\Windows\\System32\\rasman.dll",
        "C:\\Windows\\System32\\p2pcollab.dll",
        "C:\\Windows\\System32\\nlaapi.dll",
        "C:\\Windows\\SysWOW64\\gdi32.dll",
        "C:\\Windows\\SysWOW64\\msasn1.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\utorrent.lng",
        "C:\\Windows\\System32\\rsaenh.dll",
        "C:\\Windows\\SysWOW64\\oleaut32.dll",
        "C:\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll",
        "C:\\Windows\\System32\\SensApi.dll",
        "C:\\Windows\\System32\\uxtheme.dll",
        "C:\\Windows\\SysWOW64\\wininet.dll",
        "C:\\Windows\\System32\\secur32.dll",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat",
        "C:\\Windows\\SysWOW64\\setupapi.dll",
        "C:\\Windows\\SysWOW64\\kernel32.dll",
        "C:\\Windows\\SysWOW64\\msvcrt.dll",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\dht_feed.dat.old",
        "C:\\Windows\\SysWOW64\\shlwapi.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat.old",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt58C2.tmp",
        "C:\\Windows\\System32\\dhcpcsvc6.DLL",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt694F.tmp.new",
        "C:\\Windows\\SysWOW64\\devobj.dll",
        "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies",
        "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\",
        "C:\\Windows\\System32\\userenv.dll",
        "C:\\Windows\\System32\\pnrpnsp.dll",
        "C:\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll",
        "C:\\Windows\\SysWOW64\\clbcatq.dll",
        "C:\\Windows\\SysWOW64\\ntdll.dll",
        "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[1].txt",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\dht.dat.old",
        "C:\\Windows\\System32\\ntmarta.dll",
        "C:\\Windows\\System32\\imm32.dll",
        "C:\\Windows\\System32\\rtutils.dll",
        "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
        "C:\\Windows\\SysWOW64\\rpcrt4.dll",
        "C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe",
        "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\",
        "C:\\Windows\\SysWOW64\\advapi32.dll",
        "C:\\Windows\\SysWOW64\\msctf.dll",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat.new",
        "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
        "C:\\Windows\\System32\\bcrypt.dll",
        "C:\\Windows\\System32\\cryptsp.dll",
        "C:\\Windows\\System32\\msimg32.dll",
        "C:\\Windows\\SysWOW64\\comdlg32.dll",
        "C:\\Windows\\SysWOW64\\nsi.dll",
        "C:\\Windows\\SysWOW64\\crypt32.dll",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates.dat",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\dht.dat.new",
        "C:\\Windows\\System32\\npmproxy.dll",
        "C:\\Windows\\System32\\powrprof.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini",
        "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files",
        "C:\\Windows\\System32\\dhcpcsvc.dll",
        "C:\\Windows\\System32\\ncrypt.dll",
        "C:\\Windows\\System32\\rasapi32.dll",
        "C:\\Windows\\System32\\winrnr.dll",
        "C:\\Windows\\System32\\riched20.dll",
        "C:\\Windows\\System32\\FWPUCLNT.DLL",
        "C:\\Windows\\System32\\netprofm.dll",
        "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\dht.dat",
        "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5",
        "C:\\Windows\\SysWOW64\\KERNELBASE.dll"
    ],
    "directory_enumerated": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\profapi.pdb\\*",
        "C:\\Windows\\SysWOW64",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\ws2_32.pdb\\*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wtsapi32.pdb\\*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\crypt32.pdb\\*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp",
        "C:\\Windows\\SysWOW64\\sspicli.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\mswsock.pdb\\*",
        "C:\\Windows\\System32\\ras\\*.pbk",
        "C:\\Windows\\System32\\WSHTCPIP.DLL",
        "C:\\Windows\\System32\\dwmapi.dll",
        "C:\\Windows\\System32\\nlaapi.dll",
        "C:\\Windows\\SysWOW64\\ole32.dll",
        "C:\\Windows\\System32\\profapi.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.dbg\\*",
        "C:\\Windows\\System32\\IPHLPAPI.DLL",
        "C:\\Windows\\System32\\wship6.dll",
        "C:\\Windows\\SysWOW64\\psapi.dll",
        "C:\\Windows\\SysWOW64\\user32.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\msasn1.pdb\\*",
        "C:\\Windows\\SysWOW64\\clbcatq.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\iertutil.pdb\\*",
        "C:\\Windows\\SysWOW64\\wintrust.dll",
        "C:\\Windows\\System32\\NapiNSP.dll",
        "C:\\ProgramData\\Microsoft\\Network\\Connections\\Pbk\\rasphone.pbk",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wintrust.pdb\\*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\iphlpapi.pdb\\*",
        "C:\\Windows\\System32\\rasadhlp.dll",
        "C:\\Windows\\System32\\dbghelp.dll",
        "C:\\Windows\\SysWOW64\\usp10.dll",
        "C:\\Windows\\SysWOW64\\iertutil.dll",
        "C:\\Windows\\System32\\mswsock.dll",
        "C:\\Windows\\SysWOW64\\sechost.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\userenv.pdb\\*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wship6.pdb\\*",
        "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*.pbk",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\rasadhlp.pdb\\*",
        "C:\\Windows\\winsxs",
        "C:\\Windows\\SysWOW64\\Wldap32.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wininet.pdb\\*",
        "C:\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll",
        "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\rasphone.pbk",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\ncrypt.pdb\\*",
        "C:\\Windows\\System32\\winnsi.dll",
        "C:\\Windows\\SysWOW64\\cfgmgr32.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\bcrypt.pdb\\*",
        "C:\\Windows\\SysWOW64\\shell32.dll",
        "C:\\Windows\\SysWOW64\\lpk.dll",
        "C:\\Windows\\System32\\version.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wsspicli.pdb\\*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wntdll.pdb\\*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\nsi.pdb\\*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\urlmon.pdb\\*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.pdb\\*",
        "C:\\Windows\\System32\\dnsapi.dll",
        "C:\\Windows\\SysWOW64\\ws2_32.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\MicrosoftWindowsGdiPlus-1.1.7601.17514-gdiplus.pdb\\*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\cryptsp.pdb\\*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\comctl32.pdb\\*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wuser32.pdb\\*",
        "C:\\Windows\\SysWOW64\\gdi32.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\rsaenh.pdb\\*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\shlwapi.pdb\\*",
        "C:\\Windows\\System32\\rsaenh.dll",
        "C:\\Windows",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\version.pdb\\*",
        "C:\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll",
        "C:\\Windows\\System32\\SensApi.dll",
        "C:\\Windows\\System32\\uxtheme.dll",
        "C:\\Windows\\SysWOW64\\wininet.dll",
        "C:\\Windows\\System32\\secur32.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wgdi32.pdb\\*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wkernelbase.pdb\\*",
        "C:\\Windows\\SysWOW64\\setupapi.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\devobj.pdb\\*",
        "C:\\Windows\\SysWOW64\\kernel32.dll",
        "C:\\Windows\\SysWOW64\\msvcrt.dll",
        "C:\\Windows\\SysWOW64\\shlwapi.dll",
        "C:\\Windows\\System32\\rasman.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\setupapi.pdb\\*",
        "C:\\Windows\\System32\\wtsapi32.dll",
        "C:\\Windows\\SysWOW64\\devobj.dll",
        "C:\\Windows\\System32\\pnrpnsp.dll",
        "C:\\Users",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\msvcrt.pdb\\*",
        "C:\\Windows\\SysWOW64\\advapi32.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dnsapi.pdb\\*",
        "C:\\Windows\\System32\\userenv.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wshtcpip.pdb\\*",
        "C:\\Windows\\SysWOW64\\ntdll.dll",
        "C:\\Users\\cuck",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\dbghelp.pdb\\*",
        "C:\\Users\\cuck\\AppData\\Local",
        "C:\\Windows\\System32\\ntmarta.dll",
        "C:\\Windows\\System32\\imm32.dll",
        "C:\\Windows\\System32\\rtutils.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\msctf.pdb\\*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wkernel32.pdb\\*",
        "C:\\Windows\\SysWOW64\\rpcrt4.dll",
        "C:\\ProgramData\\Microsoft\\Network\\Connections\\Pbk\\*.pbk",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wuxtheme.pdb\\*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\msimg32.pdb\\*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\secur32.pdb\\*",
        "C:\\Users\\cuck\\AppData",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\shell32.pdb\\*",
        "C:\\Windows\\SysWOW64\\msctf.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wrpcrt4.pdb\\*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wlpk.pdb\\*",
        "C:\\Windows\\System32\\bcrypt.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\sechost.pdb\\*",
        "C:\\Windows\\System32",
        "C:\\Windows\\System32\\cryptsp.dll",
        "C:\\Windows\\System32\\msimg32.dll",
        "C:\\Windows\\SysWOW64\\comdlg32.dll",
        "C:\\Windows\\SysWOW64\\nsi.dll",
        "C:\\Windows\\SysWOW64\\crypt32.dll",
        "C:\\Windows\\SysWOW64\\msasn1.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\winnsi.pdb\\*",
        "C:\\Windows\\System32\\npmproxy.dll",
        "C:\\Windows\\System32\\powrprof.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\usp10.pdb\\*",
        "C:\\Windows\\SysWOW64\\oleaut32.dll",
        "C:\\Windows\\System32\\dhcpcsvc.dll",
        "C:\\Windows\\System32\\ncrypt.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\cfgmgr32.pdb\\*",
        "C:\\Windows\\System32\\rasapi32.dll",
        "C:\\Windows\\SysWOW64\\urlmon.dll",
        "C:\\Windows\\System32\\winrnr.dll",
        "C:\\Windows\\System32\\riched20.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\bcryptprimitives.pdb\\*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\wimm32.pdb\\*",
        "C:\\Windows\\System32\\FWPUCLNT.DLL",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\psapi.pdb\\*",
        "C:\\Windows\\System32\\netprofm.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\comdlg32.pdb\\*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\advapi32.pdb\\*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\cryptbase.pdb\\*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\ole32.pdb\\*",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\oleaut32.pdb\\*"
    ]
}

