Detections

Yara:

AgentTeslaV2

Auto Tasks

#17831: Unpacker

Analysis

Category Package Started Completed Duration Options Log
FILE exe 2020-06-30 13:59:01 2020-06-30 14:06:14 433 seconds Show Options Show Log
route = tor
2020-05-13 09:26:16,524 [root] INFO: Date set to: 20200630T13:51:55, timeout set to: 200
2020-06-30 13:51:55,062 [root] DEBUG: Starting analyzer from: C:\tmp2ssujfce
2020-06-30 13:51:55,062 [root] DEBUG: Storing results at: C:\HoAjDTuPwn
2020-06-30 13:51:55,062 [root] DEBUG: Pipe server name: \\.\PIPE\zqHlkSfV
2020-06-30 13:51:55,062 [root] DEBUG: Python path: C:\Users\Louise\AppData\Local\Programs\Python\Python38-32
2020-06-30 13:51:55,078 [root] DEBUG: No analysis package specified, trying to detect it automagically.
2020-06-30 13:51:55,078 [root] INFO: Automatically selected analysis package "exe"
2020-06-30 13:51:55,078 [root] DEBUG: Trying to import analysis package "exe"...
2020-06-30 13:51:55,249 [root] DEBUG: Imported analysis package "exe".
2020-06-30 13:51:55,249 [root] DEBUG: Trying to initialize analysis package "exe"...
2020-06-30 13:51:55,249 [root] DEBUG: Initialized analysis package "exe".
2020-06-30 13:51:55,781 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.browser"...
2020-06-30 13:51:55,875 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser".
2020-06-30 13:51:55,875 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.curtain"...
2020-06-30 13:51:56,203 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain".
2020-06-30 13:51:56,203 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.digisig"...
2020-06-30 13:51:56,328 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig".
2020-06-30 13:51:56,328 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.disguise"...
2020-06-30 13:51:56,421 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise".
2020-06-30 13:51:56,421 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.human"...
2020-06-30 13:51:57,437 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human".
2020-06-30 13:51:57,437 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.procmon"...
2020-06-30 13:51:57,437 [root] DEBUG: Imported auxiliary module "modules.auxiliary.procmon".
2020-06-30 13:51:57,437 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.screenshots"...
2020-06-30 13:51:57,515 [modules.auxiliary.screenshots] DEBUG: Importing 'time'
2020-06-30 13:51:57,515 [modules.auxiliary.screenshots] DEBUG: Importing 'StringIO'
2020-06-30 13:51:57,515 [modules.auxiliary.screenshots] DEBUG: Importing 'Thread'
2020-06-30 13:51:57,515 [modules.auxiliary.screenshots] DEBUG: Importing 'Auxiliary'
2020-06-30 13:51:57,515 [modules.auxiliary.screenshots] DEBUG: Importing 'NetlogFile'
2020-06-30 13:51:57,515 [modules.auxiliary.screenshots] DEBUG: Importing 'Screenshot'
2020-06-30 13:51:57,515 [lib.api.screenshot] DEBUG: Importing 'math'
2020-06-30 13:51:57,515 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2020-06-30 13:52:05,375 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2020-06-30 13:52:05,531 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2020-06-30 13:52:06,000 [modules.auxiliary.screenshots] DEBUG: Imports OK
2020-06-30 13:52:06,000 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots".
2020-06-30 13:52:06,000 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.sysmon"...
2020-06-30 13:52:06,000 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon".
2020-06-30 13:52:06,000 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.usage"...
2020-06-30 13:52:06,062 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage".
2020-06-30 13:52:06,062 [root] DEBUG: Trying to initialize auxiliary module "Browser"...
2020-06-30 13:52:06,062 [root] DEBUG: Initialized auxiliary module "Browser".
2020-06-30 13:52:06,062 [root] DEBUG: Trying to start auxiliary module "Browser"...
2020-06-30 13:52:06,062 [root] DEBUG: Started auxiliary module Browser
2020-06-30 13:52:06,062 [root] DEBUG: Trying to initialize auxiliary module "Curtain"...
2020-06-30 13:52:06,062 [root] DEBUG: Initialized auxiliary module "Curtain".
2020-06-30 13:52:06,062 [root] DEBUG: Trying to start auxiliary module "Curtain"...
2020-06-30 13:52:06,062 [root] DEBUG: Started auxiliary module Curtain
2020-06-30 13:52:06,062 [root] DEBUG: Trying to initialize auxiliary module "DigiSig"...
2020-06-30 13:52:06,062 [root] DEBUG: Initialized auxiliary module "DigiSig".
2020-06-30 13:52:06,062 [root] DEBUG: Trying to start auxiliary module "DigiSig"...
2020-06-30 13:52:06,078 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature.
2020-06-30 13:52:07,593 [modules.auxiliary.digisig] DEBUG: File is not signed.
2020-06-30 13:52:07,593 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2020-06-30 13:52:07,609 [root] DEBUG: Started auxiliary module DigiSig
2020-06-30 13:52:07,609 [root] DEBUG: Trying to initialize auxiliary module "Disguise"...
2020-06-30 13:52:07,609 [root] DEBUG: Initialized auxiliary module "Disguise".
2020-06-30 13:52:07,609 [root] DEBUG: Trying to start auxiliary module "Disguise"...
2020-06-30 13:52:07,625 [root] DEBUG: Started auxiliary module Disguise
2020-06-30 13:52:07,625 [root] DEBUG: Trying to initialize auxiliary module "Human"...
2020-06-30 13:52:07,625 [root] DEBUG: Initialized auxiliary module "Human".
2020-06-30 13:52:07,625 [root] DEBUG: Trying to start auxiliary module "Human"...
2020-06-30 13:52:07,625 [root] DEBUG: Started auxiliary module Human
2020-06-30 13:52:07,625 [root] DEBUG: Trying to initialize auxiliary module "Procmon"...
2020-06-30 13:52:07,625 [root] DEBUG: Initialized auxiliary module "Procmon".
2020-06-30 13:52:07,625 [root] DEBUG: Trying to start auxiliary module "Procmon"...
2020-06-30 13:52:07,640 [root] DEBUG: Started auxiliary module Procmon
2020-06-30 13:52:07,640 [root] DEBUG: Trying to initialize auxiliary module "Screenshots"...
2020-06-30 13:52:07,640 [root] DEBUG: Initialized auxiliary module "Screenshots".
2020-06-30 13:52:07,640 [root] DEBUG: Trying to start auxiliary module "Screenshots"...
2020-06-30 13:52:07,640 [root] DEBUG: Started auxiliary module Screenshots
2020-06-30 13:52:07,640 [root] DEBUG: Trying to initialize auxiliary module "Sysmon"...
2020-06-30 13:52:07,640 [root] DEBUG: Initialized auxiliary module "Sysmon".
2020-06-30 13:52:07,640 [root] DEBUG: Trying to start auxiliary module "Sysmon"...
2020-06-30 13:52:07,640 [root] DEBUG: Started auxiliary module Sysmon
2020-06-30 13:52:07,640 [root] DEBUG: Trying to initialize auxiliary module "Usage"...
2020-06-30 13:52:07,640 [root] DEBUG: Initialized auxiliary module "Usage".
2020-06-30 13:52:07,640 [root] DEBUG: Trying to start auxiliary module "Usage"...
2020-06-30 13:52:07,640 [root] DEBUG: Started auxiliary module Usage
2020-06-30 13:52:07,640 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL option
2020-06-30 13:52:07,640 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL_64 option
2020-06-30 13:52:07,656 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option
2020-06-30 13:52:07,656 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option
2020-06-30 13:52:07,687 [lib.api.process] INFO: Successfully executed process from path "C:\Users\Louise\AppData\Local\Temp\942XyvI5QYgF.exe" with arguments "" with pid 3464
2020-06-30 13:52:07,687 [lib.api.process] INFO: Monitor config for process 3464: C:\tmp2ssujfce\dll\3464.ini
2020-06-30 13:52:07,750 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ssujfce\dll\wIjmAvV.dll, loader C:\tmp2ssujfce\bin\oRbUDSH.exe
2020-06-30 13:52:07,921 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\zqHlkSfV.
2020-06-30 13:52:07,921 [root] DEBUG: Loader: Injecting process 3464 (thread 3000) with C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:07,921 [root] DEBUG: Process image base: 0x00EF0000
2020-06-30 13:52:07,937 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 13:52:07,937 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 13:52:07,937 [root] DEBUG: Successfully injected DLL C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:07,937 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3464
2020-06-30 13:52:09,937 [lib.api.process] INFO: Successfully resumed process with pid 3464
2020-06-30 13:52:09,968 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:52:09,968 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 13:52:09,968 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 3464 at 0x70380000, image base 0xef0000, stack from 0x3c5000-0x3d0000
2020-06-30 13:52:09,968 [root] DEBUG: Commandline: C:\Users\Louise\AppData\Local\Temp\"C:\Users\Louise\AppData\Local\Temp\942XyvI5QYgF.exe".
2020-06-30 13:52:10,031 [root] INFO: Loaded monitor into process with pid 3464
2020-06-30 13:52:10,031 [root] DEBUG: set_caller_info: Adding region at 0x002D0000 to caller regions list (advapi32::RegQueryInfoKeyW).
2020-06-30 13:52:10,046 [root] DEBUG: set_caller_info: Adding region at 0x00AB0000 to caller regions list (ntdll::RtlDispatchException).
2020-06-30 13:52:10,359 [root] DEBUG: DumpMemory: Exception occured reading memory address 0xab0000
2020-06-30 13:52:10,359 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00AB0000 size 0x400000.
2020-06-30 13:52:10,359 [root] DEBUG: DumpPEsInRange: Scanning range 0xab0000 - 0xab1000.
2020-06-30 13:52:10,359 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0xab0000-0xab1000.
2020-06-30 13:52:10,484 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\HoAjDTuPwn\CAPE\3464_1088765678103231372020 (size 0xffe)
2020-06-30 13:52:10,484 [root] DEBUG: set_caller_info: Failed to dumping calling PE image at 0x002D0000.
2020-06-30 13:52:10,500 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xd0 amd local view 0x72D60000 to global list.
2020-06-30 13:52:10,500 [root] DEBUG: DLL loaded at 0x72D60000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x7d000 bytes).
2020-06-30 13:52:10,500 [root] DEBUG: DLL unloaded from 0x760C0000.
2020-06-30 13:52:10,515 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xec amd local view 0x035E0000 to global list.
2020-06-30 13:52:10,515 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xe8 amd local view 0x035E0000 to global list.
2020-06-30 13:52:10,531 [root] DEBUG: DLL loaded at 0x73590000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-30 13:52:10,546 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6F340000 for section view with handle 0xe8.
2020-06-30 13:52:10,546 [root] DEBUG: DLL loaded at 0x6F340000: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks (0x5b1000 bytes).
2020-06-30 13:52:10,562 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6F2A0000 for section view with handle 0xec.
2020-06-30 13:52:10,562 [root] DEBUG: DLL loaded at 0x6F2A0000: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCR80 (0x9b000 bytes).
2020-06-30 13:52:10,593 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 3464, handle 0xf8.
2020-06-30 13:52:10,593 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xf4 amd local view 0x001A0000 to global list.
2020-06-30 13:52:10,593 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xfc amd local view 0x001B0000 to global list.
2020-06-30 13:52:10,609 [root] INFO: Disabling sleep skipping.
2020-06-30 13:52:10,609 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3464.
2020-06-30 13:52:10,625 [root] DEBUG: DLL loaded at 0x74F40000: C:\Windows\syswow64\shell32 (0xc4c000 bytes).
2020-06-30 13:52:10,625 [root] DEBUG: DLL loaded at 0x74440000: C:\Windows\system32\profapi (0xb000 bytes).
2020-06-30 13:52:10,640 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3464.
2020-06-30 13:52:10,656 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1b8 amd local view 0x6DF20000 to global list.
2020-06-30 13:52:10,656 [root] DEBUG: DLL loaded at 0x6DF20000: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\f8420d8c6ede777377fcff48a4beaa2a\mscorlib.ni (0xafe000 bytes).
2020-06-30 13:52:10,671 [root] DEBUG: DLL unloaded from 0x75E90000.
2020-06-30 13:52:10,765 [root] DEBUG: set_caller_info: Adding region at 0x03DE0000 to caller regions list (kernel32::SetErrorMode).
2020-06-30 13:52:11,249 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x3e1ffff
2020-06-30 13:52:11,296 [root] DEBUG: DumpMemory: Nothing to dump at 0x03DE0000!
2020-06-30 13:52:11,312 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x03DE0000 size 0x40000.
2020-06-30 13:52:11,312 [root] DEBUG: DumpPEsInRange: Scanning range 0x3de0000 - 0x3de1000.
2020-06-30 13:52:11,312 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3de0000-0x3de1000.
2020-06-30 13:52:11,421 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\HoAjDTuPwn\CAPE\3464_951990464113231372020 (size 0xffe)
2020-06-30 13:52:11,421 [root] DEBUG: DumpRegion: Dumped stack region from 0x03DE0000, size 0x1000.
2020-06-30 13:52:11,421 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1cc amd local view 0x00280000 to global list.
2020-06-30 13:52:11,437 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1c8 amd local view 0x03C50000 to global list.
2020-06-30 13:52:11,437 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6F200000 for section view with handle 0x1c8.
2020-06-30 13:52:11,437 [root] DEBUG: DLL loaded at 0x6F200000: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit (0x5b000 bytes).
2020-06-30 13:52:12,671 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1dc amd local view 0x6D770000 to global list.
2020-06-30 13:52:12,687 [root] DEBUG: DLL loaded at 0x6D770000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System\0a65164b17e5c64bacdc694ea2439c43\System.ni (0x7a5000 bytes).
2020-06-30 13:52:12,687 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6F070000 for section view with handle 0x1dc.
2020-06-30 13:52:12,687 [root] DEBUG: DLL loaded at 0x6F070000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\175df210b784212def386595c25caefb\System.Drawing.ni (0x189000 bytes).
2020-06-30 13:52:12,718 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6CB90000 for section view with handle 0x1dc.
2020-06-30 13:52:12,718 [root] DEBUG: DLL loaded at 0x6CB90000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\5669120680b52abf616f3876387ca2cc\System.Windows.Forms.ni (0xbdf000 bytes).
2020-06-30 13:52:13,437 [root] DEBUG: set_caller_info: Adding region at 0x002C0000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-06-30 13:52:13,437 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x2cffff
2020-06-30 13:52:13,468 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\HoAjDTuPwn\CAPE\3464_1749395874133231372020 (size 0x146)
2020-06-30 13:52:13,546 [root] DEBUG: DLL loaded at 0x736C0000: C:\Windows\system32\uxtheme (0x80000 bytes).
2020-06-30 13:52:13,562 [root] DEBUG: set_caller_info: Adding region at 0x001D0000 to caller regions list (ntdll::LdrGetProcedureAddress).
2020-06-30 13:52:13,562 [root] DEBUG: set_caller_info: Failed to dumping calling PE image at 0x001D0000.
2020-06-30 13:52:13,578 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1e8 amd local view 0x70E40000 to global list.
2020-06-30 13:52:14,906 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1e4 amd local view 0x00420000 to global list.
2020-06-30 13:52:17,609 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1f0 amd local view 0x03C50000 to global list.
2020-06-30 13:52:18,390 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1f8 amd local view 0x73240000 to global list.
2020-06-30 13:52:18,421 [root] DEBUG: DLL loaded at 0x73240000: C:\Windows\Microsoft.NET\Framework\v2.0.50727\culture (0x8000 bytes).
2020-06-30 13:52:18,437 [root] DEBUG: DLL unloaded from 0x73240000.
2020-06-30 13:52:18,437 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x03CA0000 for section view with handle 0x1f8.
2020-06-30 13:52:18,796 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x00430000 for section view with handle 0x1f8.
2020-06-30 13:52:28,875 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1fc amd local view 0x71170000 to global list.
2020-06-30 13:52:28,890 [root] DEBUG: DLL loaded at 0x71170000: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\gdiplus (0x192000 bytes).
2020-06-30 13:52:28,906 [root] DEBUG: DLL loaded at 0x72E60000: C:\Windows\system32\WindowsCodecs (0x131000 bytes).
2020-06-30 13:52:28,906 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x204 amd local view 0x00600000 to global list.
2020-06-30 13:52:28,906 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x00610000 for section view with handle 0x204.
2020-06-30 13:52:28,921 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x00620000 for section view with handle 0x204.
2020-06-30 13:52:29,375 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x210 amd local view 0x70FD0000 to global list.
2020-06-30 13:52:29,390 [root] DEBUG: DLL loaded at 0x70FD0000: C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\4ac828c8c4c76f3ba59f8f9c7dab1cb3\Microsoft.VisualBasic.ni (0x19b000 bytes).
2020-06-30 13:52:29,515 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x20c amd local view 0x03D70000 to global list.
2020-06-30 13:52:30,109 [root] DEBUG: DLL loaded at 0x73240000: C:\Windows\system32\shfolder (0x5000 bytes).
2020-06-30 13:52:30,125 [root] INFO: Added new file to list with pid None and path C:\Users\Louise\AppData\Roaming\VosWhPpNqq.exe
2020-06-30 13:52:30,203 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3464.
2020-06-30 13:52:30,218 [root] INFO: Added new file to list with pid None and path C:\Users\Louise\AppData\Local\Temp\tmp1A91.tmp
2020-06-30 13:52:30,312 [root] DEBUG: DLL loaded at 0x70ED0000: C:\Windows\system32\PROPSYS (0xf5000 bytes).
2020-06-30 13:52:30,312 [root] DEBUG: DLL loaded at 0x76430000: C:\Windows\syswow64\OLEAUT32 (0x91000 bytes).
2020-06-30 13:52:30,312 [root] DEBUG: DLL loaded at 0x73A10000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32 (0x19e000 bytes).
2020-06-30 13:52:30,328 [root] DEBUG: DLL loaded at 0x74CD0000: C:\Windows\system32\apphelp (0x4c000 bytes).
2020-06-30 13:52:30,453 [root] DEBUG: DLL loaded at 0x76170000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes).
2020-06-30 13:52:30,468 [root] DEBUG: DLL loaded at 0x6C0D0000: C:\Windows\SysWOW64\ieframe (0xaba000 bytes).
2020-06-30 13:52:30,468 [root] DEBUG: DLL loaded at 0x76EF0000: C:\Windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes).
2020-06-30 13:52:30,468 [root] DEBUG: DLL loaded at 0x74E90000: C:\Windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0 (0x4000 bytes).
2020-06-30 13:52:30,468 [root] DEBUG: DLL loaded at 0x76E40000: C:\Windows\syswow64\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes).
2020-06-30 13:52:30,468 [root] DEBUG: DLL loaded at 0x73010000: C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0 (0x4000 bytes).
2020-06-30 13:52:30,468 [root] DEBUG: DLL loaded at 0x76EE0000: C:\Windows\syswow64\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes).
2020-06-30 13:52:30,484 [root] DEBUG: DLL loaded at 0x767F0000: C:\Windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes).
2020-06-30 13:52:30,484 [root] DEBUG: DLL loaded at 0x766F0000: C:\Windows\syswow64\normaliz (0x3000 bytes).
2020-06-30 13:52:30,484 [root] DEBUG: DLL loaded at 0x76BA0000: C:\Windows\syswow64\iertutil (0x215000 bytes).
2020-06-30 13:52:30,515 [root] DEBUG: DLL loaded at 0x76800000: C:\Windows\syswow64\SETUPAPI (0x19d000 bytes).
2020-06-30 13:52:30,531 [root] DEBUG: DLL loaded at 0x76200000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes).
2020-06-30 13:52:30,531 [root] DEBUG: DLL loaded at 0x76EC0000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes).
2020-06-30 13:52:30,546 [root] DEBUG: DLL loaded at 0x74380000: C:\Windows\system32\ntmarta (0x21000 bytes).
2020-06-30 13:52:30,562 [root] DEBUG: DLL loaded at 0x76E50000: C:\Windows\syswow64\WLDAP32 (0x45000 bytes).
