Detections

Yara:

AgentTeslaV2

Analysis

Category Package Started Completed Duration Options Log
FILE exe 2020-06-30 13:49:48 2020-06-30 13:55:19 331 seconds Show Options Show Log
route = tor
2020-05-13 09:11:44,375 [root] INFO: Date set to: 20200630T13:37:51, timeout set to: 200
2020-06-30 13:37:51,031 [root] DEBUG: Starting analyzer from: C:\tmp52sk_on6
2020-06-30 13:37:51,031 [root] DEBUG: Storing results at: C:\qUkYtaI
2020-06-30 13:37:51,031 [root] DEBUG: Pipe server name: \\.\PIPE\QMRZoeyKmM
2020-06-30 13:37:51,031 [root] DEBUG: Python path: C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32
2020-06-30 13:37:51,031 [root] DEBUG: No analysis package specified, trying to detect it automagically.
2020-06-30 13:37:51,031 [root] INFO: Automatically selected analysis package "exe"
2020-06-30 13:37:51,031 [root] DEBUG: Trying to import analysis package "exe"...
2020-06-30 13:37:51,078 [root] DEBUG: Imported analysis package "exe".
2020-06-30 13:37:51,078 [root] DEBUG: Trying to initialize analysis package "exe"...
2020-06-30 13:37:51,078 [root] DEBUG: Initialized analysis package "exe".
2020-06-30 13:37:51,531 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.browser"...
2020-06-30 13:37:51,531 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser".
2020-06-30 13:37:51,531 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.curtain"...
2020-06-30 13:37:51,640 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain".
2020-06-30 13:37:51,640 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.digisig"...
2020-06-30 13:37:51,687 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig".
2020-06-30 13:37:51,687 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.disguise"...
2020-06-30 13:37:51,703 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise".
2020-06-30 13:37:51,703 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.human"...
2020-06-30 13:37:51,734 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human".
2020-06-30 13:37:51,734 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.procmon"...
2020-06-30 13:37:51,734 [root] DEBUG: Imported auxiliary module "modules.auxiliary.procmon".
2020-06-30 13:37:51,734 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.screenshots"...
2020-06-30 13:37:51,734 [modules.auxiliary.screenshots] DEBUG: Importing 'time'
2020-06-30 13:37:51,734 [modules.auxiliary.screenshots] DEBUG: Importing 'StringIO'
2020-06-30 13:37:51,750 [modules.auxiliary.screenshots] DEBUG: Importing 'Thread'
2020-06-30 13:37:51,750 [modules.auxiliary.screenshots] DEBUG: Importing 'Auxiliary'
2020-06-30 13:37:51,750 [modules.auxiliary.screenshots] DEBUG: Importing 'NetlogFile'
2020-06-30 13:37:51,750 [modules.auxiliary.screenshots] DEBUG: Importing 'Screenshot'
2020-06-30 13:37:51,750 [lib.api.screenshot] DEBUG: Importing 'math'
2020-06-30 13:37:51,750 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2020-06-30 13:37:54,500 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2020-06-30 13:37:54,515 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2020-06-30 13:37:54,609 [modules.auxiliary.screenshots] DEBUG: Imports OK
2020-06-30 13:37:54,609 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots".
2020-06-30 13:37:54,609 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.sysmon"...
2020-06-30 13:37:54,609 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon".
2020-06-30 13:37:54,609 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.usage"...
2020-06-30 13:37:54,625 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage".
2020-06-30 13:37:54,625 [root] DEBUG: Trying to initialize auxiliary module "Browser"...
2020-06-30 13:37:54,625 [root] DEBUG: Initialized auxiliary module "Browser".
2020-06-30 13:37:54,625 [root] DEBUG: Trying to start auxiliary module "Browser"...
2020-06-30 13:37:54,625 [root] DEBUG: Started auxiliary module Browser
2020-06-30 13:37:54,625 [root] DEBUG: Trying to initialize auxiliary module "Curtain"...
2020-06-30 13:37:54,625 [root] DEBUG: Initialized auxiliary module "Curtain".
2020-06-30 13:37:54,625 [root] DEBUG: Trying to start auxiliary module "Curtain"...
2020-06-30 13:37:54,625 [root] DEBUG: Started auxiliary module Curtain
2020-06-30 13:37:54,625 [root] DEBUG: Trying to initialize auxiliary module "DigiSig"...
2020-06-30 13:37:54,625 [root] DEBUG: Initialized auxiliary module "DigiSig".
2020-06-30 13:37:54,625 [root] DEBUG: Trying to start auxiliary module "DigiSig"...
2020-06-30 13:37:54,625 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature.
2020-06-30 13:37:54,953 [modules.auxiliary.digisig] DEBUG: File is not signed.
2020-06-30 13:37:54,953 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2020-06-30 13:37:54,968 [root] DEBUG: Started auxiliary module DigiSig
2020-06-30 13:37:54,968 [root] DEBUG: Trying to initialize auxiliary module "Disguise"...
2020-06-30 13:37:54,968 [root] DEBUG: Initialized auxiliary module "Disguise".
2020-06-30 13:37:54,968 [root] DEBUG: Trying to start auxiliary module "Disguise"...
2020-06-30 13:37:54,984 [root] DEBUG: Started auxiliary module Disguise
2020-06-30 13:37:54,984 [root] DEBUG: Trying to initialize auxiliary module "Human"...
2020-06-30 13:37:54,984 [root] DEBUG: Initialized auxiliary module "Human".
2020-06-30 13:37:54,984 [root] DEBUG: Trying to start auxiliary module "Human"...
2020-06-30 13:37:54,984 [root] DEBUG: Started auxiliary module Human
2020-06-30 13:37:54,984 [root] DEBUG: Trying to initialize auxiliary module "Procmon"...
2020-06-30 13:37:54,984 [root] DEBUG: Initialized auxiliary module "Procmon".
2020-06-30 13:37:54,984 [root] DEBUG: Trying to start auxiliary module "Procmon"...
2020-06-30 13:37:55,000 [root] DEBUG: Started auxiliary module Procmon
2020-06-30 13:37:55,000 [root] DEBUG: Trying to initialize auxiliary module "Screenshots"...
2020-06-30 13:37:55,000 [root] DEBUG: Initialized auxiliary module "Screenshots".
2020-06-30 13:37:55,000 [root] DEBUG: Trying to start auxiliary module "Screenshots"...
2020-06-30 13:37:55,000 [root] DEBUG: Started auxiliary module Screenshots
2020-06-30 13:37:55,000 [root] DEBUG: Trying to initialize auxiliary module "Sysmon"...
2020-06-30 13:37:55,000 [root] DEBUG: Initialized auxiliary module "Sysmon".
2020-06-30 13:37:55,000 [root] DEBUG: Trying to start auxiliary module "Sysmon"...
2020-06-30 13:37:55,000 [root] DEBUG: Started auxiliary module Sysmon
2020-06-30 13:37:55,000 [root] DEBUG: Trying to initialize auxiliary module "Usage"...
2020-06-30 13:37:55,015 [root] DEBUG: Initialized auxiliary module "Usage".
2020-06-30 13:37:55,015 [root] DEBUG: Trying to start auxiliary module "Usage"...
2020-06-30 13:37:55,015 [root] DEBUG: Started auxiliary module Usage
2020-06-30 13:37:55,015 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL option
2020-06-30 13:37:55,015 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL_64 option
2020-06-30 13:37:55,015 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option
2020-06-30 13:37:55,015 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option
2020-06-30 13:37:55,140 [lib.api.process] INFO: Successfully executed process from path "C:\Users\Rebecca\AppData\Local\Temp\Preform Invoice.exe" with arguments "" with pid 1232
2020-06-30 13:37:55,140 [lib.api.process] INFO: Monitor config for process 1232: C:\tmp52sk_on6\dll\1232.ini
2020-06-30 13:37:55,156 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\lnvfPcZo.dll, loader C:\tmp52sk_on6\bin\HIllrzO.exe
2020-06-30 13:37:55,281 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\QMRZoeyKmM.
2020-06-30 13:37:55,281 [root] DEBUG: Loader: Injecting process 1232 (thread 4968) with C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:37:55,296 [root] DEBUG: Process image base: 0x01060000
2020-06-30 13:37:55,296 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 13:37:55,296 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 13:37:55,296 [root] DEBUG: Successfully injected DLL C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:37:55,296 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1232
2020-06-30 13:37:57,296 [lib.api.process] INFO: Successfully resumed process with pid 1232
2020-06-30 13:37:57,796 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:37:57,796 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 13:37:57,796 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 1232 at 0x6ae60000, image base 0x1060000, stack from 0x1c5000-0x1d0000
2020-06-30 13:37:57,796 [root] DEBUG: Commandline: C:\Users\Rebecca\AppData\Local\Temp\"C:\Users\Rebecca\AppData\Local\Temp\Preform Invoice.exe".
2020-06-30 13:37:57,812 [root] INFO: Loaded monitor into process with pid 1232
2020-06-30 13:37:57,828 [root] DEBUG: set_caller_info: Adding region at 0x000D0000 to caller regions list (advapi32::RegQueryInfoKeyW).
2020-06-30 13:37:57,828 [root] DEBUG: set_caller_info: Adding region at 0x006C0000 to caller regions list (ntdll::RtlDispatchException).
2020-06-30 13:37:57,843 [root] DEBUG: DLL loaded at 0x756F0000: C:\Windows\system32\cryptbase (0xc000 bytes).
2020-06-30 13:37:57,843 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x6c0000
2020-06-30 13:37:57,843 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x006C0000 size 0x400000.
2020-06-30 13:37:57,843 [root] DEBUG: DumpPEsInRange: Scanning range 0x6c0000 - 0x6c1000.
2020-06-30 13:37:57,843 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x6c0000-0x6c1000.
2020-06-30 13:37:57,984 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\qUkYtaI\CAPE\1232_89393086657571730262020 (size 0xf68)
2020-06-30 13:37:57,984 [root] DEBUG: DumpRegion: Dumped stack region from 0x006C0000, size 0x1000.
2020-06-30 13:37:57,984 [root] DEBUG: set_caller_info: Failed to dumping calling PE image at 0x000D0000.
2020-06-30 13:37:57,984 [root] DEBUG: set_caller_info: Adding region at 0x004C0000 to caller regions list (kernel32::FindFirstFileExW).
2020-06-30 13:37:58,359 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\qUkYtaI\CAPE\1232_3654028057571730262020 (size 0x100099)
2020-06-30 13:37:58,359 [root] DEBUG: DumpRegion: Dumped stack region from 0x004C0000, size 0x101000.
2020-06-30 13:37:58,359 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xb8 amd local view 0x6BE30000 to global list.
2020-06-30 13:37:58,359 [root] DEBUG: DLL loaded at 0x6BE30000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x7d000 bytes).
2020-06-30 13:37:58,375 [root] DEBUG: DLL unloaded from 0x76970000.
2020-06-30 13:37:58,375 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xd4 amd local view 0x00350000 to global list.
2020-06-30 13:37:58,390 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xd0 amd local view 0x00350000 to global list.
2020-06-30 13:37:58,390 [root] DEBUG: DLL loaded at 0x74C70000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-30 13:37:58,390 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0FFB0000 for section view with handle 0xd4.
2020-06-30 13:37:58,390 [root] DEBUG: DLL loaded at 0x0FFB0000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr (0x6ef000 bytes).
2020-06-30 13:37:58,406 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6E9E0000 for section view with handle 0xd4.
2020-06-30 13:37:58,406 [root] DEBUG: DLL loaded at 0x6E9E0000: C:\Windows\system32\MSVCR120_CLR0400 (0xf5000 bytes).
2020-06-30 13:37:58,421 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1232, handle 0xf4.
2020-06-30 13:37:58,421 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xf8 amd local view 0x00090000 to global list.
2020-06-30 13:37:58,421 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xfc amd local view 0x000A0000 to global list.
2020-06-30 13:37:58,421 [root] INFO: Disabling sleep skipping.
2020-06-30 13:37:58,421 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 1232.
2020-06-30 13:37:58,421 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 1232.
2020-06-30 13:37:58,437 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1f0 amd local view 0x058D0000 to global list.
2020-06-30 13:37:58,593 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1f4 amd local view 0x65E60000 to global list.
2020-06-30 13:37:58,593 [root] DEBUG: DLL loaded at 0x65E60000: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni (0x1393000 bytes).
2020-06-30 13:37:58,625 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x200 amd local view 0x6A900000 to global list.
2020-06-30 13:37:58,625 [root] DEBUG: DLL loaded at 0x6A900000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit (0x80000 bytes).
2020-06-30 13:37:58,625 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1fc amd local view 0x75CB0000 to global list.
2020-06-30 13:37:58,625 [root] DEBUG: DLL loaded at 0x75CB0000: C:\Windows\system32\OLEAUT32 (0x91000 bytes).
2020-06-30 13:37:58,656 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x214 amd local view 0x68060000 to global list.
2020-06-30 13:37:58,656 [root] DEBUG: DLL loaded at 0x68060000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni (0xa10000 bytes).
2020-06-30 13:37:58,656 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x68C10000 for section view with handle 0x214.
2020-06-30 13:37:58,671 [root] DEBUG: DLL loaded at 0x68C10000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni (0x194000 bytes).
2020-06-30 13:37:58,687 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x210 amd local view 0x65140000 to global list.
2020-06-30 13:37:58,687 [root] DEBUG: DLL loaded at 0x65140000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni (0xd1d000 bytes).
2020-06-30 13:37:58,812 [root] DEBUG: set_caller_info: Adding region at 0x00370000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-06-30 13:37:58,812 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x37ffff
2020-06-30 13:37:58,812 [root] DEBUG: DumpMemory: Nothing to dump at 0x00370000!
2020-06-30 13:37:58,812 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00370000 size 0x10000.
2020-06-30 13:37:58,812 [root] DEBUG: DumpPEsInRange: Scanning range 0x370000 - 0x371000.
2020-06-30 13:37:58,812 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x370000-0x371000.
2020-06-30 13:37:58,843 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\qUkYtaI\CAPE\1232_209842894818581730262020 (size 0x52d)
2020-06-30 13:37:58,843 [root] DEBUG: DumpRegion: Dumped stack region from 0x00370000, size 0x1000.
2020-06-30 13:37:58,843 [root] DEBUG: DLL loaded at 0x74290000: C:\Windows\system32\uxtheme (0x40000 bytes).
2020-06-30 13:37:58,875 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x220 amd local view 0x67B60000 to global list.
2020-06-30 13:37:58,984 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x228 amd local view 0x00FA0000 to global list.
2020-06-30 13:37:59,031 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x003B0000 for section view with handle 0x228.
2020-06-30 13:38:09,093 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x22c amd local view 0x740F0000 to global list.
2020-06-30 13:38:09,109 [root] DEBUG: DLL loaded at 0x740F0000: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\gdiplus (0x192000 bytes).
2020-06-30 13:38:09,125 [root] DEBUG: set_caller_info: Adding region at 0x000C0000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-06-30 13:38:09,125 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0xcffff
2020-06-30 13:38:09,125 [root] DEBUG: DumpMemory: Nothing to dump at 0x000C0000!
2020-06-30 13:38:09,125 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x000C0000 size 0x10000.
2020-06-30 13:38:09,125 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0xc0000-0xc1000.
2020-06-30 13:38:09,156 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\qUkYtaI\CAPE\1232_47142400752581730262020 (size 0x14)
2020-06-30 13:38:09,156 [root] DEBUG: DumpRegion: Dumped stack region from 0x000C0000, size 0x1000.
2020-06-30 13:38:09,156 [root] DEBUG: DLL loaded at 0x73B20000: C:\Windows\system32\WindowsCodecs (0x131000 bytes).
2020-06-30 13:38:09,156 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x23c amd local view 0x00C70000 to global list.
2020-06-30 13:38:09,156 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x00C80000 for section view with handle 0x23c.
2020-06-30 13:38:09,171 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x00C90000 for section view with handle 0x23c.
2020-06-30 13:38:09,453 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 1232.
2020-06-30 13:38:09,484 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 1232.
2020-06-30 13:38:09,593 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x260 amd local view 0x67880000 to global list.
2020-06-30 13:38:09,593 [root] DEBUG: DLL loaded at 0x67880000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni (0x7e0000 bytes).
2020-06-30 13:38:09,640 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x25c amd local view 0x64F60000 to global list.
2020-06-30 13:38:09,640 [root] DEBUG: DLL loaded at 0x64F60000: C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni (0x1d1000 bytes).
2020-06-30 13:38:09,687 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x258 amd local view 0x71160000 to global list.
2020-06-30 13:38:09,703 [root] DEBUG: DLL loaded at 0x71160000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting (0x13000 bytes).
2020-06-30 13:38:09,703 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x06290000 for section view with handle 0x258.
2020-06-30 13:38:09,812 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x254 amd local view 0x00DA0000 to global list.
2020-06-30 13:38:20,078 [root] DEBUG: DLL loaded at 0x76B60000: C:\Windows\system32\shell32 (0xc4c000 bytes).
2020-06-30 13:38:20,093 [root] INFO: Added new file to list with pid None and path C:\Users\Rebecca\AppData\Roaming\PUvJoaHGhK.exe
2020-06-30 13:38:20,109 [root] INFO: Added new file to list with pid None and path C:\Users\Rebecca\AppData\Local\Temp\tmp9926.tmp
2020-06-30 13:38:20,125 [root] DEBUG: DLL loaded at 0x743C0000: C:\Windows\system32\PROPSYS (0xf5000 bytes).
2020-06-30 13:38:20,125 [root] DEBUG: DLL loaded at 0x74620000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32 (0x19e000 bytes).
2020-06-30 13:38:20,140 [root] DEBUG: DLL loaded at 0x756A0000: C:\Windows\system32\apphelp (0x4c000 bytes).
2020-06-30 13:38:20,140 [root] DEBUG: DLL loaded at 0x76130000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2020-06-30 13:38:20,140 [root] DEBUG: DLL loaded at 0x6BF80000: C:\Windows\System32\ieframe (0xaba000 bytes).
2020-06-30 13:38:20,156 [root] DEBUG: DLL loaded at 0x75AD0000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes).
2020-06-30 13:38:20,156 [root] DEBUG: DLL loaded at 0x75860000: C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0 (0x4000 bytes).
2020-06-30 13:38:20,156 [root] DEBUG: DLL loaded at 0x75870000: C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes).
2020-06-30 13:38:20,156 [root] DEBUG: DLL loaded at 0x6BF70000: C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0 (0x4000 bytes).
2020-06-30 13:38:20,156 [root] DEBUG: DLL loaded at 0x75830000: C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes).
2020-06-30 13:38:20,171 [root] DEBUG: DLL loaded at 0x75820000: C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes).
2020-06-30 13:38:20,171 [root] DEBUG: DLL loaded at 0x77910000: C:\Windows\system32\normaliz (0x3000 bytes).
2020-06-30 13:38:20,171 [root] DEBUG: DLL loaded at 0x75E40000: C:\Windows\system32\iertutil (0x215000 bytes).
2020-06-30 13:38:20,203 [root] DEBUG: DLL loaded at 0x76530000: C:\Windows\system32\SETUPAPI (0x19d000 bytes).
2020-06-30 13:38:20,218 [root] DEBUG: DLL loaded at 0x75A00000: C:\Windows\system32\CFGMGR32 (0x27000 bytes).
2020-06-30 13:38:20,218 [root] DEBUG: DLL loaded at 0x75840000: C:\Windows\system32\DEVOBJ (0x12000 bytes).
2020-06-30 13:38:20,234 [root] DEBUG: DLL loaded at 0x744C0000: C:\Windows\system32\ntmarta (0x21000 bytes).
2020-06-30 13:38:20,234 [root] DEBUG: DLL loaded at 0x75B60000: C:\Windows\system32\WLDAP32 (0x45000 bytes).
2020-06-30 13:38:20,249 [root] DEBUG: DLL loaded at 0x757A0000: C:\Windows\system32\profapi (0xb000 bytes).
2020-06-30 13:38:20,249 [root] DEBUG: DLL unloaded from 0x76B60000.
2020-06-30 13:38:20,249 [root] DEBUG: DLL loaded at 0x761C0000: C:\Windows\system32\urlmon (0x124000 bytes).
2020-06-30 13:38:20,249 [root] DEBUG: DLL loaded at 0x75AC0000: C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0 (0x4000 bytes).
2020-06-30 13:38:20,265 [root] DEBUG: DLL loaded at 0x766D0000: C:\Windows\system32\WININET (0x1c4000 bytes).
2020-06-30 13:38:20,265 [root] DEBUG: DLL loaded at 0x75480000: C:\Windows\system32\Secur32 (0x8000 bytes).
2020-06-30 13:38:20,281 [root] INFO: Announced 32-bit process name: schtasks.exe pid: 4384
2020-06-30 13:38:20,281 [lib.api.process] INFO: Monitor config for process 4384: C:\tmp52sk_on6\dll\4384.ini
2020-06-30 13:38:20,296 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\lnvfPcZo.dll, loader C:\tmp52sk_on6\bin\HIllrzO.exe
2020-06-30 13:38:20,312 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\QMRZoeyKmM.
2020-06-30 13:38:20,312 [root] DEBUG: Loader: Injecting process 4384 (thread 5860) with C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:38:20,312 [root] DEBUG: Process image base: 0x00400000
2020-06-30 13:38:20,312 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:38:20,328 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-30 13:38:20,343 [root] DEBUG: Successfully injected DLL C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:38:20,343 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 4384
2020-06-30 13:38:20,343 [root] DEBUG: CreateProcessHandler: Injection info set for new process 4384, ImageBase: 0x00400000
2020-06-30 13:38:20,343 [root] INFO: Announced 32-bit process name: schtasks.exe pid: 4384
2020-06-30 13:38:20,343 [lib.api.process] INFO: Monitor config for process 4384: C:\tmp52sk_on6\dll\4384.ini
2020-06-30 13:38:20,343 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\lnvfPcZo.dll, loader C:\tmp52sk_on6\bin\HIllrzO.exe