Dropped

[
    {
        "yara": [],
        "sha1": "7a67113f4204a2bf1250402ba9b7ba457a4bae6d",
        "name": "2b1d8f74b6b7ef38_index.hta.log",
        "filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A2B.tmp.1573254788\\index.hta.log",
        "type": "ASCII text, with CRLF line terminators",
        "sha256": "2b1d8f74b6b7ef3811b62e9320953577a736ed64ab9dd5c3e2390d994a10d234",
        "urls": [],
        "crc32": "3F5BADA9",
        "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3407\/files\/2b1d8f74b6b7ef38_index.hta.log",
        "ssdeep": null,
        "size": 26,
        "sha512": "95c76090d4edb0ae45f9d6eda45a2497651f0808eecc727d4f4d5fada0c47c82080e4bf6944ad5220ec86cef80e69436cbda3a66cad607556a457c8c38f4729b",
        "pids": [
            2660
        ],
        "md5": "2b632a88af93f552846fdbf6890e8613"
    },
    {
        "yara": [],
        "sha1": "6cfc2bc8dac56ab846eb95cb92a87bb3a220b63a",
        "name": "c58493a41e17a244_settings.dat.old",
        "filepath": "c:\\users\\cuck\\appdata\\roaming\\utorrent\\settings.dat.old",
        "type": "data",
        "sha256": "c58493a41e17a2441cc12abc51ac6aba33d146d03b1d99e54dcc1bacebf6bbb4",
        "urls": [],
        "crc32": "DD67187E",
        "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3407\/files\/c58493a41e17a244_settings.dat.old",
        "ssdeep": null,
        "size": 8135,
        "sha512": "67ce09251279455c4484c4712d9801638088f5c08bee125d4247f0b9588a941db84284cd36715c3c3ce5e5ecaf1f2b18c14a7ce7189c18782417a10044fa57e3",
        "pids": [
            2660
        ],
        "md5": "d7811fd2437fe286e4e3dcd2a947392a"
    },
    {
        "yara": [],
        "sha1": "0f5436f818cab24e7966e0656cc7bbe2705a95b6",
        "name": "388fa64cc134ff0a_toolbar.benc",
        "filepath": "c:\\users\\cuck\\appdata\\roaming\\utorrent\\toolbar.benc",
        "type": "ASCII text, with no line terminators",
        "sha256": "388fa64cc134ff0a52a92edd29a113b1eeb64b28273502b456bcc3470c423f04",
        "urls": [],
        "crc32": "156E3511",
        "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3407\/files\/388fa64cc134ff0a_toolbar.benc",
        "ssdeep": null,
        "size": 240,
        "sha512": "551ceee919d8f82bf702aedff536d25977ef85e31a9479db436a2df93d56260f6d72fb9ca17b9b0f4b09a88c2c95474e36a21a2e1922c4f02dc1102e41d3bd81",
        "pids": [
            2660
        ],
        "md5": "ced9d98dc09379c6865ba13ffc220ccd"
    },
    {
        "yara": [],
        "sha1": "c77fc70f7a3e677d87982f8a33f85e9ff11c957f",
        "name": "28fe83f8a03d327b_cuck@localhost[1].txt",
        "filepath": "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[1].txt",
        "type": "ASCII text",
        "sha256": "28fe83f8a03d327b345b41ffcf01298cb3872c9c4aafce78bba9f65d68ae3bb5",
        "urls": [
            "http:\/\/localhost:0\/proxy\/0\/"
        ],
        "crc32": "1C788F26",
        "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3407\/files\/28fe83f8a03d327b_cuck@localhost[1].txt",
        "ssdeep": null,
        "size": 87,
        "sha512": "20aafa62a53408d6cd2f1ad8b76025a282adf326ea7e79aa7de550fa8a35a5a379537e6970fef51cbee39edde51c22a0cbd1ca1997b40778f0a72c1f862bb818",
        "pids": [
            2660
        ],
        "md5": "2798c0a277581da6e0f139b5ba40cd7e"
    },
    {
        "yara": [],
        "sha1": "87c45f9506d24125fd863738a4084458acfa66d8",
        "name": "b83eebaee96f5296_cuck@localhost[2].txt",
        "filepath": "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[2].txt",
        "type": "ASCII text",
        "sha256": "b83eebaee96f529604fb679fb8d527080e116ca1c3c96fd6cdbe93bba1b86468",
        "urls": [
            "http:\/\/localhost:0\/proxy\/0\/"
        ],
        "crc32": "E3C05A93",
        "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3407\/files\/b83eebaee96f5296_cuck@localhost[2].txt",
        "ssdeep": null,
        "size": 88,
        "sha512": "ba86bcd2d1e7b80177d1de60b043d08ee452a39a3dfe2902d4d44f22276c35a63c9266369910e0c9a01d197d4b6c75610515bf7f4b12cc1932cd0163a98d351b",
        "pids": [
            2660
        ],
        "md5": "c8c0ffcab74cb40b2afbdd81992b6b19"
    },
    {
        "yara": [
            {
                "meta": {
                    "description": "Contains an embedded PE32 file",
                    "author": "nex"
                },
                "name": "embedded_pe",
                "offsets": {
                    "b": [
                        [
                            4806052,
                            0
                        ],
                        [
                            5526838,
                            0
                        ],
                        [
                            5950963,
                            0
                        ]
                    ]
                },
                "strings": [
                    "VGhpcyBwcm9ncmFt"
                ]
            },
            {
                "meta": {
                    "description": "A non-Windows executable contains win32 API functions names",
                    "author": "nex"
                },
                "name": "embedded_win_api",
                "offsets": {
                    "api4": [
                        [
                            5353204,
                            9
                        ]
                    ],
                    "api5": [
                        [
                            5348748,
                            1
                        ]
                    ],
                    "api6": [
                        [
                            2980137,
                            10
                        ],
                        [
                            5182560,
                            10
                        ],
                        [
                            5349652,
                            10
                        ]
                    ],
                    "api7": [
                        [
                            2964482,
                            8
                        ],
                        [
                            2979582,
                            8
                        ],
                        [
                            2979626,
                            8
                        ],
                        [
                            2979682,
                            8
                        ],
                        [
                            2979721,
                            8
                        ],
                        [
                            3276937,
                            8
                        ],
                        [
                            3276976,
                            8
                        ],
                        [
                            3277799,
                            8
                        ],
                        [
                            3277836,
                            8
                        ],
                        [
                            5356517,
                            8
                        ],
                        [
                            5356552,
                            8
                        ],
                        [
                            5356729,
                            8
                        ]
                    ],
                    "api1": [
                        [
                            5348695,
                            0
                        ]
                    ],
                    "api2": [
                        [
                            5181900,
                            2
                        ],
                        [
                            5351065,
                            2
                        ],
                        [
                            5494800,
                            2
                        ]
                    ],
                    "api3": [
                        [
                            5181884,
                            6
                        ],
                        [
                            5351967,
                            6
                        ],
                        [
                            5494786,
                            6
                        ]
                    ],
                    "api8": [
                        [
                            5352014,
                            3
                        ]
                    ],
                    "api14": [
                        [
                            5352014,
                            3
                        ]
                    ],
                    "api12": [
                        [
                            5184200,
                            7
                        ],
                        [
                            5350060,
                            7
                        ],
                        [
                            5351526,
                            7
                        ]
                    ],
                    "api13": [
                        [
                            5349476,
                            4
                        ]
                    ],
                    "api10": [
                        [
                            5352600,
                            5
                        ]
                    ]
                },
                "strings": [
                    "Q3JlYXRlRmlsZUE=",
                    "R2V0U3lzdGVtRGlyZWN0b3J5QQ==",
                    "R2V0UHJvY0FkZHJlc3M=",
                    "R2V0V2luZG93c0RpcmVjdG9yeQ==",
                    "R2V0VGVtcFBhdGg=",
                    "SXNCYWRSZWFkUHRy",
                    "TG9hZExpYnJhcnlB",
                    "U2V0RmlsZVBvaW50ZXI=",
                    "U2hlbGxFeGVjdXRl",
                    "V2luRXhlYw==",
                    "V3JpdGVGaWxl"
                ]
            },
            {
                "meta": {
                    "description": "Matched shellcode byte patterns",
                    "author": "nex"
                },
                "name": "shellcode",
                "offsets": {
                    "shell5": [
                        [
                            2674254,
                            1
                        ],
                        [
                            2674277,
                            1
                        ],
                        [
                            2702391,
                            1
                        ],
                        [
                            5052614,
                            1
                        ],
                        [
                            5052637,
                            1
                        ]
                    ],
                    "shell6": [
                        [
                            215842,
                            2
                        ],
                        [
                            218797,
                            2
                        ],
                        [
                            219254,
                            2
                        ],
                        [
                            220091,
                            2
                        ],
                        [
                            221907,
                            2
                        ],
                        [
                            231062,
                            2
                        ],
                        [
                            231406,
                            2
                        ],
                        [
                            312609,
                            2
                        ],
                        [
                            330806,
                            2
                        ],
                        [
                            365396,
                            2
                        ],
                        [
                            374870,
                            2
                        ],
                        [
                            385507,
                            2
                        ],
                        [
                            413495,
                            2
                        ],
                        [
                            414889,
                            2
                        ],
                        [
                            417316,
                            2
                        ],
                        [
                            419274,
                            2
                        ],
                        [
                            420454,
                            2
                        ],
                        [
                            420961,
                            2
                        ],
                        [
                            421510,
                            2
                        ],
                        [
                            478291,
                            2
                        ],
                        [
                            481679,
                            2
                        ],
                        [
                            500393,
                            2
                        ],
                        [
                            504316,
                            2
                        ],
                        [
                            511118,
                            2
                        ],
                        [
                            511336,
                            2
                        ],
                        [
                            518628,
                            2
                        ],
                        [
                            519000,
                            2
                        ],
                        [
                            519410,
                            2
                        ],
                        [
                            525832,
                            2
                        ],
                        [
                            551138,
                            2
                        ],
                        [
                            552308,
                            2
                        ],
                        [
                            553632,
                            2
                        ],
                        [
                            557056,
                            2
                        ],
                        [
                            570305,
                            2
                        ],
                        [
                            570365,
                            2
                        ],
                        [
                            778146,
                            2
                        ],
                        [
                            860268,
                            2
                        ],
                        [
                            958860,
                            2
                        ],
                        [
                            959125,
                            2
                        ],
                        [
                            959217,
                            2
                        ],
                        [
                            959321,
                            2
                        ],
                        [
                            961072,
                            2
                        ],
                        [
                            964026,
                            2
                        ],
                        [
                            964081,
                            2
                        ],
                        [
                            971793,
                            2
                        ],
                        [
                            1008171,
                            2
                        ],
                        [
                            1090504,
                            2
                        ],
                        [
                            1116626,
                            2
                        ],
                        [
                            1356134,
                            2
                        ],
                        [
                            1482064,
                            2
                        ],
                        [
                            1482307,
                            2
                        ],
                        [
                            1482604,
                            2
                        ],
                        [
                            1482838,
                            2
                        ],
                        [
                            1483908,
                            2
                        ],
                        [
                            1498107,
                            2
                        ],
                        [
                            1509282,
                            2
                        ],
                        [
                            1514122,
                            2
                        ],
                        [
                            1516208,
                            2
                        ],
                        [
                            1516318,
                            2
                        ],
                        [
                            1516927,
                            2
                        ],
                        [
                            1517685,
                            2
                        ],
                        [
                            1562929,
                            2
                        ],
                        [
                            1563949,
                            2
                        ],
                        [
                            1564244,
                            2
                        ],
                        [
                            1564299,
                            2
                        ],
                        [
                            1564985,
                            2
                        ],
                        [
                            1593366,
                            2
                        ],
                        [
                            1598006,
                            2
                        ],
                        [
                            1631436,
                            2
                        ],
                        [
                            1638382,
                            2
                        ],
                        [
                            1638637,
                            2
                        ],
                        [
                            1704608,
                            2
                        ],
                        [
                            1719688,
                            2
                        ],
                        [
                            1755653,
                            2
                        ],
                        [
                            1804527,
                            2
                        ],
                        [
                            1814465,
                            2
                        ],
                        [
                            1972463,
                            2
                        ],
                        [
                            1979561,
                            2
                        ],
                        [
                            1983128,
                            2
                        ],
                        [
                            2001904,
                            2
                        ],
                        [
                            2031872,
                            2
                        ],
                        [
                            2035443,
                            2
                        ],
                        [
                            2245222,
                            2
                        ],
                        [
                            2277451,
                            2
                        ],
                        [
                            2277506,
                            2
                        ],
                        [
                            2278918,
                            2
                        ],
                        [
                            2279050,
                            2
                        ],
                        [
                            2322519,
                            2
                        ],
                        [
                            2340742,
                            2
                        ],
                        [
                            2340992,
                            2
                        ],
                        [
                            2383404,
                            2
                        ],
                        [
                            2383654,
                            2
                        ],
                        [
                            2385625,
                            2
                        ],
                        [
                            2385875,
                            2
                        ],
                        [
                            2420287,
                            2
                        ],
                        [
                            2421160,
                            2
                        ],
                        [
                            2421423,
                            2
                        ],
                        [
                            2430018,
                            2
                        ],
                        [
                            2445293,
                            2
                        ],
                        [
                            2549811,
                            2
                        ],
                        [
                            2552409,
                            2
                        ],
                        [
                            2556197,
                            2
                        ],
                        [
                            2557538,
                            2
                        ],
                        [
                            2557918,
                            2
                        ],
                        [
                            2558307,
                            2
                        ],
                        [
                            2558687,
                            2
                        ],
                        [
                            2560483,
                            2
                        ],
                        [
                            2589352,
                            2
                        ],
                        [
                            2589713,
                            2
                        ],
                        [
                            2589836,
                            2
                        ],
                        [
                            2595930,
                            2
                        ],
                        [
                            2603744,
                            2
                        ],
                        [
                            2613595,
                            2
                        ],
                        [
                            2616660,
                            2
                        ],
                        [
                            2616778,
                            2
                        ],
                        [
                            2620464,
                            2
                        ],
                        [
                            2640126,
                            2
                        ],
                        [
                            2641615,
                            2
                        ],
                        [
                            2642356,
                            2
                        ],
                        [
                            2664932,
                            2
                        ],
                        [
                            2677642,
                            2
                        ],
                        [
                            2679452,
                            2
                        ],
                        [
                            2686484,
                            2
                        ],
                        [
                            2687983,
                            2
                        ],
                        [
                            2689188,
                            2
                        ],
                        [
                            2695054,
                            2
                        ],
                        [
                            2695488,
                            2
                        ],
                        [
                            2696234,
                            2
                        ],
                        [
                            2697307,
                            2
                        ],
                        [
                            2697847,
                            2
                        ],
                        [
                            2698439,
                            2
                        ],
                        [
                            2703085,
                            2
                        ],
                        [
                            2763917,
                            2
                        ],
                        [
                            4860486,
                            2
                        ],
                        [
                            4878150,
                            2
                        ],
                        [
                            4950054,
                            2
                        ],
                        [
                            4960681,
                            2
                        ],
                        [
                            4960944,
                            2
                        ],
                        [
                            4962779,
                            2
                        ],
                        [
                            4981679,
                            2
                        ],
                        [
                            4983095,
                            2
                        ],
                        [
                            4983475,
                            2
                        ],
                        [
                            4983864,
                            2
                        ],
                        [
                            4985647,
                            2
                        ],
                        [
                            5001154,
                            2
                        ],
                        [
                            5001272,
                            2
                        ],
                        [
                            5004975,
                            2
                        ],
                        [
                            5012792,
                            2
                        ],
                        [
                            5025184,
                            2
                        ],
                        [
                            5026673,
                            2
                        ],
                        [
                            5027414,
                            2
                        ],
                        [
                            5047153,
                            2
                        ],
                        [
                            5054142,
                            2
                        ],
                        [
                            5055347,
                            2
                        ],
                        [
                            5062244,
                            2
                        ],
                        [
                            5062678,
                            2
                        ],
                        [
                            5063424,
                            2
                        ],
                        [
                            5064497,
                            2
                        ],
                        [
                            5065037,
                            2
                        ],
                        [
                            5065629,
                            2
                        ],
                        [
                            5068459,
                            2
                        ],
                        [
                            5076504,
                            2
                        ]
                    ],
                    "shell7": [
                        [
                            580267,
                            0
                        ],
                        [
                            2416502,
                            0
                        ],
                        [
                            2416954,
                            0
                        ],
                        [
                            2416979,
                            0
                        ],
                        [
                            2429313,
                            0
                        ],
                        [
                            2499258,
                            0
                        ],
                        [
                            2499452,
                            0
                        ],
                        [
                            2517019,
                            0
                        ],
                        [
                            2582551,
                            0
                        ],
                        [
                            2587526,
                            0
                        ],
                        [
                            2622730,
                            0
                        ],
                        [
                            4880486,
                            0
                        ],
                        [
                            4944438,
                            0
                        ],
                        [
                            4959885,
                            0
                        ],
                        [
                            4960293,
                            0
                        ],
                        [
                            4960318,
                            0
                        ],
                        [
                            4971199,
                            0
                        ],
                        [
                            5015902,
                            0
                        ],
                        [
                            5020524,
                            0
                        ]
                    ],
                    "shell2": [
                        [
                            2582563,
                            3
                        ],
                        [
                            5020536,
                            3
                        ]
                    ]
                },
                "strings": [
                    "VYvs6A==",
                    "VYvsg8Q=",
                    "VYvsgew=",
                    "ZKEw"
                ]
            }
        ],
        "sha1": "30cc41cdcb90c7db5fb64bc83195db795050c53c",
        "name": "af630faf330232d7_45359-utorrent.9782.dmp",
        "filepath": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\45359-utorrent.9782.dmp",
        "type": "MDMP crash report data",
        "sha256": "af630faf330232d7e301a84a2061a1347c287164ec8c40abee991f1985818538",
        "urls": [
            "http:\/\/btinstall-artifacts.bittorrent.com",
            "http:\/\/www.utorrent.com\/help\/guides\/rss",
            "http:\/\/www.utorrent.com0",
            "https:\/\/utclient.utorrent.com\/client-user-onboarding\/second-entry-index.html",
            "http:\/\/www.facebook.com\/dialog\/oauth",
            "http:\/\/www.apple.com\/itunes",
            "http:\/\/sv.symcb.com\/sv.crl0a",
            "http:\/\/certificates.godaddy.com\/repository100.",
            "https:\/\/rebrand.ly\/368mel?type=%s-%U",
            "http:\/\/ns.adobe.com\/xap\/1.0\/mm\/",
            "http:\/\/www.bittorrent.com\/legal\/eula",
            "http:\/\/update.bittorrent.com\/time.php",
            "https:\/\/d.symcb.com\/rpa0",
            "http:\/\/trontv.com",
            "http:\/\/www.symauth.com\/cps0(",
            "http:\/\/update.utorrent.com\/speedserverlist.php",
            "http:\/\/www.utorrent.com",
            "http:\/\/ocsp.godaddy.com\/0J",
            "http:\/\/help.bittorrent.com",
            "http:\/\/cdn.ap.bittorrent.com\/control\/tags\/staging_ut.json",
            "http:\/\/www.utorrent.com.",
            "http:\/\/sv.symcd.com0",
            "http:\/\/utorrent.com\/testport?plain=1",
            "http:\/\/i-45.b-",
            "http:\/\/certificates.godaddy.com\/repository\/gd_intermediate.crt0",
            "http:\/\/www.facebook.com\/connect\/login_success.html",
            "http:\/\/www.facebook.com\/login.php",
            "https:\/\/www.facebook.com\/connect\/uiserver.php",
            "http:\/\/www.entrust.net\/rpa03",
            "http:\/\/download-lb.utorrent.com\/",
            "http:\/\/events.bittorrentILE",
            "http:\/\/crl.godaddy.com\/gds1-14.crl0S",
            "http:\/\/events.bittorrent.com\/startConversion",
            "http:\/\/cdn.ap.bittorrent.com\/control\/feature\/tags\/staging_bt.json",
            "https:\/\/www.facebook.com\/dialog\/permissions.request",
            "http:\/\/utclient.utorrent.com\/offers\/onboarding-basic\/i18n\/en\/ads-offer.html",
            "https:\/\/utclient.utorrent.com\/client-user-onboarding\/index.html",
            "https:\/\/d.symcb.com\/cps0%",
            "http:\/\/www.bittorrent.com\/legal\/privacy",
            "http:\/\/utclient.utorrent.com\/badads-feedback\/index.html",
            "http:\/\/update.utorrent.com\/streamstats.php",
            "http:\/\/portforward.com\/",
            "http:\/\/update.utorrent.com\/installoffer.php",
            "http:\/\/trontv.com\/",
            "http:\/\/utorrent.com\/prodnews",
            "http:\/\/bundles.bittorrent.com\/feed.rss",
            "http:\/\/ocsp.entrust.net02",
            "http:\/\/yogi.apps.bittorrent.com\/track\/?data=%s",
            "http:\/\/utorrent.com\/webui-guide.php",
            "http:\/\/ns.adobe.com\/xap\/1.0\/sType\/ResourceRef",
            "http:\/\/schemas.xmlsoap.org\/soap\/encoding\/",
            "http:\/\/www.facebook.com\/utorrent",
            "http:\/\/report.bittorrent.com",
            "http:\/\/download.utorrent.com\/help\/utorrent-help-3550.zip",
            "http:\/\/tinyurl.com\/api-create.php?url=%U",
            "http:\/\/www.symauth.com\/rpa00",
            "http:\/\/apps.bittorrent.com\/utorrent-onboarding\/player.btapp",
            "https:\/\/www.facebook.com\/connect\/login_success.html",
            "http:\/\/ocsp.entrust.net03",
            "https:\/\/activate.utorrent.com",
            "http:\/\/cdn.ap.bittorrent.com\/control\/feature\/tags\/ut.json",
            "http:\/\/www.utorrent.com\/faq",
            "http:\/\/cdn.ap.bittorrent.com\/control\/tags\/bt.json",
            "https:\/\/www.globalsign.com\/repository\/0",
            "http:\/\/www.utorrent.com\/pro\/?x-source=myproacct",
            "http:\/\/utorrent.com\/download\/langpacks\/dl.php?build=45359",
            "http:\/\/help.utorrent.com\/customer\/portal\/articles\/257678",
            "http:\/\/crl.godaddy.com\/gds1-82.crl0S",
            "http:\/\/s2.symcb.com0",
            "http:\/\/svr-ov-crl.thawte.com\/ThawteOV.crl0",
            "http:\/\/utclient.utorrent.com\/pro\/utorrent\/index.html",
            "http:\/\/remote.utorrent.com\/send?btih=",
            "http:\/\/update.utorrent.com\/speedstats.php?result=",
            "http:\/\/dslreports.com\/speedtest\/",
            "http:\/\/crl.globalsign.net\/root.crl0",
            "http:\/\/search.conduit.com\/Results.aspx?ctid=CT3083945",
            "http:\/\/www.entrust.net\/rpa0",
            "http:\/\/certificates.godaddy.com\/repository\/0",
            "http:\/\/sv.symcb.com\/sv.crt0",
            "http:\/\/twitter.com\/utorrent",
            "http:\/\/play-artifacts.bittorrent.com",
            "http:\/\/crl.entrust.net\/2048ca.crl0",
            "http:\/\/cdn.ap.bittorrent.com\/control\/tags\/staging_bt.json",
            "https:\/\/www.globalsign.com\/repository\/03",
            "http:\/\/crl.entrust.net\/ts1ca.crl0",
            "http:\/\/www.trontv.com\/network\/default.html",
            "http:\/\/aia.entrust.net\/ts1-chain256.cer01",
            "http:\/\/ll.www.bittorrent.com\/llspeedtest\/",
            "http:\/\/pr.apps.bittorrent.com\/client-webui\/%s\/client-webui.json",
            "http:\/\/apps.bittorrent.com",
            "http:\/\/secure.globalsign.com\/cacert\/gstimestampingg2.crt0",
            "http:\/\/localhost:0\/proxy\/0\/",
            "http:\/\/remote.utorrent.com\/",
            "http:\/\/www.utorrent.com\/faq?client=%s%s",
            "http:\/\/www.utorrent.com\/testport.php?port=%d",
            "http:\/\/www.facebook.com\/checkpoint\/",
            "http:\/\/cdn.ap.bittorrent.com\/control\/feature\/tags\/bt.json",
            "https:\/\/www.surveymonkey.com\/s\/C2VFYPC",
            "https:\/\/www.facebook.com\/dialog\/apprequests",
            "http:\/\/forum.utorrent.com",
            "http:\/\/localhost",
            "http:\/\/cdn.ap.bittorrent.com\/control\/feature\/tags\/staging_ut.json",
            "http:\/\/s1.symcb.com\/pca3-g5.crl0",
            "http:\/\/cdn.ap.bittorrent.com\/conl",
            "http:\/\/www.facebook.com\/connect\/uiserver.php",
            "http:\/\/play-artifacts.staging.bittorrent.com",
            "http:\/\/www.google-analytics.com",
            "http:\/\/i-",
            "http:\/\/cdn.ap.bittorrent.com\/control\/tags\/ut.json",
            "http:\/\/cdn.bitmedianetwork.com\/network\/index.html",
            "http:\/\/ll.www.bittorrent.com\/llspeedtest\/speedtestobjects.txt",
            "http:\/\/beta.",
            "http:\/\/schemas.xmlsoap.org\/soap\/envelope\/",
            "http:\/\/search.utorrent.com\/bntop.html",
            "https:\/\/gearbox.bittorrent.com",
            "http:\/\/ocsp.thawte.com0",
            "http:\/\/www.bittorrent.com\/certified-devices\/",
            "http:\/\/btinstall-artifacts.staging.bittorrent.com",
            "https:\/\/www.facebook.com\/checkpoint\/",
            "http:\/\/ns.adobe.com\/xap\/1.0\/",
            "https:\/\/www.facebook.com\/login.php",
            "https:\/\/www.facebook.com\/dialog\/oauth",
            "http:\/\/beta.bundles.bittorrent.com\/feed.rss",
            "http:\/\/www.facebook.com\/dialog\/permissions.request",
            "http:\/\/crl.globalsign.com\/gs\/gstimestampingg2.crl0T",
            "http:\/\/crl.thawte.com\/ThawteServerPremiumCA.crl0",
            "http:\/\/apps.bittorrent.com\/conduit\/eula\/ByChoosingToInstall.html"
        ],
        "crc32": "0A200E1A",
        "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3407\/files\/af630faf330232d7_45359-utorrent.9782.dmp",
        "ssdeep": null,
        "size": 6036886,
        "sha512": "ce775ba819fea0c10b97dea05ee2b209e95b605cca4872d4f46682fb6d65ee196a8aa00aba3e6411cdd9b8badf496b7010d33a835875463d5d74e381e43632b6",
        "pids": [
            2660
        ],
        "md5": "567af612c2416023f952a044cb6f1c40"
    },
    {
        "yara": [],
        "sha1": "bc46aa43a8f4a8dbf4d02d76dc8baf37e799214a",
        "name": "7ff4b1972651dbb6_updates.dat",
        "filepath": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates.dat",
        "type": "ASCII text, with very long lines, with no line terminators",
        "sha256": "7ff4b1972651dbb63c7f50fdab9c936d2fde441ab6d9745fd6c0aef93566b7ed",
        "urls": [],
        "crc32": "7B2EEE5E",
        "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3407\/files\/7ff4b1972651dbb6_updates.dat",
        "ssdeep": null,
        "size": 343,
        "sha512": "6a2158841a90c83249c7807c0e09648c0f822e4a5a231bf6d0b9df75afec52ccbba37f00b802e1fa78dd84532e72584a85ec3b3d785cab8acc8cd022f8d77b3e",
        "pids": [
            2660
        ],
        "md5": "96a9ba5323729940343bc20454a72de3"
    },
    {
        "yara": [],
        "sha1": "87f04711a2cd3551517cf35c862e0ba251da6038",
        "name": "10d813f22c0c5692_settings.dat",
        "filepath": "c:\\users\\cuck\\appdata\\roaming\\utorrent\\settings.dat",
        "type": "data",
        "sha256": "10d813f22c0c5692174b5304ab3b5266cfcfad5313b122bbac95f55bdd3e2193",
        "urls": [],
        "crc32": "58D7C160",
        "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3407\/files\/10d813f22c0c5692_settings.dat",
        "ssdeep": null,
        "size": 8198,
        "sha512": "8954e2c7aedb7aaf6b35e570d05e4a1f880bf6ea32984d5d5bbf4856bef2e9c923b3208c86b6df7f7ae85941d2bae13dde7cb3282d62cc97bcc358fd057b97dd",
        "pids": [
            2660
        ],
        "md5": "de9f7bde1822d0364df8bded294f7ad2"
    },
    {
        "yara": [],
        "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
        "name": "e3b0c44298fc1c14_utt58C2.tmp",
        "type": "empty",
        "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
        "urls": [],
        "crc32": "00000000",
        "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/3407\/files\/e3b0c44298fc1c14_utt58C2.tmp",
        "ssdeep": null,
        "size": 0,
        "sha512": "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e",
        "md5": "d41d8cd98f00b204e9800998ecf8427e"
    }
]

