What is uTorrent.exe?
uTorrent.exe is part of µTorrent and developed by BitTorrent Inc. according to the uTorrent.exe version information.
uTorrent.exe's description is "µTorrent"
uTorrent.exe is digitally signed by BitTorrent Inc.
uTorrent.exe is usually located in the 'c:\users\%USERNAME%\appdata\roaming\utorrent\' folder.
Some of the anti-virus scanners at VirusTotal detected uTorrent.exe.
If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.
Vendor and version information [?]
The following is the available information on uTorrent.exe:
| Property | Value |
|---|---|
| Product name | µTorrent |
| Company name | BitTorrent Inc. |
| File description | µTorrent |
| Internal name | uTorrent.exe |
| Original filename | uTorrent.exe |
| Legal copyright | ©2020 BitTorrent, Inc. All Rights Reserved. |
| Product version | 3.5.5.45704 |
| File version | 3.5.5.45704 |
| Special build | stable34 stable |
Here's a screenshot of the file properties when displayed by Windows Explorer:
| Product name | µTorrent |
| Company name | BitTorrent Inc. |
| File description | µTorrent |
| Internal name | uTorrent.exe |
| Original filename | uTorrent.exe |
| Legal copyright | ©2020 BitTorrent, Inc. All Rights R.. |
| Product version | 3.5.5.45704 |
| File version | 3.5.5.45704 |
| Special build | stable34 stable |
Digital signatures [?]
uTorrent.exe has a valid digital signature.
| Property | Value |
|---|---|
| Signer name | BitTorrent Inc |
| Certificate issuer name | Symantec Class 3 SHA256 Code Signing CA |
| Certificate serial number | 6f13bcd50963d2f309439e37fd459c7c |
VirusTotal report
10 of the 72 anti-virus programs at VirusTotal detected the uTorrent.exe file. That's a 14% detection rate.
| Scanner | Detection Name |
|---|---|
| Antiy-AVL | GrayWare/Win32.uTorrent |
| APEX | Malicious |
| Cylance | Unsafe |
| Cyren | W32/Application.NBYY-9254 |
| ESET-NOD32 | a variant of Win32/uTorrent.C potentially unwanted |
| Fortinet | Riskware/Generic_PUA_EF |
| Ikarus | PUA.Conduit |
| Microsoft | PUA:Win32/Presenoker |
| Rising | PUA.uTorrent!8.F60A (CLOUD) |
| Sophos | Generic PUA EF (PUA) |
Sandbox Report
The following information was gathered by executing the file inside Cuckoo Sandbox.
Summary
Successfully executed process in sandbox.
Summary
{
"file_opened": [
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[1].txt",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
"C:\\",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.bin",
"C:\\Windows\\SysWOW64\\en-US\\WININET.dll.mui",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt58E2.tmp"
],
"regkey_opened": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\CertCheck\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
"HKEY_LOCAL_MACHINE\\Software\\Wine",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.bin",
"HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.44.3.4!7",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\TrustedPublisher\\Safer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_EXCLUDE_INVALID_CLIENT_CERT_KB929477",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DnsClient",
"HKEY_CLASSES_ROOT\\CLSID\\{05eeb91a-aef7-4f8a-978f-fb83e7b03f8e}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_ALLOW_LONG_INTERNATIONAL_FILENAMES",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\0",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-internet-signup",
"HKEY_CLASSES_ROOT\\CLSID\\{ef79f67a-6ad7-4715-a0f8-932fca442023}",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_DISABLE_NOTIFY_UNVERIFIED_SPN_KB2385266",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Internet Explorer",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Internet Explorer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\History",
"HKEY_CURRENT_USER\\Software\\Wine",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\uTorrent",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_UNC_SAVEDFILECHECK",
"HKEY_LOCAL_MACHINE\\Software",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\ietld",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllEncodeObject",
"HKEY_CLASSES_ROOT\\CLSID\\{49C795C2-604A-4D18-AEB1-B3EBA27E5EA2}",
"HKEY_CLASSES_ROOT\\CLSID\\{1d03a978-ac0c-4004-b9fd-9cf361c7bd3f}",
"HKEY_CLASSES_ROOT\\CLSID\\{2d8d9acc-f6d7-4362-8876-a275ca929591}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\feedplat",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-ns-proxy-autoconfig",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptCNGPKCS12GetMap",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\Signature\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Content",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0",
"HKEY_CLASSES_ROOT\\CLSID\\{ad06fb5f-fef7-4a84-8c58-dca34f8e3d36}",
"HKEY_CLASSES_ROOT\\CLSID\\{656461ef-40f6-4115-9ff1-bced9812ccbb}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllEncodeObjectEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\PFX",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\Initialization\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_RETURN_FAILED_CONNECT_CONTENT_KB942615",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\3",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Ranges\\",
"HKEY_CURRENT_USER\\Software\\Classes\\FalconBetaAccount",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\BitTorrent",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo",
"HKEY_CLASSES_ROOT\\CLSID\\{D4027C7F-154A-4066-A1AD-4243D8127440}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\msasn1",
"HKEY_CURRENT_USER\\Interface\\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\1",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\PrivacIE:",
"HKEY_CURRENT_USER\\Interface\\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_USE_UTF8_FOR_BASIC_AUTH_KB967545",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\LDAP",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\DnsCache\\Parameters",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2008",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2009",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2004",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2005",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2006",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2007",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2000",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2001",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2002",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2003",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
"HKEY_CLASSES_ROOT\\CLSID\\{3041D03E-FD4B-44E0-B742-2D9B88305F98}",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\4",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\RASAPI32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip6\\Parameters\\Winsock",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3",
"HKEY_CLASSES_ROOT\\AutoProxyTypes",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\SystemCertificates\\TrustedPublisher\\Safer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.15",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.11",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.10",
"HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.12",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\",
"HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\Security",
"HKEY_LOCAL_MACHINE\\System\\Setup",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.16.4",
"HKEY_CURRENT_USER\\Software\\Policies",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\DOMStore",
"HKEY_CLASSES_ROOT\\CLSID\\{7473B6BD-4691-4744-A82B-7854EB3D70B6}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.1.1",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\WinTrust\\Trust Providers\\Software Publishing",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\KnownClasses",
"HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings",
"HKEY_CLASSES_ROOT\\CLSID\\{181f104b-b000-4010-bb18-41b8205f774d}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Cookies",
"HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Wpad",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_BUFFERBREAKING_818408",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\\ProxyStubClsid32",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\1",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\0",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\4",
"HKEY_CLASSES_ROOT\\CLSID\\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\2",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\0",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllEncodePublicKeyAndParameters",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject",
"HKEY_CLASSES_ROOT\\CLSID\\{c840e246-6b95-475e-9bd7-caa1c7eca9f2}",
"HKEY_CLASSES_ROOT\\CLSID\\{db131c55-60c8-4adc-84dc-9e76ab06e2dc}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN",
"HKEY_CURRENT_USER\\Software\\uTorrentPurchases\\PurchasedKeys",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\Certificate\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
"HKEY_CURRENT_USER\\Interface\\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptCNGInitHMAC",
"HKEY_CURRENT_USER\\Interface\\{55272A00-42CB-11CE-8135-00AA004BB851}",
"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\TreatAs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2221",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2222",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\Message\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\\ProxyStubClsid32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\RETRY_HEADERONLYPOST_ONCONNECTIONRESET",
"HKEY_CLASSES_ROOT\\CLSID\\{4ae0c3d6-f713-4eed-bc65-25dc3ffdaac1}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}",
"HKEY_CURRENT_USER\\Software\\BitTorrentPersist",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\History",
"HKEY_CURRENT_USER\\Software\\BitTorrent\\uTorrent",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\RASMANCS",
"HKEY_CLASSES_ROOT\\CLSID\\{e0301295-ab3e-4af3-979f-3d453c5f9f48}",
"HKEY_CLASSES_ROOT\\CLSID\\{7b6de06c-7013-4a87-957e-d27d7b977d21}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Cookies",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019040920190410",
"HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\Progid",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.30",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocHandler32",
"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Winsock\\Setup Migration\\Providers",
"HKEY_CURRENT_USER\\Software\\uTorrentPlus",
"HKEY_CLASSES_ROOT\\CLSID\\{91397D20-1446-11D4-8AF4-0040CA1127B6}",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001",
"HKEY_CURRENT_USER\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_DISALLOW_NULL_IN_RESPONSE_HEADERS",
"HKEY_CLASSES_ROOT\\CLSID\\{6DA66498-839A-42A7-8324-FF7D2A532835}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocHandler",
"HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\LayoutIcon\\0409\\0000041d",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.47.1.1!7",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProtocolDefaults\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_COMPAT_USE_CONNECTION_BASED_NEGOTIATE_AUTH_KB2151543",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Shell\\RegisteredApplications\\UrlAssociations\\http\\OpenWithProgids",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\4",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle",
"HKEY_CLASSES_ROOT\\CLSID\\{F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_USE_CNAME_FOR_SPN_KB911149",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\3",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Content",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\2",
"HKEY_LOCAL_MACHINE\\Software\\Policies",
"HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\shell\\open",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{55272A00-42CB-11CE-8135-00AA004BB851}\\ProxyStubClsid32",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\DiagnosticPolicy\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.47.1.1!7",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\\ProxyStubClsid32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptCNGInitHMAC",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_DIGEST_NO_EXTRAS_IN_URI",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\TrustedPublisher\\Safer",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\",
"HKEY_CURRENT_USER\\Software",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.16.1.1",
"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Network\\Location Awareness",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.28",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",
"HKEY_CLASSES_ROOT\\CLSID\\{03ea5b10-2efa-4311-ac10-04427b02d663}",
"HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\CurVer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.25",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.26",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.27",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.20",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_UNC_SAVEDFILECHECK",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.2.11",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllExportPrivateKeyInfoEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.2.12",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\2",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\LSA\\AccessProviders",
"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptCNGPKCS12GetMap",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Ranges\\",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CLASSES_ROOT\\CLSID\\{B6AC5E3C-5CEB-4E72-B451-F0E1BA983C14}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\Cleanup\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
"HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\shell\\open\\command",
"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\crypt32",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip6",
"HKEY_CURRENT_USER\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}",
"HKEY_CLASSES_ROOT\\FirefoxURL-E7CF176E110C211B",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.2.4",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OleAut",
"HKEY_CLASSES_ROOT\\CLSID\\{4E871705-D1F3-49D9-814F-1E46E85986B0}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.2.1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_SECURITY_FLAG_IGNORE_REVOCATION_KB2275828",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.2.3",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.2.2",
"HKEY_CLASSES_ROOT\\CLSID\\{87775fdb-6972-41f9-ae51-8326e38cb206}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_USE_IETLDLIST_FOR_DOMAIN_DETERMINATION",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Layers",
"HKEY_CLASSES_ROOT\\CLSID\\{5BA8E555-8C08-4CC8-80E6-1F8CDD26AE3A}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodePublicKeyAndParameters",
"HKEY_CLASSES_ROOT\\CLSID\\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_MIME_HANDLING",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\Progid",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllExportPrivateKeyInfoEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_INCLUDE_PORT_IN_SPN_KB908209",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2130",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.4",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\\ProxyStubClsid32",
"HKEY_CLASSES_ROOT\\CLSID\\{29acf17c-1713-4286-8f40-bfd05f1e70c8}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{3697C5FA-60DD-4B56-92D4-74A569205C16}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Winsock\\Parameters",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Ranges\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.44.3.4!7",
"HKEY_CLASSES_ROOT\\CLSID\\{e9df9360-97f8-4690-afe6-996c80790da4}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache",
"HKEY_CLASSES_ROOT\\CLSID\\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\",
"HKEY_CURRENT_USER\\Software\\Classes\\.torrent",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Layers",
"HKEY_CLASSES_ROOT\\CLSID\\{1fd59ce2-6236-467c-9539-3d8c93fea5e0}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.12.2.1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.12.2.2",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_ENABLE_PASSPORT_SESSION_STORE_KB948608",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\3",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_RELEASE_KEYS_ON_UNLOAD_KB975619",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}"
],
"fetches_url": [
"http:\/\/update.utorrent.com\/installstats.php?cl=uTorrent&v=111915656&h=BYMsM6I6O0Z6AOUq&w=1DB10106&bu=0&pr=0&cmp=0&ocmp=0&showinstall&pid=2456&cau=0&au=0&view=win32",
"http:\/\/update.utorrent.com\/installoffer.php?h=BYMsM6I6O0Z6AOUq&v=111915656&w=1DB10106&l=en&c=US&w64=1&db=firefox&cl=uTorrent&tsub=1&svp=4",
"http:\/\/update.utorrent.com\/installstats.php?cl=uTorrent&v=111915656&h=BYMsM6I6O0Z6AOUq&w=1DB10106&bu=0&pr=0&cmp=0&ocmp=0&showwarning&pid=2456&cau=0&view=win32",
"http:\/\/update.utorrent.com\/installstats.php?cl=uTorrent&v=111915656&h=BYMsM6I6O0Z6AOUq&w=1DB10106&bu=0&pr=0&cmp=0&ocmp=0&showtbexists&pid=2456&cau=0&tbe=0&cd=0&view=win32"
],
"guid": [
"{a47979d2-c419-11d9-a5b4-001185ad2b89}",
"{dcb00c01-570f-4a9b-8d69-199fdba5723b}",
"{dcb00000-570f-4a9b-8d69-199fdba5723b}",
"{d0074ffd-570f-4a9b-8d69-199fdba5723b}"
],
"file_deleted": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A1B.tmp",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt697E.tmp",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt58E2.tmp"
],
"regkey_written": [
"HKEY_CURRENT_USER\\Software\\BitTorrent\\computerID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\EnableFileTracing",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\EnableConsoleTracing",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\EnableConsoleTracing",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadNetworkName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\FileDirectory",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\FileTracingMask",
"HKEY_CURRENT_USER\\FalconBetaAccount\\remote_access_client_id",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\MaxFileSize",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\LanguageList",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\FileTracingMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\ConsoleTracingMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\FileDirectory",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyEnable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\EnableFileTracing",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionReason",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecision",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\ConsoleTracingMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\MaxFileSize",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionTime",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadLastNetwork",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\SavedLegacySettings"
],
"file_copied": [
[
"C:\\Users\\cuck\\AppData\\Local\\Temp\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.bin",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates\\3.5.5_45704.exe"
]
],
"regkey_deleted": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyOverride",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL"
],
"mutex": [
"Local\\\u00b5Torrent4823DF041B09",
"Local\\ZonesCounterMutex",
"RasPbFile",
"Local\\ZonesLockedCacheCounterMutex",
"Local\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.bin",
"Local\\ZoneAttributeCacheCounterMutex",
"IESQMMUTEX_0_208",
"Local\\ZonesCacheCounterMutex"
],
"file_read": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.bin"
],
"regkey_read": [