2020-06-30 13:38:20,359 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\QMRZoeyKmM.
2020-06-30 13:38:20,359 [root] DEBUG: Loader: Injecting process 4384 (thread 5860) with C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:38:20,359 [root] DEBUG: Process image base: 0x00400000
2020-06-30 13:38:20,359 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:38:20,359 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-06-30 13:38:20,375 [root] DEBUG: Successfully injected DLL C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:38:20,375 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 4384
2020-06-30 13:38:20,390 [root] DEBUG: DLL loaded at 0x751C0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-06-30 13:38:20,390 [root] DEBUG: DLL loaded at 0x74F50000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-06-30 13:38:20,406 [root] DEBUG: DLL loaded at 0x75790000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-06-30 13:38:20,437 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:38:20,437 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 13:38:20,437 [root] INFO: Disabling sleep skipping.
2020-06-30 13:38:20,453 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-30 13:38:20,453 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 4384 at 0x6ae60000, image base 0x400000, stack from 0x246000-0x250000
2020-06-30 13:38:20,453 [root] DEBUG: Commandline: C:\Users\Rebecca\AppData\Local\Temp\"C:\Windows\System32\schtasks.exe" \Create \TN "Updates\PUvJoaHGhK" \XML "C:\Users\Rebecca\AppData\Local\Temp\tmp9926.tmp".
2020-06-30 13:38:20,453 [root] INFO: Loaded monitor into process with pid 4384
2020-06-30 13:38:20,500 [root] DEBUG: DLL loaded at 0x74C70000: C:\Windows\System32\VERSION (0x9000 bytes).
2020-06-30 13:38:20,500 [root] DEBUG: DLL unloaded from 0x00400000.
2020-06-30 13:38:20,515 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xc0 amd local view 0x02830000 to global list.
2020-06-30 13:38:20,515 [root] DEBUG: DLL loaded at 0x756F0000: C:\Windows\System32\CRYPTBASE (0xc000 bytes).
2020-06-30 13:38:20,515 [root] DEBUG: ResumeThreadHandler: CurrentInjectionInfo 0x0 (Pid 4384).
2020-06-30 13:38:20,531 [root] INFO: Stopping Task Scheduler Service
2020-06-30 13:38:20,734 [root] INFO: Stopped Task Scheduler Service
2020-06-30 13:38:20,765 [root] INFO: Starting Task Scheduler Service
2020-06-30 13:38:20,812 [root] INFO: Started Task Scheduler Service
2020-06-30 13:38:20,812 [lib.api.process] INFO: Monitor config for process 836: C:\tmp52sk_on6\dll\836.ini
2020-06-30 13:38:20,812 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\lnvfPcZo.dll, loader C:\tmp52sk_on6\bin\HIllrzO.exe
2020-06-30 13:38:20,828 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\QMRZoeyKmM.
2020-06-30 13:38:20,828 [root] DEBUG: Loader: Injecting process 836 (thread 0) with C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:38:20,843 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 964, handle 0xa0
2020-06-30 13:38:20,843 [root] DEBUG: Process image base: 0x00280000
2020-06-30 13:38:20,843 [root] DEBUG: InjectDllViaIAT: Not a new process, aborting IAT patch
2020-06-30 13:38:20,843 [root] DEBUG: InjectDll: IAT patching failed, falling back to thread injection.
2020-06-30 13:38:20,843 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:38:20,843 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 13:38:20,843 [root] INFO: Disabling sleep skipping.
2020-06-30 13:38:20,859 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 836 at 0x6ae60000, image base 0x280000, stack from 0x1fa6000-0x1fb0000
2020-06-30 13:38:20,859 [root] DEBUG: Commandline: C:\Windows\System32\svchost.exe -k netsvcs.
2020-06-30 13:38:20,859 [root] INFO: Loaded monitor into process with pid 836
2020-06-30 13:38:20,875 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-30 13:38:20,875 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-30 13:38:20,875 [root] DEBUG: Successfully injected DLL C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:38:21,328 [root] DEBUG: set_caller_info: Adding region at 0x6E0B0000 to caller regions list (ntdll::NtWaitForSingleObject).
2020-06-30 13:38:21,328 [root] DEBUG: set_caller_info: Calling region at 0x6E0B0000 skipped.
2020-06-30 13:38:22,875 [root] DEBUG: DLL loaded at 0x76130000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2020-06-30 13:38:22,875 [root] DEBUG: DLL loaded at 0x73E40000: C:\Windows\system32\taskschd (0x7d000 bytes).
2020-06-30 13:38:24,109 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 4384
2020-06-30 13:38:24,109 [root] DEBUG: GetHookCallerBase: thread 5860 (handle 0x0), return address 0x00417569, allocation base 0x00400000.
2020-06-30 13:38:24,109 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00400000.
2020-06-30 13:38:24,109 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00400000.
2020-06-30 13:38:24,109 [root] DEBUG: DumpProcess: Module entry point VA is 0x00017683.
2020-06-30 13:38:24,203 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x2b400.
2020-06-30 13:38:24,203 [root] DEBUG: DLL unloaded from 0x75C80000.
2020-06-30 13:38:24,203 [root] INFO: Process with pid 4384 has terminated
2020-06-30 13:38:24,343 [root] INFO: Announced 32-bit process name: Preform Invoice.exe pid: 4560
2020-06-30 13:38:24,359 [lib.api.process] INFO: Monitor config for process 4560: C:\tmp52sk_on6\dll\4560.ini
2020-06-30 13:38:24,390 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\lnvfPcZo.dll, loader C:\tmp52sk_on6\bin\HIllrzO.exe
2020-06-30 13:38:24,421 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\QMRZoeyKmM.
2020-06-30 13:38:24,437 [root] DEBUG: Loader: Injecting process 4560 (thread 2352) with C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:38:24,437 [root] DEBUG: Process image base: 0x01060000
2020-06-30 13:38:24,437 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 13:38:24,453 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 13:38:24,453 [root] DEBUG: Successfully injected DLL C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:38:24,453 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 4560
2020-06-30 13:38:24,500 [root] DEBUG: CreateProcessHandler: Injection info set for new process 4560, ImageBase: 0x01060000
2020-06-30 13:38:24,515 [root] INFO: Announced 32-bit process name: Preform Invoice.exe pid: 4560
2020-06-30 13:38:24,515 [lib.api.process] INFO: Monitor config for process 4560: C:\tmp52sk_on6\dll\4560.ini
2020-06-30 13:38:24,515 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\lnvfPcZo.dll, loader C:\tmp52sk_on6\bin\HIllrzO.exe
2020-06-30 13:38:24,546 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\QMRZoeyKmM.
2020-06-30 13:38:24,562 [root] DEBUG: Loader: Injecting process 4560 (thread 2352) with C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:38:24,578 [root] DEBUG: Process image base: 0x01060000
2020-06-30 13:38:24,578 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 13:38:24,578 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 13:38:24,578 [root] DEBUG: Successfully injected DLL C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:38:24,578 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 4560
2020-06-30 13:38:24,609 [root] DEBUG: WriteMemoryHandler: Executable binary injected into process 4560 (ImageBase 0x400000)
2020-06-30 13:38:24,625 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-30 13:38:24,625 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x0447A200.
2020-06-30 13:38:24,703 [root] DEBUG: DumpPE: PE file in memory dumped successfully - dump size 0x45600.
2020-06-30 13:38:24,718 [root] DEBUG: WriteMemoryHandler: Dumped PE image from buffer at 0x447a200, SizeOfImage 0x4c000.
2020-06-30 13:38:24,718 [root] INFO: Announced 32-bit process name: Preform Invoice.exe pid: 4560
2020-06-30 13:38:24,718 [lib.api.process] INFO: Monitor config for process 4560: C:\tmp52sk_on6\dll\4560.ini
2020-06-30 13:38:24,734 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\lnvfPcZo.dll, loader C:\tmp52sk_on6\bin\HIllrzO.exe
2020-06-30 13:38:24,734 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\QMRZoeyKmM.
2020-06-30 13:38:24,750 [root] DEBUG: Loader: Injecting process 4560 (thread 0) with C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:38:24,750 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 2352, handle 0xa0
2020-06-30 13:38:24,765 [root] DEBUG: Process image base: 0x01060000
2020-06-30 13:38:24,765 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 13:38:24,765 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 13:38:24,765 [root] DEBUG: Successfully injected DLL C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:38:24,765 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 4560
2020-06-30 13:38:24,796 [root] DEBUG: WriteMemoryHandler: injection of section of PE image which has already been dumped.
2020-06-30 13:38:24,796 [root] INFO: Announced 32-bit process name: Preform Invoice.exe pid: 4560
2020-06-30 13:38:24,812 [lib.api.process] INFO: Monitor config for process 4560: C:\tmp52sk_on6\dll\4560.ini
2020-06-30 13:38:24,828 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\lnvfPcZo.dll, loader C:\tmp52sk_on6\bin\HIllrzO.exe
2020-06-30 13:38:24,828 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\QMRZoeyKmM.
2020-06-30 13:38:24,828 [root] DEBUG: Loader: Injecting process 4560 (thread 0) with C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:38:24,828 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 13:38:24,828 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 13:38:24,875 [root] DEBUG: Failed to inject DLL C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:38:24,875 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 4560, error: 4294967281
2020-06-30 13:38:24,921 [root] DEBUG: WriteMemoryHandler: shellcode at 0x038AAD98 (size 0x600) injected into process 4560.
2020-06-30 13:38:24,968 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\qUkYtaI\CAPE\1232_16133673221701830262020 (size 0x51d)
2020-06-30 13:38:25,000 [root] DEBUG: WriteMemoryHandler: Dumped injected code/data from buffer.
2020-06-30 13:38:25,015 [root] INFO: Announced 32-bit process name: Preform Invoice.exe pid: 4560
2020-06-30 13:38:25,015 [lib.api.process] INFO: Monitor config for process 4560: C:\tmp52sk_on6\dll\4560.ini
2020-06-30 13:38:25,031 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\lnvfPcZo.dll, loader C:\tmp52sk_on6\bin\HIllrzO.exe
2020-06-30 13:38:25,078 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\QMRZoeyKmM.
2020-06-30 13:38:25,109 [root] DEBUG: Loader: Injecting process 4560 (thread 0) with C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:38:25,125 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID -17, handle 0x0
2020-06-30 13:38:25,125 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:38:25,140 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 13:38:25,171 [root] INFO: Disabling sleep skipping.
2020-06-30 13:38:25,187 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 4560 at 0x6ae60000, image base 0x1060000, stack from 0x686000-0x690000
2020-06-30 13:38:25,187 [root] DEBUG: Commandline: C:\Users\Rebecca\AppData\Local\Temp\"{path}".
2020-06-30 13:38:25,234 [root] INFO: Loaded monitor into process with pid 4560
2020-06-30 13:38:25,265 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-30 13:38:25,281 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-30 13:38:25,281 [root] DEBUG: Successfully injected DLL C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:38:25,296 [root] DEBUG: WriteMemoryHandler: shellcode at 0x038AB3A4 (size 0x200) injected into process 4560.
2020-06-30 13:38:25,343 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\qUkYtaI\CAPE\1232_13136761281801830262020 (size 0x9)
2020-06-30 13:38:25,375 [root] DEBUG: WriteMemoryHandler: Dumped injected code/data from buffer.
2020-06-30 13:38:25,406 [root] DEBUG: SetThreadContextHandler: Hollow process entry point reset via NtSetContextThread to 0x00046ABE (process 4560).
2020-06-30 13:38:25,421 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 4560.
2020-06-30 13:38:25,421 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 1232.
2020-06-30 13:38:25,421 [root] DEBUG: set_caller_info: Adding region at 0x00030000 to caller regions list (ntdll::LdrLoadDll).
2020-06-30 13:38:25,421 [root] DEBUG: set_caller_info: Adding region at 0x009E0000 to caller regions list (kernel32::GetSystemTime).
2020-06-30 13:38:25,437 [root] DEBUG: DLL loaded at 0x756F0000: C:\Windows\system32\cryptbase (0xc000 bytes).
2020-06-30 13:38:25,453 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x9e0000
2020-06-30 13:38:25,453 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 1232.
2020-06-30 13:38:25,453 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x009E0000 size 0x400000.
2020-06-30 13:38:25,453 [root] DEBUG: DumpPEsInRange: Scanning range 0x9e0000 - 0x9e1000.
2020-06-30 13:38:25,468 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x9e0000-0x9e1000.
2020-06-30 13:38:25,531 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\qUkYtaI\CAPE\4560_82229202425581730262020 (size 0x596)
2020-06-30 13:38:25,546 [root] DEBUG: DumpRegion: Dumped stack region from 0x009E0000, size 0x1000.
2020-06-30 13:38:25,578 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\qUkYtaI\CAPE\4560_199339383025581730262020 (size 0x12b)
2020-06-30 13:38:25,593 [root] DEBUG: DumpRegion: Dumped stack region from 0x00030000, size 0x1000.
2020-06-30 13:38:25,609 [root] DEBUG: DLL loaded at 0x00560000: C:\tmp52sk_on6\dll\lnvfPcZo (0xd5000 bytes).
2020-06-30 13:38:25,609 [root] DEBUG: DLL unloaded from 0x72070000.
2020-06-30 13:38:25,625 [root] DEBUG: DLL unloaded from 0x76450000.
2020-06-30 13:38:25,625 [root] DEBUG: DLL unloaded from 0x72070000.
2020-06-30 13:38:25,640 [root] DEBUG: DLL unloaded from 0x76450000.
2020-06-30 13:38:25,640 [root] DEBUG: DLL unloaded from 0x00560000.
2020-06-30 13:38:25,656 [root] DEBUG: set_caller_info: Adding region at 0x00070000 to caller regions list (ntdll::LdrLoadDll).
2020-06-30 13:38:25,750 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\qUkYtaI\CAPE\4560_127444747225581730262020 (size 0x12b)
2020-06-30 13:38:25,750 [root] DEBUG: DumpRegion: Dumped stack region from 0x00070000, size 0x1000.
2020-06-30 13:38:25,765 [root] DEBUG: DLL loaded at 0x00560000: C:\tmp52sk_on6\dll\lnvfPcZo (0xd5000 bytes).
2020-06-30 13:38:25,765 [root] DEBUG: DLL unloaded from 0x72070000.
2020-06-30 13:38:25,765 [root] DEBUG: DLL unloaded from 0x76450000.
2020-06-30 13:38:25,765 [root] DEBUG: DLL unloaded from 0x72070000.
2020-06-30 13:38:25,765 [root] DEBUG: DLL unloaded from 0x76450000.
2020-06-30 13:38:25,781 [root] DEBUG: DLL unloaded from 0x00560000.
2020-06-30 13:38:25,796 [root] DEBUG: DLL unloaded from 0x76970000.
2020-06-30 13:38:25,796 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 4560
2020-06-30 13:38:25,796 [root] DEBUG: GetHookCallerBase: thread 2352 (handle 0x0), return address 0x6AE91698, allocation base 0x6AE60000.
2020-06-30 13:38:25,812 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x01060000.
2020-06-30 13:38:25,812 [root] DEBUG: LooksLikeSectionBoundary: Exception occured reading around suspected boundary at 0x01062000
2020-06-30 13:38:25,828 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-30 13:38:25,828 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x01060000.
2020-06-30 13:38:26,156 [root] DEBUG: DumpPE: Error: Cannot dump PE file from memory.
2020-06-30 13:38:26,156 [root] DEBUG: DumpImageInCurrentProcess: Failed to dump 'raw' PE image from 0x01060000, dumping memory region.
2020-06-30 13:38:26,171 [root] DEBUG: DoProcessDump: Dumping 'new' Imagebase at 0x00400000.
2020-06-30 13:38:26,171 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-30 13:38:26,171 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00400000.
2020-06-30 13:38:26,171 [root] DEBUG: DumpProcess: Module entry point VA is 0x00046ABE.
2020-06-30 13:38:26,281 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x45800.
2020-06-30 13:38:26,312 [root] DEBUG: DLL unloaded from 0x75C80000.
2020-06-30 13:38:26,359 [root] DEBUG: DLL unloaded from 0x6BE30000.
2020-06-30 13:38:26,375 [root] INFO: Process with pid 4560 has terminated
2020-06-30 13:38:27,484 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 1232
2020-06-30 13:38:27,484 [root] DEBUG: GetHookCallerBase: thread 4968 (handle 0x0), return address 0x003721B9, allocation base 0x00370000.
2020-06-30 13:38:27,484 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x01060000.
2020-06-30 13:38:27,484 [root] DEBUG: LooksLikeSectionBoundary: Exception occured reading around suspected boundary at 0x01062000
2020-06-30 13:38:27,484 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-30 13:38:27,484 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x01060000.
2020-06-30 13:38:27,515 [root] DEBUG: DumpPE: Error: Cannot dump PE file from memory.
2020-06-30 13:38:27,515 [root] DEBUG: DumpImageInCurrentProcess: Failed to dump 'raw' PE image from 0x01060000, dumping memory region.
2020-06-30 13:38:27,531 [root] DEBUG: DLL unloaded from 0x76450000.
2020-06-30 13:38:27,531 [root] DEBUG: DLL unloaded from 0x743C0000.
2020-06-30 13:38:27,562 [root] DEBUG: DLL unloaded from 0x75C80000.
2020-06-30 13:38:27,562 [root] DEBUG: DLL unloaded from 0x744C0000.
2020-06-30 13:38:27,609 [root] DEBUG: DLL unloaded from 0x0FFB0000.
2020-06-30 13:38:27,609 [root] DEBUG: DLL unloaded from 0x6BE30000.
2020-06-30 13:38:27,640 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 1232
2020-06-30 13:38:27,640 [root] DEBUG: GetHookCallerBase: thread 4968 (handle 0x0), return address 0x003721B9, allocation base 0x00370000.
2020-06-30 13:38:27,640 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x01060000.
2020-06-30 13:38:27,656 [root] DEBUG: LooksLikeSectionBoundary: Exception occured reading around suspected boundary at 0x01062000
2020-06-30 13:38:27,656 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-30 13:38:27,656 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x01060000.
2020-06-30 13:38:27,703 [root] DEBUG: DumpPE: Error: Cannot dump PE file from memory.
2020-06-30 13:38:27,703 [root] DEBUG: DumpImageInCurrentProcess: Failed to dump 'raw' PE image from 0x01060000, dumping memory region.
2020-06-30 13:38:27,718 [root] INFO: Process with pid 1232 has terminated
2020-06-30 13:38:53,531 [root] DEBUG: set_caller_info: Adding region at 0x6F330000 to caller regions list (kernel32::GetSystemTimeAsFileTime).
2020-06-30 13:38:53,562 [root] DEBUG: set_caller_info: Calling region at 0x6F330000 skipped.
2020-06-30 13:38:54,875 [root] DEBUG: set_caller_info: Adding region at 0x6EC50000 to caller regions list (ntdll::memcpy).
2020-06-30 13:38:54,890 [root] DEBUG: set_caller_info: Calling region at 0x6EC50000 skipped.
2020-06-30 13:38:54,890 [root] DEBUG: set_caller_info: Adding region at 0x6E6A0000 to caller regions list (ntdll::memcpy).
2020-06-30 13:39:10,203 [root] DEBUG: DLL unloaded from 0x762F0000.
2020-06-30 13:39:33,015 [root] INFO: Announced 32-bit process name: taskeng.exe pid: 5196
2020-06-30 13:39:33,031 [lib.api.process] INFO: Monitor config for process 5196: C:\tmp52sk_on6\dll\5196.ini
2020-06-30 13:39:33,046 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\lnvfPcZo.dll, loader C:\tmp52sk_on6\bin\HIllrzO.exe
2020-06-30 13:39:33,078 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\QMRZoeyKmM.
2020-06-30 13:39:33,078 [root] DEBUG: Loader: Injecting process 5196 (thread 5184) with C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:39:33,078 [root] DEBUG: Process image base: 0x006B0000
2020-06-30 13:39:33,078 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:39:33,093 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-30 13:39:33,093 [root] DEBUG: Successfully injected DLL C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:39:33,109 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 5196
2020-06-30 13:39:33,109 [root] DEBUG: CreateProcessHandler: Injection info set for new process 5196, ImageBase: 0x006B0000
2020-06-30 13:39:33,125 [root] INFO: Announced 32-bit process name: taskeng.exe pid: 5196
2020-06-30 13:39:33,125 [lib.api.process] INFO: Monitor config for process 5196: C:\tmp52sk_on6\dll\5196.ini
2020-06-30 13:39:33,125 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\lnvfPcZo.dll, loader C:\tmp52sk_on6\bin\HIllrzO.exe
2020-06-30 13:39:33,156 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\QMRZoeyKmM.
2020-06-30 13:39:33,156 [root] DEBUG: Loader: Injecting process 5196 (thread 5184) with C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:39:33,156 [root] DEBUG: Process image base: 0x006B0000
2020-06-30 13:39:33,156 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:39:33,156 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-06-30 13:39:33,171 [root] DEBUG: Successfully injected DLL C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:39:33,187 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 5196
2020-06-30 13:39:33,218 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:39:33,249 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 13:39:33,281 [root] INFO: Disabling sleep skipping.
2020-06-30 13:39:33,281 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-30 13:39:33,281 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 5196 at 0x6ae60000, image base 0x6b0000, stack from 0x116000-0x120000
2020-06-30 13:39:33,296 [root] DEBUG: Commandline: C:\Windows\System32\taskeng.exe {0CA5C4CD-C1DF-4F2A-9B3D-3FB4F80A231F} S-1-5-18:NT AUTHORITY\System:Service:.
2020-06-30 13:39:33,343 [root] INFO: Loaded monitor into process with pid 5196
2020-06-30 13:39:33,359 [root] DEBUG: DLL loaded at 0x756F0000: C:\Windows\system32\CRYPTBASE (0xc000 bytes).
2020-06-30 13:39:33,359 [root] DEBUG: ResumeThreadHandler: CurrentInjectionInfo 0x0 (Pid 5196).
