Analysis

Category Package Started Completed Duration Options Log
FILE Extraction 2020-02-14 15:33:40 2020-02-14 15:39:52 372 seconds Show Options Show Log
  • Info: The analysis hit the critical timeout, terminating.
route = inetsim
procdump = 0
2020-02-14 16:34:05,000 [root] INFO: Date set to: 02-14-20, time set to: 15:34:05, timeout set to: 200
2020-02-14 16:34:05,046 [root] DEBUG: Starting analyzer from: C:\inqczlrb
2020-02-14 16:34:05,046 [root] DEBUG: Storing results at: C:\KYrDELgaq
2020-02-14 16:34:05,046 [root] DEBUG: Pipe server name: \\.\PIPE\xwiEBcIMA
2020-02-14 16:34:05,046 [root] INFO: Analysis package "Extraction" has been specified.
2020-02-14 16:34:07,000 [root] DEBUG: Started auxiliary module Browser
2020-02-14 16:34:07,015 [root] DEBUG: Started auxiliary module Curtain
2020-02-14 16:34:07,015 [modules.auxiliary.digisig] DEBUG: Checking for a digitial signature.
2020-02-14 16:34:08,625 [modules.auxiliary.digisig] DEBUG: File has an invalid signature.
2020-02-14 16:34:08,625 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2020-02-14 16:34:08,625 [root] DEBUG: Started auxiliary module DigiSig
2020-02-14 16:34:08,625 [root] DEBUG: Started auxiliary module Disguise
2020-02-14 16:34:08,625 [root] DEBUG: Started auxiliary module Human
2020-02-14 16:34:08,625 [root] DEBUG: Started auxiliary module Screenshots
2020-02-14 16:34:08,625 [root] DEBUG: Started auxiliary module Sysmon
2020-02-14 16:34:08,625 [root] DEBUG: Started auxiliary module Usage
2020-02-14 16:34:08,625 [root] INFO: Analyzer: Package modules.packages.Extraction does not specify a DLL option
2020-02-14 16:34:08,625 [root] INFO: Analyzer: Package modules.packages.Extraction does not specify a DLL_64 option
2020-02-14 16:34:09,030 [lib.api.process] INFO: Successfully executed process from path "C:\Users\Rebecca\AppData\Local\Temp\sh1.exe" with arguments "" with pid 2360
2020-02-14 16:34:09,390 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-02-14 16:34:09,390 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-02-14 16:34:09,405 [lib.api.process] INFO: 32-bit DLL to inject is C:\inqczlrb\dll\OQecjSq.dll, loader C:\inqczlrb\bin\sUENDCm.exe
2020-02-14 16:34:19,092 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xwiEBcIMA.
2020-02-14 16:34:21,983 [root] DEBUG: Loader: Injecting process 2360 (thread 2224) with C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:34:22,578 [root] DEBUG: Process image base: 0x00400000
2020-02-14 16:34:22,842 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:34:23,453 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-02-14 16:34:23,500 [root] DEBUG: Successfully injected DLL C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:34:23,515 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2360
2020-02-14 16:34:25,515 [lib.api.process] INFO: Successfully resumed process with pid 2360
2020-02-14 16:34:25,515 [root] INFO: Added new process to list with pid: 2360
2020-02-14 16:34:25,515 [root] DEBUG: Terminate processes on terminate_event disabled.
2020-02-14 16:34:25,515 [root] DEBUG: Capture of extracted payloads enabled.
2020-02-14 16:34:25,515 [root] DEBUG: Process dumps disabled.
2020-02-14 16:34:25,546 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-02-14 16:34:25,546 [root] INFO: Disabling sleep skipping.
2020-02-14 16:34:25,546 [root] INFO: Disabling sleep skipping.
2020-02-14 16:34:25,546 [root] INFO: Disabling sleep skipping.
2020-02-14 16:34:25,546 [root] INFO: Disabling sleep skipping.
2020-02-14 16:34:25,546 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 2360 at 0x6d010000, image base 0x400000, stack from 0x126000-0x130000
2020-02-14 16:34:25,546 [root] DEBUG: Commandline: C:\Users\Rebecca\AppData\Local\Temp\"C:\Users\Rebecca\AppData\Local\Temp\sh1.exe".
2020-02-14 16:34:25,546 [root] DEBUG: WoW64 not detected.
2020-02-14 16:34:25,546 [root] DEBUG: ExtractionInit: Debugger initialised.
2020-02-14 16:34:25,546 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00400000.
2020-02-14 16:34:25,562 [root] DEBUG: AddTrackedRegion: New region at 0x00400000 size 0x1000 added to tracked regions: EntryPoint 0x2fff0, Entropy 5.645682e+00
2020-02-14 16:34:25,562 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-02-14 16:34:25,562 [root] INFO: Monitor successfully loaded in process with pid 2360.
2020-02-14 16:34:47,703 [root] DEBUG: ProtectionHandler: Address 0x004AE140 already in tracked region at 0x00400000, size 0x1000
2020-02-14 16:34:47,703 [root] DEBUG: ProtectionHandler: Address: 0x004AE140 (alloc base 0x00400000), NumberOfBytesToProtect: 0x224a, NewAccessProtection: 0x40
2020-02-14 16:34:47,703 [root] DEBUG: ProtectionHandler: Increased region size at 0x004AE140 to 0xb038a.
2020-02-14 16:34:47,703 [root] DEBUG: ProtectionHandler: Updated region protection at 0x004AE140 to 0x40.
2020-02-14 16:34:47,703 [root] DEBUG: ProcessImageBase: EP 0x0002FFF0 image base 0x00400000 size 0x0 entropy 5.679500e+00.
2020-02-14 16:34:47,703 [root] DEBUG: Allocation: 0x003D0000 - 0x003D1000, size: 0x1000, protection: 0x40.
2020-02-14 16:34:47,703 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-02-14 16:34:47,703 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-02-14 16:34:47,703 [root] DEBUG: ProcessImageBase: EP 0x0002FFF0 image base 0x00400000 size 0x0 entropy 5.673607e+00.
2020-02-14 16:34:47,703 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x003D0000, size: 0x1000.
2020-02-14 16:34:47,703 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x003D0000.
2020-02-14 16:34:47,703 [root] DEBUG: AddTrackedRegion: New region at 0x003D0000 size 0x1000 added to tracked regions.
2020-02-14 16:34:47,703 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x003D0000, TrackedRegion->RegionSize: 0x1000, thread 2224
2020-02-14 16:34:47,703 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xbc, Size=0x2, Address=0x003D0000 and Type=0x1.
2020-02-14 16:34:47,717 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 2224 type 1 at address 0x003D0000, size 2 with Callback 0x6d017890.
2020-02-14 16:34:47,717 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x003D0000
2020-02-14 16:34:47,717 [root] DEBUG: SetDebugRegister: Setting breakpoint 1 hThread=0xbc, Size=0x4, Address=0x003D003C and Type=0x1.
2020-02-14 16:34:47,717 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 2224 type 1 at address 0x003D003C, size 4 with Callback 0x6d0174e0.
2020-02-14 16:34:47,717 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x003D003C
2020-02-14 16:34:47,717 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x003D0000 (size 0x1000).
2020-02-14 16:34:47,717 [root] DEBUG: DLL unloaded from 0x77CB0000.
2020-02-14 16:34:47,717 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x004AE721 (thread 2224)
2020-02-14 16:34:47,717 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x003D0000.
2020-02-14 16:34:47,717 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 2 within Context, Size=0x0, Address=0x003D0000 and Type=0x0.
2020-02-14 16:34:47,717 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x3d0000: 0x90.
2020-02-14 16:34:47,717 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-02-14 16:34:47,717 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x004AE721 (thread 2224)
2020-02-14 16:34:47,717 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x003D0000.
2020-02-14 16:34:47,717 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x003D0000 already exists for thread 2224 (process 2360), skipping.
2020-02-14 16:34:47,717 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x3d0000: 0x90.
2020-02-14 16:34:47,717 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-02-14 16:34:47,717 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x004AE721 (thread 2224)
2020-02-14 16:34:47,717 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x003D003C.
2020-02-14 16:34:47,717 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x2f000009 (at 0x003D003C).
2020-02-14 16:34:47,717 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x003D0000 already exists for thread 2224 (process 2360), skipping.
2020-02-14 16:34:47,717 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x003D0000.
2020-02-14 16:34:47,733 [root] DEBUG: set_caller_info: Adding region at 0x003D0000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-02-14 16:34:47,733 [root] DEBUG: DumpPEsInRange: Scanning range 0x3d0000 - 0x3d1000.
2020-02-14 16:34:47,733 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3d0000-0x3d1000.
2020-02-14 16:34:47,733 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x003D0000 - 0x003D1000.
2020-02-14 16:34:47,750 [root] DEBUG: set_caller_info: Adding region at 0x013D0000 to caller regions list (kernel32::GetSystemTime).
2020-02-14 16:34:47,750 [root] DEBUG: DLL loaded at 0x75920000: C:\Windows\system32\cryptbase (0xc000 bytes).
2020-02-14 16:34:47,765 [root] INFO: Added new CAPE file to list with path: C:\KYrDELgaq\CAPE\2360_116427694227562214522020
2020-02-14 16:34:47,765 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\KYrDELgaq\CAPE\2360_116427694227562214522020 (size 0x1000)
2020-02-14 16:34:47,780 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x003D0000.
2020-02-14 16:34:47,780 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x3d0000 - 0x3d1000.
2020-02-14 16:34:47,780 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x003D0000.
2020-02-14 16:34:47,780 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x003D003C.
2020-02-14 16:34:47,780 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 2 address 0x003D0000.
2020-02-14 16:34:47,780 [root] DEBUG: Allocation: 0x02AE0000 - 0x02B3F000, size: 0x5f000, protection: 0x40.
2020-02-14 16:34:47,780 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-02-14 16:34:47,780 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-02-14 16:34:47,780 [root] DEBUG: ProcessImageBase: EP 0x0002FFF0 image base 0x00400000 size 0x0 entropy 5.673615e+00.
2020-02-14 16:34:47,780 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-02-14 16:34:47,780 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x02AE0000, size: 0x5f000.
2020-02-14 16:34:47,780 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x02AE0000.
2020-02-14 16:34:47,780 [root] DEBUG: AddTrackedRegion: New region at 0x02AE0000 size 0x5f000 added to tracked regions.
2020-02-14 16:34:47,780 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x02AE0000, TrackedRegion->RegionSize: 0x5f000, thread 2224
2020-02-14 16:34:47,780 [root] DEBUG: ActivateBreakpoints: Switching breakpoints from region 0x003D0000 to 0x02AE0000.
2020-02-14 16:34:47,780 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xbc, Size=0x2, Address=0x02AE0000 and Type=0x1.
2020-02-14 16:34:47,780 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 2224 type 1 at address 0x02AE0000, size 2 with Callback 0x6d017890.
2020-02-14 16:34:47,780 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x02AE0000
2020-02-14 16:34:47,780 [root] DEBUG: SetDebugRegister: Setting breakpoint 1 hThread=0xbc, Size=0x4, Address=0x02AE003C and Type=0x1.
2020-02-14 16:34:47,780 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 2224 type 1 at address 0x02AE003C, size 4 with Callback 0x6d0174e0.
2020-02-14 16:34:47,780 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x02AE003C
2020-02-14 16:34:47,780 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x02AE0000 (size 0x5f000).
2020-02-14 16:34:47,780 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x003D029D (thread 2224)
2020-02-14 16:34:47,780 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x02AE0000.
2020-02-14 16:34:47,796 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 2 within Context, Size=0x0, Address=0x02AE0000 and Type=0x0.
2020-02-14 16:34:47,796 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x2ae0000: 0xf3.
2020-02-14 16:34:47,796 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-02-14 16:34:47,796 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x003D029D (thread 2224)
2020-02-14 16:34:47,796 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x02AE0000.
2020-02-14 16:34:47,796 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x02AE0000 already exists for thread 2224 (process 2360), skipping.
2020-02-14 16:34:47,796 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x2ae0000: 0xf3.
2020-02-14 16:34:47,796 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-02-14 16:34:47,796 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x003D029D (thread 2224)
2020-02-14 16:34:47,796 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x02AE003C.
2020-02-14 16:34:47,796 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x89008b8d (at 0x02AE003C).
2020-02-14 16:34:47,796 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x02AE0000 already exists for thread 2224 (process 2360), skipping.
2020-02-14 16:34:47,796 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x02AE0000.
2020-02-14 16:34:47,796 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x003D0385 (thread 2224)
2020-02-14 16:34:47,796 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x02AE0000.
2020-02-14 16:34:47,796 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x02AE0000 already exists for thread 2224 (process 2360), skipping.
2020-02-14 16:34:47,796 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x2ae0000: 0xf3.
2020-02-14 16:34:47,796 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-02-14 16:34:47,796 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x003D0385 (thread 2224)
2020-02-14 16:34:47,796 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x02AE0000.
2020-02-14 16:34:47,796 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x02AE0000 already exists for thread 2224 (process 2360), skipping.
2020-02-14 16:34:47,796 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x2ae0000: 0xf3.
2020-02-14 16:34:47,796 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-02-14 16:34:47,796 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x003D0385 (thread 2224)
2020-02-14 16:34:47,796 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x02AE003C.
2020-02-14 16:34:47,796 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x89008b7e (at 0x02AE003C).
2020-02-14 16:34:47,796 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x02AE0000 already exists for thread 2224 (process 2360), skipping.
2020-02-14 16:34:47,796 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x02AE0000.
2020-02-14 16:34:47,812 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x003D0385 (thread 2224)
2020-02-14 16:34:47,812 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x02AE003C.
2020-02-14 16:34:47,812 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x8900257e (at 0x02AE003C).
2020-02-14 16:34:47,812 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x02AE0000 already exists for thread 2224 (process 2360), skipping.
2020-02-14 16:34:47,812 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x02AE0000.
2020-02-14 16:34:47,812 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x003D0385 (thread 2224)
2020-02-14 16:34:47,812 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x02AE003C.
2020-02-14 16:34:47,812 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x894d257e (at 0x02AE003C).
2020-02-14 16:34:47,812 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x02AE0000 already exists for thread 2224 (process 2360), skipping.
2020-02-14 16:34:47,812 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x02AE0000.
2020-02-14 16:34:47,812 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x003D0385 (thread 2224)
2020-02-14 16:34:47,812 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x02AE003C.
2020-02-14 16:34:47,812 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x184d257e (at 0x02AE003C).
2020-02-14 16:34:47,812 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x02AE0000 already exists for thread 2224 (process 2360), skipping.
2020-02-14 16:34:47,812 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x02AE0000.
2020-02-14 16:34:47,812 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x003D02D5 (thread 2224)
2020-02-14 16:34:47,812 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x02AE0000.
2020-02-14 16:34:47,812 [root] DEBUG: BaseAddressWriteCallback: M written to first byte, awaiting next byte.
2020-02-14 16:34:47,812 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x003D02D5 (thread 2224)
2020-02-14 16:34:47,812 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x02AE0000.
2020-02-14 16:34:47,812 [root] DEBUG: BaseAddressWriteCallback: M written to first byte, awaiting next byte.
2020-02-14 16:34:47,812 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x003D02D5 (thread 2224)
2020-02-14 16:34:47,812 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x02AE003C.
2020-02-14 16:34:47,812 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x184d2565 (at 0x02AE003C).
2020-02-14 16:34:47,812 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x02AE0000 already exists for thread 2224 (process 2360), skipping.
2020-02-14 16:34:47,812 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x02AE0000.
2020-02-14 16:34:47,812 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x003D02D5 (thread 2224)
2020-02-14 16:34:47,812 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x02AE003C.
2020-02-14 16:34:47,812 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x184daf65 (at 0x02AE003C).
2020-02-14 16:34:47,812 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x02AE0000 already exists for thread 2224 (process 2360), skipping.
2020-02-14 16:34:47,828 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x02AE0000.
2020-02-14 16:34:47,828 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x003D02D5 (thread 2224)
2020-02-14 16:34:47,828 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x02AE003C.
2020-02-14 16:34:47,828 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x18cfaf65 (at 0x02AE003C).
2020-02-14 16:34:47,828 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x02AE0000 already exists for thread 2224 (process 2360), skipping.
2020-02-14 16:34:47,828 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x02AE0000.
2020-02-14 16:34:47,828 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x003D02D5 (thread 2224)
2020-02-14 16:34:47,828 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x02AE003C.
2020-02-14 16:34:47,828 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x75cfaf65 (at 0x02AE003C).
2020-02-14 16:34:47,828 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x02AE0000 already exists for thread 2224 (process 2360), skipping.
2020-02-14 16:34:47,828 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x02AE0000.
2020-02-14 16:34:47,828 [root] DEBUG: DLL loaded at 0x73B40000: C:\Windows\system32\SAMCLI (0xf000 bytes).
2020-02-14 16:34:47,828 [root] DEBUG: DLL loaded at 0x74780000: C:\Windows\system32\WKSCLI (0xf000 bytes).
2020-02-14 16:34:47,828 [root] DEBUG: DLL loaded at 0x74560000: C:\Windows\system32\NETAPI32 (0x11000 bytes).
2020-02-14 16:34:47,828 [root] DEBUG: DLL loaded at 0x74190000: C:\Windows\system32\netutils (0x9000 bytes).
2020-02-14 16:34:47,828 [root] DEBUG: DLL loaded at 0x75620000: C:\Windows\system32\srvcli (0x19000 bytes).
2020-02-14 16:34:47,842 [root] DEBUG: DLL loaded at 0x73EB0000: C:\Windows\system32\IPHLPAPI (0x1c000 bytes).
2020-02-14 16:34:47,842 [root] DEBUG: DLL loaded at 0x76180000: C:\Windows\system32\NSI (0x6000 bytes).
2020-02-14 16:34:47,842 [root] DEBUG: DLL loaded at 0x73E70000: C:\Windows\system32\WINNSI (0x7000 bytes).
2020-02-14 16:34:47,842 [root] DEBUG: DLL loaded at 0x76190000: C:\Windows\system32\WS2_32 (0x35000 bytes).
2020-02-14 16:34:47,842 [root] DEBUG: DLL loaded at 0x75C10000: C:\Windows\system32\CRYPT32 (0x122000 bytes).
2020-02-14 16:34:47,842 [root] DEBUG: DLL loaded at 0x75A30000: C:\Windows\system32\MSASN1 (0xc000 bytes).
2020-02-14 16:34:47,842 [root] DEBUG: DLL loaded at 0x74360000: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\gdiplus (0x192000 bytes).
2020-02-14 16:34:47,858 [root] DEBUG: DLL loaded at 0x72320000: C:\Windows\system32\MPR (0x12000 bytes).
2020-02-14 16:34:47,858 [root] DEBUG: ProtectionHandler: Address 0x00401000 already in tracked region at 0x00400000, size 0xb038a
2020-02-14 16:34:47,858 [root] DEBUG: ProtectionHandler: Address: 0x00401000 (alloc base 0x00400000), NumberOfBytesToProtect: 0x1f000, NewAccessProtection: 0x20
2020-02-14 16:34:47,858 [root] DEBUG: ProtectionHandler: Updated region protection at 0x00401000 to 0x20.
2020-02-14 16:34:47,858 [root] DEBUG: ProcessImageBase: EP 0x0001B2B0 image base 0x00400000 size 0x0 entropy 6.174613e+00.
2020-02-14 16:34:47,858 [root] DEBUG: ProcessImageBase: Modified entry point (0x0001B2B0) detected at image base 0x00400000 - dumping.
2020-02-14 16:34:47,858 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-02-14 16:34:47,858 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00400000.
2020-02-14 16:34:47,858 [root] DEBUG: DumpProcess: Module entry point VA is 0x0001B2B0.
2020-02-14 16:34:47,875 [root] INFO: Added new CAPE file to list with path: C:\KYrDELgaq\CAPE\2360_161666607347341514522020
2020-02-14 16:34:47,875 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x25a00.
2020-02-14 16:34:47,875 [root] DEBUG: FreeHandler: Address: 0x02AE0000.
2020-02-14 16:34:47,875 [root] DEBUG: DumpPEsInRange: Scanning range 0x2ae0000 - 0x2b3f000.
2020-02-14 16:34:47,875 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x2af2395
2020-02-14 16:34:47,875 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-02-14 16:34:47,875 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x02AF2395.
2020-02-14 16:34:47,875 [root] INFO: Added new CAPE file to list with path: C:\KYrDELgaq\CAPE\2360_160235557847341514522020
2020-02-14 16:34:47,875 [root] DEBUG: DumpPE: PE file in memory dumped successfully - dump size 0x25a00.
2020-02-14 16:34:47,890 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x2af3395-0x2b3f000.
2020-02-14 16:34:47,890 [root] DEBUG: DumpPEsInTrackedRegion: Dumped 1 PE image(s) from range 0x02AE0000 - 0x02B3F000.
2020-02-14 16:34:47,890 [root] DEBUG: FreeHandler: Found and dumped PE image(s) in range 0x02AE0000 - 0x02B3F000.
2020-02-14 16:34:47,890 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x2ae0000 - 0x2b3f000.
2020-02-14 16:34:47,890 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x02AE0000.
2020-02-14 16:34:47,890 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x02AE003C.
2020-02-14 16:34:47,890 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 2 address 0x02AE0000.
2020-02-14 16:34:47,890 [root] DEBUG: DropTrackedRegion: CurrentTrackedRegion 0x17cec48, AllocationBase 0x0.
2020-02-14 16:34:47,890 [root] DEBUG: DropTrackedRegion: CurrentTrackedRegion 0x17cecf0, AllocationBase 0x400000.
2020-02-14 16:34:47,890 [root] DEBUG: DropTrackedRegion: CurrentTrackedRegion 0x17cfd98, AllocationBase 0x3d0000.
2020-02-14 16:34:47,890 [root] DEBUG: DropTrackedRegion: CurrentTrackedRegion 0x17cfe78, AllocationBase 0x2ae0000.
2020-02-14 16:34:47,890 [root] DEBUG: DropTrackedRegion: removed pages 0x2ae0000-0x2b3f000 from the end of the tracked region list.
2020-02-14 16:34:48,092 [root] DEBUG: DLL loaded at 0x74270000: C:\Windows\system32\ntmarta (0x21000 bytes).
2020-02-14 16:34:48,092 [root] DEBUG: DLL loaded at 0x760C0000: C:\Windows\system32\WLDAP32 (0x45000 bytes).
2020-02-14 16:34:48,092 [root] DEBUG: DLL loaded at 0x75540000: C:\Windows\system32\bcrypt (0x17000 bytes).
2020-02-14 16:34:48,092 [root] DEBUG: DLL loaded at 0x754C0000: C:\Windows\system32\bcryptprimitives (0x3d000 bytes).
2020-02-14 16:34:48,421 [root] DEBUG: DLL loaded at 0x74610000: C:\Windows\system32\PROPSYS (0xf5000 bytes).
2020-02-14 16:34:48,530 [root] DEBUG: DLL loaded at 0x74950000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32 (0x19e000 bytes).
2020-02-14 16:34:48,640 [root] DEBUG: DLL loaded at 0x758D0000: C:\Windows\system32\apphelp (0x4c000 bytes).
2020-02-14 16:34:48,750 [root] DEBUG: DLL loaded at 0x75D70000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2020-02-14 16:34:48,828 [root] DEBUG: DLL loaded at 0x6EE80000: C:\Windows\System32\ieframe (0xd12000 bytes).
2020-02-14 16:34:48,828 [root] DEBUG: DLL loaded at 0x75C00000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes).
2020-02-14 16:34:48,828 [root] DEBUG: DLL loaded at 0x75D50000: C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0 (0x4000 bytes).
2020-02-14 16:34:48,828 [root] DEBUG: DLL loaded at 0x75A60000: C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes).
2020-02-14 16:34:48,828 [root] DEBUG: DLL loaded at 0x6EAF0000: C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0 (0x4000 bytes).
2020-02-14 16:34:48,842 [root] DEBUG: DLL loaded at 0x75D40000: C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes).
2020-02-14 16:34:48,842 [root] DEBUG: DLL loaded at 0x74EC0000: C:\Windows\system32\version (0x9000 bytes).
2020-02-14 16:34:48,842 [root] DEBUG: DLL loaded at 0x75A50000: C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes).
2020-02-14 16:34:48,842 [root] DEBUG: DLL loaded at 0x75D60000: C:\Windows\system32\normaliz (0x3000 bytes).
2020-02-14 16:34:48,842 [root] DEBUG: DLL loaded at 0x76660000: C:\Windows\system32\iertutil (0x236000 bytes).
2020-02-14 16:34:48,842 [root] DEBUG: DLL loaded at 0x73BA0000: C:\Windows\System32\WINHTTP (0x58000 bytes).
2020-02-14 16:34:48,842 [root] DEBUG: DLL loaded at 0x73780000: C:\Windows\System32\webio (0x50000 bytes).
2020-02-14 16:34:48,842 [root] DEBUG: DLL unloaded from 0x77E50000.
2020-02-14 16:34:49,280 [root] DEBUG: DLL loaded at 0x762C0000: C:\Windows\system32\SETUPAPI (0x19d000 bytes).
2020-02-14 16:34:49,280 [root] DEBUG: DLL loaded at 0x75BD0000: C:\Windows\system32\CFGMGR32 (0x27000 bytes).
2020-02-14 16:34:49,280 [root] DEBUG: DLL loaded at 0x75AC0000: C:\Windows\system32\DEVOBJ (0x12000 bytes).
2020-02-14 16:34:49,280 [root] DEBUG: DLL loaded at 0x71D20000: C:\Windows\system32\cscapi (0xb000 bytes).
2020-02-14 16:34:49,280 [root] DEBUG: DLL loaded at 0x75A40000: C:\Windows\system32\profapi (0xb000 bytes).
2020-02-14 16:34:49,296 [root] DEBUG: DLL loaded at 0x76970000: C:\Windows\system32\urlmon (0x150000 bytes).
2020-02-14 16:34:49,296 [root] DEBUG: DLL loaded at 0x75B30000: C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0 (0x4000 bytes).
2020-02-14 16:34:49,342 [root] DEBUG: DLL loaded at 0x76C20000: C:\Windows\system32\WININET (0x437000 bytes).
2020-02-14 16:34:49,342 [root] DEBUG: DLL loaded at 0x75AE0000: C:\Windows\system32\USERENV (0x17000 bytes).
2020-02-14 16:34:49,342 [root] DEBUG: DLL loaded at 0x756B0000: C:\Windows\system32\Secur32 (0x8000 bytes).
2020-02-14 16:34:49,375 [root] INFO: Announced 32-bit process name: cmd.exe pid: 3740
2020-02-14 16:34:49,375 [root] DEBUG: DLL unloaded from 0x77060000.
2020-02-14 16:34:49,375 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-02-14 16:34:49,375 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-02-14 16:34:49,375 [lib.api.process] INFO: 32-bit DLL to inject is C:\inqczlrb\dll\OQecjSq.dll, loader C:\inqczlrb\bin\sUENDCm.exe
2020-02-14 16:34:49,390 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xwiEBcIMA.