2020-06-30 13:52:30,562 [root] DEBUG: DLL unloaded from 0x74F40000.
2020-06-30 13:52:30,562 [root] DEBUG: DLL loaded at 0x75B90000: C:\Windows\SysWOW64\urlmon (0x124000 bytes).
2020-06-30 13:52:30,578 [root] DEBUG: DLL loaded at 0x76EB0000: C:\Windows\syswow64\api-ms-win-downlevel-ole32-l1-1-0 (0x4000 bytes).
2020-06-30 13:52:30,625 [root] DEBUG: DLL loaded at 0x75CC0000: C:\Windows\syswow64\WININET (0x1c4000 bytes).
2020-06-30 13:52:30,640 [root] DEBUG: DLL loaded at 0x73230000: C:\Windows\system32\Secur32 (0x8000 bytes).
2020-06-30 13:52:30,796 [root] INFO: Announced 32-bit process name: schtasks.exe pid: 3388
2020-06-30 13:52:30,796 [lib.api.process] INFO: Monitor config for process 3388: C:\tmp2ssujfce\dll\3388.ini
2020-06-30 13:52:30,796 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ssujfce\dll\wIjmAvV.dll, loader C:\tmp2ssujfce\bin\oRbUDSH.exe
2020-06-30 13:52:30,828 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\zqHlkSfV.
2020-06-30 13:52:30,843 [root] DEBUG: Loader: Injecting process 3388 (thread 3736) with C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:30,843 [root] DEBUG: Process image base: 0x00150000
2020-06-30 13:52:30,843 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:30,890 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-30 13:52:30,890 [root] DEBUG: Successfully injected DLL C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:30,890 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3388
2020-06-30 13:52:31,000 [root] DEBUG: CreateProcessHandler: Injection info set for new process 3388, ImageBase: 0x00150000
2020-06-30 13:52:31,000 [root] INFO: Announced 32-bit process name: schtasks.exe pid: 3388
2020-06-30 13:52:31,000 [lib.api.process] INFO: Monitor config for process 3388: C:\tmp2ssujfce\dll\3388.ini
2020-06-30 13:52:31,000 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ssujfce\dll\wIjmAvV.dll, loader C:\tmp2ssujfce\bin\oRbUDSH.exe
2020-06-30 13:52:31,031 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\zqHlkSfV.
2020-06-30 13:52:31,031 [root] DEBUG: Loader: Injecting process 3388 (thread 3736) with C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:31,031 [root] DEBUG: Process image base: 0x00150000
2020-06-30 13:52:31,031 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:31,031 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-06-30 13:52:31,031 [root] DEBUG: Successfully injected DLL C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:31,046 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3388
2020-06-30 13:52:31,171 [root] DEBUG: DLL loaded at 0x744D0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-06-30 13:52:31,203 [root] DEBUG: DLL loaded at 0x74400000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-06-30 13:52:31,203 [root] DEBUG: DLL loaded at 0x74340000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-06-30 13:52:31,546 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:52:31,546 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 13:52:31,546 [root] INFO: Disabling sleep skipping.
2020-06-30 13:52:31,546 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-30 13:52:31,546 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 3388 at 0x70380000, image base 0x150000, stack from 0xd6000-0xe0000
2020-06-30 13:52:31,562 [root] DEBUG: Commandline: C:\Users\Louise\AppData\Local\Temp\"C:\Windows\System32\schtasks.exe" \Create \TN "Updates\VosWhPpNqq" \XML "C:\Users\Louise\AppData\Local\Temp\tmp1A91.tmp".
2020-06-30 13:52:31,609 [root] INFO: Loaded monitor into process with pid 3388
2020-06-30 13:52:31,906 [root] DEBUG: DLL loaded at 0x73590000: C:\Windows\SysWOW64\VERSION (0x9000 bytes).
2020-06-30 13:52:31,921 [root] DEBUG: DLL unloaded from 0x00150000.
2020-06-30 13:52:31,921 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xd4 amd local view 0x035F0000 to global list.
2020-06-30 13:52:31,937 [root] DEBUG: ResumeThreadHandler: CurrentInjectionInfo 0x0 (Pid 3388).
2020-06-30 13:52:31,937 [root] INFO: Stopping Task Scheduler Service
2020-06-30 13:52:33,187 [root] INFO: Stopped Task Scheduler Service
2020-06-30 13:52:33,312 [root] INFO: Starting Task Scheduler Service
2020-06-30 13:52:33,406 [root] INFO: Started Task Scheduler Service
2020-06-30 13:52:33,406 [lib.api.process] INFO: Monitor config for process 844: C:\tmp2ssujfce\dll\844.ini
2020-06-30 13:52:33,421 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp2ssujfce\dll\iBpSWjFV.dll, loader C:\tmp2ssujfce\bin\XStdTGyP.exe
2020-06-30 13:52:33,437 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\zqHlkSfV.
2020-06-30 13:52:33,437 [root] DEBUG: Loader: Injecting process 844 (thread 0) with C:\tmp2ssujfce\dll\iBpSWjFV.dll.
2020-06-30 13:52:33,437 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 13:52:33,437 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2020-06-30 13:52:33,453 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:52:33,453 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 13:52:33,453 [root] INFO: Disabling sleep skipping.
2020-06-30 13:52:33,453 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 844 at 0x0000000070DD0000, image base 0x00000000FFEF0000, stack from 0x0000000002976000-0x0000000002980000
2020-06-30 13:52:33,453 [root] DEBUG: Commandline: C:\Windows\sysnative\svchost.exe -k netsvcs.
2020-06-30 13:52:33,531 [root] WARNING: b'Unable to place hook on LockResource'
2020-06-30 13:52:33,531 [root] WARNING: b'Unable to hook LockResource'
2020-06-30 13:52:33,578 [root] INFO: Loaded monitor into process with pid 844
2020-06-30 13:52:33,578 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF5D60000 to caller regions list (msvcrt::memcpy).
2020-06-30 13:52:33,593 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-30 13:52:33,593 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF5D60000 skipped.
2020-06-30 13:52:33,593 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-30 13:52:33,609 [root] DEBUG: Successfully injected DLL C:\tmp2ssujfce\dll\iBpSWjFV.dll.
2020-06-30 13:52:35,609 [root] DEBUG: DLL loaded at 0x76170000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes).
2020-06-30 13:52:36,312 [root] DEBUG: DLL loaded at 0x73640000: C:\Windows\SysWOW64\taskschd (0x7d000 bytes).
2020-06-30 13:52:36,968 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF1E20000 to caller regions list (ntdll::NtWaitForSingleObject).
2020-06-30 13:52:36,968 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF1E20000 skipped.
2020-06-30 13:52:41,031 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 3388
2020-06-30 13:52:41,046 [root] DEBUG: GetHookCallerBase: thread 3736 (handle 0x0), return address 0x00167569, allocation base 0x00150000.
2020-06-30 13:52:41,046 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00150000.
2020-06-30 13:52:41,046 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-30 13:52:41,046 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00150000.
2020-06-30 13:52:41,046 [root] DEBUG: DumpProcess: Module entry point VA is 0x00017683.
2020-06-30 13:52:41,109 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x2b400.
2020-06-30 13:52:41,109 [root] DEBUG: DLL unloaded from 0x76680000.
2020-06-30 13:52:41,218 [root] INFO: Process with pid 3388 has terminated
2020-06-30 13:52:41,375 [root] INFO: Announced 32-bit process name: 942XyvI5QYgF.exe pid: 3164
2020-06-30 13:52:41,375 [lib.api.process] INFO: Monitor config for process 3164: C:\tmp2ssujfce\dll\3164.ini
2020-06-30 13:52:41,375 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ssujfce\dll\wIjmAvV.dll, loader C:\tmp2ssujfce\bin\oRbUDSH.exe
2020-06-30 13:52:41,578 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\zqHlkSfV.
2020-06-30 13:52:41,593 [root] DEBUG: Loader: Injecting process 3164 (thread 3268) with C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:41,656 [root] DEBUG: Process image base: 0x00EF0000
2020-06-30 13:52:41,656 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 13:52:41,734 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 13:52:41,734 [root] DEBUG: Successfully injected DLL C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:41,781 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3164
2020-06-30 13:52:41,859 [root] DEBUG: CreateProcessHandler: Injection info set for new process 3164, ImageBase: 0x00EF0000
2020-06-30 13:52:41,859 [root] INFO: Announced 32-bit process name: 942XyvI5QYgF.exe pid: 3164
2020-06-30 13:52:41,859 [lib.api.process] INFO: Monitor config for process 3164: C:\tmp2ssujfce\dll\3164.ini
2020-06-30 13:52:41,859 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ssujfce\dll\wIjmAvV.dll, loader C:\tmp2ssujfce\bin\oRbUDSH.exe
2020-06-30 13:52:42,015 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\zqHlkSfV.
2020-06-30 13:52:42,015 [root] DEBUG: Loader: Injecting process 3164 (thread 3268) with C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:42,078 [root] DEBUG: Process image base: 0x00EF0000
2020-06-30 13:52:42,078 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 13:52:42,078 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 13:52:42,078 [root] DEBUG: Successfully injected DLL C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:42,078 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3164
2020-06-30 13:52:42,140 [root] DEBUG: set_caller_info: Adding region at 0x03D20000 to caller regions list (advapi32::LookupPrivilegeValueW).
2020-06-30 13:52:42,140 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x3d2ffff
2020-06-30 13:52:42,203 [root] DEBUG: DumpMemory: Nothing to dump at 0x03D20000!
2020-06-30 13:52:42,234 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x03D20000 size 0x10000.
2020-06-30 13:52:42,281 [root] DEBUG: DumpPEsInRange: Scanning range 0x3d20000 - 0x3d21000.
2020-06-30 13:52:42,281 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3d20000-0x3d21000.
2020-06-30 13:52:42,343 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\HoAjDTuPwn\CAPE\3464_8242963353431372020 (size 0xd5)
2020-06-30 13:52:42,390 [root] DEBUG: DumpRegion: Dumped stack region from 0x03D20000, size 0x1000.
2020-06-30 13:52:42,406 [root] INFO: Process with pid 3164 has terminated
2020-06-30 13:52:42,437 [root] INFO: Announced 32-bit process name: 942XyvI5QYgF.exe pid: 1492
2020-06-30 13:52:42,437 [lib.api.process] INFO: Monitor config for process 1492: C:\tmp2ssujfce\dll\1492.ini
2020-06-30 13:52:42,531 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ssujfce\dll\wIjmAvV.dll, loader C:\tmp2ssujfce\bin\oRbUDSH.exe
2020-06-30 13:52:42,671 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\zqHlkSfV.
2020-06-30 13:52:42,687 [root] DEBUG: Loader: Injecting process 1492 (thread 2820) with C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:42,718 [root] DEBUG: Process image base: 0x00EF0000
2020-06-30 13:52:42,718 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 13:52:42,765 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 13:52:42,765 [root] DEBUG: Successfully injected DLL C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:42,859 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1492
2020-06-30 13:52:42,937 [root] DEBUG: CreateProcessHandler: Injection info set for new process 1492, ImageBase: 0x00EF0000
2020-06-30 13:52:42,937 [root] INFO: Announced 32-bit process name: 942XyvI5QYgF.exe pid: 1492
2020-06-30 13:52:42,937 [lib.api.process] INFO: Monitor config for process 1492: C:\tmp2ssujfce\dll\1492.ini
2020-06-30 13:52:42,937 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ssujfce\dll\wIjmAvV.dll, loader C:\tmp2ssujfce\bin\oRbUDSH.exe
2020-06-30 13:52:43,203 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\zqHlkSfV.
2020-06-30 13:52:43,203 [root] DEBUG: Loader: Injecting process 1492 (thread 2820) with C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:43,265 [root] DEBUG: Process image base: 0x00EF0000
2020-06-30 13:52:43,265 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 13:52:43,265 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 13:52:43,265 [root] DEBUG: Successfully injected DLL C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:43,312 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1492
2020-06-30 13:52:43,359 [root] DEBUG: WriteMemoryHandler: Executable binary injected into process 1492 (ImageBase 0x400000)
2020-06-30 13:52:43,359 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-30 13:52:43,406 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x054D5F40.
2020-06-30 13:52:43,468 [root] DEBUG: DumpPE: PE file in memory dumped successfully - dump size 0x45600.
2020-06-30 13:52:43,468 [root] DEBUG: WriteMemoryHandler: Dumped PE image from buffer at 0x54d5f40, SizeOfImage 0x4c000.
2020-06-30 13:52:43,515 [root] INFO: Announced 32-bit process name: 942XyvI5QYgF.exe pid: 1492
2020-06-30 13:52:43,515 [lib.api.process] INFO: Monitor config for process 1492: C:\tmp2ssujfce\dll\1492.ini
2020-06-30 13:52:43,515 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ssujfce\dll\wIjmAvV.dll, loader C:\tmp2ssujfce\bin\oRbUDSH.exe
2020-06-30 13:52:43,656 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\zqHlkSfV.
2020-06-30 13:52:43,703 [root] DEBUG: Loader: Injecting process 1492 (thread 0) with C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:43,703 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 2820, handle 0xbc
2020-06-30 13:52:43,718 [root] DEBUG: Process image base: 0x00EF0000
2020-06-30 13:52:43,718 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 13:52:43,765 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 13:52:43,765 [root] DEBUG: Successfully injected DLL C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:43,828 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1492
2020-06-30 13:52:43,875 [root] DEBUG: WriteMemoryHandler: injection of section of PE image which has already been dumped.
2020-06-30 13:52:43,875 [root] INFO: Announced 32-bit process name: 942XyvI5QYgF.exe pid: 1492
2020-06-30 13:52:43,875 [lib.api.process] INFO: Monitor config for process 1492: C:\tmp2ssujfce\dll\1492.ini
2020-06-30 13:52:43,875 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ssujfce\dll\wIjmAvV.dll, loader C:\tmp2ssujfce\bin\oRbUDSH.exe
2020-06-30 13:52:44,078 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\zqHlkSfV.
2020-06-30 13:52:44,078 [root] DEBUG: Loader: Injecting process 1492 (thread 0) with C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:44,125 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 2820, handle 0xbc
2020-06-30 13:52:44,125 [root] DEBUG: Process image base: 0x00EF0000
2020-06-30 13:52:44,171 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 13:52:44,171 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 13:52:44,218 [root] DEBUG: Successfully injected DLL C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:44,265 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1492
2020-06-30 13:52:44,265 [root] DEBUG: WriteMemoryHandler: shellcode at 0x046E189C (size 0x400) injected into process 1492.
2020-06-30 13:52:44,390 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\HoAjDTuPwn\CAPE\3464_1287725410373431372020 (size 0x2f0)
2020-06-30 13:52:44,390 [root] DEBUG: WriteMemoryHandler: Dumped injected code/data from buffer.
2020-06-30 13:52:44,390 [root] INFO: Announced 32-bit process name: 942XyvI5QYgF.exe pid: 1492
2020-06-30 13:52:44,390 [lib.api.process] INFO: Monitor config for process 1492: C:\tmp2ssujfce\dll\1492.ini
2020-06-30 13:52:44,406 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ssujfce\dll\wIjmAvV.dll, loader C:\tmp2ssujfce\bin\oRbUDSH.exe
2020-06-30 13:52:44,546 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\zqHlkSfV.
2020-06-30 13:52:44,546 [root] DEBUG: Loader: Injecting process 1492 (thread 0) with C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:44,546 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 2820, handle 0xbc
2020-06-30 13:52:44,546 [root] DEBUG: Process image base: 0x00EF0000
2020-06-30 13:52:44,593 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 13:52:44,593 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 13:52:44,593 [root] DEBUG: Successfully injected DLL C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:44,593 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1492
2020-06-30 13:52:44,593 [root] DEBUG: WriteMemoryHandler: shellcode at 0x046E1CA8 (size 0x200) injected into process 1492.
2020-06-30 13:52:44,656 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\HoAjDTuPwn\CAPE\3464_1079562107373431372020 (size 0x9)
2020-06-30 13:52:44,703 [root] DEBUG: WriteMemoryHandler: Dumped injected code/data from buffer.
2020-06-30 13:52:44,703 [root] INFO: Announced 32-bit process name: 942XyvI5QYgF.exe pid: 1492
2020-06-30 13:52:44,703 [lib.api.process] INFO: Monitor config for process 1492: C:\tmp2ssujfce\dll\1492.ini
2020-06-30 13:52:44,703 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ssujfce\dll\wIjmAvV.dll, loader C:\tmp2ssujfce\bin\oRbUDSH.exe
2020-06-30 13:52:44,890 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\zqHlkSfV.
2020-06-30 13:52:44,890 [root] DEBUG: Loader: Injecting process 1492 (thread 0) with C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:44,953 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 2820, handle 0xbc
2020-06-30 13:52:44,953 [root] DEBUG: Process image base: 0x00EF0000
2020-06-30 13:52:45,000 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 13:52:45,000 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 13:52:45,046 [root] DEBUG: Successfully injected DLL C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:45,093 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1492
2020-06-30 13:52:45,093 [root] INFO: Announced 32-bit process name: 942XyvI5QYgF.exe pid: 1492
2020-06-30 13:52:45,109 [lib.api.process] INFO: Monitor config for process 1492: C:\tmp2ssujfce\dll\1492.ini
2020-06-30 13:52:45,109 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ssujfce\dll\wIjmAvV.dll, loader C:\tmp2ssujfce\bin\oRbUDSH.exe
2020-06-30 13:52:45,234 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\zqHlkSfV.
2020-06-30 13:52:45,234 [root] DEBUG: Loader: Injecting process 1492 (thread 0) with C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:45,281 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 2820, handle 0xbc
2020-06-30 13:52:45,281 [root] DEBUG: Process image base: 0x00400000
2020-06-30 13:52:45,281 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 13:52:45,281 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 13:52:45,328 [root] DEBUG: Successfully injected DLL C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:45,375 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1492
2020-06-30 13:52:45,375 [root] DEBUG: SetThreadContextHandler: Hollow process entry point reset via NtSetContextThread to 0x00046DAE (process 1492).
2020-06-30 13:52:45,390 [root] INFO: Announced 32-bit process name: 942XyvI5QYgF.exe pid: 1492
2020-06-30 13:52:45,390 [lib.api.process] INFO: Monitor config for process 1492: C:\tmp2ssujfce\dll\1492.ini
2020-06-30 13:52:45,390 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ssujfce\dll\wIjmAvV.dll, loader C:\tmp2ssujfce\bin\oRbUDSH.exe
2020-06-30 13:52:45,562 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\zqHlkSfV.
2020-06-30 13:52:45,656 [root] DEBUG: Loader: Injecting process 1492 (thread 2820) with C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:45,656 [root] DEBUG: Process image base: 0x00400000
2020-06-30 13:52:45,718 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 13:52:45,718 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 13:52:45,765 [root] DEBUG: Successfully injected DLL C:\tmp2ssujfce\dll\wIjmAvV.dll.