2020-06-30 13:39:33,390 [root] DEBUG: DLL loaded at 0x751C0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-06-30 13:39:33,406 [root] DEBUG: DLL loaded at 0x74F50000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-06-30 13:39:33,531 [root] DEBUG: DLL loaded at 0x75790000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-06-30 13:39:33,546 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x150 amd local view 0x00150000 to global list.
2020-06-30 13:39:33,546 [root] DEBUG: DLL loaded at 0x76130000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2020-06-30 13:39:33,562 [root] DEBUG: DLL loaded at 0x71150000: C:\Windows\system32\tschannel (0x8000 bytes).
2020-06-30 13:39:33,593 [root] DEBUG: DLL loaded at 0x73D50000: C:\Windows\system32\XmlLite (0x2f000 bytes).
2020-06-30 13:39:33,625 [root] INFO: Announced 32-bit process name: GoogleUpdate.exe pid: 5096
2020-06-30 13:39:33,640 [lib.api.process] INFO: Monitor config for process 5096: C:\tmp52sk_on6\dll\5096.ini
2020-06-30 13:39:33,640 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\lnvfPcZo.dll, loader C:\tmp52sk_on6\bin\HIllrzO.exe
2020-06-30 13:39:33,656 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\QMRZoeyKmM.
2020-06-30 13:39:33,671 [root] DEBUG: Loader: Injecting process 5096 (thread 4976) with C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:39:33,671 [root] DEBUG: Process image base: 0x01170000
2020-06-30 13:39:33,687 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:39:33,687 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-30 13:39:33,687 [root] DEBUG: Successfully injected DLL C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:39:33,703 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 5096
2020-06-30 13:39:33,718 [root] DEBUG: DLL loaded at 0x756A0000: C:\Windows\system32\apphelp (0x4c000 bytes).
2020-06-30 13:39:33,734 [root] DEBUG: CreateProcessHandler: Injection info set for new process 5096, ImageBase: 0x01170000
2020-06-30 13:39:33,734 [root] INFO: Announced 32-bit process name: GoogleUpdate.exe pid: 5096
2020-06-30 13:39:33,750 [lib.api.process] INFO: Monitor config for process 5096: C:\tmp52sk_on6\dll\5096.ini
2020-06-30 13:39:33,750 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\lnvfPcZo.dll, loader C:\tmp52sk_on6\bin\HIllrzO.exe
2020-06-30 13:39:33,796 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\QMRZoeyKmM.
2020-06-30 13:39:33,796 [root] DEBUG: Loader: Injecting process 5096 (thread 4976) with C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:39:33,812 [root] DEBUG: Process image base: 0x01170000
2020-06-30 13:39:33,828 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:39:33,843 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-06-30 13:39:33,843 [root] DEBUG: Successfully injected DLL C:\tmp52sk_on6\dll\lnvfPcZo.dll.
2020-06-30 13:39:33,843 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 5096
2020-06-30 13:39:33,859 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 5096.
2020-06-30 13:39:33,890 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:39:33,890 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 13:39:33,906 [root] INFO: Disabling sleep skipping.
2020-06-30 13:39:33,921 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-30 13:39:33,921 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 5096 at 0x6ae60000, image base 0x1170000, stack from 0x126000-0x130000
2020-06-30 13:39:33,921 [root] DEBUG: Commandline: C:\Windows\System32\"C:\Program Files\Google\Update\GoogleUpdate.exe" \ua \installsource scheduler.
2020-06-30 13:39:33,953 [root] INFO: Loaded monitor into process with pid 5096
2020-06-30 13:39:33,968 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xd4 amd local view 0x68BE0000 to global list.
2020-06-30 13:39:33,984 [root] DEBUG: DLL loaded at 0x68BE0000: C:\Program Files\Google\Update\1.3.35.451\goopdate (0x1c6000 bytes).
2020-06-30 13:39:33,984 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xd0 amd local view 0x75CB0000 to global list.
2020-06-30 13:39:33,984 [root] DEBUG: DLL loaded at 0x75CB0000: C:\Windows\system32\OLEAUT32 (0x91000 bytes).
2020-06-30 13:39:34,000 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x73C60000 for section view with handle 0xd4.
2020-06-30 13:39:34,015 [root] DEBUG: DLL loaded at 0x73C60000: C:\Windows\system32\IPHLPAPI (0x1c000 bytes).
2020-06-30 13:39:34,015 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x779C0000 for section view with handle 0xd0.
2020-06-30 13:39:34,031 [root] DEBUG: DLL loaded at 0x779C0000: C:\Windows\system32\NSI (0x6000 bytes).
2020-06-30 13:39:34,031 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x73B10000 for section view with handle 0xd4.
2020-06-30 13:39:34,046 [root] DEBUG: DLL loaded at 0x73B10000: C:\Windows\system32\WINNSI (0x7000 bytes).
2020-06-30 13:39:34,062 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x704B0000 for section view with handle 0xd4.
2020-06-30 13:39:34,062 [root] DEBUG: DLL loaded at 0x704B0000: C:\Windows\system32\msi (0x246000 bytes).
2020-06-30 13:39:34,062 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x742F0000 for section view with handle 0xd4.
2020-06-30 13:39:34,078 [root] DEBUG: DLL loaded at 0x736D0000: C:\Windows\system32\SAMCLI (0xf000 bytes).
2020-06-30 13:39:34,078 [root] DEBUG: DLL loaded at 0x73F10000: C:\Windows\system32\WKSCLI (0xf000 bytes).
2020-06-30 13:39:34,078 [root] DEBUG: DLL loaded at 0x742F0000: C:\Windows\system32\NETAPI32 (0x11000 bytes).
2020-06-30 13:39:34,078 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x73F20000 for section view with handle 0xd4.
2020-06-30 13:39:34,093 [root] DEBUG: DLL loaded at 0x73F20000: C:\Windows\system32\netutils (0x9000 bytes).
2020-06-30 13:39:34,093 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x753A0000 for section view with handle 0xd4.
2020-06-30 13:39:34,109 [root] DEBUG: DLL loaded at 0x753A0000: C:\Windows\system32\srvcli (0x19000 bytes).
2020-06-30 13:39:34,109 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74C70000 for section view with handle 0xd4.
2020-06-30 13:39:34,125 [root] DEBUG: DLL loaded at 0x74C70000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-30 13:39:34,140 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74DD0000 for section view with handle 0xd4.
2020-06-30 13:39:34,140 [root] DEBUG: DLL loaded at 0x74DD0000: C:\Windows\system32\USERENV (0x17000 bytes).
2020-06-30 13:39:34,140 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x757A0000 for section view with handle 0xd4.
2020-06-30 13:39:34,187 [root] DEBUG: DLL loaded at 0x757A0000: C:\Windows\system32\profapi (0xb000 bytes).
2020-06-30 13:39:34,187 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x73CD0000 for section view with handle 0xd4.
2020-06-30 13:39:34,203 [root] DEBUG: DLL loaded at 0x73CD0000: C:\Windows\system32\WTSAPI32 (0xd000 bytes).
2020-06-30 13:39:34,218 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xf4 amd local view 0x74620000 to global list.
2020-06-30 13:39:34,218 [root] DEBUG: DLL loaded at 0x74620000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32 (0x19e000 bytes).
2020-06-30 13:39:34,218 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x758D0000 for section view with handle 0xd4.
2020-06-30 13:39:34,218 [root] DEBUG: DLL loaded at 0x758D0000: C:\Windows\system32\CRYPT32 (0x122000 bytes).
2020-06-30 13:39:34,234 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x75810000 for section view with handle 0xd4.
2020-06-30 13:39:34,234 [root] DEBUG: DLL loaded at 0x75810000: C:\Windows\system32\MSASN1 (0xc000 bytes).
2020-06-30 13:39:34,249 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x110 amd local view 0x73600000 to global list.
2020-06-30 13:39:34,265 [root] DEBUG: DLL loaded at 0x73600000: C:\Windows\system32\MSIMG32 (0x5000 bytes).
2020-06-30 13:39:34,281 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74290000 for section view with handle 0x110.
2020-06-30 13:39:34,281 [root] DEBUG: DLL loaded at 0x74290000: C:\Windows\system32\UxTheme (0x40000 bytes).
2020-06-30 13:39:34,296 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x766D0000 for section view with handle 0xd4.
2020-06-30 13:39:34,312 [root] DEBUG: DLL loaded at 0x766D0000: C:\Windows\system32\WININET (0x1c4000 bytes).
2020-06-30 13:39:34,328 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x75870000 for section view with handle 0xd4.
2020-06-30 13:39:34,328 [root] DEBUG: DLL loaded at 0x75870000: C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes).
2020-06-30 13:39:34,343 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x75860000 for section view with handle 0xd4.
2020-06-30 13:39:34,343 [root] DEBUG: DLL loaded at 0x75860000: C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0 (0x4000 bytes).
2020-06-30 13:39:34,343 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x75830000 for section view with handle 0xd4.
2020-06-30 13:39:34,343 [root] DEBUG: DLL loaded at 0x75830000: C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes).
2020-06-30 13:39:34,359 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x75820000 for section view with handle 0xd4.
2020-06-30 13:39:34,390 [root] DEBUG: DLL loaded at 0x75820000: C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes).
2020-06-30 13:39:34,390 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x77910000 for section view with handle 0xd4.
2020-06-30 13:39:34,406 [root] DEBUG: DLL loaded at 0x77910000: C:\Windows\system32\normaliz (0x3000 bytes).
2020-06-30 13:39:34,421 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x75E40000 for section view with handle 0xd4.
2020-06-30 13:39:34,437 [root] DEBUG: DLL loaded at 0x75E40000: C:\Windows\system32\iertutil (0x215000 bytes).
2020-06-30 13:39:34,453 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x75AD0000 for section view with handle 0xd4.
2020-06-30 13:39:34,468 [root] DEBUG: DLL loaded at 0x75AD0000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes).
2020-06-30 13:39:34,468 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x75AE0000 for section view with handle 0xd4.
2020-06-30 13:39:34,484 [root] DEBUG: DLL loaded at 0x75AE0000: C:\Windows\system32\WINTRUST (0x2f000 bytes).
2020-06-30 13:39:34,515 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x138 amd local view 0x022A0000 to global list.
2020-06-30 13:39:34,546 [root] DEBUG: DLL unloaded from 0x01170000.
2020-06-30 13:39:34,546 [root] DEBUG: DLL unloaded from 0x68BE0000.
2020-06-30 13:39:34,562 [root] DEBUG: DLL loaded at 0x744C0000: C:\Windows\system32\ntmarta (0x21000 bytes).
2020-06-30 13:39:34,562 [root] DEBUG: DLL loaded at 0x75B60000: C:\Windows\system32\WLDAP32 (0x45000 bytes).
2020-06-30 13:39:34,593 [root] DEBUG: DLL loaded at 0x6BBC0000: C:\Windows\system32\dbghelp (0xeb000 bytes).
2020-06-30 13:39:34,609 [root] DEBUG: DLL loaded at 0x756F0000: C:\Windows\system32\CRYPTBASE (0xc000 bytes).
2020-06-30 13:39:34,609 [root] DEBUG: DLL unloaded from 0x6BBC0000.
2020-06-30 13:39:34,609 [root] DEBUG: DLL unloaded from 0x75D90000.
2020-06-30 13:39:34,625 [root] DEBUG: DLL loaded at 0x6BBC0000: C:\Windows\system32\dbghelp (0xeb000 bytes).
2020-06-30 13:39:34,640 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x17c amd local view 0x00290000 to global list.
2020-06-30 13:39:34,687 [root] DEBUG: ResumeThreadHandler: CurrentInjectionInfo 0x0 (Pid 5096).
2020-06-30 13:39:44,750 [root] DEBUG: DLL loaded at 0x76130000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2020-06-30 13:39:44,781 [root] DEBUG: DLL loaded at 0x751C0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-06-30 13:39:44,796 [root] DEBUG: DLL loaded at 0x74F50000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-06-30 13:39:44,812 [root] DEBUG: DLL loaded at 0x75790000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-06-30 13:39:45,109 [root] DEBUG: DLL loaded at 0x6A930000: C:\Program Files\Google\Update\1.3.35.451\psmachine (0x42000 bytes).
2020-06-30 13:39:45,249 [root] DEBUG: DLL loaded at 0x75760000: C:\Windows\system32\WINSTA (0x29000 bytes).
2020-06-30 13:39:45,265 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 5096, handle 0x230.
2020-06-30 13:39:45,265 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 248, handle 0x230.
2020-06-30 13:39:45,281 [root] DEBUG: OpenProcessHandler: Image base for process 248 (handle 0x230): 0x47840000.
2020-06-30 13:39:45,312 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 328, handle 0x230.
2020-06-30 13:39:45,328 [root] DEBUG: OpenProcessHandler: Image base for process 328 (handle 0x230): 0x4A000000.
2020-06-30 13:39:45,328 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 364, handle 0x230.
2020-06-30 13:39:45,328 [root] DEBUG: OpenProcessHandler: Image base for process 364 (handle 0x230): 0x4A000000.
2020-06-30 13:39:45,328 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 372, handle 0x230.
2020-06-30 13:39:45,343 [root] DEBUG: OpenProcessHandler: Image base for process 372 (handle 0x230): 0x00510000.
2020-06-30 13:39:45,375 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 412, handle 0x230.
2020-06-30 13:39:45,375 [root] DEBUG: OpenProcessHandler: Image base for process 412 (handle 0x230): 0x00C00000.
2020-06-30 13:39:45,375 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 460, handle 0x230.
2020-06-30 13:39:45,375 [root] DEBUG: OpenProcessHandler: Image base for process 460 (handle 0x230): 0x009A0000.
2020-06-30 13:39:45,390 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 468, handle 0x230.
2020-06-30 13:39:45,390 [root] DEBUG: OpenProcessHandler: Image base for process 468 (handle 0x230): 0x00DD0000.
2020-06-30 13:39:45,390 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 476, handle 0x230.
2020-06-30 13:39:45,390 [root] DEBUG: OpenProcessHandler: Image base for process 476 (handle 0x230): 0x00520000.
2020-06-30 13:39:45,406 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 584, handle 0x230.
2020-06-30 13:39:45,421 [root] DEBUG: OpenProcessHandler: Image base for process 584 (handle 0x230): 0x00280000.
2020-06-30 13:39:45,421 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 660, handle 0x230.
2020-06-30 13:39:45,421 [root] DEBUG: OpenProcessHandler: Image base for process 660 (handle 0x230): 0x00280000.
2020-06-30 13:39:45,437 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 752, handle 0x230.
2020-06-30 13:39:45,453 [root] DEBUG: OpenProcessHandler: Image base for process 752 (handle 0x230): 0x00280000.
2020-06-30 13:39:45,468 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 784, handle 0x230.
2020-06-30 13:39:45,484 [root] DEBUG: OpenProcessHandler: Image base for process 784 (handle 0x230): 0x00280000.
2020-06-30 13:39:45,484 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 808, handle 0x230.
2020-06-30 13:39:45,500 [root] DEBUG: OpenProcessHandler: Image base for process 808 (handle 0x230): 0x00280000.
2020-06-30 13:39:45,500 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 836, handle 0x230.
2020-06-30 13:39:45,515 [root] DEBUG: OpenProcessHandler: Image base for process 836 (handle 0x230): 0x00280000.
2020-06-30 13:39:45,531 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1080, handle 0x230.
2020-06-30 13:39:45,546 [root] DEBUG: OpenProcessHandler: Image base for process 1080 (handle 0x230): 0x00280000.
2020-06-30 13:39:45,546 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1196, handle 0x230.
2020-06-30 13:39:45,546 [root] DEBUG: OpenProcessHandler: Image base for process 1196 (handle 0x230): 0x008E0000.
2020-06-30 13:39:45,578 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1284, handle 0x230.
2020-06-30 13:39:45,578 [root] DEBUG: OpenProcessHandler: Image base for process 1284 (handle 0x230): 0x00280000.
2020-06-30 13:39:45,578 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1460, handle 0x230.
2020-06-30 13:39:45,578 [root] DEBUG: OpenProcessHandler: Image base for process 1460 (handle 0x230): 0x009A0000.
2020-06-30 13:39:45,640 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1508, handle 0x230.
2020-06-30 13:39:45,656 [root] DEBUG: OpenProcessHandler: Image base for process 1508 (handle 0x230): 0x009E0000.
2020-06-30 13:39:45,656 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1580, handle 0x230.
2020-06-30 13:39:45,671 [root] DEBUG: OpenProcessHandler: Image base for process 1580 (handle 0x230): 0x00350000.
2020-06-30 13:39:45,671 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1588, handle 0x230.
2020-06-30 13:39:45,687 [root] DEBUG: OpenProcessHandler: Image base for process 1588 (handle 0x230): 0x00270000.
2020-06-30 13:39:45,687 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1764, handle 0x230.
2020-06-30 13:39:45,703 [root] DEBUG: OpenProcessHandler: Image base for process 1764 (handle 0x230): 0x00280000.
2020-06-30 13:39:45,703 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 312, handle 0x230.
2020-06-30 13:39:45,718 [root] DEBUG: OpenProcessHandler: Image base for process 312 (handle 0x230): 0x00280000.
2020-06-30 13:39:45,718 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1440, handle 0x230.
2020-06-30 13:39:45,734 [root] DEBUG: OpenProcessHandler: Image base for process 1440 (handle 0x230): 0x010A0000.
2020-06-30 13:39:45,734 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 2080, handle 0x230.
2020-06-30 13:39:45,750 [root] DEBUG: OpenProcessHandler: Image base for process 2080 (handle 0x230): 0x000F0000.
2020-06-30 13:39:45,750 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 2300, handle 0x230.
2020-06-30 13:39:45,750 [root] DEBUG: OpenProcessHandler: Image base for process 2300 (handle 0x230): 0x00970000.
2020-06-30 13:39:45,765 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 3232, handle 0x230.
2020-06-30 13:39:45,765 [root] DEBUG: OpenProcessHandler: Image base for process 3232 (handle 0x230): 0x01080000.
2020-06-30 13:39:45,781 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 2380, handle 0x230.
2020-06-30 13:39:45,781 [root] DEBUG: OpenProcessHandler: Image base for process 2380 (handle 0x230): 0x00280000.
2020-06-30 13:39:45,796 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 5788, handle 0x230.
2020-06-30 13:39:45,796 [root] DEBUG: OpenProcessHandler: Image base for process 5788 (handle 0x230): 0x009E0000.
2020-06-30 13:39:45,812 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 5196, handle 0x230.
2020-06-30 13:39:45,812 [root] DEBUG: OpenProcessHandler: Image base for process 5196 (handle 0x230): 0x006B0000.
2020-06-30 13:39:45,812 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 3988, handle 0x230.
2020-06-30 13:39:45,828 [root] DEBUG: OpenProcessHandler: Image base for process 3988 (handle 0x230): 0x01170000.
2020-06-30 13:40:03,531 [root] DEBUG: DLL unloaded from 0x762F0000.
2020-06-30 13:40:14,812 [root] DEBUG: DLL unloaded from 0x762F0000.
2020-06-30 13:41:17,843 [root] INFO: Analysis timeout hit, terminating analysis.
2020-06-30 13:41:17,843 [lib.api.process] INFO: Terminate event set for process 836
2020-06-30 13:41:17,843 [root] DEBUG: Terminate Event: Attempting to dump process 836
2020-06-30 13:41:17,843 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00280000.
2020-06-30 13:41:17,859 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-30 13:41:17,875 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00280000.
2020-06-30 13:41:17,890 [root] DEBUG: DumpProcess: Module entry point VA is 0x00002104.
2020-06-30 13:41:17,953 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x5200.
2020-06-30 13:41:17,953 [root] DEBUG: Terminate Event: CAPE shutdown complete for process 836
2020-06-30 13:41:17,953 [lib.api.process] INFO: Termination confirmed for process 836
2020-06-30 13:41:17,968 [root] INFO: Terminate event set for process 836.
2020-06-30 13:41:17,968 [lib.api.process] INFO: Terminate event set for process 5196
2020-06-30 13:41:17,968 [root] DEBUG: Terminate Event: Attempting to dump process 5196
2020-06-30 13:41:17,968 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x006B0000.
2020-06-30 13:41:17,968 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-30 13:41:17,968 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x006B0000.
2020-06-30 13:41:17,968 [root] DEBUG: DumpProcess: Module entry point VA is 0x00006862.
2020-06-30 13:41:18,046 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x2ec00.
2020-06-30 13:41:18,046 [root] DEBUG: Terminate Event: CAPE shutdown complete for process 5196
2020-06-30 13:41:18,046 [lib.api.process] INFO: Termination confirmed for process 5196
2020-06-30 13:41:18,046 [root] INFO: Terminate event set for process 5196.
2020-06-30 13:41:18,046 [lib.api.process] INFO: Terminate event set for process 5096
2020-06-30 13:41:18,046 [root] DEBUG: Terminate Event: Attempting to dump process 5096
2020-06-30 13:41:18,062 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x01170000.
2020-06-30 13:41:18,062 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-30 13:41:18,062 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x01170000.
2020-06-30 13:41:18,093 [root] DEBUG: DumpProcess: Module entry point VA is 0x00007442.
2020-06-30 13:41:18,984 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x23400.
2020-06-30 13:41:19,000 [lib.api.process] INFO: Termination confirmed for process 5096
2020-06-30 13:41:19,000 [root] INFO: Terminate event set for process 5096.
2020-06-30 13:41:19,000 [root] DEBUG: Terminate Event: CAPE shutdown complete for process 5096
2020-06-30 13:41:19,000 [root] INFO: Created shutdown mutex.
2020-06-30 13:41:20,000 [root] INFO: Shutting down package.
2020-06-30 13:41:20,000 [root] INFO: Stopping auxiliary modules.
2020-06-30 13:41:20,093 [lib.common.results] WARNING: File C:\qUkYtaI\bin\procmon.xml doesn't exist anymore
2020-06-30 13:41:20,093 [root] INFO: Finishing auxiliary modules.
2020-06-30 13:41:20,093 [root] INFO: Shutting down pipe server and dumping dropped files.
2020-06-30 13:41:20,125 [root] WARNING: Folder at path "C:\qUkYtaI\debugger" does not exist, skip.
2020-06-30 13:41:20,140 [root] INFO: Analysis completed.