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Language Hotkey",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-internet-signup\\Flags",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\StreamResourceType",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Hotkey",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Initialization\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\DOMStore\\CacheLimit",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}\\Enable",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SendTimeOut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Stream",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019040920190410\\CachePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\ParsingName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld\\IETldVersionLow",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\UseDelayedAcceptance",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableWorkerThreadHibernation",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\EnableConsoleTracing",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisablePassport",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\ConsoleTracingMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Content\\PerUserItem",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Signature\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Stream",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CertificateRevocation",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_MIME_HANDLING\\*",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\IdnEnabled",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.44.3.4!7\\Name",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\crypt32\\DiagMatchAnyMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableWorkerThreadHibernation",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\HeaderExclusionListForCache",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyHttp1.1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Description",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SocketSendBufferLength",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\ietld\\CachePrefix",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableHttp1_1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\FileTracingMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\CTF\\EnableAnchorContext",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice\\Progid",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Attributes",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\ietld\\CacheLimit",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019040920190410\\CacheRepair",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\BypassSSLNoCacheCheck",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\ScavengeCacheFileLimit",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\EnableFileTracing",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-internet-signup\\DllFile",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SecureProtocols",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\NoNetAutodial",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld\\IETldDllVersionHigh",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\PrivacIE:\\CachePrefix",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\LocalRedirectOnly",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\PrivacIE:\\CachePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.bin",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AlwaysDrainOnRedirect",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParentFolder",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0\\Flags",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\CertCheck\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalRedirectOnly",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ConnectTimeOut",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyOverride",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxySettingsPerUser",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ReceiveTimeOut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\BypassSSLNoCacheCheck",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Parameters\\Transports",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Attributes",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\DOMStore\\CachePrefix",
"HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\shell\\open\\command\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Cookies\\CacheLimit",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\UseHostnameAsAlias",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerProxy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_UNC_SAVEDFILECHECK\\*",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Signature\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyHttp1.1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Icon",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld\\IETldVersionHigh",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CertCacheNoValidate",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\PerUserCookies",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\Feature_ClientAuthCertFilter",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Cookies\\PerUserItem",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SendExtraCRLF",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Security\\DisableSecuritySettingsCheck",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledSessions\\GlobalSession",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\EnableConsoleTracing",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadOverride",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN\\*",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledProcesses\\3FE8B803",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\LocalRedirectOnly",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Layout Hotkey",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DialupUseLanSettings",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Security",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1\\Flags",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\\ProxyStubClsid32\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019040920190410\\CachePrefix",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\FileDirectory",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019040920190410\\CacheOptions",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableAutoProxyResultCache",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SyncMode5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledSessions\\MachineThrottling",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyHttp1.1",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\ScavengeCacheFileLimit",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-ns-proxy-autoconfig\\FileExtensions",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\SessionStartTimeDefaultDeltaSecs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerServer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001\\ProfileImagePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\History\\PerUserItem",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_UNC_SAVEDFILECHECK\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.bin",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableHttp1_1",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyEnable",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\ietld\\CachePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableKeepAlive",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\MaxFileSize",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\ScavengeCacheFileLifeTime",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Message\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\History\\CacheLimit",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MimeExclusionListForCache",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\My Music",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Hostname",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3\\Flags",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\FromCacheTimeout",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\Security\\DisableSecuritySettingsCheck",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\My Video",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\HttpDefaultExpiryTimeSecs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DontUseDNSLoadBalancing",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\EnableConsoleTracing",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Cookies\\PerUserItem",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\HelperDllName",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip6\\WinSock 2.0 Provider ID",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\feedplat\\CachePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\ietld\\CacheRepair",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MBCSAPIforCrack",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Cookies\\CachePrefix",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableCachingOfSSLPages",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Certificate\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResource",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ClientAuthBuiltInUI",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ReceiveTimeOut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PreCreate",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\History\\PerUserItem",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableAutodial",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\UseOldHostResolutionOrder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Cleanup\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\PrivacIE:\\CacheLimit",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PreCreate",
"HKEY_CURRENT_USER\\Software\\BitTorrent\\computerID",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\feedplat\\CacheOptions",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\\ProxyStubClsid32\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\feedplat\\CachePrefix",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\EnableFileTracing",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\UTF8ServerNameRes",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DnsCacheTimeout",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisplayScriptDownloadFailureUI",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\InfoTip",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxHttpRedirects",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParsingName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ConnectRetries",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WpadSearchAllDomains",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\FileDirectory",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\ietld\\CacheOptions",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\\ProxyStubClsid32\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableBasicOverClearChannel",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InitFolderHandler",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\\*",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Roamable",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\LdapClientIntegrity",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@%SystemRoot%\\system32\\p2pcollab.dll,-8042",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnOnPostRedirect",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Initialization\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\MinSockaddrLength",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Content\\CacheLimit",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{55272A00-42CB-11CE-8135-00AA004BB851}\\ProxyStubClsid32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-ns-proxy-autoconfig\\Flags",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CacheMode",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadLastNetwork",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\ScavengeCacheFileLimit",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnOnHTTPSToHTTPRedirect",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019040920190410\\CacheLimit",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ScavengeCacheLowerBound",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DialupUseLanSettings",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-ns-proxy-autoconfig\\Default",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Attributes",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DontUseDNSLoadBalancing",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SecureProtocols",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Roamable",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\KeepAliveTimeout",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerServer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Category",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\feedplat\\CacheLimit",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\FileTracingMask",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableNTLMPreAuth",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-ns-proxy-autoconfig\\DllFile",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Personal",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\MaxSockaddrLength",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ConnectRetries",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ServerInfoTimeout",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\DOMStore\\CachePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnAlwaysOnPost",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Content\\PerUserItem",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\WinTrust\\Trust Providers\\Software Publishing\\State",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\SavedLegacySettings",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7\\Name",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld\\IETldDllVersionLow",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\ParentFolder",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\History\\CachePrefix",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MBCSServername",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@%SystemRoot%\\system32\\dnsapi.dll,-103",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\LocalizedName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2\\Flags",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_MIME_HANDLING\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.bin",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Certificate\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3\\1A10",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SecureProtocols",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Security_HKLM_only",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\FtpDefaultExpiryTimeSecs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\BypassHTTPNoCacheCheck",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\ThreadingModel",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK\\*",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\NoCheckAutodialOverRide",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.bin",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DnsCacheEnabled",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\AccessProviders\\MartaExtension",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyHttp1.1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\CertCheck\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
"HKEY_CURRENT_USER\\Software\\BitTorrent\\StatsTesting",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\BadProxyExpiresTime",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnOnBadCertRecving",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Content\\CachePrefix",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\InprocServer32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Message\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ShareCredsWithWinHttp",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPer1_0Server",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoProxyDetectType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\StreamResource",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\PrivacIE:\\CacheOptions",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableBranchCache",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\crypt32\\DiagLevel",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\feedplat\\CacheRepair",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableHttpTrace",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4\\Flags",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\FolderTypeID",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Security\\Safety Warning Level",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Cleanup\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Security",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InfoTip",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MigrateProxy",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnOnZoneCrossing",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\GlobalUserOffline",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\NoCheckAutodialOverRide",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigCustomUA",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnOnPost",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\LeashLegacyCookies",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\\ProxyStubClsid32\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableNegotiate",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DnsCacheEntries",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\MaxFileSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPer1_0Server",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableHttp1_1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SendTimeOut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.bin",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Name",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\DOMStore\\CacheOptions",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SocketReceiveBufferLength",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\FolderTypeID",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\PrivacIE:\\CacheRepair",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-internet-signup\\Default",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.47.1.1!7\\Name",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Signature",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ConnectTimeOut",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\DOMStore\\CacheRepair",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\ConsoleTracingMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PublishExpandedPath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableReadRange",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\Mapping",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\TcpAutotuning",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-internet-signup\\FileExtensions",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\RelativePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\BypassHTTPNoCacheCheck"
],
"file_created": [
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[1].txt",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A1B.tmp.1594457588\\index.hta.log",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A1B.tmp.1594457588\\HTA\\install.1594457588.zip",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt697E.tmp",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat.new",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates.dat",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc.new",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A1B.tmp",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt697E.tmp.new",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt58E2.tmp"
],
"dll_loaded": [
"DBGHELP.DLL",
"COMDLG32.dll",
"profapi.dll",
"urlmon.dll",
"kernel32",
"C:\\Windows\\system32\\symsrv.dll",
"ntdll",
"api-ms-win-core-sysinfo-l1-2-1",
"api-ms-win-core-localization-l1-2-1",
"DNSAPI.dll",
"DHCPCSVC.DLL",
"kernel32.dll",
"gdiplus.dll",
"ws2_32",
"C:\\Windows\\system32\\ole32.dll",
"dwmapi.dll",
"ntdll.dll",
"ntmarta.dll",
"shlwapi.dll",
"C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll",
"api-ms-win-core-synch-l1-2-0",
"iphlpapi",
"OLEAUT32.DLL",
"ncrypt.dll",
"sensapi.dll",
"Crypt32.dll",
"Riched20.dll",
"C:\\Windows\\system32\\napinsp.dll",
"C:\\Windows\\syswow64\\MSCTF.dll",
"WININET.dll",
"C:\\Windows\\System32\\wship6.dll",
"C:\\Windows\\SysWOW64\\bcryptprimitives.dll",
"dnsapi",
"KERNEL32.DLL",
"psapi.dll",
"cryptbase.dll",
"WTSAPI32.dll",
"RASMAN.DLL",
"Iphlpapi.dll",
"advapi32.dll",
"api-ms-win-security-systemfunctions-l1-1-0",
"ole32.dll",
"SHLWAPI.dll",
"CRYPTSP.dll",
"USER32.dll",
"IMM32.dll",
"API-MS-Win-Security-SDDL-L1-1-0.dll",
"API-MS-WIN-Service-winsvc-L1-1-0.dll",
"wintrust.dll",
"rtutils.dll",
"IPHLPAPI.DLL",
"C:\\Windows\\SysWOW64\\oleaut32.dll",
"wininet.dll",
"RASAPI32.dll",
"OLEAUT32.dll",
"C:\\Windows\\system32\\pnrpnsp.dll",
"comctl32",
"SHELL32.dll",
"RPCRT4.dll",
"DnsApi.dll",
"C:\\Windows\\System32\\winrnr.dll",
"PSAPI.DLL",
"comctl32.dll",
"COMCTL32.dll",
"C:\\Windows\\system32\\NLAapi.dll",
"VERSION.dll",
"Secur32.dll",
"api-ms-win-core-fibers-l1-1-1",
"GDI32.dll",
"UxTheme.dll",
"C:\\Windows\\system32\\mswsock.dll",
"API-MS-WIN-Service-Management-L1-1-0.dll",
"ADVAPI32.dll",
"advapi32",
"SETUPAPI.dll",
"WS2_32.dll",
"user32.dll",
"MSIMG32.dll"
],
"file_moved": [
[