2020-06-30 13:52:45,859 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1492
2020-06-30 13:52:45,859 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 1492.
2020-06-30 13:52:45,984 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:52:46,046 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 13:52:46,093 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 3464
2020-06-30 13:52:46,093 [root] DEBUG: GetHookCallerBase: thread 3000 (handle 0x0), return address 0x002C1D7E, allocation base 0x002C0000.
2020-06-30 13:52:46,140 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00EF0000.
2020-06-30 13:52:46,140 [root] DEBUG: LooksLikeSectionBoundary: Exception occured reading around suspected boundary at 0x00EF2000
2020-06-30 13:52:46,187 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-30 13:52:46,187 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x00EF0000.
2020-06-30 13:52:46,234 [root] DEBUG: DumpPE: Empty or inaccessible last section, file image seems incomplete (from 0x00F54800 to 0x00F54A00).
2020-06-30 13:52:46,265 [root] INFO: Disabling sleep skipping.
2020-06-30 13:52:46,343 [root] DEBUG: DumpPE: Error: Cannot dump PE file from memory.
2020-06-30 13:52:46,343 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 1492 at 0x70380000, image base 0x400000, stack from 0x366000-0x370000
2020-06-30 13:52:46,390 [root] DEBUG: DumpImageInCurrentProcess: Failed to dump 'raw' PE image from 0x00EF0000, dumping memory region.
2020-06-30 13:52:46,406 [root] DEBUG: Commandline: C:\Users\Louise\AppData\Local\Temp\"{path}".
2020-06-30 13:52:46,515 [root] DEBUG: DLL unloaded from 0x762E0000.
2020-06-30 13:52:46,515 [root] INFO: Loaded monitor into process with pid 1492
2020-06-30 13:52:46,578 [root] DEBUG: DLL unloaded from 0x70ED0000.
2020-06-30 13:52:46,578 [root] DEBUG: set_caller_info: Adding region at 0x00090000 to caller regions list (ntdll::LdrLoadDll).
2020-06-30 13:52:46,640 [root] DEBUG: DLL unloaded from 0x76680000.
2020-06-30 13:52:46,640 [root] DEBUG: set_caller_info: Adding region at 0x02540000 to caller regions list (kernel32::GetSystemTime).
2020-06-30 13:52:46,656 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x2540000
2020-06-30 13:52:46,734 [root] DEBUG: DLL unloaded from 0x74380000.
2020-06-30 13:52:46,812 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x02540000 size 0x400000.
2020-06-30 13:52:46,812 [root] DEBUG: DumpPEsInRange: Scanning range 0x2540000 - 0x2541000.
2020-06-30 13:52:46,937 [root] DEBUG: DLL unloaded from 0x6F340000.
2020-06-30 13:52:46,937 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x2540000-0x2541000.
2020-06-30 13:52:46,984 [root] DEBUG: DLL unloaded from 0x72D60000.
2020-06-30 13:52:47,000 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 3464
2020-06-30 13:52:47,062 [root] DEBUG: GetHookCallerBase: thread 3000 (handle 0x0), return address 0x002C1D7E, allocation base 0x002C0000.
2020-06-30 13:52:47,093 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\HoAjDTuPwn\CAPE\1492_1481847324463231372020 (size 0x597)
2020-06-30 13:52:47,093 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00EF0000.
2020-06-30 13:52:47,093 [root] DEBUG: LooksLikeSectionBoundary: Exception occured reading around suspected boundary at 0x00EF2000
2020-06-30 13:52:47,218 [root] DEBUG: DumpPE: Error: Cannot dump PE file from memory.
2020-06-30 13:52:47,281 [root] DEBUG: DumpImageInCurrentProcess: Failed to dump 'raw' PE image from 0x00EF0000, dumping memory region.
2020-06-30 13:52:47,296 [root] INFO: Process with pid 3464 has terminated
2020-06-30 13:52:47,328 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\HoAjDTuPwn\CAPE\1492_1916959065473231372020 (size 0x12a)
2020-06-30 13:52:47,328 [root] DEBUG: DumpRegion: Dumped stack region from 0x000A0000, size 0x1000.
2020-06-30 13:52:47,343 [root] DEBUG: DLL loaded at 0x005B0000: C:\tmp2ssujfce\dll\wIjmAvV (0xd5000 bytes).
2020-06-30 13:52:47,343 [root] DEBUG: DLL unloaded from 0x73580000.
2020-06-30 13:52:47,359 [root] DEBUG: DLL unloaded from 0x762E0000.
2020-06-30 13:52:47,359 [root] DEBUG: DLL unloaded from 0x73580000.
2020-06-30 13:52:47,359 [root] DEBUG: DLL unloaded from 0x762E0000.
2020-06-30 13:52:47,375 [root] DEBUG: DLL unloaded from 0x005B0000.
2020-06-30 13:52:47,375 [root] DEBUG: set_caller_info: Adding region at 0x000B0000 to caller regions list (ntdll::LdrLoadDll).
2020-06-30 13:52:47,468 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\HoAjDTuPwn\CAPE\1492_1016964002473231372020 (size 0x12a)
2020-06-30 13:52:47,468 [root] DEBUG: DumpRegion: Dumped stack region from 0x000B0000, size 0x1000.
2020-06-30 13:52:47,468 [root] DEBUG: DLL loaded at 0x005B0000: C:\tmp2ssujfce\dll\wIjmAvV (0xd5000 bytes).
2020-06-30 13:52:47,500 [root] DEBUG: DLL unloaded from 0x73580000.
2020-06-30 13:52:47,500 [root] DEBUG: DLL unloaded from 0x762E0000.
2020-06-30 13:52:47,578 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\HoAjDTuPwn\CAPE\1492_1319149247473231372020 (size 0x12a)
2020-06-30 13:52:47,578 [root] DEBUG: DumpRegion: Dumped stack region from 0x000D0000, size 0x1000.
2020-06-30 13:52:47,593 [root] DEBUG: DLL loaded at 0x005B0000: C:\tmp2ssujfce\dll\wIjmAvV (0xd5000 bytes).
2020-06-30 13:52:47,593 [root] DEBUG: DLL unloaded from 0x73580000.
2020-06-30 13:52:47,593 [root] DEBUG: DLL unloaded from 0x762E0000.
2020-06-30 13:52:47,593 [root] DEBUG: DLL unloaded from 0x73580000.
2020-06-30 13:52:47,609 [root] DEBUG: DLL unloaded from 0x762E0000.
2020-06-30 13:52:47,656 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\HoAjDTuPwn\CAPE\1492_313734687473231372020 (size 0x12a)
2020-06-30 13:52:47,687 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x5affff
2020-06-30 13:52:47,734 [root] DEBUG: DumpMemory: Nothing to dump at 0x00530000!
2020-06-30 13:52:47,812 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\HoAjDTuPwn\CAPE\1492_2000115074473231372020 (size 0x16ffa)
2020-06-30 13:52:47,812 [root] DEBUG: DumpRegion: Dumped stack region from 0x00530000, size 0x17000.
2020-06-30 13:52:47,828 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xdc amd local view 0x72D60000 to global list.
2020-06-30 13:52:47,828 [root] DEBUG: DLL loaded at 0x72D60000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x7d000 bytes).
2020-06-30 13:52:47,843 [root] DEBUG: DLL unloaded from 0x760C0000.
2020-06-30 13:52:47,859 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xec amd local view 0x005B0000 to global list.
2020-06-30 13:52:47,875 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xe8 amd local view 0x005B0000 to global list.
2020-06-30 13:52:48,015 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x70810000 for section view with handle 0xe8.
2020-06-30 13:52:48,109 [root] DEBUG: DLL loaded at 0x70810000: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks (0x5b1000 bytes).
2020-06-30 13:52:48,140 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x72F00000 for section view with handle 0xec.
2020-06-30 13:52:48,156 [root] DEBUG: DLL loaded at 0x72F00000: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCR80 (0x9b000 bytes).
2020-06-30 13:52:48,203 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1492, handle 0xf8.
2020-06-30 13:52:48,203 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xf4 amd local view 0x00120000 to global list.
2020-06-30 13:52:48,203 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xfc amd local view 0x001F0000 to global list.
2020-06-30 13:52:48,218 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 1492.
2020-06-30 13:52:48,249 [root] DEBUG: DLL loaded at 0x74F40000: C:\Windows\syswow64\shell32 (0xc4c000 bytes).
2020-06-30 13:52:48,249 [root] DEBUG: DLL loaded at 0x74440000: C:\Windows\system32\profapi (0xb000 bytes).
2020-06-30 13:52:48,296 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 1492.
2020-06-30 13:52:48,359 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1b8 amd local view 0x6D420000 to global list.
2020-06-30 13:52:48,359 [root] DEBUG: DLL loaded at 0x6D420000: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\f8420d8c6ede777377fcff48a4beaa2a\mscorlib.ni (0xafe000 bytes).
2020-06-30 13:52:48,406 [root] DEBUG: set_caller_info: Adding region at 0x03A30000 to caller regions list (kernel32::SetErrorMode).
2020-06-30 13:52:48,453 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x3a6ffff
2020-06-30 13:52:48,468 [root] DEBUG: DumpMemory: Nothing to dump at 0x03A30000!
2020-06-30 13:52:48,515 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x03A30000 size 0x40000.
2020-06-30 13:52:48,515 [root] DEBUG: DumpPEsInRange: Scanning range 0x3a30000 - 0x3a31000.
2020-06-30 13:52:48,531 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3a30000-0x3a31000.
2020-06-30 13:52:48,640 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\HoAjDTuPwn\CAPE\1492_1027706199483231372020 (size 0xffe)
2020-06-30 13:52:48,640 [root] DEBUG: DumpRegion: Dumped stack region from 0x03A30000, size 0x1000.
2020-06-30 13:52:48,656 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1cc amd local view 0x00450000 to global list.
2020-06-30 13:52:48,671 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1c8 amd local view 0x02360000 to global list.
2020-06-30 13:52:48,687 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x72FC0000 for section view with handle 0x1c8.
2020-06-30 13:52:48,750 [root] DEBUG: set_caller_info: Adding region at 0x02370000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-06-30 13:52:48,812 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\HoAjDTuPwn\CAPE\1492_660637496483231372020 (size 0xf773)
2020-06-30 13:52:48,828 [root] DEBUG: DumpRegion: Dumped stack region from 0x02370000, size 0x10000.
2020-06-30 13:52:48,890 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1dc amd local view 0x6E270000 to global list.
2020-06-30 13:52:49,343 [root] DEBUG: set_caller_info: Adding region at 0x00250000 to caller regions list (ntdll::memcpy).
2020-06-30 13:52:49,343 [root] DEBUG: set_caller_info: Failed to dumping calling PE image at 0x00250000.
2020-06-30 13:52:49,375 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x00490000 for section view with handle 0x1dc.
2020-06-30 13:52:49,375 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1e4 amd local view 0x004E0000 to global list.
2020-06-30 13:52:49,390 [root] DEBUG: DLL loaded at 0x747D0000: C:\Windows\system32\bcrypt (0x17000 bytes).
2020-06-30 13:52:49,703 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1f8 amd local view 0x70FE0000 to global list.
2020-06-30 13:52:52,203 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF6F70000 to caller regions list (kernel32::GetSystemTimeAsFileTime).
2020-06-30 13:52:52,203 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF6F70000 skipped.
2020-06-30 13:52:59,343 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF55A0000 to caller regions list (ntdll::NtWaitForSingleObject).
2020-06-30 13:52:59,359 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF55A0000 skipped.
2020-06-30 13:53:00,921 [root] DEBUG: DLL loaded at 0x744D0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-06-30 13:53:00,937 [root] DEBUG: DLL loaded at 0x74400000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-06-30 13:53:00,968 [root] DEBUG: DLL loaded at 0x74340000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-06-30 13:53:00,968 [root] DEBUG: DLL loaded at 0x76170000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes).
2020-06-30 13:53:00,984 [root] DEBUG: DLL loaded at 0x76430000: C:\Windows\syswow64\OLEAUT32 (0x91000 bytes).
2020-06-30 13:53:01,000 [root] DEBUG: DLL loaded at 0x72EC0000: C:\Windows\system32\wbem\wbemdisp (0x31000 bytes).
2020-06-30 13:53:01,046 [root] DEBUG: DLL loaded at 0x72E60000: C:\Windows\system32\wbemcomn (0x5c000 bytes).
2020-06-30 13:53:01,062 [root] DEBUG: DLL loaded at 0x763F0000: C:\Windows\syswow64\WS2_32 (0x35000 bytes).
2020-06-30 13:53:01,062 [root] DEBUG: DLL loaded at 0x760B0000: C:\Windows\syswow64\NSI (0x6000 bytes).
2020-06-30 13:53:01,078 [root] INFO: Stopping WMI Service
2020-06-30 13:53:01,109 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF4000000 to caller regions list (msvcrt::memcpy).
2020-06-30 13:53:01,156 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF4000000 skipped.
2020-06-30 13:53:01,296 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1318 amd local view 0x0000000005290000 to global list.
2020-06-30 13:53:01,343 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1390 amd local view 0x0000000005680000 to global list.
2020-06-30 13:53:01,406 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x11a8 amd local view 0x0000000000C00000 to global list.
2020-06-30 13:53:01,406 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x11a8 amd local view 0x0000000000C00000 to global list.
2020-06-30 13:53:01,421 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1190 amd local view 0x0000000000BD0000 to global list.
2020-06-30 13:53:01,437 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xe50 amd local view 0x0000000000BF0000 to global list.
2020-06-30 13:53:01,437 [root] DEBUG: DLL unloaded from 0x000007FEF6810000.
2020-06-30 13:53:01,437 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000BD0000 for section view with handle 0x11a8.
2020-06-30 13:53:01,437 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000BF0000 for section view with handle 0x1190.
2020-06-30 13:53:01,750 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF47E0000 to caller regions list (msvcrt::memcpy).
2020-06-30 13:53:01,750 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF47E0000 skipped.
2020-06-30 13:53:01,781 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF5CF0000 to caller regions list (msvcrt::memcpy).
2020-06-30 13:53:01,843 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF5CF0000 skipped.
2020-06-30 13:53:01,859 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF6630000 to caller regions list (msvcrt::memcpy).
2020-06-30 13:53:01,875 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF6630000 skipped.
2020-06-30 13:53:04,046 [root] DEBUG: DLL unloaded from 0x000007FEF6590000.
2020-06-30 13:53:04,062 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF5C60000 to caller regions list (ntdll::NtClose).
2020-06-30 13:53:04,062 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF5C60000 skipped.
2020-06-30 13:53:04,406 [root] INFO: Added new file to list with pid None and path C:\Windows\Temp\fwtsqmfile01.sqm
2020-06-30 13:53:06,546 [root] DEBUG: DLL unloaded from 0x000007FEF6810000.
2020-06-30 13:53:06,656 [root] DEBUG: DLL unloaded from 0x000007FEF67F0000.
2020-06-30 13:53:07,031 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF49E0000 to caller regions list (ntdll::LdrGetDllHandle).
2020-06-30 13:53:07,031 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF49E0000 skipped.
2020-06-30 13:53:07,062 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF1D30000 to caller regions list (msvcrt::memcpy).
2020-06-30 13:53:07,078 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF1D30000 skipped.
2020-06-30 13:53:07,546 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF49C0000 to caller regions list (ntdll::NtWaitForSingleObject).
2020-06-30 13:53:07,546 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF49C0000 skipped.
2020-06-30 13:53:07,609 [root] DEBUG: DLL unloaded from 0x000007FEF5D60000.
2020-06-30 13:53:07,625 [root] DEBUG: DLL unloaded from 0x000007FEFACA0000.
2020-06-30 13:53:07,640 [root] DEBUG: set_caller_info: Adding region at 0x000007FEFACA0000 to caller regions list (ntdll::NtClose).
2020-06-30 13:53:07,640 [root] DEBUG: set_caller_info: Calling region at 0x000007FEFACA0000 skipped.
2020-06-30 13:53:07,640 [root] DEBUG: DLL unloaded from 0x000007FEF1D30000.
2020-06-30 13:53:07,656 [root] DEBUG: DLL unloaded from 0x000007FEF5CF0000.
2020-06-30 13:53:07,656 [root] DEBUG: DLL unloaded from 0x000007FEF47E0000.
2020-06-30 13:53:07,687 [root] DEBUG: DLL unloaded from 0x000007FEF51B0000.
2020-06-30 13:53:07,703 [root] DEBUG: DLL unloaded from 0x000007FEF5C60000.
2020-06-30 13:53:07,718 [root] DEBUG: DLL unloaded from 0x000007FEF6810000.
2020-06-30 13:53:07,937 [root] DEBUG: DLL unloaded from 0x0000000076F60000.
2020-06-30 13:53:07,953 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF9BD0000 to caller regions list (ntdll::NtWaitForSingleObject).
2020-06-30 13:53:07,984 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF9BD0000 skipped.
2020-06-30 13:53:08,140 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF6FF0000 to caller regions list (msvcrt::memcpy).
2020-06-30 13:53:08,156 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF6FF0000 skipped.
2020-06-30 13:53:08,171 [root] DEBUG: DLL unloaded from 0x0000000077180000.
2020-06-30 13:53:09,156 [root] INFO: Stopped WMI Service
2020-06-30 13:53:09,203 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1410 amd local view 0x00000000055A0000 to global list.
2020-06-30 13:53:09,312 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xc0c amd local view 0x0000000000B10000 to global list.
2020-06-30 13:53:09,312 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000BD0000 for section view with handle 0xc0c.
2020-06-30 13:53:09,390 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000B10000 for section view with handle 0xc0c.
2020-06-30 13:53:09,406 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000BD0000 for section view with handle 0xc0c.
2020-06-30 13:53:09,406 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000B10000 for section view with handle 0xc0c.
2020-06-30 13:53:09,468 [lib.api.process] INFO: Monitor config for process 592: C:\tmp2ssujfce\dll\592.ini
2020-06-30 13:53:09,515 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp2ssujfce\dll\iBpSWjFV.dll, loader C:\tmp2ssujfce\bin\XStdTGyP.exe
2020-06-30 13:53:09,671 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\zqHlkSfV.
2020-06-30 13:53:09,671 [root] DEBUG: Loader: Injecting process 592 (thread 0) with C:\tmp2ssujfce\dll\iBpSWjFV.dll.
2020-06-30 13:53:09,703 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 596, handle 0xa4
2020-06-30 13:53:09,703 [root] DEBUG: Process image base: 0x00000000FFEF0000
2020-06-30 13:53:09,703 [root] DEBUG: InjectDllViaIAT: Not a new process, aborting IAT patch
2020-06-30 13:53:09,703 [root] DEBUG: InjectDll: IAT patching failed, falling back to thread injection.
2020-06-30 13:53:09,718 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:53:09,718 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 13:53:09,734 [root] INFO: Disabling sleep skipping.
2020-06-30 13:53:09,734 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 592 at 0x0000000070DD0000, image base 0x00000000FFEF0000, stack from 0x0000000001216000-0x0000000001220000
2020-06-30 13:53:09,734 [root] DEBUG: Commandline: C:\Windows\sysnative\svchost.exe -k DcomLaunch.
2020-06-30 13:53:09,796 [root] WARNING: b'Unable to place hook on LockResource'
2020-06-30 13:53:09,796 [root] WARNING: b'Unable to hook LockResource'
2020-06-30 13:53:09,859 [root] INFO: Loaded monitor into process with pid 592
2020-06-30 13:53:09,875 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-30 13:53:09,953 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-30 13:53:09,953 [root] DEBUG: Successfully injected DLL C:\tmp2ssujfce\dll\iBpSWjFV.dll.
2020-06-30 13:53:12,062 [root] INFO: Starting WMI Service
2020-06-30 13:53:12,375 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000BD0000 for section view with handle 0xc0c.
2020-06-30 13:53:12,609 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 4872, handle 0x3f0.
2020-06-30 13:53:14,734 [root] INFO: Started WMI Service
2020-06-30 13:53:14,781 [lib.api.process] INFO: Monitor config for process 4872: C:\tmp2ssujfce\dll\4872.ini