2020-02-14 16:34:49,390 [root] DEBUG: DLL loaded at 0x74940000: C:\Windows\System32\drprov (0x8000 bytes).
2020-02-14 16:34:49,390 [root] DEBUG: Loader: Injecting process 3740 (thread 3836) with C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:34:49,390 [root] DEBUG: DLL loaded at 0x759A0000: C:\Windows\System32\WINSTA (0x29000 bytes).
2020-02-14 16:34:49,390 [root] DEBUG: Process image base: 0x4A710000
2020-02-14 16:34:49,390 [root] DEBUG: DLL loaded at 0x72A80000: C:\Windows\System32\ntlanman (0x14000 bytes).
2020-02-14 16:34:49,390 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:34:49,390 [root] DEBUG: DLL loaded at 0x72A60000: C:\Windows\System32\davclnt (0x18000 bytes).
2020-02-14 16:34:49,390 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-02-14 16:34:49,390 [root] DEBUG: DLL loaded at 0x74930000: C:\Windows\System32\DAVHLPR (0x8000 bytes).
2020-02-14 16:34:49,405 [root] DEBUG: Successfully injected DLL C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:34:49,405 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3740
2020-02-14 16:34:49,405 [root] INFO: Announced 32-bit process name: cmd.exe pid: 3740
2020-02-14 16:34:49,405 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-02-14 16:34:49,405 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-02-14 16:34:49,405 [lib.api.process] INFO: 32-bit DLL to inject is C:\inqczlrb\dll\OQecjSq.dll, loader C:\inqczlrb\bin\sUENDCm.exe
2020-02-14 16:34:49,453 [root] DEBUG: DLL unloaded from 0x74940000.
2020-02-14 16:34:49,467 [root] DEBUG: DLL unloaded from 0x72A60000.
2020-02-14 16:34:49,467 [root] DEBUG: DLL unloaded from 0x72A80000.
2020-02-14 16:34:49,467 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xwiEBcIMA.
2020-02-14 16:34:49,467 [root] DEBUG: DLL loaded at 0x72780000: C:\Windows\system32\browcli (0xd000 bytes).
2020-02-14 16:34:49,467 [root] DEBUG: Loader: Injecting process 3740 (thread 3836) with C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:34:49,467 [root] DEBUG: Process image base: 0x4A710000
2020-02-14 16:34:49,467 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:34:49,483 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-02-14 16:34:49,483 [root] DEBUG: Successfully injected DLL C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:34:49,483 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3740
2020-02-14 16:34:49,500 [root] DEBUG: DLL loaded at 0x72770000: C:\Windows\system32\sfc (0x3000 bytes).
2020-02-14 16:34:49,500 [root] DEBUG: DLL loaded at 0x72760000: C:\Windows\system32\sfc_os (0xd000 bytes).
2020-02-14 16:34:49,625 [root] WARNING: File at path "C:\Program Files\7-Zip\7-zip.chm" does not exist, skip.
2020-02-14 16:34:49,703 [root] WARNING: File at path "C:\Program Files\7-Zip\7z.sfx" does not exist, skip.
2020-02-14 16:34:49,703 [root] DEBUG: DLL unloaded from 0x72770000.
2020-02-14 16:34:49,733 [root] WARNING: File at path "C:\Program Files\7-Zip\7zCon.sfx" does not exist, skip.
2020-02-14 16:34:49,733 [root] WARNING: File at path "C:\Program Files\7-Zip\descript.ion" does not exist, skip.
2020-02-14 16:34:49,733 [root] DEBUG: DLL unloaded from 0x6EE80000.
2020-02-14 16:34:49,750 [root] WARNING: Unable to access file at path "C:\Program Files\7-Zip\History.txt.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\7-Zip\\History.txt.lockbit'
2020-02-14 16:34:49,750 [root] DEBUG: Terminate processes on terminate_event disabled.
2020-02-14 16:34:49,750 [root] DEBUG: DLL unloaded from 0x75EB0000.
2020-02-14 16:34:49,750 [root] DEBUG: Capture of extracted payloads enabled.
2020-02-14 16:34:49,750 [root] DEBUG: Process dumps disabled.
2020-02-14 16:34:49,750 [root] INFO: Disabling sleep skipping.
2020-02-14 16:34:49,765 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-02-14 16:34:49,765 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 3740 at 0x6d010000, image base 0x4a710000, stack from 0x103000-0x200000
2020-02-14 16:34:49,765 [root] DEBUG: Commandline: C:\Users\Rebecca\AppData\Local\Temp\"C:\Windows\System32\cmd.exe" \c vssadmin delete shadows \all \quiet & wmic shadowcopy delete & bcdedit \set {default} bootstatuspolicy ignoreallfailures & bcdedit \set {default} recoveryenabled no & wbad
2020-02-14 16:34:49,765 [root] DEBUG: WoW64 not detected.
2020-02-14 16:34:49,765 [root] DEBUG: ExtractionInit: Debugger initialised.
2020-02-14 16:34:49,765 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x4A710000.
2020-02-14 16:34:49,780 [root] DEBUG: DLL unloaded from 0x77060000.
2020-02-14 16:34:49,796 [root] DEBUG: AddTrackedRegion: New region at 0x4A710000 size 0x1000 added to tracked regions: EntryPoint 0x829a, Entropy 4.490263e+00
2020-02-14 16:34:49,812 [root] WARNING: File at path "C:\Program Files\7-Zip\History.txt" does not exist, skip.
2020-02-14 16:34:49,812 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\af.txt" does not exist, skip.
2020-02-14 16:34:49,828 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\an.txt" does not exist, skip.
2020-02-14 16:34:49,828 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-02-14 16:34:49,842 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\ar.txt" does not exist, skip.
2020-02-14 16:34:49,842 [root] INFO: Added new process to list with pid: 3740
2020-02-14 16:34:49,842 [root] INFO: Monitor successfully loaded in process with pid 3740.
2020-02-14 16:34:49,842 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\ast.txt" does not exist, skip.
2020-02-14 16:34:49,875 [root] INFO: Announced 32-bit process name: vssadmin.exe pid: 2028
2020-02-14 16:34:49,875 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\az.txt" does not exist, skip.
2020-02-14 16:34:49,875 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\ba.txt" does not exist, skip.
2020-02-14 16:34:49,875 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-02-14 16:34:49,875 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-02-14 16:34:49,875 [lib.api.process] INFO: 32-bit DLL to inject is C:\inqczlrb\dll\OQecjSq.dll, loader C:\inqczlrb\bin\sUENDCm.exe
2020-02-14 16:34:49,890 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\be.txt" does not exist, skip.
2020-02-14 16:34:49,905 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\bg.txt" does not exist, skip.
2020-02-14 16:34:49,921 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\bn.txt" does not exist, skip.
2020-02-14 16:34:49,921 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xwiEBcIMA.
2020-02-14 16:34:49,921 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\br.txt" does not exist, skip.
2020-02-14 16:34:49,921 [root] DEBUG: Loader: Injecting process 2028 (thread 4048) with C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:34:49,921 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\ca.txt" does not exist, skip.
2020-02-14 16:34:49,937 [root] DEBUG: Process image base: 0x002F0000
2020-02-14 16:34:49,953 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\co.txt" does not exist, skip.
2020-02-14 16:34:49,953 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:34:49,953 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\cs.txt" does not exist, skip.
2020-02-14 16:34:49,953 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-02-14 16:34:49,967 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\cy.txt" does not exist, skip.
2020-02-14 16:34:49,967 [root] DEBUG: Successfully injected DLL C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:34:49,983 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\da.txt" does not exist, skip.
2020-02-14 16:34:49,983 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2028
2020-02-14 16:34:50,000 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\de.txt" does not exist, skip.
2020-02-14 16:34:50,000 [root] DEBUG: DLL loaded at 0x758D0000: C:\Windows\system32\apphelp (0x4c000 bytes).
2020-02-14 16:34:50,015 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\el.txt" does not exist, skip.
2020-02-14 16:34:50,078 [root] INFO: Announced 32-bit process name: vssadmin.exe pid: 2028
2020-02-14 16:34:50,078 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-02-14 16:34:50,078 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-02-14 16:34:50,078 [lib.api.process] INFO: 32-bit DLL to inject is C:\inqczlrb\dll\OQecjSq.dll, loader C:\inqczlrb\bin\sUENDCm.exe
2020-02-14 16:34:50,078 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\en.ttt" does not exist, skip.
2020-02-14 16:34:50,092 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xwiEBcIMA.
2020-02-14 16:34:50,092 [root] DEBUG: Loader: Injecting process 2028 (thread 4048) with C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:34:50,092 [root] DEBUG: Process image base: 0x002F0000
2020-02-14 16:34:50,092 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:34:50,092 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-02-14 16:34:50,092 [root] DEBUG: Successfully injected DLL C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:34:50,092 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2028
2020-02-14 16:34:50,171 [root] WARNING: Unable to access file at path "C:\Program Files\7-Zip\Lang\eo.txt.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\7-Zip\\Lang\\eo.txt.lockbit'
2020-02-14 16:34:50,187 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\eo.txt" does not exist, skip.
2020-02-14 16:34:50,187 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\es.txt" does not exist, skip.
2020-02-14 16:34:50,187 [root] DEBUG: Terminate processes on terminate_event disabled.
2020-02-14 16:34:50,187 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\et.txt" does not exist, skip.
2020-02-14 16:34:50,203 [root] DEBUG: Capture of extracted payloads enabled.
2020-02-14 16:34:50,217 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\eu.txt" does not exist, skip.
2020-02-14 16:34:50,217 [root] DEBUG: Process dumps disabled.
2020-02-14 16:34:50,233 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\ext.txt" does not exist, skip.
2020-02-14 16:34:50,233 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\fa.txt" does not exist, skip.
2020-02-14 16:34:50,233 [root] INFO: Disabling sleep skipping.
2020-02-14 16:34:50,265 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\fi.txt" does not exist, skip.
2020-02-14 16:34:50,265 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-02-14 16:34:50,265 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\fr.txt" does not exist, skip.
2020-02-14 16:34:50,265 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 2028 at 0x6d010000, image base 0x2f0000, stack from 0x146000-0x150000
2020-02-14 16:34:50,265 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\fur.txt" does not exist, skip.
2020-02-14 16:34:50,280 [root] DEBUG: Commandline: C:\Users\Rebecca\AppData\Local\Temp\vssadmin  delete shadows \all \quiet.
2020-02-14 16:34:50,280 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\fy.txt" does not exist, skip.
2020-02-14 16:34:50,296 [root] DEBUG: WoW64 not detected.
2020-02-14 16:34:50,296 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\ga.txt" does not exist, skip.
2020-02-14 16:34:50,296 [root] DEBUG: ExtractionInit: Debugger initialised.
2020-02-14 16:34:50,312 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\gl.txt" does not exist, skip.
2020-02-14 16:34:50,312 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x002F0000.
2020-02-14 16:34:50,328 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\gu.txt" does not exist, skip.
2020-02-14 16:34:50,328 [root] DEBUG: AddTrackedRegion: New region at 0x002F0000 size 0x1000 added to tracked regions: EntryPoint 0x11f03, Entropy 5.420615e+00
2020-02-14 16:34:50,328 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\he.txt" does not exist, skip.
2020-02-14 16:34:50,328 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-02-14 16:34:50,342 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\hi.txt" does not exist, skip.
2020-02-14 16:34:50,342 [root] INFO: Added new process to list with pid: 2028
2020-02-14 16:34:50,342 [root] INFO: Monitor successfully loaded in process with pid 2028.
2020-02-14 16:34:50,342 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\hr.txt" does not exist, skip.
2020-02-14 16:34:50,358 [root] DEBUG: DLL loaded at 0x75920000: C:\Windows\system32\CRYPTBASE (0xc000 bytes).
2020-02-14 16:34:50,375 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\hu.txt" does not exist, skip.
2020-02-14 16:34:50,390 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\hy.txt" does not exist, skip.
2020-02-14 16:34:50,390 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\id.txt" does not exist, skip.
2020-02-14 16:34:50,405 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\io.txt" does not exist, skip.
2020-02-14 16:34:50,405 [root] DEBUG: DLL loaded at 0x75D70000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2020-02-14 16:34:50,421 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\is.txt" does not exist, skip.
2020-02-14 16:34:50,421 [root] DEBUG: DLL loaded at 0x753F0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-02-14 16:34:50,437 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\it.txt" does not exist, skip.
2020-02-14 16:34:50,437 [root] DEBUG: DLL loaded at 0x75180000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-02-14 16:34:50,437 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\ja.txt" does not exist, skip.
2020-02-14 16:34:50,437 [root] DEBUG: DLL loaded at 0x75990000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-02-14 16:34:50,467 [root] WARNING: Unable to access file at path "C:\Program Files\7-Zip\Lang\ka.txt.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\7-Zip\\Lang\\ka.txt.lockbit'
2020-02-14 16:34:50,483 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\ka.txt" does not exist, skip.
2020-02-14 16:34:50,483 [root] WARNING: Unable to access file at path "C:\Program Files\7-Zip\Lang\kaa.txt.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\7-Zip\\Lang\\kaa.txt.lockbit'
2020-02-14 16:34:50,500 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\kaa.txt" does not exist, skip.
2020-02-14 16:34:50,500 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\kab.txt" does not exist, skip.
2020-02-14 16:34:50,515 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\kk.txt" does not exist, skip.
2020-02-14 16:34:50,530 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\ko.txt" does not exist, skip.
2020-02-14 16:34:50,546 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\ku-ckb.txt" does not exist, skip.
2020-02-14 16:34:50,562 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\ku.txt" does not exist, skip.
2020-02-14 16:34:50,592 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\ky.txt" does not exist, skip.
2020-02-14 16:34:50,608 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\lij.txt" does not exist, skip.
2020-02-14 16:34:50,625 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\lt.txt" does not exist, skip.
2020-02-14 16:34:50,640 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\lv.txt" does not exist, skip.
2020-02-14 16:34:50,655 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\mk.txt" does not exist, skip.
2020-02-14 16:34:50,655 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\mn.txt" does not exist, skip.
2020-02-14 16:34:50,671 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\mng.txt" does not exist, skip.
2020-02-14 16:34:50,687 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\mng2.txt" does not exist, skip.
2020-02-14 16:34:50,717 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\mr.txt" does not exist, skip.
2020-02-14 16:34:50,717 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\ms.txt" does not exist, skip.
2020-02-14 16:34:50,733 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\nb.txt" does not exist, skip.
2020-02-14 16:34:50,750 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\ne.txt" does not exist, skip.
2020-02-14 16:34:50,750 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\nl.txt" does not exist, skip.
2020-02-14 16:34:50,765 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\nn.txt" does not exist, skip.
2020-02-14 16:34:50,780 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\pa-in.txt" does not exist, skip.
2020-02-14 16:34:50,796 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\pl.txt" does not exist, skip.
2020-02-14 16:34:50,796 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\ps.txt" does not exist, skip.
2020-02-14 16:34:50,828 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\pt.txt" does not exist, skip.
2020-02-14 16:34:50,842 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\ro.txt" does not exist, skip.
2020-02-14 16:34:50,842 [root] DEBUG: DLL loaded at 0x6D730000: C:\Windows\system32\vss_ps (0xa000 bytes).
2020-02-14 16:34:50,858 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\ru.txt" does not exist, skip.
2020-02-14 16:34:50,890 [root] WARNING: Unable to access file at path "C:\Program Files\7-Zip\Lang\sa.txt.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\7-Zip\\Lang\\sa.txt.lockbit'
2020-02-14 16:34:50,890 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\sa.txt" does not exist, skip.
2020-02-14 16:34:50,921 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\si.txt" does not exist, skip.
2020-02-14 16:34:50,921 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\sk.txt" does not exist, skip.
2020-02-14 16:34:50,937 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\sl.txt" does not exist, skip.
2020-02-14 16:34:50,937 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\sq.txt" does not exist, skip.
2020-02-14 16:34:50,953 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\sr-spc.txt" does not exist, skip.
2020-02-14 16:34:50,983 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\sr-spl.txt" does not exist, skip.
2020-02-14 16:34:50,983 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\sv.txt" does not exist, skip.
2020-02-14 16:34:51,015 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\ta.txt" does not exist, skip.
2020-02-14 16:34:51,015 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\th.txt" does not exist, skip.
2020-02-14 16:34:51,030 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\tr.txt" does not exist, skip.
2020-02-14 16:34:51,155 [root] WARNING: Unable to access file at path "C:\Program Files\7-Zip\Lang\tt.txt.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\7-Zip\\Lang\\tt.txt.lockbit'
2020-02-14 16:34:51,171 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\tt.txt" does not exist, skip.
2020-02-14 16:34:51,171 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\ug.txt" does not exist, skip.
2020-02-14 16:34:51,217 [root] WARNING: Unable to access file at path "C:\Program Files\7-Zip\Lang\uk.txt.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\7-Zip\\Lang\\uk.txt.lockbit'
2020-02-14 16:34:51,217 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\uk.txt" does not exist, skip.
2020-02-14 16:34:51,296 [root] WARNING: Unable to access file at path "C:\Program Files\7-Zip\Lang\uz.txt.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\7-Zip\\Lang\\uz.txt.lockbit'
2020-02-14 16:34:51,296 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\uz.txt" does not exist, skip.
2020-02-14 16:34:51,515 [root] WARNING: Unable to access file at path "C:\Program Files\7-Zip\Lang\va.txt.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\7-Zip\\Lang\\va.txt.lockbit'
2020-02-14 16:34:51,515 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\va.txt" does not exist, skip.
2020-02-14 16:34:51,671 [root] WARNING: Unable to access file at path "C:\Program Files\7-Zip\Lang\vi.txt.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\7-Zip\\Lang\\vi.txt.lockbit'
2020-02-14 16:34:51,671 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\vi.txt" does not exist, skip.
2020-02-14 16:34:51,703 [root] WARNING: Unable to access file at path "C:\Program Files\7-Zip\Lang\yo.txt.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\7-Zip\\Lang\\yo.txt.lockbit'
2020-02-14 16:34:51,703 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\yo.txt" does not exist, skip.
2020-02-14 16:34:51,750 [root] WARNING: Unable to access file at path "C:\Program Files\7-Zip\Lang\zh-cn.txt.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\7-Zip\\Lang\\zh-cn.txt.lockbit'
2020-02-14 16:34:51,750 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\zh-cn.txt" does not exist, skip.
2020-02-14 16:34:51,765 [root] WARNING: Unable to access file at path "C:\Program Files\7-Zip\Lang\zh-tw.txt.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\7-Zip\\Lang\\zh-tw.txt.lockbit'
2020-02-14 16:34:51,765 [root] WARNING: File at path "C:\Program Files\7-Zip\Lang\zh-tw.txt" does not exist, skip.
2020-02-14 16:34:51,780 [root] WARNING: File at path "C:\Program Files\7-Zip\License.txt" does not exist, skip.
2020-02-14 16:34:51,828 [root] WARNING: File at path "C:\Program Files\7-Zip\readme.txt" does not exist, skip.
2020-02-14 16:34:52,592 [root] WARNING: Unable to access file at path "C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\cef.pak.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\Adobe\\Reader 11.0\\Reader\\AcroExt\\cef.pak.lockbit'
2020-02-14 16:34:52,717 [root] DEBUG: DLL unloaded from 0x76970000.
2020-02-14 16:34:52,733 [root] DEBUG: DLL unloaded from 0x74610000.
2020-02-14 16:34:52,921 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\cef.pak" does not exist, skip.
2020-02-14 16:34:52,967 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\locales\en-US.pak" does not exist, skip.
2020-02-14 16:34:53,546 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\cryptocme.sig" does not exist, skip.
2020-02-14 16:34:53,546 [root] DEBUG: DLL unloaded from 0x6D730000.
2020-02-14 16:34:53,546 [root] DEBUG: NtTerminateProcess hook: Processing tracked regions before shutdown (process 2028).
2020-02-14 16:34:53,546 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-02-14 16:34:53,546 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x002F0000.
2020-02-14 16:34:53,546 [root] DEBUG: ProcessImageBase: EP 0x00011F03 image base 0x002F0000 size 0x0 entropy 5.421421e+00.
2020-02-14 16:34:53,578 [root] DEBUG: DLL unloaded from 0x762A0000.
2020-02-14 16:34:53,578 [root] DEBUG: NtTerminateProcess hook: Processing tracked regions before shutdown (process 2028).
2020-02-14 16:34:53,578 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-02-14 16:34:53,592 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x002F0000.
2020-02-14 16:34:53,592 [root] DEBUG: ProcessImageBase: EP 0x00011F03 image base 0x002F0000 size 0x0 entropy 5.421421e+00.
2020-02-14 16:34:53,592 [root] INFO: Notified of termination of process with pid 2028.
2020-02-14 16:34:53,765 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\ENU\AdobeID.pdf" does not exist, skip.
2020-02-14 16:34:53,765 [root] INFO: Announced 32-bit process name: WMIC.exe pid: 3184
2020-02-14 16:34:53,812 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\ENU\DefaultID.pdf" does not exist, skip.
2020-02-14 16:34:53,812 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-02-14 16:34:53,812 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-02-14 16:34:53,812 [lib.api.process] INFO: 32-bit DLL to inject is C:\inqczlrb\dll\OQecjSq.dll, loader C:\inqczlrb\bin\sUENDCm.exe
2020-02-14 16:34:53,875 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Legal\ENU\license.html" does not exist, skip.
2020-02-14 16:34:53,937 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\PDFSigQFormalRep.pdf" does not exist, skip.
2020-02-14 16:34:53,983 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xwiEBcIMA.
2020-02-14 16:34:54,046 [root] DEBUG: Loader: Injecting process 3184 (thread 3080) with C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:34:54,046 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Accessibility.api" does not exist, skip.
2020-02-14 16:34:54,092 [root] DEBUG: Process image base: 0x00370000
2020-02-14 16:34:54,140 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:34:54,421 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-02-14 16:34:54,421 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\AcroForm\adobepdf.xdc" does not exist, skip.
2020-02-14 16:34:54,467 [root] DEBUG: Successfully injected DLL C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:34:54,515 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3184
2020-02-14 16:34:54,562 [root] INFO: Announced 32-bit process name: WMIC.exe pid: 3184
2020-02-14 16:34:55,203 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-02-14 16:34:55,203 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-02-14 16:34:55,203 [lib.api.process] INFO: 32-bit DLL to inject is C:\inqczlrb\dll\OQecjSq.dll, loader C:\inqczlrb\bin\sUENDCm.exe
2020-02-14 16:34:55,312 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xwiEBcIMA.
2020-02-14 16:34:55,358 [root] DEBUG: Loader: Injecting process 3184 (thread 3080) with C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:34:55,405 [root] DEBUG: Process image base: 0x00370000
2020-02-14 16:34:55,453 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:34:55,483 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-02-14 16:34:55,530 [root] DEBUG: Successfully injected DLL C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:34:55,530 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3184
2020-02-14 16:34:55,608 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp" does not exist, skip.
2020-02-14 16:34:55,828 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp" does not exist, skip.
2020-02-14 16:34:56,280 [root] DEBUG: Terminate processes on terminate_event disabled.
2020-02-14 16:34:56,328 [root] DEBUG: Capture of extracted payloads enabled.
2020-02-14 16:34:56,375 [root] DEBUG: Process dumps disabled.
2020-02-14 16:34:56,467 [root] INFO: Disabling sleep skipping.
2020-02-14 16:34:56,467 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\AcroForm\PMP\QRCode.pmp" does not exist, skip.
2020-02-14 16:34:56,515 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-02-14 16:34:56,562 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 3184 at 0x6d010000, image base 0x370000, stack from 0x176000-0x180000
2020-02-14 16:34:56,608 [root] DEBUG: Commandline: C:\Users\Rebecca\AppData\Local\Temp\wmic  shadowcopy delete.
2020-02-14 16:34:56,655 [root] DEBUG: WoW64 not detected.
2020-02-14 16:34:56,687 [root] DEBUG: ExtractionInit: Debugger initialised.
2020-02-14 16:34:56,750 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00370000.
2020-02-14 16:34:56,750 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\AcroForm.api" does not exist, skip.
2020-02-14 16:34:56,905 [lib.common.results] ERROR: Exception uploading file C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\AcroForm.api.lockbit to host: [Errno 10053] An established connection was aborted by the software in your host machine
2020-02-14 16:34:56,905 [root] DEBUG: AddTrackedRegion: New region at 0x00370000 size 0x1000 added to tracked regions: EntryPoint 0x3d81a, Entropy 6.430643e+00
2020-02-14 16:34:56,967 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-02-14 16:34:57,000 [root] INFO: Added new process to list with pid: 3184
2020-02-14 16:34:57,000 [root] INFO: Monitor successfully loaded in process with pid 3184.
2020-02-14 16:34:57,046 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf" does not exist, skip.
2020-02-14 16:34:57,046 [root] DEBUG: DLL loaded at 0x75920000: C:\Windows\system32\CRYPTBASE (0xc000 bytes).
2020-02-14 16:34:57,092 [root] WARNING: Unable to access file at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf.lockbit'
2020-02-14 16:34:57,140 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf" does not exist, skip.
2020-02-14 16:34:57,140 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf" does not exist, skip.
2020-02-14 16:34:57,717 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\Words.pdf" does not exist, skip.
2020-02-14 16:34:57,765 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annots.api" does not exist, skip.
2020-02-14 16:34:58,155 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Checkers.api" does not exist, skip.
2020-02-14 16:34:58,967 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\DigSig.api" does not exist, skip.
2020-02-14 16:34:59,078 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\DVA.api" does not exist, skip.
2020-02-14 16:34:59,140 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\eBook.api" does not exist, skip.
2020-02-14 16:34:59,203 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\EScript.api" does not exist, skip.
2020-02-14 16:34:59,280 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\IA32.api" does not exist, skip.
2020-02-14 16:34:59,342 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\MakeAccessible.api" does not exist, skip.
2020-02-14 16:34:59,483 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Multimedia\MPP\Flash.mpp" does not exist, skip.
2020-02-14 16:34:59,483 [root] DEBUG: DLL loaded at 0x73B20000: C:\Windows\system32\dhcpcsvc (0x12000 bytes).
2020-02-14 16:34:59,562 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp" does not exist, skip.
2020-02-14 16:34:59,608 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp" does not exist, skip.
2020-02-14 16:34:59,671 [root] DEBUG: DLL loaded at 0x753B0000: C:\Windows\system32\mswsock (0x3c000 bytes).
2020-02-14 16:34:59,717 [root] DEBUG: DLL loaded at 0x74F50000: C:\Windows\System32\wshtcpip (0x5000 bytes).
2020-02-14 16:34:59,765 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Multimedia\MPP\WindowsMedia.mpp" does not exist, skip.
2020-02-14 16:34:59,828 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Multimedia.api" does not exist, skip.