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc.new",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc"
],
[
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat.old"
],
[
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt697E.tmp",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt697E.tmp.old"
],
[
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat.new",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat"
],
[
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt697E.tmp.new",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt697E.tmp"
],
[
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc.old"
]
],
"file_written": [
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[1].txt",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A1B.tmp.1594457588\\index.hta.log",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates.dat",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat.new",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc.new",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt697E.tmp.new",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt58E2.tmp"
],
"file_recreated": [
"\\Device\\KsecDD"
],
"directory_created": [
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A1B.tmp.1594457588\\HTA\\",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates\\",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A1B.tmp.1594457588"
],
"file_failed": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\sechost.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\rasadhlp.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\msctf.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wlpk.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\nsi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\crypt32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\ole32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\mswsock.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wuser32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\DLL\\winnsi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\profapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\msasn1.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\cryptsp.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\setupapi.pdb",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\current.btskin",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\msvcrt.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\bin\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\shell32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\mswsock.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wtsapi32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\msimg32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wkernel32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\rsaenh.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wntdll.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\advapi32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\MicrosoftWindowsGdiPlus-1.1.7601.17514-gdiplus.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wininet.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wsspicli.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\DLL\\dbghelp.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\devobj.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\cfgmgr32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wrpcrt4.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\winnsi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\DLL\\winnsi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wininet.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\DLL\\psapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ole32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\msasn1.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wship6.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\secur32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\ole32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\shlwapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\cryptbase.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wkernelbase.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wkernelbase.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wshtcpip.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\crypt32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\msvcrt.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\secur32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wimm32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\comctl32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\usp10.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\comdlg32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dnsapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\advapi32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\setupapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\msctf.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\dnsapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\userenv.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\shell32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\bcrypt.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\MicrosoftWindowsGdiPlus-1.1.7601.17514-gdiplus.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wship6.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\oleaut32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\devobj.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\devobj.pdb",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates\\sua_pmr",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\webui.zip",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wkernel32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\urlmon.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\DLL\\dbghelp.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\bcryptprimitives.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ws2_32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wrpcrt4.pdb",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\utorrent.lng",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\bin\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wintrust.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wrpcrt4.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\DLL\\wimm32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wkernel32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\nsi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\cryptsp.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\rasadhlp.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\ws2_32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wuser32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\bin\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.dbg",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\DLL\\psapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\cryptbase.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\version.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\bcryptprimitives.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\oleaut32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\rsaenh.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wininet.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wuser32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wgdi32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\dnsapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wkernelbase.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\shlwapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\iertutil.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wuxtheme.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wshtcpip.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\msvcrt.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\iphlpapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\comdlg32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wsspicli.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\userenv.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\shell32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dbghelp.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\DLL\\iphlpapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ncrypt.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wntdll.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wintrust.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\advapi32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wtsapi32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\msimg32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\bcryptprimitives.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\cryptbase.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\version.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wgdi32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\profapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.dbg",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\msimg32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wtsapi32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\ncrypt.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\ws2_32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\bin\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.dbg",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\iertutil.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wlpk.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\bcrypt.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\msasn1.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wuxtheme.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wshtcpip.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\MicrosoftWindowsGdiPlus-1.1.7601.17514-gdiplus.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\comctl32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\comdlg32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\urlmon.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\setupapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\sechost.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\nsi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\msctf.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\usp10.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\cfgmgr32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\bcrypt.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\iertutil.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\DLL\\iphlpapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\ncrypt.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\userenv.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\profapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\version.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wlpk.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\psapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\cfgmgr32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wsspicli.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\usp10.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\rsaenh.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\mswsock.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wgdi32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\DLL\\wimm32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\cryptsp.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\rasadhlp.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\crypt32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wintrust.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.bin.lang.txt",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wntdll.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\comctl32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\urlmon.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\secur32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wuxtheme.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\shlwapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wship6.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\sechost.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\oleaut32.pdb"
],
"resolves_host": [
"router.utorrent.com",
"i-50.b-000.xyz.bench.utorrent.com",
"update.utorrent.com",
"cuckpc",
"router.bittorrent.com",
"download-lb.utorrent.com",
"wpad"
],
"connects_ip": [
"127.0.0.1"
],
"file_exists": [
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\uTorrent.exe",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat.new",
"C:\\Users\\cuck\\AppData\\Local\\Temp",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\dht_feed.dat.old",
"C:\\Users\\cuck\\Music",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt58E2.tmp",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\dht_feed.dat",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\",
"C:\\Windows\\System32\\qagentrt.dll",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates.dat",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\settings.dat",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\dht.dat.new",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat.old",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\current.btskin",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates.dat.old",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt697E.tmp.new",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates.dat.new",
"C:\\Users\\cuck\\Documents",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\dht_feed.dat.new",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc.new",
"C:\\Windows\\System32\\dnsapi.dll",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\settings.dat.old",
"C:\\Users\\cuck\\Videos",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\dht.dat.old",
"C:\\Windows\\System32\\p2pcollab.dll",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[1].txt",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utorrent.lng",
"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates\\3.5.5_45704.exe",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\dht.dat"
],
"directory_enumerated": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\profapi.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wininet.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ws2_32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wtsapi32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\crypt32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\shell32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wkernelbase.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wrpcrt4.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\devobj.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\rasphone.pbk",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ncrypt.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wlpk.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\mswsock.pdb\\*",
"C:\\Windows\\System32\\ras\\*.pbk",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\sechost.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\setupapi.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\bcrypt.pdb\\*",
"C:\\Users\\cuck\\AppData",
"C:\\ProgramData\\Microsoft\\Network\\Connections\\Pbk\\rasphone.pbk",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\msasn1.pdb\\*",
"C:\\Users",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\iertutil.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\msvcrt.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wsspicli.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wgdi32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\winnsi.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dnsapi.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wintrust.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\usp10.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\iphlpapi.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wshtcpip.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\nsi.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wuxtheme.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\urlmon.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\cfgmgr32.pdb\\*",
"C:\\Users\\cuck",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\msimg32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\cryptsp.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dbghelp.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\userenv.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wship6.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\bcryptprimitives.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\comctl32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wuser32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wimm32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*.pbk",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\psapi.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\rsaenh.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\msctf.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\comdlg32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wkernel32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wntdll.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\shlwapi.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\advapi32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\rasadhlp.pdb\\*",
"C:\\ProgramData\\Microsoft\\Network\\Connections\\Pbk\\*.pbk",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\cryptbase.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\version.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ole32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\MicrosoftWindowsGdiPlus-1.1.7601.17514-gdiplus.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.dbg\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\secur32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\oleaut32.pdb\\*"
]
}Dropped
[
{
"yara": [],
"sha1": "7a67113f4204a2bf1250402ba9b7ba457a4bae6d",
"name": "2b1d8f74b6b7ef38_index.hta.log",
"filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A1B.tmp.1594457588\\index.hta.log",
"type": "ASCII text, with CRLF line terminators",
"sha256": "2b1d8f74b6b7ef3811b62e9320953577a736ed64ab9dd5c3e2390d994a10d234",
"urls": [],
"crc32": "3F5BADA9",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/8272\/files\/2b1d8f74b6b7ef38_index.hta.log",
"ssdeep": null,
"size": 26,
"sha512": "95c76090d4edb0ae45f9d6eda45a2497651f0808eecc727d4f4d5fada0c47c82080e4bf6944ad5220ec86cef80e69436cbda3a66cad607556a457c8c38f4729b",
"pids": [
2456
],
"md5": "2b632a88af93f552846fdbf6890e8613"
},
{
"yara": [],
"sha1": "4ff194771e4dbdbfb59b1d9716cb62393e639951",
"name": "770657a882abc063_settings.dat.old",
"filepath": "c:\\users\\cuck\\appdata\\roaming\\utorrent\\settings.dat.old",
"type": "data",
"sha256": "770657a882abc063b1b680bae7ccd80c317d3b2303369fef8a5206ae397f8174",
"urls": [],
"crc32": "FF7E8EDC",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/8272\/files\/770657a882abc063_settings.dat.old",
"ssdeep": null,
"size": 8169,
"sha512": "c8a58ea4438c6c161eb7b11147f61a01a6d95fc9e2e727eadab7fda20e0a9c366b60e9a3eb04c09bb9cd7eb78099492baeb60043215e6b415967fcb499e8a8db",
"pids": [
2456
],
"md5": "1ae6a0cacfc734849feb8ac9e6d55f59"
},
{
"yara": [],
"sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
"name": "e3b0c44298fc1c14_utt58E2.tmp",
"type": "empty",
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"urls": [],
"crc32": "00000000",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/8272\/files\/e3b0c44298fc1c14_utt58E2.tmp",
"ssdeep": null,
"size": 0,
"sha512": "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e",
"md5": "d41d8cd98f00b204e9800998ecf8427e"
},
{
"yara": [],
"sha1": "7ddfd3ad4003bbec01121d56130171f1df479a7b",
"name": "e6831778905d3d26_cuck@localhost[1].txt",
"filepath": "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[1].txt",
"type": "ASCII text",
"sha256": "e6831778905d3d26cc98322e7221fdda2c4f0ef342811c6a324c5a558cffa740",
"urls": [
"http:\/\/localhost:0\/proxy\/0\/"
],
"crc32": "52E7ACB6",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/8272\/files\/e6831778905d3d26_cuck@localhost[1].txt",
"ssdeep": null,
"size": 89,
"sha512": "18cd002fd098aa263ee31f2575753ae05beeb83d705123b8ec559a5b5811baf27ffc6fad0582a83776b8d787da4f5b0fba41715bcff4862bbecf387f8d2e2810",
"pids": [
2456
],
"md5": "9e89134155719a8d21e1876ce103c2e5"
},
{
"yara": [],
"sha1": "c11acbfd6c603caa0a2cda9b9acc666abedb65bc",
"name": "eb3d2c81bafa0ba1_settings.dat",
"filepath": "c:\\users\\cuck\\appdata\\roaming\\utorrent\\settings.dat",
"type": "data",
"sha256": "eb3d2c81bafa0ba19737092c47c111b4966a4d12666a74ebae3a37bef9b683c1",
"urls": [],
"crc32": "142B8EAB",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/8272\/files\/eb3d2c81bafa0ba1_settings.dat",
"ssdeep": null,
"size": 8232,
"sha512": "d6c5c67d10e49e22838987bbf0483f1ff2752e1fabb594e81dc2a22a48525cac9941ae64ad96dbdb480fa48ac6b89b727e27e95671a0338165ad88a7edc9e720",