Machine

Name Label Manager Started On Shutdown On
win7_3 win7_3 KVM 2020-06-30 13:49:49 2020-06-30 13:55:19

File Details

File Name Preform Invoice.exe
File Size 399360 bytes
File Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
PE timestamp 2020-06-30 04:21:47
MD5 fac2cb9080743d1c1201d307dadc66a7
SHA1 58445be625af49f21df9502d4f7f27d1bf43c083
SHA256 6d8990f56f9413f16f2dbe490367d7585b5e6165982e6929a8fd71fc60cffefd
SHA512 44b3a0350c78f71b1272e9a51f33c5a8275bff18ce079b8b41250bdcfb3ae8db9fc59037058999b556156cdb791f853907371fac0d74f66004100f7a169b74ca
CRC32 957794BD
Ssdeep 6144:eH8ytbpm/noGtAHM612ZNHWYQxQrCSzBIcwnxwwsP7K/WlvD1tLZ6yvqfWh:eH8yCnRuMz1LOSz86w0K/OpkyyfWh
Download Download ZIP Resubmit sample

Signatures

SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Hit: PID 4560 trigged the Yara rule 'AgentTeslaV2'
Hit: PID 1232 trigged the Yara rule 'AgentTeslaV2'
Creates RWX memory
Guard pages use detected - possible anti-debugging.
Dynamic (imported) function loading detected
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: MSCOREE.DLL/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/_CorExeMain_RetAddr
DynamicLoader: mscoreei.dll/_CorExeMain
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: VERSION.dll/GetFileVersionInfoW
DynamicLoader: VERSION.dll/VerQueryValueW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: clr.dll/SetRuntimeInfo
DynamicLoader: USER32.dll/GetProcessWindowStation
DynamicLoader: USER32.dll/GetUserObjectInformationW
DynamicLoader: clr.dll/_CorExeMain
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: MSCOREE.DLL/CreateConfigStream
DynamicLoader: mscoreei.dll/CreateConfigStream_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream
DynamicLoader: KERNEL32.dll/GetNumaHighestNodeNumber
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/GetSystemWindowsDirectoryW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/AddSIDToBoundaryDescriptor
DynamicLoader: KERNEL32.dll/CreateBoundaryDescriptorW
DynamicLoader: KERNEL32.dll/CreatePrivateNamespaceW
DynamicLoader: KERNEL32.dll/OpenPrivateNamespaceW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/DeleteBoundaryDescriptor
DynamicLoader: KERNEL32.dll/WerRegisterRuntimeExceptionModule
DynamicLoader: KERNEL32.dll/RaiseException
DynamicLoader: MSCOREE.DLL/
DynamicLoader: mscoreei.dll/
DynamicLoader: KERNELBASE.dll/SetSystemFileCacheSize
DynamicLoader: ntdll.dll/NtSetSystemInformation
DynamicLoader: KERNELBASE.dll/PrivIsDllSynchronizationHeld
DynamicLoader: KERNEL32.dll/AddDllDirectory
DynamicLoader: KERNEL32.dll/SortGetHandle
DynamicLoader: KERNEL32.dll/SortCloseHandle
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoGetContextToken
DynamicLoader: clrjit.dll/sxsJitStartup
DynamicLoader: clrjit.dll/jitStartup
DynamicLoader: clrjit.dll/getJit
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/LocaleNameToLCID
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/LCIDToLocaleName
DynamicLoader: KERNEL32.dll/GetUserPreferredUILanguages
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegOpenKeyEx
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: KERNEL32.dll/GetFullPathName
DynamicLoader: KERNEL32.dll/GetFullPathNameW
DynamicLoader: uxtheme.dll/IsAppThemed
DynamicLoader: uxtheme.dll/IsAppThemedW
DynamicLoader: KERNEL32.dll/CreateActCtx
DynamicLoader: KERNEL32.dll/CreateActCtxA
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: USER32.dll/RegisterWindowMessage
DynamicLoader: USER32.dll/RegisterWindowMessageW
DynamicLoader: ole32.dll/CoCreateGuid
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: MSCOREE.DLL/GetProcessExecutableHeap
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap_RetAddr
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap
DynamicLoader: KERNEL32.dll/CompareStringOrdinal
DynamicLoader: KERNEL32.dll/SetThreadErrorMode
DynamicLoader: KERNEL32.dll/GetFileAttributesEx
DynamicLoader: KERNEL32.dll/GetFileAttributesExW
DynamicLoader: KERNEL32.dll/ResolveLocaleName
DynamicLoader: gdiplus.dll/GdiplusStartup
DynamicLoader: KERNEL32.dll/IsProcessorFeaturePresent
DynamicLoader: USER32.dll/GetWindowInfo
DynamicLoader: USER32.dll/GetAncestor
DynamicLoader: USER32.dll/GetMonitorInfoA
DynamicLoader: USER32.dll/EnumDisplayMonitors
DynamicLoader: USER32.dll/EnumDisplayDevicesA
DynamicLoader: GDI32.dll/ExtTextOutW
DynamicLoader: GDI32.dll/GdiIsMetaPrintDC
DynamicLoader: gdiplus.dll/GdipLoadImageFromStream
DynamicLoader: WindowsCodecs.dll/DllGetClassObject
DynamicLoader: gdiplus.dll/GdipImageForceValidation
DynamicLoader: gdiplus.dll/GdipGetImageType
DynamicLoader: gdiplus.dll/GdipGetImageRawFormat
DynamicLoader: gdiplus.dll/GdipGetImageWidth
DynamicLoader: gdiplus.dll/GdipGetImageHeight
DynamicLoader: gdiplus.dll/GdipBitmapGetPixel
DynamicLoader: nlssorting.dll/SortGetHandle
DynamicLoader: nlssorting.dll/SortCloseHandle
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: shell32.dll/SHGetFolderPath
DynamicLoader: shell32.dll/SHGetFolderPathW
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: KERNEL32.dll/CopyFile
DynamicLoader: KERNEL32.dll/CopyFileW
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: KERNEL32.dll/GetCurrentProcessW
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/OpenProcessTokenW
DynamicLoader: KERNEL32.dll/LocalFree
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/GetTokenInformationW
DynamicLoader: KERNEL32.dll/LocalAlloc
DynamicLoader: KERNEL32.dll/LocalAllocW
DynamicLoader: ADVAPI32.dll/LsaClose
DynamicLoader: ADVAPI32.dll/LsaFreeMemory
DynamicLoader: ADVAPI32.dll/LsaOpenPolicy
DynamicLoader: ADVAPI32.dll/LsaLookupSids
DynamicLoader: KERNEL32.dll/GetTempPath
DynamicLoader: KERNEL32.dll/GetTempPathW
DynamicLoader: KERNEL32.dll/GetTempFileName
DynamicLoader: KERNEL32.dll/GetTempFileNameW
DynamicLoader: KERNEL32.dll/CreateFile
DynamicLoader: KERNEL32.dll/CreateFileW
DynamicLoader: KERNEL32.dll/GetFileType
DynamicLoader: KERNEL32.dll/WriteFile
DynamicLoader: KERNEL32.dll/LocalAlloc
DynamicLoader: shell32.dll/ShellExecuteEx
DynamicLoader: shell32.dll/ShellExecuteExW
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: comctl32.dll/
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: KERNEL32.dll/DuplicateHandle
DynamicLoader: ole32.dll/CoWaitForMultipleHandles
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: ole32.dll/NdrOleInitializeExtension
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: KERNEL32.dll/DeleteFile
DynamicLoader: KERNEL32.dll/DeleteFileW
DynamicLoader: KERNEL32.dll/CreateProcess
DynamicLoader: KERNEL32.dll/CreateProcessW
DynamicLoader: KERNEL32.dll/GetThreadContext
DynamicLoader: KERNEL32.dll/ReadProcessMemory
DynamicLoader: KERNEL32.dll/VirtualAllocEx
DynamicLoader: KERNEL32.dll/WriteProcessMemory
DynamicLoader: KERNEL32.dll/SetThreadContext
DynamicLoader: KERNEL32.dll/ResumeThread
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValue
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValueW
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/OpenProcessTokenW
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivileges
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivilegesW
DynamicLoader: ntdll.dll/NtQuerySystemInformation
DynamicLoader: ntdll.dll/NtQuerySystemInformationW
DynamicLoader: ADVAPI32.dll/EventUnregister
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/UnregisterTraceGuids
DynamicLoader: ADVAPI32.dll/UnregisterTraceGuids
DynamicLoader: comctl32.dll/
DynamicLoader: KERNEL32.dll/CreateActCtxW
DynamicLoader: KERNEL32.dll/AddRefActCtx
DynamicLoader: KERNEL32.dll/ReleaseActCtx
DynamicLoader: KERNEL32.dll/ActivateActCtx
DynamicLoader: KERNEL32.dll/DeactivateActCtx
DynamicLoader: KERNEL32.dll/GetCurrentActCtx
DynamicLoader: KERNEL32.dll/QueryActCtxW
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/EventUnregister
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: VERSION.dll/GetFileVersionInfoW
DynamicLoader: VERSION.dll/VerQueryValueW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: SspiCli.dll/GetUserNameExW
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: MSCOREE.DLL/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/_CorExeMain_RetAddr
DynamicLoader: mscoreei.dll/_CorExeMain
DynamicLoader: ADVAPI32.dll/EventUnregister
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: ADVAPI32.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: ADVAPI32.dll/RegCreateKeyExW
DynamicLoader: SHLWAPI.dll/PathIsDirectoryW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegNotifyChangeKeyValue
DynamicLoader: SspiCli.dll/GetUserNameExW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: ole32.dll/NdrOleInitializeExtension
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: ole32.dll/CLSIDFromOle1Class
DynamicLoader: CLBCatQ.DLL/GetCatalogObject
DynamicLoader: CLBCatQ.DLL/GetCatalogObject2
DynamicLoader: tschannel.dll/DllGetClassObject
DynamicLoader: tschannel.dll/DllCanUnloadNow
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegSetValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: SHLWAPI.dll/PathIsPrefixW
DynamicLoader: ADVAPI32.dll/CryptCreateHash
DynamicLoader: CRYPTSP.dll/CryptCreateHash
DynamicLoader: ADVAPI32.dll/CryptGetHashParam
DynamicLoader: CRYPTSP.dll/CryptGetHashParam
DynamicLoader: ADVAPI32.dll/CryptHashData
DynamicLoader: CRYPTSP.dll/CryptHashData
DynamicLoader: ADVAPI32.dll/CryptGetHashParam
DynamicLoader: ADVAPI32.dll/CryptDestroyHash
DynamicLoader: CRYPTSP.dll/CryptDestroyHash
DynamicLoader: XmlLite.dll/CreateXmlReader
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/SetDefaultDllDirectories
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/InitOnceExecuteOnce
DynamicLoader: kernel32.dll/CreateEventExW
DynamicLoader: kernel32.dll/CreateSemaphoreW
DynamicLoader: kernel32.dll/CreateSemaphoreExW
DynamicLoader: kernel32.dll/CreateThreadpoolTimer
DynamicLoader: kernel32.dll/SetThreadpoolTimer
DynamicLoader: kernel32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: kernel32.dll/CloseThreadpoolTimer
DynamicLoader: kernel32.dll/CreateThreadpoolWait
DynamicLoader: kernel32.dll/SetThreadpoolWait
DynamicLoader: kernel32.dll/CloseThreadpoolWait
DynamicLoader: kernel32.dll/FlushProcessWriteBuffers
DynamicLoader: kernel32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: kernel32.dll/GetCurrentProcessorNumber
DynamicLoader: kernel32.dll/CreateSymbolicLinkW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/GetTickCount64
DynamicLoader: kernel32.dll/GetFileInformationByHandleEx
DynamicLoader: kernel32.dll/SetFileInformationByHandle
DynamicLoader: kernel32.dll/GetSystemTimePreciseAsFileTime
DynamicLoader: kernel32.dll/InitializeConditionVariable
DynamicLoader: kernel32.dll/WakeConditionVariable
DynamicLoader: kernel32.dll/WakeAllConditionVariable
DynamicLoader: kernel32.dll/SleepConditionVariableCS
DynamicLoader: kernel32.dll/InitializeSRWLock
DynamicLoader: kernel32.dll/AcquireSRWLockExclusive
DynamicLoader: kernel32.dll/TryAcquireSRWLockExclusive
DynamicLoader: kernel32.dll/ReleaseSRWLockExclusive
DynamicLoader: kernel32.dll/SleepConditionVariableSRW
DynamicLoader: kernel32.dll/CreateThreadpoolWork
DynamicLoader: kernel32.dll/SubmitThreadpoolWork
DynamicLoader: kernel32.dll/CloseThreadpoolWork
DynamicLoader: kernel32.dll/CompareStringEx
DynamicLoader: kernel32.dll/GetLocaleInfoEx
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: goopdate.dll/DllEntry
DynamicLoader: kernel32.dll/RtlCaptureStackBackTrace
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: kernel32.dll/CreateMutexExW
DynamicLoader: kernel32.dll/CreateEventExW
DynamicLoader: dbghelp.dll/MiniDumpWriteDump
DynamicLoader: RPCRT4.dll/UuidCreate
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: dbghelp.dll/MiniDumpWriteDump
DynamicLoader: RPCRT4.dll/UuidCreate
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: kernel32.dll/WTSGetActiveConsoleSessionId
DynamicLoader: WINSTA.dll/WinStationQueryInformationW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: ADVAPI32.dll/CreateWellKnownSid
DynamicLoader: RPCRT4.dll/RpcStringBindingComposeW
DynamicLoader: RPCRT4.dll/RpcBindingFromStringBindingW
DynamicLoader: RPCRT4.dll/RpcStringFreeW
DynamicLoader: RPCRT4.dll/RpcBindingSetAuthInfoExW
DynamicLoader: RPCRT4.dll/NdrClientCall2
DynamicLoader: RPCRT4.dll/I_RpcExceptionFilter
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: kernel32.dll/FlsGetValue
A process created a hidden window
Process: Preform Invoice.exe -> schtasks.exe
CAPE extracted potentially suspicious content
Preform Invoice.exe: Injected Shellcode/Data
Preform Invoice.exe: Unpacked Shellcode
Preform Invoice.exe: Unpacked Shellcode
Preform Invoice.exe: Unpacked Shellcode
Preform Invoice.exe: Unpacked Shellcode
Preform Invoice.exe: Unpacked Shellcode
Preform Invoice.exe: Injected Shellcode/Data
Preform Invoice.exe: AgentTeslaV2 Payload: 32-bit executable
Preform Invoice.exe: AgentTeslaV2
Preform Invoice.exe: Unpacked Shellcode
Preform Invoice.exe: Unpacked Shellcode
Queries or connects to DNS-Over-HTTPS/DNS-Over-TLS domain or IP address
ip: 1.1.1.1
The binary likely contains encrypted or compressed data.
section: name: .text, entropy: 7.90, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x0005d200, virtual_size: 0x0005d1e8
Authenticode signature is invalid
authenticode error: No signature found. SignTool Error File not valid C\Users\Rebecca\AppData\Local\Temp\Preform Invoice.exe
Uses Windows utilities for basic functionality
command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PUvJoaHGhK" /XML "C:\Users\Rebecca\AppData\Local\Temp\tmp9926.tmp"
command: schtasks.exe /Create /TN "Updates\PUvJoaHGhK" /XML "C:\Users\Rebecca\AppData\Local\Temp\tmp9926.tmp"
Behavioural detection: Injection (Process Hollowing)
Injection: Preform Invoice.exe(1232) -> Preform Invoice.exe(4560)
Executed a process and injected code into it, probably while unpacking
Injection: Preform Invoice.exe(1232) -> Preform Invoice.exe(4560)
Behavioural detection: Injection (inter-process)
CAPE detected the AgentTeslaV2 malware family
Creates a copy of itself
copy: C:\Users\Rebecca\AppData\Roaming\PUvJoaHGhK.exe
Created network traffic indicative of malicious activity
signature: ET JA3 Hash - Possible Malware - Various Malspam/RigEK

Screenshots


Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
Y 1.1.1.1 [VT] Australia

DNS

No domains contacted.