2020-02-14 16:34:59,921 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\PDDom.api" does not exist, skip.
2020-02-14 16:35:00,015 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\PPKLite.api" does not exist, skip.
2020-02-14 16:35:00,750 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\ReadOutLoud.api" does not exist, skip.
2020-02-14 16:35:00,750 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\reflow.api" does not exist, skip.
2020-02-14 16:35:00,812 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\SaveAsRTF.api" does not exist, skip.
2020-02-14 16:35:00,875 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Search.api" does not exist, skip.
2020-02-14 16:35:00,937 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\SendMail.api" does not exist, skip.
2020-02-14 16:35:01,000 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Spelling.api" does not exist, skip.
2020-02-14 16:35:01,062 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Updater.api" does not exist, skip.
2020-02-14 16:35:01,125 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\weblink.api" does not exist, skip.
2020-02-14 16:35:01,233 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins3d\2d.x3d" does not exist, skip.
2020-02-14 16:35:01,296 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins3d\3difr.x3d" does not exist, skip.
2020-02-14 16:35:01,296 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins3d\drvDX9.x3d" does not exist, skip.
2020-02-14 16:35:01,358 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins3d\drvSOFT.x3d" does not exist, skip.
2020-02-14 16:35:01,421 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins3d\prc\MyriadCAD.otf" does not exist, skip.
2020-02-14 16:35:01,467 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins3d\prcr.x3d" does not exist, skip.
2020-02-14 16:35:01,546 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins3d\tesselate.x3d" does not exist, skip.
2020-02-14 16:35:01,592 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\pmd.cer" does not exist, skip.
2020-02-14 16:35:01,640 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\RTC.der" does not exist, skip.
2020-02-14 16:35:01,703 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Services\DEXEchoSign.spi" does not exist, skip.
2020-02-14 16:35:01,858 [root] DEBUG: DLL unloaded from 0x72A80000.
2020-02-14 16:35:02,140 [root] WARNING: Unable to access file at path "C:\Program Files\Adobe\Reader 11.0\Reader\Services\DEXShare.spi.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\Adobe\\Reader 11.0\\Reader\\Services\\DEXShare.spi.lockbit'
2020-02-14 16:35:02,203 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Services\DEXShare.spi" does not exist, skip.
2020-02-14 16:35:02,500 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Services\files.acx" does not exist, skip.
2020-02-14 16:35:02,733 [root] DEBUG: DLL loaded at 0x73BA0000: C:\Windows\system32\WINHTTP (0x58000 bytes).
2020-02-14 16:35:02,733 [root] WARNING: Unable to access file at path "C:\Program Files\Adobe\Reader 11.0\Reader\Services\Services.cfg.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\Adobe\\Reader 11.0\\Reader\\Services\\Services.cfg.lockbit'
2020-02-14 16:35:02,780 [root] DEBUG: DLL loaded at 0x73780000: C:\Windows\system32\webio (0x50000 bytes).
2020-02-14 16:35:02,828 [root] DEBUG: DLL unloaded from 0x75EB0000.
2020-02-14 16:35:02,875 [root] DEBUG: DLL loaded at 0x753F0000: C:\Windows\system32\cryptsp (0x17000 bytes).
2020-02-14 16:35:02,921 [root] DEBUG: DLL loaded at 0x750C0000: C:\Windows\system32\credssp (0x8000 bytes).
2020-02-14 16:35:02,967 [root] DEBUG: DLL unloaded from 0x753F0000.
2020-02-14 16:35:03,015 [root] DEBUG: DLL loaded at 0x76970000: C:\Windows\system32\urlmon (0x150000 bytes).
2020-02-14 16:35:03,062 [root] DEBUG: DLL loaded at 0x75B30000: C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0 (0x4000 bytes).
2020-02-14 16:35:03,092 [root] DEBUG: DLL loaded at 0x75A60000: C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes).
2020-02-14 16:35:03,155 [root] DEBUG: DLL loaded at 0x75D40000: C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes).
2020-02-14 16:35:03,203 [root] DEBUG: DLL loaded at 0x74EC0000: C:\Windows\system32\version (0x9000 bytes).
2020-02-14 16:35:03,250 [root] DEBUG: DLL loaded at 0x75A50000: C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes).
2020-02-14 16:35:03,296 [root] DEBUG: DLL loaded at 0x75D60000: C:\Windows\system32\normaliz (0x3000 bytes).
2020-02-14 16:35:03,342 [root] DEBUG: DLL loaded at 0x76660000: C:\Windows\system32\iertutil (0x236000 bytes).
2020-02-14 16:35:03,390 [root] DEBUG: DLL loaded at 0x76C20000: C:\Windows\system32\WININET (0x437000 bytes).
2020-02-14 16:35:03,453 [root] DEBUG: DLL loaded at 0x75AE0000: C:\Windows\system32\USERENV (0x17000 bytes).
2020-02-14 16:35:03,500 [root] DEBUG: DLL loaded at 0x73B50000: C:\Windows\system32\dhcpcsvc6 (0xd000 bytes).
2020-02-14 16:35:03,546 [root] DEBUG: DLL unloaded from 0x77CB0000.
2020-02-14 16:35:03,687 [root] DEBUG: DLL loaded at 0x75270000: C:\Windows\system32\DNSAPI (0x44000 bytes).
2020-02-14 16:35:03,828 [root] DEBUG: DLL loaded at 0x753A0000: C:\Windows\System32\wship6 (0x6000 bytes).
2020-02-14 16:35:03,921 [root] DEBUG: DLL loaded at 0x72340000: C:\Windows\system32\rasadhlp (0x6000 bytes).
2020-02-14 16:35:04,250 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Services\Services.cfg" does not exist, skip.
2020-02-14 16:35:04,780 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\add_reviewer.gif" does not exist, skip.
2020-02-14 16:35:04,875 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\bl.gif" does not exist, skip.
2020-02-14 16:35:04,921 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\br.gif" does not exist, skip.
2020-02-14 16:35:05,108 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\create_form.gif" does not exist, skip.
2020-02-14 16:35:05,155 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\distribute_form.gif" does not exist, skip.
2020-02-14 16:35:05,203 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\email_all.gif" does not exist, skip.
2020-02-14 16:35:05,250 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\email_initiator.gif" does not exist, skip.
2020-02-14 16:35:05,296 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\ended_review_or_form.gif" does not exist, skip.
2020-02-14 16:35:05,342 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\end_review.gif" does not exist, skip.
2020-02-14 16:35:05,390 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\forms_distributed.gif" does not exist, skip.
2020-02-14 16:35:05,437 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\forms_received.gif" does not exist, skip.
2020-02-14 16:35:05,483 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\forms_super.gif" does not exist, skip.
2020-02-14 16:35:05,546 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\form_responses.gif" does not exist, skip.
2020-02-14 16:35:05,608 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\info.gif" does not exist, skip.
2020-02-14 16:35:05,655 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\main.css" does not exist, skip.
2020-02-14 16:35:05,703 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\open_original_form.gif" does not exist, skip.
2020-02-14 16:35:05,750 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\pdf.gif" does not exist, skip.
2020-02-14 16:35:05,796 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\reviewers.gif" does not exist, skip.
2020-02-14 16:35:05,842 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\reviews_joined.gif" does not exist, skip.
2020-02-14 16:35:05,890 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\reviews_sent.gif" does not exist, skip.
2020-02-14 16:35:05,937 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\reviews_super.gif" does not exist, skip.
2020-02-14 16:35:05,983 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\review_browser.gif" does not exist, skip.
2020-02-14 16:35:06,046 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\review_email.gif" does not exist, skip.
2020-02-14 16:35:06,187 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\review_same_reviewers.gif" does not exist, skip.
2020-02-14 16:35:06,703 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\review_shared.gif" does not exist, skip.
2020-02-14 16:35:06,750 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\rss.gif" does not exist, skip.
2020-02-14 16:35:06,796 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\server_issue.gif" does not exist, skip.
2020-02-14 16:35:06,937 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\server_lg.gif" does not exist, skip.
2020-02-14 16:35:06,983 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\server_ok.gif" does not exist, skip.
2020-02-14 16:35:07,125 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\stop_collection_data.gif" does not exist, skip.
2020-02-14 16:35:07,171 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\submission_history.gif" does not exist, skip.
2020-02-14 16:35:07,265 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\tl.gif" does not exist, skip.
2020-02-14 16:35:07,328 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\tr.gif" does not exist, skip.
2020-02-14 16:35:07,375 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\trash.gif" does not exist, skip.
2020-02-14 16:35:07,421 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\turnOffNotificationInAcrobat.gif" does not exist, skip.
2020-02-14 16:35:07,467 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\turnOffNotificationInTray.gif" does not exist, skip.
2020-02-14 16:35:07,530 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\turnOnNotificationInAcrobat.gif" does not exist, skip.
2020-02-14 16:35:07,592 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\turnOnNotificationInTray.gif" does not exist, skip.
2020-02-14 16:35:07,655 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Reader\Tracker\warning.gif" does not exist, skip.
2020-02-14 16:35:07,703 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\ReadMe.htm" does not exist, skip.
2020-02-14 16:35:08,015 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\Font\AdobePiStd.otf" does not exist, skip.
2020-02-14 16:35:08,078 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\Font\CourierStd-Bold.otf" does not exist, skip.
2020-02-14 16:35:08,171 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\Font\CourierStd-BoldOblique.otf" does not exist, skip.
2020-02-14 16:35:08,250 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\Font\CourierStd-Oblique.otf" does not exist, skip.
2020-02-14 16:35:08,296 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\Font\CourierStd.otf" does not exist, skip.
2020-02-14 16:35:08,342 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\Font\MinionPro-Bold.otf" does not exist, skip.
2020-02-14 16:35:08,405 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\Font\MinionPro-BoldIt.otf" does not exist, skip.
2020-02-14 16:35:08,467 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\Font\MinionPro-It.otf" does not exist, skip.
2020-02-14 16:35:08,530 [root] DEBUG: DLL loaded at 0x74090000: C:\Windows\system32\NLAapi (0x10000 bytes).
2020-02-14 16:35:08,578 [root] DEBUG: DLL loaded at 0x6EB00000: C:\Windows\system32\napinsp (0x10000 bytes).
2020-02-14 16:35:08,625 [root] DEBUG: DLL loaded at 0x6EAD0000: C:\Windows\system32\pnrpnsp (0x12000 bytes).
2020-02-14 16:35:08,687 [root] DEBUG: DLL loaded at 0x6EA70000: C:\Windows\System32\winrnr (0x8000 bytes).
2020-02-14 16:35:08,733 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\Font\MinionPro-Regular.otf" does not exist, skip.
2020-02-14 16:35:08,796 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\Font\MyriadPro-Bold.otf" does not exist, skip.
2020-02-14 16:35:08,858 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\Font\MyriadPro-BoldIt.otf" does not exist, skip.
2020-02-14 16:35:08,921 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\Font\MyriadPro-It.otf" does not exist, skip.
2020-02-14 16:35:08,983 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\Font\MyriadPro-Regular.otf" does not exist, skip.
2020-02-14 16:35:09,078 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\Font\PFM\SY______.PFM" does not exist, skip.
2020-02-14 16:35:09,140 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\Font\PFM\zx______.pfm" does not exist, skip.
2020-02-14 16:35:09,203 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\Font\PFM\zy______.pfm" does not exist, skip.
2020-02-14 16:35:09,265 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\Font\SY______.PFB" does not exist, skip.
2020-02-14 16:35:09,328 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\Font\ZX______.PFB" does not exist, skip.
2020-02-14 16:35:09,375 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\Font\ZY______.PFB" does not exist, skip.
2020-02-14 16:35:09,437 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp" does not exist, skip.
2020-02-14 16:35:09,500 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat" does not exist, skip.
2020-02-14 16:35:09,890 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt" does not exist, skip.
2020-02-14 16:35:09,890 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT" does not exist, skip.
2020-02-14 16:35:09,953 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT" does not exist, skip.
2020-02-14 16:35:10,015 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT" does not exist, skip.
2020-02-14 16:35:10,062 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT" does not exist, skip.
2020-02-14 16:35:10,203 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT" does not exist, skip.
2020-02-14 16:35:10,717 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT" does not exist, skip.
2020-02-14 16:35:10,967 [root] WARNING: Unable to access file at path "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMAN.TXT.lockbit'
2020-02-14 16:35:11,000 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT" does not exist, skip.
2020-02-14 16:35:11,155 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT" does not exist, skip.
2020-02-14 16:35:11,608 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT" does not exist, skip.
2020-02-14 16:35:11,703 [root] INFO: Stopped WMI Service
2020-02-14 16:35:11,703 [root] INFO: Attaching to DcomLaunch service (pid 556)
2020-02-14 16:35:11,733 [root] WARNING: Unable to access file at path "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\TURKISH.TXT.lockbit'
2020-02-14 16:35:11,765 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT" does not exist, skip.
2020-02-14 16:35:11,765 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-02-14 16:35:11,765 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-02-14 16:35:11,765 [lib.api.process] INFO: 32-bit DLL to inject is C:\inqczlrb\dll\OQecjSq.dll, loader C:\inqczlrb\bin\sUENDCm.exe
2020-02-14 16:35:11,905 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xwiEBcIMA.
2020-02-14 16:35:11,937 [root] WARNING: Unable to access file at path "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\UKRAINE.TXT.lockbit'
2020-02-14 16:35:11,937 [root] DEBUG: Loader: Injecting process 556 (thread 0) with C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:12,000 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2020-02-14 16:35:12,000 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT" does not exist, skip.
2020-02-14 16:35:12,078 [root] DEBUG: Terminate processes on terminate_event disabled.
2020-02-14 16:35:12,125 [root] DEBUG: Capture of extracted payloads enabled.
2020-02-14 16:35:12,171 [root] DEBUG: Process dumps disabled.
2020-02-14 16:35:12,265 [root] INFO: Disabling sleep skipping.
2020-02-14 16:35:12,312 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 556 at 0x6d010000, image base 0xeb0000, stack from 0x9c6000-0x9d0000
2020-02-14 16:35:12,358 [root] DEBUG: Commandline: C:\Windows\System32\svchost.exe -k DcomLaunch.
2020-02-14 16:35:12,405 [root] DEBUG: WoW64 not detected.
2020-02-14 16:35:12,453 [root] DEBUG: ExtractionInit: Debugger initialised.
2020-02-14 16:35:12,483 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00EB0000.
2020-02-14 16:35:12,530 [root] DEBUG: AddTrackedRegion: New region at 0x00EB0000 size 0x1000 added to tracked regions: EntryPoint 0x2104, Entropy 4.247836e+00
2020-02-14 16:35:12,578 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-02-14 16:35:12,625 [root] INFO: Added new process to list with pid: 556
2020-02-14 16:35:12,625 [root] INFO: Monitor successfully loaded in process with pid 556.
2020-02-14 16:35:12,671 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-02-14 16:35:12,717 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-02-14 16:35:12,750 [root] DEBUG: Successfully injected DLL C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:13,358 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT" does not exist, skip.
2020-02-14 16:35:13,546 [root] WARNING: Unable to access file at path "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1251.TXT.lockbit'
2020-02-14 16:35:13,592 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT" does not exist, skip.
2020-02-14 16:35:13,592 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT" does not exist, skip.
2020-02-14 16:35:13,655 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT" does not exist, skip.
2020-02-14 16:35:13,703 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT" does not exist, skip.
2020-02-14 16:35:13,765 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT" does not exist, skip.
2020-02-14 16:35:13,828 [root] WARNING: File at path "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT" does not exist, skip.
2020-02-14 16:35:13,983 [root] WARNING: File at path "C:\Program Files\DVD Maker\audiodepthconverter.ax" does not exist, skip.
2020-02-14 16:35:14,046 [root] DEBUG: DLL unloaded from 0x72A80000.
2020-02-14 16:35:14,046 [root] WARNING: File at path "C:\Program Files\DVD Maker\bod_r.TTF" does not exist, skip.
2020-02-14 16:35:14,140 [root] WARNING: File at path "C:\Program Files\DVD Maker\directshowtap.ax" does not exist, skip.
2020-02-14 16:35:15,625 [root] WARNING: File at path "C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui" does not exist, skip.
2020-02-14 16:35:15,921 [root] WARNING: File at path "C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui" does not exist, skip.
2020-02-14 16:35:15,983 [root] WARNING: File at path "C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui" does not exist, skip.
2020-02-14 16:35:16,046 [root] WARNING: File at path "C:\Program Files\DVD Maker\Eurosti.TTF" does not exist, skip.
2020-02-14 16:35:16,265 [root] WARNING: File at path "C:\Program Files\DVD Maker\fieldswitch.ax" does not exist, skip.
2020-02-14 16:35:16,405 [root] WARNING: File at path "C:\Program Files\DVD Maker\offset.ax" does not exist, skip.
2020-02-14 16:35:16,405 [root] WARNING: Unable to access file at path "C:\Program Files\DVD Maker\rtstreamsink.ax.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\DVD Maker\\rtstreamsink.ax.lockbit'
2020-02-14 16:35:16,467 [root] WARNING: File at path "C:\Program Files\DVD Maker\rtstreamsink.ax" does not exist, skip.
2020-02-14 16:35:16,467 [root] WARNING: File at path "C:\Program Files\DVD Maker\rtstreamsource.ax" does not exist, skip.
2020-02-14 16:35:16,530 [root] WARNING: File at path "C:\Program Files\DVD Maker\SecretST.TTF" does not exist, skip.
2020-02-14 16:35:16,578 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\Common.fxh" does not exist, skip.
2020-02-14 16:35:16,640 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DissolveAnother.png" does not exist, skip.
2020-02-14 16:35:16,703 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DissolveNoise.png" does not exist, skip.
2020-02-14 16:35:16,828 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png" does not exist, skip.
2020-02-14 16:35:16,875 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:16,953 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png" does not exist, skip.
2020-02-14 16:35:17,000 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png" does not exist, skip.
2020-02-14 16:35:17,046 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:17,092 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png" does not exist, skip.
2020-02-14 16:35:17,140 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png" does not exist, skip.
2020-02-14 16:35:17,203 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv" does not exist, skip.
2020-02-14 16:35:17,265 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv" does not exist, skip.
2020-02-14 16:35:17,328 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv" does not exist, skip.
2020-02-14 16:35:17,375 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv" does not exist, skip.
2020-02-14 16:35:17,437 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv" does not exist, skip.
2020-02-14 16:35:17,500 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv" does not exist, skip.
2020-02-14 16:35:17,562 [root] INFO: Started WMI Service
2020-02-14 16:35:17,562 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv" does not exist, skip.
2020-02-14 16:35:17,562 [root] INFO: Attaching to WMI service (pid 2788)
2020-02-14 16:35:17,625 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv" does not exist, skip.
2020-02-14 16:35:17,625 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-02-14 16:35:17,625 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-02-14 16:35:17,625 [lib.api.process] INFO: 32-bit DLL to inject is C:\inqczlrb\dll\OQecjSq.dll, loader C:\inqczlrb\bin\sUENDCm.exe
2020-02-14 16:35:17,687 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv" does not exist, skip.
2020-02-14 16:35:17,750 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv" does not exist, skip.
2020-02-14 16:35:17,796 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xwiEBcIMA.
2020-02-14 16:35:17,796 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG" does not exist, skip.
2020-02-14 16:35:17,842 [root] DEBUG: Loader: Injecting process 2788 (thread 0) with C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:17,842 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png" does not exist, skip.
2020-02-14 16:35:17,905 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 2404, handle 0x7c
2020-02-14 16:35:17,905 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png" does not exist, skip.
2020-02-14 16:35:17,967 [root] DEBUG: Process image base: 0x00EB0000
2020-02-14 16:35:17,983 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png" does not exist, skip.
2020-02-14 16:35:18,046 [root] DEBUG: InjectDllViaIAT: Not a new process, aborting IAT patch
2020-02-14 16:35:18,062 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png" does not exist, skip.
2020-02-14 16:35:18,140 [root] DEBUG: InjectDll: IAT patching failed, falling back to thread injection.
2020-02-14 16:35:18,140 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png" does not exist, skip.
2020-02-14 16:35:18,233 [root] DEBUG: Terminate processes on terminate_event disabled.
2020-02-14 16:35:18,233 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png" does not exist, skip.
2020-02-14 16:35:18,296 [root] DEBUG: Capture of extracted payloads enabled.
2020-02-14 16:35:18,296 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png" does not exist, skip.
2020-02-14 16:35:18,342 [root] DEBUG: Process dumps disabled.
2020-02-14 16:35:18,437 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png" does not exist, skip.
2020-02-14 16:35:18,437 [root] INFO: Disabling sleep skipping.
2020-02-14 16:35:18,500 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png" does not exist, skip.
2020-02-14 16:35:18,500 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 2788 at 0x6d010000, image base 0xeb0000, stack from 0x636000-0x640000
2020-02-14 16:35:18,546 [root] DEBUG: Commandline: C:\Windows\System32\svchost.exe -k netsvcs.
2020-02-14 16:35:18,546 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png" does not exist, skip.
2020-02-14 16:35:18,592 [root] DEBUG: WoW64 not detected.
2020-02-14 16:35:18,640 [root] DEBUG: ExtractionInit: Debugger initialised.
2020-02-14 16:35:18,687 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00EB0000.
2020-02-14 16:35:18,733 [root] DEBUG: AddTrackedRegion: New region at 0x00EB0000 size 0x1000 added to tracked regions: EntryPoint 0x2104, Entropy 4.230648e+00
2020-02-14 16:35:18,780 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-02-14 16:35:18,828 [root] INFO: Added new process to list with pid: 2788
2020-02-14 16:35:18,828 [root] INFO: Monitor successfully loaded in process with pid 2788.
2020-02-14 16:35:18,875 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-02-14 16:35:18,905 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-02-14 16:35:18,905 [root] WARNING: Unable to access file at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv.lockbit'
2020-02-14 16:35:18,953 [root] DEBUG: Successfully injected DLL C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:18,953 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv" does not exist, skip.
2020-02-14 16:35:19,108 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv" does not exist, skip.
2020-02-14 16:35:19,296 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv" does not exist, skip.
2020-02-14 16:35:19,296 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv" does not exist, skip.
2020-02-14 16:35:19,358 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png" does not exist, skip.
2020-02-14 16:35:19,405 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png" does not exist, skip.
2020-02-14 16:35:19,467 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png" does not exist, skip.
2020-02-14 16:35:19,515 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png" does not exist, skip.
2020-02-14 16:35:19,562 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png" does not exist, skip.
2020-02-14 16:35:19,717 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png" does not exist, skip.
2020-02-14 16:35:19,858 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png" does not exist, skip.
2020-02-14 16:35:19,937 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png" does not exist, skip.
2020-02-14 16:35:19,983 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv" does not exist, skip.
2020-02-14 16:35:20,062 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv" does not exist, skip.
2020-02-14 16:35:20,108 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv" does not exist, skip.
2020-02-14 16:35:20,171 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv" does not exist, skip.
2020-02-14 16:35:20,280 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv" does not exist, skip.
2020-02-14 16:35:20,280 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv" does not exist, skip.
2020-02-14 16:35:20,342 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png" does not exist, skip.
2020-02-14 16:35:20,390 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png" does not exist, skip.
2020-02-14 16:35:20,437 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png" does not exist, skip.
2020-02-14 16:35:20,500 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png" does not exist, skip.
2020-02-14 16:35:20,546 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp" does not exist, skip.
2020-02-14 16:35:20,592 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png" does not exist, skip.
2020-02-14 16:35:20,640 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png" does not exist, skip.
2020-02-14 16:35:20,687 [root] DEBUG: DLL unloaded from 0x77CB0000.
2020-02-14 16:35:20,687 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png" does not exist, skip.
2020-02-14 16:35:20,733 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:20,780 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp" does not exist, skip.
2020-02-14 16:35:20,828 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png" does not exist, skip.
2020-02-14 16:35:20,875 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png" does not exist, skip.
2020-02-14 16:35:20,921 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png" does not exist, skip.
2020-02-14 16:35:20,967 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp" does not exist, skip.
2020-02-14 16:35:21,030 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png" does not exist, skip.
2020-02-14 16:35:21,092 [root] DEBUG: DLL loaded at 0x75D70000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2020-02-14 16:35:21,108 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx" does not exist, skip.
2020-02-14 16:35:21,155 [root] DEBUG: DLL loaded at 0x73330000: C:\Windows\system32\wbem\wbemprox (0xb000 bytes).
2020-02-14 16:35:21,155 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png" does not exist, skip.
2020-02-14 16:35:21,217 [root] DEBUG: DLL loaded at 0x73580000: C:\Windows\system32\wbemcomn2 (0x61000 bytes).
2020-02-14 16:35:21,217 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png" does not exist, skip.
2020-02-14 16:35:21,280 [root] DEBUG: DLL loaded at 0x75540000: C:\Windows\system32\bcrypt (0x17000 bytes).
2020-02-14 16:35:21,280 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:21,342 [root] DEBUG: DLL unloaded from 0x75EB0000.
2020-02-14 16:35:21,342 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:21,405 [root] DEBUG: DLL loaded at 0x6C3E0000: C:\Windows\System32\msxml3 (0x134000 bytes).
2020-02-14 16:35:21,405 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:21,453 [root] DEBUG: DLL loaded at 0x76970000: C:\Windows\system32\urlmon (0x150000 bytes).
2020-02-14 16:35:21,453 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:21,515 [root] DEBUG: DLL loaded at 0x75B30000: C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0 (0x4000 bytes).
2020-02-14 16:35:21,515 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:21,578 [root] DEBUG: DLL loaded at 0x75D50000: C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0 (0x4000 bytes).
2020-02-14 16:35:21,578 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:21,640 [root] DEBUG: DLL loaded at 0x75C00000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes).
2020-02-14 16:35:21,640 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png" does not exist, skip.
2020-02-14 16:35:21,687 [root] DEBUG: DLL loaded at 0x75A60000: C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes).
2020-02-14 16:35:21,687 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png" does not exist, skip.
2020-02-14 16:35:21,733 [root] DEBUG: DLL loaded at 0x75D40000: C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes).
2020-02-14 16:35:21,733 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png" does not exist, skip.
2020-02-14 16:35:21,796 [root] DEBUG: DLL loaded at 0x74EC0000: C:\Windows\system32\version (0x9000 bytes).
2020-02-14 16:35:21,796 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png" does not exist, skip.
2020-02-14 16:35:21,842 [root] DEBUG: DLL loaded at 0x75A50000: C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes).
2020-02-14 16:35:21,842 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png" does not exist, skip.
2020-02-14 16:35:21,890 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png" does not exist, skip.
2020-02-14 16:35:21,890 [root] DEBUG: DLL loaded at 0x75D60000: C:\Windows\system32\normaliz (0x3000 bytes).
2020-02-14 16:35:21,937 [root] DEBUG: DLL loaded at 0x76660000: C:\Windows\system32\iertutil (0x236000 bytes).