"pids": [
2456
],
"md5": "017c82fba6213de410c684378a72e5a7"
},
{
"yara": [],
"sha1": "0f5436f818cab24e7966e0656cc7bbe2705a95b6",
"name": "388fa64cc134ff0a_utt697e.tmp",
"filepath": "c:\\users\\cuck\\appdata\\local\\temp\\utt697e.tmp",
"type": "ASCII text, with no line terminators",
"sha256": "388fa64cc134ff0a52a92edd29a113b1eeb64b28273502b456bcc3470c423f04",
"urls": [],
"crc32": "156E3511",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/8272\/files\/388fa64cc134ff0a_utt697e.tmp",
"ssdeep": null,
"size": 240,
"sha512": "551ceee919d8f82bf702aedff536d25977ef85e31a9479db436a2df93d56260f6d72fb9ca17b9b0f4b09a88c2c95474e36a21a2e1922c4f02dc1102e41d3bd81",
"pids": [
2456
],
"md5": "ced9d98dc09379c6865ba13ffc220ccd"
},
{
"yara": [],
"sha1": "44e94c1a84ea6de81652a3fa9ba676a213cfb9fa",
"name": "6e92fed46aab2447_updates.dat",
"filepath": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates.dat",
"type": "ASCII text, with very long lines, with no line terminators",
"sha256": "6e92fed46aab2447ff3d8519b9d29a6a8eb1041ec5e812f889579557fe288ce5",
"urls": [],
"crc32": "0044B6C4",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/8272\/files\/6e92fed46aab2447_updates.dat",
"ssdeep": null,
"size": 343,
"sha512": "2d15a6e5380bf13970bff2a053fc0352119e18a7a83f2a48f8445f2b8b332ae63df3d55ed2bfc88378cae7737a2c0d8a6e3d5ab6bec40f85118a920ef7b0c98e",
"pids": [
2456
],
"md5": "a7735fb1caea68449ab6551ca2ef4831"
}
]Generic
[
{
"process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.bin",
"process_name": "a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.bin",
"pid": 2456,
"summary": {
"file_opened": [
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[1].txt",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
"C:\\",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.bin",
"C:\\Windows\\SysWOW64\\en-US\\WININET.dll.mui",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt58E2.tmp"
],
"regkey_opened": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\CertCheck\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
"HKEY_LOCAL_MACHINE\\Software\\Wine",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.bin",
"HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.44.3.4!7",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\TrustedPublisher\\Safer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_EXCLUDE_INVALID_CLIENT_CERT_KB929477",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DnsClient",
"HKEY_CLASSES_ROOT\\CLSID\\{05eeb91a-aef7-4f8a-978f-fb83e7b03f8e}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_ALLOW_LONG_INTERNATIONAL_FILENAMES",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\0",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-internet-signup",
"HKEY_CLASSES_ROOT\\CLSID\\{ef79f67a-6ad7-4715-a0f8-932fca442023}",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_DISABLE_NOTIFY_UNVERIFIED_SPN_KB2385266",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Internet Explorer",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Internet Explorer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\History",
"HKEY_CURRENT_USER\\Software\\Wine",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\uTorrent",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_UNC_SAVEDFILECHECK",
"HKEY_LOCAL_MACHINE\\Software",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\ietld",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllEncodeObject",
"HKEY_CLASSES_ROOT\\CLSID\\{49C795C2-604A-4D18-AEB1-B3EBA27E5EA2}",
"HKEY_CLASSES_ROOT\\CLSID\\{1d03a978-ac0c-4004-b9fd-9cf361c7bd3f}",
"HKEY_CLASSES_ROOT\\CLSID\\{2d8d9acc-f6d7-4362-8876-a275ca929591}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\feedplat",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-ns-proxy-autoconfig",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptCNGPKCS12GetMap",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\Signature\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Content",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0",
"HKEY_CLASSES_ROOT\\CLSID\\{ad06fb5f-fef7-4a84-8c58-dca34f8e3d36}",
"HKEY_CLASSES_ROOT\\CLSID\\{656461ef-40f6-4115-9ff1-bced9812ccbb}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllEncodeObjectEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\PFX",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\Initialization\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_RETURN_FAILED_CONNECT_CONTENT_KB942615",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\3",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Ranges\\",
"HKEY_CURRENT_USER\\Software\\Classes\\FalconBetaAccount",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\BitTorrent",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo",
"HKEY_CLASSES_ROOT\\CLSID\\{D4027C7F-154A-4066-A1AD-4243D8127440}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\msasn1",
"HKEY_CURRENT_USER\\Interface\\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\1",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\PrivacIE:",
"HKEY_CURRENT_USER\\Interface\\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_USE_UTF8_FOR_BASIC_AUTH_KB967545",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\LDAP",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\DnsCache\\Parameters",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2008",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2009",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2004",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2005",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2006",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2007",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2000",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2001",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2002",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2003",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
"HKEY_CLASSES_ROOT\\CLSID\\{3041D03E-FD4B-44E0-B742-2D9B88305F98}",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\4",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\RASAPI32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip6\\Parameters\\Winsock",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3",
"HKEY_CLASSES_ROOT\\AutoProxyTypes",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\SystemCertificates\\TrustedPublisher\\Safer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.15",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.11",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.10",
"HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.12",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\",
"HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\Security",
"HKEY_LOCAL_MACHINE\\System\\Setup",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.16.4",
"HKEY_CURRENT_USER\\Software\\Policies",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\DOMStore",
"HKEY_CLASSES_ROOT\\CLSID\\{7473B6BD-4691-4744-A82B-7854EB3D70B6}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.1.1",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\WinTrust\\Trust Providers\\Software Publishing",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\KnownClasses",
"HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings",
"HKEY_CLASSES_ROOT\\CLSID\\{181f104b-b000-4010-bb18-41b8205f774d}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Cookies",
"HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Wpad",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_BUFFERBREAKING_818408",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\\ProxyStubClsid32",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\1",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\0",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\4",
"HKEY_CLASSES_ROOT\\CLSID\\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\2",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\0",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllEncodePublicKeyAndParameters",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject",
"HKEY_CLASSES_ROOT\\CLSID\\{c840e246-6b95-475e-9bd7-caa1c7eca9f2}",
"HKEY_CLASSES_ROOT\\CLSID\\{db131c55-60c8-4adc-84dc-9e76ab06e2dc}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN",
"HKEY_CURRENT_USER\\Software\\uTorrentPurchases\\PurchasedKeys",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\Certificate\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
"HKEY_CURRENT_USER\\Interface\\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptCNGInitHMAC",
"HKEY_CURRENT_USER\\Interface\\{55272A00-42CB-11CE-8135-00AA004BB851}",
"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\TreatAs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2221",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2222",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\Message\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\\ProxyStubClsid32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\RETRY_HEADERONLYPOST_ONCONNECTIONRESET",
"HKEY_CLASSES_ROOT\\CLSID\\{4ae0c3d6-f713-4eed-bc65-25dc3ffdaac1}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}",
"HKEY_CURRENT_USER\\Software\\BitTorrentPersist",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\History",
"HKEY_CURRENT_USER\\Software\\BitTorrent\\uTorrent",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\RASMANCS",
"HKEY_CLASSES_ROOT\\CLSID\\{e0301295-ab3e-4af3-979f-3d453c5f9f48}",
"HKEY_CLASSES_ROOT\\CLSID\\{7b6de06c-7013-4a87-957e-d27d7b977d21}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Cookies",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019040920190410",
"HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\Progid",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.30",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocHandler32",
"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Winsock\\Setup Migration\\Providers",
"HKEY_CURRENT_USER\\Software\\uTorrentPlus",
"HKEY_CLASSES_ROOT\\CLSID\\{91397D20-1446-11D4-8AF4-0040CA1127B6}",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001",
"HKEY_CURRENT_USER\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_DISALLOW_NULL_IN_RESPONSE_HEADERS",
"HKEY_CLASSES_ROOT\\CLSID\\{6DA66498-839A-42A7-8324-FF7D2A532835}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocHandler",
"HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\LayoutIcon\\0409\\0000041d",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.47.1.1!7",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProtocolDefaults\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_COMPAT_USE_CONNECTION_BASED_NEGOTIATE_AUTH_KB2151543",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Shell\\RegisteredApplications\\UrlAssociations\\http\\OpenWithProgids",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\4",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle",
"HKEY_CLASSES_ROOT\\CLSID\\{F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_USE_CNAME_FOR_SPN_KB911149",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\3",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Content",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\2",
"HKEY_LOCAL_MACHINE\\Software\\Policies",
"HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\shell\\open",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{55272A00-42CB-11CE-8135-00AA004BB851}\\ProxyStubClsid32",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\DiagnosticPolicy\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.47.1.1!7",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\\ProxyStubClsid32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptCNGInitHMAC",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_DIGEST_NO_EXTRAS_IN_URI",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\TrustedPublisher\\Safer",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\",
"HKEY_CURRENT_USER\\Software",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.16.1.1",
"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Network\\Location Awareness",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.28",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",
"HKEY_CLASSES_ROOT\\CLSID\\{03ea5b10-2efa-4311-ac10-04427b02d663}",
"HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\CurVer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.25",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.26",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.27",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.20",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_UNC_SAVEDFILECHECK",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.2.11",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllExportPrivateKeyInfoEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.2.12",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\2",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\LSA\\AccessProviders",
"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptCNGPKCS12GetMap",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Ranges\\",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CLASSES_ROOT\\CLSID\\{B6AC5E3C-5CEB-4E72-B451-F0E1BA983C14}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\Providers\\Trust\\Cleanup\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}",
"HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\shell\\open\\command",
"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\crypt32",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip6",
"HKEY_CURRENT_USER\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}",
"HKEY_CLASSES_ROOT\\FirefoxURL-E7CF176E110C211B",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.2.4",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OleAut",
"HKEY_CLASSES_ROOT\\CLSID\\{4E871705-D1F3-49D9-814F-1E46E85986B0}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.2.1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_SECURITY_FLAG_IGNORE_REVOCATION_KB2275828",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.2.3",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObjectEx\\1.2.840.113549.1.9.16.2.2",
"HKEY_CLASSES_ROOT\\CLSID\\{87775fdb-6972-41f9-ae51-8326e38cb206}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_USE_IETLDLIST_FOR_DOMAIN_DETERMINATION",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Layers",
"HKEY_CLASSES_ROOT\\CLSID\\{5BA8E555-8C08-4CC8-80E6-1F8CDD26AE3A}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodePublicKeyAndParameters",
"HKEY_CLASSES_ROOT\\CLSID\\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_MIME_HANDLING",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\Progid",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllExportPrivateKeyInfoEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_INCLUDE_PORT_IN_SPN_KB908209",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\#2130",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.2.1.4",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\\ProxyStubClsid32",
"HKEY_CLASSES_ROOT\\CLSID\\{29acf17c-1713-4286-8f40-bfd05f1e70c8}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{3697C5FA-60DD-4B56-92D4-74A569205C16}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Winsock\\Parameters",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Ranges\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.44.3.4!7",
"HKEY_CLASSES_ROOT\\CLSID\\{e9df9360-97f8-4690-afe6-996c80790da4}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache",
"HKEY_CLASSES_ROOT\\CLSID\\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\",
"HKEY_CURRENT_USER\\Software\\Classes\\.torrent",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Layers",
"HKEY_CLASSES_ROOT\\CLSID\\{1fd59ce2-6236-467c-9539-3d8c93fea5e0}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.12.2.1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CryptDllEncodeObject\\1.3.6.1.4.1.311.12.2.2",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_ENABLE_PASSPORT_SESSION_STORE_KB948608",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\3",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_RELEASE_KEYS_ON_UNLOAD_KB975619",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}"
],
"fetches_url": [
"http:\/\/update.utorrent.com\/installstats.php?cl=uTorrent&v=111915656&h=BYMsM6I6O0Z6AOUq&w=1DB10106&bu=0&pr=0&cmp=0&ocmp=0&showinstall&pid=2456&cau=0&au=0&view=win32",
"http:\/\/update.utorrent.com\/installoffer.php?h=BYMsM6I6O0Z6AOUq&v=111915656&w=1DB10106&l=en&c=US&w64=1&db=firefox&cl=uTorrent&tsub=1&svp=4",
"http:\/\/update.utorrent.com\/installstats.php?cl=uTorrent&v=111915656&h=BYMsM6I6O0Z6AOUq&w=1DB10106&bu=0&pr=0&cmp=0&ocmp=0&showwarning&pid=2456&cau=0&view=win32",
"http:\/\/update.utorrent.com\/installstats.php?cl=uTorrent&v=111915656&h=BYMsM6I6O0Z6AOUq&w=1DB10106&bu=0&pr=0&cmp=0&ocmp=0&showtbexists&pid=2456&cau=0&tbe=0&cd=0&view=win32"
],
"guid": [
"{a47979d2-c419-11d9-a5b4-001185ad2b89}",
"{dcb00c01-570f-4a9b-8d69-199fdba5723b}",
"{dcb00000-570f-4a9b-8d69-199fdba5723b}",
"{d0074ffd-570f-4a9b-8d69-199fdba5723b}"
],
"file_deleted": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A1B.tmp",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt697E.tmp",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt58E2.tmp"
],
"regkey_written": [
"HKEY_CURRENT_USER\\Software\\BitTorrent\\computerID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\EnableFileTracing",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\EnableConsoleTracing",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\EnableConsoleTracing",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadNetworkName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\FileDirectory",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\FileTracingMask",
"HKEY_CURRENT_USER\\FalconBetaAccount\\remote_access_client_id",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\MaxFileSize",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\LanguageList",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\FileTracingMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\ConsoleTracingMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\FileDirectory",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyEnable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\EnableFileTracing",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionReason",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecision",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\ConsoleTracingMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\MaxFileSize",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionTime",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadLastNetwork",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\SavedLegacySettings"
],
"file_copied": [
[
"C:\\Users\\cuck\\AppData\\Local\\Temp\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.bin",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates\\3.5.5_45704.exe"
]
],
"regkey_deleted": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyOverride",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL"
],
"mutex": [
"Local\\\u00b5Torrent4823DF041B09",
"Local\\ZonesCounterMutex",
"RasPbFile",
"Local\\ZonesLockedCacheCounterMutex",
"Local\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.bin",
"Local\\ZoneAttributeCacheCounterMutex",
"IESQMMUTEX_0_208",
"Local\\ZonesCacheCounterMutex"
],
"file_read": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.bin"
],
"regkey_read": [