2020-06-30 13:53:14,953 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp2ssujfce\dll\iBpSWjFV.dll, loader C:\tmp2ssujfce\bin\XStdTGyP.exe
2020-06-30 13:53:15,015 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\zqHlkSfV.
2020-06-30 13:53:15,015 [root] DEBUG: Loader: Injecting process 4872 (thread 0) with C:\tmp2ssujfce\dll\iBpSWjFV.dll.
2020-06-30 13:53:15,015 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 13:53:15,015 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2020-06-30 13:53:15,031 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:53:15,031 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 13:53:15,046 [root] INFO: Disabling sleep skipping.
2020-06-30 13:53:15,046 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 4872 at 0x0000000070DD0000, image base 0x00000000FFEF0000, stack from 0x00000000011F6000-0x0000000001200000
2020-06-30 13:53:15,062 [root] DEBUG: Commandline: C:\Windows\sysnative\svchost.exe -k netsvcs.
2020-06-30 13:53:15,156 [root] WARNING: b'Unable to place hook on LockResource'
2020-06-30 13:53:15,156 [root] WARNING: b'Unable to hook LockResource'
2020-06-30 13:53:15,171 [root] INFO: Loaded monitor into process with pid 4872
2020-06-30 13:53:15,171 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-30 13:53:15,187 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-30 13:53:15,187 [root] DEBUG: Successfully injected DLL C:\tmp2ssujfce\dll\iBpSWjFV.dll.
2020-06-30 13:53:17,265 [root] DEBUG: DLL loaded at 0x73240000: C:\Windows\system32\wbem\wbemprox (0xb000 bytes).
2020-06-30 13:53:17,265 [root] DEBUG: DLL loaded at 0x70F70000: C:\Windows\system32\wbemcomn2 (0x61000 bytes).
2020-06-30 13:53:17,281 [root] DEBUG: DLL loaded at 0x72E40000: C:\Windows\system32\wbem\wmiutils (0x1a000 bytes).
2020-06-30 13:53:17,406 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x2a0 amd local view 0x06C80000 to global list.
2020-06-30 13:53:17,500 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x2a4 amd local view 0x70700000 to global list.
2020-06-30 13:53:17,531 [root] DEBUG: DLL loaded at 0x70700000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\81ab4c39c6a7c9f50721aca2db09b417\System.Management.ni (0x106000 bytes).
2020-06-30 13:53:17,640 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 1492.
2020-06-30 13:53:17,687 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 1492.
2020-06-30 13:53:17,781 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x2f0 amd local view 0x72E20000 to global list.
2020-06-30 13:53:17,796 [root] DEBUG: DLL loaded at 0x72E20000: C:\Windows\Microsoft.NET\Framework\v2.0.50727\wminet_utils (0x1e000 bytes).
2020-06-30 13:53:17,921 [root] DEBUG: set_caller_info: Adding region at 0x00950000 to caller regions list (ole32::CoCreateInstance).
2020-06-30 13:53:17,937 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x95ffff
2020-06-30 13:53:17,937 [root] DEBUG: DumpMemory: Nothing to dump at 0x00950000!
2020-06-30 13:53:17,937 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00950000 size 0x10000.
2020-06-30 13:53:17,937 [root] DEBUG: DumpPEsInRange: Scanning range 0x950000 - 0x953000.
2020-06-30 13:53:17,953 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x950000-0x953000.
2020-06-30 13:53:18,000 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\HoAjDTuPwn\CAPE\1492_191241320173531372020 (size 0x2164)
2020-06-30 13:53:18,015 [root] DEBUG: DumpRegion: Dumped stack region from 0x00950000, size 0x3000.
2020-06-30 13:53:18,078 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 1492.
2020-06-30 13:53:29,562 [root] DEBUG: DLL unloaded from 0x0000000076F60000.
2020-06-30 13:53:31,296 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 1492.
2020-06-30 13:53:31,312 [root] DEBUG: set_caller_info: Adding region at 0x00960000 to caller regions list (kernel32::GetSystemTimeAsFileTime).
2020-06-30 13:53:31,359 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x96ffff
2020-06-30 13:53:31,359 [root] DEBUG: DumpMemory: Nothing to dump at 0x00960000!
2020-06-30 13:53:31,375 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00960000 size 0x10000.
2020-06-30 13:53:31,375 [root] DEBUG: DumpPEsInRange: Scanning range 0x960000 - 0x961000.
2020-06-30 13:53:31,375 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x960000-0x961000.
2020-06-30 13:53:31,406 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\HoAjDTuPwn\CAPE\1492_798943705414031372020 (size 0x235)
2020-06-30 13:53:31,406 [root] DEBUG: DumpRegion: Dumped stack region from 0x00960000, size 0x1000.
2020-06-30 13:53:31,406 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x360 amd local view 0x00970000 to global list.
2020-06-30 13:53:31,437 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x35c amd local view 0x00970000 to global list.
2020-06-30 13:53:39,328 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 1492.
2020-06-30 13:53:39,500 [root] DEBUG: DLL loaded at 0x72FB0000: C:\Windows\system32\shfolder (0x5000 bytes).
2020-06-30 13:53:39,812 [root] DEBUG: DLL loaded at 0x735B0000: C:\Windows\system32\sxs (0x5f000 bytes).
2020-06-30 13:53:39,828 [root] DEBUG: DLL loaded at 0x70F40000: C:\Windows\SysWOW64\wshom.ocx (0x21000 bytes).
2020-06-30 13:53:39,828 [root] DEBUG: DLL loaded at 0x70F20000: C:\Windows\SysWOW64\MPR (0x12000 bytes).
2020-06-30 13:53:39,843 [root] DEBUG: DLL loaded at 0x70EF0000: C:\Windows\SysWOW64\ScrRun (0x2a000 bytes).
2020-06-30 13:53:39,968 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x384 amd local view 0x00970000 to global list.
2020-06-30 13:53:40,203 [root] DEBUG: set_caller_info: Adding region at 0x02520000 to caller regions list (ntdll::LdrGetProcedureAddress).
2020-06-30 13:53:40,218 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x252ffff
2020-06-30 13:53:40,218 [root] DEBUG: DumpMemory: Nothing to dump at 0x02520000!
2020-06-30 13:53:40,218 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x02520000 size 0x10000.
2020-06-30 13:53:40,218 [root] DEBUG: DumpPEsInRange: Scanning range 0x2520000 - 0x2527000.
2020-06-30 13:53:40,218 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x2520000-0x2527000.
2020-06-30 13:53:40,249 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\HoAjDTuPwn\CAPE\1492_33830626404331372020 (size 0x675b)
2020-06-30 13:53:40,265 [root] DEBUG: DumpRegion: Dumped stack region from 0x02520000, size 0x7000.
2020-06-30 13:53:40,281 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x374 amd local view 0x00D10000 to global list.
2020-06-30 13:53:40,890 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x37c amd local view 0x6FCF0000 to global list.
2020-06-30 13:53:40,890 [root] DEBUG: DLL loaded at 0x6FCF0000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\b065f84b49a27b648015c08fab8cd00e\System.Xml.ni (0x53b000 bytes).
2020-06-30 13:53:41,031 [root] DEBUG: set_caller_info: Adding region at 0x00D40000 to caller regions list (shell32::SHGetFolderPathW).
2020-06-30 13:53:41,031 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0xd4ffff
2020-06-30 13:53:41,031 [root] DEBUG: DumpMemory: Nothing to dump at 0x00D40000!
2020-06-30 13:53:41,062 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00D40000 size 0x10000.
2020-06-30 13:53:41,062 [root] DEBUG: DumpPEsInRange: Scanning range 0xd40000 - 0xd41000.
2020-06-30 13:53:41,062 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0xd40000-0xd41000.
2020-06-30 13:53:41,093 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\HoAjDTuPwn\CAPE\1492_68468797614331372020 (size 0x516)
2020-06-30 13:53:41,109 [root] DEBUG: DumpRegion: Dumped stack region from 0x00D40000, size 0x1000.
2020-06-30 13:53:41,203 [root] DEBUG: DLL loaded at 0x70EE0000: C:\Windows\system32\vaultcli (0xc000 bytes).
2020-06-30 13:53:41,249 [root] DEBUG: DLL unloaded from 0x76700000.
2020-06-30 13:53:41,406 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xf8 amd local view 0x00000000055A0000 to global list.
2020-06-30 13:53:41,593 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xfd8 amd local view 0x0000000000B10000 to global list.
2020-06-30 13:53:41,625 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000BD0000 for section view with handle 0xfd8.
2020-06-30 13:53:41,687 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000B10000 for section view with handle 0xfd8.
2020-06-30 13:53:41,703 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000BD0000 for section view with handle 0xfd8.
2020-06-30 13:53:41,750 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000B10000 for section view with handle 0xfd8.
2020-06-30 13:53:41,750 [root] INFO: Announced starting service "b'VaultSvc'"
2020-06-30 13:53:41,765 [lib.api.process] INFO: Monitor config for process 476: C:\tmp2ssujfce\dll\476.ini
2020-06-30 13:53:41,781 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp2ssujfce\dll\iBpSWjFV.dll, loader C:\tmp2ssujfce\bin\XStdTGyP.exe
2020-06-30 13:53:41,890 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\zqHlkSfV.
2020-06-30 13:53:41,890 [root] DEBUG: Loader: Injecting process 476 (thread 0) with C:\tmp2ssujfce\dll\iBpSWjFV.dll.
2020-06-30 13:53:42,031 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 13:53:42,031 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2020-06-30 13:53:42,046 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:53:42,062 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 13:53:42,062 [root] INFO: Disabling sleep skipping.
2020-06-30 13:53:42,078 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 476 at 0x0000000070DD0000, image base 0x00000000FF5E0000, stack from 0x0000000000E46000-0x0000000000E50000
2020-06-30 13:53:42,078 [root] DEBUG: Commandline: C:\Windows\sysnative\services.exe.
2020-06-30 13:53:42,203 [root] WARNING: b'Unable to place hook on LockResource'
2020-06-30 13:53:42,203 [root] WARNING: b'Unable to hook LockResource'
2020-06-30 13:53:42,281 [root] INFO: Loaded monitor into process with pid 476
2020-06-30 13:53:42,281 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-30 13:53:42,281 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-30 13:53:42,281 [root] DEBUG: Successfully injected DLL C:\tmp2ssujfce\dll\iBpSWjFV.dll.
2020-06-30 13:53:42,703 [root] DEBUG: DLL loaded at 0x000007FEF6880000: C:\Windows\system32\VSSAPI (0x1b0000 bytes).
2020-06-30 13:53:42,718 [root] DEBUG: DLL loaded at 0x000007FEFADD0000: C:\Windows\system32\ATL (0x19000 bytes).
2020-06-30 13:53:42,781 [root] DEBUG: DLL loaded at 0x000007FEF67F0000: C:\Windows\system32\VssTrace (0x17000 bytes).
2020-06-30 13:53:42,796 [root] DEBUG: DLL loaded at 0x000007FEFA570000: C:\Windows\system32\samcli (0x14000 bytes).
2020-06-30 13:53:42,812 [root] DEBUG: DLL loaded at 0x000007FEFB560000: C:\Windows\system32\SAMLIB (0x1d000 bytes).
2020-06-30 13:53:42,859 [root] DEBUG: DLL loaded at 0x000007FEFB590000: C:\Windows\system32\netutils (0xc000 bytes).
2020-06-30 13:53:42,906 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1dc amd local view 0x0000000001140000 to global list.
2020-06-30 13:53:42,906 [root] DEBUG: DLL unloaded from 0x000007FEF67F0000.
2020-06-30 13:53:43,328 [root] INFO: Announced 64-bit process name: lsass.exe pid: 3556
2020-06-30 13:53:43,343 [lib.api.process] INFO: Monitor config for process 3556: C:\tmp2ssujfce\dll\3556.ini
2020-06-30 13:53:43,406 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp2ssujfce\dll\iBpSWjFV.dll, loader C:\tmp2ssujfce\bin\XStdTGyP.exe
2020-06-30 13:53:43,593 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\zqHlkSfV.
2020-06-30 13:53:43,625 [root] DEBUG: Loader: Injecting process 3556 (thread 3528) with C:\tmp2ssujfce\dll\iBpSWjFV.dll.
2020-06-30 13:53:43,671 [root] DEBUG: Process image base: 0x00000000FFC60000
2020-06-30 13:53:43,687 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp2ssujfce\dll\iBpSWjFV.dll.
2020-06-30 13:53:43,687 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-30 13:53:43,687 [root] DEBUG: Successfully injected DLL C:\tmp2ssujfce\dll\iBpSWjFV.dll.
2020-06-30 13:53:43,765 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 3556
2020-06-30 13:53:43,765 [root] DEBUG: CreateProcessHandler: using lpCommandLine: C:\Windows\system32\lsass.exe.
2020-06-30 13:53:43,765 [root] DEBUG: CreateProcessHandler: Injection info set for new process 3556, ImageBase: 0x00000000FFC60000
2020-06-30 13:53:43,843 [root] INFO: Announced 64-bit process name: lsass.exe pid: 3556
2020-06-30 13:53:43,843 [lib.api.process] INFO: Monitor config for process 3556: C:\tmp2ssujfce\dll\3556.ini
2020-06-30 13:53:43,890 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp2ssujfce\dll\iBpSWjFV.dll, loader C:\tmp2ssujfce\bin\XStdTGyP.exe
2020-06-30 13:53:43,984 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\zqHlkSfV.
2020-06-30 13:53:43,984 [root] DEBUG: Loader: Injecting process 3556 (thread 3528) with C:\tmp2ssujfce\dll\iBpSWjFV.dll.
2020-06-30 13:53:44,000 [root] DEBUG: Process image base: 0x00000000FFC60000
2020-06-30 13:53:44,000 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp2ssujfce\dll\iBpSWjFV.dll.
2020-06-30 13:53:44,000 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-06-30 13:53:44,000 [root] DEBUG: Successfully injected DLL C:\tmp2ssujfce\dll\iBpSWjFV.dll.
2020-06-30 13:53:44,015 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 3556
2020-06-30 13:53:44,046 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3556.
2020-06-30 13:53:44,078 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:53:44,093 [root] INFO: Disabling sleep skipping.
2020-06-30 13:53:44,093 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-30 13:53:44,125 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 3556 at 0x0000000070DD0000, image base 0x00000000FFC60000, stack from 0x00000000001D4000-0x00000000001E0000
2020-06-30 13:54:15,046 [root] DEBUG: DLL unloaded from 0x000007FEFD5B0000.
2020-06-30 13:54:21,078 [root] INFO: Process with pid 3556 has terminated
2020-06-30 13:54:29,968 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x24c amd local view 0x70ED0000 to global list.
2020-06-30 13:54:36,328 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 1492.
2020-06-30 13:54:36,843 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 1492.
2020-06-30 13:54:37,062 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x3c8 amd local view 0x6FB50000 to global list.
2020-06-30 13:54:37,296 [root] DEBUG: DLL loaded at 0x6FB50000: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\gdiplus (0x192000 bytes).
2020-06-30 13:54:37,390 [root] DEBUG: DLL loaded at 0x6F7C0000: C:\Windows\system32\WindowsCodecs (0x131000 bytes).
2020-06-30 13:55:32,234 [root] INFO: Analysis timeout hit, terminating analysis.
2020-06-30 13:55:32,249 [lib.api.process] INFO: Terminate event set for process 844
2020-06-30 13:55:32,249 [root] DEBUG: Terminate Event: Attempting to dump process 844
2020-06-30 13:55:32,359 [lib.api.process] INFO: Termination confirmed for process 844
2020-06-30 13:55:32,359 [root] INFO: Terminate event set for process 844.
2020-06-30 13:55:32,359 [lib.api.process] INFO: Terminate event set for process 1492
2020-06-30 13:55:32,406 [root] DEBUG: Terminate Event: Attempting to dump process 1492
2020-06-30 13:55:32,406 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00400000.
2020-06-30 13:55:32,500 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-30 13:55:32,500 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00400000.
2020-06-30 13:55:32,500 [root] DEBUG: DumpProcess: Error - entry point too big: 0x72f37cef, ignoring.
2020-06-30 13:55:32,687 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x45800.
2020-06-30 13:55:32,734 [root] DEBUG: Terminate Event: CAPE shutdown complete for process 1492
2020-06-30 13:55:32,781 [lib.api.process] INFO: Termination confirmed for process 1492
2020-06-30 13:55:32,781 [root] INFO: Terminate event set for process 1492.
2020-06-30 13:55:32,812 [root] DEBUG: Terminate Event: Attempting to dump process 592
2020-06-30 13:55:32,812 [lib.api.process] INFO: Terminate event set for process 592
2020-06-30 13:55:36,437 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 1492.
2020-06-30 13:55:36,718 [root] INFO: Added new file to list with pid None and path C:\Users\Louise\AppData\Local\Temp\log.tmp
2020-06-30 13:55:37,390 [root] DEBUG: DLL unloaded from 0x000007FEFD5B0000.
2020-06-30 13:55:37,859 [lib.api.process] INFO: Termination confirmed for process 592
2020-06-30 13:55:37,859 [root] INFO: Terminate event set for process 592.
2020-06-30 13:55:37,953 [lib.api.process] INFO: Terminate event set for process 4872
2020-06-30 13:55:37,953 [root] DEBUG: Terminate Event: Attempting to dump process 4872
2020-06-30 13:55:37,953 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00000000FFEF0000.
2020-06-30 13:55:37,953 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-30 13:55:37,953 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00000000FFEF0000.
2020-06-30 13:55:38,000 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000246C.
2020-06-30 13:55:38,109 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x6800.
2020-06-30 13:55:38,109 [lib.api.process] INFO: Termination confirmed for process 4872
2020-06-30 13:55:38,109 [root] INFO: Terminate event set for process 4872.
2020-06-30 13:55:38,109 [lib.api.process] INFO: Terminate event set for process 476
2020-06-30 13:55:38,281 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x50000.
2020-06-30 13:55:38,296 [root] DEBUG: Terminate Event: CAPE shutdown complete for process 476
2020-06-30 13:55:38,328 [lib.api.process] INFO: Termination confirmed for process 476
2020-06-30 13:55:38,328 [root] INFO: Terminate event set for process 476.
2020-06-30 13:55:38,328 [root] INFO: Created shutdown mutex.
2020-06-30 13:55:39,328 [root] INFO: Shutting down package.
2020-06-30 13:55:39,328 [root] INFO: Stopping auxiliary modules.
2020-06-30 13:55:39,375 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xf08 amd local view 0x00000000055A0000 to global list.
2020-06-30 13:55:39,421 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x5c8 amd local view 0x000000004A0B0000 to global list.
2020-06-30 13:55:39,437 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000BD0000 for section view with handle 0x5c8.
2020-06-30 13:55:39,453 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x000000004A0B0000 for section view with handle 0x5c8.
2020-06-30 13:55:39,453 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000BD0000 for section view with handle 0x5c8.
2020-06-30 13:55:39,625 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x000000004A900000 for section view with handle 0x5c8.
2020-06-30 13:55:39,625 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000BD0000 for section view with handle 0x5c8.
2020-06-30 13:55:39,625 [lib.common.results] WARNING: File C:\HoAjDTuPwn\bin\procmon.xml doesn't exist anymore
2020-06-30 13:55:39,640 [root] INFO: Finishing auxiliary modules.
2020-06-30 13:55:39,640 [root] INFO: Shutting down pipe server and dumping dropped files.
2020-06-30 13:55:39,640 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x000000004A880000 for section view with handle 0x5c8.
2020-06-30 13:55:39,640 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000BD0000 for section view with handle 0x5c8.
2020-06-30 13:55:39,656 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x000000004AB70000 for section view with handle 0x5c8.
2020-06-30 13:55:40,109 [root] WARNING: Folder at path "C:\HoAjDTuPwn\debugger" does not exist, skip.
2020-06-30 13:55:40,156 [root] WARNING: Monitor injection attempted but failed for process 3164.
2020-06-30 13:55:40,156 [root] WARNING: Monitor injection attempted but failed for process 3556.
2020-06-30 13:55:40,156 [root] INFO: Analysis completed.