Generic

[
    {
        "process_path": "C:\\Windows\\System32\\lsass.exe",
        "process_name": "lsass.exe",
        "pid": 476,
        "summary": {},
        "first_seen": 1573253587.3438,
        "ppid": 376
    },
    {
        "process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
        "process_name": "8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
        "pid": 2660,
        "summary": {
            "file_opened": [
                "C:\\Windows\\System32\\FWPUCLNT.DLL",
                "C:\\Windows\\System32\\mswsock.dll",
                "C:\\",
                "C:\\Windows\\SysWOW64\\wininet.dll",
                "C:\\Windows\\SysWOW64\\user32.dll",
                "C:\\Windows\\SysWOW64\\advapi32.dll",
                "C:\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll",
                "C:\\Windows\\SysWOW64\\setupapi.dll",
                "C:\\Windows\\SysWOW64\\msasn1.dll",
                "C:\\Windows\\SysWOW64\\sspicli.dll",
                "C:\\Windows\\System32\\RpcRtRemote.dll",
                "C:\\Windows\\System32\\riched20.dll",
                "C:\\Windows\\System32\\powrprof.dll",
                "C:\\Windows\\SysWOW64\\kernel32.dll",
                "C:\\Windows\\SysWOW64\\msvcrt.dll",
                "C:\\Windows\\System32\\winnsi.dll",
                "C:\\Windows\\SysWOW64\\shlwapi.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
                "C:\\Windows\\SysWOW64\\cfgmgr32.dll",
                "C:\\Windows\\System32\\secur32.dll",
                "C:\\Windows\\System32\\cryptsp.dll",
                "C:\\Windows\\SysWOW64\\bcryptprimitives.dll",
                "C:\\Windows\\System32\\dbghelp.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt58C2.tmp",
                "C:\\Windows\\System32\\dwmapi.dll",
                "C:\\Windows\\SysWOW64\\CRYPTBASE.dll",
                "C:\\Windows\\System32\\dhcpcsvc6.DLL",
                "C:\\Windows\\SysWOW64\\ole32.dll",
                "C:\\Windows\\SysWOW64\\nsi.dll",
                "C:\\Windows\\System32\\profapi.dll",
                "C:\\Windows\\SysWOW64\\crypt32.dll",
                "C:\\Windows\\System32\\IPHLPAPI.DLL",
                "C:\\Windows\\System32\\bcrypt.dll",
                "C:\\Windows\\System32\\wship6.dll",
                "C:\\Windows\\SysWOW64\\psapi.dll",
                "C:\\Windows\\System32\\wtsapi32.dll",
                "C:\\Windows\\SysWOW64\\shell32.dll",
                "C:\\Windows\\SysWOW64\\lpk.dll",
                "C:\\Windows\\System32\\version.dll",
                "C:\\Windows\\SysWOW64\\en-US\\WININET.dll.mui",
                "C:\\Windows\\System32\\rasadhlp.dll",
                "C:\\Windows\\SysWOW64\\wintrust.dll",
                "C:\\Windows\\System32\\NapiNSP.dll",
                "C:\\Windows\\SysWOW64\\devobj.dll",
                "C:\\Windows\\System32\\npmproxy.dll",
                "C:\\Windows\\System32\\userenv.dll",
                "C:\\Windows\\System32\\pnrpnsp.dll",
                "C:\\Windows\\System32\\rasman.dll",
                "C:\\Windows\\SysWOW64\\msctf.dll",
                "C:\\Windows\\System32\\SensApi.dll",
                "C:\\Windows\\SysWOW64\\clbcatq.dll",
                "C:\\Windows\\System32\\dhcpcsvc.dll",
                "C:\\Windows\\SysWOW64\\urlmon.dll",
                "C:\\Windows\\System32\\ncrypt.dll",
                "C:\\Windows\\SysWOW64\\ntdll.dll",
                "C:\\Windows\\SysWOW64\\usp10.dll",
                "C:\\Windows\\System32\\dnsapi.dll",
                "C:\\Windows\\SysWOW64\\iertutil.dll",
                "C:\\Windows\\SysWOW64\\ws2_32.dll",
                "C:\\Windows\\System32\\rasapi32.dll",
                "C:\\Windows\\SysWOW64\\gdi32.dll",
                "C:\\Windows\\SysWOW64\\sechost.dll",
                "C:\\Windows\\System32\\winrnr.dll",
                "C:\\Windows\\System32\\msimg32.dll",
                "C:\\Windows\\System32\\ntmarta.dll",
                "C:\\Windows\\SysWOW64\\comdlg32.dll",
                "C:\\Windows\\System32\\imm32.dll",
                "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[1].txt",
                "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
                "C:\\Windows\\System32\\rtutils.dll",
                "C:\\Windows\\System32\\netprofm.dll",
                "C:\\Windows\\System32\\imageres.dll",
                "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[2].txt",
                "C:\\Windows\\SysWOW64\\rpcrt4.dll",
                "C:\\Windows\\System32\\WSHTCPIP.DLL",
                "C:\\Windows\\System32\\rsaenh.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
                "C:\\Windows\\SysWOW64\\oleaut32.dll",
                "C:\\Windows\\SysWOW64\\Wldap32.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat",
                "C:\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll",
                "C:\\Windows\\System32\\nlaapi.dll",
                "C:\\Windows\\SysWOW64\\KERNELBASE.dll",
                "C:\\Windows\\System32\\uxtheme.dll"
            ],
            "regkey_opened": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PropertyBag",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\CertCheck\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
                "HKEY_LOCAL_MACHINE\\Software\\Wine",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562",
                "HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.44.3.4!7",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\TrustedPublisher\\Safer",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_EXCLUDE_INVALID_CLIENT_CERT_KB929477",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DnsClient",
                "HKEY_CLASSES_ROOT\\CLSID\\{05eeb91a-aef7-4f8a-978f-fb83e7b03f8e}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_ALLOW_LONG_INTERNATIONAL_FILENAMES",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\0",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-internet-signup",
                "HKEY_CLASSES_ROOT\\CLSID\\{ef79f67a-6ad7-4715-a0f8-932fca442023}",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_DISABLE_NOTIFY_UNVERIFIED_SPN_KB2385266",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Internet Explorer",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Internet Explorer",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\History",
                "HKEY_CURRENT_USER\\Software\\Wine",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\uTorrent",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_UNC_SAVEDFILECHECK",
                "HKEY_LOCAL_MACHINE\\Software",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\ietld",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllEncodeObject",
                "HKEY_CLASSES_ROOT\\CLSID\\{49C795C2-604A-4D18-AEB1-B3EBA27E5EA2}",
                "HKEY_CLASSES_ROOT\\CLSID\\{1d03a978-ac0c-4004-b9fd-9cf361c7bd3f}",
                "HKEY_CLASSES_ROOT\\CLSID\\{2d8d9acc-f6d7-4362-8876-a275ca929591}",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\feedplat",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-ns-proxy-autoconfig",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptCNGPKCS12GetMap",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\Signature\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Content",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0",
                "HKEY_CLASSES_ROOT\\CLSID\\{ad06fb5f-fef7-4a84-8c58-dca34f8e3d36}",
                "HKEY_CLASSES_ROOT\\CLSID\\{656461ef-40f6-4115-9ff1-bced9812ccbb}",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllEncodeObjectEx",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\PFX",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\Initialization\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_RETURN_FAILED_CONNECT_CONTENT_KB942615",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\3",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Ranges\\",
                "HKEY_CURRENT_USER\\Software\\Classes\\FalconBetaAccount",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PropertyBag",
                "HKEY_CURRENT_USER\\Software\\BitTorrent",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo",
                "HKEY_CLASSES_ROOT\\CLSID\\{D4027C7F-154A-4066-A1AD-4243D8127440}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\msasn1",
                "HKEY_CURRENT_USER\\Interface\\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\1",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\PrivacIE:",
                "HKEY_CURRENT_USER\\Interface\\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Security",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_USE_UTF8_FOR_BASIC_AUTH_KB967545",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\LDAP",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\DnsCache\\Parameters",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2008",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2009",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2004",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2005",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2006",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2007",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2000",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2001",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2002",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2003",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
                "HKEY_CLASSES_ROOT\\CLSID\\{3041D03E-FD4B-44E0-B742-2D9B88305F98}",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\4",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\RASAPI32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip6\\Parameters\\Winsock",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3",
                "HKEY_CLASSES_ROOT\\AutoProxyTypes",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\SystemCertificates\\TrustedPublisher\\Safer",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.15",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.11",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.10",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.12",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\Security",
                "HKEY_LOCAL_MACHINE\\System\\Setup",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.16.4",
                "HKEY_CURRENT_USER\\Software\\Policies",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\DOMStore",
                "HKEY_CLASSES_ROOT\\CLSID\\{7473B6BD-4691-4744-A82B-7854EB3D70B6}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.1.1",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\WinTrust\\Trust Providers\\Software Publishing",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\KnownClasses",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings",
                "HKEY_CLASSES_ROOT\\CLSID\\{181f104b-b000-4010-bb18-41b8205f774d}",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Cookies",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Wpad",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_BUFFERBREAKING_818408",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\\ProxyStubClsid32",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\1",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\0",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\4",
                "HKEY_CLASSES_ROOT\\CLSID\\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\2",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\0",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\1",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllEncodePublicKeyAndParameters",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject",
                "HKEY_CLASSES_ROOT\\CLSID\\{c840e246-6b95-475e-9bd7-caa1c7eca9f2}",
                "HKEY_CLASSES_ROOT\\CLSID\\{db131c55-60c8-4adc-84dc-9e76ab06e2dc}",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN",
                "HKEY_CURRENT_USER\\Software\\uTorrentPurchases\\PurchasedKeys",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\Certificate\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
                "HKEY_CURRENT_USER\\Interface\\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptCNGInitHMAC",
                "HKEY_CURRENT_USER\\Interface\\{55272A00-42CB-11CE-8135-00AA004BB851}",
                "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\TreatAs",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2221",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2222",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\Message\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\\ProxyStubClsid32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\RETRY_HEADERONLYPOST_ONCONNECTIONRESET",
                "HKEY_CLASSES_ROOT\\CLSID\\{4ae0c3d6-f713-4eed-bc65-25dc3ffdaac1}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}",
                "HKEY_CURRENT_USER\\Software\\BitTorrentPersist",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\History",
                "HKEY_CURRENT_USER\\Software\\BitTorrent\\uTorrent",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\RASMANCS",
                "HKEY_CLASSES_ROOT\\CLSID\\{e0301295-ab3e-4af3-979f-3d453c5f9f48}",
                "HKEY_CLASSES_ROOT\\CLSID\\{7b6de06c-7013-4a87-957e-d27d7b977d21}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Cookies",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019040920190410",
                "HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\Progid",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.30",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocHandler32",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Winsock\\Setup Migration\\Providers",
                "HKEY_CURRENT_USER\\Software\\uTorrentPlus",
                "HKEY_CLASSES_ROOT\\CLSID\\{91397D20-1446-11D4-8AF4-0040CA1127B6}",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001",
                "HKEY_CURRENT_USER\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_DISALLOW_NULL_IN_RESPONSE_HEADERS",
                "HKEY_CLASSES_ROOT\\CLSID\\{6DA66498-839A-42A7-8324-FF7D2A532835}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocHandler",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\LayoutIcon\\0409\\0000041d",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.47.1.1!7",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProtocolDefaults\\",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_COMPAT_USE_CONNECTION_BASED_NEGOTIATE_AUTH_KB2151543",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Shell\\RegisteredApplications\\UrlAssociations\\http\\OpenWithProgids",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\DirectUI",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\4",
                "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle",
                "HKEY_CLASSES_ROOT\\CLSID\\{F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_USE_CNAME_FOR_SPN_KB911149",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\3",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_CLASSES_ROOT\\.torrent",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Content",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\2",
                "HKEY_LOCAL_MACHINE\\Software\\Policies",
                "HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\shell\\open",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{55272A00-42CB-11CE-8135-00AA004BB851}\\ProxyStubClsid32",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\DiagnosticPolicy\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.47.1.1!7",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\\ProxyStubClsid32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice",
                "HKEY_CURRENT_USER\\Software\\AppDataLow\\Software\\Search Protection",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptCNGInitHMAC",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_DIGEST_NO_EXTRAS_IN_URI",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\TrustedPublisher\\Safer",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\",
                "HKEY_CURRENT_USER\\Software",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.16.1.1",
                "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Network\\Location Awareness",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.28",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",
                "HKEY_CLASSES_ROOT\\CLSID\\{03ea5b10-2efa-4311-ac10-04427b02d663}",
                "HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\CurVer",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.25",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.26",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.27",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.20",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_UNC_SAVEDFILECHECK",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.2.11",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllExportPrivateKeyInfoEx",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.2.12",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\2",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\LSA\\AccessProviders",
                "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptCNGPKCS12GetMap",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Ranges\\",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_CLASSES_ROOT\\CLSID\\{B6AC5E3C-5CEB-4E72-B451-F0E1BA983C14}",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\Cleanup\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
                "HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\shell\\open\\command",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\crypt32",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip6",
                "HKEY_CURRENT_USER\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}",
                "HKEY_CLASSES_ROOT\\FirefoxURL-E7CF176E110C211B",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.2.4",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OleAut",
                "HKEY_CLASSES_ROOT\\CLSID\\{4E871705-D1F3-49D9-814F-1E46E85986B0}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.2.1",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_SECURITY_FLAG_IGNORE_REVOCATION_KB2275828",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.2.3",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.2.2",
                "HKEY_CLASSES_ROOT\\CLSID\\{87775fdb-6972-41f9-ae51-8326e38cb206}",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_USE_IETLDLIST_FOR_DOMAIN_DETERMINATION",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Layers",
                "HKEY_CLASSES_ROOT\\CLSID\\{5BA8E555-8C08-4CC8-80E6-1F8CDD26AE3A}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodePublicKeyAndParameters",
                "HKEY_CLASSES_ROOT\\CLSID\\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_MIME_HANDLING",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\Progid",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllExportPrivateKeyInfoEx",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_INCLUDE_PORT_IN_SPN_KB908209",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2130",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.4",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\\ProxyStubClsid32",
                "HKEY_CLASSES_ROOT\\CLSID\\{29acf17c-1713-4286-8f40-bfd05f1e70c8}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{3697C5FA-60DD-4B56-92D4-74A569205C16}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Winsock\\Parameters",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Ranges\\",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.44.3.4!7",
                "HKEY_CLASSES_ROOT\\CLSID\\{e9df9360-97f8-4690-afe6-996c80790da4}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_CURRENT_USER",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache",
                "HKEY_CLASSES_ROOT\\CLSID\\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\",
                "HKEY_CURRENT_USER\\Software\\Classes\\.torrent",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Layers",
                "HKEY_CLASSES_ROOT\\CLSID\\{1fd59ce2-6236-467c-9539-3d8c93fea5e0}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.12.2.1",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.12.2.2",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PropertyBag",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_ENABLE_PASSPORT_SESSION_STORE_KB948608",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\3",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_RELEASE_KEYS_ON_UNLOAD_KB975619",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}"
            ],
            "fetches_url": [
                "http:\/\/update.utorrent.com\/installstats.php?cl=uTorrent&v=111849775&h=r5l-vgQJK7gnDD9k&w=1DB10106&bu=0&pr=0&cmp=0&ocmp=0&showtbexists&pid=2660&cau=0&tbe=0&cd=0&view=win32",
                "http:\/\/update.utorrent.com\/installoffer.php?h=r5l-vgQJK7gnDD9k&v=111849775&w=1DB10106&l=en&c=US&w64=1&db=firefox&cl=uTorrent&tsub=1&svp=4",
                "http:\/\/update.utorrent.com\/installstats.php?cl=uTorrent&v=111849775&h=r5l-vgQJK7gnDD9k&w=1DB10106&bu=0&pr=0&cmp=0&ocmp=0&showinstall&pid=2660&cau=0&au=0&view=win32",
                "http:\/\/update.utorrent.com\/installstats.php?cl=uTorrent&v=111849775&h=r5l-vgQJK7gnDD9k&w=1DB10106&bu=0&pr=0&cmp=0&ocmp=0&showwarning&pid=2660&cau=0&view=win32"
            ],
            "guid": [
                "{a47979d2-c419-11d9-a5b4-001185ad2b89}",
                "{dcb00c01-570f-4a9b-8d69-199fdba5723b}",
                "{dcb00000-570f-4a9b-8d69-199fdba5723b}",
                "{d0074ffd-570f-4a9b-8d69-199fdba5723b}"
            ],
            "file_deleted": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt694F.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt58C2.tmp",
                "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[1].txt",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A2B.tmp"
            ],
            "regkey_written": [
                "HKEY_CURRENT_USER\\Software\\BitTorrent\\computerID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\EnableFileTracing",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\EnableConsoleTracing",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\EnableConsoleTracing",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadNetworkName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\FileDirectory",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\FileTracingMask",
                "HKEY_CURRENT_USER\\FalconBetaAccount\\remote_access_client_id",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\MaxFileSize",
                "HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\LanguageList",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\FileTracingMask",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\ConsoleTracingMask",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\FileDirectory",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyEnable",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\EnableFileTracing",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionReason",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecision",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\ConsoleTracingMask",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\MaxFileSize",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionTime",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadLastNetwork",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\SavedLegacySettings"
            ],
            "file_copied": [
                [
                    "C:\\Users\\cuck\\AppData\\Local\\Temp\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
                    "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates\\3.5.5_45359.exe"
                ]
            ],
            "connects_host": [
                "i-41.b-45359.bench.utorrent.com"
            ],
            "regkey_deleted": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyOverride",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL"
            ],
            "mutex": [
                "Local\\\u00b5Torrent4823DF041B09",
                "Local\\ZonesCounterMutex",
                "RasPbFile",
                "Local\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
                "Local\\ZoneAttributeCacheCounterMutex",
                "Local\\ZonesLockedCacheCounterMutex",
                "IESQMMUTEX_0_208",
                "Local\\ZonesCacheCounterMutex"
            ],
            "file_read": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\StreamResourceType",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\SspiCli.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Initialization\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\ParsingName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\System32\\wshtcpip.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Cookies\\CacheLimit",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\SysWOW64\\sechost.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Signature\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\ScavengeCacheFileLifeTime",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CertificateRevocation",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.44.3.4!7\\Name",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\crypt32\\DiagMatchAnyMask",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\ietld\\CachePrefix",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoProxyDetectType",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\StreamResource",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\InfoTip",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019040920190410\\CacheRepair",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\CertCheck\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\DOMStore\\CachePrefix",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ConnectTimeOut",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\ParsingName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledProcesses\\3997CE90",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\BypassSSLNoCacheCheck",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerProxy",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7\\Name",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\FolderTypeID",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyEnable",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\NSI.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Cookies\\PerUserItem",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\EnableConsoleTracing",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\LocalizedName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-ns-proxy-autoconfig\\FileExtensions",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN\\*",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001\\ProfileImagePath",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0\\Flags",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\History\\PerUserItem",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\HttpDefaultExpiryTimeSecs",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\EnableFileTracing",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Users\\cuck\\AppData\\Local\\Temp\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\ietld\\CacheRepair",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Signature",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableNTLMPreAuth",