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Language Hotkey",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-internet-signup\\Flags",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\StreamResourceType",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Hotkey",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Initialization\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\DOMStore\\CacheLimit",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}\\Enable",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SendTimeOut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Stream",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019040920190410\\CachePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\ParsingName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld\\IETldVersionLow",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\UseDelayedAcceptance",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableWorkerThreadHibernation",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\EnableConsoleTracing",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisablePassport",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\ConsoleTracingMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Content\\PerUserItem",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Signature\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Stream",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CertificateRevocation",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_MIME_HANDLING\\*",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\IdnEnabled",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.44.3.4!7\\Name",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\crypt32\\DiagMatchAnyMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableWorkerThreadHibernation",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\HeaderExclusionListForCache",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyHttp1.1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Description",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SocketSendBufferLength",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\ietld\\CachePrefix",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableHttp1_1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\FileTracingMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\CTF\\EnableAnchorContext",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice\\Progid",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Attributes",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\ietld\\CacheLimit",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019040920190410\\CacheRepair",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\BypassSSLNoCacheCheck",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\ScavengeCacheFileLimit",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\EnableFileTracing",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProgramData",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-internet-signup\\DllFile",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SecureProtocols",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\NoNetAutodial",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld\\IETldDllVersionHigh",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\PrivacIE:\\CachePrefix",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\LocalRedirectOnly",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\PrivacIE:\\CachePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.bin",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AlwaysDrainOnRedirect",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParentFolder",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0\\Flags",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\CertCheck\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalRedirectOnly",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ConnectTimeOut",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyOverride",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxySettingsPerUser",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ReceiveTimeOut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\BypassSSLNoCacheCheck",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Parameters\\Transports",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Attributes",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\DOMStore\\CachePrefix",
"HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\shell\\open\\command\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Cookies\\CacheLimit",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\UseHostnameAsAlias",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerProxy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_UNC_SAVEDFILECHECK\\*",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Signature\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyHttp1.1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Icon",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld\\IETldVersionHigh",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CertCacheNoValidate",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\PerUserCookies",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\Feature_ClientAuthCertFilter",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Cookies\\PerUserItem",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SendExtraCRLF",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Security\\DisableSecuritySettingsCheck",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledSessions\\GlobalSession",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\EnableConsoleTracing",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadOverride",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN\\*",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledProcesses\\3FE8B803",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\LocalRedirectOnly",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Layout Hotkey",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DialupUseLanSettings",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Security",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1\\Flags",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\\ProxyStubClsid32\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019040920190410\\CachePrefix",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\FileDirectory",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019040920190410\\CacheOptions",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableAutoProxyResultCache",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SyncMode5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledSessions\\MachineThrottling",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyHttp1.1",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\ScavengeCacheFileLimit",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-ns-proxy-autoconfig\\FileExtensions",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\SessionStartTimeDefaultDeltaSecs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerServer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001\\ProfileImagePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\History\\PerUserItem",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_UNC_SAVEDFILECHECK\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.bin",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableHttp1_1",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyEnable",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\ietld\\CachePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableKeepAlive",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\MaxFileSize",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\ScavengeCacheFileLifeTime",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Message\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\History\\CacheLimit",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MimeExclusionListForCache",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\My Music",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Hostname",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3\\Flags",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\FromCacheTimeout",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\Security\\DisableSecuritySettingsCheck",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\My Video",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\HttpDefaultExpiryTimeSecs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DontUseDNSLoadBalancing",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\EnableConsoleTracing",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Cookies\\PerUserItem",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\HelperDllName",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip6\\WinSock 2.0 Provider ID",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\feedplat\\CachePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\ietld\\CacheRepair",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MBCSAPIforCrack",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Cookies\\CachePrefix",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableCachingOfSSLPages",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Certificate\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResource",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ClientAuthBuiltInUI",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ReceiveTimeOut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PreCreate",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\History\\PerUserItem",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableAutodial",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\UseOldHostResolutionOrder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Cleanup\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\PrivacIE:\\CacheLimit",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PreCreate",
"HKEY_CURRENT_USER\\Software\\BitTorrent\\computerID",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\feedplat\\CacheOptions",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\\ProxyStubClsid32\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\feedplat\\CachePrefix",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\EnableFileTracing",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\UTF8ServerNameRes",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DnsCacheTimeout",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisplayScriptDownloadFailureUI",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\InfoTip",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxHttpRedirects",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParsingName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ConnectRetries",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WpadSearchAllDomains",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\FileDirectory",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\ietld\\CacheOptions",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\\ProxyStubClsid32\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableBasicOverClearChannel",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InitFolderHandler",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\\*",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Roamable",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\LdapClientIntegrity",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@%SystemRoot%\\system32\\p2pcollab.dll,-8042",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnOnPostRedirect",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Initialization\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\MinSockaddrLength",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Content\\CacheLimit",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{55272A00-42CB-11CE-8135-00AA004BB851}\\ProxyStubClsid32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-ns-proxy-autoconfig\\Flags",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CacheMode",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadLastNetwork",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\ScavengeCacheFileLimit",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnOnHTTPSToHTTPRedirect",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019040920190410\\CacheLimit",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ScavengeCacheLowerBound",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DialupUseLanSettings",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-ns-proxy-autoconfig\\Default",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Attributes",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DontUseDNSLoadBalancing",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SecureProtocols",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Roamable",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\KeepAliveTimeout",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerServer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Category",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\feedplat\\CacheLimit",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASMANCS\\FileTracingMask",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableNTLMPreAuth",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-ns-proxy-autoconfig\\DllFile",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Personal",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\MaxSockaddrLength",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ConnectRetries",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ServerInfoTimeout",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\DOMStore\\CachePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnAlwaysOnPost",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Content\\PerUserItem",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\WinTrust\\Trust Providers\\Software Publishing\\State",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\SavedLegacySettings",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7\\Name",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld\\IETldDllVersionLow",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\ParentFolder",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\History\\CachePrefix",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MBCSServername",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@%SystemRoot%\\system32\\dnsapi.dll,-103",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\LocalizedName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2\\Flags",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_MIME_HANDLING\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.bin",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Certificate\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$DLL",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3\\1A10",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SecureProtocols",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Security_HKLM_only",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\FtpDefaultExpiryTimeSecs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\BypassHTTPNoCacheCheck",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\ThreadingModel",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK\\*",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\NoCheckAutodialOverRide",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.bin",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DnsCacheEnabled",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\AccessProviders\\MartaExtension",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyHttp1.1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\CertCheck\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
"HKEY_CURRENT_USER\\Software\\BitTorrent\\StatsTesting",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\BadProxyExpiresTime",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnOnBadCertRecving",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Content\\CachePrefix",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\InprocServer32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Message\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ShareCredsWithWinHttp",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPer1_0Server",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoProxyDetectType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\StreamResource",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\PrivacIE:\\CacheOptions",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableBranchCache",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\crypt32\\DiagLevel",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\feedplat\\CacheRepair",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableHttpTrace",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4\\Flags",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\FolderTypeID",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Security\\Safety Warning Level",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Cleanup\\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\\$Function",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Security",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InfoTip",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MigrateProxy",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnOnZoneCrossing",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\GlobalUserOffline",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\NoCheckAutodialOverRide",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigCustomUA",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WarnOnPost",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\LeashLegacyCookies",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\\ProxyStubClsid32\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableNegotiate",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DnsCacheEntries",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\MaxFileSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPer1_0Server",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableHttp1_1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SendTimeOut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.bin",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Name",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\DOMStore\\CacheOptions",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\SocketReceiveBufferLength",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\FolderTypeID",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\PrivacIE:\\CacheRepair",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-internet-signup\\Default",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.47.1.1!7\\Name",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Signature",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ConnectTimeOut",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\DOMStore\\CacheRepair",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RASAPI32\\ConsoleTracingMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PublishExpandedPath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\DisableReadRange",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\Mapping",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\TcpAutotuning",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AutoProxyTypes\\Application\/x-internet-signup\\FileExtensions",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\RelativePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\BypassHTTPNoCacheCheck"
],
"file_created": [
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[1].txt",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A1B.tmp.1594457588\\index.hta.log",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A1B.tmp.1594457588\\HTA\\install.1594457588.zip",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt697E.tmp",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat.new",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates.dat",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc.new",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A1B.tmp",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt697E.tmp.new",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt58E2.tmp"
],
"dll_loaded": [
"DBGHELP.DLL",
"COMDLG32.dll",
"profapi.dll",
"urlmon.dll",
"kernel32",
"C:\\Windows\\system32\\symsrv.dll",
"ntdll",
"api-ms-win-core-sysinfo-l1-2-1",
"api-ms-win-core-localization-l1-2-1",
"DNSAPI.dll",
"DHCPCSVC.DLL",
"kernel32.dll",
"gdiplus.dll",
"ws2_32",
"C:\\Windows\\system32\\ole32.dll",
"dwmapi.dll",
"ntdll.dll",
"ntmarta.dll",
"shlwapi.dll",
"C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll",
"api-ms-win-core-synch-l1-2-0",
"iphlpapi",
"OLEAUT32.DLL",
"ncrypt.dll",
"sensapi.dll",
"Crypt32.dll",
"Riched20.dll",
"C:\\Windows\\system32\\napinsp.dll",
"C:\\Windows\\syswow64\\MSCTF.dll",
"WININET.dll",
"C:\\Windows\\System32\\wship6.dll",
"C:\\Windows\\SysWOW64\\bcryptprimitives.dll",
"dnsapi",
"KERNEL32.DLL",
"psapi.dll",
"cryptbase.dll",
"WTSAPI32.dll",
"RASMAN.DLL",
"Iphlpapi.dll",
"advapi32.dll",
"api-ms-win-security-systemfunctions-l1-1-0",
"ole32.dll",
"SHLWAPI.dll",
"CRYPTSP.dll",
"USER32.dll",
"IMM32.dll",
"API-MS-Win-Security-SDDL-L1-1-0.dll",
"API-MS-WIN-Service-winsvc-L1-1-0.dll",
"wintrust.dll",
"rtutils.dll",
"IPHLPAPI.DLL",
"C:\\Windows\\SysWOW64\\oleaut32.dll",
"wininet.dll",
"RASAPI32.dll",
"OLEAUT32.dll",
"C:\\Windows\\system32\\pnrpnsp.dll",
"comctl32",
"SHELL32.dll",
"RPCRT4.dll",
"DnsApi.dll",
"C:\\Windows\\System32\\winrnr.dll",
"PSAPI.DLL",
"comctl32.dll",
"COMCTL32.dll",
"C:\\Windows\\system32\\NLAapi.dll",
"VERSION.dll",
"Secur32.dll",
"api-ms-win-core-fibers-l1-1-1",
"GDI32.dll",
"UxTheme.dll",
"C:\\Windows\\system32\\mswsock.dll",
"API-MS-WIN-Service-Management-L1-1-0.dll",
"ADVAPI32.dll",
"advapi32",
"SETUPAPI.dll",
"WS2_32.dll",
"user32.dll",
"MSIMG32.dll"
],
"file_moved": [
[
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc.new",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc"
],
[
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat.old"
],
[
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt697E.tmp",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt697E.tmp.old"