Machine

Name Label Manager Started On Shutdown On
win7x64_1 win7x64_5 KVM 2020-06-30 13:59:01 2020-06-30 14:06:13

File Details

File Name 942XyvI5QYgF
File Size 412160 bytes
File Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
PE timestamp 2020-06-30 10:41:02
MD5 0b41d4a0669721c9ce59863deb1e5811
SHA1 404a42f7a91bebceb0e42d7b80162e38d679bd4d
SHA256 5ec9293c84bbb32bbdd575f86f9b9e161c6869df311f02096c280db1985c2c59
SHA512 b3fafde81bcaea9e2804f2d97e356d3f2058b3b534ba0568082fb142661c65027fd159cdfab0ac01603cd312fb8f8f63a574f68dd77c8d9cba5bd2e4b7a15293
CRC32 C2DA1816
Ssdeep 12288:2sQ8ogE11TxvUc+IRdNcoMG+AEc7oSo/xG:2sQ8811VvUc+svnMGrEc7oN/o
Download Download ZIP Resubmit sample

Signatures

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction - unpacking
Attempts to connect to a dead IP:Port (1 unique times)
IP: 23.54.113.244:443 (Netherlands)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Hit: PID 1492 trigged the Yara rule 'AgentTeslaV2'
Hit: PID 3464 trigged the Yara rule 'AgentTeslaV2'
Creates RWX memory
Guard pages use detected - possible anti-debugging.
A process attempted to delay the analysis task.
Process: 942XyvI5QYgF.exe tried to sleep 404.522 seconds, actually delayed analysis time by 0.0 seconds
Dynamic (imported) function loading detected
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: MSCOREE.DLL/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/_CorExeMain_RetAddr
DynamicLoader: mscoreei.dll/_CorExeMain
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: VERSION.dll/GetFileVersionInfoW
DynamicLoader: VERSION.dll/VerQueryValueW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionAndSpinCount
DynamicLoader: KERNEL32.dll/IsProcessorFeaturePresent
DynamicLoader: msvcrt.dll/_set_error_mode
DynamicLoader: msvcrt.dll/[email protected]@[email protected]
DynamicLoader: msvcrt.dll/_get_terminate
DynamicLoader: KERNEL32.dll/FindActCtxSectionStringW
DynamicLoader: KERNEL32.dll/GetSystemWindowsDirectoryW
DynamicLoader: MSCOREE.DLL/GetProcessExecutableHeap
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap_RetAddr
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap
DynamicLoader: mscorwks.dll/SetLoadedByMscoree
DynamicLoader: USER32.dll/GetProcessWindowStation
DynamicLoader: USER32.dll/GetUserObjectInformationW
DynamicLoader: mscorwks.dll/_CorExeMain
DynamicLoader: mscorwks.dll/GetCLRFunction
DynamicLoader: ADVAPI32.dll/RegisterTraceGuidsW
DynamicLoader: ADVAPI32.dll/UnregisterTraceGuids
DynamicLoader: ADVAPI32.dll/GetTraceLoggerHandle
DynamicLoader: ADVAPI32.dll/GetTraceEnableLevel
DynamicLoader: ADVAPI32.dll/GetTraceEnableFlags
DynamicLoader: ADVAPI32.dll/TraceEvent
DynamicLoader: MSCOREE.DLL/IEE
DynamicLoader: mscoreei.dll/IEE_RetAddr
DynamicLoader: mscoreei.dll/IEE
DynamicLoader: mscorwks.dll/IEE
DynamicLoader: MSCOREE.DLL/GetStartupFlags
DynamicLoader: mscoreei.dll/GetStartupFlags_RetAddr
DynamicLoader: mscoreei.dll/GetStartupFlags
DynamicLoader: MSCOREE.DLL/GetHostConfigurationFile
DynamicLoader: mscoreei.dll/GetHostConfigurationFile_RetAddr
DynamicLoader: mscoreei.dll/GetHostConfigurationFile
DynamicLoader: mscoreei.dll/GetCORVersion_RetAddr
DynamicLoader: mscoreei.dll/GetCORVersion
DynamicLoader: MSCOREE.DLL/GetCORSystemDirectory
DynamicLoader: mscoreei.dll/GetCORSystemDirectory_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream
DynamicLoader: ntdll.dll/RtlUnwind
DynamicLoader: KERNEL32.dll/IsWow64Process
DynamicLoader: KERNEL32.dll/GetSystemWindowsDirectoryW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/AddVectoredContinueHandler
DynamicLoader: KERNEL32.dll/RemoveVectoredContinueHandler
DynamicLoader: ADVAPI32.dll/ConvertSidToStringSidW
DynamicLoader: shell32.dll/SHGetFolderPathW
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/GetWriteWatch
DynamicLoader: KERNEL32.dll/ResetWriteWatch
DynamicLoader: KERNEL32.dll/CreateMemoryResourceNotification
DynamicLoader: KERNEL32.dll/QueryMemoryResourceNotification
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: KERNEL32.dll/QueryActCtxW
DynamicLoader: ole32.dll/CoGetContextToken
DynamicLoader: KERNEL32.dll/GetFullPathName
DynamicLoader: KERNEL32.dll/GetFullPathNameW
DynamicLoader: KERNEL32.dll/GetVersionEx
DynamicLoader: KERNEL32.dll/GetVersionExW
DynamicLoader: ADVAPI32.dll/CryptAcquireContextA
DynamicLoader: ADVAPI32.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/CryptCreateHash
DynamicLoader: ADVAPI32.dll/CryptDestroyHash
DynamicLoader: ADVAPI32.dll/CryptHashData
DynamicLoader: ADVAPI32.dll/CryptGetHashParam
DynamicLoader: ADVAPI32.dll/CryptImportKey
DynamicLoader: ADVAPI32.dll/CryptExportKey
DynamicLoader: ADVAPI32.dll/CryptGenKey
DynamicLoader: ADVAPI32.dll/CryptGetKeyParam
DynamicLoader: ADVAPI32.dll/CryptDestroyKey
DynamicLoader: ADVAPI32.dll/CryptVerifySignatureA
DynamicLoader: ADVAPI32.dll/CryptSignHashA
DynamicLoader: ADVAPI32.dll/CryptGetProvParam
DynamicLoader: ADVAPI32.dll/CryptGetUserKey
DynamicLoader: ADVAPI32.dll/CryptEnumProvidersA
DynamicLoader: MSCOREE.DLL/GetMetaDataInternalInterface
DynamicLoader: mscoreei.dll/GetMetaDataInternalInterface_RetAddr
DynamicLoader: mscoreei.dll/GetMetaDataInternalInterface
DynamicLoader: mscorwks.dll/GetMetaDataInternalInterface
DynamicLoader: mscorjit.dll/getJit
DynamicLoader: KERNEL32.dll/IsWow64Process
DynamicLoader: uxtheme.dll/IsAppThemed
DynamicLoader: uxtheme.dll/IsAppThemedW
DynamicLoader: KERNEL32.dll/CreateActCtx
DynamicLoader: KERNEL32.dll/CreateActCtxA
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: USER32.dll/RegisterWindowMessage
DynamicLoader: USER32.dll/RegisterWindowMessageW
DynamicLoader: ole32.dll/CoCreateGuid
DynamicLoader: KERNEL32.dll/GetUserDefaultUILanguage
DynamicLoader: KERNEL32.dll/SetErrorMode
DynamicLoader: KERNEL32.dll/GetFileAttributesEx
DynamicLoader: KERNEL32.dll/GetFileAttributesExW
DynamicLoader: mscoreei.dll/LoadLibraryShim_RetAddr
DynamicLoader: mscoreei.dll/LoadLibraryShim
DynamicLoader: culture.dll/ConvertLangIdToCultureName
DynamicLoader: KERNEL32.dll/GetCurrentProcessId
DynamicLoader: KERNEL32.dll/GetCurrentProcessIdW
DynamicLoader: KERNEL32.dll/FindAtom
DynamicLoader: KERNEL32.dll/FindAtomW
DynamicLoader: KERNEL32.dll/AddAtom
DynamicLoader: KERNEL32.dll/AddAtomW
DynamicLoader: MSCOREE.DLL/LoadLibraryShim
DynamicLoader: gdiplus.dll/GdiplusStartup
DynamicLoader: KERNEL32.dll/IsProcessorFeaturePresent
DynamicLoader: USER32.dll/GetWindowInfo
DynamicLoader: USER32.dll/GetAncestor
DynamicLoader: USER32.dll/GetMonitorInfoA
DynamicLoader: USER32.dll/EnumDisplayMonitors
DynamicLoader: USER32.dll/EnumDisplayDevicesA
DynamicLoader: GDI32.dll/ExtTextOutW
DynamicLoader: GDI32.dll/GdiIsMetaPrintDC
DynamicLoader: gdiplus.dll/GdipLoadImageFromStream
DynamicLoader: WindowsCodecs.dll/DllGetClassObject
DynamicLoader: gdiplus.dll/GdipImageForceValidation
DynamicLoader: gdiplus.dll/GdipGetImageType
DynamicLoader: gdiplus.dll/GdipGetImageRawFormat
DynamicLoader: gdiplus.dll/GdipGetImageWidth
DynamicLoader: gdiplus.dll/GdipGetImageHeight
DynamicLoader: gdiplus.dll/GdipBitmapGetPixel
DynamicLoader: KERNEL32.dll/GlobalMemoryStatusEx
DynamicLoader: shfolder.dll/SHGetFolderPath
DynamicLoader: shfolder.dll/SHGetFolderPathW
DynamicLoader: KERNEL32.dll/CopyFile
DynamicLoader: KERNEL32.dll/CopyFileW
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: KERNEL32.dll/GetCurrentProcessW
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/OpenProcessTokenW
DynamicLoader: KERNEL32.dll/LocalFree
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/GetTokenInformationW
DynamicLoader: KERNEL32.dll/LocalAlloc
DynamicLoader: KERNEL32.dll/LocalAllocW
DynamicLoader: KERNEL32.dll/lstrlen
DynamicLoader: KERNEL32.dll/lstrlenW
DynamicLoader: MSCOREE.DLL/ND_RI4
DynamicLoader: mscoreei.dll/ND_RI4_RetAddr
DynamicLoader: mscoreei.dll/ND_RI4
DynamicLoader: MSCOREE.DLL/ND_RU1
DynamicLoader: mscoreei.dll/ND_RU1_RetAddr
DynamicLoader: mscoreei.dll/ND_RU1
DynamicLoader: ADVAPI32.dll/LsaClose
DynamicLoader: ADVAPI32.dll/LsaFreeMemory
DynamicLoader: ADVAPI32.dll/LsaOpenPolicy
DynamicLoader: ADVAPI32.dll/LsaOpenPolicyW
DynamicLoader: ADVAPI32.dll/LsaLookupSids
DynamicLoader: ADVAPI32.dll/LsaLookupSidsW
DynamicLoader: KERNEL32.dll/GetTempPath
DynamicLoader: KERNEL32.dll/GetTempPathW
DynamicLoader: KERNEL32.dll/GetTempFileName
DynamicLoader: KERNEL32.dll/GetTempFileNameW
DynamicLoader: KERNEL32.dll/CreateFile
DynamicLoader: KERNEL32.dll/CreateFileW
DynamicLoader: KERNEL32.dll/GetFileType
DynamicLoader: KERNEL32.dll/WriteFile
DynamicLoader: KERNEL32.dll/LocalAlloc
DynamicLoader: KERNEL32.dll/RtlMoveMemory
DynamicLoader: KERNEL32.dll/RtlMoveMemoryW
DynamicLoader: shell32.dll/ShellExecuteEx
DynamicLoader: shell32.dll/ShellExecuteExW
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: KERNEL32.dll/DuplicateHandle
DynamicLoader: ole32.dll/CoWaitForMultipleHandles
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: ole32.dll/NdrOleInitializeExtension
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: KERNEL32.dll/DeleteFile
DynamicLoader: KERNEL32.dll/DeleteFileW
DynamicLoader: KERNEL32.dll/CreateProcess
DynamicLoader: KERNEL32.dll/CreateProcessW
DynamicLoader: KERNEL32.dll/GetThreadContext
DynamicLoader: KERNEL32.dll/ReadProcessMemory
DynamicLoader: KERNEL32.dll/VirtualAllocEx
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValue
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValueW
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/OpenProcessTokenW
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivileges
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivilegesW
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: PSAPI.DLL/EnumProcesses
DynamicLoader: PSAPI.DLL/EnumProcessesW
DynamicLoader: KERNEL32.dll/OpenProcess
DynamicLoader: KERNEL32.dll/OpenProcessW
DynamicLoader: KERNEL32.dll/TerminateProcess
DynamicLoader: KERNEL32.dll/TerminateProcessW
DynamicLoader: KERNEL32.dll/WriteProcessMemory
DynamicLoader: KERNEL32.dll/SetThreadContext
DynamicLoader: KERNEL32.dll/ResumeThread
DynamicLoader: KERNEL32.dll/DeleteAtom
DynamicLoader: KERNEL32.dll/DeleteAtomW
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/UnregisterTraceGuids
DynamicLoader: ADVAPI32.dll/UnregisterTraceGuids
DynamicLoader: comctl32.dll/
DynamicLoader: KERNEL32.dll/CreateActCtxW
DynamicLoader: KERNEL32.dll/AddRefActCtx
DynamicLoader: KERNEL32.dll/ReleaseActCtx
DynamicLoader: KERNEL32.dll/ActivateActCtx
DynamicLoader: KERNEL32.dll/DeactivateActCtx
DynamicLoader: KERNEL32.dll/GetCurrentActCtx
DynamicLoader: KERNEL32.dll/QueryActCtxW
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/EventUnregister
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: VERSION.dll/GetFileVersionInfoW
DynamicLoader: VERSION.dll/VerQueryValueW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: SspiCli.dll/GetUserNameExW
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: pcwum.dll/PerfDeleteInstance
DynamicLoader: pcwum.dll/PerfStopProvider
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: ADVAPI32.dll/RegisterEventSourceW
DynamicLoader: ADVAPI32.dll/ReportEventW
DynamicLoader: ADVAPI32.dll/DeregisterEventSource
DynamicLoader: ole32.dll/CoDisconnectObject
DynamicLoader: wbemcore.dll/Shutdown
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: ole32.dll/CoDisconnectObject
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: kernel32.dll/RegDeleteValueW
DynamicLoader: kernel32.dll/GetProductInfo
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: kernel32.dll/GetProductInfo
DynamicLoader: kernel32.dll/GetProductInfo
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: MSCOREE.DLL/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/_CorExeMain_RetAddr
DynamicLoader: mscoreei.dll/_CorExeMain
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: VERSION.dll/GetFileVersionInfoW
DynamicLoader: VERSION.dll/VerQueryValueW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionAndSpinCount
DynamicLoader: KERNEL32.dll/IsProcessorFeaturePresent
DynamicLoader: msvcrt.dll/_set_error_mode
DynamicLoader: msvcrt.dll/[email protected]@[email protected]
DynamicLoader: msvcrt.dll/_get_terminate
DynamicLoader: KERNEL32.dll/FindActCtxSectionStringW
DynamicLoader: KERNEL32.dll/GetSystemWindowsDirectoryW
DynamicLoader: MSCOREE.DLL/GetProcessExecutableHeap
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap_RetAddr
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap
DynamicLoader: mscorwks.dll/SetLoadedByMscoree
DynamicLoader: USER32.dll/GetProcessWindowStation
DynamicLoader: USER32.dll/GetUserObjectInformationW
DynamicLoader: mscorwks.dll/_CorExeMain
DynamicLoader: mscorwks.dll/GetCLRFunction
DynamicLoader: ADVAPI32.dll/RegisterTraceGuidsW
DynamicLoader: ADVAPI32.dll/UnregisterTraceGuids
DynamicLoader: ADVAPI32.dll/GetTraceLoggerHandle
DynamicLoader: ADVAPI32.dll/GetTraceEnableLevel
DynamicLoader: ADVAPI32.dll/GetTraceEnableFlags
DynamicLoader: ADVAPI32.dll/TraceEvent
DynamicLoader: MSCOREE.DLL/IEE
DynamicLoader: mscoreei.dll/IEE_RetAddr
DynamicLoader: mscoreei.dll/IEE
DynamicLoader: mscorwks.dll/IEE
DynamicLoader: MSCOREE.DLL/GetStartupFlags
DynamicLoader: mscoreei.dll/GetStartupFlags_RetAddr
DynamicLoader: mscoreei.dll/GetStartupFlags
DynamicLoader: MSCOREE.DLL/GetHostConfigurationFile
DynamicLoader: mscoreei.dll/GetHostConfigurationFile_RetAddr
DynamicLoader: mscoreei.dll/GetHostConfigurationFile
DynamicLoader: mscoreei.dll/GetCORVersion_RetAddr
DynamicLoader: mscoreei.dll/GetCORVersion
DynamicLoader: MSCOREE.DLL/GetCORSystemDirectory
DynamicLoader: mscoreei.dll/GetCORSystemDirectory_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream
DynamicLoader: ntdll.dll/RtlUnwind
DynamicLoader: KERNEL32.dll/IsWow64Process
DynamicLoader: KERNEL32.dll/GetSystemWindowsDirectoryW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/AddVectoredContinueHandler
DynamicLoader: KERNEL32.dll/RemoveVectoredContinueHandler
DynamicLoader: ADVAPI32.dll/ConvertSidToStringSidW
DynamicLoader: shell32.dll/SHGetFolderPathW
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/GetWriteWatch
DynamicLoader: KERNEL32.dll/ResetWriteWatch
DynamicLoader: KERNEL32.dll/CreateMemoryResourceNotification
DynamicLoader: KERNEL32.dll/QueryMemoryResourceNotification
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: KERNEL32.dll/QueryActCtxW
DynamicLoader: ole32.dll/CoGetContextToken
DynamicLoader: KERNEL32.dll/GetFullPathName
DynamicLoader: KERNEL32.dll/GetFullPathNameW
DynamicLoader: KERNEL32.dll/GetVersionEx
DynamicLoader: KERNEL32.dll/GetVersionExW
DynamicLoader: ADVAPI32.dll/CryptAcquireContextA
DynamicLoader: ADVAPI32.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/CryptCreateHash
DynamicLoader: ADVAPI32.dll/CryptDestroyHash
DynamicLoader: ADVAPI32.dll/CryptHashData
DynamicLoader: ADVAPI32.dll/CryptGetHashParam
DynamicLoader: ADVAPI32.dll/CryptImportKey
DynamicLoader: ADVAPI32.dll/CryptExportKey
DynamicLoader: ADVAPI32.dll/CryptGenKey
DynamicLoader: ADVAPI32.dll/CryptGetKeyParam
DynamicLoader: ADVAPI32.dll/CryptDestroyKey
DynamicLoader: ADVAPI32.dll/CryptVerifySignatureA
DynamicLoader: ADVAPI32.dll/CryptSignHashA
DynamicLoader: ADVAPI32.dll/CryptGetProvParam
DynamicLoader: ADVAPI32.dll/CryptGetUserKey
DynamicLoader: ADVAPI32.dll/CryptEnumProvidersA
DynamicLoader: MSCOREE.DLL/GetMetaDataInternalInterface
DynamicLoader: mscoreei.dll/GetMetaDataInternalInterface_RetAddr
DynamicLoader: mscoreei.dll/GetMetaDataInternalInterface
DynamicLoader: mscorwks.dll/GetMetaDataInternalInterface
DynamicLoader: mscorjit.dll/getJit
DynamicLoader: KERNEL32.dll/IsWow64Process
DynamicLoader: KERNEL32.dll/GetUserDefaultUILanguage
DynamicLoader: KERNEL32.dll/SetErrorMode
DynamicLoader: KERNEL32.dll/GetFileAttributesEx
DynamicLoader: KERNEL32.dll/GetFileAttributesExW
DynamicLoader: bcrypt.dll/BCryptGetFipsAlgorithmMode
DynamicLoader: KERNEL32.dll/lstrlen
DynamicLoader: KERNEL32.dll/lstrlenW
DynamicLoader: KERNEL32.dll/GetModuleHandle
DynamicLoader: KERNEL32.dll/GetModuleHandleW
DynamicLoader: KERNEL32.dll/GetProcAddress
DynamicLoader: USER32.dll/DefWindowProcW
DynamicLoader: GDI32.dll/GetStockObject