                "HKEY_CURRENT_USER\\Software\\BitTorrent\\computerID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\\ProxyStubClsid32\\(Default)",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\NoNetAutodial",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\RpcRtRemote.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019040920190410\\CachePrefix",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableWorkerThreadHibernation",
                "HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@%SystemRoot%\\system32\\p2pcollab.dll,-8042",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CacheMode",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnOnHTTPSToHTTPRedirect",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019040920190410\\CacheLimit",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ScavengeCacheLowerBound",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DialupUseLanSettings",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Description",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SecureProtocols",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\FileTracingMask",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Personal",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\MaxSockaddrLength",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DialupUseLanSettings",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2\\Flags",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\ParentFolder",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip6\\WinSock 2.0 Provider ID",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld\\IETldDllVersionLow",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\CLBCatQ.DLL",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnOnZoneCrossing",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\CertCheck\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\InprocServer32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ShareCredsWithWinHttp",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Stream",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableBranchCache",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\crypt32\\DiagLevel",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\feedplat\\CacheRepair",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\EnableConsoleTracing",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld\\IETldDllVersionHigh",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\msvcrt.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\SysWOW64\\ntdll.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MigrateProxy",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnOnPost",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\\ProxyStubClsid32\\(Default)",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableNegotiate",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\System32\\winrnr.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\MSIMG32.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\IMM32.DLL",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\GlobalUserOffline",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\DOMStore\\CachePath",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.47.1.1!7\\Name",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\napinsp.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\VERSION.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AlwaysDrainOnRedirect",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\DOMStore\\CacheLimit",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}\\Enable",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SendTimeOut",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SendTimeOut",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Category",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\SETUPAPI.dll",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\WS2_32.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyHttp1.1",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Description",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-internet-signup\\Flags",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableHttp1_1",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\InitFolderHandler",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\UseOldHostResolutionOrder",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\DEVOBJ.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\FolderTypeID",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SecureProtocols",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\PrivacIE:\\CachePrefix",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalizedName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Category",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\RASAPI32.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParentFolder",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ReceiveTimeOut",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\dwmapi.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\Secur32.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\iertutil.dll",
                "HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\shell\\open\\command\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\KERNELBASE.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Roamable",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Content\\PerUserItem",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\Feature_ClientAuthCertFilter",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadOverride",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\InitFolderHandler",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\CRYPT32.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Security",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\rtutils.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld\\IETldVersionHigh",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\SessionStartTimeDefaultDeltaSecs",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019040920190410\\CacheOptions",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\RPCRT4.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledSessions\\MachineThrottling",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MimeExclusionListForCache",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\My Music",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\feedplat\\CacheOptions",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\My Video",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MBCSServername",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MBCSAPIforCrack",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableCachingOfSSLPages",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\HeaderExclusionListForCache",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\ncrypt.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\WTSAPI32.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\rsaenh.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\PerUserCookies",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PublishExpandedPath",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InitFolderHandler",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\\*",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Roamable",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WpadSearchAllDomains",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnOnPostRedirect",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Hostname",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-ns-proxy-autoconfig\\Flags",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\ScavengeCacheFileLimit",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\GDI32.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\feedplat\\CacheLimit",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\COMCTL32.dll",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\AccessProviders\\MartaExtension",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnAlwaysOnPost",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Icon",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\WinTrust\\Trust Providers\\Software Publishing\\State",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3\\1A10",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\BypassHTTPNoCacheCheck",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Icon",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DnsCacheTimeout",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\SHELL32.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DnsCacheEnabled",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\dhcpcsvc6.DLL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\CRYPTSP.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\PrivacIE:\\CacheOptions",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Cleanup\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Security",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InfoTip",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\NoCheckAutodialOverRide",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\LeashLegacyCookies",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\History\\CacheLimit",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DnsCacheEntries",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\mswsock.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPer1_0Server",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\FileDirectory",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\MSCTF.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_UNC_SAVEDFILECHECK\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Security\\Safety Warning Level",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\TcpAutotuning",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1\\Flags",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\rasman.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\profapi.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice\\Progid",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Stream",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld\\IETldVersionLow",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\EnableConsoleTracing",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisablePassport",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Content\\PerUserItem",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\COMDLG32.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Stream",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Cookies\\PerUserItem",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Icon",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SocketSendBufferLength",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\CTF\\EnableAnchorContext",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Attributes",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\ietld\\CacheLimit",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\System32\\npmproxy.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\WLDAP32.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\UTF8ServerNameRes",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PublishExpandedPath",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\kernel32.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\LPK.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalRedirectOnly",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxySettingsPerUser",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Parameters\\Transports",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\urlmon.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Attributes",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\DOMStore\\CacheRepair",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Signature\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyHttp1.1",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\uxtheme.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\ADVAPI32.dll",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\LocalRedirectOnly",
                "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Layout Hotkey",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\FtpDefaultExpiryTimeSecs",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyHttp1.1",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Security",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableHttp1_1",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\MaxFileSize",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\ietld\\CachePath",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\CRYPTBASE.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ConnectRetries",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\FromCacheTimeout",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DontUseDNSLoadBalancing",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\HelperDllName",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResource",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ReceiveTimeOut",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyHttp1.1",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableAutodial",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PreCreate",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\feedplat\\CachePrefix",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\EnableFileTracing",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisplayScriptDownloadFailureUI",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\InfoTip",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\DHCPCSVC.DLL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\CFGMGR32.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\RelativePath",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\PrivacIE:\\CacheLimit",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\MinSockaddrLength",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\pnrpnsp.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\ole32.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\System32\\fwpuclnt.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Attributes",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DontUseDNSLoadBalancing",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Category",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigCustomUA",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\ConsoleTracingMask",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\MSASN1.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\DNSAPI.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadLastNetwork",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK\\*",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyOverride",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Content\\CacheLimit",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\System32\\wship6.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\BadProxyExpiresTime",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\SysWOW64\\bcryptprimitives.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPer1_0Server",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\StreamResource",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\ntmarta.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledSessions\\GlobalSession",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\wintrust.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\SHLWAPI.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableHttp1_1",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\DOMStore\\CacheOptions",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\LocalizedName",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\PrivacIE:\\CacheRepair",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\WININET.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_MIME_HANDLING\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\ConsoleTracingMask",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\IPHLPAPI.DLL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\bcrypt.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResourceType",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-internet-signup\\FileExtensions",
                "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Language Hotkey",
                "HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Hotkey",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\SavedLegacySettings",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\UseDelayedAcceptance",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\UseHostnameAsAlias",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\System32\\netprofm.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\PrivacIE:\\CachePath",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\IdnEnabled",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableWorkerThreadHibernation",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019040920190410\\CachePath",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxHttpRedirects",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Description",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\FileTracingMask",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\ScavengeCacheFileLimit",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\StreamResourceType",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-internet-signup\\DllFile",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\NLAapi.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\LocalRedirectOnly",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_MIME_HANDLING\\*",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CertCacheNoValidate",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SendExtraCRLF",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{55272A00-42CB-11CE-8135-00AA004BB851}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\rasadhlp.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\FileDirectory",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SyncMode5",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\powrprof.dll",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\ScavengeCacheFileLimit",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\RelativePath",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerServer",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableKeepAlive",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Message\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3\\Flags",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\LdapClientIntegrity",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\Security\\DisableSecuritySettingsCheck",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\feedplat\\CachePath",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-internet-signup\\Default",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Cookies\\CachePrefix",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Certificate\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\BypassSSLNoCacheCheck",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\(Default)",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ClientAuthBuiltInUI",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PreCreate",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\ietld\\CacheOptions",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Cleanup\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_UNC_SAVEDFILECHECK\\*",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\USP10.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParsingName",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ConnectRetries",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\OLEAUT32.dll",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableBasicOverClearChannel",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
                "HKEY_CURRENT_USER\\Software\\BitTorrent\\StatsTesting",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Initialization\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\History\\PerUserItem",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\USERENV.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\USER32.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Roamable",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\KeepAliveTimeout",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerServer",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Name",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-ns-proxy-autoconfig\\DllFile",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ServerInfoTimeout",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\ThreadingModel",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PreCreate",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Security\\DisableSecuritySettingsCheck",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\History\\CachePrefix",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\MaxFileSize",
                "HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@%SystemRoot%\\system32\\dnsapi.dll,-103",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableAutoProxyResultCache",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Certificate\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
                "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SecureProtocols",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Security_HKLM_only",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\syswow64\\PSAPI.DLL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\NoCheckAutodialOverRide",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\Riched20.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnOnBadCertRecving",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Content\\CachePrefix",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Message\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\WINNSI.DLL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableHttpTrace",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4\\Flags",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentType",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\DBGHELP.DLL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\MiniDumpAuxiliaryDlls\\C:\\Windows\\system32\\sensapi.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Name",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SocketReceiveBufferLength",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\FolderTypeID",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ConnectTimeOut",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-ns-proxy-autoconfig\\Default",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Name",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PublishExpandedPath",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableReadRange",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\Mapping",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\ParentFolder",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\RelativePath",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\BypassHTTPNoCacheCheck"
            ],
            "file_created": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt58C2.tmp",
                "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[1].txt",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\45359-utorrent.9782.dmp",
                "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[2].txt",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat.new",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A2B.tmp.1573254788\\HTA\\install.1573254788.zip",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates.dat",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A2B.tmp",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A2B.tmp.1573254788\\index.hta.log",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt694F.tmp.new",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc.new",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt694F.tmp"
            ],
            "dll_loaded": [
                "DBGHELP.DLL",
                "version.dll",
                "COMDLG32.dll",
                "profapi.dll",
                "urlmon.dll",
                "kernel32",
                "C:\\Windows\\system32\\symsrv.dll",
                "ntdll",
                "api-ms-win-core-sysinfo-l1-2-1",
                "api-ms-win-core-localization-l1-2-1",
                "DNSAPI.dll",
                "C:\\Windows\\system32\\DUser.dll",
                "DHCPCSVC.DLL",
                "kernel32.dll",
                "gdiplus.dll",
                "ws2_32",
                "C:\\Windows\\system32\\ole32.dll",
                "dwmapi.dll",
                "ntdll.dll",
                "ntmarta.dll",
                "shlwapi.dll",
                "C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll",
                "api-ms-win-core-synch-l1-2-0",
                "iphlpapi",
                "OLEAUT32.DLL",
                "ncrypt.dll",
                "sensapi.dll",
                "Crypt32.dll",
                "Riched20.dll",
                "C:\\Windows\\system32\\napinsp.dll",
                "C:\\Windows\\syswow64\\MSCTF.dll",
                "WININET.dll",
                "powrprof.dll",
                "C:\\Windows\\System32\\wship6.dll",
                "C:\\Windows\\SysWOW64\\bcryptprimitives.dll",
                "dnsapi",
                "KERNEL32.DLL",
                "psapi.dll",
                "cryptbase.dll",
                "WTSAPI32.dll",
                "RASMAN.DLL",
                "Iphlpapi.dll",
                "advapi32.dll",
                "api-ms-win-security-systemfunctions-l1-1-0",
                "ole32.dll",
                "SHLWAPI.dll",
                "CRYPTSP.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\DBGHELP.DLL",
                "USER32.dll",
                "IMM32.dll",
                "API-MS-Win-Security-SDDL-L1-1-0.dll",
                "API-MS-WIN-Service-winsvc-L1-1-0.dll",
                "wintrust.dll",
                "rtutils.dll",
                "IPHLPAPI.DLL",
                "C:\\Windows\\SysWOW64\\oleaut32.dll",
                "wininet.dll",
                "C:\\Windows\\system32\\xmllite.dll",
                "RASAPI32.dll",
                "OLEAUT32.dll",
                "C:\\Windows\\system32\\pnrpnsp.dll",
                "comctl32",
                "SHELL32.dll",
                "RPCRT4.dll",
                "DnsApi.dll",
                "C:\\Windows\\System32\\winrnr.dll",
                "PSAPI.DLL",
                "comctl32.dll",
                "COMCTL32.dll",
                "DUser.dll",
                "C:\\Windows\\system32\\NLAapi.dll",
                "VERSION.dll",
                "Secur32.dll",
                "api-ms-win-core-fibers-l1-1-1",
                "GDI32.dll",
                "UxTheme.dll",
                "C:\\Windows\\system32\\mswsock.dll",
                "API-MS-WIN-Service-Management-L1-1-0.dll",
                "ADVAPI32.dll",
                "advapi32",
                "SETUPAPI.dll",
                "WS2_32.dll",
                "user32.dll",
                "MSIMG32.dll"
            ],
            "file_moved": [
                [
                    "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc",
                    "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc.old"
                ],
                [
                    "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt694F.tmp.new",
                    "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt694F.tmp"
                ],
                [
                    "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc.new",
                    "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc"
                ],
                [
                    "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat",
                    "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat.old"
                ],
                [
                    "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat.new",