],
[
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat.new",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat"
],
[
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt697E.tmp.new",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt697E.tmp"
],
[
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc.old"
]
],
"file_written": [
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[1].txt",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A1B.tmp.1594457588\\index.hta.log",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates.dat",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat.new",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc.new",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt697E.tmp.new",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt58E2.tmp"
],
"file_recreated": [
"\\Device\\KsecDD"
],
"directory_created": [
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A1B.tmp.1594457588\\HTA\\",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates\\",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\HYD5A1B.tmp.1594457588"
],
"file_failed": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\sechost.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\rasadhlp.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\msctf.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wlpk.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\nsi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\crypt32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\ole32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\mswsock.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wuser32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\DLL\\winnsi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\profapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\msasn1.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\cryptsp.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\setupapi.pdb",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\current.btskin",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\msvcrt.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\bin\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\shell32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\mswsock.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wtsapi32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\msimg32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wkernel32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\rsaenh.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wntdll.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\advapi32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\MicrosoftWindowsGdiPlus-1.1.7601.17514-gdiplus.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wininet.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wsspicli.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\DLL\\dbghelp.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\devobj.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\cfgmgr32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wrpcrt4.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\winnsi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\DLL\\winnsi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wininet.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\DLL\\psapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ole32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\msasn1.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wship6.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\secur32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\ole32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\shlwapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\cryptbase.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wkernelbase.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wkernelbase.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wshtcpip.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\crypt32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\msvcrt.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\secur32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wimm32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\comctl32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\usp10.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\comdlg32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dnsapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\advapi32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\setupapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\msctf.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\dnsapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\userenv.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\shell32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\bcrypt.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\MicrosoftWindowsGdiPlus-1.1.7601.17514-gdiplus.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wship6.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\oleaut32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\devobj.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\devobj.pdb",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates\\sua_pmr",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\webui.zip",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wkernel32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\urlmon.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\DLL\\dbghelp.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\bcryptprimitives.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ws2_32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wrpcrt4.pdb",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\utorrent.lng",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\bin\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wintrust.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wrpcrt4.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\DLL\\wimm32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wkernel32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\nsi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\cryptsp.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\rasadhlp.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\ws2_32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wuser32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\bin\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.dbg",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\DLL\\psapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\cryptbase.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\version.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\bcryptprimitives.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\oleaut32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\rsaenh.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wininet.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wuser32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wgdi32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\dnsapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wkernelbase.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\shlwapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\iertutil.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wuxtheme.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wshtcpip.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\msvcrt.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\iphlpapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\comdlg32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wsspicli.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\userenv.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\shell32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dbghelp.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\DLL\\iphlpapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ncrypt.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wntdll.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wintrust.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\advapi32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wtsapi32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\msimg32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\bcryptprimitives.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\cryptbase.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\version.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wgdi32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\profapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.dbg",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\msimg32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wtsapi32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\ncrypt.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\ws2_32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\bin\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.dbg",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\iertutil.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wlpk.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\bcrypt.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\msasn1.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wuxtheme.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wshtcpip.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\MicrosoftWindowsGdiPlus-1.1.7601.17514-gdiplus.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\comctl32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\comdlg32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\urlmon.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\setupapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\sechost.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\nsi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\msctf.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\usp10.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\cfgmgr32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\bcrypt.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\iertutil.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\DLL\\iphlpapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\ncrypt.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\userenv.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\profapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\version.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wlpk.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\psapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\cfgmgr32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wsspicli.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\usp10.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\rsaenh.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\mswsock.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wgdi32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\DLL\\wimm32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\cryptsp.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\rasadhlp.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\crypt32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\wintrust.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.bin.lang.txt",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\wntdll.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\comctl32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\urlmon.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\secur32.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wuxtheme.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\symbols\\dll\\shlwapi.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wship6.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\sechost.pdb",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dll\\oleaut32.pdb"
],
"resolves_host": [
"router.utorrent.com",
"i-50.b-000.xyz.bench.utorrent.com",
"update.utorrent.com",
"cuckpc",
"router.bittorrent.com",
"download-lb.utorrent.com",
"wpad"
],
"connects_ip": [
"127.0.0.1"
],
"file_exists": [
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\uTorrent.exe",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat.new",
"C:\\Users\\cuck\\AppData\\Local\\Temp",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\dht_feed.dat.old",
"C:\\Users\\cuck\\Music",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt58E2.tmp",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\dht_feed.dat",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\",
"C:\\Windows\\System32\\qagentrt.dll",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates.dat",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\settings.dat",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\dht.dat.new",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\settings.dat.old",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\current.btskin",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates.dat.old",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utt697E.tmp.new",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates.dat.new",
"C:\\Users\\cuck\\Documents",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\dht_feed.dat.new",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\toolbar.benc.new",
"C:\\Windows\\System32\\dnsapi.dll",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\settings.dat.old",
"C:\\Users\\cuck\\Videos",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\dht.dat.old",
"C:\\Windows\\System32\\p2pcollab.dll",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\cuck@localhost[1].txt",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\utorrent.lng",
"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\updates\\3.5.5_45704.exe",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\",
"C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\dht.dat"
],
"directory_enumerated": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\profapi.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wininet.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ws2_32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wtsapi32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\crypt32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\shell32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wkernelbase.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wrpcrt4.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\devobj.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\rasphone.pbk",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ncrypt.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wlpk.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\mswsock.pdb\\*",
"C:\\Windows\\System32\\ras\\*.pbk",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\sechost.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\setupapi.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\bcrypt.pdb\\*",
"C:\\Users\\cuck\\AppData",
"C:\\ProgramData\\Microsoft\\Network\\Connections\\Pbk\\rasphone.pbk",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\msasn1.pdb\\*",
"C:\\Users",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\iertutil.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\msvcrt.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wsspicli.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wgdi32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\winnsi.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dnsapi.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wintrust.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\usp10.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\iphlpapi.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wshtcpip.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\nsi.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wuxtheme.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\urlmon.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\cfgmgr32.pdb\\*",
"C:\\Users\\cuck",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\msimg32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\cryptsp.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\dbghelp.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\userenv.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wship6.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\bcryptprimitives.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\comctl32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wuser32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wimm32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*.pbk",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\psapi.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\rsaenh.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\msctf.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\comdlg32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wkernel32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\wntdll.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\shlwapi.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\advapi32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\rasadhlp.pdb\\*",
"C:\\ProgramData\\Microsoft\\Network\\Connections\\Pbk\\*.pbk",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\cryptbase.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\version.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\ole32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\MicrosoftWindowsGdiPlus-1.1.7601.17514-gdiplus.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4.dbg\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\secur32.pdb\\*",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\oleaut32.pdb\\*"
]
},
"first_seen": 1594439587.609375,
"ppid": 2780
},
{
"process_path": "C:\\Windows\\System32\\lsass.exe",
"process_name": "lsass.exe",
"pid": 476,
"summary": {},
"first_seen": 1594439587.328125,
"ppid": 376
}
]Signatures
[
{
"markcount": 22,
"families": [
"generic"
],
"description": "Uses Windows APIs to generate a cryptographic key",
"severity": 1,
"marks": [
{
"call": {
"category": "crypto",
"status": 1,
"stacktrace": [],
"api": "CryptGenKey",
"return_value": 1,
"arguments": {
"crypto_handle": "0x00a49a78",
"algorithm_identifier": "0x00000001",
"provider_handle": "0x00a61ce0",
"flags": 16385
},
"time": 1594439588.187375,
"tid": 2676,
"flags": {
"algorithm_identifier": ""
}
},
"pid": 2456,
"type": "call",
"cid": 1233
},
{
"call": {
"category": "crypto",
"status": 1,
"stacktrace": [],
"api": "CryptExportKey",
"return_value": 1,
"arguments": {
"crypto_handle": "0x00a4a0f8",
"crypto_export_handle": "0x00000000",
"buffer": "",
"blob_type": 6,
"flags": 0
},
"time": 1594439588.218375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 1556
},
{
"call": {
"category": "crypto",
"status": 1,
"stacktrace": [],
"api": "CryptExportKey",
"return_value": 1,
"arguments": {
"crypto_handle": "0x00a4a0f8",
"crypto_export_handle": "0x00000000",
"buffer": "\u0006\u0002\u0000\u0000\u0000\u00a4\u0000\u0000RSA1\u0000\u0004\u0000\u0000\u0001\u0000\u0001\u0000\u00c3\b\u00c6\u00aa\u00ea\u001e\u0014\u00ebvxC\u008ab\u0097w\u00ca]z\u009d\u001al\u00bd\u00f0O)\u00fb\u00c4;<\u0014uT8\u000e\u00ba\u00e2\u00e4\u00ab\u001d\u00a7\u00aa-N\u00d0\u00e2\u00a3\u00d6t\u0098@\u00a3\u00fe\u009c)\u00ea\u00f5\u00d9\u0086\u00f5\u008aB\u0090\u00ca\u00e8\u0001\u00a7\u00a9R\u009f\u00a76\u00e3*+\u00cc\u00ae\u00afL-\u00b1\u00c0vf\u0085I\u0016\u00b1(\u00c2\u00ea\u00f1{\u0081]\u0098U\u00f2\u00ceb\u0094\u00d1S;\u0010\u0007n\u00d1C\u00ff\u009b\u0088\u0005\u0091\u00ba\u0090\u00d6\u009d\u00b7\u0004\u00bbZ\u00d8\"\u008a9\u009c\u0096\u00b5",
"blob_type": 6,
"flags": 0
},
"time": 1594439588.218375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 1557
},
{
"call": {
"category": "crypto",
"status": 1,
"stacktrace": [],
"api": "CryptExportKey",
"return_value": 1,
"arguments": {
"crypto_handle": "0x00a4a0f8",
"crypto_export_handle": "0x00000000",
"buffer": "",
"blob_type": 6,
"flags": 0
},
"time": 1594439588.218375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 1570
},
{
"call": {
"category": "crypto",
"status": 1,
"stacktrace": [],
"api": "CryptExportKey",
"return_value": 1,
"arguments": {
"crypto_handle": "0x00a4a0f8",
"crypto_export_handle": "0x00000000",
"buffer": "\u0006\u0002\u0000\u0000\u0000\u00a4\u0000\u0000RSA1\u0000\u0004\u0000\u0000\u0001\u0000\u0001\u0000\u00c3\b\u00c6\u00aa\u00ea\u001e\u0014\u00ebvxC\u008ab\u0097w\u00ca]z\u009d\u001al\u00bd\u00f0O)\u00fb\u00c4;<\u0014uT8\u000e\u00ba\u00e2\u00e4\u00ab\u001d\u00a7\u00aa-N\u00d0\u00e2\u00a3\u00d6t\u0098@\u00a3\u00fe\u009c)\u00ea\u00f5\u00d9\u0086\u00f5\u008aB\u0090\u00ca\u00e8\u0001\u00a7\u00a9R\u009f\u00a76\u00e3*+\u00cc\u00ae\u00afL-\u00b1\u00c0vf\u0085I\u0016\u00b1(\u00c2\u00ea\u00f1{\u0081]\u0098U\u00f2\u00ceb\u0094\u00d1S;\u0010\u0007n\u00d1C\u00ff\u009b\u0088\u0005\u0091\u00ba\u0090\u00d6\u009d\u00b7\u0004\u00bbZ\u00d8\"\u008a9\u009c\u0096\u00b5",