DynamicLoader: USER32.dll/RegisterClass
DynamicLoader: USER32.dll/RegisterClassW
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: USER32.dll/CreateWindowEx
DynamicLoader: USER32.dll/CreateWindowExW
DynamicLoader: USER32.dll/SetWindowLong
DynamicLoader: USER32.dll/SetWindowLongW
DynamicLoader: USER32.dll/GetWindowLong
DynamicLoader: USER32.dll/GetWindowLongW
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: KERNEL32.dll/GetCurrentThread
DynamicLoader: KERNEL32.dll/DuplicateHandle
DynamicLoader: KERNEL32.dll/GetCurrentThreadId
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegOpenKeyEx
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueEx
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: USER32.dll/SetWindowLong
DynamicLoader: USER32.dll/SetWindowLongW
DynamicLoader: USER32.dll/CallWindowProc
DynamicLoader: USER32.dll/CallWindowProcW
DynamicLoader: USER32.dll/RegisterWindowMessage
DynamicLoader: USER32.dll/RegisterWindowMessageW
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: KERNEL32.dll/GetCurrentProcessId
DynamicLoader: KERNEL32.dll/GetCurrentProcessIdW
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValue
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValueW
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/OpenProcessTokenW
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivileges
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivilegesW
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: ntdll.dll/NtQuerySystemInformation
DynamicLoader: ntdll.dll/NtQuerySystemInformationW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptCreateHash
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoGetObjectContext
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: ole32.dll/NdrOleInitializeExtension
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: ole32.dll/MkParseDisplayName
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: KERNEL32.dll/CreateEvent
DynamicLoader: KERNEL32.dll/CreateEventW
DynamicLoader: KERNEL32.dll/SwitchToThread
DynamicLoader: KERNEL32.dll/SetEvent
DynamicLoader: ole32.dll/CoWaitForMultipleHandles
DynamicLoader: ole32.dll/IIDFromString
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: KERNEL32.dll/LoadLibrary
DynamicLoader: KERNEL32.dll/LoadLibraryA
DynamicLoader: KERNEL32.dll/GetProcAddress
DynamicLoader: wminet_utils.dll/ResetSecurity
DynamicLoader: wminet_utils.dll/SetSecurity
DynamicLoader: wminet_utils.dll/BlessIWbemServices
DynamicLoader: wminet_utils.dll/BlessIWbemServicesObject
DynamicLoader: wminet_utils.dll/GetPropertyHandle
DynamicLoader: wminet_utils.dll/WritePropertyValue
DynamicLoader: wminet_utils.dll/Clone
DynamicLoader: wminet_utils.dll/VerifyClientKey
DynamicLoader: wminet_utils.dll/GetQualifierSet
DynamicLoader: wminet_utils.dll/Get
DynamicLoader: wminet_utils.dll/Put
DynamicLoader: wminet_utils.dll/Delete
DynamicLoader: wminet_utils.dll/GetNames
DynamicLoader: wminet_utils.dll/BeginEnumeration
DynamicLoader: wminet_utils.dll/Next
DynamicLoader: wminet_utils.dll/EndEnumeration
DynamicLoader: wminet_utils.dll/GetPropertyQualifierSet
DynamicLoader: wminet_utils.dll/Clone
DynamicLoader: wminet_utils.dll/GetObjectText
DynamicLoader: wminet_utils.dll/SpawnDerivedClass
DynamicLoader: wminet_utils.dll/SpawnInstance
DynamicLoader: wminet_utils.dll/CompareTo
DynamicLoader: wminet_utils.dll/GetPropertyOrigin
DynamicLoader: wminet_utils.dll/InheritsFrom
DynamicLoader: wminet_utils.dll/GetMethod
DynamicLoader: wminet_utils.dll/PutMethod
DynamicLoader: wminet_utils.dll/DeleteMethod
DynamicLoader: wminet_utils.dll/BeginMethodEnumeration
DynamicLoader: wminet_utils.dll/NextMethod
DynamicLoader: wminet_utils.dll/EndMethodEnumeration
DynamicLoader: wminet_utils.dll/GetMethodQualifierSet
DynamicLoader: wminet_utils.dll/GetMethodOrigin
DynamicLoader: wminet_utils.dll/QualifierSet_Get
DynamicLoader: wminet_utils.dll/QualifierSet_Put
DynamicLoader: wminet_utils.dll/QualifierSet_Delete
DynamicLoader: wminet_utils.dll/QualifierSet_GetNames
DynamicLoader: wminet_utils.dll/QualifierSet_BeginEnumeration
DynamicLoader: wminet_utils.dll/QualifierSet_Next
DynamicLoader: wminet_utils.dll/QualifierSet_EndEnumeration
DynamicLoader: wminet_utils.dll/GetCurrentApartmentType
DynamicLoader: wminet_utils.dll/GetDemultiplexedStub
DynamicLoader: wminet_utils.dll/CreateInstanceEnumWmi
DynamicLoader: wminet_utils.dll/CreateClassEnumWmi
DynamicLoader: wminet_utils.dll/ExecQueryWmi
DynamicLoader: wminet_utils.dll/ExecNotificationQueryWmi
DynamicLoader: wminet_utils.dll/PutInstanceWmi
DynamicLoader: wminet_utils.dll/PutClassWmi
DynamicLoader: wminet_utils.dll/CloneEnumWbemClassObject
DynamicLoader: wminet_utils.dll/ConnectServerWmi
DynamicLoader: wminet_utils.dll/GetErrorInfo
DynamicLoader: wminet_utils.dll/Initialize
DynamicLoader: OLEAUT32.dll/SysStringLen
DynamicLoader: KERNEL32.dll/ZeroMemory
DynamicLoader: KERNEL32.dll/ZeroMemoryA
DynamicLoader: KERNEL32.dll/RtlZeroMemory
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: OLEAUT32.dll/
DynamicLoader: CRYPTSP.dll/CryptHashData
DynamicLoader: CRYPTSP.dll/CryptGetHashParam
DynamicLoader: CRYPTSP.dll/CryptDestroyHash
DynamicLoader: KERNEL32.dll/GetEnvironmentVariable
DynamicLoader: KERNEL32.dll/GetEnvironmentVariableW
DynamicLoader: ADVAPI32.dll/GetUserName
DynamicLoader: ADVAPI32.dll/GetUserNameW
DynamicLoader: KERNEL32.dll/GetComputerName
DynamicLoader: KERNEL32.dll/GetComputerNameW
DynamicLoader: KERNEL32.dll/CreateIoCompletionPort
DynamicLoader: KERNEL32.dll/PostQueuedCompletionStatus
DynamicLoader: ntdll.dll/NtQueryInformationThread
DynamicLoader: ntdll.dll/NtQuerySystemInformation
DynamicLoader: ntdll.dll/NtGetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetSystemTimeAsFileTime
DynamicLoader: USER32.dll/GetLastInputInfo
DynamicLoader: shfolder.dll/SHGetFolderPath
DynamicLoader: shfolder.dll/SHGetFolderPathW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: KERNEL32.dll/FindFirstFile
DynamicLoader: KERNEL32.dll/FindFirstFileW
DynamicLoader: KERNEL32.dll/FindClose
DynamicLoader: OLEAUT32.dll/
DynamicLoader: KERNEL32.dll/CreateFile
DynamicLoader: KERNEL32.dll/CreateFileW
DynamicLoader: ole32.dll/CLSIDFromProgIDEx
DynamicLoader: sxs.dll/SxsLookupClrGuid
DynamicLoader: KERNEL32.dll/ReleaseActCtx
DynamicLoader: sxs.dll/SxsOleAut32RedirectTypeLibrary
DynamicLoader: ADVAPI32.dll/RegOpenKeyW
DynamicLoader: ADVAPI32.dll/RegQueryValueW
DynamicLoader: sxs.dll/SxsOleAut32MapConfiguredClsidToReferenceClsid
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: KERNEL32.dll/GetFileType
DynamicLoader: KERNEL32.dll/ReadFile
DynamicLoader: KERNEL32.dll/GetFileSize
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: KERNEL32.dll/GetACP
DynamicLoader: KERNEL32.dll/UnmapViewOfFile
DynamicLoader: KERNEL32.dll/FindNextFile
DynamicLoader: KERNEL32.dll/FindNextFileW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: vaultcli.dll/VaultEnumerateVaults
DynamicLoader: mscoreei.dll/LoadLibraryShim_RetAddr
DynamicLoader: mscoreei.dll/LoadLibraryShim
DynamicLoader: culture.dll/ConvertLangIdToCultureName
DynamicLoader: USER32.dll/SetClipboardViewer
DynamicLoader: USER32.dll/SetClipboardViewerW
DynamicLoader: ole32.dll/OleInitialize
DynamicLoader: ole32.dll/OleGetClipboard
DynamicLoader: KERNEL32.dll/GlobalLock
DynamicLoader: KERNEL32.dll/GlobalUnlock
DynamicLoader: KERNEL32.dll/GlobalFree
DynamicLoader: USER32.dll/SendMessage
DynamicLoader: USER32.dll/SendMessageW
DynamicLoader: USER32.dll/SetWindowsHookEx
DynamicLoader: USER32.dll/SetWindowsHookExW
DynamicLoader: USER32.dll/GetSystemMetrics
DynamicLoader: USER32.dll/GetDC
DynamicLoader: USER32.dll/EnumDisplayMonitors
DynamicLoader: USER32.dll/GetMonitorInfo
DynamicLoader: USER32.dll/GetMonitorInfoW
DynamicLoader: GDI32.dll/GetDeviceCaps
DynamicLoader: USER32.dll/ReleaseDC
DynamicLoader: USER32.dll/GetProcessWindowStation
DynamicLoader: USER32.dll/GetUserObjectInformation
DynamicLoader: USER32.dll/GetUserObjectInformationA
DynamicLoader: KERNEL32.dll/SetConsoleCtrlHandler
DynamicLoader: KERNEL32.dll/SetConsoleCtrlHandlerW
DynamicLoader: KERNEL32.dll/GetModuleHandle
DynamicLoader: KERNEL32.dll/GetModuleHandleW
DynamicLoader: USER32.dll/GetClassInfo
DynamicLoader: USER32.dll/GetClassInfoW
DynamicLoader: USER32.dll/RegisterClass
DynamicLoader: USER32.dll/RegisterClassW
DynamicLoader: USER32.dll/CreateWindowEx
DynamicLoader: USER32.dll/CreateWindowExW
DynamicLoader: USER32.dll/DefWindowProc
DynamicLoader: USER32.dll/DefWindowProcW
DynamicLoader: USER32.dll/MsgWaitForMultipleObjectsEx
DynamicLoader: KERNEL32.dll/GetCurrentProcessId
DynamicLoader: KERNEL32.dll/GetCurrentProcessIdW
DynamicLoader: KERNEL32.dll/FindAtom
DynamicLoader: KERNEL32.dll/FindAtomW
DynamicLoader: KERNEL32.dll/AddAtom
DynamicLoader: KERNEL32.dll/AddAtomW
DynamicLoader: MSCOREE.DLL/LoadLibraryShim
DynamicLoader: gdiplus.dll/GdiplusStartup
DynamicLoader: KERNEL32.dll/IsProcessorFeaturePresent
DynamicLoader: USER32.dll/GetWindowInfo
DynamicLoader: USER32.dll/GetAncestor
DynamicLoader: USER32.dll/GetMonitorInfoA
DynamicLoader: USER32.dll/EnumDisplayMonitors
DynamicLoader: USER32.dll/EnumDisplayDevicesA
DynamicLoader: GDI32.dll/ExtTextOutW
DynamicLoader: GDI32.dll/GdiIsMetaPrintDC
DynamicLoader: gdiplus.dll/GdipCreateBitmapFromScan0
DynamicLoader: gdiplus.dll/GdipGetImageEncodersSize
DynamicLoader: KERNEL32.dll/LocalAlloc
DynamicLoader: gdiplus.dll/GdipGetImageEncoders
DynamicLoader: KERNEL32.dll/lstrlenW
DynamicLoader: KERNEL32.dll/lstrlenWW
DynamicLoader: KERNEL32.dll/RtlMoveMemory
DynamicLoader: KERNEL32.dll/RtlMoveMemoryW
DynamicLoader: KERNEL32.dll/LocalFree
DynamicLoader: MSCOREE.DLL/ND_WI4
DynamicLoader: mscoreei.dll/ND_WI4_RetAddr
DynamicLoader: mscoreei.dll/ND_WI4
DynamicLoader: gdiplus.dll/GdipGetImagePixelFormat
DynamicLoader: gdiplus.dll/GdipGetImageGraphicsContext
DynamicLoader: USER32.dll/GetDC
DynamicLoader: GDI32.dll/GetCurrentObject
DynamicLoader: gdiplus.dll/GdipGetDC
DynamicLoader: GDI32.dll/BitBlt
DynamicLoader: gdiplus.dll/GdipReleaseDC
DynamicLoader: USER32.dll/ReleaseDC
DynamicLoader: gdiplus.dll/GdipSaveImageToStream
DynamicLoader: WindowsCodecs.dll/DllGetClassObject
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoGetObjectContext
DynamicLoader: USER32.dll/GetClientRect
DynamicLoader: USER32.dll/GetWindowRect
DynamicLoader: USER32.dll/GetParent
DynamicLoader: ole32.dll/CoRegisterMessageFilter
DynamicLoader: USER32.dll/PeekMessage
DynamicLoader: USER32.dll/PeekMessageW
DynamicLoader: USER32.dll/WaitMessage
DynamicLoader: KERNEL32.dll/GetTempPath
DynamicLoader: KERNEL32.dll/GetTempPathW
DynamicLoader: USER32.dll/IsWindowUnicode
DynamicLoader: USER32.dll/GetMessageW
DynamicLoader: USER32.dll/TranslateMessage
DynamicLoader: USER32.dll/DispatchMessageW
DynamicLoader: gdiplus.dll/GdipDisposeImage
DynamicLoader: gdiplus.dll/GdipDeleteGraphics
DynamicLoader: KERNEL32.dll/SetFilePointer
DynamicLoader: KERNEL32.dll/WriteFile
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: kernel32.dll/ResolveDelayLoadedAPI
DynamicLoader: VSSAPI.DLL/CreateWriter
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ADVAPI32.dll/LookupAccountNameW
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: samcli.dll/NetLocalGroupGetMembers
DynamicLoader: SAMLIB.dll/SamConnect
DynamicLoader: RPCRT4.dll/NdrClientCall3
DynamicLoader: RPCRT4.dll/RpcStringBindingComposeW
DynamicLoader: RPCRT4.dll/RpcBindingFromStringBindingW
DynamicLoader: RPCRT4.dll/RpcStringFreeW
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: SAMLIB.dll/SamOpenDomain
DynamicLoader: SAMLIB.dll/SamLookupNamesInDomain
DynamicLoader: SAMLIB.dll/SamOpenAlias
DynamicLoader: SAMLIB.dll/SamFreeMemory
DynamicLoader: SAMLIB.dll/SamCloseHandle
DynamicLoader: SAMLIB.dll/SamGetMembersInAlias
DynamicLoader: netutils.dll/NetApiBufferFree
DynamicLoader: ole32.dll/CoCreateGuid
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: ole32.dll/CoTaskMemRealloc
DynamicLoader: ADVAPI32.dll/RegisterEventSourceW
DynamicLoader: ADVAPI32.dll/ReportEventW
DynamicLoader: ADVAPI32.dll/DeregisterEventSource
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
A process created a hidden window
Process: 942XyvI5QYgF.exe -> schtasks.exe
CAPE extracted potentially suspicious content
942XyvI5QYgF.exe: Unpacked Shellcode
942XyvI5QYgF.exe: Unpacked Shellcode
942XyvI5QYgF.exe: Unpacked Shellcode
942XyvI5QYgF.exe: AgentTeslaV2 Payload: 32-bit executable
942XyvI5QYgF.exe: AgentTeslaV2
942XyvI5QYgF.exe: Injected Shellcode/Data
942XyvI5QYgF.exe: Unpacked Shellcode
942XyvI5QYgF.exe: Unpacked Shellcode
942XyvI5QYgF.exe: Unpacked Shellcode
942XyvI5QYgF.exe: Unpacked Shellcode
942XyvI5QYgF.exe: Unpacked Shellcode
942XyvI5QYgF.exe: Unpacked Shellcode
942XyvI5QYgF.exe: Unpacked Shellcode
942XyvI5QYgF.exe: Unpacked Shellcode
942XyvI5QYgF.exe: Unpacked Shellcode
942XyvI5QYgF.exe: Unpacked Shellcode
942XyvI5QYgF.exe: Injected Shellcode/Data
942XyvI5QYgF.exe: Unpacked Shellcode
Queries or connects to DNS-Over-HTTPS/DNS-Over-TLS domain or IP address
ip: 1.1.1.1
The binary likely contains encrypted or compressed data.
section: name: .text, entropy: 7.91, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00060200, virtual_size: 0x00060188
Authenticode signature is invalid
authenticode error: No signature found. SignTool Error File not valid C\Users\Louise\AppData\Local\Temp\942XyvI5QYgF
Uses Windows utilities for basic functionality
command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VosWhPpNqq" /XML "C:\Users\Louise\AppData\Local\Temp\tmp1A91.tmp"
command: schtasks.exe /Create /TN "Updates\VosWhPpNqq" /XML "C:\Users\Louise\AppData\Local\Temp\tmp1A91.tmp"
Behavioural detection: Injection (Process Hollowing)
Injection: 942XyvI5QYgF.exe(3464) -> 942XyvI5QYgF.exe(1492)
Executed a process and injected code into it, probably while unpacking
Injection: 942XyvI5QYgF.exe(3464) -> 942XyvI5QYgF.exe(1492)
Sniffs keystrokes
SetWindowsHookExW: Process: 942XyvI5QYgF.exe(1492)
Behavioural detection: Injection (inter-process)
Behavioural detection: Injection with CreateRemoteThread in a remote process
Attempts to repeatedly call a single API many times in order to delay analysis time
Spam: services.exe (476) called API GetSystemTimeAsFileTime 650760 times
Steals private information from local Internet browsers
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db
file: C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Default\Login Data
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\profiles.ini
CAPE detected the AgentTeslaV2 malware family
File has been identified by 13 Antiviruses on VirusTotal as malicious
DrWeb: Trojan.InjectNET.14
Cylance: Unsafe
Sangfor: Malware
BitDefenderTheta: Gen:[email protected]
APEX: Malicious
Kaspersky: UDS:DangerousObject.Multi.Generic
Endgame: malicious (high confidence)
Trapmine: malicious.moderate.ml.score
Cyren: W32/MSIL_Troj.WM.gen!Eldorado
Microsoft: Trojan:Win32/Wacatac.C!ml
ZoneAlarm: UDS:DangerousObject.Multi.Generic
Malwarebytes: Trojan.MalPack.ADC
ESET-NOD32: a variant of MSIL/Kryptik.WPS
Creates a copy of itself
copy: C:\Users\Louise\AppData\Roaming\VosWhPpNqq.exe
Harvests credentials from local FTP client softwares
file: C:\Users\Louise\AppData\Roaming\FileZilla\recentservers.xml
file: C:\Users\Louise\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\*.xml
file: C:\Users\Louise\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
file: C:\Users\Louise\AppData\Roaming\FTPGetter\servers.xml
file: C:\Users\Louise\AppData\Roaming\Ipswitch\WS_FTP\Sites\ws_ftp.ini
file: C:\cftp\Ftplist.txt
key: HKEY_CURRENT_USER\Software\FTPWare\COREFTP\Sites
Harvests information related to installed mail clients
file: C:\Users\Louise\AppData\Roaming\Thunderbird\profiles.ini
key: HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
key: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
key: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Created network traffic indicative of malicious activity
signature: ET JA3 Hash - Possible Malware - Various Eitest
signature: ET JA3 Hash - Possible Malware - RigEK