                    "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat"
                ],
                [
                    "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt694F.tmp",
                    "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt694F.tmp.old"
                ]
            ],
            "file_written": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt58C2.tmp",
                "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[1].txt",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\45359-utorrent.9782.dmp",
                "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[2].txt",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates.dat",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat.new",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A2B.tmp.1573254788\\index.hta.log",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt694F.tmp.new",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc.new"
            ],
            "file_recreated": [
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates.dat",
                "\\Device\\KsecDD"
            ],
            "directory_created": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A2B.tmp.1573254788",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A2B.tmp.1573254788\\HTA\\",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates\\"
            ],
            "file_failed": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\sechost.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\rasadhlp.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\msctf.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wlpk.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\nsi.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\crypt32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\ole32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\mswsock.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wuser32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\DLL\\winnsi.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\profapi.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\msasn1.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\cryptsp.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\setupapi.pdb",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\current.btskin",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\msvcrt.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\bin\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\mswsock.pdb",
                "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[1].txt",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wtsapi32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\bin\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.dbg",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\msimg32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wkernel32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\rsaenh.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wntdll.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\advapi32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\MicrosoftWindowsGdiPlus-1.1.7601.17514-gdiplus.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wininet.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wsspicli.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\DLL\\dbghelp.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\devobj.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\cfgmgr32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wrpcrt4.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\winnsi.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\DLL\\winnsi.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wininet.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\DLL\\psapi.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\ole32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\msasn1.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wship6.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\secur32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\ole32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\shlwapi.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\cryptbase.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wkernelbase.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wkernelbase.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wshtcpip.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\crypt32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\msvcrt.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\secur32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wimm32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\comctl32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\usp10.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\comdlg32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dnsapi.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\advapi32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\setupapi.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\msctf.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\dnsapi.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\userenv.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\shell32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\bcrypt.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\bcrypt.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\MicrosoftWindowsGdiPlus-1.1.7601.17514-gdiplus.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wship6.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\oleaut32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\devobj.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\devobj.pdb",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates\\sua_pmr",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\webui.zip",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wkernel32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\urlmon.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\DLL\\dbghelp.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\bcryptprimitives.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\ws2_32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wrpcrt4.pdb",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\utorrent.lng",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wintrust.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wrpcrt4.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\DLL\\wimm32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wkernel32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\nsi.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\cryptsp.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\rasadhlp.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\ws2_32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wuser32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\shell32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\DLL\\psapi.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\cryptbase.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\bin\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\version.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\bcryptprimitives.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\oleaut32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\rsaenh.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wininet.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wuser32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wgdi32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\dnsapi.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wkernelbase.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\shlwapi.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\iertutil.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wuxtheme.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wshtcpip.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\msvcrt.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\iphlpapi.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\comdlg32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wsspicli.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\userenv.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\shell32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dbghelp.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\DLL\\iphlpapi.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\ncrypt.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wntdll.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wintrust.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\advapi32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\bin\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.dbg",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wtsapi32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\msimg32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\bcryptprimitives.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\cryptbase.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\version.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wgdi32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\profapi.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\msimg32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wtsapi32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\ncrypt.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\ws2_32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\iertutil.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wlpk.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\bcrypt.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\msasn1.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wuxtheme.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wshtcpip.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\MicrosoftWindowsGdiPlus-1.1.7601.17514-gdiplus.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\comctl32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\comdlg32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\urlmon.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\setupapi.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\sechost.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\nsi.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\msctf.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\usp10.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\cfgmgr32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.dbg",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\iertutil.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\DLL\\iphlpapi.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\ncrypt.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\userenv.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\profapi.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\version.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wlpk.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\psapi.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\cfgmgr32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wsspicli.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\usp10.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\rsaenh.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\mswsock.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wgdi32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\DLL\\wimm32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\cryptsp.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\rasadhlp.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\crypt32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wintrust.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wntdll.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\comctl32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\urlmon.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\secur32.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wuxtheme.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\shlwapi.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wship6.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\sechost.pdb",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin.lang.txt",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\oleaut32.pdb"
            ],
            "resolves_host": [
                "router.utorrent.com",
                "i-50.b-000.xyz.bench.utorrent.com",
                "update.utorrent.com",
                "cuckpc",
                "router.bittorrent.com",
                "download-lb.utorrent.com",
                "wpad"
            ],
            "connects_ip": [
                "127.0.0.1"
            ],
            "file_exists": [
                "C:\\Windows\\SysWOW64\\user32.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp",
                "C:\\Windows\\SysWOW64\\sspicli.dll",
                "C:\\Windows\\System32\\WSHTCPIP.DLL",
                "C:\\Windows\\System32\\dwmapi.dll",
                "C:\\Windows\\SysWOW64\\bcryptprimitives.dll",
                "C:\\Windows\\SysWOW64\\ole32.dll",
                "C:\\Windows\\System32\\profapi.dll",
                "C:\\Windows\\System32\\qagentrt.dll",
                "C:\\Windows\\System32\\IPHLPAPI.DLL",
                "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\",
                "C:\\Windows\\System32\\wtsapi32.dll",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\current.btskin",
                "C:\\Windows\\SysWOW64\\psapi.dll",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc.new",
                "C:\\Windows\\SysWOW64\\wintrust.dll",
                "C:\\Windows\\System32\\NapiNSP.dll",
                "C:\\Windows\\System32\\rasadhlp.dll",
                "C:\\Windows\\System32\\dbghelp.dll",
                "C:\\Windows\\SysWOW64\\usp10.dll",
                "C:\\Windows\\SysWOW64\\iertutil.dll",
                "C:\\Windows\\System32\\mswsock.dll",
                "C:\\Users\\cuck\\Videos",
                "C:\\Windows\\SysWOW64\\sechost.dll",
                "C:\\Windows\\System32\\wship6.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates\\3.5.5_45359.exe",
                "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[2].txt",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
                "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5",
                "C:\\Windows\\SysWOW64\\Wldap32.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\uTorrent.exe",
                "C:\\Windows\\SysWOW64\\CRYPTBASE.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini",
                "C:\\Windows\\System32\\RpcRtRemote.dll",
                "C:\\Users\\cuck\\Music",
                "C:\\Windows\\System32\\winnsi.dll",
                "C:\\Windows\\SysWOW64\\cfgmgr32.dll",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\dht_feed.dat",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\settings.dat",
                "C:\\Windows\\SysWOW64\\shell32.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\settings.dat.old",
                "C:\\Windows\\SysWOW64\\lpk.dll",
                "C:\\Windows\\System32\\version.dll",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates.dat.old",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates.dat.new",
                "C:\\Users\\cuck\\Documents",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\dht_feed.dat.new",
                "C:\\Windows\\SysWOW64\\urlmon.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History",
                "C:\\Windows\\System32\\dnsapi.dll",
                "C:\\Windows\\SysWOW64\\ws2_32.dll",
                "C:\\Windows\\System32\\rasman.dll",
                "C:\\Windows\\System32\\p2pcollab.dll",
                "C:\\Windows\\System32\\nlaapi.dll",
                "C:\\Windows\\SysWOW64\\gdi32.dll",
                "C:\\Windows\\SysWOW64\\msasn1.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\utorrent.lng",
                "C:\\Windows\\System32\\rsaenh.dll",
                "C:\\Windows\\SysWOW64\\oleaut32.dll",
                "C:\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll",
                "C:\\Windows\\System32\\SensApi.dll",
                "C:\\Windows\\System32\\uxtheme.dll",
                "C:\\Windows\\SysWOW64\\wininet.dll",
                "C:\\Windows\\System32\\secur32.dll",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat",
                "C:\\Windows\\SysWOW64\\setupapi.dll",
                "C:\\Windows\\SysWOW64\\kernel32.dll",
                "C:\\Windows\\SysWOW64\\msvcrt.dll",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\dht_feed.dat.old",
                "C:\\Windows\\SysWOW64\\shlwapi.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat.old",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt58C2.tmp",
                "C:\\Windows\\System32\\dhcpcsvc6.DLL",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\utt694F.tmp.new",
                "C:\\Windows\\SysWOW64\\devobj.dll",
                "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies",
                "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\",
                "C:\\Windows\\System32\\userenv.dll",
                "C:\\Windows\\System32\\pnrpnsp.dll",
                "C:\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll",
                "C:\\Windows\\SysWOW64\\clbcatq.dll",
                "C:\\Windows\\SysWOW64\\ntdll.dll",
                "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[1].txt",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\dht.dat.old",
                "C:\\Windows\\System32\\ntmarta.dll",
                "C:\\Windows\\System32\\imm32.dll",
                "C:\\Windows\\System32\\rtutils.dll",
                "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
                "C:\\Windows\\SysWOW64\\rpcrt4.dll",
                "C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe",
                "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\",
                "C:\\Windows\\SysWOW64\\advapi32.dll",
                "C:\\Windows\\SysWOW64\\msctf.dll",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat.new",
                "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
                "C:\\Windows\\System32\\bcrypt.dll",
                "C:\\Windows\\System32\\cryptsp.dll",
                "C:\\Windows\\System32\\msimg32.dll",
                "C:\\Windows\\SysWOW64\\comdlg32.dll",
                "C:\\Windows\\SysWOW64\\nsi.dll",
                "C:\\Windows\\SysWOW64\\crypt32.dll",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates.dat",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\dht.dat.new",
                "C:\\Windows\\System32\\npmproxy.dll",
                "C:\\Windows\\System32\\powrprof.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini",
                "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files",
                "C:\\Windows\\System32\\dhcpcsvc.dll",
                "C:\\Windows\\System32\\ncrypt.dll",
                "C:\\Windows\\System32\\rasapi32.dll",
                "C:\\Windows\\System32\\winrnr.dll",
                "C:\\Windows\\System32\\riched20.dll",
                "C:\\Windows\\System32\\FWPUCLNT.DLL",
                "C:\\Windows\\System32\\netprofm.dll",
                "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\dht.dat",
                "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5",
                "C:\\Windows\\SysWOW64\\KERNELBASE.dll"
            ],
            "directory_enumerated": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\profapi.pdb\\*",
                "C:\\Windows\\SysWOW64",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\ws2_32.pdb\\*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wtsapi32.pdb\\*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\crypt32.pdb\\*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp",
                "C:\\Windows\\SysWOW64\\sspicli.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\mswsock.pdb\\*",
                "C:\\Windows\\System32\\ras\\*.pbk",
                "C:\\Windows\\System32\\WSHTCPIP.DLL",
                "C:\\Windows\\System32\\dwmapi.dll",
                "C:\\Windows\\System32\\nlaapi.dll",
                "C:\\Windows\\SysWOW64\\ole32.dll",
                "C:\\Windows\\System32\\profapi.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.dbg\\*",
                "C:\\Windows\\System32\\IPHLPAPI.DLL",
                "C:\\Windows\\System32\\wship6.dll",
                "C:\\Windows\\SysWOW64\\psapi.dll",
                "C:\\Windows\\SysWOW64\\user32.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\msasn1.pdb\\*",
                "C:\\Windows\\SysWOW64\\clbcatq.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\iertutil.pdb\\*",
                "C:\\Windows\\SysWOW64\\wintrust.dll",
                "C:\\Windows\\System32\\NapiNSP.dll",
                "C:\\ProgramData\\Microsoft\\Network\\Connections\\Pbk\\rasphone.pbk",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wintrust.pdb\\*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\iphlpapi.pdb\\*",
                "C:\\Windows\\System32\\rasadhlp.dll",
                "C:\\Windows\\System32\\dbghelp.dll",
                "C:\\Windows\\SysWOW64\\usp10.dll",
                "C:\\Windows\\SysWOW64\\iertutil.dll",
                "C:\\Windows\\System32\\mswsock.dll",
                "C:\\Windows\\SysWOW64\\sechost.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\userenv.pdb\\*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wship6.pdb\\*",
                "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*.pbk",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\rasadhlp.pdb\\*",
                "C:\\Windows\\winsxs",
                "C:\\Windows\\SysWOW64\\Wldap32.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wininet.pdb\\*",
                "C:\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll",
                "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\rasphone.pbk",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\ncrypt.pdb\\*",
                "C:\\Windows\\System32\\winnsi.dll",
                "C:\\Windows\\SysWOW64\\cfgmgr32.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\bcrypt.pdb\\*",
                "C:\\Windows\\SysWOW64\\shell32.dll",
                "C:\\Windows\\SysWOW64\\lpk.dll",
                "C:\\Windows\\System32\\version.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wsspicli.pdb\\*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wntdll.pdb\\*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\nsi.pdb\\*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\urlmon.pdb\\*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.pdb\\*",
                "C:\\Windows\\System32\\dnsapi.dll",
                "C:\\Windows\\SysWOW64\\ws2_32.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\MicrosoftWindowsGdiPlus-1.1.7601.17514-gdiplus.pdb\\*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\cryptsp.pdb\\*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\comctl32.pdb\\*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wuser32.pdb\\*",
                "C:\\Windows\\SysWOW64\\gdi32.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\rsaenh.pdb\\*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\shlwapi.pdb\\*",
                "C:\\Windows\\System32\\rsaenh.dll",
                "C:\\Windows",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\version.pdb\\*",
                "C:\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll",
                "C:\\Windows\\System32\\SensApi.dll",
                "C:\\Windows\\System32\\uxtheme.dll",
                "C:\\Windows\\SysWOW64\\wininet.dll",
                "C:\\Windows\\System32\\secur32.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wgdi32.pdb\\*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wkernelbase.pdb\\*",
                "C:\\Windows\\SysWOW64\\setupapi.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\devobj.pdb\\*",
                "C:\\Windows\\SysWOW64\\kernel32.dll",
                "C:\\Windows\\SysWOW64\\msvcrt.dll",
                "C:\\Windows\\SysWOW64\\shlwapi.dll",
                "C:\\Windows\\System32\\rasman.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\setupapi.pdb\\*",
                "C:\\Windows\\System32\\wtsapi32.dll",
                "C:\\Windows\\SysWOW64\\devobj.dll",
                "C:\\Windows\\System32\\pnrpnsp.dll",
                "C:\\Users",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\msvcrt.pdb\\*",
                "C:\\Windows\\SysWOW64\\advapi32.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dnsapi.pdb\\*",
                "C:\\Windows\\System32\\userenv.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wshtcpip.pdb\\*",
                "C:\\Windows\\SysWOW64\\ntdll.dll",
                "C:\\Users\\cuck",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\dbghelp.pdb\\*",
                "C:\\Users\\cuck\\AppData\\Local",
                "C:\\Windows\\System32\\ntmarta.dll",
                "C:\\Windows\\System32\\imm32.dll",
                "C:\\Windows\\System32\\rtutils.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\msctf.pdb\\*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wkernel32.pdb\\*",
                "C:\\Windows\\SysWOW64\\rpcrt4.dll",
                "C:\\ProgramData\\Microsoft\\Network\\Connections\\Pbk\\*.pbk",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wuxtheme.pdb\\*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\msimg32.pdb\\*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\secur32.pdb\\*",
                "C:\\Users\\cuck\\AppData",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\shell32.pdb\\*",
                "C:\\Windows\\SysWOW64\\msctf.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wrpcrt4.pdb\\*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wlpk.pdb\\*",
                "C:\\Windows\\System32\\bcrypt.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\sechost.pdb\\*",
                "C:\\Windows\\System32",
                "C:\\Windows\\System32\\cryptsp.dll",
                "C:\\Windows\\System32\\msimg32.dll",
                "C:\\Windows\\SysWOW64\\comdlg32.dll",
                "C:\\Windows\\SysWOW64\\nsi.dll",
                "C:\\Windows\\SysWOW64\\crypt32.dll",
                "C:\\Windows\\SysWOW64\\msasn1.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\winnsi.pdb\\*",
                "C:\\Windows\\System32\\npmproxy.dll",
                "C:\\Windows\\System32\\powrprof.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\usp10.pdb\\*",
                "C:\\Windows\\SysWOW64\\oleaut32.dll",
                "C:\\Windows\\System32\\dhcpcsvc.dll",
                "C:\\Windows\\System32\\ncrypt.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\cfgmgr32.pdb\\*",
                "C:\\Windows\\System32\\rasapi32.dll",
                "C:\\Windows\\SysWOW64\\urlmon.dll",
                "C:\\Windows\\System32\\winrnr.dll",
                "C:\\Windows\\System32\\riched20.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\bcryptprimitives.pdb\\*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\wimm32.pdb\\*",
                "C:\\Windows\\System32\\FWPUCLNT.DLL",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\psapi.pdb\\*",
                "C:\\Windows\\System32\\netprofm.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\comdlg32.pdb\\*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\advapi32.pdb\\*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\cryptbase.pdb\\*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\ole32.pdb\\*",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\oleaut32.pdb\\*"
            ]
        },
        "first_seen": 1573253587.6562,
        "ppid": 1624
    }
]