2020-02-14 16:35:21,937 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:22,000 [root] DEBUG: DLL loaded at 0x76C20000: C:\Windows\system32\WININET (0x437000 bytes).
2020-02-14 16:35:22,015 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:22,062 [root] DEBUG: DLL loaded at 0x75AE0000: C:\Windows\system32\USERENV (0x17000 bytes).
2020-02-14 16:35:22,078 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:22,108 [root] DEBUG: DLL loaded at 0x75A40000: C:\Windows\system32\profapi (0xb000 bytes).
2020-02-14 16:35:22,125 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:22,187 [root] DEBUG: DLL loaded at 0x6D870000: C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0 (0x4000 bytes).
2020-02-14 16:35:22,562 [root] DEBUG: DLL loaded at 0x753F0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-02-14 16:35:22,608 [root] DEBUG: DLL loaded at 0x75180000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-02-14 16:35:22,625 [root] WARNING: Unable to access file at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png.lockbit'
2020-02-14 16:35:22,671 [root] DEBUG: DLL loaded at 0x75990000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-02-14 16:35:22,671 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:22,842 [root] DEBUG: DLL loaded at 0x72A30000: C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLMF (0xe000 bytes).
2020-02-14 16:35:22,890 [root] DEBUG: DLL loaded at 0x6DCE0000: C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\VCRUNTIME140 (0x15000 bytes).
2020-02-14 16:35:22,937 [root] DEBUG: DLL loaded at 0x70040000: C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\api-ms-win-crt-runtime-l1-1-0 (0x4000 bytes).
2020-02-14 16:35:22,983 [root] DEBUG: DLL loaded at 0x6D790000: C:\Windows\system32\ucrtbase (0xe0000 bytes).
2020-02-14 16:35:23,030 [root] DEBUG: DLL loaded at 0x6EA90000: C:\Windows\system32\api-ms-win-core-timezone-l1-1-0 (0x3000 bytes).
2020-02-14 16:35:23,078 [root] DEBUG: DLL loaded at 0x6D750000: C:\Windows\system32\api-ms-win-core-file-l2-1-0 (0x3000 bytes).
2020-02-14 16:35:23,125 [root] DEBUG: DLL loaded at 0x6D710000: C:\Windows\system32\api-ms-win-core-localization-l1-2-0 (0x3000 bytes).
2020-02-14 16:35:23,125 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:23,187 [root] DEBUG: DLL loaded at 0x6D700000: C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1 (0x3000 bytes).
2020-02-14 16:35:23,203 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png" does not exist, skip.
2020-02-14 16:35:23,250 [root] DEBUG: DLL loaded at 0x6D6F0000: C:\Windows\system32\api-ms-win-core-file-l1-2-0 (0x3000 bytes).
2020-02-14 16:35:23,250 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:23,296 [root] DEBUG: DLL loaded at 0x6D6E0000: C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\api-ms-win-crt-string-l1-1-0 (0x4000 bytes).
2020-02-14 16:35:23,296 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp" does not exist, skip.
2020-02-14 16:35:23,342 [root] DEBUG: DLL loaded at 0x6D6D0000: C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\api-ms-win-crt-heap-l1-1-0 (0x3000 bytes).
2020-02-14 16:35:23,342 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:23,390 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png" does not exist, skip.
2020-02-14 16:35:23,390 [root] DEBUG: DLL loaded at 0x6D6C0000: C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\api-ms-win-crt-stdio-l1-1-0 (0x4000 bytes).
2020-02-14 16:35:23,453 [root] DEBUG: DLL loaded at 0x6D6B0000: C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\api-ms-win-crt-convert-l1-1-0 (0x4000 bytes).
2020-02-14 16:35:23,453 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png" does not exist, skip.
2020-02-14 16:35:23,515 [root] DEBUG: DLL loaded at 0x6D6A0000: C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\api-ms-win-crt-locale-l1-1-0 (0x3000 bytes).
2020-02-14 16:35:23,515 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png" does not exist, skip.
2020-02-14 16:35:23,578 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png" does not exist, skip.
2020-02-14 16:35:23,640 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\huemainsubpicture2.png" does not exist, skip.
2020-02-14 16:35:23,687 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:23,733 [root] DEBUG: DLL loaded at 0x735F0000: C:\Windows\system32\VSSAPI (0x116000 bytes).
2020-02-14 16:35:23,733 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:23,780 [root] DEBUG: DLL loaded at 0x73FD0000: C:\Windows\system32\ATL (0x14000 bytes).
2020-02-14 16:35:23,780 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:23,828 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:23,828 [root] DEBUG: DLL loaded at 0x73E20000: C:\Windows\system32\VssTrace (0x10000 bytes).
2020-02-14 16:35:23,875 [root] DEBUG: DLL loaded at 0x73B40000: C:\Windows\system32\samcli (0xf000 bytes).
2020-02-14 16:35:23,875 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:23,921 [root] DEBUG: DLL loaded at 0x74540000: C:\Windows\system32\SAMLIB (0x12000 bytes).
2020-02-14 16:35:23,921 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:23,967 [root] DEBUG: DLL loaded at 0x74190000: C:\Windows\system32\netutils (0x9000 bytes).
2020-02-14 16:35:23,967 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png" does not exist, skip.
2020-02-14 16:35:24,030 [root] DEBUG: DLL loaded at 0x73F40000: C:\Windows\system32\es (0x47000 bytes).
2020-02-14 16:35:24,030 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png" does not exist, skip.
2020-02-14 16:35:24,108 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png" does not exist, skip.
2020-02-14 16:35:24,171 [root] WARNING: Unable to access file at path "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png.lockbit'
2020-02-14 16:35:24,217 [root] DEBUG: DLL loaded at 0x74610000: C:\Windows\system32\PROPSYS (0xf5000 bytes).
2020-02-14 16:35:24,217 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png" does not exist, skip.
2020-02-14 16:35:24,217 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png" does not exist, skip.
2020-02-14 16:35:24,375 [root] DEBUG: DLL loaded at 0x72B50000: C:\Windows\system32\wbem\wbemcore (0xf1000 bytes).
2020-02-14 16:35:24,375 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:24,421 [root] DEBUG: DLL loaded at 0x74EC0000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-02-14 16:35:24,467 [root] DEBUG: DLL loaded at 0x72AA0000: C:\Windows\system32\wbem\esscli (0x4a000 bytes).
2020-02-14 16:35:24,515 [root] DEBUG: DLL loaded at 0x73400000: C:\Windows\system32\wbem\FastProx (0xa6000 bytes).
2020-02-14 16:35:24,562 [root] DEBUG: DLL loaded at 0x730A0000: C:\Windows\system32\NTDSAPI (0x18000 bytes).
2020-02-14 16:35:24,608 [root] DEBUG: DLL unloaded from 0x72B50000.
2020-02-14 16:35:24,608 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:24,671 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:24,671 [root] DEBUG: DLL loaded at 0x72C50000: C:\Windows\system32\wbem\wbemsvc (0xf000 bytes).
2020-02-14 16:35:24,733 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:24,780 [root] DEBUG: DLL loaded at 0x72C50000: C:\Windows\system32\wbem\wbemsvc (0xf000 bytes).
2020-02-14 16:35:24,780 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:24,828 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:24,875 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png" does not exist, skip.
2020-02-14 16:35:24,921 [root] DEBUG: DLL loaded at 0x755A0000: C:\Windows\system32\authZ (0x1b000 bytes).
2020-02-14 16:35:24,967 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png" does not exist, skip.
2020-02-14 16:35:24,967 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2328.
2020-02-14 16:35:25,015 [root] DEBUG: DLL unloaded from 0x77CB0000.
2020-02-14 16:35:25,015 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png" does not exist, skip.
2020-02-14 16:35:25,078 [root] DEBUG: DLL loaded at 0x72480000: C:\Windows\system32\wbem\wmiutils (0x1a000 bytes).
2020-02-14 16:35:25,078 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png" does not exist, skip.
2020-02-14 16:35:25,140 [root] DEBUG: DLL loaded at 0x6FBA0000: C:\Windows\system32\wbem\repdrvfs (0x47000 bytes).
2020-02-14 16:35:25,155 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png" does not exist, skip.
2020-02-14 16:35:25,203 [root] WARNING: File at path "C:\Windows\System32\wbem\repository\WRITABLE.TST" does not exist, skip.
2020-02-14 16:35:25,217 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png" does not exist, skip.
2020-02-14 16:35:25,265 [root] DEBUG: DLL loaded at 0x755D0000: C:\Windows\system32\Wevtapi (0x42000 bytes).
2020-02-14 16:35:25,280 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png" does not exist, skip.
2020-02-14 16:35:25,358 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png" does not exist, skip.
2020-02-14 16:35:25,405 [root] DEBUG: DLL unloaded from 0x755D0000.
2020-02-14 16:35:25,405 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png" does not exist, skip.
2020-02-14 16:35:25,592 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png" does not exist, skip.
2020-02-14 16:35:25,671 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png" does not exist, skip.
2020-02-14 16:35:25,717 [root] DEBUG: DLL loaded at 0x6E0E0000: C:\Windows\system32\wbem\wmiprvsd (0x91000 bytes).
2020-02-14 16:35:25,717 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png" does not exist, skip.
2020-02-14 16:35:25,780 [root] DEBUG: DLL loaded at 0x6E8F0000: C:\Windows\system32\NCObjAPI (0xf000 bytes).
2020-02-14 16:35:25,780 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png" does not exist, skip.
2020-02-14 16:35:25,842 [root] DEBUG: DLL loaded at 0x6DC80000: C:\Windows\system32\wbem\wbemess (0x5b000 bytes).
2020-02-14 16:35:25,842 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png" does not exist, skip.
2020-02-14 16:35:25,905 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2412.
2020-02-14 16:35:25,905 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png" does not exist, skip.
2020-02-14 16:35:25,967 [root] DEBUG: DLL unloaded from 0x77CB0000.
2020-02-14 16:35:25,967 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png" does not exist, skip.
2020-02-14 16:35:26,030 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png" does not exist, skip.
2020-02-14 16:35:26,078 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png" does not exist, skip.
2020-02-14 16:35:26,187 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:26,296 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2864.
2020-02-14 16:35:26,342 [root] DEBUG: DLL unloaded from 0x72A80000.
2020-02-14 16:35:26,405 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:26,500 [root] DEBUG: CreateThread: Initialising breakpoints for thread 3704.
2020-02-14 16:35:26,546 [root] DEBUG: CreateThread: Initialising breakpoints for thread 3656.
2020-02-14 16:35:26,592 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2980.
2020-02-14 16:35:26,640 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2904.
2020-02-14 16:35:26,687 [root] DEBUG: CreateThread: Initialising breakpoints for thread 3228.
2020-02-14 16:35:26,733 [root] DEBUG: CreateThread: Initialising breakpoints for thread 188.
2020-02-14 16:35:26,780 [root] DEBUG: CreateThread: Initialising breakpoints for thread 200.
2020-02-14 16:35:27,046 [root] DEBUG: CreateThread: Initialising breakpoints for thread 3148.
2020-02-14 16:35:27,233 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:27,765 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:27,812 [root] DEBUG: DLL loaded at 0x73400000: C:\Windows\system32\wbem\fastprox (0xa6000 bytes).
2020-02-14 16:35:27,858 [root] DEBUG: DLL loaded at 0x730A0000: C:\Windows\system32\NTDSAPI (0x18000 bytes).
2020-02-14 16:35:28,062 [root] DEBUG: DLL unloaded from 0x72B50000.
2020-02-14 16:35:28,905 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:28,983 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:29,155 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png" does not exist, skip.
2020-02-14 16:35:29,250 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png" does not exist, skip.
2020-02-14 16:35:29,250 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png" does not exist, skip.
2020-02-14 16:35:29,296 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:29,342 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:29,390 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:29,467 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:29,515 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:29,562 [root] DEBUG: DLL loaded at 0x734F0000: C:\Windows\system32\wbem\ncprov (0x12000 bytes).
2020-02-14 16:35:29,562 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:29,655 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png" does not exist, skip.
2020-02-14 16:35:30,046 [root] DEBUG: CreateThread: Initialising breakpoints for thread 1952.
2020-02-14 16:35:30,092 [root] DEBUG: DLL unloaded from 0x77CB0000.
2020-02-14 16:35:30,140 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2320.
2020-02-14 16:35:30,140 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2212.
2020-02-14 16:35:31,000 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png" does not exist, skip.
2020-02-14 16:35:31,515 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png" does not exist, skip.
2020-02-14 16:35:31,717 [root] INFO: Announced 32-bit process name: WmiPrvSE.exe pid: 2296
2020-02-14 16:35:31,717 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv" does not exist, skip.
2020-02-14 16:35:31,765 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-02-14 16:35:31,765 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-02-14 16:35:31,765 [lib.api.process] INFO: 32-bit DLL to inject is C:\inqczlrb\dll\OQecjSq.dll, loader C:\inqczlrb\bin\sUENDCm.exe
2020-02-14 16:35:31,858 [root] WARNING: Unable to access file at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv.lockbit'
2020-02-14 16:35:31,905 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png" does not exist, skip.
2020-02-14 16:35:31,905 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xwiEBcIMA.
2020-02-14 16:35:31,905 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv" does not exist, skip.
2020-02-14 16:35:31,953 [root] DEBUG: Loader: Injecting process 2296 (thread 2272) with C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:31,953 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png" does not exist, skip.
2020-02-14 16:35:32,000 [root] DEBUG: Process image base: 0x01360000
2020-02-14 16:35:32,000 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\performance.png" does not exist, skip.
2020-02-14 16:35:32,062 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:32,062 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png" does not exist, skip.
2020-02-14 16:35:32,155 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png" does not exist, skip.
2020-02-14 16:35:32,203 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-02-14 16:35:32,203 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIcon.png" does not exist, skip.
2020-02-14 16:35:32,250 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png" does not exist, skip.
2020-02-14 16:35:32,250 [root] DEBUG: Successfully injected DLL C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:32,296 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2296
2020-02-14 16:35:32,296 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png" does not exist, skip.
2020-02-14 16:35:32,358 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv" does not exist, skip.
2020-02-14 16:35:32,358 [root] INFO: Announced 32-bit process name: WmiPrvSE.exe pid: 2296
2020-02-14 16:35:32,358 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-02-14 16:35:32,358 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-02-14 16:35:32,358 [lib.api.process] INFO: 32-bit DLL to inject is C:\inqczlrb\dll\OQecjSq.dll, loader C:\inqczlrb\bin\sUENDCm.exe
2020-02-14 16:35:32,421 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv" does not exist, skip.
2020-02-14 16:35:32,483 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png" does not exist, skip.
2020-02-14 16:35:32,546 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xwiEBcIMA.
2020-02-14 16:35:32,546 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png" does not exist, skip.
2020-02-14 16:35:32,592 [root] DEBUG: Loader: Injecting process 2296 (thread 2272) with C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:32,592 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv" does not exist, skip.
2020-02-14 16:35:32,671 [root] DEBUG: Process image base: 0x01360000
2020-02-14 16:35:32,671 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv" does not exist, skip.
2020-02-14 16:35:32,750 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:32,750 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv" does not exist, skip.
2020-02-14 16:35:32,812 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-02-14 16:35:32,812 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv" does not exist, skip.
2020-02-14 16:35:32,875 [root] DEBUG: Successfully injected DLL C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:32,875 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv" does not exist, skip.
2020-02-14 16:35:32,937 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2296
2020-02-14 16:35:32,937 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv" does not exist, skip.
2020-02-14 16:35:33,000 [root] DEBUG: Terminate processes on terminate_event disabled.
2020-02-14 16:35:33,000 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\userContent_16x9_imagemask.png" does not exist, skip.
2020-02-14 16:35:33,046 [root] DEBUG: Capture of extracted payloads enabled.
2020-02-14 16:35:33,046 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png" does not exist, skip.
2020-02-14 16:35:33,092 [root] DEBUG: Process dumps disabled.
2020-02-14 16:35:33,092 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv" does not exist, skip.
2020-02-14 16:35:33,217 [root] INFO: Disabling sleep skipping.
2020-02-14 16:35:33,217 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv" does not exist, skip.
2020-02-14 16:35:33,217 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv" does not exist, skip.
2020-02-14 16:35:33,296 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-02-14 16:35:33,296 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv" does not exist, skip.
2020-02-14 16:35:33,358 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 2296 at 0x6d010000, image base 0x1360000, stack from 0x1b0000-0x1c0000
2020-02-14 16:35:33,358 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png" does not exist, skip.
2020-02-14 16:35:33,405 [root] DEBUG: Commandline: C:\Windows\System32\wbem\wmiprvse.exe -secured -Embedding.
2020-02-14 16:35:33,405 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png" does not exist, skip.
2020-02-14 16:35:33,453 [root] DEBUG: WoW64 not detected.
2020-02-14 16:35:33,515 [root] DEBUG: ExtractionInit: Debugger initialised.
2020-02-14 16:35:33,515 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png" does not exist, skip.
2020-02-14 16:35:33,578 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x01360000.
2020-02-14 16:35:33,671 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png" does not exist, skip.
2020-02-14 16:35:33,812 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png" does not exist, skip.
2020-02-14 16:35:33,858 [root] DEBUG: AddTrackedRegion: New region at 0x01360000 size 0x1000 added to tracked regions: EntryPoint 0x3a810, Entropy 6.564612e+00
2020-02-14 16:35:33,905 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png" does not exist, skip.
2020-02-14 16:35:33,905 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-02-14 16:35:33,953 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png" does not exist, skip.
2020-02-14 16:35:33,953 [root] INFO: Added new process to list with pid: 2296
2020-02-14 16:35:33,953 [root] INFO: Monitor successfully loaded in process with pid 2296.
2020-02-14 16:35:34,015 [root] DEBUG: DLL loaded at 0x75920000: C:\Windows\system32\CRYPTBASE (0xc000 bytes).
2020-02-14 16:35:34,015 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png" does not exist, skip.
2020-02-14 16:35:34,062 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png" does not exist, skip.
2020-02-14 16:35:34,062 [root] DEBUG: DLL loaded at 0x74270000: C:\Windows\system32\ntmarta (0x21000 bytes).
2020-02-14 16:35:34,108 [root] DEBUG: DLL loaded at 0x760C0000: C:\Windows\system32\WLDAP32 (0x45000 bytes).
2020-02-14 16:35:34,203 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png" does not exist, skip.
2020-02-14 16:35:34,265 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png" does not exist, skip.
2020-02-14 16:35:34,312 [root] DEBUG: DLL loaded at 0x75D70000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2020-02-14 16:35:34,312 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-backglow.png" does not exist, skip.
2020-02-14 16:35:34,375 [root] DEBUG: CreateThread: Initialising breakpoints for thread 3676.
2020-02-14 16:35:34,375 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png" does not exist, skip.
2020-02-14 16:35:34,421 [root] DEBUG: DLL unloaded from 0x77CB0000.
2020-02-14 16:35:34,421 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png" does not exist, skip.
2020-02-14 16:35:34,467 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png" does not exist, skip.
2020-02-14 16:35:34,515 [root] DEBUG: DLL loaded at 0x73330000: C:\Windows\system32\wbem\wbemprox (0xb000 bytes).
2020-02-14 16:35:34,515 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png" does not exist, skip.
2020-02-14 16:35:34,578 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv" does not exist, skip.
2020-02-14 16:35:34,578 [root] DEBUG: DLL loaded at 0x753F0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-02-14 16:35:34,655 [root] DEBUG: DLL loaded at 0x75180000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-02-14 16:35:34,655 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv" does not exist, skip.
2020-02-14 16:35:34,717 [root] DEBUG: DLL loaded at 0x75990000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-02-14 16:35:34,717 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv" does not exist, skip.
2020-02-14 16:35:34,765 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv" does not exist, skip.
2020-02-14 16:35:34,842 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv" does not exist, skip.
2020-02-14 16:35:34,953 [root] DEBUG: DLL unloaded from 0x72B50000.
2020-02-14 16:35:35,000 [root] DEBUG: DLL loaded at 0x72C50000: C:\Windows\system32\wbem\wbemsvc (0xf000 bytes).
2020-02-14 16:35:35,000 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv" does not exist, skip.
2020-02-14 16:35:35,062 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png" does not exist, skip.
2020-02-14 16:35:35,125 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_selectionsubpicture.png" does not exist, skip.
2020-02-14 16:35:35,171 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png" does not exist, skip.
2020-02-14 16:35:35,233 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:35,280 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:35,328 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png" does not exist, skip.
2020-02-14 16:35:35,390 [root] DEBUG: CreateThread: Initialising breakpoints for thread 1848.
2020-02-14 16:35:35,390 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png" does not exist, skip.
2020-02-14 16:35:35,453 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png" does not exist, skip.
2020-02-14 16:35:35,515 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:35,562 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:35,625 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:35,687 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:35,750 [root] DEBUG: DLL loaded at 0x72480000: C:\Windows\system32\wbem\wmiutils (0x1a000 bytes).
2020-02-14 16:35:35,750 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:35,812 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:35,890 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png" does not exist, skip.
2020-02-14 16:35:35,937 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png" does not exist, skip.
2020-02-14 16:35:36,000 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png" does not exist, skip.
2020-02-14 16:35:36,062 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png" does not exist, skip.
2020-02-14 16:35:36,171 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png" does not exist, skip.
2020-02-14 16:35:36,233 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png" does not exist, skip.
2020-02-14 16:35:36,328 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png" does not exist, skip.
2020-02-14 16:35:36,375 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png" does not exist, skip.
2020-02-14 16:35:36,437 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:36,500 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:36,546 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:36,608 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:36,671 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:36,717 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:36,765 [root] DEBUG: DLL loaded at 0x734D0000: C:\Windows\system32\wbem\vsswmi (0x20000 bytes).
2020-02-14 16:35:36,780 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png" does not exist, skip.
2020-02-14 16:35:36,842 [root] DEBUG: DLL loaded at 0x6D900000: C:\Windows\system32\framedynos (0x35000 bytes).
2020-02-14 16:35:36,842 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png" does not exist, skip.
2020-02-14 16:35:36,890 [root] DEBUG: DLL loaded at 0x735F0000: C:\Windows\system32\VSSAPI (0x116000 bytes).
2020-02-14 16:35:36,967 [root] DEBUG: DLL loaded at 0x73FD0000: C:\Windows\system32\ATL (0x14000 bytes).
2020-02-14 16:35:36,967 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp" does not exist, skip.
2020-02-14 16:35:37,015 [root] DEBUG: DLL loaded at 0x73E20000: C:\Windows\system32\VssTrace (0x10000 bytes).
2020-02-14 16:35:37,108 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp" does not exist, skip.
2020-02-14 16:35:37,155 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp" does not exist, skip.
2020-02-14 16:35:37,203 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp" does not exist, skip.
2020-02-14 16:35:37,265 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp" does not exist, skip.
2020-02-14 16:35:37,328 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp" does not exist, skip.
2020-02-14 16:35:37,375 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp" does not exist, skip.
2020-02-14 16:35:37,421 [root] DEBUG: DLL loaded at 0x6D730000: C:\Windows\system32\vss_ps (0xa000 bytes).
2020-02-14 16:35:37,421 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp" does not exist, skip.
2020-02-14 16:35:37,467 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp" does not exist, skip.
2020-02-14 16:35:37,515 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp" does not exist, skip.
2020-02-14 16:35:37,562 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp" does not exist, skip.
2020-02-14 16:35:37,608 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png" does not exist, skip.
2020-02-14 16:35:37,655 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png" does not exist, skip.
2020-02-14 16:35:37,733 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\bandwidth.png" does not exist, skip.
2020-02-14 16:35:37,780 [root] DEBUG: DLL unloaded from 0x72A30000.
2020-02-14 16:35:37,780 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png" does not exist, skip.
2020-02-14 16:35:37,842 [root] DEBUG: DLL unloaded from 0x6D760000.
2020-02-14 16:35:37,842 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:37,890 [root] DEBUG: DLL unloaded from 0x75EB0000.
2020-02-14 16:35:37,890 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:37,967 [root] DEBUG: DLL unloaded from 0x6D760000.
2020-02-14 16:35:37,967 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:38,030 [root] DEBUG: DLL unloaded from 0x75EB0000.
2020-02-14 16:35:38,030 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:38,078 [root] DEBUG: DLL unloaded from 0x6D760000.
2020-02-14 16:35:38,078 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:38,171 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:38,217 [root] DEBUG: DLL unloaded from 0x75EB0000.
2020-02-14 16:35:38,358 [root] DEBUG: DLL unloaded from 0x76AC0000.
2020-02-14 16:35:38,358 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv" does not exist, skip.
2020-02-14 16:35:38,437 [root] DEBUG: DLL unloaded from 0x73400000.
2020-02-14 16:35:38,515 [root] DEBUG: DLL unloaded from 0x72C50000.
2020-02-14 16:35:38,562 [root] DEBUG: DLL unloaded from 0x6C3E0000.
2020-02-14 16:35:38,562 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv" does not exist, skip.
2020-02-14 16:35:38,608 [root] DEBUG: DLL unloaded from 0x73330000.
2020-02-14 16:35:38,671 [root] DEBUG: NtTerminateProcess hook: Processing tracked regions before shutdown (process 3184).
2020-02-14 16:35:38,717 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-02-14 16:35:38,765 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00370000.
2020-02-14 16:35:38,828 [root] DEBUG: ProcessImageBase: EP 0x0003D81A image base 0x00370000 size 0x0 entropy 6.431156e+00.
2020-02-14 16:35:38,875 [root] DEBUG: DLL unloaded from 0x762A0000.
2020-02-14 16:35:38,921 [root] DEBUG: NtTerminateProcess hook: Processing tracked regions before shutdown (process 3184).
2020-02-14 16:35:38,967 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-02-14 16:35:39,015 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00370000.
2020-02-14 16:35:39,062 [root] DEBUG: ProcessImageBase: EP 0x0003D81A image base 0x00370000 size 0x0 entropy 6.431156e+00.
2020-02-14 16:35:39,108 [root] INFO: Notified of termination of process with pid 3184.
2020-02-14 16:35:39,342 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp" does not exist, skip.
2020-02-14 16:35:39,390 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png" does not exist, skip.
2020-02-14 16:35:39,671 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png" does not exist, skip.
2020-02-14 16:35:40,546 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png" does not exist, skip.
2020-02-14 16:35:40,655 [root] INFO: Announced 32-bit process name: bcdedit.exe pid: 2668
2020-02-14 16:35:40,703 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-02-14 16:35:40,703 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-02-14 16:35:40,703 [lib.api.process] INFO: 32-bit DLL to inject is C:\inqczlrb\dll\OQecjSq.dll, loader C:\inqczlrb\bin\sUENDCm.exe
2020-02-14 16:35:40,842 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xwiEBcIMA.
2020-02-14 16:35:40,905 [root] DEBUG: Loader: Injecting process 2668 (thread 3904) with C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:40,953 [root] DEBUG: Process image base: 0x00800000
2020-02-14 16:35:40,953 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\1047x576black.png" does not exist, skip.