Screenshots


Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
Y 52.109.76.6 [VT] Ireland
Y 23.54.113.244 [VT] Netherlands
Y 13.107.42.23 [VT] United States
Y 1.1.1.1 [VT] Australia

DNS

No domains contacted.


Summary

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Louise\AppData\Local\Temp\942XyvI5QYgF.exe.config
C:\Users\Louise\AppData\Local\Temp\942XyvI5QYgF.exe
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-2.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\942XyvI5QYgF.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Louise\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Louise\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index39c.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\f8420d8c6ede777377fcff48a4beaa2a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Louise
C:\Users\Louise\AppData
C:\Users\Louise\AppData\Local
C:\Users\Louise\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
C:\Users\Louise\AppData\Local\Temp\942XyvI5QYgF.config
C:\Users\Louise\AppData\Local\Temp\942XyvI5QYgF.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol214.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\0a65164b17e5c64bacdc694ea2439c43\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\175df210b784212def386595c25caefb\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\5669120680b52abf616f3876387ca2cc\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Louise\AppData\Local\Temp\en-US\XhsNyehgHEUoht.resources.dll
C:\Users\Louise\AppData\Local\Temp\en-US\XhsNyehgHEUoht.resources\XhsNyehgHEUoht.resources.dll
C:\Users\Louise\AppData\Local\Temp\en-US\XhsNyehgHEUoht.resources.exe
C:\Users\Louise\AppData\Local\Temp\en-US\XhsNyehgHEUoht.resources\XhsNyehgHEUoht.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
C:\Windows\Globalization\en.nlp
C:\Users\Louise\AppData\Local\Temp\en\XhsNyehgHEUoht.resources.dll
C:\Users\Louise\AppData\Local\Temp\en\XhsNyehgHEUoht.resources\XhsNyehgHEUoht.resources.dll
C:\Users\Louise\AppData\Local\Temp\en\XhsNyehgHEUoht.resources.exe
C:\Users\Louise\AppData\Local\Temp\en\XhsNyehgHEUoht.resources\XhsNyehgHEUoht.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\GdiPlus.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\4ac828c8c4c76f3ba59f8f9c7dab1cb3\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI
C:\Users\Louise\AppData\Local\Temp\en-US\Lazarus.resources.dll
C:\Users\Louise\AppData\Local\Temp\en-US\Lazarus.resources\Lazarus.resources.dll
C:\Users\Louise\AppData\Local\Temp\en-US\Lazarus.resources.exe
C:\Users\Louise\AppData\Local\Temp\en-US\Lazarus.resources\Lazarus.resources.exe
C:\Users\Louise\AppData\Local\Temp\en\Lazarus.resources.dll
C:\Users\Louise\AppData\Local\Temp\en\Lazarus.resources\Lazarus.resources.dll
C:\Users\Louise\AppData\Local\Temp\en\Lazarus.resources.exe
C:\Users\Louise\AppData\Local\Temp\en\Lazarus.resources\Lazarus.resources.exe
C:\Users\Louise\AppData\Roaming\VosWhPpNqq.exe
C:\Users\Louise\AppData\Local\Temp\tmp1A91.tmp
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\shell32.dll
\??\MountPointManager
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.3464.29029000
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.3464.29029000
C:\Users\Louise\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.3464.29029031
C:\Windows\Globalization\Sorting\sortdefault.nls
\Device\KsecDD
C:\Windows\sysnative\Tasks
C:\Windows\sysnative\Tasks\*
C:\Windows\sysnative\Tasks\AutoKMS
C:\Windows\sysnative\Tasks\Updates\VosWhPpNqq
C:\Windows\sysnative\Tasks\Updates
C:\Windows\sysnative\Tasks\Updates\
C:\Windows\SysWOW64\net.exe
C:\Windows\SysWOW64
C:\Windows\AppPatch\sysmain.sdb
C:\Windows\SysWOW64\
C:\Windows\SysWOW64\*.*
C:\Windows\SysWOW64\net1.exe
C:\Windows\SysWOW64\ui\SwDRM.dll
C:\Windows\Temp\fwtsqmfile00.sqm
C:\Windows\Temp\fwtsqmfile01.sqm
C:\Users\Louise\AppData\Local\Temp\wctB32F.tmp
C:\Users\Louise\AppData\Local\Temp\wctB32F.tmp\
C:\Users\Louise\AppData\Local\Temp\
C:\Users\Louise\AppData\Local\
C:\Users\Louise\AppData\
C:\Users\Louise\
C:\Users\
C:
\??\Volume{80b5a658-2730-11e9-8620-806e6f6e6963}\
C:\
C:\Users\Louise\AppData\Local\Temp\BITB9C6.tmp
C:\Windows\SysWOW64\sc.exe
C:\Windows\SysWOW64\en-US\sc.exe.mui
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\en-US\cmd.exe.mui
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bcrypt.dll
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll
C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\81ab4c39c6a7c9f50721aca2db09b417\System.Management.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\wminet_utils.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\oleaut32.dll
C:\%insfolder%\%insname%
C:\Windows\System32\tzres.dll
C:\Users\Louise\AppData\Local\Coowon\Coowon\User Data
C:\Users\Louise\AppData\Local\Comodo\Dragon\User Data
C:\Users\Louise\AppData\Local\CatalinaGroup\Citrio\User Data
C:\Users\Louise\AppData\Roaming\Opera Software\Opera Stable
C:\Users\Louise\AppData\Local\Amigo\User Data
C:\Users\Louise\AppData\Local\Vivaldi\User Data
C:\Users\Louise\AppData\Local\Sputnik\Sputnik\User Data
C:\Users\Louise\AppData\Local\Kometa\User Data
C:\Users\Louise\AppData\Local\Chromium\User Data
C:\Users\Louise\AppData\Local\7Star\7Star\User Data
C:\Users\Louise\AppData\Local\Chedot\User Data
C:\Users\Louise\AppData\Local\MapleStudio\ChromePlus\User Data
C:\Users\Louise\AppData\Local\BraveSoftware\Brave-Browser\User Data
C:\Users\Louise\AppData\Local\Epic Privacy Browser\User Data
C:\Users\Louise\AppData\Local\Iridium\User Data
C:\Users\Louise\AppData\Local\Orbitum\User Data
C:\Users\Louise\AppData\Local\CocCoc\Browser\User Data
C:\Users\Louise\AppData\Local\Elements Browser\User Data
C:\Users\Louise\AppData\Local\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
C:\Users\Louise\AppData\Local\CentBrowser\User Data
C:\Users\Louise\AppData\Local\uCozMedia\Uran\User Data
C:\Users\Louise\AppData\Local\Yandex\YandexBrowser\User Data
C:\Users\Louise\AppData\Local\QIP Surf\User Data
C:\Users\Louise\AppData\Local\360Chrome\Chrome\User Data
C:\Users\Louise\AppData\Local\liebao\User Data
C:\Users\Louise\AppData\Local\Torch\User Data
C:\Users\Louise\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\*.xml
C:\Users\Louise\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
C:\Users\Louise\AppData\Roaming\Flock\Browser\profiles.ini
C:\Users\Louise\AppData\Roaming\CoreFTP\sites.idx
C:\Windows\SysWOW64\wshom.ocx
C:\Users\Louise\AppData\Local\Tencent\QQBrowser\User Data
C:\Users\Louise\AppData\Local\Tencent\QQBrowser\User Data\Default\EncryptedStorage
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\profiles.ini
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\logins.json
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\signons.sqlite
C:\FTP Navigator\Ftplist.txt
C:\Users\Louise\AppData\Roaming\Mozilla\icecat\profiles.ini
C:\Users\Louise\AppData\Local\Google\Chrome\User Data\
C:\Users\Louise\AppData\Local\Google\Chrome\User Data\*
C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Login Data
C:\Users\Louise\AppData\Local\Temp\Folder.lst
C:\Users\All Users\AppData\Roaming\FlashFXP\3quick.dat
C:\Users\Louise\AppData\Roaming\Trillian\users\global\accounts.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\b065f84b49a27b648015c08fab8cd00e\System.Xml.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.INI
C:\Users\Louise\AppData\Roaming\Psi\profiles
C:\Users\Louise\AppData\Roaming\Psi+\profiles
C:\Users\Louise\AppData\Local\falkon\profiles\profiles.ini
C:\Users\Louise\AppData\Local\Microsoft\Edge\User Data
C:\Users\Louise\AppData\Local\Temp\vaultcli.dll
C:\Users\Louise\AppData\Roaming\Moonchild Productions\Pale Moon\profiles.ini
C:\Users\Louise\AppData\Roaming\Mozilla\SeaMonkey\profiles.ini
C:\Users\Louise\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
C:\Users\Louise\AppData\Roaming\Comodo\IceDragon\profiles.ini
C:\cftp\Ftplist.txt
C:\Users\Louise\AppData\Roaming\FileZilla\recentservers.xml
C:\Users\Louise\AppData\Roaming\K-Meleon\profiles.ini
C:\Users\Louise\AppData\Roaming\Waterfox\profiles.ini
C:\Users\Louise\AppData\Roaming\Postbox\profiles.ini
C:\Users\Louise\AppData\Roaming\Thunderbird\profiles.ini
C:\Users\Louise\AppData\Local\UCBrowser\*
C:\Users\Louise\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
C:\Users\Louise\AppData\Roaming\FTPGetter\servers.xml
C:\Users\Louise\AppData\Roaming\Ipswitch\WS_FTP\Sites\ws_ftp.ini
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\plutil.exe
C:\Users\Louise\AppData\Roaming\The Bat!
C:\Users\Louise\AppData\Roaming\Claws-mail
C:\Users\Louise\AppData\Roaming\Claws-mail\clawsrc
C:\Users\Louise\AppData\Roaming\Pocomail\accounts.ini
C:\Storage\
C:\mail\
C:\Users\Louise\AppData\Local\VirtualStore\Program Files\Foxmail\mail\
C:\Users\Louise\AppData\Local\VirtualStore\Program Files (x86)\Foxmail\mail\
C:\Users\Louise\AppData\Roaming\Opera Mail\Opera Mail\wand.dat
C:\Program Files (x86)\jDownloader\config\database.script
C:\Users\Louise\AppData\Local\Temp\log.tmp
\??\PIPE\samr
C:\DosDevices\pipe\
C:\Windows\sysnative\en-US\KERNELBASE.dll.mui
C:\Windows\Temp
C:\Windows\sysnative\LogFiles\Scm\eaca24ff-236c-401d-a1e7-b3d5267b8a50
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Louise\AppData\Local\Temp\942XyvI5QYgF.exe.config
C:\Users\Louise\AppData\Local\Temp\942XyvI5QYgF.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Louise\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Louise\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index39c.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\f8420d8c6ede777377fcff48a4beaa2a\mscorlib.ni.dll
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol214.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\0a65164b17e5c64bacdc694ea2439c43\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\175df210b784212def386595c25caefb\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\5669120680b52abf616f3876387ca2cc\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\GdiPlus.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\4ac828c8c4c76f3ba59f8f9c7dab1cb3\Microsoft.VisualBasic.ni.dll
C:\Users\Louise\AppData\Local\Temp\tmp1A91.tmp
C:\Windows\Globalization\Sorting\sortdefault.nls
\Device\KsecDD
C:\Windows\SysWOW64\net.exe
C:\Windows\AppPatch\sysmain.sdb
C:\Windows\SysWOW64\
C:\Windows\SysWOW64\net1.exe
C:\Windows\Temp\fwtsqmfile01.sqm
C:\Windows\SysWOW64\sc.exe
C:\Windows\SysWOW64\en-US\sc.exe.mui
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\en-US\cmd.exe.mui
C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\81ab4c39c6a7c9f50721aca2db09b417\System.Management.ni.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\wminet_utils.dll
C:\Windows\System32\tzres.dll
C:\Users\Louise\AppData\Roaming\Flock\Browser\profiles.ini
C:\Users\Louise\AppData\Roaming\CoreFTP\sites.idx
C:\Windows\SysWOW64\wshom.ocx
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\profiles.ini
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db
C:\FTP Navigator\Ftplist.txt
C:\Users\Louise\AppData\Roaming\Mozilla\icecat\profiles.ini
C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Default\Login Data
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\b065f84b49a27b648015c08fab8cd00e\System.Xml.ni.dll
C:\Users\Louise\AppData\Local\falkon\profiles\profiles.ini
C:\Users\Louise\AppData\Roaming\Moonchild Productions\Pale Moon\profiles.ini
C:\Users\Louise\AppData\Roaming\Mozilla\SeaMonkey\profiles.ini
C:\Users\Louise\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
C:\Users\Louise\AppData\Roaming\Comodo\IceDragon\profiles.ini
C:\Users\Louise\AppData\Roaming\FileZilla\recentservers.xml
C:\Users\Louise\AppData\Roaming\K-Meleon\profiles.ini
C:\Users\Louise\AppData\Roaming\Waterfox\profiles.ini
C:\Users\Louise\AppData\Roaming\Postbox\profiles.ini
C:\Users\Louise\AppData\Roaming\Thunderbird\profiles.ini
C:\Users\Louise\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
\??\PIPE\samr
C:\Windows\sysnative\en-US\KERNELBASE.dll.mui
C:\Windows\sysnative\LogFiles\Scm\eaca24ff-236c-401d-a1e7-b3d5267b8a50
C:\Users\Louise\AppData\Roaming\VosWhPpNqq.exe
C:\Users\Louise\AppData\Local\Temp\tmp1A91.tmp
C:\Windows\Temp\fwtsqmfile01.sqm
C:\Users\Louise\AppData\Local\Temp\BITB9C6.tmp
C:\Users\Louise\AppData\Local\Temp\log.tmp
\??\PIPE\samr
C:\Users\Louise\AppData\Local\Temp\tmp1A91.tmp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.3464.29029000
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.3464.29029000
C:\Users\Louise\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.3464.29029031
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\942XyvI5QYgF.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\NGen\Policy\v2.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1339698970-4093829097-1161395185-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index39c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index39c\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index39c\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\c9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\c9\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\c9\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\c9\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\c9\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\c9\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\afeb01a\394c6cf2
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index214
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\cb
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\cb\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\cb\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\cb\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\cb\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\cb\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\cf
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\cf\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\cf\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\cf\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\cf\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\cf\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\cc
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\cc\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\cc\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\cc\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\cc\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\cc\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\ce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\ce\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\ce\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\ce\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\ce\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\ce\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\c0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\c0\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\c0\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\c0\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\c0\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\c0\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\c6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\c6\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\c6\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\c6\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\c6\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\c6\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\c1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\c1\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\c1\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\c1\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\c1\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\c1\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\d0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\d0\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\d0\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\d0\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\d0\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\d0\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\c8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\c8\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\c8\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\c8\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\c8\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\c8\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7df82cb0\6669d41a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1339698970-4093829097-1161395185-1000\Installer\Assemblies\C:|Users|Louise|AppData|Local|Temp|942XyvI5QYgF.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Louise|AppData|Local|Temp|942XyvI5QYgF.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Louise|AppData|Local|Temp|942XyvI5QYgF.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1339698970-4093829097-1161395185-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7df82cb0\558ae052
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\b7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\b7\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\b7\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\b7\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\b7\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\b7\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\5d
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\5d\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\5d\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\5d\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\5d\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\5d\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\b6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\b6\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\b6\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\b6\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\b6\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\b6\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\3f
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\3f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\3f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\3f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\3f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\3f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Web__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1d0e73eb\1cb4ac38
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1d0e73eb\2d08b1b5
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{9a0b8d7d-300f-11ea-b342-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{9a0b8d7d-300f-11ea-b342-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{9a0b8d7d-300f-11ea-b342-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a657-2730-11e9-8620-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a657-2730-11e9-8620-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a657-2730-11e9-8620-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a658-2730-11e9-8620-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a658-2730-11e9-8620-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a658-2730-11e9-8620-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\AppID\942XyvI5QYgF.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\AppCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT
DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\00060101.00060101
HKEY_CURRENT_USER\Software\Classes\AppID\schtasks.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoKMS
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoKMS\Id
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\SchedulingEngineKnob
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Control Panel\International
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Control Panel\International\LocaleName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updates\VosWhPpNqq
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\svchost.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\svchost.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6C2D8E85-74E6-4357-A85F-E5E7CD457C3D}\Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6C2D8E85-74E6-4357-A85F-E5E7CD457C3D}\Hash
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updates\VosWhPpNqq\Id
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updates\VosWhPpNqq\Index
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6C2D8E85-74E6-4357-A85F-E5E7CD457C3D}\Triggers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6C2D8E85-74E6-4357-A85F-E5E7CD457C3D}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6C2D8E85-74E6-4357-A85F-E5E7CD457C3D}\DynamicInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS\StateIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\RepositoryRestoreInProgress
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\net.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\net1.exe
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iphlpsvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iphlpsvc\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iphlpsvc\Parameters\ServiceDllUnloadOnStop
HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\CIMOM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\LastServiceStart
HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\ESS
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\ESS\//./root/CIMV2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\ESS\//./root/CIMV2\SCM Event Provider
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\PreviousServiceShutdown
HKEY_LOCAL_MACHINE\system\Setup
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ProcessID
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\winmgmt
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winmgmt\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winmgmt\Parameters\ServiceDllUnloadOnStop
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS\DisableBranchCache
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\PeerDist\Service
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\PeerDist\Service
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Service\Enable
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}
HKEY_CURRENT_USER\Software\Microsoft\windows\CurrentVersion\Internet Settings\Wpad
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\sc.exe
HKEY_USERS\.DEFAULT\Control Panel\International\LocaleName
HKEY_USERS\.DEFAULT\Control Panel\International\sCountry
HKEY_USERS\.DEFAULT\Control Panel\International\sList
HKEY_USERS\.DEFAULT\Control Panel\International\sDecimal