"blob_type": 6,
"flags": 0
},
"time": 1594439588.218375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 1571
},
{
"call": {
"category": "crypto",
"status": 1,
"stacktrace": [],
"api": "CryptExportKey",
"return_value": 1,
"arguments": {
"crypto_handle": "0x00a4a078",
"crypto_export_handle": "0x00000000",
"buffer": "",
"blob_type": 7,
"flags": 0
},
"time": 1594439588.234375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 1601
},
{
"call": {
"category": "crypto",
"status": 1,
"stacktrace": [],
"api": "CryptExportKey",
"return_value": 1,
"arguments": {
"crypto_handle": "0x00a4a078",
"crypto_export_handle": "0x00000000",
"buffer": "",
"blob_type": 7,
"flags": 0
},
"time": 1594439588.249375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 1783
},
{
"call": {
"category": "crypto",
"status": 1,
"stacktrace": [],
"api": "CryptExportKey",
"return_value": 1,
"arguments": {
"crypto_handle": "0x00a4a2b8",
"crypto_export_handle": "0x00000000",
"buffer": "",
"blob_type": 7,
"flags": 0
},
"time": 1594439588.265375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 1854
},
{
"call": {
"category": "crypto",
"status": 1,
"stacktrace": [],
"api": "CryptExportKey",
"return_value": 1,
"arguments": {
"crypto_handle": "0x00a4a2b8",
"crypto_export_handle": "0x00000000",
"buffer": "",
"blob_type": 7,
"flags": 0
},
"time": 1594439588.265375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 1855
},
{
"call": {
"category": "crypto",
"status": 1,
"stacktrace": [],
"api": "CryptExportKey",
"return_value": 1,
"arguments": {
"crypto_handle": "0x00a4a2b8",
"crypto_export_handle": "0x00000000",
"buffer": "",
"blob_type": 7,
"flags": 0
},
"time": 1594439588.265375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 1871
},
{
"call": {
"category": "crypto",
"status": 1,
"stacktrace": [],
"api": "CryptExportKey",
"return_value": 1,
"arguments": {
"crypto_handle": "0x00a4a2b8",
"crypto_export_handle": "0x00000000",
"buffer": "",
"blob_type": 7,
"flags": 0
},
"time": 1594439588.265375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 1872
},
{
"call": {
"category": "crypto",
"status": 1,
"stacktrace": [],
"api": "CryptExportKey",
"return_value": 1,
"arguments": {
"crypto_handle": "0x00a4a2b8",
"crypto_export_handle": "0x00000000",
"buffer": "",
"blob_type": 7,
"flags": 0
},
"time": 1594439588.265375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 1885
},
{
"call": {
"category": "crypto",
"status": 1,
"stacktrace": [],
"api": "CryptExportKey",
"return_value": 1,
"arguments": {
"crypto_handle": "0x00a4a2b8",
"crypto_export_handle": "0x00000000",
"buffer": "",
"blob_type": 7,
"flags": 0
},
"time": 1594439588.265375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 1886
},
{
"call": {
"category": "crypto",
"status": 1,
"stacktrace": [],
"api": "CryptExportKey",
"return_value": 1,
"arguments": {
"crypto_handle": "0x00a4a2b8",
"crypto_export_handle": "0x00000000",
"buffer": "",
"blob_type": 7,
"flags": 0
},
"time": 1594439588.265375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 1935
},
{
"call": {
"category": "crypto",
"status": 1,
"stacktrace": [],
"api": "CryptExportKey",
"return_value": 1,
"arguments": {
"crypto_handle": "0x00a4a2b8",
"crypto_export_handle": "0x00000000",
"buffer": "",
"blob_type": 7,
"flags": 0
},
"time": 1594439588.265375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 1936
},
{
"call": {
"category": "crypto",
"status": 1,
"stacktrace": [],
"api": "CryptExportKey",
"return_value": 1,
"arguments": {
"crypto_handle": "0x00a4a2b8",
"crypto_export_handle": "0x00000000",
"buffer": "",
"blob_type": 7,
"flags": 0
},
"time": 1594439588.265375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 1949
},
{
"call": {
"category": "crypto",
"status": 1,
"stacktrace": [],
"api": "CryptExportKey",
"return_value": 1,
"arguments": {
"crypto_handle": "0x00a4a2b8",
"crypto_export_handle": "0x00000000",
"buffer": "",
"blob_type": 7,
"flags": 0
},
"time": 1594439588.265375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 1950
},
{
"call": {
"category": "crypto",
"status": 1,
"stacktrace": [],
"api": "CryptExportKey",
"return_value": 1,
"arguments": {
"crypto_handle": "0x00a4a2b8",
"crypto_export_handle": "0x00000000",
"buffer": "",
"blob_type": 7,
"flags": 0
},
"time": 1594439588.265375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 1964
},
{
"call": {
"category": "crypto",
"status": 1,
"stacktrace": [],
"api": "CryptExportKey",
"return_value": 1,
"arguments": {
"crypto_handle": "0x00a4a2b8",
"crypto_export_handle": "0x00000000",
"buffer": "",
"blob_type": 7,
"flags": 0
},
"time": 1594439588.265375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 1965
},
{
"call": {
"category": "crypto",
"status": 1,
"stacktrace": [],
"api": "CryptExportKey",
"return_value": 1,
"arguments": {
"crypto_handle": "0x00a4a2b8",
"crypto_export_handle": "0x00000000",
"buffer": "",
"blob_type": 7,
"flags": 0
},
"time": 1594439588.265375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 1978
},
{
"call": {
"category": "crypto",
"status": 1,
"stacktrace": [],
"api": "CryptExportKey",
"return_value": 1,
"arguments": {
"crypto_handle": "0x00a4a2b8",
"crypto_export_handle": "0x00000000",
"buffer": "",
"blob_type": 7,
"flags": 0
},
"time": 1594439588.265375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 1979
},
{
"call": {
"category": "crypto",
"status": 1,
"stacktrace": [],
"api": "CryptExportKey",
"return_value": 1,
"arguments": {
"crypto_handle": "0x00a4a2b8",
"crypto_export_handle": "0x00000000",
"buffer": "\u0007\u0002\u0000\u0000\u0000\u00a4\u0000\u0000RSA2\u0000\u0004\u0000\u0000\u0001\u0000\u0001\u0000\u00c3\b\u00c6\u00aa\u00ea\u001e\u0014\u00ebvxC\u008ab\u0097w\u00ca]z\u009d\u001al\u00bd\u00f0O)\u00fb\u00c4;<\u0014uT8\u000e\u00ba\u00e2\u00e4\u00ab\u001d\u00a7\u00aa-N\u00d0\u00e2\u00a3\u00d6t\u0098@\u00a3\u00fe\u009c)\u00ea\u00f5\u00d9\u0086\u00f5\u008aB\u0090\u00ca\u00e8\u0001\u00a7\u00a9R\u009f\u00a76\u00e3*+\u00cc\u00ae\u00afL-\u00b1\u00c0vf\u0085I\u0016\u00b1(\u00c2\u00ea\u00f1{\u0081]\u0098U\u00f2\u00ceb\u0094\u00d1S;\u0010\u0007n\u00d1C\u00ff\u009b\u0088\u0005\u0091\u00ba\u0090\u00d6\u009d\u00b7\u0004\u00bbZ\u00d8\"\u008a9\u009c\u0096\u00b5\u00f5\u0088\u0083\u00fb\u00c7\u0010\u00a8E\u00c2\u00e1\u00a9e\u00c5\u0007\u00c8\u00fd0\u00bfj\u00a3\u0000\u00f0\u00bdmT\u00cb\r\u00be\u0087\u0090\u008b{7\u00dbh\u00fb't\u00bf\u00b4\u00d6\u008d\u00feY\u009d\n\u00b5\u009fj\u00f5\u00c4\u00db\u00a7\u00e6\u0097w\u0014\u00b9\u00d0\u0085\u00d7\u00fb-\u00fb\u00d7\u0017\u0000f\u001c|\f\u00a3?\u00dd\u00bc\u00ca^\u00d1\u0095H\u00a8\u00fa5\u0092\u00ca\u0082)\u00feHT\u00ad\u0096\u00d8^\u00e5\u00f7t\u00a4\u00fbxh\u00b6\u0096\u0002\u00c3\u009eM\u00a1\u00f1,\u00c3&\u00bf\u00e0\u00a2y\u00ac\u0096\u00f6\u001a\u00e9=\t\u0087\u00bb\u0012\u00b9i\u0010#\u008e\u00e1j5\u009b\u0089(\u00a1\u00bd\u0088%\u00b4Q\n\u00ea\u00db{f\u009cSA\u009c\u00c5\u001d6>\u00a5\u00f9\u00bc\u00dcrk\u00fcO\/\u000b\u00a2\u009a\u0002\u00f6q\u00df\r\u00d2c=\u00dbG\t\u008fL\u00e7\u00cc\u00ec\u00d0j\u00b44\u00d4xVU\u000b\u00ce?\u00fcXd\u00ff\u00e1\u008bh3\u00a6\u00ad\u00ea@]\u00ce\u0007\u00969\u00c2c`\u00eb\u00c4F1\u00cc`\u00b4e\u0082R\u00bf\u00d9\u0093\u00c5h\u001d\u00de_0\u00a1e\u008f\u00cd\nZ\u0097qL6m\b\u00e8\u001e\u00f2+\u0094>\u0089\u00a4\u00b3\u00ba\u00d3\u00da\u00b9\u00b7\u00f2\u00cdcLh\u0096+\u00da?u=\u009do\u00ef\u009cU\u00ec\u00e5o9\u0099\u00d7\u00e4!@k\u00da,K+\u00c48\u000bz\bD\u0083\u00c5\u00d8\u00a2'\u00d0\u00ef\u00b6:#^\u0098\u00bbs\u00e2\u00dfq\u000e\u00b0\u0080\u00de\u00e0\u00f3\u0081Y\u00136-\u0088\u00c1\u00e3Y\u009f\u00e2\u00d6-\u00b5\u00b5V\u00fd\u0093\u00ddI\u00ackac\u00f7\u0085\u00ffU{)\u00dc\u00e17\u00a9\u001a\u0086\u00c3\u00f0\u00d1&\u00b7\u0088oJ\u0094{\u00d2\u00ed3\u00f4\u00fd\u00ffY2j\u0004Cp\u00e9\u00d6B\u00f2 \u00e5\u00db\u00cb\u0097\u0004&\u00aa\u00e0\u00cc\u0084\u00f1\nEn\u00c8\u0092\u00e1\u00c1\u009dY_x\u00e2\u00c2\u00f1\u00a0\u00d4\u0098\u00a7\u008bW\u00b6\u0095\u0085X\u00fe\u00c2\u009b\u009d\u00e7\u0016\u0002\u00cb]\u00ab^\u00c3B'\u0097Z\u0001>\u00a6u`.\u00d4\u0082\u00f3e\u00e1i\u0003",
"blob_type": 7,
"flags": 0
},
"time": 1594439588.265375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 1980
}
],
"references": [],
"name": "generates_crypto_key"
},
{
"markcount": 1,
"families": [],
"description": "Tries to locate where the browsers are installed",
"severity": 1,
"marks": [
{
"category": "file",
"ioc": "C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "locates_browser"
},
{
"markcount": 4,
"families": [],
"description": "The file contains an unknown PE resource name possibly indicative of a packer",
"severity": 1,
"marks": [
{
"category": "resource name",
"ioc": "CSS",
"type": "ioc",
"description": null
},
{
"category": "resource name",
"ioc": "GIF",
"type": "ioc",
"description": null
},
{
"category": "resource name",
"ioc": "JS",
"type": "ioc",
"description": null
},
{
"category": "resource name",
"ioc": "PNG",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "pe_unknown_resource_name"
},
{
"markcount": 3,
"families": [],
"description": "One or more processes crashed",
"severity": 1,
"marks": [
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "W\nS\nP\nS\nt\na\nr\nt\nu\np\n-\n0\nx\n7\n4\n2\n1\n \nm\ns\nw\ns\no\nc\nk\n+\n0\nx\n1\n6\n7\na\n \n@\n \n0\nx\n7\n4\nc\n7\n1\n6\n7\na\n\n\nW\nS\nP\nS\nt\na\nr\nt\nu\np\n-\n0\nx\n5\ne\n5\nb\n \nm\ns\nw\ns\no\nc\nk\n+\n0\nx\n2\nc\n4\n0\n \n@\n \n0\nx\n7\n4\nc\n7\n2\nc\n4\n0\n\n\nc\nl\no\ns\ne\ns\no\nc\nk\ne\nt\n+\n0\nx\n4\na\n \nW\na\nh\nR\ne\nm\no\nv\ne\nH\na\nn\nd\nl\ne\nC\no\nn\nt\ne\nx\nt\n-\n0\nx\n4\ne\n \nw\ns\n2\n_\n3\n2\n+\n0\nx\n3\n9\n6\n2\n \n@\n \n0\nx\n7\n7\n3\n1\n3\n9\n6\n2\n\n\nN\ne\nw\n_\nw\ns\n2\n_\n3\n2\n_\nc\nl\no\ns\ne\ns\no\nc\nk\ne\nt\n@\n4\n+\n0\nx\n3\n4\n \nN\ne\nw\n_\nw\ns\n2\n_\n3\n2\n_\nc\no\nn\nn\ne\nc\nt\n@\n1\n2\n-\n0\nx\n9\n8\n \n@\n \n0\nx\n6\n3\nd\ne\nc\n2\nd\n6\n\n\nW\nS\nA\nL\no\no\nk\nu\np\nS\ne\nr\nv\ni\nc\ne\nB\ne\ng\ni\nn\nW\n+\n0\nx\n6\n5\n7\n \nW\nS\nA\nE\nv\ne\nn\nt\nS\ne\nl\ne\nc\nt\n-\n0\nx\n6\nd\ne\n \nw\ns\n2\n_\n3\n2\n+\n0\nx\n5\nd\nb\n1\n \n@\n \n0\nx\n7\n7\n3\n1\n5\nd\nb\n1\n\n\nW\nS\nA\nL\no\no\nk\nu\np\nS\ne\nr\nv\ni\nc\ne\nB\ne\ng\ni\nn\nW\n+\n0\nx\n5\ne\ne\n \nW\nS\nA\nE\nv\ne\nn\nt\nS\ne\nl\ne\nc\nt\n-\n0\nx\n7\n4\n7\n \nw\ns\n2\n_\n3\n2\n+\n0\nx\n5\nd\n4\n8\n \n@\n \n0\nx\n7\n7\n3\n1\n5\nd\n4\n8\n\n\nW\nS\nA\nL\no\no\nk\nu\np\nS\ne\nr\nv\ni\nc\ne\nB\ne\ng\ni\nn\nW\n+\n0\nx\na\n8\n9\n \nW\nS\nA\nE\nv\ne\nn\nt\nS\ne\nl\ne\nc\nt\n-\n0\nx\n2\na\nc\n \nw\ns\n2\n_\n3\n2\n+\n0\nx\n6\n1\ne\n3\n \n@\n \n0\nx\n7\n7\n3\n1\n6\n1\ne\n3\n\n\nG\ne\nt\nA\nd\nd\nr\nI\nn\nf\no\nW\n+\n0\nx\n2\n1\n0\n \nF\nr\ne\ne\nA\nd\nd\nr\nI\nn\nf\no\nW\n-\n0\nx\n8\n2\n \nw\ns\n2\n_\n3\n2\n+\n0\nx\n4\na\n9\n9\n \n@\n \n0\nx\n7\n7\n3\n1\n4\na\n9\n9\n\n\nN\ne\nw\n_\nw\ns\n2\n_\n3\n2\n_\nG\ne\nt\nA\nd\nd\nr\nI\nn\nf\no\nW\n@\n1\n6\n+\n0\nx\n4\n9\n \nN\ne\nw\n_\nw\ns\n2\n_\n3\n2\n_\nT\nr\na\nn\ns\nm\ni\nt\nF\ni\nl\ne\n@\n2\n8\n-\n0\nx\n1\n1\n8\n \n@\n \n0\nx\n6\n3\nd\ne\nb\n0\n5\nf\n\n\ng\ne\nt\na\nd\nd\nr\ni\nn\nf\no\n+\n0\nx\n6\nd\n \nW\nS\nA\nS\ne\nn\nd\n-\n0\nx\n1\n0\n3\n \nw\ns\n2\n_\n3\n2\n+\n0\nx\n4\n3\n0\n3\n \n@\n \n0\nx\n7\n7\n3\n1\n4\n3\n0\n3\n\n\nN\ne\nw\n_\nw\ns\n2\n_\n3\n2\n_\ng\ne\nt\na\nd\nd\nr\ni\nn\nf\no\n@\n1\n6\n+\n0\nx\nf\n7\n \nN\ne\nw\n_\nw\ns\n2\n_\n3\n2\n_\ng\ne\nt\nh\no\ns\nt\nb\ny\nn\na\nm\ne\n@\n4\n-\n0\nx\n6\na\n \n@\n \n0\nx\n6\n3\nd\ne\nc\n5\nd\nf\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nQ\nu\ne\nr\ny\nD\na\nt\na\nA\nv\na\ni\nl\na\nb\nl\ne\n+\n0\nx\n1\n6\nd\nd\n \nI\nn\nt\ne\nr\nn\ne\nt\nO\np\ne\nn\nW\n-\n0\nx\n1\nc\n5\nd\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n2\n7\n5\n3\na\n \n@\n \n0\nx\n7\n5\ne\n2\n7\n5\n3\na\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nC\nr\ne\na\nt\ne\nU\nr\nl\nW\n+\n0\nx\n5\nf\nc\n \nD\ne\nl\ne\nt\ne\nU\nr\nl\nC\na\nc\nh\ne\nE\nn\nt\nr\ny\nW\n-\n0\nx\n7\n4\n1\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n5\n8\ne\n3\n2\n \n@\n \n0\nx\n7\n5\ne\n5\n8\ne\n3\n2\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nQ\nu\ne\nr\ny\nD\na\nt\na\nA\nv\na\ni\nl\na\nb\nl\ne\n+\n0\nx\n2\nc\nb\na\n \nI\nn\nt\ne\nr\nn\ne\nt\nO\np\ne\nn\nW\n-\n0\nx\n6\n8\n0\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n2\n8\nb\n1\n7\n \n@\n \n0\nx\n7\n5\ne\n2\n8\nb\n1\n7\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nQ\nu\ne\nr\ny\nO\np\nt\ni\no\nn\nW\n+\n0\nx\n1\n1\nf\n0\n \nH\nt\nt\np\nQ\nu\ne\nr\ny\nI\nn\nf\no\nA\n-\n0\nx\n1\n2\n7\n7\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n1\n9\n0\nc\n7\n \n@\n \n0\nx\n7\n5\ne\n1\n9\n0\nc\n7\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nQ\nu\ne\nr\ny\nO\np\nt\ni\no\nn\nW\n+\n0\nx\n1\n8\na\na\n \nH\nt\nt\np\nQ\nu\ne\nr\ny\nI\nn\nf\no\nA\n-\n0\nx\nb\nb\nd\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n1\n9\n7\n8\n1\n \n@\n \n0\nx\n7\n5\ne\n1\n9\n7\n8\n1\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nQ\nu\ne\nr\ny\nD\na\nt\na\nA\nv\na\ni\nl\na\nb\nl\ne\n+\n0\nx\n2\nc\n8\nf\n \nI\nn\nt\ne\nr\nn\ne\nt\nO\np\ne\nn\nW\n-\n0\nx\n6\na\nb\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n2\n8\na\ne\nc\n \n@\n \n0\nx\n7\n5\ne\n2\n8\na\ne\nc\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nQ\nu\ne\nr\ny\nD\na\nt\na\nA\nv\na\ni\nl\na\nb\nl\ne\n+\n0\nx\n2\nc\n5\n8\n \nI\nn\nt\ne\nr\nn\ne\nt\nO\np\ne\nn\nW\n-\n0\nx\n6\ne\n2\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n2\n8\na\nb\n5\n \n@\n \n0\nx\n7\n5\ne\n2\n8\na\nb\n5\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nQ\nu\ne\nr\ny\nD\na\nt\na\nA\nv\na\ni\nl\na\nb\nl\ne\n+\n0\nx\n2\nb\nc\nd\n \nI\nn\nt\ne\nr\nn\ne\nt\nO\np\ne\nn\nW\n-\n0\nx\n7\n6\nd\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n2\n8\na\n2\na\n \n@\n \n0\nx\n7\n5\ne\n2\n8\na\n2\na\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nQ\nu\ne\nr\ny\nD\na\nt\na\nA\nv\na\ni\nl\na\nb\nl\ne\n+\n0\nx\n2\n4\n0\nd\n \nI\nn\nt\ne\nr\nn\ne\nt\nO\np\ne\nn\nW\n-\n0\nx\nf\n2\nd\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n2\n8\n2\n6\na\n \n@\n \n0\nx\n7\n5\ne\n2\n8\n2\n6\na\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nQ\nu\ne\nr\ny\nD\na\nt\na\nA\nv\na\ni\nl\na\nb\nl\ne\n+\n0\nx\n1\nd\n0\n6\n \nI\nn\nt\ne\nr\nn\ne\nt\nO\np\ne\nn\nW\n-\n0\nx\n1\n6\n3\n4\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n2\n7\nb\n6\n3\n \n@\n \n0\nx\n7\n5\ne\n2\n7\nb\n6\n3\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nQ\nu\ne\nr\ny\nO\np\nt\ni\no\nn\nW\n+\n0\nx\n1\n1\nf\n0\n \nH\nt\nt\np\nQ\nu\ne\nr\ny\nI\nn\nf\no\nA\n-\n0\nx\n1\n2\n7\n7\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n1\n9\n0\nc\n7\n \n@\n \n0\nx\n7\n5\ne\n1\n9\n0\nc\n7\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nQ\nu\ne\nr\ny\nO\np\nt\ni\no\nn\nW\n+\n0\nx\n1\n8\na\na\n \nH\nt\nt\np\nQ\nu\ne\nr\ny\nI\nn\nf\no\nA\n-\n0\nx\nb\nb\nd\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n1\n9\n7\n8\n1\n \n@\n \n0\nx\n7\n5\ne\n1\n9\n7\n8\n1\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nQ\nu\ne\nr\ny\nD\na\nt\na\nA\nv\na\ni\nl\na\nb\nl\ne\n+\n0\nx\n2\n1\n4\ne\n \nI\nn\nt\ne\nr\nn\ne\nt\nO\np\ne\nn\nW\n-\n0\nx\n1\n1\ne\nc\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n2\n7\nf\na\nb\n \n@\n \n0\nx\n7\n5\ne\n2\n7\nf\na\nb\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nQ\nu\ne\nr\ny\nD\na\nt\na\nA\nv\na\ni\nl\na\nb\nl\ne\n+\n0\nx\n2\n2\n9\n4\n \nI\nn\nt\ne\nr\nn\ne\nt\nO\np\ne\nn\nW\n-\n0\nx\n1\n0\na\n6\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n2\n8\n0\nf\n1\n \n@\n \n0\nx\n7\n5\ne\n2\n8\n0\nf\n1\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nA\nu\nt\no\nP\nr\no\nx\ny\nD\nl\nl\n+\n0\nx\n2\n4\nc\n1\n \nI\nn\nt\ne\nr\nn\ne\nt\nC\no\nn\nn\ne\nc\nt\nW\n-\n0\nx\n2\n9\n4\nf\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n2\n1\nf\nd\nd\n \n@\n \n0\nx\n7\n5\ne\n2\n1\nf\nd\nd\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nQ\nu\ne\nr\ny\nO\np\nt\ni\no\nn\nW\n+\n0\nx\n1\n1\nf\n0\n \nH\nt\nt\np\nQ\nu\ne\nr\ny\nI\nn\nf\no\nA\n-\n0\nx\n1\n2\n7\n7\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n1\n9\n0\nc\n7\n \n@\n \n0\nx\n7\n5\ne\n1\n9\n0\nc\n7\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nQ\nu\ne\nr\ny\nO\np\nt\ni\no\nn\nW\n+\n0\nx\n1\n8\na\na\n \nH\nt\nt\np\nQ\nu\ne\nr\ny\nI\nn\nf\no\nA\n-\n0\nx\nb\nb\nd\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n1\n9\n7\n8\n1\n \n@\n \n0\nx\n7\n5\ne\n1\n9\n7\n8\n1\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nA\nu\nt\no\nP\nr\no\nx\ny\nD\nl\nl\n+\n0\nx\n3\n2\na\na\n \nI\nn\nt\ne\nr\nn\ne\nt\nC\no\nn\nn\ne\nc\nt\nW\n-\n0\nx\n1\nb\n6\n6\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n2\n2\nd\nc\n6\n \n@\n \n0\nx\n7\n5\ne\n2\n2\nd\nc\n6\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nA\nu\nt\no\nP\nr\no\nx\ny\nD\nl\nl\n+\n0\nx\n2\na\nd\nc\n \nI\nn\nt\ne\nr\nn\ne\nt\nC\no\nn\nn\ne\nc\nt\nW\n-\n0\nx\n2\n3\n3\n4\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n2\n2\n5\nf\n8\n \n@\n \n0\nx\n7\n5\ne\n2\n2\n5\nf\n8\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nA\nu\nt\no\nP\nr\no\nx\ny\nD\nl\nl\n+\n0\nx\n2\na\n7\n9\n \nI\nn\nt\ne\nr\nn\ne\nt\nC\no\nn\nn\ne\nc\nt\nW\n-\n0\nx\n2\n3\n9\n7\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n2\n2\n5\n9\n5\n \n@\n \n0\nx\n7\n5\ne\n2\n2\n5\n9\n5\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nQ\nu\ne\nr\ny\nO\np\nt\ni\no\nn\nW\n+\n0\nx\n1\n1\nf\n0\n \nH\nt\nt\np\nQ\nu\ne\nr\ny\nI\nn\nf\no\nA\n-\n0\nx\n1\n2\n7\n7\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n1\n9\n0\nc\n7\n \n@\n \n0\nx\n7\n5\ne\n1\n9\n0\nc\n7\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nQ\nu\ne\nr\ny\nO\np\nt\ni\no\nn\nW\n+\n0\nx\n1\n8\na\na\n \nH\nt\nt\np\nQ\nu\ne\nr\ny\nI\nn\nf\no\nA\n-\n0\nx\nb\nb\nd\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n1\n9\n7\n8\n1\n \n@\n \n0\nx\n7\n5\ne\n1\n9\n7\n8\n1\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nA\nu\nt\no\nP\nr\no\nx\ny\nD\nl\nl\n+\n0\nx\n2\n8\n5\n8\n \nI\nn\nt\ne\nr\nn\ne\nt\nC\no\nn\nn\ne\nc\nt\nW\n-\n0\nx\n2\n5\nb\n8\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n2\n2\n3\n7\n4\n \n@\n \n0\nx\n7\n5\ne\n2\n2\n3\n7\n4\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nA\nu\nt\no\nP\nr\no\nx\ny\nD\nl\nl\n+\n0\nx\n2\n7\n7\ne\n \nI\nn\nt\ne\nr\nn\ne\nt\nC\no\nn\nn\ne\nc\nt\nW\n-\n0\nx\n2\n6\n9\n2\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n2\n2\n2\n9\na\n \n@\n \n0\nx\n7\n5\ne\n2\n2\n2\n9\na\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nQ\nu\ne\nr\ny\nO\np\nt\ni\no\nn\nW\n+\n0\nx\n1\n1\nf\n0\n \nH\nt\nt\np\nQ\nu\ne\nr\ny\nI\nn\nf\no\nA\n-\n0\nx\n1\n2\n7\n7\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n1\n9\n0\nc\n7\n \n@\n \n0\nx\n7\n5\ne\n1\n9\n0\nc\n7\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nQ\nu\ne\nr\ny\nO\np\nt\ni\no\nn\nW\n+\n0\nx\n1\n8\na\na\n \nH\nt\nt\np\nQ\nu\ne\nr\ny\nI\nn\nf\no\nA\n-\n0\nx\nb\nb\nd\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n1\n9\n7\n8\n1\n \n@\n \n0\nx\n7\n5\ne\n1\n9\n7\n8\n1\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nA\nu\nt\no\nP\nr\no\nx\ny\nD\nl\nl\n+\n0\nx\n2\n3\nb\nb\n \nI\nn\nt\ne\nr\nn\ne\nt\nC\no\nn\nn\ne\nc\nt\nW\n-\n0\nx\n2\na\n5\n5\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n2\n1\ne\nd\n7\n \n@\n \n0\nx\n7\n5\ne\n2\n1\ne\nd\n7\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nA\nu\nt\no\nP\nr\no\nx\ny\nD\nl\nl\n+\n0\nx\n4\n0\n8\n \nI\nn\nt\ne\nr\nn\ne\nt\nC\no\nn\nn\ne\nc\nt\nW\n-\n0\nx\n4\na\n0\n8\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n1\nf\nf\n2\n4\n \n@\n \n0\nx\n7\n5\ne\n1\nf\nf\n2\n4\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nQ\nu\ne\nr\ny\nO\np\nt\ni\no\nn\nW\n+\n0\nx\n1\n1\nf\n0\n \nH\nt\nt\np\nQ\nu\ne\nr\ny\nI\nn\nf\no\nA\n-\n0\nx\n1\n2\n7\n7\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n1\n9\n0\nc\n7\n \n@\n \n0\nx\n7\n5\ne\n1\n9\n0\nc\n7\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nQ\nu\ne\nr\ny\nO\np\nt\ni\no\nn\nW\n+\n0\nx\n1\n8\na\na\n \nH\nt\nt\np\nQ\nu\ne\nr\ny\nI\nn\nf\no\nA\n-\n0\nx\nb\nb\nd\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n1\n9\n7\n8\n1\n \n@\n \n0\nx\n7\n5\ne\n1\n9\n7\n8\n1\n\n\nD\ne\nl\ne\nt\ne\nU\nr\nl\nC\na\nc\nh\ne\nE\nn\nt\nr\ny\n+\n0\nx\n9\n6\ne\n \nS\ne\nt\nU\nr\nl\nC\na\nc\nh\ne\nE\nn\nt\nr\ny\nI\nn\nf\no\nA\n-\n0\nx\n6\n5\nd\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n4\n6\n3\n5\n6\n \n@\n \n0\nx\n7\n5\ne\n4\n6\n3\n5\n6\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nO\np\ne\nn\nU\nr\nl\nA\n+\n0\nx\n7\ne\n1\n \nI\nn\nt\ne\nr\nn\ne\nt\nC\no\nm\nb\ni\nn\ne\nU\nr\nl\nW\n-\n0\nx\n1\n6\nb\n3\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n4\n3\n8\nd\n2\n \n@\n \n0\nx\n7\n5\ne\n4\n3\n8\nd\n2\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nO\np\ne\nn\nU\nr\nl\nA\n+\n0\nx\n7\n3\n5\n \nI\nn\nt\ne\nr\nn\ne\nt\nC\no\nm\nb\ni\nn\ne\nU\nr\nl\nW\n-\n0\nx\n1\n7\n5\nf\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n4\n3\n8\n2\n6\n \n@\n \n0\nx\n7\n5\ne\n4\n3\n8\n2\n6\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nQ\nu\ne\nr\ny\nO\np\nt\ni\no\nn\nW\n+\n0\nx\n1\n1\nf\n0\n \nH\nt\nt\np\nQ\nu\ne\nr\ny\nI\nn\nf\no\nA\n-\n0\nx\n1\n2\n7\n7\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n1\n9\n0\nc\n7\n \n@\n \n0\nx\n7\n5\ne\n1\n9\n0\nc\n7\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nQ\nu\ne\nr\ny\nO\np\nt\ni\no\nn\nW\n+\n0\nx\n1\n8\na\na\n \nH\nt\nt\np\nQ\nu\ne\nr\ny\nI\nn\nf\no\nA\n-\n0\nx\nb\nb\nd\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n1\n9\n7\n8\n1\n \n@\n \n0\nx\n7\n5\ne\n1\n9\n7\n8\n1\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nO\np\ne\nn\nU\nr\nl\nA\n+\n0\nx\n4\n2\n3\n \nI\nn\nt\ne\nr\nn\ne\nt\nC\no\nm\nb\ni\nn\ne\nU\nr\nl\nW\n-\n0\nx\n1\na\n7\n1\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n4\n3\n5\n1\n4\n \n@\n \n0\nx\n7\n5\ne\n4\n3\n5\n1\n4\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nO\np\ne\nn\nU\nr\nl\nA\n+\n0\nx\n2\n9\n2\n \nI\nn\nt\ne\nr\nn\ne\nt\nC\no\nm\nb\ni\nn\ne\nU\nr\nl\nW\n-\n0\nx\n1\nc\n0\n2\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n4\n3\n3\n8\n3\n \n@\n \n0\nx\n7\n5\ne\n4\n3\n3\n8\n3\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nQ\nu\ne\nr\ny\nO\np\nt\ni\no\nn\nW\n+\n0\nx\n1\n1\nf\n0\n \nH\nt\nt\np\nQ\nu\ne\nr\ny\nI\nn\nf\no\nA\n-\n0\nx\n1\n2\n7\n7\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n1\n9\n0\nc\n7\n \n@\n \n0\nx\n7\n5\ne\n1\n9\n0\nc\n7\n\n\nI\nn\nt\ne\nr\nn\ne\nt\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nA\nu\nt\no\nP\nr\no\nx\ny\nD\nl\nl\n+\n0\nx\n3\n3\n9\n \nI\nn\nt\ne\nr\nn\ne\nt\nC\no\nn\nn\ne\nc\nt\nW\n-\n0\nx\n4\na\nd\n7\n \nw\ni\nn\ni\nn\ne\nt\n+\n0\nx\n1\nf\ne\n5\n5\n \n@\n \n0\nx\n7\n5\ne\n1\nf\ne\n5\n5\n\n\nP\na\nt\nh\nB\nu\ni\nl\nd\nR\no\no\nt\nW\n+\n0\nx\n4\nc\n \nS\nH\nR\ne\ng\nG\ne\nt\nV\na\nl\nu\ne\nW\n-\n0\nx\n6\n0\n9\n \ns\nh\nl\nw\na\np\ni\n+\n0\nx\n1\nb\n2\nb\n1\n \n@\n \n0\nx\n7\n7\n5\n8\nb\n2\nb\n1\n\n\nR\nt\nl\nG\ne\nt\nU\ns\ne\nr\nI\nn\nf\no\nH\ne\na\np\n+\n0\nx\n2\n2\n5\n \nR\nt\nl\nQ\nu\ne\nu\ne\nW\no\nr\nk\nI\nt\ne\nm\n-\n0\nx\n2\n1\n0\n \nn\nt\nd\nl\nl\n+\n0\nx\n6\n7\ne\n9\n6\n \n@\n \n0\nx\n7\n7\nb\nf\n7\ne\n9\n6\n\n\nT\np\nC\na\nl\nl\nb\na\nc\nk\nI\nn\nd\ne\np\ne\nn\nd\ne\nn\nt\n+\n0\nx\n5\n2\n7\n \nR\nt\nl\nI\ns\nC\nr\ni\nt\ni\nc\na\nl\nS\ne\nc\nt\ni\no\nn\nL\no\nc\nk\ne\nd\nB\ny\nT\nh\nr\ne\na\nd\n-\n0\nx\n2\n4\n0\n \nn\nt\nd\nl\nl\n+\n0\nx\n4\n5\n4\nf\n4\n \n@\n \n0\nx\n7\n7\nb\nd\n5\n4\nf\n4\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 66710512,