Signatures

[
    {
        "markcount": 22,
        "families": [
            "generic"
        ],
        "description": "Uses Windows APIs to generate a cryptographic key",
        "severity": 1,
        "marks": [
            {
                "call": {
                    "category": "crypto",
                    "status": 1,
                    "stacktrace": [],
                    "api": "CryptGenKey",
                    "return_value": 1,
                    "arguments": {
                        "crypto_handle": "0x00a361c8",
                        "algorithm_identifier": "0x00000001",
                        "provider_handle": "0x00a4f420",
                        "flags": 16385
                    },
                    "time": 1573253588.2343,
                    "tid": 2308,
                    "flags": {
                        "algorithm_identifier": ""
                    }
                },
                "pid": 2660,
                "type": "call",
                "cid": 1230
            },
            {
                "call": {
                    "category": "crypto",
                    "status": 1,
                    "stacktrace": [],
                    "api": "CryptExportKey",
                    "return_value": 1,
                    "arguments": {
                        "crypto_handle": "0x00a36848",
                        "crypto_export_handle": "0x00000000",
                        "buffer": "",
                        "blob_type": 6,
                        "flags": 0
                    },
                    "time": 1573253588.2662,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 1554
            },
            {
                "call": {
                    "category": "crypto",
                    "status": 1,
                    "stacktrace": [],
                    "api": "CryptExportKey",
                    "return_value": 1,
                    "arguments": {
                        "crypto_handle": "0x00a36848",
                        "crypto_export_handle": "0x00000000",
                        "buffer": "\u0006\u0002\u0000\u0000\u0000\u00a4\u0000\u0000RSA1\u0000\u0004\u0000\u0000\u0001\u0000\u0001\u0000-j\u00d0\u001aPp\u00ed\u00a8\u00d3p]\u009d\u0080d$\u0010\u0090\u00d7\u0093\u00f1d\u00cc\r.\u009b\u009c\u00b1\u0010\u0002\u00aau0qp\u00d9`\u008aq\u00ec\u0015\u0093\u009f.4\u00ca-\u0096L\u0087b[8\u00dc\u00e8u\u00a9[\u00bb\b}6rj0\u0094\u0017\u00e5\u009aV\u0088B\u00ec\u00ab8\u00bf\u0097\u00ec\u00a9)U5\\#\u0017*\u001bG\u00a6^\u00b4\u00dd\u00ae\f\u00ed5\u00d3\u00ac\u00e4\u00f9\u00c0\u0092\u00dcN\u00a7j\u00d1\u00e1B\u00da\u00a1Zi&\u0018\u00fa\u0088\u0088\u0013\u009e\u00f577\u009bQ\u00c3\u0084p\u00d4",
                        "blob_type": 6,
                        "flags": 0
                    },
                    "time": 1573253588.2662,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 1555
            },
            {
                "call": {
                    "category": "crypto",
                    "status": 1,
                    "stacktrace": [],
                    "api": "CryptExportKey",
                    "return_value": 1,
                    "arguments": {
                        "crypto_handle": "0x00a36848",
                        "crypto_export_handle": "0x00000000",
                        "buffer": "",
                        "blob_type": 6,
                        "flags": 0
                    },
                    "time": 1573253588.2662,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 1568
            },
            {
                "call": {
                    "category": "crypto",
                    "status": 1,
                    "stacktrace": [],
                    "api": "CryptExportKey",
                    "return_value": 1,
                    "arguments": {
                        "crypto_handle": "0x00a36848",
                        "crypto_export_handle": "0x00000000",
                        "buffer": "\u0006\u0002\u0000\u0000\u0000\u00a4\u0000\u0000RSA1\u0000\u0004\u0000\u0000\u0001\u0000\u0001\u0000-j\u00d0\u001aPp\u00ed\u00a8\u00d3p]\u009d\u0080d$\u0010\u0090\u00d7\u0093\u00f1d\u00cc\r.\u009b\u009c\u00b1\u0010\u0002\u00aau0qp\u00d9`\u008aq\u00ec\u0015\u0093\u009f.4\u00ca-\u0096L\u0087b[8\u00dc\u00e8u\u00a9[\u00bb\b}6rj0\u0094\u0017\u00e5\u009aV\u0088B\u00ec\u00ab8\u00bf\u0097\u00ec\u00a9)U5\\#\u0017*\u001bG\u00a6^\u00b4\u00dd\u00ae\f\u00ed5\u00d3\u00ac\u00e4\u00f9\u00c0\u0092\u00dcN\u00a7j\u00d1\u00e1B\u00da\u00a1Zi&\u0018\u00fa\u0088\u0088\u0013\u009e\u00f577\u009bQ\u00c3\u0084p\u00d4",
                        "blob_type": 6,
                        "flags": 0
                    },
                    "time": 1573253588.2662,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 1569
            },
            {
                "call": {
                    "category": "crypto",
                    "status": 1,
                    "stacktrace": [],
                    "api": "CryptExportKey",
                    "return_value": 1,
                    "arguments": {
                        "crypto_handle": "0x00a367c8",
                        "crypto_export_handle": "0x00000000",
                        "buffer": "",
                        "blob_type": 7,
                        "flags": 0
                    },
                    "time": 1573253588.2812,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 1599
            },
            {
                "call": {
                    "category": "crypto",
                    "status": 1,
                    "stacktrace": [],
                    "api": "CryptExportKey",
                    "return_value": 1,
                    "arguments": {
                        "crypto_handle": "0x00a367c8",
                        "crypto_export_handle": "0x00000000",
                        "buffer": "",
                        "blob_type": 7,
                        "flags": 0
                    },
                    "time": 1573253588.2973,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 1782
            },
            {
                "call": {
                    "category": "crypto",
                    "status": 1,
                    "stacktrace": [],
                    "api": "CryptExportKey",
                    "return_value": 1,
                    "arguments": {
                        "crypto_handle": "0x00a36a08",
                        "crypto_export_handle": "0x00000000",
                        "buffer": "",
                        "blob_type": 7,
                        "flags": 0
                    },
                    "time": 1573253588.2973,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 1852
            },
            {
                "call": {
                    "category": "crypto",
                    "status": 1,
                    "stacktrace": [],
                    "api": "CryptExportKey",
                    "return_value": 1,
                    "arguments": {
                        "crypto_handle": "0x00a36a08",
                        "crypto_export_handle": "0x00000000",
                        "buffer": "",
                        "blob_type": 7,
                        "flags": 0
                    },
                    "time": 1573253588.2973,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 1853
            },
            {
                "call": {
                    "category": "crypto",
                    "status": 1,
                    "stacktrace": [],
                    "api": "CryptExportKey",
                    "return_value": 1,
                    "arguments": {
                        "crypto_handle": "0x00a36a08",
                        "crypto_export_handle": "0x00000000",
                        "buffer": "",
                        "blob_type": 7,
                        "flags": 0
                    },
                    "time": 1573253588.3122,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 1868
            },
            {
                "call": {
                    "category": "crypto",
                    "status": 1,
                    "stacktrace": [],
                    "api": "CryptExportKey",
                    "return_value": 1,
                    "arguments": {
                        "crypto_handle": "0x00a36a08",
                        "crypto_export_handle": "0x00000000",
                        "buffer": "",
                        "blob_type": 7,
                        "flags": 0
                    },
                    "time": 1573253588.3122,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 1869
            },
            {
                "call": {
                    "category": "crypto",
                    "status": 1,
                    "stacktrace": [],
                    "api": "CryptExportKey",
                    "return_value": 1,
                    "arguments": {
                        "crypto_handle": "0x00a36a08",
                        "crypto_export_handle": "0x00000000",
                        "buffer": "",
                        "blob_type": 7,
                        "flags": 0
                    },
                    "time": 1573253588.3122,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 1883
            },
            {
                "call": {
                    "category": "crypto",
                    "status": 1,
                    "stacktrace": [],
                    "api": "CryptExportKey",
                    "return_value": 1,
                    "arguments": {
                        "crypto_handle": "0x00a36a08",
                        "crypto_export_handle": "0x00000000",
                        "buffer": "",
                        "blob_type": 7,
                        "flags": 0
                    },
                    "time": 1573253588.3122,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 1884
            },
            {
                "call": {
                    "category": "crypto",
                    "status": 1,
                    "stacktrace": [],
                    "api": "CryptExportKey",
                    "return_value": 1,
                    "arguments": {
                        "crypto_handle": "0x00a36a08",
                        "crypto_export_handle": "0x00000000",
                        "buffer": "",
                        "blob_type": 7,
                        "flags": 0
                    },
                    "time": 1573253588.3122,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 1933
            },
            {
                "call": {
                    "category": "crypto",
                    "status": 1,
                    "stacktrace": [],
                    "api": "CryptExportKey",
                    "return_value": 1,
                    "arguments": {
                        "crypto_handle": "0x00a36a08",
                        "crypto_export_handle": "0x00000000",
                        "buffer": "",
                        "blob_type": 7,
                        "flags": 0
                    },
                    "time": 1573253588.3122,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 1934
            },
            {
                "call": {
                    "category": "crypto",
                    "status": 1,
                    "stacktrace": [],
                    "api": "CryptExportKey",
                    "return_value": 1,
                    "arguments": {
                        "crypto_handle": "0x00a36a08",
                        "crypto_export_handle": "0x00000000",
                        "buffer": "",
                        "blob_type": 7,
                        "flags": 0
                    },
                    "time": 1573253588.3122,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 1947
            },
            {
                "call": {
                    "category": "crypto",
                    "status": 1,
                    "stacktrace": [],
                    "api": "CryptExportKey",
                    "return_value": 1,
                    "arguments": {
                        "crypto_handle": "0x00a36a08",
                        "crypto_export_handle": "0x00000000",
                        "buffer": "",
                        "blob_type": 7,
                        "flags": 0
                    },
                    "time": 1573253588.3122,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 1948
            },
            {
                "call": {
                    "category": "crypto",
                    "status": 1,
                    "stacktrace": [],
                    "api": "CryptExportKey",
                    "return_value": 1,
                    "arguments": {
                        "crypto_handle": "0x00a36a08",
                        "crypto_export_handle": "0x00000000",
                        "buffer": "",
                        "blob_type": 7,
                        "flags": 0
                    },
                    "time": 1573253588.3122,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 1962
            },
            {
                "call": {
                    "category": "crypto",
                    "status": 1,
                    "stacktrace": [],
                    "api": "CryptExportKey",
                    "return_value": 1,
                    "arguments": {
                        "crypto_handle": "0x00a36a08",
                        "crypto_export_handle": "0x00000000",
                        "buffer": "",
                        "blob_type": 7,
                        "flags": 0
                    },
                    "time": 1573253588.3122,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 1963
            },
            {
                "call": {
                    "category": "crypto",
                    "status": 1,
                    "stacktrace": [],
                    "api": "CryptExportKey",
                    "return_value": 1,
                    "arguments": {
                        "crypto_handle": "0x00a36a08",
                        "crypto_export_handle": "0x00000000",
                        "buffer": "",
                        "blob_type": 7,
                        "flags": 0
                    },
                    "time": 1573253588.3122,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 1976
            },
            {
                "call": {
                    "category": "crypto",
                    "status": 1,
                    "stacktrace": [],
                    "api": "CryptExportKey",
                    "return_value": 1,
                    "arguments": {
                        "crypto_handle": "0x00a36a08",
                        "crypto_export_handle": "0x00000000",
                        "buffer": "",
                        "blob_type": 7,
                        "flags": 0
                    },
                    "time": 1573253588.3122,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 1977
            },
            {
                "call": {
                    "category": "crypto",
                    "status": 1,
                    "stacktrace": [],
                    "api": "CryptExportKey",
                    "return_value": 1,
                    "arguments": {
                        "crypto_handle": "0x00a36a08",
                        "crypto_export_handle": "0x00000000",
                        "buffer": "\u0007\u0002\u0000\u0000\u0000\u00a4\u0000\u0000RSA2\u0000\u0004\u0000\u0000\u0001\u0000\u0001\u0000-j\u00d0\u001aPp\u00ed\u00a8\u00d3p]\u009d\u0080d$\u0010\u0090\u00d7\u0093\u00f1d\u00cc\r.\u009b\u009c\u00b1\u0010\u0002\u00aau0qp\u00d9`\u008aq\u00ec\u0015\u0093\u009f.4\u00ca-\u0096L\u0087b[8\u00dc\u00e8u\u00a9[\u00bb\b}6rj0\u0094\u0017\u00e5\u009aV\u0088B\u00ec\u00ab8\u00bf\u0097\u00ec\u00a9)U5\\#\u0017*\u001bG\u00a6^\u00b4\u00dd\u00ae\f\u00ed5\u00d3\u00ac\u00e4\u00f9\u00c0\u0092\u00dcN\u00a7j\u00d1\u00e1B\u00da\u00a1Zi&\u0018\u00fa\u0088\u0088\u0013\u009e\u00f577\u009bQ\u00c3\u0084p\u00d4a@\u00fda\u00a8\u0084\u00e3\n\u00caJ\u00915R\"hM\u0006\u0002=\u00afe[\u008cL\rM\u00f7\u00a3\u0096\u0089\u00e5\u0093\u0010t\u00bd!\u00ff\u009e\u00da\u001e\u00c9>\u00ef\u00c0O\u00a7\u0006\t\u00a1I\u00f8\u00f2\u00c0\u00e5\u00b2\u0017@\u00de&1d\u00d9\u00a5\u00f2M-3\u008a\u00e9\u000e\n\u00c5\u0082#\u00cdZ\u000e\u00f7B\u00bb\u00d8\u0016)\u00e8w\u00d6)\u00c5|\u0011K7U\u0099\u00d2\u00f8\u008c&\u00f3\u00d8Q[lz\u00ba\u0081\u00a0\u00cft8\u00d7#=,\u00f3\u00970\u00f7\u008c\u00e5\u00c5\u00bc\u00a4\u00aa\u00e1 !\u00e0\u00e1\/\u00b9R\u00bd\u0089\u00ca\u00f3Z@I<\u00fe\u00d3b8\u0095\u00cd\u00ed\u00a3\u00b4#\u00fe\u00a2zh\u00e0\u00c9N\u0097\u00bb\u00a4\u00f1\u0013\u00c2L\n\u00ab\u00dc!\u00ed\u00bdn\u0091\u0085<\u001a\u00be;G\u00ac\u0004\b\u00bf\u0013\\\u000bX\u00c5\u00f9\u00d4\u0014\u00d5Z\u00e1B\/\u00dd[5\u00ab\u00e4=@\u0088\u00e8\u0002\u00f4\u0007\u00bf\u00f8\u0016\u0004!\u009b\u0004\"\u0095po\u000f$\u00d6c\u0081V\u00046\u00a2\u00a2X\u0001\u00cd\u00fd\u0087\u0019Y\u009e \u0006\u00c7\u0083'\u00b3M\u00b8\u0007~\u001b\u00b9\r^0\u00f5\u00e0\u00d4\u00b3\u00f2\u0093)\u00c2\u00cdUI\u00d9>e\u0094\u0094\u0098X\u00c9\u0013`w\u00d2\u0019~7\u00da\u00dauE\u001d\u00e0\u00f3\u009fF\u00ed6I\u00b1\u0000!8\u00d0\u00b4\u0091\u00cf?\u00ee\u001d:1\u00f9\u00e5\u0012\u00af\u00a9y\u00fd\u00a1@\u00f1\u009cw\u00e4\u00a31\u00db\u00c6\u0081:\u00d0\u00d2\u009c\u00a9\u001a\u000f\u00a7\u00d7\u0002\u0016\n\u00df.\u00f9\u001c\u00105T-2d@\u0085\u00ff\u0097~C]\u00c3\u00e3=D\u00d2\u008b\u00d6\u00ba\u00be\r\u00b2a\u00a4Gn\u0094\u0000\u0088\u00d6\u00dfU\u00c2\u00cd~_X\u00a7\u0001r\u0084\u0016\u00bfW,\u00d0\u0098I 6\u00c1\"Z\u0083\u00e8UX!\u00d8\u0013u~\u00bf0\u00f9\u00a0\u0099\u00f4\u00be\u0094\u0092e}=\u00c8,!\u00beV(\u00e0\u00af\u00c5\u0097(!S\u009a\u00cd>\u00c6I\u0013\bu)\u0093 \u00db\u00f0\u00f4\u0012\u00ea\u0087\u0006\u00c6\u009cj\u00aa",
                        "blob_type": 7,
                        "flags": 0
                    },
                    "time": 1573253588.3122,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 1978
            }
        ],
        "references": [],
        "name": "generates_crypto_key"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "Tries to locate where the browsers are installed",
        "severity": 1,
        "marks": [
            {
                "category": "file",
                "ioc": "C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "locates_browser"
    },
    {
        "markcount": 4,
        "families": [],
        "description": "The file contains an unknown PE resource name possibly indicative of a packer",
        "severity": 1,
        "marks": [
            {
                "category": "resource name",
                "ioc": "CSS",
                "type": "ioc",
                "description": null
            },
            {
                "category": "resource name",
                "ioc": "GIF",
                "type": "ioc",
                "description": null
            },
            {
                "category": "resource name",
                "ioc": "JS",
                "type": "ioc",
                "description": null
            },
            {
                "category": "resource name",
                "ioc": "PNG",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "pe_unknown_resource_name"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "One or more processes crashed",
        "severity": 1,
        "marks": [
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "",
                        "registers": {
                            "esp": 1629748,
                            "edi": 1323,
                            "eax": 1421,
                            "ebp": 1323,
                            "edx": 1421,
                            "ebx": 0,
                            "esi": 1631916,
                            "ecx": 1983705618
                        },
                        "exception": {
                            "instruction_r": "83 25 00 00 00 00 00 57 ff 76 04 ff 15 38 78 6c",
                            "symbol": "8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08+0x19d85c",
                            "instruction": "and dword ptr [0], 0",
                            "module": "8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
                            "exception_code": "0xc0000005",
                            "offset": 1693788,
                            "address": "0x59d85c"
                        }
                    },
                    "time": 1573253608.1723,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 6501
            }
        ],
        "references": [],
        "name": "raises_exception"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "Allocates read-write-execute memory (usually to unpack itself)",
        "severity": 2,
        "marks": [
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2660,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "allocation_type": 4096,
                        "base_address": "0x07450000"
                    },
                    "time": 1573253612.5622,
                    "tid": 2792,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT"
                    }
                },
                "pid": 2660,
                "type": "call",
                "cid": 23240
            }
        ],
        "references": [],
        "name": "allocates_rwx"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "A process attempted to delay the analysis task.",
        "severity": 2,
        "marks": [
            {
                "type": "generic",
                "description": "8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin tried to sleep 126 seconds, actually delayed analysis time by 126 seconds"
            }
        ],
        "references": [],
        "name": "antisandbox_sleep"
    },
    {
        "markcount": 119,
        "families": [],
        "description": "Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation",