2020-02-14 16:35:41,000 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:41,000 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png" does not exist, skip.
2020-02-14 16:35:41,062 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-02-14 16:35:41,062 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:41,155 [root] DEBUG: Successfully injected DLL C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:41,155 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:41,265 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2668
2020-02-14 16:35:41,265 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:41,328 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:41,328 [root] INFO: Announced 32-bit process name: bcdedit.exe pid: 2668
2020-02-14 16:35:41,328 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-02-14 16:35:41,328 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-02-14 16:35:41,328 [lib.api.process] INFO: 32-bit DLL to inject is C:\inqczlrb\dll\OQecjSq.dll, loader C:\inqczlrb\bin\sUENDCm.exe
2020-02-14 16:35:41,390 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:41,483 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xwiEBcIMA.
2020-02-14 16:35:41,483 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:41,578 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png" does not exist, skip.
2020-02-14 16:35:41,578 [root] DEBUG: Loader: Injecting process 2668 (thread 3904) with C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:41,578 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png" does not exist, skip.
2020-02-14 16:35:41,640 [root] DEBUG: Process image base: 0x00800000
2020-02-14 16:35:41,703 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:41,703 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png" does not exist, skip.
2020-02-14 16:35:41,812 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:41,812 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-02-14 16:35:41,812 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:41,858 [root] DEBUG: Successfully injected DLL C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:41,875 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:41,921 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2668
2020-02-14 16:35:42,015 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:42,078 [root] DEBUG: Terminate processes on terminate_event disabled.
2020-02-14 16:35:42,078 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:42,140 [root] DEBUG: Capture of extracted payloads enabled.
2020-02-14 16:35:42,187 [root] DEBUG: Process dumps disabled.
2020-02-14 16:35:42,312 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:42,375 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png" does not exist, skip.
2020-02-14 16:35:42,375 [root] INFO: Disabling sleep skipping.
2020-02-14 16:35:42,483 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png" does not exist, skip.
2020-02-14 16:35:42,483 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-02-14 16:35:42,578 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:42,578 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 2668 at 0x6d010000, image base 0x800000, stack from 0x176000-0x180000
2020-02-14 16:35:42,625 [root] DEBUG: Commandline: C:\Users\Rebecca\AppData\Local\Temp\bcdedit  \set {default} bootstatuspolicy ignoreallfailures.
2020-02-14 16:35:42,671 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:42,671 [root] DEBUG: WoW64 not detected.
2020-02-14 16:35:42,733 [root] DEBUG: ExtractionInit: Debugger initialised.
2020-02-14 16:35:42,733 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:42,733 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:42,828 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00800000.
2020-02-14 16:35:42,828 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:42,921 [root] DEBUG: AddTrackedRegion: New region at 0x00800000 size 0x1000 added to tracked regions: EntryPoint 0x12670, Entropy 5.195208e+00
2020-02-14 16:35:42,921 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:43,015 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png" does not exist, skip.
2020-02-14 16:35:43,015 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-02-14 16:35:43,062 [root] INFO: Added new process to list with pid: 2668
2020-02-14 16:35:43,062 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png" does not exist, skip.
2020-02-14 16:35:43,062 [root] INFO: Monitor successfully loaded in process with pid 2668.
2020-02-14 16:35:43,108 [root] DEBUG: DLL unloaded from 0x75EB0000.
2020-02-14 16:35:43,171 [root] DEBUG: DLL unloaded from 0x00800000.
2020-02-14 16:35:43,171 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png" does not exist, skip.
2020-02-14 16:35:43,233 [root] DEBUG: NtTerminateProcess hook: Processing tracked regions before shutdown (process 2668).
2020-02-14 16:35:43,233 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png" does not exist, skip.
2020-02-14 16:35:43,296 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png" does not exist, skip.
2020-02-14 16:35:43,296 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-02-14 16:35:43,296 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png" does not exist, skip.
2020-02-14 16:35:43,342 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00800000.
2020-02-14 16:35:43,342 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png" does not exist, skip.
2020-02-14 16:35:43,405 [root] DEBUG: ProcessImageBase: EP 0x00012670 image base 0x00800000 size 0x0 entropy 5.196700e+00.
2020-02-14 16:35:43,405 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png" does not exist, skip.
2020-02-14 16:35:43,500 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png" does not exist, skip.
2020-02-14 16:35:43,500 [root] DEBUG: set_caller_info: Adding region at 0x758B0000 to caller regions list (ntdll::NtClose).
2020-02-14 16:35:43,592 [root] DEBUG: DLL unloaded from 0x762A0000.
2020-02-14 16:35:43,592 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png" does not exist, skip.
2020-02-14 16:35:43,640 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png" does not exist, skip.
2020-02-14 16:35:43,640 [root] DEBUG: NtTerminateProcess hook: Processing tracked regions before shutdown (process 2668).
2020-02-14 16:35:43,687 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png" does not exist, skip.
2020-02-14 16:35:43,687 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-02-14 16:35:43,750 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00800000.
2020-02-14 16:35:43,750 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png" does not exist, skip.
2020-02-14 16:35:43,796 [root] DEBUG: ProcessImageBase: EP 0x00012670 image base 0x00800000 size 0x0 entropy 5.196700e+00.
2020-02-14 16:35:43,796 [root] WARNING: Unable to access file at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.lockbit": [Errno 13] Permission denied: u'C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.lockbit'
2020-02-14 16:35:43,842 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv" does not exist, skip.
2020-02-14 16:35:43,842 [root] INFO: Notified of termination of process with pid 2668.
2020-02-14 16:35:44,030 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv" does not exist, skip.
2020-02-14 16:35:44,030 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv" does not exist, skip.
2020-02-14 16:35:44,030 [root] INFO: Announced 32-bit process name: bcdedit.exe pid: 2384
2020-02-14 16:35:44,078 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-02-14 16:35:44,078 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-02-14 16:35:44,092 [lib.api.process] INFO: 32-bit DLL to inject is C:\inqczlrb\dll\OQecjSq.dll, loader C:\inqczlrb\bin\sUENDCm.exe
2020-02-14 16:35:44,280 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv" does not exist, skip.
2020-02-14 16:35:44,280 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xwiEBcIMA.
2020-02-14 16:35:44,280 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv" does not exist, skip.
2020-02-14 16:35:44,280 [root] DEBUG: Loader: Injecting process 2384 (thread 3052) with C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:44,375 [root] DEBUG: Process image base: 0x00470000
2020-02-14 16:35:44,375 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv" does not exist, skip.
2020-02-14 16:35:44,390 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:44,467 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-02-14 16:35:44,467 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv" does not exist, skip.
2020-02-14 16:35:44,500 [root] DEBUG: Successfully injected DLL C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:44,562 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2384
2020-02-14 16:35:44,578 [root] INFO: Announced 32-bit process name: bcdedit.exe pid: 2384
2020-02-14 16:35:44,578 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-02-14 16:35:44,578 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-02-14 16:35:44,578 [lib.api.process] INFO: 32-bit DLL to inject is C:\inqczlrb\dll\OQecjSq.dll, loader C:\inqczlrb\bin\sUENDCm.exe
2020-02-14 16:35:44,750 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xwiEBcIMA.
2020-02-14 16:35:44,750 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv" does not exist, skip.
2020-02-14 16:35:44,780 [root] DEBUG: Loader: Injecting process 2384 (thread 3052) with C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:44,812 [root] DEBUG: Process image base: 0x00470000
2020-02-14 16:35:44,890 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:44,937 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-02-14 16:35:44,937 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv" does not exist, skip.
2020-02-14 16:35:44,953 [root] DEBUG: Successfully injected DLL C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:45,046 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2384
2020-02-14 16:35:45,046 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground_PAL.wmv" does not exist, skip.
2020-02-14 16:35:45,125 [root] DEBUG: Terminate processes on terminate_event disabled.
2020-02-14 16:35:45,125 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png" does not exist, skip.
2020-02-14 16:35:45,203 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576black.png" does not exist, skip.
2020-02-14 16:35:45,203 [root] DEBUG: Capture of extracted payloads enabled.
2020-02-14 16:35:45,217 [root] DEBUG: Process dumps disabled.
2020-02-14 16:35:45,217 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png" does not exist, skip.
2020-02-14 16:35:45,296 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png" does not exist, skip.
2020-02-14 16:35:45,328 [root] INFO: Disabling sleep skipping.
2020-02-14 16:35:45,328 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png" does not exist, skip.
2020-02-14 16:35:45,405 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png" does not exist, skip.
2020-02-14 16:35:45,405 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-02-14 16:35:45,437 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 2384 at 0x6d010000, image base 0x470000, stack from 0x66000-0x70000
2020-02-14 16:35:45,437 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:45,500 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:45,500 [root] DEBUG: Commandline: C:\Users\Rebecca\AppData\Local\Temp\bcdedit  \set {default} recoveryenabled no.
2020-02-14 16:35:45,530 [root] DEBUG: WoW64 not detected.
2020-02-14 16:35:45,530 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:45,592 [root] DEBUG: ExtractionInit: Debugger initialised.
2020-02-14 16:35:45,592 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:45,625 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00470000.
2020-02-14 16:35:45,625 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:45,703 [root] DEBUG: AddTrackedRegion: New region at 0x00470000 size 0x1000 added to tracked regions: EntryPoint 0x12670, Entropy 5.194196e+00
2020-02-14 16:35:45,703 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:45,717 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-02-14 16:35:45,780 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png" does not exist, skip.
2020-02-14 16:35:45,780 [root] INFO: Added new process to list with pid: 2384
2020-02-14 16:35:45,780 [root] INFO: Monitor successfully loaded in process with pid 2384.
2020-02-14 16:35:45,812 [root] DEBUG: DLL unloaded from 0x75EB0000.
2020-02-14 16:35:45,875 [root] DEBUG: DLL unloaded from 0x00470000.
2020-02-14 16:35:45,875 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png" does not exist, skip.
2020-02-14 16:35:45,890 [root] DEBUG: NtTerminateProcess hook: Processing tracked regions before shutdown (process 2384).
2020-02-14 16:35:45,890 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png" does not exist, skip.
2020-02-14 16:35:45,967 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-02-14 16:35:45,967 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png" does not exist, skip.
2020-02-14 16:35:45,983 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00470000.
2020-02-14 16:35:45,983 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png" does not exist, skip.
2020-02-14 16:35:46,046 [root] DEBUG: ProcessImageBase: EP 0x00012670 image base 0x00470000 size 0x0 entropy 5.195716e+00.
2020-02-14 16:35:46,046 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png" does not exist, skip.
2020-02-14 16:35:46,078 [root] DEBUG: set_caller_info: Adding region at 0x758B0000 to caller regions list (ntdll::NtClose).
2020-02-14 16:35:46,155 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-previous-static.png" does not exist, skip.
2020-02-14 16:35:46,155 [root] DEBUG: DLL unloaded from 0x762A0000.
2020-02-14 16:35:46,171 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png" does not exist, skip.
2020-02-14 16:35:46,171 [root] DEBUG: NtTerminateProcess hook: Processing tracked regions before shutdown (process 2384).
2020-02-14 16:35:46,233 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-02-14 16:35:46,233 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png" does not exist, skip.
2020-02-14 16:35:46,265 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00470000.
2020-02-14 16:35:46,265 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png" does not exist, skip.
2020-02-14 16:35:46,342 [root] DEBUG: ProcessImageBase: EP 0x00012670 image base 0x00470000 size 0x0 entropy 5.195716e+00.
2020-02-14 16:35:46,342 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png" does not exist, skip.
2020-02-14 16:35:46,358 [root] INFO: Notified of termination of process with pid 2384.
2020-02-14 16:35:46,515 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png" does not exist, skip.
2020-02-14 16:35:46,703 [root] INFO: Announced 32-bit process name: wbadmin.exe pid: 3316
2020-02-14 16:35:46,765 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-02-14 16:35:46,765 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-02-14 16:35:46,765 [lib.api.process] INFO: 32-bit DLL to inject is C:\inqczlrb\dll\OQecjSq.dll, loader C:\inqczlrb\bin\sUENDCm.exe
2020-02-14 16:35:46,875 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xwiEBcIMA.
2020-02-14 16:35:46,875 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv" does not exist, skip.
2020-02-14 16:35:46,890 [root] DEBUG: Loader: Injecting process 3316 (thread 3348) with C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:46,921 [root] DEBUG: Process image base: 0x00310000
2020-02-14 16:35:46,983 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:47,078 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-02-14 16:35:47,092 [root] DEBUG: Successfully injected DLL C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:47,092 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png" does not exist, skip.
2020-02-14 16:35:47,125 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3316
2020-02-14 16:35:47,265 [root] INFO: Announced 32-bit process name: wbadmin.exe pid: 3316
2020-02-14 16:35:47,265 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-02-14 16:35:47,265 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-02-14 16:35:47,265 [lib.api.process] INFO: 32-bit DLL to inject is C:\inqczlrb\dll\OQecjSq.dll, loader C:\inqczlrb\bin\sUENDCm.exe
2020-02-14 16:35:47,358 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xwiEBcIMA.
2020-02-14 16:35:47,437 [root] DEBUG: Loader: Injecting process 3316 (thread 3348) with C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:47,453 [root] DEBUG: Process image base: 0x00310000
2020-02-14 16:35:47,467 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:47,546 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv" does not exist, skip.
2020-02-14 16:35:47,546 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-02-14 16:35:47,562 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv" does not exist, skip.
2020-02-14 16:35:47,562 [root] DEBUG: Successfully injected DLL C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:47,608 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3316
2020-02-14 16:35:47,608 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png" does not exist, skip.
2020-02-14 16:35:47,687 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png" does not exist, skip.
2020-02-14 16:35:47,733 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv" does not exist, skip.
2020-02-14 16:35:47,812 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png" does not exist, skip.
2020-02-14 16:35:47,812 [root] DEBUG: Terminate processes on terminate_event disabled.
2020-02-14 16:35:47,858 [root] DEBUG: Capture of extracted payloads enabled.
2020-02-14 16:35:47,858 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png" does not exist, skip.
2020-02-14 16:35:47,937 [root] DEBUG: Process dumps disabled.
2020-02-14 16:35:47,937 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png" does not exist, skip.
2020-02-14 16:35:47,983 [root] INFO: Disabling sleep skipping.
2020-02-14 16:35:47,983 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv" does not exist, skip.
2020-02-14 16:35:48,078 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-02-14 16:35:48,078 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv" does not exist, skip.
2020-02-14 16:35:48,078 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 3316 at 0x6d010000, image base 0x310000, stack from 0xa6000-0xb0000
2020-02-14 16:35:48,155 [root] DEBUG: Commandline: C:\Users\Rebecca\AppData\Local\Temp\wbadmin  delete catalog -quiet.
2020-02-14 16:35:48,250 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv" does not exist, skip.
2020-02-14 16:35:48,250 [root] DEBUG: WoW64 not detected.
2020-02-14 16:35:48,280 [root] DEBUG: ExtractionInit: Debugger initialised.
2020-02-14 16:35:48,296 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv" does not exist, skip.
2020-02-14 16:35:48,375 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00310000.
2020-02-14 16:35:48,375 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png" does not exist, skip.
2020-02-14 16:35:48,375 [root] DEBUG: AddTrackedRegion: New region at 0x00310000 size 0x1000 added to tracked regions: EntryPoint 0x2666c, Entropy 6.411011e+00
2020-02-14 16:35:48,421 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png" does not exist, skip.
2020-02-14 16:35:48,421 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-02-14 16:35:48,500 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png" does not exist, skip.
2020-02-14 16:35:48,500 [root] INFO: Added new process to list with pid: 3316
2020-02-14 16:35:48,515 [root] INFO: Monitor successfully loaded in process with pid 3316.
2020-02-14 16:35:48,546 [root] DEBUG: DLL loaded at 0x74950000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32 (0x19e000 bytes).
2020-02-14 16:35:48,546 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png" does not exist, skip.
2020-02-14 16:35:48,640 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:48,687 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:48,717 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:48,842 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:48,858 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_ButtonGraphic.png" does not exist, skip.
2020-02-14 16:35:48,858 [root] DEBUG: DLL loaded at 0x75920000: C:\Windows\system32\CRYPTBASE (0xc000 bytes).
2020-02-14 16:35:48,967 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png" does not exist, skip.
2020-02-14 16:35:48,967 [root] DEBUG: DLL loaded at 0x75D70000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2020-02-14 16:35:48,983 [root] DEBUG: DLL loaded at 0x753F0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-02-14 16:35:49,092 [root] DEBUG: DLL loaded at 0x75180000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-02-14 16:35:49,092 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png" does not exist, skip.
2020-02-14 16:35:49,108 [root] DEBUG: DLL loaded at 0x75990000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-02-14 16:35:49,108 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png" does not exist, skip.
2020-02-14 16:35:49,265 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png" does not exist, skip.
2020-02-14 16:35:49,375 [root] DEBUG: DLL unloaded from 0x75E00000.
2020-02-14 16:35:49,375 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png" does not exist, skip.
2020-02-14 16:35:49,608 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\Parity.fx" does not exist, skip.
2020-02-14 16:35:49,608 [root] WARNING: File at path "C:\Program Files\DVD Maker\Shared\Filters.xml" does not exist, skip.
2020-02-14 16:35:49,842 [root] WARNING: File at path "C:\Program Files\DVD Maker\soniccolorconverter.ax" does not exist, skip.
2020-02-14 16:35:50,030 [root] WARNING: File at path "C:\Program Files\DVD Maker\sonicsptransform.ax" does not exist, skip.
2020-02-14 16:35:50,046 [root] INFO: Announced starting service "wbengine"
2020-02-14 16:35:50,046 [root] INFO: Attaching to Service Control Manager (services.exe - pid 444)
2020-02-14 16:35:50,062 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-02-14 16:35:50,062 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-02-14 16:35:50,062 [lib.api.process] INFO: 32-bit DLL to inject is C:\inqczlrb\dll\OQecjSq.dll, loader C:\inqczlrb\bin\sUENDCm.exe
2020-02-14 16:35:50,171 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xwiEBcIMA.
2020-02-14 16:35:50,250 [root] DEBUG: Loader: Injecting process 444 (thread 0) with C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:50,280 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2020-02-14 16:35:50,280 [root] DEBUG: Terminate processes on terminate_event disabled.
2020-02-14 16:35:50,375 [root] DEBUG: Capture of extracted payloads enabled.
2020-02-14 16:35:50,390 [root] DEBUG: Process dumps disabled.
2020-02-14 16:35:50,515 [root] INFO: Disabling sleep skipping.
2020-02-14 16:35:50,530 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 444 at 0x6d010000, image base 0xc90000, stack from 0xb56000-0xb60000
2020-02-14 16:35:50,530 [root] DEBUG: Commandline: C:\Windows\System32\services.exe.
2020-02-14 16:35:50,625 [root] DEBUG: WoW64 not detected.
2020-02-14 16:35:50,625 [root] DEBUG: ExtractionInit: Debugger initialised.
2020-02-14 16:35:50,717 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00C90000.
2020-02-14 16:35:50,733 [root] DEBUG: AddTrackedRegion: New region at 0x00C90000 size 0x1000 added to tracked regions: EntryPoint 0x13882, Entropy 6.347020e+00
2020-02-14 16:35:50,828 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-02-14 16:35:50,828 [root] INFO: Added new process to list with pid: 444
2020-02-14 16:35:50,828 [root] INFO: Monitor successfully loaded in process with pid 444.
2020-02-14 16:35:50,921 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-02-14 16:35:50,921 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-02-14 16:35:50,937 [root] DEBUG: Successfully injected DLL C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:51,125 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Custom Highlighting\black_from_Fonarev.farconfig" does not exist, skip.
2020-02-14 16:35:51,140 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Custom Highlighting\black_from_july.farconfig" does not exist, skip.
2020-02-14 16:35:51,265 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Custom Highlighting\black_from_Myodov.farconfig" does not exist, skip.
2020-02-14 16:35:51,390 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Custom Highlighting\Colors_from_admin_essp_ru.farconfig" does not exist, skip.
2020-02-14 16:35:51,500 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Custom Highlighting\Colors_from_Gernichenko.farconfig" does not exist, skip.
2020-02-14 16:35:51,608 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Custom Highlighting\Colors_from_Sadovoj.farconfig" does not exist, skip.
2020-02-14 16:35:51,703 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Custom Highlighting\Descript.ion" does not exist, skip.
2020-02-14 16:35:51,717 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Custom Highlighting\dn_like.farconfig" does not exist, skip.
2020-02-14 16:35:51,828 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Custom Highlighting\FARColors242.farconfig" does not exist, skip.
2020-02-14 16:35:51,937 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Custom Highlighting\GreenMile.farconfig" does not exist, skip.
2020-02-14 16:35:52,046 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Custom Highlighting\hell.farconfig" does not exist, skip.
2020-02-14 16:35:52,530 [root] INFO: Announced 32-bit process name: wbengine.exe pid: 2116
2020-02-14 16:35:52,546 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-02-14 16:35:52,546 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-02-14 16:35:52,546 [lib.api.process] INFO: 32-bit DLL to inject is C:\inqczlrb\dll\OQecjSq.dll, loader C:\inqczlrb\bin\sUENDCm.exe
2020-02-14 16:35:52,655 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Custom Highlighting\nc5pal2.farconfig" does not exist, skip.
2020-02-14 16:35:52,655 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xwiEBcIMA.
2020-02-14 16:35:52,750 [root] DEBUG: Loader: Injecting process 2116 (thread 3248) with C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:52,765 [root] DEBUG: Process image base: 0x00E10000
2020-02-14 16:35:52,890 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:53,092 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-02-14 16:35:53,108 [root] DEBUG: Successfully injected DLL C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:53,108 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2116
2020-02-14 16:35:53,546 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Custom Highlighting\Rodion_Doroshkevich.farconfig" does not exist, skip.
2020-02-14 16:35:53,546 [root] INFO: Announced 32-bit process name: wbengine.exe pid: 2116
2020-02-14 16:35:53,546 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-02-14 16:35:53,546 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-02-14 16:35:53,546 [lib.api.process] INFO: 32-bit DLL to inject is C:\inqczlrb\dll\OQecjSq.dll, loader C:\inqczlrb\bin\sUENDCm.exe
2020-02-14 16:35:53,655 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xwiEBcIMA.
2020-02-14 16:35:53,655 [root] DEBUG: Loader: Injecting process 2116 (thread 3248) with C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:53,717 [root] DEBUG: Process image base: 0x00E10000
2020-02-14 16:35:53,733 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:53,733 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-02-14 16:35:53,812 [root] DEBUG: Successfully injected DLL C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:35:53,828 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2116
2020-02-14 16:35:54,671 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Custom Highlighting\VaxColors.farconfig" does not exist, skip.
2020-02-14 16:35:55,265 [root] DEBUG: Terminate processes on terminate_event disabled.
2020-02-14 16:35:55,265 [root] DEBUG: Capture of extracted payloads enabled.
2020-02-14 16:35:55,328 [root] DEBUG: Process dumps disabled.
2020-02-14 16:35:55,421 [root] INFO: Disabling sleep skipping.
2020-02-14 16:35:55,483 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-02-14 16:35:55,483 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Default Highlighting\black_from_Fonarev.farconfig" does not exist, skip.
2020-02-14 16:35:55,483 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 2116 at 0x6d010000, image base 0xe10000, stack from 0x66000-0x70000
2020-02-14 16:35:55,546 [root] DEBUG: Commandline: C:\Windows\System32\"C:\Windows\system32\wbengine.exe".
2020-02-14 16:35:55,592 [root] DEBUG: WoW64 not detected.
2020-02-14 16:35:55,608 [root] DEBUG: ExtractionInit: Debugger initialised.
2020-02-14 16:35:55,671 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00E10000.
2020-02-14 16:35:55,717 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Default Highlighting\black_from_july.farconfig" does not exist, skip.
2020-02-14 16:35:56,030 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Default Highlighting\black_from_Myodov.farconfig" does not exist, skip.
2020-02-14 16:35:56,765 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Default Highlighting\Colors_from_admin_essp_ru.farconfig" does not exist, skip.
2020-02-14 16:35:57,015 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Default Highlighting\Colors_from_Gernichenko.farconfig" does not exist, skip.
2020-02-14 16:35:57,250 [root] DEBUG: AddTrackedRegion: New region at 0x00E10000 size 0x1000 added to tracked regions: EntryPoint 0x6f530, Entropy 6.627694e+00
2020-02-14 16:35:57,250 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Default Highlighting\Colors_from_Sadovoj.farconfig" does not exist, skip.
2020-02-14 16:35:57,250 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Default Highlighting\Descript.ion" does not exist, skip.
2020-02-14 16:35:57,296 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-02-14 16:35:57,296 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Default Highlighting\dn_like.farconfig" does not exist, skip.
2020-02-14 16:35:57,312 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Default Highlighting\FARColors242.farconfig" does not exist, skip.
2020-02-14 16:35:57,312 [root] INFO: Added new process to list with pid: 2116
2020-02-14 16:35:57,312 [root] INFO: Monitor successfully loaded in process with pid 2116.
2020-02-14 16:35:57,375 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Default Highlighting\GreenMile.farconfig" does not exist, skip.
2020-02-14 16:35:57,421 [root] DEBUG: DLL loaded at 0x75920000: C:\Windows\system32\CRYPTBASE (0xc000 bytes).
2020-02-14 16:35:57,421 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Default Highlighting\hell.farconfig" does not exist, skip.
2020-02-14 16:35:57,515 [root] DEBUG: CreateThread: Initialising breakpoints for thread 1348.
2020-02-14 16:35:57,515 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Default Highlighting\nc5pal2.farconfig" does not exist, skip.
2020-02-14 16:35:57,515 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Default Highlighting\Rodion_Doroshkevich.farconfig" does not exist, skip.
2020-02-14 16:35:57,562 [root] DEBUG: DLL unloaded from 0x77CB0000.
2020-02-14 16:35:57,562 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Default Highlighting\VaxColors.farconfig" does not exist, skip.
2020-02-14 16:35:57,608 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Colors\Descript.ion" does not exist, skip.
2020-02-14 16:35:57,687 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Descript.ion" does not exist, skip.
2020-02-14 16:35:57,703 [root] DEBUG: DLL loaded at 0x754C0000: C:\Windows\system32\bcryptprimitives (0x3d000 bytes).
2020-02-14 16:35:57,780 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\AltMenu.lua" does not exist, skip.
2020-02-14 16:35:57,812 [root] DEBUG: DLL loaded at 0x73850000: C:\Windows\system32\fveapi (0x58000 bytes).
2020-02-14 16:35:57,812 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\AltScreens.lua" does not exist, skip.
2020-02-14 16:35:57,842 [root] DEBUG: DLL loaded at 0x73840000: C:\Windows\system32\tbs (0x7000 bytes).
2020-02-14 16:35:57,842 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\AltSearch.lua" does not exist, skip.