Summary

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Rebecca\AppData\Local\Temp\Preform Invoice.exe.config
C:\Users\Rebecca\AppData\Local\Temp\Preform Invoice.exe
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-2.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSVCR120_CLR0400.dll
C:\Windows\System32\MSVCR120_CLR0400.dll
C:\Windows\System32\api-ms-win-core-quirks-l1-1-0.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll.aux
C:\Users
C:\Users\Rebecca
C:\Users\Rebecca\AppData
C:\Users\Rebecca\AppData\Local
C:\Users\Rebecca\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\NNnBUpqoQehfI\*
C:\Users\Rebecca\AppData\Local\Temp\Preform Invoice.INI
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
C:\Windows\assembly\pubpol224.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\Microsoft.Net\assembly\GAC_32\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\NNnBUpqoQehfI.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\NNnBUpqoQehfI.resources\NNnBUpqoQehfI.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\NNnBUpqoQehfI.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en-US\NNnBUpqoQehfI.resources\NNnBUpqoQehfI.resources.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
C:\Users\Rebecca\AppData\Local\Temp\en\NNnBUpqoQehfI.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en\NNnBUpqoQehfI.resources\NNnBUpqoQehfI.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en\NNnBUpqoQehfI.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en\NNnBUpqoQehfI.resources\NNnBUpqoQehfI.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\Preform Invoice.exe.Local\
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\GdiPlus.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Xml.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.Linq.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\SortDefault.nlp
C:\Users\Rebecca\AppData\Local\Temp\en-US\Lazarus.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\Lazarus.resources\Lazarus.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\Lazarus.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en-US\Lazarus.resources\Lazarus.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en\Lazarus.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en\Lazarus.resources\Lazarus.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en\Lazarus.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en\Lazarus.resources\Lazarus.resources.exe
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll
C:\Users\Rebecca\AppData\Roaming\PUvJoaHGhK.exe
C:\Users\Rebecca\AppData\Local\Temp\tmp9926.tmp
\??\MountPointManager
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll
\Device\KsecDD
C:\Windows\System32\Tasks
C:\Windows\System32\Tasks\*
C:\Windows\System32\Tasks\AutoKMS
C:\Windows\System32\Tasks\Updates\PUvJoaHGhK
C:\Windows\System32\Tasks\Updates
C:\Windows\System32\Tasks\Updates\
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
C:\Windows\System32\api-ms-win-core-fibers-l1-1-1.DLL
C:\Windows\System32\api-ms-win-core-localization-l1-2-1.DLL
C:\Program Files\Google\Update\goopdate.dll
C:\Program Files\Google\Update\1.3.35.451\goopdate.dll
C:\Windows\System32\IPHLPAPI.DLL
C:\Windows\System32\winnsi.dll
C:\Windows\System32\msi.dll
C:\Windows\System32\netapi32.dll
C:\Windows\System32\netutils.dll
C:\Windows\System32\srvcli.dll
C:\Windows\System32\version.dll
C:\Windows\System32\userenv.dll
C:\Windows\System32\profapi.dll
C:\Windows\System32\wtsapi32.dll
C:\Program Files\Google\Update\GoogleUpdate.exe.Local\
C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d
C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll
C:\Windows\System32\msimg32.dll
C:\Windows\System32\uxtheme.dll
C:\GoogleUpdate.ini
C:\Windows\System32
C:\Program Files
C:\Program Files\Google
C:\Program Files\Google\CrashReports
\??\pipe\GoogleCrashServices\S-1-5-18
C:\Program Files\Google\Update\1.3.35.451
C:\Program Files\Google\Update\1.3.35.451\goopdateres_en.dll
C:\Program Files\Google\Policies
C:\Windows\System32\atlthunk.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Rebecca\AppData\Local\Temp\Preform Invoice.exe.config
C:\Users\Rebecca\AppData\Local\Temp\Preform Invoice.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Windows\System32\MSVCR120_CLR0400.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
C:\Windows\assembly\pubpol224.dat
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\GdiPlus.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\SortDefault.nlp
C:\Users\Rebecca\AppData\Local\Temp\tmp9926.tmp
\Device\KsecDD
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
C:\Program Files\Google\Update\1.3.35.451\goopdate.dll
C:\Windows\System32\IPHLPAPI.DLL
C:\Windows\System32\winnsi.dll
C:\Windows\System32\msi.dll
C:\Windows\System32\netapi32.dll
C:\Windows\System32\netutils.dll
C:\Windows\System32\srvcli.dll
C:\Windows\System32\version.dll
C:\Windows\System32\userenv.dll
C:\Windows\System32\profapi.dll
C:\Windows\System32\wtsapi32.dll
C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll
C:\Windows\System32\msimg32.dll
C:\Windows\System32\uxtheme.dll
C:\Program Files\Google\CrashReports
\??\pipe\GoogleCrashServices\S-1-5-18
C:\Program Files\Google\Update\1.3.35.451\goopdateres_en.dll
C:\Users\Rebecca\AppData\Roaming\PUvJoaHGhK.exe
C:\Users\Rebecca\AppData\Local\Temp\tmp9926.tmp
\??\pipe\GoogleCrashServices\S-1-5-18
C:\Users\Rebecca\AppData\Local\Temp\tmp9926.tmp
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Standards\v4.0.30319
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v4.0.30319\SKUs\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\SKUs\default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Preform Invoice.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseRetryAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseMillisecondsBetweenRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\NGen\Policy\v4.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\NGen\Policy\v4.0\OptimizeUsedBinaries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Servicing
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\00060101.00060101
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\FeatureSIMD
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AltJit
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index224
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AppContext
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-479431668-4257340731-3059248302-1002\Installer\Assemblies\C:|Users|Rebecca|AppData|Local|Temp|Preform Invoice.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Rebecca|AppData|Local|Temp|Preform Invoice.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Rebecca|AppData|Local|Temp|Preform Invoice.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-479431668-4257340731-3059248302-1002\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Numerics__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Numerics__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml.Linq__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml.Linq__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{4c2e3c01-5984-11ea-a9cb-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{4c2e3c01-5984-11ea-a9cb-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{4c2e3c01-5984-11ea-a9cb-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{210acb57-272f-11e9-8326-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{210acb57-272f-11e9-8326-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{210acb57-272f-11e9-8326-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{210acb58-272f-11e9-8326-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{210acb58-272f-11e9-8326-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{210acb58-272f-11e9-8326-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\AppID\Preform Invoice.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\AppCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\DefaultAccessPermission
HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
DisableUserModeCallbackFilter
HKEY_CURRENT_USER\Software\Classes\AppID\schtasks.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\RepositoryRestoreInProgress
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoKMS
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoKMS\Id
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\SchedulingEngineKnob
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002\Control Panel\International
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002\Control Panel\International\LocaleName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updates\PUvJoaHGhK
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\svchost.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\svchost.exe
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{15F462BB-5778-4495-8311-8BDA84553AC0}\Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{15F462BB-5778-4495-8311-8BDA84553AC0}\Hash
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updates\PUvJoaHGhK\Id
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updates\PUvJoaHGhK\Index
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{15F462BB-5778-4495-8311-8BDA84553AC0}\Triggers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{15F462BB-5778-4495-8311-8BDA84553AC0}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{15F462BB-5778-4495-8311-8BDA84553AC0}\DynamicInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{987A7D63-4169-466C-AB80-45D77E9611A1}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{987A7D63-4169-466C-AB80-45D77E9611A1}\Hash
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{987A7D63-4169-466C-AB80-45D77E9611A1}\DynamicInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{0CA5C4CD-C1DF-4F2A-9B3D-3FB4F80A231F}
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Time Zones\Central European Standard Time\Dynamic DST
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{0CA5C4CD-C1DF-4F2A-9B3D-3FB4F80A231F}\data
HKEY_LOCAL_MACHINE\system\Setup
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\Software\Classes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\taskeng.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\DataVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\EnableBackCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\MissedTasksStartupDelay
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\TasksInMemoryQueue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\TasksPerHighestPrivEngine
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\TasksPerLeastPrivEngine
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\TracingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\WindowSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\6BA0E3C1
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\COM3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\Com+Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\InprocHandler
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\MaxSxSHashCount
HKEY_CURRENT_USER
HKEY_USERS\.DEFAULT\Control Panel\International
HKEY_USERS\.DEFAULT\Control Panel\International\LocaleName
HKEY_USERS\.DEFAULT\Control Panel\International\sCountry
HKEY_USERS\.DEFAULT\Control Panel\International\sList
HKEY_USERS\.DEFAULT\Control Panel\International\sDecimal
HKEY_USERS\.DEFAULT\Control Panel\International\sThousand
HKEY_USERS\.DEFAULT\Control Panel\International\sGrouping
HKEY_USERS\.DEFAULT\Control Panel\International\sNativeDigits
HKEY_USERS\.DEFAULT\Control Panel\International\sCurrency
HKEY_USERS\.DEFAULT\Control Panel\International\sMonDecimalSep
HKEY_USERS\.DEFAULT\Control Panel\International\sMonThousandSep
HKEY_USERS\.DEFAULT\Control Panel\International\sMonGrouping
HKEY_USERS\.DEFAULT\Control Panel\International\sPositiveSign
HKEY_USERS\.DEFAULT\Control Panel\International\sNegativeSign
HKEY_USERS\.DEFAULT\Control Panel\International\sTimeFormat
HKEY_USERS\.DEFAULT\Control Panel\International\sShortTime
HKEY_USERS\.DEFAULT\Control Panel\International\s1159
HKEY_USERS\.DEFAULT\Control Panel\International\s2359
HKEY_USERS\.DEFAULT\Control Panel\International\sShortDate
HKEY_USERS\.DEFAULT\Control Panel\International\sYearMonth
HKEY_USERS\.DEFAULT\Control Panel\International\sLongDate
HKEY_USERS\.DEFAULT\Control Panel\International\iCountry
HKEY_USERS\.DEFAULT\Control Panel\International\iMeasure
HKEY_USERS\.DEFAULT\Control Panel\International\iPaperSize
HKEY_USERS\.DEFAULT\Control Panel\International\iDigits
HKEY_USERS\.DEFAULT\Control Panel\International\iLZero
HKEY_USERS\.DEFAULT\Control Panel\International\iNegNumber
HKEY_USERS\.DEFAULT\Control Panel\International\NumShape
HKEY_USERS\.DEFAULT\Control Panel\International\iCurrDigits
HKEY_USERS\.DEFAULT\Control Panel\International\iCurrency
HKEY_USERS\.DEFAULT\Control Panel\International\iNegCurr
HKEY_USERS\.DEFAULT\Control Panel\International\iCalendarType
HKEY_USERS\.DEFAULT\Control Panel\International\iFirstDayOfWeek
HKEY_USERS\.DEFAULT\Control Panel\International\iFirstWeekOfYear
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\Software\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}\pv
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\msasn1
HKEY_LOCAL_MACHINE\Software\Policies\Google\Update\
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Hostname
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\System\DNSclient
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Domain
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\AccessProviders
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
HKEY_LOCAL_MACHINE\Software\Google\Update\
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\OemInstallTime
HKEY_LOCAL_MACHINE\Software\Google\UpdateDev\
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientStateMedium\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\usagestats
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\usagestats
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\uid
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\old-uid
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\eulaaccepted
HKEY_LOCAL_MACHINE\Software\Google\Enrollment\
HKEY_LOCAL_MACHINE\Software\Google\Chrome\Enrollment\
HKEY_LOCAL_MACHINE\Software\Policies\Google\CloudManagement\
HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CloudManagementEnrollmentToken
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\GoogleUpdate.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\GoogleUpdate.exe\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\LastChecked
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\LastStartedAU
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\IsMSIHelperRegistered
HKEY_LOCAL_MACHINE\Software\Google\Update\PersistedPings
HKEY_LOCAL_MACHINE\Software\Google\Update\Clients\
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\RetryAfter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseRetryAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseMillisecondsBetweenRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\NGen\Policy\v4.0\OptimizeUsedBinaries
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\00060101.00060101
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\FeatureSIMD
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AltJit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index224
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{4c2e3c01-5984-11ea-a9cb-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{4c2e3c01-5984-11ea-a9cb-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{210acb57-272f-11e9-8326-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{210acb57-272f-11e9-8326-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{210acb58-272f-11e9-8326-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{210acb58-272f-11e9-8326-806e6f6e6963}\Generation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\DefaultAccessPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoKMS\Id
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\SchedulingEngineKnob
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002\Control Panel\International\LocaleName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{15F462BB-5778-4495-8311-8BDA84553AC0}\Hash
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{15F462BB-5778-4495-8311-8BDA84553AC0}\DynamicInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{987A7D63-4169-466C-AB80-45D77E9611A1}\Hash
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{987A7D63-4169-466C-AB80-45D77E9611A1}\DynamicInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{0CA5C4CD-C1DF-4F2A-9B3D-3FB4F80A231F}\data
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\DataVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\EnableBackCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\MissedTasksStartupDelay
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\TasksInMemoryQueue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\TasksPerHighestPrivEngine
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\TasksPerLeastPrivEngine
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\TracingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\WindowSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\6BA0E3C1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\Com+Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\MaxSxSHashCount
HKEY_USERS\.DEFAULT\Control Panel\International\LocaleName
HKEY_USERS\.DEFAULT\Control Panel\International\sCountry
HKEY_USERS\.DEFAULT\Control Panel\International\sList
HKEY_USERS\.DEFAULT\Control Panel\International\sDecimal
HKEY_USERS\.DEFAULT\Control Panel\International\sThousand
HKEY_USERS\.DEFAULT\Control Panel\International\sGrouping
HKEY_USERS\.DEFAULT\Control Panel\International\sNativeDigits
HKEY_USERS\.DEFAULT\Control Panel\International\sCurrency
HKEY_USERS\.DEFAULT\Control Panel\International\sMonDecimalSep
HKEY_USERS\.DEFAULT\Control Panel\International\sMonThousandSep
HKEY_USERS\.DEFAULT\Control Panel\International\sMonGrouping
HKEY_USERS\.DEFAULT\Control Panel\International\sPositiveSign
HKEY_USERS\.DEFAULT\Control Panel\International\sNegativeSign
HKEY_USERS\.DEFAULT\Control Panel\International\sTimeFormat
HKEY_USERS\.DEFAULT\Control Panel\International\sShortTime
HKEY_USERS\.DEFAULT\Control Panel\International\s1159
HKEY_USERS\.DEFAULT\Control Panel\International\s2359
HKEY_USERS\.DEFAULT\Control Panel\International\sShortDate
HKEY_USERS\.DEFAULT\Control Panel\International\sYearMonth
HKEY_USERS\.DEFAULT\Control Panel\International\sLongDate
HKEY_USERS\.DEFAULT\Control Panel\International\iCountry
HKEY_USERS\.DEFAULT\Control Panel\International\iMeasure
HKEY_USERS\.DEFAULT\Control Panel\International\iPaperSize
HKEY_USERS\.DEFAULT\Control Panel\International\iDigits
HKEY_USERS\.DEFAULT\Control Panel\International\iLZero
HKEY_USERS\.DEFAULT\Control Panel\International\iNegNumber
HKEY_USERS\.DEFAULT\Control Panel\International\NumShape
HKEY_USERS\.DEFAULT\Control Panel\International\iCurrDigits
HKEY_USERS\.DEFAULT\Control Panel\International\iCurrency
HKEY_USERS\.DEFAULT\Control Panel\International\iNegCurr
HKEY_USERS\.DEFAULT\Control Panel\International\iCalendarType
HKEY_USERS\.DEFAULT\Control Panel\International\iFirstDayOfWeek
HKEY_USERS\.DEFAULT\Control Panel\International\iFirstWeekOfYear
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}\pv
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Hostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Domain
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\OemInstallTime
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\usagestats
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\usagestats
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\eulaaccepted
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CloudManagementEnrollmentToken
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\GoogleUpdate.exe\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\LastChecked
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\IsMSIHelperRegistered
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\RetryAfter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{15F462BB-5778-4495-8311-8BDA84553AC0}\Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{15F462BB-5778-4495-8311-8BDA84553AC0}\Hash
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updates\PUvJoaHGhK\Id
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updates\PUvJoaHGhK\Index
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{15F462BB-5778-4495-8311-8BDA84553AC0}\Triggers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{15F462BB-5778-4495-8311-8BDA84553AC0}\DynamicInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{987A7D63-4169-466C-AB80-45D77E9611A1}\DynamicInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{0CA5C4CD-C1DF-4F2A-9B3D-3FB4F80A231F}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{0CA5C4CD-C1DF-4F2A-9B3D-3FB4F80A231F}\data
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\LastStartedAU
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\uid
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\old-uid
advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.SetDefaultDllDirectories
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
kernel32.dll.AcquireSRWLockExclusive
kernel32.dll.ReleaseSRWLockExclusive
advapi32.dll.EventRegister
advapi32.dll.EventSetInformation
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
clr.dll.SetRuntimeInfo
user32.dll.GetProcessWindowStation
user32.dll.GetUserObjectInformationW
clr.dll._CorExeMain
mscoree.dll.CreateConfigStream
mscoreei.dll.CreateConfigStream
kernel32.dll.GetNumaHighestNodeNumber
kernel32.dll.GetSystemWindowsDirectoryW
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddSIDToBoundaryDescriptor
kernel32.dll.CreateBoundaryDescriptorW
kernel32.dll.CreatePrivateNamespaceW
kernel32.dll.OpenPrivateNamespaceW
kernel32.dll.DeleteBoundaryDescriptor
kernel32.dll.WerRegisterRuntimeExceptionModule
kernel32.dll.RaiseException
mscoree.dll.#24
mscoreei.dll.#24
ntdll.dll.NtSetSystemInformation
kernel32.dll.AddDllDirectory
kernel32.dll.SortGetHandle
kernel32.dll.SortCloseHandle
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
clrjit.dll.sxsJitStartup
clrjit.dll.getJit
kernel32.dll.LocaleNameToLCID
kernel32.dll.LCIDToLocaleName
kernel32.dll.GetUserPreferredUILanguages
kernel32.dll.GetFullPathNameW
uxtheme.dll.IsAppThemed
kernel32.dll.CreateActCtxA
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
user32.dll.RegisterWindowMessageW
ole32.dll.CoCreateGuid
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
kernel32.dll.CompareStringOrdinal
kernel32.dll.SetThreadErrorMode
kernel32.dll.GetFileAttributesExW
kernel32.dll.ResolveLocaleName
gdiplus.dll.GdiplusStartup
kernel32.dll.IsProcessorFeaturePresent
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipBitmapGetPixel
nlssorting.dll.SortGetHandle
nlssorting.dll.SortCloseHandle
shell32.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
kernel32.dll.CloseHandle
kernel32.dll.GetCurrentProcess
kernel32.dll.LocalFree
kernel32.dll.LocalAlloc
advapi32.dll.LsaClose
advapi32.dll.LsaFreeMemory
advapi32.dll.LsaOpenPolicy
advapi32.dll.LsaLookupSids
kernel32.dll.GetTempPathW
kernel32.dll.GetTempFileNameW
kernel32.dll.CreateFileW
kernel32.dll.GetFileType
kernel32.dll.WriteFile
shell32.dll.ShellExecuteEx
shell32.dll.ShellExecuteExW
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#386
kernel32.dll.DuplicateHandle
ole32.dll.CoWaitForMultipleHandles
sechost.dll.LookupAccountNameLocalW
advapi32.dll.LookupAccountSidW
sechost.dll.LookupAccountSidLocalW
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptGenRandom
ole32.dll.NdrOleInitializeExtension
ole32.dll.CoGetClassObject
ole32.dll.CoGetMarshalSizeMax
ole32.dll.CoMarshalInterface
ole32.dll.CoUnmarshalInterface
ole32.dll.StringFromIID
ole32.dll.CoGetPSClsid
ole32.dll.CoCreateInstance
ole32.dll.CoReleaseMarshalData
ole32.dll.DcomChannelSetHResult
rpcrtremote.dll.I_RpcExtInitializeExtensionPoint
kernel32.dll.DeleteFileW
kernel32.dll.CreateProcessW
kernel32.dll.GetThreadContext
kernel32.dll.ReadProcessMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.WriteProcessMemory
kernel32.dll.SetThreadContext
kernel32.dll.ResumeThread
advapi32.dll.LookupPrivilegeValueW
advapi32.dll.AdjustTokenPrivileges
ntdll.dll.NtQuerySystemInformation
advapi32.dll.EventUnregister
api-ms-win-downlevel-advapi32-l1-1-0.dll.UnregisterTraceGuids
advapi32.dll.UnregisterTraceGuids
comctl32.dll.#321
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
kernel32.dll.QueryActCtxW
cryptsp.dll.CryptReleaseContext
sspicli.dll.GetUserNameExW
advapi32.dll.CryptAcquireContextW
advapi32.dll.RegCreateKeyExW
shlwapi.dll.PathIsDirectoryW
advapi32.dll.RegNotifyChangeKeyValue
ole32.dll.CLSIDFromOle1Class
clbcatq.dll.GetCatalogObject
clbcatq.dll.GetCatalogObject2
tschannel.dll.DllGetClassObject
tschannel.dll.DllCanUnloadNow
advapi32.dll.RegSetValueExW
shlwapi.dll.PathIsPrefixW
advapi32.dll.CryptCreateHash
cryptsp.dll.CryptCreateHash
advapi32.dll.CryptGetHashParam
cryptsp.dll.CryptGetHashParam
advapi32.dll.CryptHashData
cryptsp.dll.CryptHashData
advapi32.dll.CryptDestroyHash
cryptsp.dll.CryptDestroyHash
xmllite.dll.CreateXmlReader
kernel32.dll.InitOnceExecuteOnce
kernel32.dll.CreateSemaphoreW
kernel32.dll.GetFileInformationByHandleEx
kernel32.dll.SetFileInformationByHandle
kernel32.dll.InitializeConditionVariable
kernel32.dll.WakeConditionVariable
kernel32.dll.WakeAllConditionVariable
kernel32.dll.SleepConditionVariableCS
kernel32.dll.InitializeSRWLock
kernel32.dll.TryAcquireSRWLockExclusive
kernel32.dll.SleepConditionVariableSRW
kernel32.dll.CreateThreadpoolWork
kernel32.dll.SubmitThreadpoolWork
kernel32.dll.CloseThreadpoolWork
goopdate.dll.DllEntry
kernel32.dll.RtlCaptureStackBackTrace
ntmarta.dll.GetMartaExtensionInterface
kernel32.dll.CreateMutexExW
dbghelp.dll.MiniDumpWriteDump
rpcrt4.dll.UuidCreate
kernel32.dll.WTSGetActiveConsoleSessionId
winsta.dll.WinStationQueryInformationW
advapi32.dll.CreateWellKnownSid
rpcrt4.dll.RpcStringBindingComposeW
rpcrt4.dll.RpcBindingFromStringBindingW
rpcrt4.dll.RpcStringFreeW
rpcrt4.dll.RpcBindingSetAuthInfoExW
rpcrt4.dll.NdrClientCall2
rpcrt4.dll.I_RpcExceptionFilter
rpcrt4.dll.RpcBindingFree
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PUvJoaHGhK" /XML "C:\Users\Rebecca\AppData\Local\Temp\tmp9926.tmp"
schtasks.exe /Create /TN "Updates\PUvJoaHGhK" /XML "C:\Users\Rebecca\AppData\Local\Temp\tmp9926.tmp"
"{path}"
C:\Users\Rebecca\AppData\Local\Temp\Preform Invoice.exe "{path}"
taskeng.exe {0CA5C4CD-C1DF-4F2A-9B3D-3FB4F80A231F} S-1-5-18:NT AUTHORITY\System:Service:
"C:\Program Files\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler
Global\G{D19BAF17-7C87-467E-8D63-6C4B1C836373}
Global\G{D0BB2EF1-C183-4cdb-B218-040922092869}

BinGraph Download graph

PE Information

Image Base Entry Point Reported Checksum Actual Checksum Minimum OS Version Compile Time Import Hash Icon Icon Exact Hash Icon Similarity Hash
0x00400000 0x0045f1e2 0x00000000 0x00068f84 4.0 2020-06-30 04:21:47 f34d5f2d4577ed6d9ceec516c1f5a744 d7fa4c61eee64a320960111c1c362842 920c3027c18f1b01bd763db3bf5579e5

Sections

Name RAW Address Virtual Address Virtual Size Size of Raw Data Characteristics Entropy
.text 0x00000200 0x00002000 0x0005d1e8 0x0005d200 IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 7.90
.rsrc 0x0005d400 0x00060000 0x000041c8 0x00004200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 6.54
.reloc 0x00061600 0x00066000 0x0000000c 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 0.10

Resources

Name Offset Size Language Sub-language Entropy File type
RT_ICON 0x00061670 0x000025a8 LANG_NEUTRAL SUBLANG_NEUTRAL 6.60 None
RT_ICON 0x00061670 0x000025a8 LANG_NEUTRAL SUBLANG_NEUTRAL 6.60 None
RT_ICON 0x00061670 0x000025a8 LANG_NEUTRAL SUBLANG_NEUTRAL 6.60 None
RT_GROUP_ICON 0x00063c28 0x00000030 LANG_NEUTRAL SUBLANG_NEUTRAL 2.46 None
RT_VERSION 0x00063c68 0x0000035e LANG_NEUTRAL SUBLANG_NEUTRAL 3.41 None
RT_MANIFEST 0x00063fd8 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL 5.00 None

Imports


Assembly Information

Name NNnBUpqoQehfI
Version 1.98.4.0

Assembly References

Name Version
mscorlib 4.0.0.0
System.Windows.Forms 4.0.0.0
System 4.0.0.0
System.Drawing 4.0.0.0
System.Xml 4.0.0.0
System.Data 4.0.0.0

Custom Attributes

Type Name Value
Assembly [mscorlib]System.Reflection.AssemblyTitleAttribute Winform Sandb
Assembly [mscorlib]System.Reflection.AssemblyProductAttribute Winform Sandb
Assembly [mscorlib]System.Reflection.AssemblyCopyrightAttribute Copyright \xa9 2017 - 20
Assembly [mscorlib]System.Runtime.InteropServices.GuidAttribute D7AFF0CC-F635-4140-A9B4-0FEA7D211F
Assembly [mscorlib]System.Reflection.AssemblyFileVersionAttribute 1.98.4

Type References

Assembly Type Name
mscorlib System.Runtime.CompilerServices.CompilationRelaxationsAttribute
mscorlib System.Runtime.CompilerServices.RuntimeCompatibilityAttribute
mscorlib System.Diagnostics.DebuggableAttribute
mscorlib System.Diagnostics.DebuggableAttribute/DebuggingModes
mscorlib System.Reflection.AssemblyTitleAttribute
mscorlib System.Reflection.AssemblyDescriptionAttribute
mscorlib System.Reflection.AssemblyConfigurationAttribute
mscorlib System.Reflection.AssemblyCompanyAttribute
mscorlib System.Reflection.AssemblyProductAttribute
mscorlib System.Reflection.AssemblyCopyrightAttribute
mscorlib System.Reflection.AssemblyTrademarkAttribute
mscorlib System.Runtime.InteropServices.ComVisibleAttribute
mscorlib System.Runtime.InteropServices.GuidAttribute
mscorlib System.Reflection.AssemblyFileVersionAttribute
mscorlib System.Runtime.Versioning.TargetFrameworkAttribute
System.Windows.Forms System.Windows.Forms.Form
mscorlib System.Collections.Generic.List`1
System System.ComponentModel.IContainer
System.Windows.Forms System.Windows.Forms.ComboBox
System.Windows.Forms System.Windows.Forms.Label
System.Windows.Forms System.Windows.Forms.Button
System.Windows.Forms System.Windows.Forms.ListBox
mscorlib System.Object
mscorlib System.EventArgs
mscorlib System.Decimal
mscorlib System.Enum
mscorlib System.Runtime.CompilerServices.CompilerGeneratedAttribute
mscorlib System.Diagnostics.DebuggerBrowsableState
mscorlib System.Diagnostics.DebuggerBrowsableAttribute
mscorlib System.Collections.Generic.List`1/Enumerator
mscorlib System.Reflection.Assembly
mscorlib System.Type
mscorlib System.Reflection.MethodInfo
mscorlib System.STAThreadAttribute
System System.CodeDom.Compiler.GeneratedCodeAttribute
mscorlib System.Diagnostics.DebuggerNonUserCodeAttribute
mscorlib System.Resources.ResourceManager
mscorlib System.Globalization.CultureInfo
System.Drawing System.Drawing.Bitmap
System System.ComponentModel.EditorBrowsableState
System System.ComponentModel.EditorBrowsableAttribute
System System.Configuration.ApplicationSettingsBase
System.Windows.Forms System.Windows.Forms.DataGridView
System.Windows.Forms System.Windows.Forms.DataGridViewTextBoxColumn
System.Windows.Forms System.Windows.Forms.DataGridViewCellEventArgs
System System.ComponentModel.INotifyPropertyChanged
System System.ComponentModel.PropertyChangedEventHandler
mscorlib System.Collections.Generic.IList`1
mscorlib System.Collections.Generic.ICollection`1
mscorlib System.Collections.Generic.IEnumerable`1
mscorlib System.Collections.IEnumerable
mscorlib System.Guid
System System.ComponentModel.BindingList`1
System System.ComponentModel.ListSortDirection
System System.ComponentModel.PropertyDescriptor
mscorlib System.IComparable
System.Windows.Forms System.Windows.Forms.GroupBox
System.Windows.Forms System.Windows.Forms.TextBox
mscorlib System.Exception
System.Windows.Forms System.Windows.Forms.DataGridViewRow
System.Windows.Forms System.Windows.Forms.DataGridViewCellStyle
System.Xml System.Xml.Serialization.XmlSerializer
System.Data System.Data.DataSet
System.Data System.Data.DataTable
System.Windows.Forms System.Windows.Forms.BindingSource
System.Windows.Forms System.Windows.Forms.ListBox/ObjectCollection
System.Windows.Forms System.Windows.Forms.Control
System.Windows.Forms System.Windows.Forms.ListControl
mscorlib System.IDisposable
System.Windows.Forms System.Windows.Forms.AutoCompleteMode
System.Windows.Forms System.Windows.Forms.AutoCompleteSource
System.Drawing System.Drawing.Point
System.Drawing System.Drawing.Size
mscorlib System.EventHandler
System.Windows.Forms System.Windows.Forms.ButtonBase
System.Drawing System.Drawing.SizeF
System.Windows.Forms System.Windows.Forms.ContainerControl
System.Windows.Forms System.Windows.Forms.AutoScaleMode
System.Windows.Forms System.Windows.Forms.Control/ControlCollection
mscorlib System.Convert
mscorlib System.AppDomain
mscorlib System.Reflection.MethodBase
System System.ComponentModel.Container
System.Windows.Forms System.Windows.Forms.Application
mscorlib System.RuntimeTypeHandle
System System.Configuration.SettingsBase
System.Windows.Forms System.Windows.Forms.ControlBindingsCollection
System.Windows.Forms System.Windows.Forms.Binding
System.Windows.Forms System.Windows.Forms.DataGridViewCellEventHandler
System System.ComponentModel.ISupportInitialize
System.Windows.Forms System.Windows.Forms.DataGridViewColumnHeadersHeightSizeMode
System.Windows.Forms System.Windows.Forms.DataGridViewColumnCollection
System.Windows.Forms System.Windows.Forms.DataGridViewColumn
System.Windows.Forms System.Windows.Forms.DataGridViewBand
System.Windows.Forms System.Windows.Forms.DataGridViewAutoSizeColumnMode
System.Drawing System.Drawing.Font
System.Drawing System.Drawing.FontStyle
System.Drawing System.Drawing.GraphicsUnit
mscorlib System.Delegate
mscorlib System.Threading.Interlocked
System System.ComponentModel.PropertyChangedEventArgs
mscorlib System.Collections.ObjectModel.Collection`1
System.Windows.Forms System.Windows.Forms.DataGridViewRowCollection
mscorlib System.Math
mscorlib System.String
mscorlib System.Comparison`1
System System.ComponentModel.ListChangedEventArgs
System System.ComponentModel.ListChangedType
mscorlib System.StringComparison
System.Windows.Forms System.Windows.Forms.MessageBox
System.Windows.Forms System.Windows.Forms.DialogResult
System.Data System.Data.DataRowCollection
System.Data System.Data.DataRow
System.Windows.Forms System.Windows.Forms.BorderStyle
System.Windows.Forms System.Windows.Forms.TextBoxBase
System.Windows.Forms System.Windows.Forms.ScrollBars
System.Drawing System.Drawing.Color
System.Windows.Forms System.Windows.Forms.DataGridViewTriState
System.Windows.Forms System.Windows.Forms.DataGridViewSelectedRowCollection
System.Windows.Forms System.Windows.Forms.DataGridViewCellCollection
System.Windows.Forms System.Windows.Forms.DataGridViewCell
System.Windows.Forms System.Windows.Forms.DataGridViewAutoSizeColumnsMode
System.Windows.Forms System.Windows.Forms.DataGridViewAutoSizeRowsMode
System.Windows.Forms System.Windows.Forms.DataGridViewContentAlignment
System.Drawing System.Drawing.SystemColors
System.Windows.Forms System.Windows.Forms.DataGridViewEditMode
System.Windows.Forms System.Windows.Forms.DataGridViewRowHeadersWidthSizeMode
System.Windows.Forms System.Windows.Forms.DataGridViewSelectionMode
System.Windows.Forms System.Windows.Forms.FormStartPosition
System.Windows.Forms System.Windows.Forms.FormBorderStyle
System.Windows.Forms System.Windows.Forms.FormClosingEventHandler
System.Data System.Data.XmlReadMode
System.Data System.Data.DataTableCollection
System.Windows.Forms System.Windows.Forms.DockStyle