        "severity": 2,
        "marks": [
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741766,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 46161329244864512,
                        "total_number_of_free_bytes": 16106127418,
                        "total_number_of_bytes": 45948350410260480
                    },
                    "time": 1573253588.0312,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 1115
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 45035996280505900,
                        "total_number_of_free_bytes": 228835651383177008,
                        "total_number_of_bytes": 10485760
                    },
                    "time": 1573253589.2662,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 3848
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253590.1723,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 4930
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253591.1723,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 4933
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253592.1872,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 5280
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253593.1872,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 5757
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253594.1872,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 5788
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253595.1872,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 5867
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253596.1872,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 5897
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253597.1872,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 6025
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20569079427648512,
                        "total_number_of_free_bytes": 53279936,
                        "total_number_of_bytes": 228835582657762604
                    },
                    "time": 1573253598.1872,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 6055
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253599.1872,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 6123
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253600.1872,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 6152
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253601.1872,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 6177
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253602.1723,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 6418
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253603.1723,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 6435
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253604.1723,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 6442
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253605.1723,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 6468
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253606.1723,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 6483
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253607.1723,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 6485
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20569079427648512,
                        "total_number_of_free_bytes": 53279936,
                        "total_number_of_bytes": 228835582657762604
                    },
                    "time": 1573253608.1723,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 6500
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 5344
                    },
                    "time": 1573253612.5473,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23092
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253613.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23471
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253614.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23478
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253615.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23483
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253616.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23488
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253617.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23494
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253618.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23500
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253619.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23505
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253620.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23510
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20569079427648512,
                        "total_number_of_free_bytes": 53279936,
                        "total_number_of_bytes": 228835582657762604
                    },
                    "time": 1573253621.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23515
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253622.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23521
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253623.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23537
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253624.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23542
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253625.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23547
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253626.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23552
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253627.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23558
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253628.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23563
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253629.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23568
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253630.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23573
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20569079427648512,
                        "total_number_of_free_bytes": 53279936,
                        "total_number_of_bytes": 228835582657762604
                    },
                    "time": 1573253631.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23578
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253632.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23584
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253633.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23589
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253634.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23605
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253635.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23610
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253636.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23615
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253637.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23621
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253638.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23626
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253639.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23631
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 0,
                    "arguments": {
                        "root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
                        "free_bytes_available": 20568637088529616,
                        "total_number_of_free_bytes": 7196082438801259752,
                        "total_number_of_bytes": 1031
                    },
                    "time": 1573253640.5622,
                    "tid": 964,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 23636
            }
        ],
        "references": [],
        "name": "antivm_disk_size"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping",
        "severity": 2,
        "marks": [
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "Process32NextW",
                    "return_value": 1,
                    "arguments": {
                        "process_name": "8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
                        "snapshot_handle": "0x00000464",
                        "process_identifier": 2660
                    },
                    "time": 1573253589.5003,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 4178
            }
        ],
        "references": [],
        "name": "injection_process_search"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "Checks adapter addresses which can be used to detect virtual network interfaces",
        "severity": 2,
        "marks": [
            {
                "call": {
                    "category": "network",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 0,
                    "nt_status": -1073741772,
                    "api": "GetAdaptersAddresses",
                    "return_value": 111,
                    "arguments": {
                        "flags": 0,
                        "family": 0
                    },
                    "time": 1573253589.5942,
                    "tid": 1224,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 4924
            }
        ],
        "references": [],
        "name": "antivm_network_adapters"
    },
    {
        "markcount": 3,
        "families": [],
        "description": "The binary likely contains encrypted or compressed data indicative of a packer",
        "severity": 2,
        "marks": [
            {
                "entropy": 7.9998994512932,
                "section": {
                    "size_of_data": "0x001cca00",
                    "virtual_address": "0x0034d000",
                    "entropy": 7.9998994512932,
                    "name": "UPX1",
                    "virtual_size": "0x001cd000"
                },
                "type": "generic",
                "description": "A section with a high entropy has been found"
            },
            {
                "entropy": 7.0187201046065,
                "section": {
                    "size_of_data": "0x0001ec00",
                    "virtual_address": "0x0051a000",
                    "entropy": 7.0187201046065,
                    "name": ".rsrc",
                    "virtual_size": "0x0001f000"
                },
                "type": "generic",
                "description": "A section with a high entropy has been found"
            },
            {
                "entropy": 1,
                "type": "generic",
                "description": "Overall entropy of this PE file is high"
            }
        ],
        "references": [
            "http:\/\/www.forensickb.com\/2013\/03\/file-entropy-explained.html",
            "http:\/\/virii.es\/U\/Using%20Entropy%20Analysis%20to%20Find%20Encrypted%20and%20Packed%20Malware.pdf"
        ],
        "name": "packer_entropy"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "Checks for the Locally Unique Identifier on the system for a suspicious privilege",
        "severity": 2,
        "marks": [
            {
                "call": {
                    "category": "system",
                    "status": 1,
                    "stacktrace": [],
                    "api": "LookupPrivilegeValueW",
                    "return_value": 1,
                    "arguments": {
                        "system_name": "",
                        "privilege_name": "SeManageVolumePrivilege"
                    },
                    "time": 1573253588.0162,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 1103
            }
        ],
        "references": [],
        "name": "privilege_luid_check"
    },
    {
        "markcount": 3,
        "families": [],
        "description": "Queries for potentially installed applications",
        "severity": 2,
        "marks": [
            {
                "call": {
                    "category": "registry",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 3,
                    "nt_status": -1073741772,
                    "api": "RegOpenKeyExW",
                    "return_value": 2,
                    "arguments": {
                        "access": "0x00020019",
                        "base_handle": "0x80000001",
                        "key_handle": "0x00000000",
                        "regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\uTorrent",
                        "regkey_r": "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\uTorrent",
                        "options": 0
                    },
                    "time": 1573253588.3282,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 2041
            },
            {
                "call": {
                    "category": "registry",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 2,
                    "nt_status": -1073741772,
                    "api": "RegOpenKeyExW",
                    "return_value": 2,
                    "arguments": {
                        "access": "0x00020019",
                        "base_handle": "0x80000001",
                        "key_handle": "0x00000000",
                        "regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\uTorrent",
                        "regkey_r": "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\uTorrent",
                        "options": 0
                    },
                    "time": 1573253589.5162,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 4191
            },
            {
                "call": {
                    "category": "registry",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 2,
                    "nt_status": -1073741772,
                    "api": "RegOpenKeyExW",
                    "return_value": 2,
                    "arguments": {
                        "access": "0x00020019",
                        "base_handle": "0x80000001",
                        "key_handle": "0x00000000",
                        "regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\uTorrent",
                        "regkey_r": "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\uTorrent",
                        "options": 0
                    },
                    "time": 1573253589.5162,
                    "tid": 2308,
                    "flags": {}
                },
                "pid": 2660,
                "type": "call",
                "cid": 4255
            }
        ],
        "references": [],
        "name": "queries_programs"
    },
    {
        "markcount": 2,
        "families": [],
        "description": "The executable is compressed using UPX",
        "severity": 2,
        "marks": [
            {
                "section": "UPX0",
                "type": "generic",
                "description": "Section name indicates UPX"
            },
            {
                "section": "UPX1",
                "type": "generic",
                "description": "Section name indicates UPX"
            }
        ],
        "references": [],
        "name": "packer_upx"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "Disables proxy possibly for traffic interception",
        "severity": 3,
        "marks": [
            {
                "call": {
                    "category": "registry",
                    "status": 1,
                    "stacktrace": [],
                    "api": "RegSetValueExA",
                    "return_value": 0,
                    "arguments": {
                        "key_handle": "0x000004c4",
                        "value": 0,
                        "regkey_r": "ProxyEnable",
                        "reg_type": 4,
                        "regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyEnable"
                    },
                    "time": 1573253589.5782,
                    "tid": 2272,
                    "flags": {
                        "reg_type": "REG_DWORD"
                    }
                },
                "pid": 2660,
                "type": "call",
                "cid": 4719
            }
        ],
        "references": [],
        "name": "disables_proxy"
    },
    {
        "markcount": 5,
        "families": [],
        "description": "Sets or modifies WPAD proxy autoconfiguration file for traffic interception",
        "severity": 3,
        "marks": [
            {
                "call": {
                    "category": "registry",
                    "status": 1,
                    "stacktrace": [],
                    "api": "RegSetValueExA",
                    "return_value": 0,
                    "arguments": {
                        "key_handle": "0x00000548",
                        "value": 1,
                        "regkey_r": "WpadDecisionReason",
                        "reg_type": 4,
                        "regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionReason"
                    },
                    "time": 1573253592.1723,
                    "tid": 1224,
                    "flags": {
                        "reg_type": "REG_DWORD"
                    }
                },
                "pid": 2660,
                "type": "call",
                "cid": 5216
            },
            {
                "call": {
                    "category": "registry",
                    "status": 1,
                    "stacktrace": [],
                    "api": "RegSetValueExA",
                    "return_value": 0,
                    "arguments": {
                        "key_handle": "0x00000548",
                        "value": "\u00b0\u008b\u0087\u0017\u008a\u0096\u00d5\u0001",
                        "regkey_r": "WpadDecisionTime",
                        "reg_type": 3,
                        "regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionTime"
                    },
                    "time": 1573253592.1723,
                    "tid": 1224,
                    "flags": {
                        "reg_type": "REG_BINARY"
                    }
                },
                "pid": 2660,
                "type": "call",
                "cid": 5217
            },
            {
                "call": {
                    "category": "registry",
                    "status": 1,
                    "stacktrace": [],
                    "api": "RegSetValueExA",
                    "return_value": 0,
                    "arguments": {
                        "key_handle": "0x00000548",
                        "value": 3,
                        "regkey_r": "WpadDecision",
                        "reg_type": 4,
                        "regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecision"
                    },
                    "time": 1573253592.1723,
                    "tid": 1224,
                    "flags": {
                        "reg_type": "REG_DWORD"
                    }
                },
                "pid": 2660,
                "type": "call",
                "cid": 5218
            },
            {
                "call": {
                    "category": "registry",
                    "status": 1,
                    "stacktrace": [],
                    "api": "RegSetValueExW",
                    "return_value": 0,
                    "arguments": {
                        "key_handle": "0x00000548",
                        "value": "Unidentified network",
                        "regkey_r": "WpadNetworkName",
                        "reg_type": 1,
                        "regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadNetworkName"
                    },
                    "time": 1573253592.1723,
                    "tid": 1224,
                    "flags": {
                        "reg_type": "REG_SZ"
                    }
                },
                "pid": 2660,
                "type": "call",
                "cid": 5219
            },
            {
                "call": {
                    "category": "registry",
                    "status": 1,
                    "stacktrace": [],
                    "api": "RegSetValueExW",
                    "return_value": 0,
                    "arguments": {
                        "key_handle": "0x00000544",
                        "value": "{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}",
                        "regkey_r": "WpadLastNetwork",
                        "reg_type": 1,
                        "regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadLastNetwork"
                    },
                    "time": 1573253592.1872,
                    "tid": 1224,
                    "flags": {
                        "reg_type": "REG_SZ"
                    }
                },
                "pid": 2660,
                "type": "call",
                "cid": 5289
            }
        ],
        "references": [],
        "name": "modifies_proxy_wpad"
    },
    {
        "markcount": 2,
        "families": [],
        "description": "Network activity contains more than one unique useragent",
        "severity": 3,
        "marks": [
            {
                "process": "8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
                "useragent": "uTorrent(45359105433.5.5",
                "type": "generic"
            },
            {
                "process": "8916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08.bin",
                "useragent": "uTorrent\/355B",
                "type": "generic"
            }
        ],
        "references": [],
        "name": "multiple_useragents"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "Detects the presence of Wine emulator",
        "severity": 3,
        "marks": [
            {
                "category": "registry",
                "ioc": "HKEY_CURRENT_USER\\Software\\Wine",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "antiemu_wine"
    }
]