2020-02-14 16:35:57,905 [root] DEBUG: DLL loaded at 0x73830000: C:\Windows\system32\FVECERTS (0x8000 bytes).
2020-02-14 16:35:57,905 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\AltX.lua" does not exist, skip.
2020-02-14 16:35:57,953 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\CtrlDel.lua" does not exist, skip.
2020-02-14 16:35:57,953 [root] DEBUG: DLL loaded at 0x75C10000: C:\Windows\system32\CRYPT32 (0x122000 bytes).
2020-02-14 16:35:57,983 [root] DEBUG: DLL loaded at 0x75A30000: C:\Windows\system32\MSASN1 (0xc000 bytes).
2020-02-14 16:35:57,983 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\CtrlF10.lua" does not exist, skip.
2020-02-14 16:35:58,046 [root] DEBUG: DLL loaded at 0x75240000: C:\Windows\system32\LOGONCLI (0x22000 bytes).
2020-02-14 16:35:58,046 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Descript.ion" does not exist, skip.
2020-02-14 16:35:58,217 [root] DEBUG: DLL loaded at 0x71D20000: C:\Windows\system32\cscapi (0xb000 bytes).
2020-02-14 16:35:58,233 [root] DEBUG: CreateThread: Initialising breakpoints for thread 3296.
2020-02-14 16:35:58,233 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Dialog.AltDown.lua" does not exist, skip.
2020-02-14 16:35:58,358 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Edit.Notepad.lua" does not exist, skip.
2020-02-14 16:35:58,358 [root] DEBUG: DLL loaded at 0x75D70000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2020-02-14 16:35:58,375 [root] DEBUG: DLL loaded at 0x753F0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-02-14 16:35:58,375 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Edit.OpenURL.lua" does not exist, skip.
2020-02-14 16:35:58,483 [root] DEBUG: DLL loaded at 0x75180000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-02-14 16:35:58,483 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Edit.SaveAndExit.lua" does not exist, skip.
2020-02-14 16:35:58,483 [root] DEBUG: DLL loaded at 0x75990000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-02-14 16:35:58,515 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Edit.SaveFile.lua" does not exist, skip.
2020-02-14 16:35:58,608 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Editor.ColorWord.moon" does not exist, skip.
2020-02-14 16:35:58,608 [root] DEBUG: CreateThread: Initialising breakpoints for thread 3728.
2020-02-14 16:35:58,625 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\F3.lua" does not exist, skip.
2020-02-14 16:35:58,750 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\F9DeactivateMenu.lua" does not exist, skip.
2020-02-14 16:35:58,780 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\F9Table.lua" does not exist, skip.
2020-02-14 16:35:58,890 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\OpeningLastFile.lua" does not exist, skip.
2020-02-14 16:35:58,905 [root] DEBUG: DLL loaded at 0x739D0000: C:\Windows\system32\blb_ps (0xa000 bytes).
2020-02-14 16:35:58,905 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Panel.AltBS.lua" does not exist, skip.
2020-02-14 16:35:59,000 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Panel.Apps.lua" does not exist, skip.
2020-02-14 16:35:59,015 [root] DEBUG: DLL loaded at 0x739D0000: C:\Windows\system32\blb_ps (0xa000 bytes).
2020-02-14 16:35:59,015 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Panel.BS.lua" does not exist, skip.
2020-02-14 16:35:59,046 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Panel.CtrlIns...lua" does not exist, skip.
2020-02-14 16:35:59,140 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Panel.CtrlLeft.lua" does not exist, skip.
2020-02-14 16:35:59,155 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Panel.CtrlQ.lua" does not exist, skip.
2020-02-14 16:35:59,171 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Panel.CtrlRight.lua" does not exist, skip.
2020-02-14 16:35:59,280 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Panel.CtrlShiftBackSlash.lua" does not exist, skip.
2020-02-14 16:35:59,842 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Panel.CtrlShiftPgUpDn.lua" does not exist, skip.
2020-02-14 16:35:59,858 [root] INFO: Announced 32-bit process name: vdsldr.exe pid: 2664
2020-02-14 16:35:59,953 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-02-14 16:35:59,953 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-02-14 16:35:59,967 [lib.api.process] INFO: 32-bit DLL to inject is C:\inqczlrb\dll\OQecjSq.dll, loader C:\inqczlrb\bin\sUENDCm.exe
2020-02-14 16:36:00,062 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xwiEBcIMA.
2020-02-14 16:36:00,062 [root] DEBUG: Loader: Injecting process 2664 (thread 2888) with C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:36:00,078 [root] DEBUG: Process image base: 0x00AF0000
2020-02-14 16:36:00,155 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:36:00,171 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-02-14 16:36:00,171 [root] DEBUG: Successfully injected DLL C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:36:00,265 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2664
2020-02-14 16:36:00,578 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Panel.Del.lua" does not exist, skip.
2020-02-14 16:36:00,578 [root] INFO: Announced 32-bit process name: vdsldr.exe pid: 2664
2020-02-14 16:36:00,592 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-02-14 16:36:00,592 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-02-14 16:36:00,592 [lib.api.process] INFO: 32-bit DLL to inject is C:\inqczlrb\dll\OQecjSq.dll, loader C:\inqczlrb\bin\sUENDCm.exe
2020-02-14 16:36:00,608 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Panel.Esc.lua" does not exist, skip.
2020-02-14 16:36:00,703 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Panel.EscKeyBar.lua" does not exist, skip.
2020-02-14 16:36:00,717 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xwiEBcIMA.
2020-02-14 16:36:00,717 [root] DEBUG: Loader: Injecting process 2664 (thread 2888) with C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:36:00,842 [root] DEBUG: Process image base: 0x00AF0000
2020-02-14 16:36:00,842 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Panel.JumpToSelectedFile.lua" does not exist, skip.
2020-02-14 16:36:00,875 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:36:00,890 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-02-14 16:36:00,983 [root] DEBUG: Successfully injected DLL C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:36:00,983 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2664
2020-02-14 16:36:01,092 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Panel.Lynx-mot.lua" does not exist, skip.
2020-02-14 16:36:01,108 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Panel.MouseWheelTilt.lua" does not exist, skip.
2020-02-14 16:36:01,203 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Panel.Numpad.lua" does not exist, skip.
2020-02-14 16:36:01,233 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Panel.SelectFromClipboard.lua" does not exist, skip.
2020-02-14 16:36:01,312 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Panel.SpaceToSelect.lua" does not exist, skip.
2020-02-14 16:36:01,342 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Search.CtrlIns.lua" does not exist, skip.
2020-02-14 16:36:01,453 [root] DEBUG: Terminate processes on terminate_event disabled.
2020-02-14 16:36:01,453 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\ShiftBS.lua" does not exist, skip.
2020-02-14 16:36:01,467 [root] DEBUG: Capture of extracted payloads enabled.
2020-02-14 16:36:01,578 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\ShiftF1.lua" does not exist, skip.
2020-02-14 16:36:01,608 [root] DEBUG: Process dumps disabled.
2020-02-14 16:36:01,608 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\ShiftTab.lua" does not exist, skip.
2020-02-14 16:36:01,703 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\Symlink.lua" does not exist, skip.
2020-02-14 16:36:01,703 [root] INFO: Disabling sleep skipping.
2020-02-14 16:36:01,733 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-02-14 16:36:01,733 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\UppercaseFolders.lua" does not exist, skip.
2020-02-14 16:36:01,812 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 2664 at 0x6d010000, image base 0xaf0000, stack from 0x246000-0x250000
2020-02-14 16:36:01,812 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\View.CtrlUpDown.lua" does not exist, skip.
2020-02-14 16:36:01,828 [root] DEBUG: Commandline: C:\Windows\System32\vdsldr.exe -Embedding.
2020-02-14 16:36:01,858 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\View.NextPrevFile.lua" does not exist, skip.
2020-02-14 16:36:01,858 [root] DEBUG: WoW64 not detected.
2020-02-14 16:36:01,953 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\View.PgDn.lua" does not exist, skip.
2020-02-14 16:36:01,953 [root] DEBUG: ExtractionInit: Debugger initialised.
2020-02-14 16:36:01,983 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\View.ShiftInsSearch.lua" does not exist, skip.
2020-02-14 16:36:01,983 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00AF0000.
2020-02-14 16:36:02,078 [root] DEBUG: AddTrackedRegion: New region at 0x00AF0000 size 0x1000 added to tracked regions: EntryPoint 0x3cc6, Entropy 4.442858e+00
2020-02-14 16:36:02,078 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\View.Space.lua" does not exist, skip.
2020-02-14 16:36:02,203 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-02-14 16:36:02,203 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Macros\WheelScreenSwitch.lua" does not exist, skip.
2020-02-14 16:36:02,203 [root] INFO: Added new process to list with pid: 2664
2020-02-14 16:36:02,217 [root] INFO: Monitor successfully loaded in process with pid 2664.
2020-02-14 16:36:02,421 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\README.TXT" does not exist, skip.
2020-02-14 16:36:02,421 [root] DEBUG: DLL loaded at 0x75920000: C:\Windows\System32\CRYPTBASE (0xc000 bytes).
2020-02-14 16:36:02,437 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2164.
2020-02-14 16:36:02,530 [root] DEBUG: DLL unloaded from 0x77CB0000.
2020-02-14 16:36:02,640 [root] DEBUG: DLL loaded at 0x75D70000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2020-02-14 16:36:02,640 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\SetUp\Default165.farconfig" does not exist, skip.
2020-02-14 16:36:02,671 [root] DEBUG: DLL loaded at 0x753F0000: C:\Windows\System32\CRYPTSP (0x17000 bytes).
2020-02-14 16:36:02,671 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\SetUp\Descript.ion" does not exist, skip.
2020-02-14 16:36:02,765 [root] DEBUG: DLL loaded at 0x75180000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-02-14 16:36:02,765 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\SetUp\Executor.4NT.farconfig" does not exist, skip.
2020-02-14 16:36:02,780 [root] DEBUG: DLL loaded at 0x75990000: C:\Windows\System32\RpcRtRemote (0xe000 bytes).
2020-02-14 16:36:02,780 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\SetUp\Executor.CMD.farconfig" does not exist, skip.
2020-02-14 16:36:02,812 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\SetUp\Executor.COMMAND.farconfig" does not exist, skip.
2020-02-14 16:36:02,890 [root] DEBUG: CreateThread: Initialising breakpoints for thread 3100.
2020-02-14 16:36:03,108 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\SetUp\WindowsGUI.farconfig" does not exist, skip.
2020-02-14 16:36:03,233 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\SetUp\WindowsGUI.lua" does not exist, skip.
2020-02-14 16:36:03,265 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Shell\Descript.ion" does not exist, skip.
2020-02-14 16:36:03,358 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\Shell\FARHere.inf" does not exist, skip.
2020-02-14 16:36:03,358 [root] DEBUG: DLL loaded at 0x734C0000: C:\Windows\System32\vds_ps (0xf000 bytes).
2020-02-14 16:36:03,375 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\XLat\Descript.ion" does not exist, skip.
2020-02-14 16:36:03,405 [root] DEBUG: DLL loaded at 0x734C0000: C:\Windows\System32\vds_ps (0xf000 bytes).
2020-02-14 16:36:03,500 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\XLat\Russian\AltR.lua" does not exist, skip.
2020-02-14 16:36:03,515 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\XLat\Russian\Apps.lua" does not exist, skip.
2020-02-14 16:36:03,546 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\XLat\Russian\CtrlR.lua" does not exist, skip.
2020-02-14 16:36:03,640 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\XLat\Russian\CtrlShiftX.lua" does not exist, skip.
2020-02-14 16:36:03,655 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\XLat\Russian\Descript.ion" does not exist, skip.
2020-02-14 16:36:03,687 [root] WARNING: File at path "C:\Program Files\Far Manager\Addons\XLat\Russian\Qwerty.farconfig" does not exist, skip.
2020-02-14 16:36:04,092 [root] WARNING: File at path "C:\Program Files\Far Manager\changelog" does not exist, skip.
2020-02-14 16:36:04,312 [root] INFO: Announced starting service "vds"
2020-02-14 16:36:04,828 [root] WARNING: File at path "C:\Program Files\Far Manager\changelog_eng" does not exist, skip.
2020-02-14 16:36:04,953 [root] INFO: Announced 32-bit process name: vds.exe pid: 3804
2020-02-14 16:36:04,967 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-02-14 16:36:04,967 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-02-14 16:36:04,967 [lib.api.process] INFO: 32-bit DLL to inject is C:\inqczlrb\dll\OQecjSq.dll, loader C:\inqczlrb\bin\sUENDCm.exe
2020-02-14 16:36:05,062 [root] WARNING: File at path "C:\Program Files\Far Manager\Documentation\eng\Bug.Report.txt" does not exist, skip.
2020-02-14 16:36:05,092 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xwiEBcIMA.
2020-02-14 16:36:05,108 [root] WARNING: File at path "C:\Program Files\Far Manager\Documentation\eng\Far.FAQ.txt" does not exist, skip.
2020-02-14 16:36:05,125 [root] DEBUG: Loader: Injecting process 3804 (thread 3168) with C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:36:05,217 [root] WARNING: File at path "C:\Program Files\Far Manager\Documentation\eng\Plugins.Install.txt" does not exist, skip.
2020-02-14 16:36:05,217 [root] DEBUG: Process image base: 0x00280000
2020-02-14 16:36:05,233 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:36:05,233 [root] WARNING: File at path "C:\Program Files\Far Manager\Documentation\eng\Plugins.Review.txt" does not exist, skip.
2020-02-14 16:36:05,250 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-02-14 16:36:05,342 [root] WARNING: File at path "C:\Program Files\Far Manager\Documentation\eng\TechInfo.txt" does not exist, skip.
2020-02-14 16:36:05,342 [root] DEBUG: Successfully injected DLL C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:36:05,358 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3804
2020-02-14 16:36:05,358 [root] WARNING: File at path "C:\Program Files\Far Manager\Documentation\rus\Bug.Report.txt" does not exist, skip.
2020-02-14 16:36:05,405 [root] WARNING: File at path "C:\Program Files\Far Manager\Documentation\rus\Far.FAQ.txt" does not exist, skip.
2020-02-14 16:36:05,405 [root] INFO: Announced 32-bit process name: vds.exe pid: 3804
2020-02-14 16:36:05,405 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-02-14 16:36:05,405 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-02-14 16:36:05,405 [lib.api.process] INFO: 32-bit DLL to inject is C:\inqczlrb\dll\OQecjSq.dll, loader C:\inqczlrb\bin\sUENDCm.exe
2020-02-14 16:36:05,500 [root] WARNING: File at path "C:\Program Files\Far Manager\Documentation\rus\Plugins.Install.txt" does not exist, skip.
2020-02-14 16:36:05,515 [root] WARNING: File at path "C:\Program Files\Far Manager\Documentation\rus\Plugins.Review.txt" does not exist, skip.
2020-02-14 16:36:05,546 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xwiEBcIMA.
2020-02-14 16:36:05,546 [root] WARNING: File at path "C:\Program Files\Far Manager\Documentation\rus\TechInfo.txt" does not exist, skip.
2020-02-14 16:36:05,640 [root] DEBUG: Loader: Injecting process 3804 (thread 3168) with C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:36:05,640 [root] WARNING: File at path "C:\Program Files\Far Manager\Encyclopedia\FarEncyclopedia.ru.chm" does not exist, skip.
2020-02-14 16:36:05,671 [root] WARNING: File at path "C:\Program Files\Far Manager\Encyclopedia\luafar_manual.chm" does not exist, skip.
2020-02-14 16:36:05,671 [root] DEBUG: Process image base: 0x00280000
2020-02-14 16:36:05,703 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:36:05,703 [root] WARNING: File at path "C:\Program Files\Far Manager\Encyclopedia\macroapi_manual.en.chm" does not exist, skip.
2020-02-14 16:36:05,796 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-02-14 16:36:05,796 [root] WARNING: File at path "C:\Program Files\Far Manager\Encyclopedia\macroapi_manual.ru.chm" does not exist, skip.
2020-02-14 16:36:05,812 [root] DEBUG: Successfully injected DLL C:\inqczlrb\dll\OQecjSq.dll.
2020-02-14 16:36:05,828 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3804
2020-02-14 16:36:05,875 [root] WARNING: File at path "C:\Program Files\Far Manager\Far.map" does not exist, skip.
2020-02-14 16:36:06,030 [root] DEBUG: Terminate processes on terminate_event disabled.
2020-02-14 16:36:06,030 [root] WARNING: File at path "C:\Program Files\Far Manager\FarCze.lng" does not exist, skip.
2020-02-14 16:36:06,062 [root] DEBUG: Capture of extracted payloads enabled.
2020-02-14 16:36:06,062 [root] WARNING: File at path "C:\Program Files\Far Manager\FarEng.hlf" does not exist, skip.
2020-02-14 16:36:06,092 [root] DEBUG: Process dumps disabled.
2020-02-14 16:36:06,217 [root] INFO: Disabling sleep skipping.
2020-02-14 16:36:06,233 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-02-14 16:36:06,233 [root] DEBUG: DLL unloaded from 0x73BA0000.
2020-02-14 16:36:06,328 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 3804 at 0x6d010000, image base 0x280000, stack from 0xa6000-0xb0000
2020-02-14 16:36:06,358 [root] WARNING: File at path "C:\Program Files\Far Manager\FarGer.lng" does not exist, skip.
2020-02-14 16:36:06,342 [root] DEBUG: Commandline: C:\Windows\System32\vds.exe.
2020-02-14 16:36:06,342 [root] WARNING: File at path "C:\Program Files\Far Manager\FarEng.lng" does not exist, skip.
2020-02-14 16:36:06,358 [root] DEBUG: WoW64 not detected.
2020-02-14 16:36:06,453 [root] WARNING: File at path "C:\Program Files\Far Manager\FarHun.hlf" does not exist, skip.
2020-02-14 16:36:06,453 [root] DEBUG: ExtractionInit: Debugger initialised.
2020-02-14 16:36:06,483 [root] WARNING: File at path "C:\Program Files\Far Manager\FarHun.lng" does not exist, skip.
2020-02-14 16:36:06,483 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00280000.
2020-02-14 16:36:06,500 [root] DEBUG: AddTrackedRegion: New region at 0x00280000 size 0x1000 added to tracked regions: EntryPoint 0x632fc, Entropy 6.315863e+00
2020-02-14 16:36:06,500 [root] WARNING: File at path "C:\Program Files\Far Manager\FarIta.lng" does not exist, skip.
2020-02-14 16:36:06,592 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-02-14 16:36:06,592 [root] WARNING: File at path "C:\Program Files\Far Manager\FarPol.lng" does not exist, skip.
2020-02-14 16:36:06,608 [root] INFO: Added new process to list with pid: 3804
2020-02-14 16:36:06,608 [root] INFO: Monitor successfully loaded in process with pid 3804.
2020-02-14 16:36:06,733 [root] WARNING: File at path "C:\Program Files\Far Manager\FarRus.hlf" does not exist, skip.
2020-02-14 16:36:06,733 [root] DEBUG: CreateThread: Initialising breakpoints for thread 3904.
2020-02-14 16:36:06,733 [root] WARNING: File at path "C:\Program Files\Far Manager\FarRus.lng" does not exist, skip.
2020-02-14 16:36:06,750 [root] DEBUG: DLL unloaded from 0x77CB0000.
2020-02-14 16:36:06,750 [root] WARNING: File at path "C:\Program Files\Far Manager\FarSky.lng" does not exist, skip.
2020-02-14 16:36:06,780 [root] WARNING: File at path "C:\Program Files\Far Manager\FarSpa.lng" does not exist, skip.
2020-02-14 16:36:06,828 [root] WARNING: File at path "C:\Program Files\Far Manager\FarUkr.lng" does not exist, skip.
2020-02-14 16:36:06,937 [root] WARNING: File at path "C:\Program Files\Far Manager\FExcept\changelog" does not exist, skip.
2020-02-14 16:36:06,953 [root] WARNING: File at path "C:\Program Files\Far Manager\FExcept\SetFarExceptionHandler.farconfig" does not exist, skip.
2020-02-14 16:36:06,983 [root] WARNING: File at path "C:\Program Files\Far Manager\File_id.diz" does not exist, skip.
2020-02-14 16:36:14,453 [root] WARNING: File at path "C:\Program Files\Far Manager\luafar3.map" does not exist, skip.
2020-02-14 16:36:24,437 [root] DEBUG: DLL loaded at 0x6E360000: C:\Windows\system32\UEXFAT (0x14000 bytes).
2020-02-14 16:36:24,437 [root] WARNING: File at path "C:\Program Files\Far Manager\Plugins\Align\Align.map" does not exist, skip.
2020-02-14 16:36:29,515 [root] DEBUG: DLL unloaded from 0x72A80000.
2020-02-14 16:36:29,515 [root] DEBUG: DLL unloaded from 0x75E00000.
2020-02-14 16:36:34,530 [root] DEBUG: DLL unloaded from 0x753A0000.
2020-02-14 16:36:39,483 [root] WARNING: File at path "C:\Program Files\Far Manager\Plugins\Align\AlignEng.lng" does not exist, skip.
2020-02-14 16:36:39,483 [root] DEBUG: DLL unloaded from 0x73F40000.
2020-02-14 16:36:39,483 [root] DEBUG: DLL loaded at 0x6DD00000: C:\Windows\System32\ulib (0x1d000 bytes).
2020-02-14 16:36:44,483 [root] DEBUG: DLL unloaded from 0x76AC0000.
2020-02-14 16:36:44,483 [root] DEBUG: DLL unloaded from 0x76AC0000.
2020-02-14 16:36:44,483 [root] WARNING: File at path "C:\Program Files\Far Manager\Plugins\Align\AlignIta.lng" does not exist, skip.
2020-02-14 16:36:49,500 [root] DEBUG: DLL loaded at 0x6DC50000: C:\Windows\System32\ifsutil (0x27000 bytes).
2020-02-14 16:36:49,500 [root] DEBUG: DLL unloaded from 0x74F50000.
2020-02-14 16:36:49,500 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2140.
2020-02-14 16:36:49,500 [root] DEBUG: DLL unloaded from 0x00E10000.
2020-02-14 16:36:54,500 [root] DEBUG: DLL unloaded from 0x72A80000.
2020-02-14 16:36:54,500 [root] DEBUG: DLL unloaded from 0x76AC0000.
2020-02-14 16:36:54,500 [root] WARNING: File at path "C:\Program Files\Far Manager\Plugins\Align\AlignRus.lng" does not exist, skip.
2020-02-14 16:37:04,483 [root] DEBUG: DLL unloaded from 0x753B0000.
2020-02-14 16:37:04,483 [root] DEBUG: DLL loaded at 0x6DC20000: C:\Windows\system32\UUDF (0x24000 bytes).
2020-02-14 16:37:04,483 [root] DEBUG: DLL unloaded from 0x77CB0000.
2020-02-14 16:37:04,483 [root] DEBUG: DLL unloaded from 0x753B0000.
2020-02-14 16:37:09,483 [root] DEBUG: DLL unloaded from 0x6D730000.
2020-02-14 16:37:09,483 [root] WARNING: File at path "C:\Program Files\Far Manager\Plugins\Align\AlignSky.lng" does not exist, skip.
2020-02-14 16:37:19,453 [root] DEBUG: DLL unloaded from 0x734D0000.
2020-02-14 16:37:19,453 [root] DEBUG: DLL unloaded from 0x74090000.
2020-02-14 16:37:19,453 [root] DEBUG: DLL loaded at 0x6CE40000: C:\Windows\system32\UNTFS (0x58000 bytes).
2020-02-14 16:37:24,453 [root] DEBUG: DLL unloaded from 0x72480000.
2020-02-14 16:37:24,453 [root] DEBUG: DLL unloaded from 0x72A80000.
2020-02-14 16:37:24,467 [root] DEBUG: DLL unloaded from 0x76AC0000.
2020-02-14 16:37:24,467 [root] WARNING: File at path "C:\Program Files\Far Manager\Plugins\Align\AlignSpa.lng" does not exist, skip.
2020-02-14 16:37:34,453 [root] WARNING: File at path "C:\Program Files\Far Manager\Plugins\Align\changelog" does not exist, skip.
2020-02-14 16:37:34,453 [root] DEBUG: DLL unloaded from 0x6EB00000.
2020-02-14 16:37:34,453 [root] DEBUG: DLL unloaded from 0x6DD00000.
2020-02-14 16:37:39,467 [root] DEBUG: DLL unloaded from 0x73400000.
2020-02-14 16:37:39,467 [root] DEBUG: DLL unloaded from 0x6EAD0000.
2020-02-14 16:37:49,453 [root] DEBUG: DLL unloaded from 0x753B0000.
2020-02-14 16:37:49,453 [root] DEBUG: DLL unloaded from 0x72C50000.
2020-02-14 16:37:49,453 [root] DEBUG: NtTerminateProcess hook: Processing tracked regions before shutdown (process 444).
2020-02-14 16:37:49,453 [root] DEBUG: DLL loaded at 0x734D0000: C:\Windows\system32\UFAT (0x1a000 bytes).
2020-02-14 16:37:54,437 [root] INFO: Analysis timeout hit (200 seconds), terminating analysis.
2020-02-14 16:37:54,453 [root] WARNING: File at path "C:\Program Files\Far Manager\Plugins\ArcLite\7z.sfx" does not exist, skip.
2020-02-14 16:37:54,453 [root] DEBUG: DLL unloaded from 0x6EA70000.
2020-02-14 16:37:54,453 [root] DEBUG: DLL unloaded from 0x72A80000.
2020-02-14 16:37:54,467 [root] INFO: Created shutdown mutex.
2020-02-14 16:38:04,453 [root] DEBUG: DLL unloaded from 0x73330000.
2020-02-14 16:38:04,453 [root] DEBUG: DLL unloaded from 0x73BA0000.
2020-02-14 16:38:04,453 [lib.api.process] INFO: Terminate event set for process 2360
2020-02-14 16:38:04,453 [root] DEBUG: DLL loaded at 0x72A30000: C:\Windows\system32\fmifs (0x9000 bytes).
2020-02-14 16:38:04,453 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-02-14 16:38:09,437 [root] WARNING: File at path "C:\Program Files\Far Manager\Plugins\ArcLite\7zCon.sfx" does not exist, skip.
2020-02-14 16:38:09,437 [root] DEBUG: Terminate Event: Processing tracked regions before shutdown (process 2360).
2020-02-14 16:38:14,453 [root] DEBUG: DLL loaded at 0x75920000: C:\Windows\System32\CRYPTBASE (0xc000 bytes).
2020-02-14 16:38:14,453 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00C90000.
2020-02-14 16:38:14,453 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-02-14 16:38:14,453 [root] DEBUG: NtTerminateProcess hook: Processing tracked regions before shutdown (process 2296).
2020-02-14 16:38:24,453 [root] DEBUG: DLL unloaded from 0x72A80000.