!This program cannot be run in DOS mode.
.text
`.rsrc
@.reloc
*BSJB
v4.0.30319
#Strings
#GUID
#Blob
IEnumerable`1
ICollection`1
Comparison`1
IList`1
SortableBindingList`1
label1
Form1
dataGridView1
groupBox1
label2
button3
Class3
get_unify4
<Module>
SizeF
NNnBUpqoQehfI
labelTM
textBoxTM
SDSDSDS
CVVVVVVVVV
value__
System.Data
SaveData
mscorlib
System.Collections.Generic
get_Id
add_Load
OrderForm_Load
buttonAdd
OnListChanged
add_SelectedIndexChanged
lstOrder_SelectedIndexChanged
cbMenus_SelectedIndexChanged
add_PropertyChanged
remove_PropertyChanged
INotifyPropertyChanged
Interlocked
set_Enabled
set_FormattingEnabled
_isSorted
Synchronized
PopulateDataGrid
SelectedGroupDataGrid
GroupsDataGrid
NewGuid
<Id>k__BackingField
<Price>k__BackingField
<ProductsTable>k__BackingField
<Title>k__BackingField
<Name>k__BackingField
<GroupName>k__BackingField
<ProductName>k__BackingField
<MenuType>k__BackingField
<TradeMark>k__BackingField
<Description>k__BackingField
<PhoneNumber>k__BackingField
<SkuNumber>k__BackingField
<Supplier>k__BackingField
<ProductDetails>k__BackingField
<OrderItems>k__BackingField
<MenuItems>k__BackingField
<StorageUnit>k__BackingField
<Category>k__BackingField
DataGridViewBand
buttonAmend
SBind
GetMethod
get_Price
set_Price
get_TotalPrice
RefreshTotalPrice
lblTotalPrice
labelPrice
textBoxPrice
defaultInstance
set_DataSource
set_AutoCompleteSource
BindingSource
source
XmlReadMode
set_AutoScaleMode
set_AutoCompleteMode
set_RowHeadersWidthSizeMode
DataGridViewRowHeadersWidthSizeMode
set_AutoSizeMode
set_ColumnHeadersHeightSizeMode
DataGridViewColumnHeadersHeightSizeMode
DataGridViewAutoSizeColumnMode
set_SelectionMode
DataGridViewSelectionMode
set_WrapMode
set_AutoSizeColumnsMode
DataGridViewAutoSizeColumnsMode
set_AutoSizeRowsMode
DataGridViewAutoSizeRowsMode
set_EditMode
DataGridViewEditMode
AddRange
CompareExchange
get_WhiteSmoke
Invoke
DataTable
get_ProductsTable
set_ProductsTable
IComparable
IEnumerable
IDisposable
dtable
set_RowHeadersVisible
RuntimeTypeHandle
GetTypeFromHandle
numberOfPeople
get_Title
set_Title
DockStyle
get_DefaultCellStyle
set_DefaultCellStyle
set_ColumnHeadersDefaultCellStyle
DataGridViewCellStyle
set_BorderStyle
set_FormBorderStyle
FontStyle
get_Name
set_Name
PersonName
get_GroupName
set_GroupName
groupName
labelPrName
textBoxPrName
get_ProductName
set_ProductName
set_DataPropertyName
Combine
set_Multiline
Phone
ListChangedType
GetType
get_MenuType
set_MenuType
Compare
get_IsSortedCore
get_SupportsSortingCore
get_SortDirectionCore
GroupCore
RemoveSortCore
ApplySortCore
get_SortPropertyCore
get_Culture
set_Culture
resourceCulture
MethodBase
ButtonBase
ApplicationSettingsBase
TextBoxBase
Close
Dispose
Delegate
DebuggerBrowsableState
EditorBrowsableState
DataGridViewTriState
Delete
get_White
STAThreadAttribute
CompilerGeneratedAttribute
GuidAttribute
GeneratedCodeAttribute
DebuggerNonUserCodeAttribute
DebuggableAttribute
DebuggerBrowsableAttribute
EditorBrowsableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
labelCatalogue
get_Value
GetValue
value
buttonSave
Remove
NNnBUpqoQehfI.exe
set_Size
set_MinimumSize
set_MaximumSize
set_AutoSize
set_ClientSize
myserialize
ISupportInitialize
IndexOf
get_Tag
set_Tag
System.Threading
Binding
System.Runtime.Versioning
FromBase64String
ToString
GetString
MainForm_Closing
add_FormClosing
disposing
Operating
System.Drawing
ShowDialog
set_MaxLength
buttonAdd_Click
add_Click
buttonAmend_Click
buttonDelete_Click
buttonSave_Click
buttonCancel_Click
btnClearMenus_Click
buttonEdit_Click
buttonExit_Click
btnAddMenu_Click
btnRemoveMenu_Click
buttonShow_Click
set_Dock
get_TradeMark
set_TradeMark
ToDecimal
Label
buttonCancel
System.Collections.ObjectModel
System.ComponentModel
WinformsSandbox.ComponentModel
IGroupsViewModel
get_GroupsViewModel
set_GroupsViewModel
_groupsViewModel
DataGridViewCell
System.Xml
ReadXml
WriteXml
GetFromXml
get_Control
ContainerControl
ListControl
Program
get_Item
AddItem
get_SelectedItem
get_DataBoundItem
RemoveItem
MenuItem
menuItem
System
EditDeleteAddForm
MainForm
OrderForm
AddEditForm
ShowForm
labelStoreUn
textBoxStoreUn
resourceMan
Vegetarian
AppDomain
get_CurrentDomain
DataGridViewColumn
DataGridViewTextBoxColumn
Application
set_Location
System.Configuration
System.Globalization
System.Xml.Serialization
System.Reflection
DataTableCollection
DataGridViewCellCollection
ControlCollection
DataGridViewColumnCollection
ControlBindingsCollection
ObjectCollection
DataRowCollection
DataGridViewSelectedRowCollection
DataGridViewRowCollection
ListSortDirection
_sortDirection
direction
set_StartPosition
FormStartPosition
Exception
get_Description
set_Description
StringComparison
OnComparison
IPerson
Button
CompareTo
MethodInfo
CultureInfo
get_Gainsboro
Bitmap
set_TabStop
IGroup
GetRandomGroup
Clear
set_ValueMember
get_PhoneNumber
set_PhoneNumber
get_SkuNumber
set_SkuNumber
sender
PhoneOrder
_currentOrder
lstOrder
get_ResourceManager
ProductsManager
get_Supplier
set_Supplier
labelSupplier
textBoxSupplier
PropertyChangedEventHandler
FormClosingEventHandler
DataGridViewCellEventHandler
System.CodeDom.Compiler
IContainer
add_RowEnter
GroupsDataGrid_RowEnter
remove_RowEnter
get_Silver
XmlSerializer
set_GridColor
set_BackgroundColor
set_ForeColor
set_SelectionForeColor
set_BackColor
set_UseVisualStyleBackColor
set_SelectionBackColor
GetEnumerator
.ctor
.cctor
PropertyDescriptor
System.Diagnostics
WinformsSandbox.Models.Interfaces
WinformsSandbox.ViewModels.Interfaces
System.Runtime.InteropServices
System.Runtime.CompilerServices
System.Resources
ProductsManager.EditDeleteAddForm.resources
ProductsManager.MainForm.resources
Restaurant.OrderForm.resources
ProductsManager.AddEditForm.resources
ProductsManager.ShowForm.resources
WinformsSandbox.Properties.Resources.resources
WinformsSandbox.Views.GroupsView.resources
DebuggingModes
AcceptChanges
WinformsSandbox.Properties
get_Tables
EnableVisualStyles
WinformsSandbox.Models.Classes
WinformsSandbox.ViewModels.Classes
get_DataBindings
Settings
ListChangedEventArgs
PropertyChangedEventArgs
DataGridViewCellEventArgs
Equals
get_ProductDetails
set_ProductDetails
labelProductDetails
textBoxProductDetails
get_Cells
get_Controls
get_Items
get_OrderItems
set_OrderItems
get_MenuItems
set_MenuItems
System.Windows.Forms
Contains
get_Columns
set_AutoGenerateColumns
set_AutoScaleDimensions
System.Collections
groupBoxButtons
IGroups
get_Groups
set_Groups
_groups
set_ScrollBars
SystemColors
labelProducts
components
cbMenus
InitializeAvailableMenus
_availableMenus
btnClearMenus
WinformsSandbox.Views
get_Rows
set_AllowUserToAddRows
get_SelectedRows
set_AllowUserToDeleteRows
set_AllowUserToResizeRows
Concat
Format
GetObject
set_MultiSelect
Product
ProductDirDataSet
get_Highlight
buttonEdit
EndInit
BeginInit
get_StorageUnit
set_StorageUnit
GraphicsUnit
buttonExit
get_Default
SetCompatibleTextRenderingDefault
DialogResult
Restaurant
set_Alignment
DataGridViewContentAlignment
InitializeComponent
get_Current
Point
set_Font
get_Count
get_RowCount
Convert
RandomPersonSourceList
get_SelectedGroupBindingList
set_SelectedGroupBindingList
_selectedGroupBindingList
get_GroupsBindingList
set_GroupsBindingList
_groupsBindingList
SuspendLayout
ResumeLayout
PerformLayout
MoveNext
get_Text
set_Text
get_ControlText
set_HeaderText
get_HighlightText
get_WindowText
labelSku
textBoxSku
btnAddMenu
btnRemoveMenu
get_leTJAGIErIXRAtjdeYKbv
DataGridView
GroupsView
DataRow
DataGridViewRow
get_Window
buttonShow
get_Index
set_TabIndex
get_SelectedIndex
get_RowIndex
rowIndex
index
MessageBox
set_MaximizeBox
ComboBox
GroupBox
ListBox
TextBox
WinformsSandbox
get_Assembly
set_ReadOnly
RestaurantLibrary
get_Category
set_Category
labelCategory
textBoxCategory
op_Inequality
_sortProperty
WrapNonExceptionThrows
Winform Sandbox
Copyright
2017 - 2020
$D7AFF0CC-F635-4140-A9B4-0FEA7D211F60
1.98.4.0
.NETFramework,Version=v4.0
FrameworkDisplayName
.NET Framework 4
3System.Resources.Tools.StronglyTypedResourceBuilder
16.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
16.1.0.0
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD1
QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
IDATx^
tB6Od
<h$9J
=E9wy
c?4y\m
b0kj%
z^t~ 8
7.&[p
EFt]NX
(~/q`
Onx]~A
J&K={
^i4X9
?RsaCZy
O9mcF
"jcMFk
%|coYg$_
gm0-W
!?{0u
H,_6a
9K88b!
OF%]"
vi']=
_6]%*5
Yr!|[
]cq+-
b({m_r
[Yg%z!
AS{pV
.l|t8c
:*W3N
Kzec9k
`{X$W
"sL(O
FZ}Un
7K"js_~
ZlGy1<s
r7oGn
rxM-~^
^W27Ya1
0e]\u
SzL^B
/'%b)
jFrx!
,^eBnyC
;UaaQ
8y-#[
'os*u
~^_Jn
6!dwcv<
>m<W
p2EO)p%I
bok|A
5J~{K
JSj4)O
ptfy\
U+y#2
#Y]2(
0|,[F[
DV'-|
yeVkI
9` -_
<"x*I
uM'eP5
^@#Z+\e
7NEwV$
?>F4]V
mK!xn:
pi~(m
k^S}e"
4l7<dz
bFV;t/
{&T&9;
Jp;O"
%^uRG
H6?%R
X]F|y
gMh.-
-450&
mibf+
~r/Lvy
.!'s0
pr;PY
K=Fp0
mMGj<
pvCi]
|N7#Z
yXeFq
Kc8?$
T3Yo\
qW{76g{
DK~o8
gp:4E
!{93e\`/
+{;f<
'9]8C
cnJ'.
O83hV
FXwOEK
){{ZE,%
O30l*
!4q,Ag
a?Jx%
mgb[rB
Mbv)?/
Fskmu
)C^si
7|Sjr
:3(?L
=wk170
2thb6
Aj?Y+
u`Y|;
R+0~AK2
[0ve#
>OnsK
|N2K3j
+G'.eT
b,9xz,
FLa|T
DdS2F
jC)nz
yTd-#K
rEjU;
M)dwO"
+_mH9q
Bp+}t
FN|9z
nYG.&5
_K>O8L
~'wGo
0n]Eb
d4.ja
K=\~l
B!Z%;0o
?q)6D
>8L/E
RueW4L"
[Vfvo
#Ut\U
/rOcU
|Z&K;*V
s\>mt
vW&ct
18hT`
CkMM6
s'vj{
oLaew
LC{^1f#
[mnSf
vxfgszm=
wfn6s<
\?.~"I
+sGJ^
`u~JL4
E:gU6
.MT=X
ts8U+
'P9z0
Trl,1
udI^Of
@eK-TV5
C;&a7~
:T9%{
Z%{l&'
|Cx\.K
6s3o1h
Bo-jL
s$?PtN
{,1N;
;+7eJ
0bP6V
m~c"F
jszV4
cR5c&
T]YEO
?l8:w|
'Y>o.[
n+qS3
vt~.6
fS5{6
f^U5Q
^9{;-5
_]W32
&=%NVE
b?}zMc
g]s,?
^`i$y
5'1q.
~[W5#!
)etMc
pr*Zq
.u8[y*v
fXat_H
{hm/6V
1y.&Z
`Z\9I
nrs+L
Lj7B#?
8f_5XXp
*eu?J|
RLgS]r
*z5FN
*(e*C
2>2_Y
gC17^
PtecX
e#0+(&tbU
)r=4)
zcU\*)umL
hNjcC&H
A5Mou
(_G_R
H^Kb_
/6SubG
oJ?bd}J
anK8<
g+~)g
{LeaG
'rY?2
7gHd7b
@UOVQ
8>,/F;<
zQ4^_
cwq6$
+FR80
7H6-CB
'|42eY
jOiIP
l[,fk
ej1:y
3} vS
33Iau{
m+wZ*y
'&s.P
$E'vxeU/
^W_2'
F%Oi\
lSjO-
o_b~o
'6SY^EOV
w_AdRo
:6XTXH
OB/}'
)Cv*qd]
=uH^f
kX$u{
y4SftdJB
_VVea
wem=sRGga
GHY}\
-uPtu
FUC9}
@bl=F
scp4M
/FSLd
9Qsf3ju
dG?Ca[
-0)eam
4|W,C+
(Va,O
v2Na9
,X$y/
y;..\NAD
^ekoM
':I{6
$v1:%
o6!L'
jFBs3
BR/[St
5Eo\>
],ydP
qS:)l
.>6at
IDATj0
1+Xa<
glh)6
ib7QK
v&wu2
";(HlG
h}Zea
<BeQ3
LnR/E
9TOec
I8V4d
`zD<f
${F<fI
rcx]>
|N$\[
$G*Lp
p4'lQ
m6Z|>
!Se&_
|+*(y
O`"qm
CIOTXK
wg`HY
%yL8a
)Pud_H]
`[Zmjv=
\lj0^
zw7%8*
T4$fU
)s*a3
vgPA[
YPq6ZY
sJxpD
qoW_L
9~|Nud
6)XtS
Yl5ZKT
"q~(w
_nxU8Fl
XaDm
DSe#=
JWFm2
)lSXX
E7v(9
5J!xa
tn85!O
m[`3:
]]e^k,.
8um~3
3.j2g
+yJxp":t"
WXpJ~
C&(lf
v=YKEOv/
&T_J?
~=nGF
';.U)/
j0ni="
{Rcn.9Sfab
[0bak
^?Rsl
V$|wE
$^su~e_
AuYGK
<~v,ce
O>g[I
S6P8V
^Gld>
].tyK
Wae[(
w{kr:
VVaaM
qk\G'p
gJ|+5
<VX^f
>J>uhz
nFWe>
'{Ck6#
`VMyI
,ca{):
$;\&*
=ZT6!~
+5hafB
<.S#q_
&SNaa
A{\vwd
anz<cC
m!ku:
|vWr}
!v(E]J
/X?k)
p/[{]d
:-hoU
GI<]B
lzX8k
IxU#f
skj1O2
nJ=R1
^rnd]O
kuUu{s
iR_+UOV
at4."
Q^w0W
/cUm?
%xU:cz%b
J^7G|!t
YFs||+
/U=Y?9
:Qc~1
s9}j#
0WeEG
=Ofy}9
dUU~$|
rz;?v
(b:^
?rs~R7
2;Q~V[
YTq"I-
q!{vo<
XV%B.t{
QDdL`
2O5oU
=}X%uI
qXqT'Z
NaamU]
?Va]U=Y
6rn,d|
=d]'8W
<_?C5
{y^2f
<k>$Y
,ca;*
%qjXSW
ZY4hk
[v.\K
6Ow`Z
4}11.%W+
WcEWu!&N
x_aQS0_
,=|Kq>
{Haa3U
HqX!]N
X^5See
vd\9o
R;UO6Z
~g8&o
(cDgZ
8d^fy
LOVoPY
lp?\{
t.riM
/7GL%
Tiw,b
z7lCf
E2n_0
+363`BO
r#&}O
..fv'
xiWtS
%`e=Rd~
*hyt
e;l{es
hNc9'
\[mIo
+Xe_[):
~V3:%Fr
HAj#~Xl
}S;*>
glx|_l
(L$^3
?"0i2
wPa+Wha?
3holH
bX u|gJ
T_ef-3
ig\We
`_oWu
tbZm=
;"_kT
g;r5H
aZn!%
,o6g3
x8w%9
~Ekw-*)q
8ToFZ
Nc`H"
v<]`C
4/aip
!iLVtG
l"aUK
ZV1 *
'o*V4
[hnxF
@a|-:m
z0/a2
AfXWa
KvSYY
R%Nyk
7*8t%7]
Z2e};V>l
&Fw`U
J5sXZ}
(UOVa0C
1_eb[
5S9T{/
+{>zc
`Or~GN
=Ut^U
J;Hn)
dIqbo
m`{p4?
xK"&4bx
%?>/c
DwD.g
cgXv>J
oQqMk^
Sy3w7
x&VSY
~iflju
'jD!>
n#|7<
M~MP\=<
hfJ{q
OoH:?
Avv/R
r}IK~<
^M,c6/WP
~g'OA
s"FuZ
i&wrE
:.Cyl%o
>h/>),
X{ND)
x2G+(L
cpp>-
a;}U?
Si'q8
_77N;K
MEE'V
qjv)az
IDATG
v}:-Z
+6Jad
j Vafg
!U/Vae
:[QKl
G*YRE
sw9Q}
"v`7"
sf#7{
I{|zg<
!Vac{+:
l)RuYmqmz
4/gLL
xikH-
n}T66U+
k3aEC
nhHRVK
p6iM`
fQcgkR+
K49T}4
OzH5j
;skzU
oe,l3s
T&Vae
{Iea;
4N)ld
OAa\G
z> M{
eGPti
~?Ke`M
W]+aR
/~'lW
}fY~]
szooV;
UX=|4
:RWCu\
ca|7:lhBalk|
K_Rt*
l1uK|
h{Neb
*+j!~
i>%Vad
YQk9C[E
Q=:ljLu?s
rsz4]#
er]ac
w-n4M
65o?V
>[s\G
]bw4~
>ZGfJ -
:NM}I
X6o:W
~saQE?
|n6&Dc<
<AwQO
kjkl+~
X^eAK
F2mx:s%
DZ>;*_2
xm<e|
X2Fe+
Hu9ob
dG\7i
EfMi'cS
41~i)
ol>lf
vhkzl
^E?vx
Q8W[Fe
vu8_=s
Ba*]U
:1UeLg
f/m,q
K;|U?
!9tlQ
m:l~K
GRw}
xqhJ!YY
I^|OeY
|e\r_
Br;r$]a
wC>Pc
OG:7:
p`0];g
Ne>-%
=aEo7(
Ea\k[
1Be`{N
bSr3*
m3ih`'
h\EaX
nfG*~
U^.q'
7b:7e=
^!u,G
>uN'=z
%]s:%R
+qCTF
$Q\}:-
qEUWWa
O=Y7k
mw`_K
!6Al=':|
~ar}=
'z\8D
#0y}^e8
$)ut)e
&']l2
KW;Yo?i+
+;Ceem
f:}J3%N
_ag/Ts
RUMfJ
6r1ZgMiRq=>Y#ha(~
tu"Bn
{Feak
K>5l&
XR_aD5\
Fcj2!
y8m+e
i{j&S
Bwg {
qd'zP3
Zr]+Y
:&v<o
+yvl>
0Xah+~
ESqY0
r"f1CZ
iklNF
;?Sus
p0eb3
s_WUg
n$eJ;n?
k(y4M
Z)\:c
?Bqh|
PY{c:G
h,5VU
[O\Kg
\*V[l-j
p%1Ieb
<<BhHC
ljXD!
2.SeG
K_eS#&
`O.J^=
VZx>{#
t%^'4
QwLmz0T
{Gl:c
HwvfpY
/^,z;
3Nv 7y(
ve]wf
s|k<Sz
s6<J j
Ga&kh
#U=ZE
UaZe]vk
|sbOe
nMRU=
OocKt
c_->eJ
x-$l|/
MejmR~
8`$K<
t'jtS
EW6Re
:9a?]>
O+k4B6
D?B"\(4
_h(lnq2
O)PuK
&xwnG[
1su_QNft
0`PH1
S_eq#
cA6F&[
+hr":
\&>lO
S;tG;
jV'krts
\$C>9qDK
K+Ml_
{Y9wU/x
W%)u;
<e_O1(
Ljd(o
|v}X#o$-96
6RYOE
N3G*+
xi}Z6R
6rNN#p(nB
\Rtcc
\VtSY
v!Tt{
W_ek-5O
Itw>B]9
VS]g4
yy-{F
Og'UwV
&,_bB
V_aaw
,lTb#
-F%F|
3}uB1
^H=S[
rA^!k
`|qEv<
b~,'[Na{
EF$|\
CDYWn9
[~#!Eu8n
5s\o1)*
05]k`
@eYC]
6'ZaSM
./x-_
wTgUG
f4!lh&z
Og^Lj
m#ulW
hR&M`
y\l//B
Q.b6g
y}le^
Yad6{
=~3u]
KX~9*
<F.s&p
Uea_:
C5EWV
(uy-~V
5^/v6
AwSeB<;
buVSe
:q"i.
6^Qo$
%35OE
1Nuh.o
XT]RY
J/:WR
XVer;
MeV#O
H9/]y
!/QsT=
&QVCa)
1~j\Wu\
NjdV.
b_.66
nmG>{
/#{Ged
2j~/V
IhW>B
rF:d2%
=I9Sw
Nv#C.
r^@:q
g>94T
Gi'mh
ILs`^
IMp[8W
#*Shy
.ogsW
C\tZ'
^Et~h
0I\%yJ;
WfgNf
5eAQ[
=VMP~
?OeUGD
DaTf?
EPKov
b^?LeW
Z3Leh-d
IDATU
%o4ei
Cm\TV
!lu8A
)-rjH
8Xm2Q
aYDPQ
hh$Zk
3zK{pop$:E#
l_`yL
AU)kdI
5VU-9T7
U&-=F
~1k01
7Ta8#(
dPKe9
<d^w=
I<]aESEO
mS<-;
~M"G&n
e~Od>N
7,Ruc
(,lUsi
"vT~,615
OF34$n
~'ulBJ
~ -&Z
(R7j0
(~78I?s
1j'qW+
kIKsCB
-zz%Dz5
,v/\pf_a
q(F/{p
*Z^d&
3SF`\<
gW|kjK=l
zlbKt=n
p3o7v
|Y|w%
Saq[2
RudOZ
tu(7/
Y+SUG
znSud7L:
EZb$E
hpK'F
>IaI#
]hkUowkh8
o[GeG
~!_y$q
gX:V*
Qqtnm
~Twru
XW]eiu
OXO:ImY
Bj\s4m
z{Kee
JPXXE
emGSA
8UJdM
Pek;D
o*c;xR!C
+=veQ
Naf+H
fP*=~E
W9EoX
NG3*2
}jRPf
u43~Oc
m~bykb
UgUa[]
+"Vjbg8
+o$^s
GMVuc
F%a*c
rBe 3
$DOce
Vak7[
Fa8Kui
+C_^$
D~,#cX
[5WubS
ZwFaU
&x|z(
4*.Vt_m
Pucw=S
Y$VaT
2oE?Ua*
01PaRO
&a^vl
LtU\v
N7TfPe
&-.rJ
V;i8>
ZPgH"7
.}Rue
q8?[#
hm7dd
I`{U7
AerKYOs|
wWud/
->H>b
2Li<m
SYaEo
Z[ZU7"l
me-W*
^=2ii
+6}IK