Yara

The Yara rules did not detect anything in the file.

Network

{
    "tls": [],
    "udp": [
        {
            "src": "192.168.56.101",
            "dst": "192.168.56.255",
            "offset": 546,
            "time": 3.0786499977112,
            "dport": 137,
            "sport": 137
        },
        {
            "src": "192.168.56.101",
            "dst": "192.168.56.255",
            "offset": 5874,
            "time": 9.0781419277191,
            "dport": 138,
            "sport": 138
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 7718,
            "time": 3.0183198451996,
            "dport": 5355,
            "sport": 51001
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 8046,
            "time": 1.0169160366058,
            "dport": 5355,
            "sport": 53595
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 8374,
            "time": 3.0260410308838,
            "dport": 5355,
            "sport": 53848
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 8702,
            "time": 1.649454832077,
            "dport": 5355,
            "sport": 54255
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 9030,
            "time": -0.096896171569824,
            "dport": 5355,
            "sport": 55314
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 9358,
            "time": 4.0123250484467,
            "dport": 5355,
            "sport": 55880
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 9678,
            "time": 1.0377669334412,
            "dport": 1900,
            "sport": 1900
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 29088,
            "time": 1.0380229949951,
            "dport": 3702,
            "sport": 49152
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 37472,
            "time": 3.1126439571381,
            "dport": 1900,
            "sport": 53598
        }
    ],
    "dns_servers": [],
    "http": [],
    "icmp": [],
    "smtp": [],
    "tcp": [],
    "smtp_ex": [],
    "mitm": [],
    "hosts": [],
    "pcap_sha256": "1ff3eb81b58b41c0e74e3e1f0fea83491ad435ba0498493c552a9b2bd10989cb",
    "dns": [],
    "http_ex": [],
    "domains": [],
    "dead_hosts": [],
    "sorted_pcap_sha256": "80afa314fb70d181812fb1bc0eb789a8596b59a822c1ea54fa3fe9a83e96ace3",
    "irc": [],
    "https_ex": []
}

Screenshots

Screenshot from the sandboxScreenshot from the sandboxScreenshot from the sandboxScreenshot from the sandboxScreenshot from the sandboxScreenshot from the sandboxScreenshot from the sandbox

Other files also named uTorrent.exe

uTorrent.exe (15 votes)

Hashes [?]

PropertyValue
MD53ce9b96d82f6369ba33ebdb3f7037100
SHA2568916eb67f85064b91c1c73bfc6e00faf5612b238e302587f310a4e8320c9ec08

Error Messages

These are some of the error messages that can appear related to utorrent.exe:

utorrent.exe has encountered a problem and needs to close. We are sorry for the inconvenience.

utorrent.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.

µTorrent has stopped working.

End Program - utorrent.exe. This program is not responding.

utorrent.exe is not a valid Win32 application.

utorrent.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.

What will you do with uTorrent.exe?

To help other users, please let us know what you will do with uTorrent.exe:



Malware or legitimate?

If you feel that you need more information to determine if your should keep this file or remove it, please read this guide.

Please select the option that best describe your thoughts on the information provided on this web page


Free online surveys

And now some shameless self promotion ;)

A screenshot of FreeFixer's scan result.Hi, my name is Roger Karlsson. I've been running this website since 2006. I want to let you know about the FreeFixer program. FreeFixer is a freeware tool that analyzes your system and let you manually identify unwanted programs. Once you've identified some malware files, FreeFixer is pretty good at removing them. You can download FreeFixer here. It runs on Windows 2000/XP/2003/2008/2016/2019/Vista/7/8/8.1/10. Supports both 32- and 64-bit Windows.

If you have questions, feedback on FreeFixer or the freefixer.com website, need help analyzing FreeFixer's scan result or just want to say hello, please contact me. You can find my email address at the contact page.

Comments

Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.

I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.

No comments posted yet.

Leave a reply