2020-02-14 16:38:24,453 [root] WARNING: File at path "C:\Program Files\Far Manager\Plugins\ArcLite\7zS2.sfx" does not exist, skip.
2020-02-14 16:38:29,453 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-02-14 16:38:29,453 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-02-14 16:38:29,453 [root] DEBUG: DLL loaded at 0x75D70000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2020-02-14 16:38:29,453 [root] DEBUG: ProcessImageBase: EP 0x00013882 image base 0x00C90000 size 0x0 entropy 6.347011e+00.
2020-02-14 16:38:39,453 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01360000.
2020-02-14 16:38:39,453 [root] DEBUG: ProcessImageBase: EP 0x0001B2B0 image base 0x00400000 size 0x0 entropy 6.234451e+00.
2020-02-14 16:38:39,453 [root] WARNING: File at path "C:\Program Files\Far Manager\Plugins\ArcLite\7zS2con.sfx" does not exist, skip.
2020-02-14 16:38:44,453 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-02-14 16:38:44,453 [root] DEBUG: ProcessImageBase: EP 0x0003A810 image base 0x01360000 size 0x0 entropy 6.565324e+00.
2020-02-14 16:38:44,453 [root] DEBUG: ClearAllBreakpoints: Error getting thread context for thread 2616.
2020-02-14 16:38:44,453 [root] DEBUG: DLL loaded at 0x753F0000: C:\Windows\System32\CRYPTSP (0x17000 bytes).
2020-02-14 16:38:54,453 [root] DEBUG: ClearAllBreakpoints: Error getting thread context for thread 3676.
2020-02-14 16:38:54,453 [root] WARNING: File at path "C:\Program Files\Far Manager\Plugins\ArcLite\7zSD.sfx" does not exist, skip.
2020-02-14 16:38:54,453 [root] WARNING: File at path "C:\Program Files\Far Manager\Plugins\ArcLite\7zSD.sfx" does not exist, skip.
2020-02-14 16:38:54,467 [lib.api.process] INFO: Termination confirmed for process 2360
2020-02-14 16:38:54,467 [root] INFO: Terminate event set for process 2360.
2020-02-14 16:38:54,467 [lib.api.process] INFO: Terminate event set for process 3740
2020-02-14 16:38:59,453 [root] DEBUG: DLL loaded at 0x75180000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-02-14 16:38:59,453 [root] DEBUG: ClearAllBreakpoints: Error getting thread context for thread 1848.
2020-02-14 16:38:59,453 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2776.
2020-02-14 16:38:59,453 [root] INFO: Notified of termination of process with pid 2116.

MalScore

10.0

Goodmen

Machine

Name Label Manager Started On Shutdown On
win7_2 win7_2 KVM 2020-02-14 15:33:41 2020-02-14 15:39:43

File Details

File Name sh1
File Size 780688 bytes
File Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 a04a99d946fb08b2f65ba664ad7faebd
SHA1 1fe7e2f8fbd98d6b5505fd9ee66da5b4f11720a1
SHA256 faa3453ceb1bd4e5b0b10171eaa908e56e7275173178010fcc323fdea67a6869
SHA512 1afde06049a7132e552681a71f74fbb09ac5b26e05c0570af95de0ce4484eb647f2afb781c0683fdba6cb37daacf1c6be690b5208df477158a4d8d45e4c2e374
CRC32 E842E805
Ssdeep 12288:S1kx1gjdatSK411nhuGvv6DuQ4yPcFy62eaFsvXPAVVRSPq2hv:S1kfoatSK41dhuGvQgy6GWQxSv
TrID None matched
ClamAV None matched
Yara None matched
CAPE Yara None matched
Download Download ZIP Resubmit sample

Signatures

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction
Yara rule detections observed from a process memory dump/dropped files/CAPE
Hit: PID 0 trigged the Yara rule 'embedded_win_api'
Hit: PID 0 trigged the Yara rule 'shellcode_patterns'
Hit: PID 0 trigged the Yara rule 'shellcode_get_eip'
Hit: PID 0 trigged the Yara rule 'vmdetect'
Hit: PID 0 trigged the Yara rule 'shellcode_stack_strings'
Hit: PID 2360 trigged the Yara rule 'vmdetect'
Hit: PID 2360 trigged the Yara rule 'shellcode_patterns'
Hit: PID 2360 trigged the Yara rule 'shellcode_get_eip'
Presents an Authenticode digital signature
md5_fingerprint: 1f51c6363ff3bf4284350b379b14d9ec
cn: "CENTR MBP"
sha1_fingerprint: a3eb1caf251401cffb0724765ae61df41579a27d
sn: 207141913439838338276216762076461364100
The PE file contains a PDB path
pdbpath: c:\lowdoes\magnetTen\DrawSince\LargeSeason\northfraction\enemybarChord.pdb
NtSetInformationThread: attempt to hide thread from debugger
Possible date expiration check, exits too soon after checking local time
process: WmiPrvSE.exe, PID 2296
Attempts to connect to a dead IP:Port (505 unique times)
IP: 192.168.1.219:135
IP: 192.168.1.220:135
IP: 192.168.1.231:135
IP: 192.168.1.71:135
IP: 192.168.1.34:445
IP: 192.168.1.253:445
IP: 192.168.1.224:445
IP: 192.168.1.220:445
IP: 192.168.1.52:445
IP: 192.168.1.225:135
IP: 192.168.1.94:135
IP: 192.168.1.49:445
IP: 192.168.1.69:445
IP: 192.168.1.81:445
IP: 192.168.1.82:135
IP: 192.168.1.136:135
IP: 192.168.1.169:445
IP: 192.168.1.181:135
IP: 192.168.1.216:445
IP: 192.168.1.112:445
IP: 192.168.1.117:135
IP: 192.168.1.110:135
IP: 192.168.1.30:445
IP: 192.168.1.28:445
IP: 192.168.1.75:135
IP: 192.168.1.248:135
IP: 192.168.1.210:135
IP: 192.168.1.137:445
IP: 192.168.1.6:135
IP: 192.168.1.126:445
IP: 192.168.1.161:445
IP: 192.168.1.18:445
IP: 192.168.1.230:445
IP: 192.168.1.152:445
IP: 192.168.1.61:135
IP: 192.168.1.184:135
IP: 192.168.1.106:445
IP: 192.168.1.60:135
IP: 192.168.1.58:135
IP: 192.168.1.38:445
IP: 192.168.1.55:445
IP: 192.168.1.149:135
IP: 192.168.1.182:445
IP: 192.168.1.39:445
IP: 192.168.1.103:135
IP: 192.168.1.175:445
IP: 192.168.1.16:135
IP: 192.168.1.155:135
IP: 192.168.1.96:445
IP: 192.168.1.195:135
IP: 192.168.1.149:445
IP: 192.168.1.7:445
IP: 192.168.1.120:445
IP: 192.168.1.194:135
IP: 192.168.1.227:445
IP: 192.168.1.133:135
IP: 192.168.1.211:445
IP: 192.168.1.214:135
IP: 192.168.1.224:135
IP: 192.168.1.3:135
IP: 192.168.1.21:445
IP: 192.168.1.66:135
IP: 192.168.1.179:445
IP: 192.168.1.50:135
IP: 192.168.1.119:135
IP: 192.168.1.213:445
IP: 192.168.1.185:445
IP: 192.168.1.180:135
IP: 192.168.1.125:445
IP: 192.168.1.243:445
IP: 192.168.1.226:445
IP: 192.168.1.162:445
IP: 192.168.1.192:135
IP: 192.168.1.187:135
IP: 192.168.1.39:135
IP: 192.168.1.29:445
IP: 192.168.1.101:135
IP: 192.168.1.51:445
IP: 192.168.1.131:445
IP: 192.168.1.152:135
IP: 192.168.1.62:445
IP: 192.168.1.37:445
IP: 192.168.1.236:445
IP: 192.168.1.235:135
IP: 192.168.1.100:445
IP: 192.168.1.157:135
IP: 192.168.1.186:445
IP: 192.168.1.198:445
IP: 192.168.1.168:135
IP: 192.168.1.95:445
IP: 192.168.1.35:445
IP: 192.168.1.124:135
IP: 192.168.1.147:135
IP: 192.168.1.71:445
IP: 192.168.1.192:445
IP: 192.168.1.196:445
IP: 192.168.1.209:135
IP: 192.168.1.252:135
IP: 192.168.1.158:445
IP: 192.168.1.1:445
IP: 192.168.1.213:135
IP: 192.168.1.62:135
IP: 192.168.1.253:135
IP: 192.168.1.41:445
IP: 192.168.1.222:135
IP: 192.168.1.188:445
IP: 192.168.1.42:135
IP: 192.168.1.249:135
IP: 192.168.1.23:445
IP: 192.168.1.244:445
IP: 192.168.1.168:445
IP: 192.168.1.33:445
IP: 192.168.1.9:445
IP: 192.168.1.207:445
IP: 192.168.1.143:135
IP: 192.168.1.67:135
IP: 192.168.1.16:445
IP: 192.168.1.196:135
IP: 192.168.1.139:445
IP: 192.168.1.27:445
IP: 192.168.1.12:135
IP: 192.168.1.15:445
IP: 192.168.1.61:445
IP: 192.168.1.142:445
IP: 192.168.1.135:445
IP: 192.168.1.172:445
IP: 192.168.1.99:135
IP: 192.168.1.108:445
IP: 192.168.1.223:445
IP: 192.168.1.167:445
IP: 192.168.1.239:445
IP: 192.168.1.218:135
IP: 192.168.1.111:445
IP: 192.168.1.154:135
IP: 192.168.1.55:135
IP: 192.168.1.99:445
IP: 192.168.1.10:445
IP: 192.168.1.46:445
IP: 192.168.1.156:135
IP: 192.168.1.104:445
IP: 192.168.1.195:445
IP: 192.168.1.241:135
IP: 192.168.1.160:135
IP: 192.168.1.85:445
IP: 192.168.1.98:445
IP: 192.168.1.5:445
IP: 192.168.1.156:445
IP: 192.168.1.153:135
IP: 192.168.1.133:445
IP: 192.168.1.180:445
IP: 192.168.1.165:445
IP: 192.168.1.238:135
IP: 192.168.1.88:445
IP: 192.168.1.118:135
IP: 192.168.1.78:135
IP: 192.168.1.212:445
IP: 192.168.1.146:135
IP: 192.168.1.205:135
IP: 192.168.1.240:445
IP: 192.168.1.98:135
IP: 192.168.1.90:135
IP: 192.168.1.87:135
IP: 192.168.1.96:135
IP: 192.168.1.251:445
IP: 192.168.1.66:445
IP: 192.168.1.77:445
IP: 192.168.1.63:135
IP: 192.168.1.9:135
IP: 192.168.1.150:135
IP: 192.168.1.204:445
IP: 192.168.1.53:135
IP: 192.168.1.64:135
IP: 192.168.1.3:445
IP: 192.168.1.239:135
IP: 192.168.1.43:135
IP: 192.168.1.219:445
IP: 192.168.1.119:445
IP: 192.168.1.197:135
IP: 192.168.1.107:445
IP: 192.168.1.48:135
IP: 192.168.1.136:445
IP: 192.168.1.251:135
IP: 192.168.1.65:445
IP: 192.168.1.32:135
IP: 192.168.1.59:445
IP: 192.168.1.123:445
IP: 192.168.1.171:445
IP: 192.168.1.240:135
IP: 192.168.1.190:135
IP: 192.168.1.14:445
IP: 192.168.1.42:445
IP: 192.168.1.144:445
IP: 192.168.1.101:445
IP: 192.168.1.35:135
IP: 192.168.1.114:135
IP: 192.168.1.167:135
IP: 192.168.1.57:445
IP: 192.168.1.20:445
IP: 192.168.1.225:445
IP: 192.168.1.212:135
IP: 192.168.1.127:135
IP: 192.168.1.226:135
IP: 192.168.1.117:445
IP: 192.168.1.77:135
IP: 192.168.1.162:135
IP: 192.168.1.191:445
IP: 192.168.1.97:135
IP: 192.168.1.44:135
IP: 192.168.1.86:445
IP: 192.168.1.33:135
IP: 192.168.1.6:445
IP: 192.168.1.229:445
IP: 192.168.1.252:445
IP: 192.168.1.97:445
IP: 192.168.1.158:135
IP: 192.168.1.92:135
IP: 192.168.1.116:445
IP: 192.168.1.7:135
IP: 192.168.1.245:135
IP: 192.168.1.57:135
IP: 192.168.1.129:445
IP: 192.168.1.34:135
IP: 192.168.1.214:445
IP: 192.168.1.160:445
IP: 192.168.1.79:445
IP: 192.168.1.208:445
IP: 192.168.1.51:135
IP: 192.168.1.126:135
IP: 192.168.1.106:135
IP: 192.168.1.49:135
IP: 192.168.1.24:445
IP: 192.168.1.232:445
IP: 192.168.1.209:445
IP: 192.168.1.52:135
IP: 192.168.1.36:135
IP: 192.168.1.76:135
IP: 192.168.1.73:135
IP: 192.168.1.116:135
IP: 192.168.1.54:445
IP: 192.168.1.123:135
IP: 192.168.1.140:445
IP: 192.168.1.201:135
IP: 192.168.1.207:135
IP: 192.168.1.178:135
IP: 192.168.1.250:135
IP: 192.168.1.47:135
IP: 192.168.1.175:135
IP: 192.168.1.161:135
IP: 192.168.1.63:445
IP: 192.168.1.46:135
IP: 192.168.1.58:445
IP: 192.168.1.90:445
IP: 192.168.1.242:135
IP: 192.168.1.12:445
IP: 192.168.1.48:445
IP: 192.168.1.163:135
IP: 192.168.1.113:445
IP: 192.168.1.164:135
IP: 192.168.1.13:445
IP: 192.168.1.155:445
IP: 192.168.1.102:135
IP: 192.168.1.93:135
IP: 192.168.1.173:135
IP: 192.168.1.163:445
IP: 192.168.1.93:445
IP: 192.168.1.31:445
IP: 192.168.1.146:445
IP: 192.168.1.197:445
IP: 192.168.1.176:445
IP: 192.168.1.248:445
IP: 192.168.1.137:135
IP: 192.168.1.127:445
IP: 192.168.1.122:135
IP: 192.168.1.159:135
IP: 192.168.1.179:135
IP: 192.168.1.230:135
IP: 192.168.1.83:135
IP: 192.168.1.151:445
IP: 192.168.1.85:135
IP: 192.168.1.246:445
IP: 192.168.1.28:135
IP: 192.168.1.53:445
IP: 192.168.1.56:135
IP: 192.168.1.121:445
IP: 192.168.1.206:135
IP: 192.168.1.165:135
IP: 192.168.1.91:445
IP: 192.168.1.89:135
IP: 192.168.1.17:135
IP: 192.168.1.231:445
IP: 192.168.1.31:135
IP: 192.168.1.54:135
IP: 192.168.1.40:135
IP: 192.168.1.150:445
IP: 192.168.1.202:445
IP: 192.168.1.206:445
IP: 192.168.1.203:135
IP: 192.168.1.110:445
IP: 192.168.1.143:445
IP: 192.168.1.88:135
IP: 192.168.1.246:135
IP: 192.168.1.50:445
IP: 192.168.1.184:445
IP: 192.168.1.25:135
IP: 192.168.1.130:445
IP: 192.168.1.29:135
IP: 192.168.1.13:135
IP: 192.168.1.68:445
IP: 192.168.1.22:135
IP: 192.168.1.37:135
IP: 192.168.1.174:135
IP: 192.168.1.79:135
IP: 192.168.1.210:445
IP: 192.168.1.32:445
IP: 192.168.1.138:445
IP: 192.168.1.243:135
IP: 192.168.1.171:135
IP: 192.168.1.111:135
IP: 192.168.1.84:135
IP: 192.168.1.95:135
IP: 192.168.1.0:445
IP: 192.168.1.178:445
IP: 192.168.1.24:135
IP: 192.168.1.189:445
IP: 192.168.1.244:135
IP: 192.168.1.80:445
IP: 192.168.1.245:445
IP: 192.168.1.84:445
IP: 192.168.1.217:445
IP: 192.168.1.81:135
IP: 192.168.1.8:445
IP: 192.168.1.153:445
IP: 192.168.1.74:135
IP: 192.168.1.250:445
IP: 192.168.1.30:135
IP: 192.168.1.23:135
IP: 192.168.1.249:445
IP: 192.168.1.201:445
IP: 192.168.1.135:135
IP: 192.168.1.183:445
IP: 192.168.1.193:135
IP: 192.168.1.19:445
IP: 192.168.1.105:135
IP: 192.168.1.202:135
IP: 192.168.1.94:445
IP: 192.168.1.221:445
IP: 192.168.1.169:135
IP: 192.168.1.41:135
IP: 192.168.1.21:135
IP: 192.168.1.70:445
IP: 192.168.1.5:135
IP: 192.168.1.129:135
IP: 192.168.1.73:445
IP: 192.168.1.44:445
IP: 192.168.1.208:135
IP: 192.168.1.47:445
IP: 192.168.1.130:135
IP: 192.168.1.67:445
IP: 192.168.1.234:135
IP: 192.168.1.232:135
IP: 192.168.1.70:135
IP: 192.168.1.242:445
IP: 192.168.1.247:135
IP: 192.168.1.172:135
IP: 192.168.1.56:445
IP: 192.168.1.134:135
IP: 192.168.1.4:445
IP: 192.168.1.200:445
IP: 192.168.1.148:445
IP: 192.168.1.83:445
IP: 192.168.1.104:135
IP: 192.168.1.76:445
IP: 192.168.1.170:135
IP: 192.168.1.177:135
IP: 192.168.1.138:135
IP: 192.168.1.186:135
IP: 192.168.1.115:135
IP: 192.168.1.80:135
IP: 192.168.1.170:445
IP: 192.168.1.0:135
IP: 192.168.1.26:445
IP: 192.168.1.159:445
IP: 192.168.1.22:445
IP: 192.168.1.241:445
IP: 192.168.1.189:135
IP: 192.168.1.142:135
IP: 192.168.1.173:445
IP: 192.168.1.134:445
IP: 192.168.1.103:445
IP: 192.168.1.131:135
IP: 192.168.1.223:135
IP: 192.168.1.187:445
IP: 192.168.1.121:135
IP: 192.168.1.164:445
IP: 192.168.1.17:445
IP: 192.168.1.38:135
IP: 192.168.1.15:135
IP: 192.168.1.40:445
IP: 192.168.1.8:135
IP: 192.168.1.45:135
IP: 192.168.1.102:445
IP: 192.168.1.132:445
IP: 192.168.1.233:135
IP: 192.168.1.151:135
IP: 192.168.1.204:135
IP: 192.168.1.176:135
IP: 192.168.1.82:445
IP: 192.168.1.222:445
IP: 192.168.1.26:135
IP: 192.168.1.72:135
IP: 192.168.1.237:445
IP: 192.168.1.233:445
IP: 192.168.1.236:135
IP: 192.168.1.228:135
IP: 192.168.1.11:135
IP: 192.168.1.92:445
IP: 192.168.1.91:135
IP: 192.168.1.125:135
IP: 192.168.1.43:445
IP: 192.168.1.218:445
IP: 192.168.1.18:135
IP: 192.168.1.105:445
IP: 192.168.1.145:445
IP: 192.168.1.100:135
IP: 192.168.1.107:135
IP: 192.168.1.72:445
IP: 192.168.1.124:445
IP: 192.168.1.154:445
IP: 192.168.1.20:135
IP: 192.168.1.25:445
IP: 192.168.1.205:445
IP: 192.168.1.141:135
IP: 192.168.1.128:135
IP: 192.168.1.86:135
IP: 192.168.1.229:135
IP: 192.168.1.19:135
IP: 192.168.1.215:445
IP: 192.168.1.60:445
IP: 192.168.1.166:445
IP: 192.168.1.68:135
IP: 192.168.1.4:135
IP: 192.168.1.182:135
IP: 192.168.1.139:135
IP: 192.168.1.247:445
IP: 192.168.1.183:135
IP: 192.168.1.27:135
IP: 192.168.1.118:445
IP: 192.168.1.234:445
IP: 192.168.1.199:135
IP: 192.168.1.78:445
IP: 192.168.1.120:135
IP: 192.168.1.140:135
IP: 192.168.1.194:445
IP: 192.168.1.109:445
IP: 192.168.1.188:135
IP: 192.168.1.59:135
IP: 192.168.1.108:135
IP: 192.168.1.128:445
IP: 192.168.1.193:445
IP: 192.168.1.217:135
IP: 192.168.1.112:135
IP: 192.168.1.237:135
IP: 192.168.1.87:445
IP: 192.168.1.11:445
IP: 192.168.1.199:445
IP: 192.168.1.36:445
IP: 192.168.1.14:135
IP: 192.168.1.145:135
IP: 192.168.1.227:135
IP: 192.168.1.221:135
IP: 192.168.1.65:135
IP: 192.168.1.198:135
IP: 192.168.1.89:445
IP: 192.168.1.69:135
IP: 192.168.1.45:445
IP: 192.168.1.254:445
IP: 192.168.1.166:135
IP: 192.168.1.228:445
IP: 192.168.1.235:445
IP: 192.168.1.157:445
IP: 192.168.1.113:135
IP: 192.168.1.185:135
IP: 192.168.1.74:445
IP: 192.168.1.64:445
IP: 192.168.1.122:445
IP: 192.168.1.75:445
IP: 192.168.1.191:135
IP: 192.168.1.203:445
IP: 192.168.1.200:135
IP: 192.168.1.238:445
IP: 192.168.1.211:135
IP: 192.168.1.216:135
IP: 192.168.1.148:135
IP: 192.168.1.174:445
IP: 192.168.1.215:135
IP: 192.168.1.141:445
IP: 192.168.1.114:445
IP: 192.168.1.144:135
IP: 192.168.1.190:445
IP: 192.168.1.132:135
IP: 192.168.1.177:445
IP: 192.168.1.181:445
IP: 192.168.1.109:135
IP: 192.168.1.115:445
IP: 192.168.1.147:445
Dynamic (imported) function loading detected
DynamicLoader: NETAPI32.dll/NetShareEnum
DynamicLoader: NETAPI32.dll/NetWkstaGetInfo
DynamicLoader: NETAPI32.dll/NetApiBufferFree
DynamicLoader: IPHLPAPI.DLL/GetAdaptersInfo
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: CRYPT32.dll/CryptBinaryToStringA
DynamicLoader: gdiplus.dll/GdipDeleteGraphics
DynamicLoader: gdiplus.dll/GdipDeleteStringFormat
DynamicLoader: gdiplus.dll/GdipDeleteFont
DynamicLoader: gdiplus.dll/GdipCreateBitmapFromScan0
DynamicLoader: gdiplus.dll/GdipSetStringFormatAlign
DynamicLoader: gdiplus.dll/GdipSaveImageToFile
DynamicLoader: gdiplus.dll/GdipGetImageEncodersSize
DynamicLoader: gdiplus.dll/GdipGetImageGraphicsContext
DynamicLoader: gdiplus.dll/GdipDeleteFontFamily
DynamicLoader: gdiplus.dll/GdipCreateLineBrushFromRect
DynamicLoader: gdiplus.dll/GdipCreateStringFormat
DynamicLoader: gdiplus.dll/GdiplusStartup
DynamicLoader: gdiplus.dll/GdipDisposeImage
DynamicLoader: gdiplus.dll/GdipCloneBrush
DynamicLoader: gdiplus.dll/GdipDrawString
DynamicLoader: gdiplus.dll/GdipFree
DynamicLoader: gdiplus.dll/GdipGetGenericFontFamilySansSerif
DynamicLoader: gdiplus.dll/GdipFillRectangle
DynamicLoader: gdiplus.dll/GdipCreateFont
DynamicLoader: gdiplus.dll/GdipAlloc
DynamicLoader: gdiplus.dll/GdipDeleteBrush
DynamicLoader: gdiplus.dll/GdipCreateFontFamilyFromName
DynamicLoader: gdiplus.dll/GdipGetImageEncoders
DynamicLoader: gdiplus.dll/GdipSetStringFormatLineAlign
DynamicLoader: SHLWAPI.dll/PathAddBackslashW
DynamicLoader: SHLWAPI.dll/PathFindExtensionW
DynamicLoader: SHLWAPI.dll/PathRemoveExtensionA
DynamicLoader: SHLWAPI.dll/PathRemoveFileSpecW
DynamicLoader: SHLWAPI.dll/PathRemoveBackslashW
DynamicLoader: SHLWAPI.dll/StrFormatByteSize64A
DynamicLoader: MPR.dll/WNetAddConnection2W
DynamicLoader: MPR.dll/WNetOpenEnumW
DynamicLoader: MPR.dll/WNetEnumResourceW
DynamicLoader: MPR.dll/WNetGetConnectionW
DynamicLoader: MPR.dll/WNetCloseEnum
DynamicLoader: ntdll.dll/RtlEnterCriticalSection
DynamicLoader: ntdll.dll/RtlLeaveCriticalSection
DynamicLoader: ntdll.dll/RtlDeleteCriticalSection
DynamicLoader: ntdll.dll/RtlInitializeCriticalSection
DynamicLoader: ntdll.dll/NtSetInformationThread
DynamicLoader: ntdll.dll/RtlCreateUserThread
DynamicLoader: ntdll.dll/NtAdjustPrivilegesToken
DynamicLoader: ntdll.dll/NtOpenProcessToken
DynamicLoader: ntdll.dll/NtQueryInformationToken
DynamicLoader: ntdll.dll/VerSetConditionMask
DynamicLoader: ntdll.dll/RtlGetAce
DynamicLoader: ntdll.dll/NtOpenProcess
DynamicLoader: ntdll.dll/RtlQueryInformationAcl
DynamicLoader: ntdll.dll/RtlAllocateAndInitializeSid
DynamicLoader: ntdll.dll/RtlAddAce
DynamicLoader: ntdll.dll/RtlLengthSid
DynamicLoader: ntdll.dll/RtlAdjustPrivilege
DynamicLoader: ntdll.dll/RtlFreeSid
DynamicLoader: ntdll.dll/RtlAddAccessDeniedAce
DynamicLoader: ntdll.dll/RtlCreateAcl
DynamicLoader: ntdll.dll/NtSetInformationFile
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U
DynamicLoader: ntdll.dll/RtlInterlockedPushEntrySList
DynamicLoader: ntdll.dll/RtlInitializeSListHead
DynamicLoader: ntdll.dll/RtlInterlockedPopEntrySList
DynamicLoader: ntdll.dll/RtlInterlockedFlushSList
DynamicLoader: ntdll.dll/RtlInitUnicodeString
DynamicLoader: ntdll.dll/NtAllocateVirtualMemory
DynamicLoader: ntdll.dll/LdrEnumerateLoadedModules
DynamicLoader: ntdll.dll/RtlAcquirePebLock
DynamicLoader: ntdll.dll/RtlReleasePebLock
DynamicLoader: msvcrt.dll/srand
DynamicLoader: msvcrt.dll/malloc
DynamicLoader: msvcrt.dll/free
DynamicLoader: msvcrt.dll/rand
DynamicLoader: msvcrt.dll/calloc
DynamicLoader: kernel32.dll/CreateFileW
DynamicLoader: kernel32.dll/GetFileAttributesW
DynamicLoader: kernel32.dll/GetDiskFreeSpaceExW
DynamicLoader: kernel32.dll/FindClose
DynamicLoader: kernel32.dll/WaitForMultipleObjects
DynamicLoader: kernel32.dll/GetWindowsDirectoryW
DynamicLoader: kernel32.dll/CreateIoCompletionPort
DynamicLoader: kernel32.dll/GetQueuedCompletionStatus
DynamicLoader: kernel32.dll/GetFileSizeEx
DynamicLoader: kernel32.dll/ReadFile
DynamicLoader: kernel32.dll/CreateProcessW
DynamicLoader: kernel32.dll/FindNextVolumeW
DynamicLoader: kernel32.dll/GetVolumePathNamesForVolumeNameW
DynamicLoader: kernel32.dll/FindVolumeClose
DynamicLoader: kernel32.dll/SetVolumeMountPointW
DynamicLoader: kernel32.dll/FindNextFileW
DynamicLoader: kernel32.dll/FindFirstFileExW
DynamicLoader: kernel32.dll/GetLogicalDrives
DynamicLoader: kernel32.dll/AllocConsole
DynamicLoader: kernel32.dll/GetConsoleWindow
DynamicLoader: kernel32.dll/GetProcAddress
DynamicLoader: kernel32.dll/FindFirstVolumeW
DynamicLoader: kernel32.dll/QueryDosDeviceW
DynamicLoader: kernel32.dll/WaitForSingleObject
DynamicLoader: kernel32.dll/CreateProcessA
DynamicLoader: kernel32.dll/lstrcmpiA
DynamicLoader: kernel32.dll/GetCurrentProcessId
DynamicLoader: kernel32.dll/MoveFileExW
DynamicLoader: kernel32.dll/Process32Next
DynamicLoader: kernel32.dll/CreateToolhelp32Snapshot
DynamicLoader: kernel32.dll/OpenProcess
DynamicLoader: kernel32.dll/TerminateProcess
DynamicLoader: kernel32.dll/Process32First
DynamicLoader: kernel32.dll/GetComputerNameA
DynamicLoader: kernel32.dll/VerifyVersionInfoW
DynamicLoader: kernel32.dll/GetSystemInfo
DynamicLoader: kernel32.dll/GetVersionExA
DynamicLoader: kernel32.dll/LoadLibraryA
DynamicLoader: kernel32.dll/OpenMutexA
DynamicLoader: kernel32.dll/CreateMutexA