T_Vm/
Sug;2
1(d:^{
L*t[._
?XX?&*,
MYZ&Je1
id},$
@bkOc
~dOh|
(B_7$ff
cLumv
Oq7vaN
Z+<e=]
MX+u?
ZSx5x
Xe79W
]$qZ(
.nCq/n
1zoNaD
S>R9O
3#*VJ
]$Oc.
J?s&$X
"Vhhcw<
)g0|dK
AQh 3~
PuImw
fLqKN\
1He~'0jq
B:[Q~F
CzW=lb
*VzLf
mnsmyOV
h|5Te]
KanW3d
-_WeP
lnn!c
^#:q\_
,sL#p
6l(9S>
&w-#X[
YI<u|
)L]tC]
dZ$}#
$]) jc{<
KXX+E
c!#"F
xgX"q
{,Es4
}GgoC
cfWfQ
./tx0e Y+
?F{J(
?92p;3
T!0x,
7#zMC
DO6k<C
k]U&V
6)#iz
igE_v
Z|$Ow
m[UO6
5z4Y-
*{6C&
6?Jea
V(,j$
x]8P~&
:F29Q
4%[7H
{rT{)
'u=nUk.
EwxY`
I/8Ubu
9RmuX
Vea{`
nk(V~
^y>aM
ePeB*
w(ig4A
gmUOVa
&TaeU
~E,d|
<Uw5F
6W'4q
eO>r'
/uFS>
;K^0?
4ehQyjK}d
pVt|O
R.ae=3
D&dbq
gp}ZC
;D??EG
u0.?}
UaI}TV7-
R?EegUVR
fq=a>~
qNEOd
j#n5W
cM"^(:
2OEO6
:dI|Mn}%U
YHVEC
(CDBO
62Rud
'eE_u
S/b{I\
\kLv|!u
_a6S$
p>M9F^-C
vmxjX
{HJq'
]r_y+
%O{0s
lQ.yV{pr
zUwWad
6w)ZE
UVVaa
L4<G-i
Vk6ns
W_>n9
Xj'3l
>lKuf
1~nu2
U]Y)qE
R6VnB
*QmN?N
oFC'g
#zd7E
j>4FM$
#V&Ndl
'N%mGS
d?I<C~
~HG/l=S'
y7Qad
>'yTk2
U?Ta6
nlI^%
~NQYX_
wjI<S
EymMaEoE
v~<@G
dTMm:^
KKzkUfU
2x5_O
/Kt^#
[{neV\sZG?
NhY^eR#_
jsi?sI=U
Z3%k'
{jcg_
mp57#:
<:+_f
p2M^~y
5mMnF'
Uv/[:
n;"n='
y_]80
QD|WtN
;Z-O~
WGrzU
UXX-)+,l
=][ea
W4n;YX_
t(nFB
Tte[DD
c!R.'~
6]y><
Q1Iag
]S#2#
7!Mo&
+sjUCj
,q^N\
r{Vq]
*ruT2
n'PZ3
0}*~6
vSzZ0
0n_b}oI
<emn"C
co-bs
X.Z=b
8&9[R6
b[_~Gu
)R^[}:Cj
!6pGO
[0uN(k
%^]|Y
F2_lF%z
vm=6$k
ObUfRaV
6cwuEO
y2~r[
T^"qt+G
$z5^s
kW3Nu
s{',T]
>'Y2d
Q=34~
VTmbG
P]2S?c\\
35Rr)
LVugm
-<PeF
^Sud7Dd
y?:b8st
lEv$hS
kHIL(
xT:sf
Jn]onoLd
iSEeR
]__t6
9a7e?w
'&VVY
KzqLg
u- F{2
%4_bK
j#FJ=
y[Nu'
*I]BK
)x&n& P~0z
OWN pD
6fMsu
=bM5s'n
Neco+
{0TaY
X]Wso]
%AboOsGSn
@OvcL
Xh;^^
Q\HlB7
5Lw~L
:RvTg
={Ied
,q+Ow
dj4G]
.WW/&
7GY5k
FgKS~^
;k`*w"
5j8Q,
T6Wa;
uh4$
r~*+u
cdyF3
M-*'X
+eJ7I
(\^We
h9|5w
sBa}'
9/)\Q
jlVYY
9=+`gr
bS9.\=A
=%Vaa
ELN8Kl
S5TfVeiM$.
:_/\@
1f*:?=
oKX9&
O}1PX
cq}$%
'mUO6N9W
IWuEG
Ke]?{
y9^5'
w&lf5
6TX]-
TasOX{1[
:*+x?
vJ!El
T%Cy_
^mYgb2
b/Qkpy*
n(qn`
./m?K
`:&c^
ymp{w
K]*P%F
-)eauJuD
En8]'
^g"vf
pw"&W
p%w$~
i1+-l
r5RuC
1k]I/<
y[TVTe5
%8Se9
n8OpT
ny0_lNf;
JF%+~
MaKP/
m'yh6
&t%>}g
m1Z/qT
:0f~96
?^Ov{x
f$:m%
0[{Yg8
}Rtg3_
"':}R
74s=(
kZWVt}
?4|Aq`*{
K^x36M
0idM<?
>Y>K"
R{N~J#
![x$m
5%{py
!VliNe
uuK&6w
g3Z<?
FXgGQ
bkruJ
O\:=:
.74je25
mrO|"o
cm.6`kU
VarMm
cG*qP
TS,kL
"wltY
?XYKC
Oc6J~
<s3)o
R66fM
XR9AnU:
UXXEW
phpi;
%Je|c
@~{>`
^C<+Fr
Qm{H]
~wyW~
VCcF?R
8Ty*E
Wee*d5`
P~kV$
^X(S^
ohi^H
2!?Weo
DK9Gr
aS[~4
+*+;N
BF}_A
9'6!t,
L`MH8
'Uen}
%^8?g+L
Ik2Cd}cWr
H~NIbA
jP~z#
5'Fmg
RugM3~J
Fy[U{
X;+ZK
'oq-&
-#oD1
}[3%p
"q&_)V
p'{iw^
,<O<cP
CJbEj
Uao_>W
.b^zO
M%xCK
H#L^H>
REg!anGx
r}U}7
MZ(lj
_bEfO/
N- !=
40Utf
4E^ie
~M9RC
PYVc~
qiD%\
&b3p'[V%
'N/Li
Aa^UV
~i_:7
o(m#9
1r}z66
h!uy!
uQtn
ggQAs)
(,kk+
"+Lmi
Wa^u&
VoU;\
Lka[x
vt)?{
]sDaK
=RE'v
P*j$c
uJ^!u
(LO^a
q40ba
ic6<i
KMm:unG
f7-%/
NTuU#6|
5'xN-Y
rls}f-
+[Naa
N-cz3
oSZizR
MGPgy5l
l=CII_
tUOvG
iOSugS
{DaD#
b-<:F0
*3kT4
hr5Lc
oM9Ya
b2]b.r
WuV]%
iUi3IV
zF^I'
w9lGCW
Oa5KC
3r"ZK
y}nfZ
s]Ot2G
+['Ma[
>X74G
t74%j
Y^9zj
o=Yc|R
,eVIg
/ccmJ
Q7``#
t* %N
FFaM"
v72fn
8nCFVgB
tUFV#^
Ti;3T
r.uk1
Gat;J
y3Daf
lDJR-
.2{F9
}M}7Yec
\G694
}3ul|
$v.:ErC
,Tud[
y7UVVs
'qlHw
hnv\J~F4
7lB(^
X|}%V.q
,!fO*~m
w_Yw3U
84Zl
u+4,cx`PB
j?e+7Z6E+Oa7
SwcKFn
&Q_aA
f%1tU
8"W=$
F(,w1
Q=&E?
5FN+
DV6aP
o9?Cv
"gFH<
mhYSa_
2cn[5
"tVk\
IDATo,
u=1;o
'vB?M
kKfVs
$gh3{
~z'j>
vduLf
G'0=y-
E?Vaw
/Xf>c
&xK['f
>u+92
X4(cb
@TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDACi6+l4AAAAAAAAAAOAAAiELAQgAABAAAAAGAAAAAAAAji8AAAAgAAAAQAAAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAAAAAgAAAAAAAAMAQIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAEQvAABKAAAAAEAAAJADAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAlA8AAAAgAAAAEAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAJADAAAAQAAAAAQAAAASAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAFgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAB0LwAAAAAAAEgAAAACAAUANCQAABALAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMwBQDRAAAAAQAAER8J/g/gOI0AAAAAOI0AAACOaR8Q2hfaF9aNEwAAATiAAAAAOIEAAAAfEDiAAAAAFjiAAAAAjmk4fwAAAAA4gwAAADiEAAAAjmkX2lQGGlgWVBssAysmAAcGGlhKjxMAAAEMCAhHAgYaWEofEF2RYdJSAAYaWAYaWEoX1lQGHlgGGlhKBkr+Ahb+AVIGHlhGLcUHDSsACSoKOG3///8COG3///8LOHr///8COHn///8HOHr///8HOHr///8oDwAACjh3////Bjh3////Bzh2////AAAAEzAGAFsBAAACAAARHxP+D+A4EwEAAAA4EwEAADgYAQAAOBkBAAA4GgEAADgbAQAAF9pUOB0BAAAaWBZUOLQAAAAAOBQBAAAeWDgTAQAAbxAAAAoX2lQGHwxYFlQrbwACBhpYSgYfDFhKbxEAAAoMFyyvBh8QWAgWFhYWKBIAAAooEwAAClIGHxBYRiwzAAcHbxQAAAoZjRMAAAElFhICKBUAAAqcJRcSAigWAAAKnCUYEgIoFwAACpxvGAAACgAAAAYfDFgGHwxYShfWVAYfEVgGHwxYSgYeWEr+Ahb+AVIGHxFYRjp0////AAYaWAYaWEoX1lQGHxJYBhpYSgZK/gIW/gFSBh8SWEY6Mv///wfQEwAAASgZAAAKbxoAAAp0AQAAGw0rAAkqCjjn/v//cxsAAAo44/7//ws44v7//wY44f7//wI44P7//28cAAAKONv+//8GON3+//8GOOb+//8COOf+//8AEzACAEwAAAADAAARACsecgEAAHArGisfKyQrKSsqKysrLHQDAAABKywrAAcqAyvfKB0AAAor3ygeAAAKK9pzHwAACivVCivUBivTAivSbyAAAAorzQsr0RMwAgBoAAAABAAAEQAg6IAAACsxABwsLCsyKzMrNCs5Kz4rQxYt7itBK0ILFi0UBygGAAAGDAgoBwAABiYWKCEAAAoAKigiAAAKK8gCK8sDK8ooAwAABivFKAIAAAYrwCgBAAAGK7sKK7oGK7woBQAABiu3EzAHADQAAAAFAAARACsaci0AAHAYF40BAAABJRYrEaIrESsWKwArFSooIwAACivfAivsKCQAAAor6Aor5wYr6BMwBAAjAAAABQAAEQArEHI3AABwGBQrCisPKwArDioCK+0oJAAACivvCivuBivvABMwBwA9AAAABQAAERUsJQAeLCEXLB4dLB0rHnJNAABwGBiNAQAAASUWFowkAAABoisKKw8rACsOKgIr3ygkAAAKK+8KK+4GK+8AAAAiAiglAAAKACoAAAAeAigmAAAKKkJTSkIBAAEAAAAAAAwAAAB2NC4wLjMwMzE5AAAAAAUAbAAAAKADAAAjfgAADAQAAKQEAAAjU3RyaW5ncwAAAACwCAAAXAAAACNVUwAMCQAAEAAAACNHVUlEAAAAHAkAAPQBAAAjQmxvYgAAAAAAAAACAAABRxUCCAkAAAAAEAAAAAAAAAEAAAAkAAAAAwAAAAkAAAAJAAAAJgAAAA8AAAAFAAAAAQAAAAEAAAADAAAAAAABAAEAAAAAAAYAPABDAAYAdgBDAAoAoACRAAYA+AAYAQYAOAEYAQYAVgFqARsAfQEAAAYAjAGjAQYAtQGjAQYA0gGjAQYA8QGjAQYACgKjAQYAIwKjAQYAPgKjAQYAWQJtAgYAjAJtAgYAmgKjAQYAtwLQAgYA6gJDAAYA7wJDAAYAAANDAAoABgORAAoAIAORAAYAPQNHAwYAggNHAwYAjgNDAAYApQNDAAYAyQNDAAYA1wOjAQYA8QMBBAYAHARDAAYALQQ0BAYASwRDAA4AfQRnBA4AlARnBAYAnQRDAAAAAAAfAAAAAAABAAEAAQAQACgAEgAFAAEAAQABAQAASgBdAAkAAQAJAFAgAAAAAJEAgAAKAAEAMCEAAAAAkQCLABoAAgCYIgAAAACWAKkAIQADAPAiAAAAAJYAtwAoAAUAZCMAAAAAkQDPAC4ABwCkIwAAAACRAN4ANAAIANQjAAAAAJEA6gA0AAkAICQAAAAAhhjyADkACgAsJAAAAAAGGPIAPQAKAAAAAQCIAAAAAQCnAAAAAQCxAAAAAgC0AAAAAQDBAAAAAgDMAAAAAQDcAAAAAQDnAAAAAQDvACEA8gBCACkA8gA5ADEA8gBvAEEA8gA9AEkA8gA9AFEA8gA9AFkA8gA9AGEA8gA9AGkA8gA9AHEA8gA9AHkA8gCuAIEA8gA9AIkA8gA9AJEA8gA9AKEA9gJbAbEADANxARkAFwN1AbkAJgN8AbkALwOFAcEAWgNxAbkAZAONAbkAagONAbkAcAONAcEAdgORAdEAkwOYAcEAtwOfAcEA8gA5ALEAvwNxAeEA0AO0AekA4AO6AfEA8gC/AfEAEgTGAfkAKATSAQEBRQTSAQkBVQTeAREBiQTkAQkA8gA5ABEA8gA5AC4ACwBHAC4AEwBQAC4AGwB1AC4AIwB+AC4AKwCQAC4AMwCQAC4AOwCQAC4AQwB+AC4ASwCWAC4AUwCQAC4AWwCQAC4AYwCzAC4AawDdAC4AcwDqAC4ASgAyAWYBqQHLAdcB7wGmAQAAAAABAAAAAAAAAAAAAAAAABIAAAAEAAAAAAAAAAAAAAABADMAAAAAAAQAAAAAAAAAAAAAABEAkQAAAAAACgAAAAAAAAAAAAAAEQBnBAAAAAAAQU1EX0lzb3RvcGVzLmRsbABBTURfSXNvdG9wZXMAPE1vZHVsZT4AUHJvY2Vzc29ycwBtc2NvcmxpYgBPYmplY3QAU3lzdGVtAFBvd2VyZWRCeUF0dHJpYnV0ZQBTbWFydEFzc2VtYmx5LkF0dHJpYnV0ZXMAQXR0cmlidXRlAFhBWENBU0QAYzUASU1NTU0AU3lzdGVtLkRyYXdpbmcAQml0bWFwAEIAWEFYQVhBWABtbQB4eABTdGFydEdhbWUAQ1NDU0NWRFdERABFUQBXREZFR0dFR0VHR0UAYwBTQVNBU0ZXRgBCSABWUlZWAEtKAC5jdG9yAENvbXBpbGF0aW9uUmVsYXhhdGlvbnNBdHRyaWJ1dGUAU3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcwBSdW50aW1lQ29tcGF0aWJpbGl0eUF0dHJpYnV0ZQBEZWJ1Z2dhYmxlQXR0cmlidXRlAFN5c3RlbS5EaWFnbm9zdGljcwBEZWJ1Z2dpbmdNb2RlcwBBc3NlbWJseVRpdGxlQXR0cmlidXRlAFN5c3RlbS5SZWZsZWN0aW9uAEFzc2VtYmx5RGVzY3JpcHRpb25BdHRyaWJ1dGUAQXNzZW1ibHlDb25maWd1cmF0aW9uQXR0cmlidXRlAEFzc2VtYmx5Q29tcGFueUF0dHJpYnV0ZQBBc3NlbWJseVByb2R1Y3RBdHRyaWJ1dGUAQXNzZW1ibHlDb3B5cmlnaHRBdHRyaWJ1dGUAQXNzZW1ibHlUcmFkZW1hcmtBdHRyaWJ1dGUAQ29tVmlzaWJsZUF0dHJpYnV0ZQBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMAR3VpZEF0dHJpYnV0ZQBBc3NlbWJseUZpbGVWZXJzaW9uQXR0cmlidXRlAFRhcmdldEZyYW1ld29ya0F0dHJpYnV0ZQBTeXN0ZW0uUnVudGltZS5WZXJzaW9uaW5nAEJ5dGUAQnVmZmVyAEJsb2NrQ29weQBBcnJheQBJbWFnZQBnZXRfSGVpZ2h0AEdldFBpeGVsAENvbG9yAEZyb21BcmdiAG9wX0luZXF1YWxpdHkAQXJyYXlMaXN0AFN5c3RlbS5Db2xsZWN0aW9ucwBnZXRfQ291bnQAZ2V0X1IAZ2V0X0cAZ2V0X0IASW5zZXJ0UmFuZ2UASUNvbGxlY3Rpb24AVHlwZQBHZXRUeXBlRnJvbUhhbmRsZQBSdW50aW1lVHlwZUhhbmRsZQBUb0FycmF5AGdldF9XaWR0aABTdHJpbmcAQ29uY2F0AEFzc2VtYmx5AEdldEVudHJ5QXNzZW1ibHkAUmVzb3VyY2VNYW5hZ2VyAFN5c3RlbS5SZXNvdXJjZXMAR2V0T2JqZWN0AEVudmlyb25tZW50AEV4aXQAVGhyZWFkAFN5c3RlbS5UaHJlYWRpbmcAU2xlZXAAQXBwRG9tYWluAGdldF9DdXJyZW50RG9tYWluAE1pY3Jvc29mdC5WaXN1YWxCYXNpYwBJbnRlcmFjdGlvbgBDYWxsQnlOYW1lAENhbGxUeXBlAEludDMyAAAAKy4AUAByAG8AcABlAHIAdABpAGUAcwAuAFIAZQBzAG8AdQByAGMAZQBzAAAJTABvAGEAZAAAFUUAbgB0AHIAeQBQAG8AaQBuAHQAAA1JAG4AdgBvAGsAZQAAAE6N49+kRK9GiPDpaI83z98ACLd6XFYZNOCJBgABHQUdBQiwP19/EdUKOgYAAR0FEg0GAAISDQ4OBQACAQ4OBQABHB0FBAABHBwDIAABBCABAQ4EIAEBCAgBAAgAAAAAAB4BAAEAVAIWV3JhcE5vbkV4Y2VwdGlvblRocm93cwEFIAEBER0IAQAHAQAAAAARAQAMQU1EX0lzb3RvcGVzAAAFAQAAAAAXAQASQ29weXJpZ2h0IMKpICAyMDIwAAAEIAEBAikBACRiNmM0YzIyOS0wODhiLTQzYTYtYTIwMi1kZjY1OGFlNDg4ZGIAAAwBAAcxLjAuMC4wAABHAQAaLk5FVEZyYW1ld29yayxWZXJzaW9uPXY0LjABAFQOFEZyYW1ld29ya0Rpc3BsYXlOYW1lEC5ORVQgRnJhbWV3b3JrIDQoAQAjUG93ZXJlZCBieSBTbWFydEFzc2VtYmx5IDcuMy4wLjMyOTYAAAoABQESVQgSVQgICgcEDwEdBRAFHQUDIAAIBiACEV0ICAgABBFdCAgICAcAAgIRXRFdAyAABQYgAgEIEmUGAAESaRFtBiABElUSaQIdBQoHBA8BEmERXR0FBQACDg4OBAAAEnUGIAIBDhJ1BCABHA4GBwISeRINBAABAQgGBwMdBRwcBQAAEoCFCgAEHBwOEYCNHRwDBwEcAGwvAAAAAAAAAAAAAIIvAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB0LwAAAAAAAAAAX0NvckRsbE1haW4AbXNjb3JlZS5kbGwA/yUAIEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABABAAAAAYAACAAAAAAAAAAAAAAAAAAAABAAEAAAAwAACAAAAAAAAAAAAAAAAAAAABAAAAAABIAAAAVEAAADwDAAAAAAAAPAM0AAAAVgBTAF8AVgBFAFIAUwBJAE8ATgBfAEkATgBGAE8AAAAAAL0E7/4AAAEAAAABAAAAAAAAAAEAAAAAAD8AAAAAAAAABAAAAAIAAAAAAAAAAAAAAAAAAABEAAAAAQBWAGEAcgBGAGkAbABlAEkAbgBmAG8AAAAAACQABAAAAFQAcgBhAG4AcwBsAGEAdABpAG8AbgAAAAAAAACwBJwCAAABAFMAdAByAGkAbgBnAEYAaQBsAGUASQBuAGYAbwAAAHgCAAABADAAMAAwADAAMAA0AGIAMAAAABoAAQABAEMAbwBtAG0AZQBuAHQAcwAAAAAAAAAiAAEAAQBDAG8AbQBwAGEAbgB5AE4AYQBtAGUAAAAAAAAAAABCAA0AAQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAAAAQQBNAEQAXwBJAHMAbwB0AG8AcABlAHMAAAAAADAACAABAEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAAMQAuADAALgAwAC4AMAAAAEIAEQABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAAQQBNAEQAXwBJAHMAbwB0AG8AcABlAHMALgBkAGwAbAAAAAAASAASAAEATABlAGcAYQBsAEMAbwBwAHkAcgBpAGcAaAB0AAAAQwBvAHAAeQByAGkAZwBoAHQAIACpACAAIAAyADAAMgAwAAAAKgABAAEATABlAGcAYQBsAFQAcgBhAGQAZQBtAGEAcgBrAHMAAAAAAAAAAABKABEAAQBPAHIAaQBnAGkAbgBhAGwARgBpAGwAZQBuAGEAbQBlAAAAQQBNAEQAXwBJAHMAbwB0AG8AcABlAHMALgBkAGwAbAAAAAAAOgANAAEAUAByAG8AZAB1AGMAdABOAGEAbQBlAAAAAABBAE0ARABfAEkAcwBvAHQAbwBwAGUAcwAAAAAANAAIAAEAUAByAG8AZAB1AGMAdABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAADgACAABAEEAcwBzAGUAbQBiAGwAeQAgAFYAZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAMAAAAkD8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
C:\Users\Administrator\Desktop\Client\Temp\odFPckgUuk\src\obj\Debug\NNnBUpqoQehfI.pdb
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
U-5=EMU]dk
Fries
These are some fries
ner Pizza
Turkish Pizza
This is a turkish pizza
Vega Burger
This is a vegetarian hamburger
Double Cheeseburger
This is a double cheeseburger
Grilled Salmon
This is a grilled salmon
cbMenus
label1
Menu:
btnAddMenu
lstOrder
btnClearMenus
Clear
btnRemoveMenu
Remove
label2
Totalprice:
lblTotalPrice
OrderForm
leTJAGIErIXRAtjdeYKbv
AMD_Isotopes.Processors
StartGame
WinformsSandbox
Form1
Group of Groups!
WinformsSandbox.Properties.Resources
unify4
DataSource
GroupsBindingList
SelectedGroupBindingList
SelectedGroupDataGrid
PersonName
GroupsDataGrid
GroupName
Group Name
Roboto
GroupsView
Groups
{Random Group:
Leonor Halberg
Emil Hardin
Fredda Tardif
Regenia Kearley
Antonietta Batie
Rikki Melnyk
Claire Younger
Mindy Smale
Fredricka Vining
Maribeth Corum
Dagmar Paulson
Ariane Rexroat
Kristyn Drakeford
Susan Debose
Marisol Felter
Lenore Costner
Mitch Tremblay
Madie Penn
Eduardo Gloster
Ardella Bongiorno
Gertude Sherburne
Basilia Leger
Brianna Fleener
Kristian Langlois
Billi Torgerson
Tawnya Berenbaum
Ma Fritze
Lilly Ketchum
Lourie Snook
Brice Spece
Zenia Wilke
Leland Mccaslin
Sanjuanita Slemp
Elwanda Nasser
Melody Cockerham
Roseann Mcgillis
Jesse Sheffield
Lavona Dolloff
Raisa Holst
Regan Schoenberg
Gearldine Pettry
Ilene Mahr
Mitchell Rethman
Britney Riddell
Signe Shuman
Valery Solie
Sherril Portwood
Moshe Lirette
Renata Rael
Jefferey Brendel
Vallie Eidt
Nadia Wine
Neomi Mole
Jannette Gambrell
Tomika Graeber
Ricki Purdom
Martine Tetrault
Dorotha Dashiell
Shaunda Demko
Nereida Chisum
Joy Besaw
Bernardine Winebrenner
Omega Segawa
Patrina Morones
Buddy Sowell
Mahalia Landrum
Fleta Luft
Helen Le
Darlene Borton
Lai Lamont
Winona Lapan
Annie Romero
Samantha Crone
Tamela Weatherwax
Denyse Bosket
Margurite Estabrook
Sebastian Hassell
Joshua Brittingham
Clay Hudspeth
Loriann Burditt
Keshia Poplawski
Karissa Paugh
Annamarie Drees
Tifany Johnosn
Essie Critchfield
Eleanore Bradeen
Deidre Chauez
Santo Limbaugh
Fermina Spinelli
Deonna Higby
Ute Fouts
Joesph Speno
Timothy Fritz
Irene Houze
Brock Lambright
Buffy Claybrooks
Jarod Hofstetter
Holley Mousseau
Bettye Soderberg
Tammera Strebel
Editing
Please, put price in correct format!
Please, fill in all fields!!!
groupBoxButtons
Microsoft Sans Serif
buttonCancel
Cancel
buttonSave
Adding Products:
textBoxSku
labelSku
SKU Number
labelCategory
Category
textBoxCategory
labelTM
Trade Mark
textBoxTM
labelPrName
Product Name
textBoxPrName
labelSupplier
Supplier
textBoxSupplier
labelPrice
Price, UAH
textBoxPrice
labelStoreUn
Storage Unite
textBoxStoreUn
labelProductDetails
Product Details
textBoxProductDetails
AddEditForm
Adding product
Product Editing:
dataGridView1
buttonAdd
Add Product
buttonEdit
Edit Product
button3
Delete Product
groupBox1
buttonExit
EditDeleteAddForm
Products Amending
buttonShow
Show products
buttonAmend
Amend Products
Arial Narrow
labelProducts
Products
labelCatalogue
Catalogue
MainForm
ProductsDirectory.xml
SKU Number =
, Category =
, Trade Mark =
,Product Name =
, Product Details =
, Supplier =
Price = {0}, Storage Unit = {1}
ShowForm
Show Products
leTJAGIErIXRAtjdeYKbv
unify4
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
Winform Sandbox
FileVersion
1.98.4.0
InternalName
NNnBUpqoQehfI.exe
LegalCopyright
Copyright
2017 - 2020
LegalTrademarks
OriginalFilename
NNnBUpqoQehfI.exe
ProductName
Winform Sandbox
ProductVersion
1.98.4.0
Assembly Version
1.98.4.0
No antivirus signatures available.
Sorry! No behavior.

Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
Y 1.1.1.1 [VT] Australia

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.1.4 49430 1.1.1.1 53
192.168.1.4 49766 1.1.1.1 53
192.168.1.4 51228 1.1.1.1 53
192.168.1.4 51819 1.1.1.1 53
192.168.1.4 52623 1.1.1.1 53
192.168.1.4 59326 1.1.1.1 53
192.168.1.4 60879 1.1.1.1 53
192.168.1.4 62350 1.1.1.1 53
192.168.1.4 64113 1.1.1.1 53
192.168.1.4 137 192.168.1.255 137
192.168.1.4 49430 8.8.8.8 53
192.168.1.4 49766 8.8.8.8 53
192.168.1.4 51819 8.8.8.8 53
192.168.1.4 52623 8.8.8.8 53
192.168.1.4 59326 8.8.8.8 53
192.168.1.4 60879 8.8.8.8 53
192.168.1.4 64113 8.8.8.8 53

DNS

No domains contacted.

HTTP Requests

No HTTP requests performed.

SMTP traffic

No SMTP traffic performed.

IRC traffic

No IRC requests performed.

ICMP traffic

No ICMP traffic performed.

CIF Results

No CIF Results

Suricata Alerts

Timestamp Source IP Source Port Destination IP Destination Port Protocol GID SID REV Signature Category Severity
2020-06-30 13:51:50.192 192.168.1.4 [VT] 49177 13.107.42.23 [VT] 443 TCP 1 2028397 2 ET JA3 Hash - Possible Malware - Various Malspam/RigEK Unknown Traffic 3

Suricata TLS

Timestamp Source IP Source Port Destination IP Destination Port Subject Issuer Fingerprint Version
2020-06-30 13:51:50.227 192.168.1.4 [VT] 49177 13.107.42.23 [VT] 443 CN=edge.skype.com 5c:3b:53:ee:b8:65:a3:2a:66:d4:04:36:67:98:af:88:8d:96:5d:74 TLS 1.2

Suricata HTTP

No Suricata HTTP

Sorry! No dropped Suricata Extracted files.

JA3

Source Source Port Destination Destination Port JA3 Hash JA3 Description
192.168.1.4 49177 13.107.42.23 443 3b483d0b34894548b602e8d18cdc24c5 unknown
Sorry! No dropped files.
Sorry! No CAPE files.
Process Name Preform Invoice.exe
PID 4560
Dump Size 284672 bytes
Module Path C:\Users\Rebecca\AppData\Local\Temp\Preform Invoice.exe
Type PE image: 32-bit executable
PE timestamp 2020-06-26 09:15:14
MD5 d3b6f4bf26efef51c5db0a3324892b8c
SHA1 bfb67c8208fe3016b1d9b94cfab23a276cef6734
SHA256 b38bc190950eec23130cd21b2506cd5b09016bf0abb39594e9a60a1671b6f3d1
CRC32 B751CC12
Ssdeep 6144:Xz/dvXVARE/p8SIAW8X25xGRWe+t8e2+z+RaWIQJ:X7dKExyAWm2jG382S+RN
CAPE Yara
  • AgentTeslaV2 Payload - Author: ditekshen
Dump Filename b38bc190950eec23130cd21b2506cd5b09016bf0abb39594e9a60a1671b6f3d1
Download Download Zip

BinGraph Download graph

Process Name taskeng.exe
PID 5196
Dump Size 191488 bytes
Module Path C:\Windows\System32\taskeng.exe
Type PE image: 32-bit executable
PE timestamp 2010-11-20 09:18:25
MD5 d68ff3aa25d85d57a771133be981e5e4
SHA1 17743079a122433cf46bb4127fb7ebc065ec361d
SHA256 41479f5f5308498ea29983ff78b2b6894202b6cb96eae48e0cf5f0ced3f60b1f
CRC32 F4B70EF5
Ssdeep 3072:pPO1cPy+YgkHGqLuKn8y6bNtPVoXZ+AFS5q9C4hvs1B:QKRPyitP+XZXFNCjB
Dump Filename 41479f5f5308498ea29983ff78b2b6894202b6cb96eae48e0cf5f0ced3f60b1f
Download Download Zip

BinGraph Download graph

Process Name schtasks.exe
PID 4384
Dump Size 177152 bytes
Module Path C:\Windows\System32\schtasks.exe
Type PE image: 32-bit executable
PE timestamp 2010-11-20 09:20:03
MD5 9eed5a70422f410f1e3625805187e693
SHA1 fbfe44c5ae38e1fb6cce4e6c59bb75b8aeb86c10
SHA256 5bd00d6e020cae19a8b45318caecd59da27ad7e2d2016b9726f7d5b705ca12a7
CRC32 983701F7
Ssdeep 3072:R7hc2V0e29VxIGB6+QhXTct3cUK2qtDLfogS3moe4eGBGATCx:Rlc2V0DfRe6sF28fofGAm
Dump Filename 5bd00d6e020cae19a8b45318caecd59da27ad7e2d2016b9726f7d5b705ca12a7
Download Download Zip

BinGraph Download graph

Process Name GoogleUpdate.exe
PID 5096
Dump Size 144384 bytes
Module Path C:\Program Files\Google\Update\GoogleUpdate.exe
Type PE image: 32-bit executable
PE timestamp 2020-03-02 23:22:03
MD5 60222cca99b320230ea4900c27b8f041
SHA1 da68eb9913c85113ab80867b4e2ed85721a5b74e
SHA256 6bb0e88ad970e7ff82d61014be38f79db7e4eb8c7749748ff19c718a382cf79c
CRC32 FFE2CE56
Ssdeep 3072:QQdi5uyn5grX+yruTmjyaFPd2AtB+llojrWTMK12XdjWtVAlR8yVciqFltCT3VmB:uniruyzQsB+F
Dump Filename 6bb0e88ad970e7ff82d61014be38f79db7e4eb8c7749748ff19c718a382cf79c
Download Download Zip

BinGraph Download graph

Process Name svchost.exe
PID 836
Dump Size 20992 bytes
Module Path C:\Windows\System32\svchost.exe
Type PE image: 32-bit executable
PE timestamp 2009-07-13 23:19:28
MD5 170c8f74516c67647c3609979a4f3db3
SHA1 fe6472091b141272481dbf83e903f22f817a12cc
SHA256 ca47c990cf333bb490d479de8b3e934adf7405ef3bd29492350059b314a883c6
CRC32 92383454
Ssdeep 384:Ydnfo6z/o4+KzP7Numa2rVYYj0q0/W+lFUOLg2JUaW9C5bW9odW:GQMpDTFGYEe+lFbUaw
Dump Filename ca47c990cf333bb490d479de8b3e934adf7405ef3bd29492350059b314a883c6
Download Download Zip

BinGraph Download graph

JSON Report Download
Defense Evasion Privilege Escalation Execution Persistence
  • T1116 - Code Signing
    • Signature - invalid_authenticode_signature
  • T1055 - Process Injection
    • Signature - InjectionInterProcess
  • T1045 - Software Packing
    • Signature - packer_entropy
  • T1055 - Process Injection
    • Signature - InjectionInterProcess
  • T1053 - Scheduled Task
    • Signature - uses_windows_utilities_to_create_scheduled_task
  • T1053 - Scheduled Task
    • Signature - uses_windows_utilities_to_create_scheduled_task
  • T1053 - Scheduled Task
    • Signature - uses_windows_utilities_to_create_scheduled_task

    Processing ( 20.214000000000002 seconds )

    • 12.811 BehaviorAnalysis
    • 5.276 Suricata
    • 0.593 Static
    • 0.47 CAPE
    • 0.329 NetworkAnalysis
    • 0.252 static_dotnet
    • 0.161 VirusTotal
    • 0.11 ProcDump
    • 0.055 AnalysisInfo
    • 0.051 TargetInfo
    • 0.048 Dropped
    • 0.033 Deduplicate
    • 0.012 Strings
    • 0.007 peid
    • 0.006 Debug

    Signatures ( 1.3229999999999975 seconds )

    • 0.258 antiav_detectreg
    • 0.062 infostealer_ftp
    • 0.054 antianalysis_detectreg
    • 0.052 antiav_detectfile
    • 0.048 territorial_disputes_sigs
    • 0.043 stealth_timeout
    • 0.036 decoy_document
    • 0.035 api_spamming
    • 0.033 infostealer_im
    • 0.031 antianalysis_detectfile
    • 0.03 lsass_credential_dumping
    • 0.029 NewtWire Behavior
    • 0.029 antivm_vbox_keys
    • 0.028 Doppelganging
    • 0.023 InjectionCreateRemoteThread
    • 0.023 injection_createremotethread
    • 0.023 masquerade_process_name
    • 0.021 antivm_vbox_files
    • 0.015 InjectionInterProcess
    • 0.014 antivm_parallels_keys
    • 0.014 infostealer_bitcoin
    • 0.014 ransomware_files
    • 0.012 antivm_generic_disk
    • 0.012 injection_explorer
    • 0.012 infostealer_mail
    • 0.011 Locky_behavior
    • 0.01 mimics_filetime
    • 0.01 virus
    • 0.01 antivm_vmware_keys
    • 0.009 dynamic_function_loading
    • 0.009 kibex_behavior
    • 0.009 persistence_autorun
    • 0.009 antidbg_devices
    • 0.009 antivm_generic_diskreg
    • 0.009 ransomware_extensions
    • 0.008 Unpacker
    • 0.008 antiemu_wine_func
    • 0.008 betabot_behavior
    • 0.008 bootkit
    • 0.008 exec_crash
    • 0.008 malicious_dynamic_function_loading
    • 0.008 reads_self
    • 0.008 stealth_file
    • 0.007 antivm_xen_keys
    • 0.006 antidbg_windows
    • 0.006 guloader_apis
    • 0.006 hancitor_behavior
    • 0.006 infostealer_browser_password
    • 0.006 kovter_behavior
    • 0.006 network_tor
    • 0.006 geodo_banking_trojan
    • 0.005 antidebug_guardpages
    • 0.005 antivm_generic_scsi
    • 0.005 antivm_vbox_libs
    • 0.005 shifu_behavior
    • 0.005 antivm_vpc_keys
    • 0.005 predatorthethief_files
    • 0.005 qulab_files
    • 0.004 exploit_getbasekerneladdress
    • 0.004 exploit_heapspray
    • 0.004 hawkeye_behavior
    • 0.004 injection_runpe
    • 0.004 kazybot_behavior
    • 0.004 vawtrak_behavior
    • 0.004 antivm_xen_keys
    • 0.004 antivm_hyperv_keys
    • 0.004 antivm_vbox_devices
    • 0.003 InjectionProcessHollowing
    • 0.003 antivm_generic_services
    • 0.003 encrypted_ioc
    • 0.003 exploit_gethaldispatchtable
    • 0.003 OrcusRAT Behavior
    • 0.003 antivm_vmware_files
    • 0.003 browser_security
    • 0.002 antiav_avast_libs
    • 0.002 antisandbox_sunbelt_libs
    • 0.002 dyre_behavior
    • 0.002 infostealer_browser
    • 0.002 blackrat_registry_keys
    • 0.002 stack_pivot
    • 0.002 tinba_behavior
    • 0.002 antisandbox_fortinet_files
    • 0.002 antisandbox_threattrack_files
    • 0.002 antivm_generic_bios
    • 0.002 antivm_generic_system
    • 0.002 ketrican_regkeys
    • 0.002 bypass_firewall
    • 0.002 disables_browser_warn
    • 0.002 masslogger_files
    • 0.002 limerat_regkeys
    • 0.001 InjectionSetWindowLong
    • 0.001 PlugX
    • 0.001 antiav_bitdefender_libs
    • 0.001 antiav_bullgaurd_libs
    • 0.001 antiav_emsisoft_libs
    • 0.001 antiav_qurb_libs
    • 0.001 antiav_apioverride_libs
    • 0.001 antiav_nthookengine_libs
    • 0.001 antisandbox_sboxie_libs
    • 0.001 antivm_vmware_libs
    • 0.001 cerber_behavior
    • 0.001 office_com_load
    • 0.001 office_vb_load
    • 0.001 persistence_autorun_tasks
    • 0.001 ransomware_message
    • 0.001 rat_nanocore
    • 0.001 recon_programs
    • 0.001 antisandbox_cuckoo_files
    • 0.001 antisandbox_joe_anubis_files
    • 0.001 antisandbox_sunbelt_files
    • 0.001 antivm_generic_cpu
    • 0.001 browser_addon
    • 0.001 modify_proxy
    • 0.001 codelux_behavior
    • 0.001 darkcomet_regkeys
    • 0.001 disables_system_restore
    • 0.001 azorult_mutexes
    • 0.001 modify_uac_prompt
    • 0.001 medusalocker_regkeys
    • 0.001 revil_mutexes
    • 0.001 modirat_bheavior
    • 0.001 obliquerat_files
    • 0.001 rat_pcclient
    • 0.001 warzonerat_regkeys
    • 0.001 recon_fingerprint
    • 0.001 remcos_regkeys
    • 0.001 sniffer_winpcap
    • 0.001 tampers_etw
    • 0.001 targeted_flame
    • 0.001 lokibot_mutexes

    Reporting ( 22.023 seconds )

    • 18.022 BinGraph
    • 3.926 JsonDump
    • 0.067 MITRE_TTPS
    • 0.008 PCAP2CERT