"edi": 1,
"eax": 1564,
"ebp": 66710524,
"edx": 0,
"ebx": 1977313952,
"esi": 10877860,
"ecx": 10936144
},
"exception": {
"instruction_r": "f7 31 8b 4c 91 04 89 4d 08 85 c9 74 2a 8b 45 0c",
"symbol": "WahReferenceContextByHandle+0x38 WSAIoctl-0x8f ws2_32+0x2f58",
"instruction": "div dword ptr [ecx]",
"module": "WS2_32.dll",
"exception_code": "0xc0000094",
"offset": 12120,
"address": "0x77312f58"
}
},
"time": 1594439596.874375,
"tid": 2272,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 6021
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "R\nt\nl\nF\nr\ne\ne\nH\ne\na\np\n+\n0\nx\n7\ne\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nH\ne\na\np\n-\n0\nx\n2\n3\n \nn\nt\nd\nl\nl\n+\n0\nx\n2\ne\n0\n0\n3\n \n@\n \n0\nx\n7\n7\nb\nb\ne\n0\n0\n3\n\n\nH\ne\na\np\nF\nr\ne\ne\n+\n0\nx\n1\n4\n \nG\ne\nt\nP\nr\no\nc\ne\ns\ns\nH\ne\na\np\n-\n0\nx\nc\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n1\n4\nd\nd\n \n@\n \n0\nx\n7\n5\nb\nc\n1\n4\nd\nd\n\n\na\n9\n2\na\n3\n3\n7\n9\ne\n7\n0\nd\n2\nd\n3\n9\nc\nf\n6\n3\na\nc\n6\nc\n8\nd\n9\ne\ne\n8\nb\ne\nd\nc\n9\na\n2\n7\nb\n3\n1\n1\n0\nc\n0\n5\nd\n2\n0\nc\nc\n5\n5\nd\n9\n9\nf\n3\n3\n4\n5\n5\ne\n4\n+\n0\nx\n2\n7\n7\n5\n5\nc\n \n@\n \n0\nx\n6\n7\n7\n5\n5\nc\n\n\na\n9\n2\na\n3\n3\n7\n9\ne\n7\n0\nd\n2\nd\n3\n9\nc\nf\n6\n3\na\nc\n6\nc\n8\nd\n9\ne\ne\n8\nb\ne\nd\nc\n9\na\n2\n7\nb\n3\n1\n1\n0\nc\n0\n5\nd\n2\n0\nc\nc\n5\n5\nd\n9\n9\nf\n3\n3\n4\n5\n5\ne\n4\n+\n0\nx\n2\n8\ne\n3\nb\n \n@\n \n0\nx\n4\n2\n8\ne\n3\nb\n\n\na\n9\n2\na\n3\n3\n7\n9\ne\n7\n0\nd\n2\nd\n3\n9\nc\nf\n6\n3\na\nc\n6\nc\n8\nd\n9\ne\ne\n8\nb\ne\nd\nc\n9\na\n2\n7\nb\n3\n1\n1\n0\nc\n0\n5\nd\n2\n0\nc\nc\n5\n5\nd\n9\n9\nf\n3\n3\n4\n5\n5\ne\n4\n+\n0\nx\n2\n8\nf\n3\n0\n \n@\n \n0\nx\n4\n2\n8\nf\n3\n0\n\n\na\n9\n2\na\n3\n3\n7\n9\ne\n7\n0\nd\n2\nd\n3\n9\nc\nf\n6\n3\na\nc\n6\nc\n8\nd\n9\ne\ne\n8\nb\ne\nd\nc\n9\na\n2\n7\nb\n3\n1\n1\n0\nc\n0\n5\nd\n2\n0\nc\nc\n5\n5\nd\n9\n9\nf\n3\n3\n4\n5\n5\ne\n4\n+\n0\nx\n1\na\n6\nd\nf\n3\n \n@\n \n0\nx\n5\na\n6\nd\nf\n3\n\n\nG\ne\nt\nP\nr\no\nf\ni\nl\ne\nS\nt\nr\ni\nn\ng\nW\n+\n0\nx\n1\n2\na\n9\nb\n \nE\nn\nu\nm\nR\ne\ns\no\nu\nr\nc\ne\nN\na\nm\ne\ns\nW\n-\n0\nx\n3\n3\n1\n1\na\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n5\n0\n0\n4\n7\n \n@\n \n0\nx\n7\n5\nc\n0\n0\n0\n4\n7\n\n\nR\nt\nl\nW\ne\nr\np\nR\ne\np\no\nr\nt\nE\nx\nc\ne\np\nt\ni\no\nn\n+\n0\nx\n2\n5\nb\n \nT\np\nR\ne\nl\ne\na\ns\ne\nC\nl\ne\na\nn\nu\np\nG\nr\no\nu\np\nM\ne\nm\nb\ne\nr\ns\n-\n0\nx\n2\nf\nb\n \nn\nt\nd\nl\nl\n+\n0\nx\n7\n3\nd\n2\n1\n \n@\n \n0\nx\n7\n7\nc\n0\n3\nd\n2\n1\n\n\nR\nt\nl\nW\ne\nr\np\nR\ne\np\no\nr\nt\nE\nx\nc\ne\np\nt\ni\no\nn\n+\n0\nx\n1\ne\nf\n \nT\np\nR\ne\nl\ne\na\ns\ne\nC\nl\ne\na\nn\nu\np\nG\nr\no\nu\np\nM\ne\nm\nb\ne\nr\ns\n-\n0\nx\n3\n6\n7\n \nn\nt\nd\nl\nl\n+\n0\nx\n7\n3\nc\nb\n5\n \n@\n \n0\nx\n7\n7\nc\n0\n3\nc\nb\n5\n\n\nR\nt\nl\nU\nl\no\nn\ng\nl\no\nn\ng\nB\ny\nt\ne\nS\nw\na\np\n+\n0\nx\n1\ne\n7\nc\n7\n \nR\nt\nl\nF\nr\ne\ne\nO\ne\nm\nS\nt\nr\ni\nn\ng\n-\n0\nx\n3\n1\n1\n3\n \nn\nt\nd\nl\nl\n+\n0\nx\n9\nb\nb\nb\n7\n \n@\n \n0\nx\n7\n7\nc\n2\nb\nb\nb\n7\n\n\nB\na\ns\ne\nT\nh\nr\ne\na\nd\nI\nn\ni\nt\nT\nh\nu\nn\nk\n+\n0\nx\n1\n2\n \nV\ne\nr\ni\nf\ny\nC\no\nn\ns\no\nl\ne\nI\no\nH\na\nn\nd\nl\ne\n-\n0\nx\nb\n3\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n3\n3\nc\na\n \n@\n \n0\nx\n7\n5\nb\nc\n3\n3\nc\na\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n6\n3\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\na\n1\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\nd\n2\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\nd\n2\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 66707600,
"edi": 11235520,
"eax": 0,
"ebp": 66707652,
"edx": 11235528,
"ebx": 11235528,
"esi": 466386304,
"ecx": 10551296
},
"exception": {
"instruction_r": "8b 46 04 89 45 f4 c6 47 07 80 c6 47 06 00 8b 5e",
"symbol": "RtlInitUnicodeString+0x196 RtlMultiByteToUnicodeN-0x1a7 ntdll+0x2e39e",
"instruction": "mov eax, dword ptr [esi + 4]",
"module": "ntdll.dll",
"exception_code": "0xc0000005",
"offset": 189342,
"address": "0x77bbe39e"
}
},
"time": 1594439596.874375,
"tid": 2272,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 6023
},
{
"call": {
"category": "__notification__",
"status": 1,
"stacktrace": [],
"raw": [
"stacktrace"
],
"api": "__exception__",
"return_value": 0,
"arguments": {
"stacktrace": "R\nt\nl\nF\nr\ne\ne\nH\ne\na\np\n+\n0\nx\n7\ne\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nH\ne\na\np\n-\n0\nx\n2\n3\n \nn\nt\nd\nl\nl\n+\n0\nx\n2\ne\n0\n0\n3\n \n@\n \n0\nx\n7\n7\nb\nb\ne\n0\n0\n3\n\n\nH\ne\na\np\nF\nr\ne\ne\n+\n0\nx\n1\n4\n \nG\ne\nt\nP\nr\no\nc\ne\ns\ns\nH\ne\na\np\n-\n0\nx\nc\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n1\n1\n4\nd\nd\n \n@\n \n0\nx\n7\n5\nb\nc\n1\n4\nd\nd\n\n\na\n9\n2\na\n3\n3\n7\n9\ne\n7\n0\nd\n2\nd\n3\n9\nc\nf\n6\n3\na\nc\n6\nc\n8\nd\n9\ne\ne\n8\nb\ne\nd\nc\n9\na\n2\n7\nb\n3\n1\n1\n0\nc\n0\n5\nd\n2\n0\nc\nc\n5\n5\nd\n9\n9\nf\n3\n3\n4\n5\n5\ne\n4\n+\n0\nx\n2\n7\n7\n5\n5\nc\n \n@\n \n0\nx\n6\n7\n7\n5\n5\nc\n\n\na\n9\n2\na\n3\n3\n7\n9\ne\n7\n0\nd\n2\nd\n3\n9\nc\nf\n6\n3\na\nc\n6\nc\n8\nd\n9\ne\ne\n8\nb\ne\nd\nc\n9\na\n2\n7\nb\n3\n1\n1\n0\nc\n0\n5\nd\n2\n0\nc\nc\n5\n5\nd\n9\n9\nf\n3\n3\n4\n5\n5\ne\n4\n+\n0\nx\n2\n8\ne\n3\nb\n \n@\n \n0\nx\n4\n2\n8\ne\n3\nb\n\n\na\n9\n2\na\n3\n3\n7\n9\ne\n7\n0\nd\n2\nd\n3\n9\nc\nf\n6\n3\na\nc\n6\nc\n8\nd\n9\ne\ne\n8\nb\ne\nd\nc\n9\na\n2\n7\nb\n3\n1\n1\n0\nc\n0\n5\nd\n2\n0\nc\nc\n5\n5\nd\n9\n9\nf\n3\n3\n4\n5\n5\ne\n4\n+\n0\nx\n2\n8\nf\n3\n0\n \n@\n \n0\nx\n4\n2\n8\nf\n3\n0\n\n\na\n9\n2\na\n3\n3\n7\n9\ne\n7\n0\nd\n2\nd\n3\n9\nc\nf\n6\n3\na\nc\n6\nc\n8\nd\n9\ne\ne\n8\nb\ne\nd\nc\n9\na\n2\n7\nb\n3\n1\n1\n0\nc\n0\n5\nd\n2\n0\nc\nc\n5\n5\nd\n9\n9\nf\n3\n3\n4\n5\n5\ne\n4\n+\n0\nx\n1\na\n6\nd\nf\n3\n \n@\n \n0\nx\n5\na\n6\nd\nf\n3\n\n\nG\ne\nt\nP\nr\no\nf\ni\nl\ne\nS\nt\nr\ni\nn\ng\nW\n+\n0\nx\n1\n2\na\n9\nb\n \nE\nn\nu\nm\nR\ne\ns\no\nu\nr\nc\ne\nN\na\nm\ne\ns\nW\n-\n0\nx\n3\n3\n1\n1\na\n \nk\ne\nr\nn\ne\nl\n3\n2\n+\n0\nx\n5\n0\n0\n4\n7\n \n@\n \n0\nx\n7\n5\nc\n0\n0\n0\n4\n7\n\n\nR\nt\nl\nK\nn\no\nw\nn\nE\nx\nc\ne\np\nt\ni\no\nn\nF\ni\nl\nt\ne\nr\n+\n0\nx\nb\n7\n \nE\nt\nw\nE\nv\ne\nn\nt\nW\nr\ni\nt\ne\nN\no\nR\ne\ng\ni\ns\nt\nr\na\nt\ni\no\nn\n-\n0\nx\n4\n9\n \nn\nt\nd\nl\nl\n+\n0\nx\n7\n2\n1\nd\n7\n \n@\n \n0\nx\n7\n7\nc\n0\n2\n1\nd\n7\n\n\nR\nt\nl\nI\nn\ni\nt\ni\na\nl\ni\nz\ne\nE\nx\nc\ne\np\nt\ni\no\nn\nC\nh\na\ni\nn\n+\n0\nx\n3\n6\n \nR\nt\nl\nA\nl\nl\no\nc\na\nt\ne\nA\nc\nt\ni\nv\na\nt\ni\no\nn\nC\no\nn\nt\ne\nx\nt\nS\nt\na\nc\nk\n-\n0\nx\nc\ne\n \nn\nt\nd\nl\nl\n+\n0\nx\n3\n9\ne\na\n5\n \n@\n \n0\nx\n7\n7\nb\nc\n9\ne\na\n5",
"registers": {
"esp": 66704740,
"edi": 10936032,
"eax": 10732824,
"ebp": 66704792,
"edx": 10936040,
"ebx": 10936040,
"esi": 460197212,
"ecx": 10551296
},
"exception": {
"instruction_r": "8b 46 04 89 45 f4 c6 47 07 80 c6 47 06 00 8b 5e",
"symbol": "RtlInitUnicodeString+0x196 RtlMultiByteToUnicodeN-0x1a7 ntdll+0x2e39e",
"instruction": "mov eax, dword ptr [esi + 4]",
"module": "ntdll.dll",
"exception_code": "0xc0000005",
"offset": 189342,
"address": "0x77bbe39e"
}
},
"time": 1594439596.874375,
"tid": 2272,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 6025
}
],
"references": [],
"name": "raises_exception"
},
{
"markcount": 1,
"families": [],
"description": "Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation",
"severity": 2,
"marks": [
{
"call": {
"category": "misc",
"status": 0,
"stacktrace": [],
"last_error": 3,
"nt_status": -1073741766,
"api": "GetDiskFreeSpaceExW",
"return_value": 0,
"arguments": {
"root_path": "C:\\Users\\cuck\\AppData\\Roaming\\uTorrent\\share",
"free_bytes_available": 46527638415605760,
"total_number_of_free_bytes": 16106127418,
"total_number_of_bytes": 46495907200892928
},
"time": 1594439588.015375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 1118
}
],
"references": [],
"name": "antivm_disk_size"
},
{
"markcount": 1,
"families": [],
"description": "Checks adapter addresses which can be used to detect virtual network interfaces",
"severity": 2,
"marks": [
{
"call": {
"category": "network",
"status": 0,
"stacktrace": [],
"last_error": 0,
"nt_status": -1073741772,
"api": "GetAdaptersAddresses",
"return_value": 111,
"arguments": {
"flags": 0,
"family": 0
},
"time": 1594439589.609375,
"tid": 1424,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 4932
}
],
"references": [],
"name": "antivm_network_adapters"
},
{
"markcount": 3,
"families": [],
"description": "The binary likely contains encrypted or compressed data indicative of a packer",
"severity": 2,
"marks": [
{
"entropy": 7.999873991297165,
"section": {
"size_of_data": "0x001d9200",
"virtual_address": "0x00350000",
"entropy": 7.999873991297165,
"name": "UPX1",
"virtual_size": "0x001da000"
},
"type": "generic",
"description": "A section with a high entropy has been found"
},
{
"entropy": 7.006179290036449,
"section": {
"size_of_data": "0x0001ee00",
"virtual_address": "0x0052a000",
"entropy": 7.006179290036449,
"name": ".rsrc",
"virtual_size": "0x0001f000"
},
"type": "generic",
"description": "A section with a high entropy has been found"
},
{
"entropy": 1,
"type": "generic",
"description": "Overall entropy of this PE file is high"
}
],
"references": [
"http:\/\/www.forensickb.com\/2013\/03\/file-entropy-explained.html",
"http:\/\/virii.es\/U\/Using%20Entropy%20Analysis%20to%20Find%20Encrypted%20and%20Packed%20Malware.pdf"
],
"name": "packer_entropy"
},
{
"markcount": 1,
"families": [],
"description": "Checks for the Locally Unique Identifier on the system for a suspicious privilege",
"severity": 2,
"marks": [
{
"call": {
"category": "system",
"status": 1,
"stacktrace": [],
"api": "LookupPrivilegeValueW",
"return_value": 1,
"arguments": {
"system_name": "",
"privilege_name": "SeManageVolumePrivilege"
},
"time": 1594439588.015375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 1106
}
],
"references": [],
"name": "privilege_luid_check"
},
{
"markcount": 3,
"families": [],
"description": "Queries for potentially installed applications",
"severity": 2,
"marks": [
{
"call": {
"category": "registry",
"status": 0,
"stacktrace": [],
"last_error": 3,
"nt_status": -1073741772,
"api": "RegOpenKeyExW",
"return_value": 2,
"arguments": {
"access": "0x00020019",
"base_handle": "0x80000001",
"key_handle": "0x00000000",
"regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\uTorrent",
"regkey_r": "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\uTorrent",
"options": 0
},
"time": 1594439588.280375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 2042
},
{
"call": {
"category": "registry",
"status": 0,
"stacktrace": [],
"last_error": 1444,
"nt_status": -1073741772,
"api": "RegOpenKeyExW",
"return_value": 2,
"arguments": {
"access": "0x00020019",
"base_handle": "0x80000001",
"key_handle": "0x00000000",
"regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\uTorrent",
"regkey_r": "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\uTorrent",
"options": 0
},
"time": 1594439589.515375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 4197
},
{
"call": {
"category": "registry",
"status": 0,
"stacktrace": [],
"last_error": 2,
"nt_status": -1073741772,
"api": "RegOpenKeyExW",
"return_value": 2,
"arguments": {
"access": "0x00020019",
"base_handle": "0x80000001",
"key_handle": "0x00000000",
"regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\uTorrent",
"regkey_r": "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\uTorrent",
"options": 0
},
"time": 1594439589.530375,
"tid": 2676,
"flags": {}
},
"pid": 2456,
"type": "call",
"cid": 4261
}
],
"references": [],
"name": "queries_programs"
},
{
"markcount": 2,
"families": [],
"description": "The executable is compressed using UPX",
"severity": 2,
"marks": [
{
"section": "UPX0",
"type": "generic",
"description": "Section name indicates UPX"
},
{
"section": "UPX1",
"type": "generic",
"description": "Section name indicates UPX"
}
],
"references": [],
"name": "packer_upx"
},
{
"markcount": 1,
"families": [],
"description": "Disables proxy possibly for traffic interception",
"severity": 3,
"marks": [
{
"call": {
"category": "registry",
"status": 1,
"stacktrace": [],
"api": "RegSetValueExA",
"return_value": 0,
"arguments": {
"key_handle": "0x000004c4",
"value": 0,
"regkey_r": "ProxyEnable",
"reg_type": 4,
"regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyEnable"
},
"time": 1594439589.577375,
"tid": 344,
"flags": {
"reg_type": "REG_DWORD"
}
},
"pid": 2456,
"type": "call",
"cid": 4727
}
],
"references": [],
"name": "disables_proxy"
},
{
"markcount": 5,
"families": [],
"description": "Sets or modifies WPAD proxy autoconfiguration file for traffic interception",
"severity": 3,
"marks": [
{
"call": {
"category": "registry",
"status": 1,
"stacktrace": [],
"api": "RegSetValueExA",
"return_value": 0,
"arguments": {
"key_handle": "0x00000548",
"value": 1,
"regkey_r": "WpadDecisionReason",
"reg_type": 4,
"regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionReason"
},
"time": 1594439592.187375,
"tid": 1424,
"flags": {
"reg_type": "REG_DWORD"
}
},
"pid": 2456,
"type": "call",
"cid": 5224
},
{
"call": {
"category": "registry",
"status": 1,
"stacktrace": [],
"api": "RegSetValueExA",
"return_value": 0,
"arguments": {
"key_handle": "0x00000548",
"value": "\u00b0T)\u00b5`W\u00d6\u0001",
"regkey_r": "WpadDecisionTime",
"reg_type": 3,
"regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecisionTime"
},
"time": 1594439592.187375,
"tid": 1424,
"flags": {
"reg_type": "REG_BINARY"
}
},
"pid": 2456,
"type": "call",
"cid": 5225
},
{
"call": {
"category": "registry",
"status": 1,
"stacktrace": [],
"api": "RegSetValueExA",
"return_value": 0,
"arguments": {
"key_handle": "0x00000548",
"value": 3,
"regkey_r": "WpadDecision",
"reg_type": 4,
"regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadDecision"
},
"time": 1594439592.187375,
"tid": 1424,
"flags": {
"reg_type": "REG_DWORD"
}
},
"pid": 2456,
"type": "call",
"cid": 5226
},
{
"call": {
"category": "registry",
"status": 1,
"stacktrace": [],
"api": "RegSetValueExW",
"return_value": 0,
"arguments": {
"key_handle": "0x00000548",
"value": "Unidentified network",
"regkey_r": "WpadNetworkName",
"reg_type": 1,
"regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}\\WpadNetworkName"
},
"time": 1594439592.187375,
"tid": 1424,
"flags": {
"reg_type": "REG_SZ"
}
},
"pid": 2456,
"type": "call",
"cid": 5227
},
{
"call": {
"category": "registry",
"status": 1,
"stacktrace": [],
"api": "RegSetValueExW",
"return_value": 0,
"arguments": {
"key_handle": "0x00000544",
"value": "{E34DF837-3A38-4E8C-83F4-ABF8AB3FB4A6}",
"regkey_r": "WpadLastNetwork",
"reg_type": 1,
"regkey": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadLastNetwork"
},
"time": 1594439592.202375,
"tid": 1424,
"flags": {
"reg_type": "REG_SZ"
}
},
"pid": 2456,
"type": "call",
"cid": 5296
}
],
"references": [],
"name": "modifies_proxy_wpad"
},
{
"markcount": 1,
"families": [],
"description": "Detects the presence of Wine emulator",
"severity": 3,
"marks": [
{
"category": "registry",
"ioc": "HKEY_CURRENT_USER\\Software\\Wine",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "antiemu_wine"
}
] Yara
The Yara rules did not detect anything in the file.
Network
{
"tls": [],
"udp": [
{
"src": "192.168.56.101",
"dst": "192.168.56.255",
"offset": 546,
"time": 3.081908941268921,
"dport": 137,
"sport": 137
},
{
"src": "192.168.56.101",
"dst": "192.168.56.255",
"offset": 5874,
"time": 9.078470945358276,
"dport": 138,
"sport": 138
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 7718,
"time": 3.0139760971069336,
"dport": 5355,
"sport": 51001
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 8046,
"time": 1.0376439094543457,
"dport": 5355,
"sport": 53595
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 8374,
"time": 3.0235888957977295,
"dport": 5355,
"sport": 53848
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 8702,
"time": 1.6668610572814941,
"dport": 5355,
"sport": 54255
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 9030,
"time": -0.08894109725952148,
"dport": 5355,
"sport": 55314
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 9358,
"time": 4.052516937255859,
"dport": 5355,
"sport": 55880
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 9678,
"time": 1.6089630126953125,
"dport": 1900,
"sport": 1900
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 29088,
"time": 1.0768799781799316,
"dport": 3702,
"sport": 49152
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 37472,
"time": 3.1260669231414795,
"dport": 1900,
"sport": 53598
}
],
"dns_servers": [],
"http": [],
"icmp": [],
"smtp": [],
"tcp": [],
"smtp_ex": [],
"mitm": [],
"hosts": [],
"pcap_sha256": "91807ecedcff5dd9ba5a03c77ee36ac42abc29ebdbef040a4cd1a10a09e079f1",
"dns": [],
"http_ex": [],
"domains": [],
"dead_hosts": [],
"sorted_pcap_sha256": "f28eff6413b4fa22fd3e929dd9f9b820ca8c02b1e546c1c81df55387770b524e",
"irc": [],
"https_ex": []
}Screenshots
Other files also named uTorrent.exe
uTorrent.exe (15 votes)
TCP/UDP Listening Ports [?]
uTorrent.exe has been reported to listen on the following TCP/UDP ports.
| Port | Protocol | # Occurrences |
|---|---|---|
| 49618 | TCP v4 | 2 |
Hashes [?]
| Property | Value |
|---|---|
| MD5 | a38e9d412d2482e12caa4d8b5f42cab2 |
| SHA256 | a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4 |
Error Messages
These are some of the error messages that can appear related to utorrent.exe:
utorrent.exe has encountered a problem and needs to close. We are sorry for the inconvenience.
utorrent.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.
µTorrent has stopped working.
End Program - utorrent.exe. This program is not responding.
utorrent.exe is not a valid Win32 application.
utorrent.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.
What will you do with uTorrent.exe?
To help other users, please let us know what you will do with uTorrent.exe:
Malware or legitimate?
If you feel that you need more information to determine if your should keep this file or remove it, please read this guide.
And now some shameless self promotion ;)
Hi, my name is Roger Karlsson. I've been running this website since 2006. I want to let you know about the FreeFixer program. FreeFixer is a freeware tool that analyzes your system and let you manually identify unwanted programs. Once you've identified some malware files, FreeFixer is pretty good at removing them. You can download FreeFixer here. It runs on Windows 2000/XP/2003/2008/2016/2019/Vista/7/8/8.1/10. Supports both 32- and 64-bit Windows.
If you have questions, feedback on FreeFixer or the freefixer.com website, need help analyzing FreeFixer's scan result or just want to say hello, please contact me. You can find my email address at the contact page.
Comments
Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.
I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.
No comments posted yet.