DynamicLoader: kernel32.dll/GetTickCount
DynamicLoader: kernel32.dll/GetTempFileNameW
DynamicLoader: kernel32.dll/GetTempPathW
DynamicLoader: kernel32.dll/GetDriveTypeW
DynamicLoader: kernel32.dll/lstrcmpiW
DynamicLoader: kernel32.dll/ExitProcess
DynamicLoader: kernel32.dll/CreateThread
DynamicLoader: kernel32.dll/CloseHandle
DynamicLoader: kernel32.dll/DeleteFileW
DynamicLoader: kernel32.dll/GetLocalTime
DynamicLoader: kernel32.dll/SetConsoleCtrlHandler
DynamicLoader: kernel32.dll/SetConsoleTextAttribute
DynamicLoader: kernel32.dll/SetConsoleTitleA
DynamicLoader: kernel32.dll/WriteFile
DynamicLoader: kernel32.dll/SetConsoleMode
DynamicLoader: kernel32.dll/SetProcessShutdownParameters
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/ExitThread
DynamicLoader: kernel32.dll/GetModuleHandleA
DynamicLoader: kernel32.dll/Sleep
DynamicLoader: kernel32.dll/GetConsoleMode
DynamicLoader: kernel32.dll/SetFileAttributesW
DynamicLoader: USER32.dll/DispatchMessageA
DynamicLoader: USER32.dll/IsWindowVisible
DynamicLoader: USER32.dll/DeleteMenu
DynamicLoader: USER32.dll/wsprintfA
DynamicLoader: USER32.dll/ShowWindow
DynamicLoader: USER32.dll/SetWindowLongA
DynamicLoader: USER32.dll/GetMessageA
DynamicLoader: USER32.dll/GetWindowLongA
DynamicLoader: USER32.dll/RegisterHotKey
DynamicLoader: USER32.dll/RegisterClassA
DynamicLoader: USER32.dll/DefWindowProcA
DynamicLoader: USER32.dll/FlashWindow
DynamicLoader: USER32.dll/CreateWindowExA
DynamicLoader: USER32.dll/SetLayeredWindowAttributes
DynamicLoader: USER32.dll/TranslateMessage
DynamicLoader: USER32.dll/wsprintfW
DynamicLoader: USER32.dll/EnableMenuItem
DynamicLoader: USER32.dll/SetForegroundWindow
DynamicLoader: USER32.dll/CharUpperA
DynamicLoader: USER32.dll/GetSystemMenu
DynamicLoader: USER32.dll/GetMessageW
DynamicLoader: USER32.dll/SystemParametersInfoW
DynamicLoader: USER32.dll/wvsprintfA
DynamicLoader: USER32.dll/GetSystemMetrics
DynamicLoader: USER32.dll/CharLowerBuffW
DynamicLoader: USER32.dll/PeekMessageW
DynamicLoader: ADVAPI32.dll/OpenSCManagerA
DynamicLoader: ADVAPI32.dll/RegCreateKeyExA
DynamicLoader: ADVAPI32.dll/RegQueryValueExA
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/SetThreadToken
DynamicLoader: ADVAPI32.dll/RegOpenKeyA
DynamicLoader: ADVAPI32.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/EqualSid
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: ADVAPI32.dll/CreateProcessAsUserW
DynamicLoader: ADVAPI32.dll/DuplicateToken
DynamicLoader: ADVAPI32.dll/DuplicateTokenEx
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/SetSecurityInfo
DynamicLoader: ADVAPI32.dll/GetSecurityInfo
DynamicLoader: ADVAPI32.dll/EnumDependentServicesA
DynamicLoader: ADVAPI32.dll/CloseServiceHandle
DynamicLoader: ADVAPI32.dll/InitializeSecurityDescriptor
DynamicLoader: ADVAPI32.dll/CheckTokenMembership
DynamicLoader: ADVAPI32.dll/RegSetValueExA
DynamicLoader: ADVAPI32.dll/ControlService
DynamicLoader: ADVAPI32.dll/RegSetValueExW
DynamicLoader: ADVAPI32.dll/RegDeleteValueW
DynamicLoader: ADVAPI32.dll/QueryServiceStatusEx
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/OpenServiceA
DynamicLoader: ADVAPI32.dll/SetFileSecurityW
DynamicLoader: ADVAPI32.dll/CryptAcquireContextW
DynamicLoader: ADVAPI32.dll/SetSecurityDescriptorOwner
DynamicLoader: ADVAPI32.dll/CryptGenRandom
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValueA
DynamicLoader: ADVAPI32.dll/CreateWellKnownSid
DynamicLoader: SHELL32.dll/CommandLineToArgvW
DynamicLoader: SHELL32.dll/SHEmptyRecycleBinW
DynamicLoader: SHELL32.dll/ShellExecuteExA
DynamicLoader: SHELL32.dll/ShellExecuteExW
DynamicLoader: ole32.dll/CoGetObject
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ntdll.dll/NtCreateThreadEx
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcryptprimitives.dll/GetRngInterface
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: ole32.dll/OleInitialize
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: PROPSYS.dll/PSCreateMemoryPropertyStore
DynamicLoader: PROPSYS.dll/PSPropertyBag_WriteDWORD
DynamicLoader: ole32.dll/CoGetApartmentType
DynamicLoader: ole32.dll/CoRegisterInitializeSpy
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: PROPSYS.dll/PSPropertyBag_ReadDWORD
DynamicLoader: PROPSYS.dll/PSPropertyBag_ReadGUID
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: ADVAPI32.dll/OpenThreadToken
DynamicLoader: ole32.dll/StringFromGUID2
DynamicLoader: apphelp.dll/ApphelpCheckShellObject
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: SHELL32.dll/
DynamicLoader: PROPSYS.dll/PSPropertyBag_ReadStrAlloc
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ADVAPI32.dll/InitializeSecurityDescriptor
DynamicLoader: ADVAPI32.dll/SetEntriesInAclW
DynamicLoader: ADVAPI32.dll/SetSecurityDescriptorDacl
DynamicLoader: ADVAPI32.dll/IsTextUnicode
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: WKSCLI.DLL/NetWkstaGetInfo
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: profapi.dll/
DynamicLoader: PROPSYS.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegGetValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ole32.dll/CoTaskMemRealloc
DynamicLoader: PROPSYS.dll/InitPropVariantFromStringAsVector
DynamicLoader: PROPSYS.dll/PSCoerceToCanonicalValue
DynamicLoader: PROPSYS.dll/PropVariantToStringAlloc
DynamicLoader: ole32.dll/PropVariantClear
DynamicLoader: ole32.dll/CoAllowSetForegroundWindow
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: Secur32.dll/GetUserNameExW
DynamicLoader: cscapi.dll/CscNetApiGetInterface
DynamicLoader: api-ms-win-downlevel-shlwapi-l1-1-0.dll/PathCreateFromUrlW
DynamicLoader: SHELL32.dll/SHGetFolderPathW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/SaferGetPolicyInformation
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: USER32.dll/ShutdownBlockReasonCreate
DynamicLoader: USER32.dll/LoadStringW
DynamicLoader: drprov.dll/NPGetCaps
DynamicLoader: drprov.dll/NPGetUser
DynamicLoader: drprov.dll/NPAddConnection
DynamicLoader: drprov.dll/NPAddConnection3
DynamicLoader: drprov.dll/NPGetReconnectFlags
DynamicLoader: drprov.dll/NPCancelConnection
DynamicLoader: drprov.dll/NPGetConnection
DynamicLoader: drprov.dll/NPGetConnection3
DynamicLoader: drprov.dll/NPGetUniversalName
DynamicLoader: drprov.dll/NPOpenEnum
DynamicLoader: drprov.dll/NPEnumResource
DynamicLoader: drprov.dll/NPCloseEnum
DynamicLoader: drprov.dll/NPGetResourceParent
DynamicLoader: drprov.dll/NPGetResourceInformation
DynamicLoader: ntlanman.dll/NPGetCaps
DynamicLoader: ntlanman.dll/NPGetUser
DynamicLoader: ntlanman.dll/NPAddConnection
DynamicLoader: ntlanman.dll/NPAddConnection3
DynamicLoader: ntlanman.dll/NPGetReconnectFlags
DynamicLoader: ntlanman.dll/NPCancelConnection
DynamicLoader: ntlanman.dll/NPGetConnection
DynamicLoader: ntlanman.dll/NPGetConnection3
DynamicLoader: ntlanman.dll/NPGetUniversalName
DynamicLoader: ntlanman.dll/NPGetConnectionPerformance
DynamicLoader: ntlanman.dll/NPOpenEnum
DynamicLoader: ntlanman.dll/NPEnumResource
DynamicLoader: ntlanman.dll/NPCloseEnum
DynamicLoader: ntlanman.dll/NPFormatNetworkName
DynamicLoader: ntlanman.dll/NPGetResourceParent
DynamicLoader: ntlanman.dll/NPGetResourceInformation
DynamicLoader: davclnt.dll/NPGetCaps
DynamicLoader: davclnt.dll/NPGetUser
DynamicLoader: davclnt.dll/NPAddConnection
DynamicLoader: davclnt.dll/NPAddConnection3
DynamicLoader: davclnt.dll/NPGetReconnectFlags
DynamicLoader: davclnt.dll/NPCancelConnection
DynamicLoader: davclnt.dll/NPGetConnection
DynamicLoader: davclnt.dll/NPGetConnection3
DynamicLoader: davclnt.dll/NPGetUniversalName
DynamicLoader: davclnt.dll/NPOpenEnum
DynamicLoader: davclnt.dll/NPEnumResource
DynamicLoader: davclnt.dll/NPCloseEnum
DynamicLoader: davclnt.dll/NPFormatNetworkName
DynamicLoader: davclnt.dll/NPGetResourceParent
DynamicLoader: davclnt.dll/NPGetResourceInformation
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: ADVAPI32.dll/CreateWellKnownSid
DynamicLoader: SHELL32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: RPCRT4.dll/RpcStringBindingComposeW
DynamicLoader: RPCRT4.dll/RpcBindingFromStringBindingW
DynamicLoader: RPCRT4.dll/RpcStringFreeW
DynamicLoader: RPCRT4.dll/RpcBindingSetAuthInfoExW
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: RPCRT4.dll/NdrClientCall2
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: ADVAPI32.dll/GetNamedSecurityInfoW
DynamicLoader: sechost.dll/ConvertStringSecurityDescriptorToSecurityDescriptorW
DynamicLoader: comctl32.dll/
DynamicLoader: WKSCLI.DLL/NetWkstaGetInfo
DynamicLoader: netutils.dll/NetApiBufferFree
DynamicLoader: WKSCLI.DLL/NetUseEnum
DynamicLoader: netutils.dll/NetRemoteComputerSupports
DynamicLoader: RPCRT4.dll/RpcStringBindingComposeW
DynamicLoader: RPCRT4.dll/RpcBindingFromStringBindingW
DynamicLoader: RPCRT4.dll/RpcStringFreeW
DynamicLoader: RPCRT4.dll/NdrClientCall2
DynamicLoader: RPCRT4.dll/I_RpcExceptionFilter
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: ole32.dll/CoRevokeInitializeSpy
DynamicLoader: OLEAUT32.dll/
DynamicLoader: PROPSYS.dll/
DynamicLoader: browcli.dll/NetServerEnum
DynamicLoader: sfc.dll/SfcIsFileProtected
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: sechost.dll/OpenSCManagerW
DynamicLoader: sechost.dll/OpenServiceW
DynamicLoader: sechost.dll/QueryServiceStatus
DynamicLoader: sechost.dll/CloseServiceHandle
DynamicLoader: cscapi.dll/CscNetApiGetInterface
DynamicLoader: netutils.dll/NetApiBufferAllocate
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlDllShutdownInProgress
DynamicLoader: comctl32.dll/
DynamicLoader: ole32.dll/OleUninitialize
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/UnregisterTraceGuids
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: netutils.dll/NetApiBufferFree
DynamicLoader: MPR.dll/WNetSetLastErrorW
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: NSI.dll/NsiAllocateAndGetTable
DynamicLoader: CFGMGR32.dll/CM_Open_Class_Key_ExW
DynamicLoader: IPHLPAPI.DLL/ConvertInterfaceGuidToLuid
DynamicLoader: IPHLPAPI.DLL/GetIfEntry2
DynamicLoader: IPHLPAPI.DLL/GetIpForwardTable2
DynamicLoader: IPHLPAPI.DLL/GetIpNetEntry2
DynamicLoader: IPHLPAPI.DLL/FreeMibTable
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: NSI.dll/NsiFreeTable
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: WS2_32.dll/GetAddrInfoW
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: netutils.dll/NetpIsRemote
DynamicLoader: netutils.dll/NetpIsRemoteNameValid
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: sechost.dll/OpenSCManagerW
DynamicLoader: sechost.dll/OpenServiceW
DynamicLoader: sechost.dll/QueryServiceStatus
DynamicLoader: sechost.dll/CloseServiceHandle
DynamicLoader: cscapi.dll/CscNetApiGetInterface
DynamicLoader: WS2_32.dll/inet_addr
DynamicLoader: WS2_32.dll/gethostbyaddr
DynamicLoader: NLAapi.dll/NSPStartup
DynamicLoader: napinsp.dll/NSPStartup
DynamicLoader: sechost.dll/ConvertStringSecurityDescriptorToSecurityDescriptorW
DynamicLoader: pnrpnsp.dll/NSPStartup
DynamicLoader: pnrpnsp.dll/NSPStartup
DynamicLoader: winrnr.dll/NSPStartup
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: WS2_32.dll/
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: WS2_32.dll/inet_addr
DynamicLoader: WS2_32.dll/gethostbyaddr
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: WS2_32.dll/inet_addr
DynamicLoader: WS2_32.dll/gethostbyaddr
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: ntdll.dll/RtlFreeUnicodeString
DynamicLoader: ntdll.dll/RtlDosPathNameToNtPathName_U_WithStatus
DynamicLoader: ntdll.dll/NtOpenFile
DynamicLoader: ntdll.dll/CloseHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: WS2_32.dll/
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: WS2_32.dll/
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: sechost.dll/OpenSCManagerW
DynamicLoader: sechost.dll/OpenServiceW
DynamicLoader: sechost.dll/QueryServiceStatus
DynamicLoader: sechost.dll/CloseServiceHandle
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: DNSAPI.dll/DnsApiFree
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: bcrypt.dll/BCryptGenRandom
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: OLEAUT32.dll/
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: kernel32.dll/GetModuleHandleW
DynamicLoader: urlmon.dll/DllCanUnloadNow
DynamicLoader: urlmon.dll/IEDllLoader
DynamicLoader: urlmon.dll/CoInternetCreateZoneManager
DynamicLoader: urlmon.dll/CoInternetGetSession
DynamicLoader: urlmon.dll/CopyBindInfo
DynamicLoader: urlmon.dll/CreateURLMoniker
DynamicLoader: urlmon.dll/RegisterBindStatusCallback
DynamicLoader: urlmon.dll/ReleaseBindInfo
DynamicLoader: urlmon.dll/RevokeBindStatusCallback
DynamicLoader: urlmon.dll/UrlMkGetSessionOption
DynamicLoader: urlmon.dll/CoInternetCreateSecurityManager
DynamicLoader: urlmon.dll/CreateUri
DynamicLoader: urlmon.dll/CoInternetCombineUrl
DynamicLoader: urlmon.dll/CoInternetGetSecurityUrl
DynamicLoader: urlmon.dll/IsValidURL
DynamicLoader: WININET.dll/InternetCrackUrlW
DynamicLoader: WININET.dll/InternetCreateUrlW
DynamicLoader: api-ms-win-downlevel-shlwapi-l1-1-0.dll/PathCreateFromUrlW
DynamicLoader: api-ms-win-downlevel-shlwapi-l2-1-0.dll/IUnknown_QueryService
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeConditionVariable
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/SleepConditionVariableCS
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/WakeAllConditionVariable
DynamicLoader: MSOXMLMF.DLL/DllGetClassObject
DynamicLoader: MSOXMLMF.DLL/DllCanUnloadNow
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: kernel32.dll/GetThreadPreferredUILanguages
DynamicLoader: kernel32.dll/SetThreadPreferredUILanguages
DynamicLoader: kernel32.dll/LocaleNameToLCID
DynamicLoader: kernel32.dll/GetLocaleInfoEx
DynamicLoader: kernel32.dll/LCIDToLocaleName
DynamicLoader: kernel32.dll/GetSystemDefaultLocaleName
DynamicLoader: fastprox.dll/DllGetClassObject
DynamicLoader: fastprox.dll/DllCanUnloadNow
DynamicLoader: kernel32.dll/RegOpenKeyExW
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ntdll.dll/EtwUnregisterTraceGuids
DynamicLoader: ntdll.dll/EtwUnregisterTraceGuids
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/UnregisterTraceGuids
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: kernel32.dll/ResolveDelayLoadedAPI
DynamicLoader: VSSAPI.DLL/CreateWriter
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ADVAPI32.dll/LookupAccountNameW
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: samcli.dll/NetLocalGroupGetMembers
DynamicLoader: SAMLIB.dll/SamConnect
DynamicLoader: RPCRT4.dll/NdrClientCall2
DynamicLoader: RPCRT4.dll/RpcStringBindingComposeW
DynamicLoader: RPCRT4.dll/RpcBindingFromStringBindingW
DynamicLoader: RPCRT4.dll/RpcStringFreeW
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: SAMLIB.dll/SamOpenDomain
DynamicLoader: SAMLIB.dll/SamLookupNamesInDomain
DynamicLoader: SAMLIB.dll/SamOpenAlias
DynamicLoader: SAMLIB.dll/SamFreeMemory
DynamicLoader: SAMLIB.dll/SamCloseHandle
DynamicLoader: SAMLIB.dll/SamGetMembersInAlias
DynamicLoader: netutils.dll/NetApiBufferFree
DynamicLoader: ole32.dll/CoCreateGuid
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/StringFromCLSID
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyW
DynamicLoader: PROPSYS.dll/VariantToPropVariant
DynamicLoader: OLEAUT32.dll/
DynamicLoader: wbemcore.dll/Reinitialize
DynamicLoader: wbemsvc.dll/DllGetClassObject
DynamicLoader: wbemsvc.dll/DllCanUnloadNow
DynamicLoader: authZ.dll/AuthzInitializeContextFromToken
DynamicLoader: authZ.dll/AuthzInitializeObjectAccessAuditEvent2
DynamicLoader: authZ.dll/AuthzAccessCheck
DynamicLoader: authZ.dll/AuthzFreeAuditEvent
DynamicLoader: authZ.dll/AuthzFreeContext
DynamicLoader: authZ.dll/AuthzInitializeResourceManager
DynamicLoader: authZ.dll/AuthzFreeResourceManager
DynamicLoader: RPCRT4.dll/NdrClientCall2
DynamicLoader: RPCRT4.dll/RpcBindingCreateW
DynamicLoader: RPCRT4.dll/RpcBindingBind
DynamicLoader: RPCRT4.dll/I_RpcMapWin32Status
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventUnregister
DynamicLoader: ADVAPI32.dll/EventWrite
DynamicLoader: ADVAPI32.dll/EventActivityIdControl
DynamicLoader: ADVAPI32.dll/EventWriteTransfer
DynamicLoader: ADVAPI32.dll/EventEnabled
DynamicLoader: kernel32.dll/RegCloseKey
DynamicLoader: kernel32.dll/RegSetValueExW
DynamicLoader: kernel32.dll/RegOpenKeyExW
DynamicLoader: kernel32.dll/RegQueryValueExW
DynamicLoader: kernel32.dll/RegCloseKey
DynamicLoader: wmisvc.dll/IsImproperShutdownDetected
DynamicLoader: Wevtapi.dll/EvtRender
DynamicLoader: Wevtapi.dll/EvtNext
DynamicLoader: Wevtapi.dll/EvtClose
DynamicLoader: Wevtapi.dll/EvtQuery
DynamicLoader: Wevtapi.dll/EvtCreateRenderContext
DynamicLoader: RPCRT4.dll/RpcStringBindingComposeW
DynamicLoader: RPCRT4.dll/RpcBindingFromStringBindingW
DynamicLoader: RPCRT4.dll/RpcBindingSetAuthInfoExW
DynamicLoader: RPCRT4.dll/RpcBindingSetOption
DynamicLoader: RPCRT4.dll/RpcStringFreeW
DynamicLoader: RPCRT4.dll/NdrClientCall2
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: kernel32.dll/ResolveDelayLoadedAPI
DynamicLoader: ole32.dll/CoCreateFreeThreadedMarshaler
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CreateStreamOnHGlobal
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: KERNELBASE.dll/InitializeAcl
DynamicLoader: KERNELBASE.dll/AddAce
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: kernel32.dll/OpenProcessToken
DynamicLoader: KERNELBASE.dll/GetTokenInformation
DynamicLoader: KERNELBASE.dll/DuplicateTokenEx
DynamicLoader: KERNELBASE.dll/AdjustTokenPrivileges
DynamicLoader: kernel32.dll/SetThreadToken
DynamicLoader: KERNELBASE.dll/CheckTokenMembership
DynamicLoader: ole32.dll/CLSIDFromString
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: KERNELBASE.dll/AllocateAndInitializeSid
DynamicLoader: wbemcore.dll/Reinitialize
DynamicLoader: authZ.dll/AuthzInitializeContextFromToken
DynamicLoader: authZ.dll/AuthzInitializeResourceManager
DynamicLoader: authZ.dll/AuthzInitializeContextFromSid
DynamicLoader: authZ.dll/AuthzInitializeContextFromToken
DynamicLoader: authZ.dll/AuthzAccessCheck
DynamicLoader: authZ.dll/AuthzFreeContext
DynamicLoader: authZ.dll/AuthzFreeResourceManager
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetCallContext
DynamicLoader: wbemcore.dll/Reinitialize
DynamicLoader: ole32.dll/StringFromGUID2
DynamicLoader: ole32.dll/CoImpersonateClient
DynamicLoader: ole32.dll/CoRevertToSelf
DynamicLoader: ole32.dll/CoSwitchCallContext
DynamicLoader: ole32.dll/CoCreateGuid
DynamicLoader: kernel32.dll/ResolveDelayLoadedAPI
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: SspiCli.dll/LogonUserExExW
DynamicLoader: wbemcore.dll/Reinitialize
DynamicLoader: OLEAUT32.dll/
DynamicLoader: wbemcore.dll/Reinitialize
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: kernel32.dll/RegCreateKeyExW
DynamicLoader: ntdll.dll/EtwRegisterTraceGuidsW
DynamicLoader: ntdll.dll/EtwRegisterTraceGuidsW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: kernel32.dll/GetThreadPreferredUILanguages
DynamicLoader: kernel32.dll/SetThreadPreferredUILanguages
DynamicLoader: kernel32.dll/LocaleNameToLCID
DynamicLoader: kernel32.dll/GetLocaleInfoEx
DynamicLoader: kernel32.dll/LCIDToLocaleName
DynamicLoader: kernel32.dll/GetSystemDefaultLocaleName
DynamicLoader: FastProx.dll/DllGetClassObject
DynamicLoader: FastProx.dll/DllCanUnloadNow
DynamicLoader: kernel32.dll/RegOpenKeyExW
DynamicLoader: kernel32.dll/RegQueryValueExW
DynamicLoader: kernel32.dll/RegCloseKey
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventUnregister
DynamicLoader: ADVAPI32.dll/EventWrite
DynamicLoader: ADVAPI32.dll/EventActivityIdControl
DynamicLoader: ADVAPI32.dll/EventWriteTransfer
DynamicLoader: ADVAPI32.dll/EventEnabled
DynamicLoader: ADVAPI32.dll/RegOpenKeyW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ntdll.dll/EtwUnregisterTraceGuids
DynamicLoader: ntdll.dll/EtwUnregisterTraceGuids
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: kernel32.dll/HeapSetInformation
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/HeapSetInformation
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/RegQueryValueExW
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: kernel32.dll/RegQueryValueExW
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: kernel32.dll/SetFileShortNameW
DynamicLoader: bcryptprimitives.dll/GetHashInterface
DynamicLoader: cscapi.dll/CscNetApiGetInterface
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: sechost.dll/LookupAccountNameLocalW
Dynamic