HKEY_USERS\.DEFAULT\Control Panel\International\sThousand
HKEY_USERS\.DEFAULT\Control Panel\International\sGrouping
HKEY_USERS\.DEFAULT\Control Panel\International\sNativeDigits
HKEY_USERS\.DEFAULT\Control Panel\International\sCurrency
HKEY_USERS\.DEFAULT\Control Panel\International\sMonDecimalSep
HKEY_USERS\.DEFAULT\Control Panel\International\sMonThousandSep
HKEY_USERS\.DEFAULT\Control Panel\International\sMonGrouping
HKEY_USERS\.DEFAULT\Control Panel\International\sPositiveSign
HKEY_USERS\.DEFAULT\Control Panel\International\sNegativeSign
HKEY_USERS\.DEFAULT\Control Panel\International\sTimeFormat
HKEY_USERS\.DEFAULT\Control Panel\International\sShortTime
HKEY_USERS\.DEFAULT\Control Panel\International\s1159
HKEY_USERS\.DEFAULT\Control Panel\International\s2359
HKEY_USERS\.DEFAULT\Control Panel\International\sShortDate
HKEY_USERS\.DEFAULT\Control Panel\International\sYearMonth
HKEY_USERS\.DEFAULT\Control Panel\International\sLongDate
HKEY_USERS\.DEFAULT\Control Panel\International\iCountry
HKEY_USERS\.DEFAULT\Control Panel\International\iMeasure
HKEY_USERS\.DEFAULT\Control Panel\International\iPaperSize
HKEY_USERS\.DEFAULT\Control Panel\International\iDigits
HKEY_USERS\.DEFAULT\Control Panel\International\iLZero
HKEY_USERS\.DEFAULT\Control Panel\International\iNegNumber
HKEY_USERS\.DEFAULT\Control Panel\International\NumShape
HKEY_USERS\.DEFAULT\Control Panel\International\iCurrDigits
HKEY_USERS\.DEFAULT\Control Panel\International\iCurrency
HKEY_USERS\.DEFAULT\Control Panel\International\iNegCurr
HKEY_USERS\.DEFAULT\Control Panel\International\iCalendarType
HKEY_USERS\.DEFAULT\Control Panel\International\iFirstDayOfWeek
HKEY_USERS\.DEFAULT\Control Panel\International\iFirstWeekOfYear
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\cmd.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5230b0b5\660406b6
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\1E6BBD07
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_CURRENT_USER\Software\Classes\WinMgmts
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WINMGMTS\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WINMGMTS\CLSID\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Scripting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\WBEM\Scripting\Default Namespace
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Hostname
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\System\DNSclient
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Domain
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\ae
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\ae\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\ae\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\ae\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\ae\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\ae\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\5b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\5b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\5b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\5b\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\5b\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\5b\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.JScript__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.JScript,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727\WMIDisableCOMSecurity
HKEY_CLASSES_ROOT\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\Class
HKEY_CURRENT_USER\Software\Classes\TypeLib
HKEY_CURRENT_USER\Software\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\409
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\9
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0\win32\(Default)
HKEY_CURRENT_USER\Software\FTPWare\COREFTP\Sites
HKEY_CURRENT_USER\Software\RimArts\B2\Settings
HKEY_CURRENT_USER\Software\IncrediMail\Identities
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\c2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\c2\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\c2\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\c2\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\c2\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\c2\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\c2\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\c2\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\c2\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\c2\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\c2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\c2\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\c2\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\c2\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\c2\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\c2\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Data.SqlXml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Data.SqlXml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_CURRENT_USER\Software\OpenVPN-GUI\configs
HKEY_CURRENT_USER\Software\DownloadManager\Passwords
HKEY_CURRENT_USER\Software\Qualcomm\Eudora\CommandLine
HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
HKEY_CURRENT_USER\Software\Aerofox\FoxmailPreview
HKEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1
HKEY_CURRENT_USER\Control Panel\International
HKEY_CURRENT_USER\Control Panel\International\sYearMonth
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\FinalizerActivityBypass
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Power\PowerRequestOverride
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Power\PowerRequestOverride
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Power\PowerRequestOverride\Driver
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\Setup
HKEY_LOCAL_MACHINE\SYSTEM\Setup\UpgradeInProgress
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Safeboot\Option
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Settings
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\ActiveWriterStateTimeout
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\(Default)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\WMI Writer
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\TornComponentsMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssNeedsLoading
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\WOW64
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_USERS\S-1-5-18
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_USERS\.DEFAULT\Environment
HKEY_USERS\.DEFAULT\Volatile Environment
HKEY_USERS\.DEFAULT\Volatile Environment\0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\RequiredPrivileges
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ObjectName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index39c\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index39c\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\c9\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\c9\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\c9\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\c9\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\c9\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index214
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\cb\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\cb\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\cb\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\cb\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\cb\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\cf\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\cf\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\cf\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\cf\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\cf\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\cc\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\cc\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\cc\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\cc\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\cc\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\ce\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\ce\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\ce\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\ce\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\ce\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\c0\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\c0\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\c0\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\c0\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\c0\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\c6\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\c6\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\c6\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\c6\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\c6\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\c1\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\c1\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\c1\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\c1\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\c1\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\d0\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\d0\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\d0\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\d0\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\d0\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\c8\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\c8\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\c8\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\c8\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\c8\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\b7\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\b7\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\b7\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\b7\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\b7\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\5d\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\5d\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\5d\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\5d\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\5d\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\b6\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\b6\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\b6\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\b6\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\b6\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\3f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\3f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\3f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\3f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\3f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{9a0b8d7d-300f-11ea-b342-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{9a0b8d7d-300f-11ea-b342-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a657-2730-11e9-8620-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a657-2730-11e9-8620-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a658-2730-11e9-8620-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a658-2730-11e9-8620-806e6f6e6963}\Generation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\00060101.00060101
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoKMS\Id
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\SchedulingEngineKnob
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Control Panel\International\LocaleName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6C2D8E85-74E6-4357-A85F-E5E7CD457C3D}\Hash
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6C2D8E85-74E6-4357-A85F-E5E7CD457C3D}\DynamicInfo
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iphlpsvc\Parameters\ServiceDllUnloadOnStop
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\LastServiceStart
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\MarshaledProxy
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winmgmt\Parameters\ServiceDllUnloadOnStop
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS\DisableBranchCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Service\Enable
HKEY_USERS\.DEFAULT\Control Panel\International\LocaleName
HKEY_USERS\.DEFAULT\Control Panel\International\sCountry
HKEY_USERS\.DEFAULT\Control Panel\International\sList
HKEY_USERS\.DEFAULT\Control Panel\International\sDecimal
HKEY_USERS\.DEFAULT\Control Panel\International\sThousand
HKEY_USERS\.DEFAULT\Control Panel\International\sGrouping
HKEY_USERS\.DEFAULT\Control Panel\International\sNativeDigits
HKEY_USERS\.DEFAULT\Control Panel\International\sCurrency
HKEY_USERS\.DEFAULT\Control Panel\International\sMonDecimalSep
HKEY_USERS\.DEFAULT\Control Panel\International\sMonThousandSep
HKEY_USERS\.DEFAULT\Control Panel\International\sMonGrouping
HKEY_USERS\.DEFAULT\Control Panel\International\sPositiveSign
HKEY_USERS\.DEFAULT\Control Panel\International\sNegativeSign
HKEY_USERS\.DEFAULT\Control Panel\International\sTimeFormat
HKEY_USERS\.DEFAULT\Control Panel\International\sShortTime
HKEY_USERS\.DEFAULT\Control Panel\International\s1159
HKEY_USERS\.DEFAULT\Control Panel\International\s2359
HKEY_USERS\.DEFAULT\Control Panel\International\sShortDate
HKEY_USERS\.DEFAULT\Control Panel\International\sYearMonth
HKEY_USERS\.DEFAULT\Control Panel\International\sLongDate
HKEY_USERS\.DEFAULT\Control Panel\International\iCountry
HKEY_USERS\.DEFAULT\Control Panel\International\iMeasure
HKEY_USERS\.DEFAULT\Control Panel\International\iPaperSize
HKEY_USERS\.DEFAULT\Control Panel\International\iDigits
HKEY_USERS\.DEFAULT\Control Panel\International\iLZero
HKEY_USERS\.DEFAULT\Control Panel\International\iNegNumber
HKEY_USERS\.DEFAULT\Control Panel\International\NumShape
HKEY_USERS\.DEFAULT\Control Panel\International\iCurrDigits
HKEY_USERS\.DEFAULT\Control Panel\International\iCurrency
HKEY_USERS\.DEFAULT\Control Panel\International\iNegCurr
HKEY_USERS\.DEFAULT\Control Panel\International\iCalendarType
HKEY_USERS\.DEFAULT\Control Panel\International\iFirstDayOfWeek
HKEY_USERS\.DEFAULT\Control Panel\International\iFirstWeekOfYear
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\1E6BBD07
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WINMGMTS\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\WBEM\Scripting\Default Namespace
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Hostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Domain
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\ae\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\ae\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\ae\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\ae\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\ae\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\5b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\5b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\5b\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\5b\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\5b\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.JScript,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727\WMIDisableCOMSecurity
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\Class
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0\win32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\c2\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\c2\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\c2\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\c2\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\c2\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\c2\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\c2\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\c2\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\c2\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\c2\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\c2\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\c2\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\c2\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\c2\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Data.SqlXml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_CURRENT_USER\Control Panel\International\sYearMonth
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\FinalizerActivityBypass
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\Setup\UpgradeInProgress
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\ActiveWriterStateTimeout
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\(Default)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\TornComponentsMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssNeedsLoading
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\WOW64
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\RequiredPrivileges
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ObjectName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6C2D8E85-74E6-4357-A85F-E5E7CD457C3D}\Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6C2D8E85-74E6-4357-A85F-E5E7CD457C3D}\Hash
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updates\VosWhPpNqq\Id
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updates\VosWhPpNqq\Index
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6C2D8E85-74E6-4357-A85F-E5E7CD457C3D}\Triggers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6C2D8E85-74E6-4357-A85F-E5E7CD457C3D}\DynamicInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS\StateIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\LastServiceStart
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\PreviousServiceShutdown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ProcessID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\LastServiceStart
advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.SetDefaultDllDirectories
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
kernel32.dll.AcquireSRWLockExclusive
kernel32.dll.ReleaseSRWLockExclusive
advapi32.dll.EventRegister
advapi32.dll.EventSetInformation
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
[email protected]@[email protected]
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
user32.dll.GetProcessWindowStation
user32.dll.GetUserObjectInformationW
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
kernel32.dll.QueryActCtxW
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
uxtheme.dll.IsAppThemed
kernel32.dll.CreateActCtxA
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
user32.dll.RegisterWindowMessageW
ole32.dll.CoCreateGuid
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.GetCurrentProcessId
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipBitmapGetPixel
kernel32.dll.GlobalMemoryStatusEx
shfolder.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
kernel32.dll.CloseHandle
kernel32.dll.GetCurrentProcess
kernel32.dll.LocalFree
kernel32.dll.LocalAlloc
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
mscoree.dll.ND_RU1
mscoreei.dll.ND_RU1
advapi32.dll.LsaClose
advapi32.dll.LsaFreeMemory
advapi32.dll.LsaOpenPolicy
advapi32.dll.LsaLookupSids
kernel32.dll.GetTempPathW
kernel32.dll.GetTempFileNameW
kernel32.dll.CreateFileW
kernel32.dll.GetFileType
kernel32.dll.WriteFile
kernel32.dll.RtlMoveMemory
shell32.dll.ShellExecuteEx
shell32.dll.ShellExecuteExW
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#332
comctl32.dll.#386
kernel32.dll.DuplicateHandle
ole32.dll.CoWaitForMultipleHandles
sechost.dll.LookupAccountNameLocalW
advapi32.dll.LookupAccountSidW
sechost.dll.LookupAccountSidLocalW
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptGenRandom
ole32.dll.NdrOleInitializeExtension
ole32.dll.CoGetClassObject
ole32.dll.CoGetMarshalSizeMax
ole32.dll.CoMarshalInterface
ole32.dll.CoUnmarshalInterface
ole32.dll.StringFromIID
ole32.dll.CoGetPSClsid
ole32.dll.CoCreateInstance
ole32.dll.CoReleaseMarshalData
ole32.dll.DcomChannelSetHResult
rpcrtremote.dll.I_RpcExtInitializeExtensionPoint
kernel32.dll.DeleteFileW
kernel32.dll.CreateProcessW
kernel32.dll.GetThreadContext
kernel32.dll.ReadProcessMemory
kernel32.dll.VirtualAllocEx
advapi32.dll.LookupPrivilegeValueW
advapi32.dll.AdjustTokenPrivileges
psapi.dll.EnumProcesses
kernel32.dll.OpenProcess
kernel32.dll.TerminateProcess
kernel32.dll.WriteProcessMemory
kernel32.dll.SetThreadContext
kernel32.dll.ResumeThread
kernel32.dll.DeleteAtom
api-ms-win-downlevel-advapi32-l1-1-0.dll.UnregisterTraceGuids
comctl32.dll.#321
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
cryptsp.dll.CryptReleaseContext
advapi32.dll.EventUnregister
kernel32.dll.SortGetHandle
kernel32.dll.SortCloseHandle
sspicli.dll.GetUserNameExW
pcwum.dll.PerfDeleteInstance
pcwum.dll.PerfStopProvider
sechost.dll.ConvertSidToStringSidW
advapi32.dll.RegisterEventSourceW
advapi32.dll.ReportEventW
advapi32.dll.DeregisterEventSource
ole32.dll.CoDisconnectObject
wbemcore.dll.Shutdown
ole32.dll.CoUninitialize
kernel32.dll.RegDeleteValueW
kernel32.dll.GetProductInfo
advapi32.dll.RegDeleteTreeA
advapi32.dll.RegDeleteTreeW
bcrypt.dll.BCryptGetFipsAlgorithmMode
kernel32.dll.GetModuleHandleW
kernel32.dll.GetProcAddress
user32.dll.DefWindowProcW
gdi32.dll.GetStockObject
user32.dll.RegisterClassW
user32.dll.CreateWindowExW
user32.dll.SetWindowLongW
user32.dll.GetWindowLongW
kernel32.dll.GetCurrentThread
kernel32.dll.GetCurrentThreadId
user32.dll.CallWindowProcW
ntdll.dll.NtQuerySystemInformation
cryptsp.dll.CryptCreateHash
ole32.dll.CreateBindCtx
ole32.dll.CoGetObjectContext
ole32.dll.MkParseDisplayName
oleaut32.dll.#200
oleaut32.dll.#2
oleaut32.dll.#7
oleaut32.dll.#6
kernel32.dll.CreateEventW
kernel32.dll.SwitchToThread
kernel32.dll.SetEvent
ole32.dll.IIDFromString
kernel32.dll.LoadLibraryA
wminet_utils.dll.ResetSecurity
wminet_utils.dll.SetSecurity
wminet_utils.dll.BlessIWbemServices
wminet_utils.dll.BlessIWbemServicesObject
wminet_utils.dll.GetPropertyHandle
wminet_utils.dll.WritePropertyValue
wminet_utils.dll.Clone
wminet_utils.dll.VerifyClientKey
wminet_utils.dll.GetQualifierSet
wminet_utils.dll.Get
wminet_utils.dll.Put
wminet_utils.dll.Delete
wminet_utils.dll.GetNames
wminet_utils.dll.BeginEnumeration
wminet_utils.dll.Next
wminet_utils.dll.EndEnumeration
wminet_utils.dll.GetPropertyQualifierSet
wminet_utils.dll.GetObjectText
wminet_utils.dll.SpawnDerivedClass
wminet_utils.dll.SpawnInstance
wminet_utils.dll.CompareTo
wminet_utils.dll.GetPropertyOrigin
wminet_utils.dll.InheritsFrom
wminet_utils.dll.GetMethod
wminet_utils.dll.PutMethod
wminet_utils.dll.DeleteMethod
wminet_utils.dll.BeginMethodEnumeration
wminet_utils.dll.NextMethod
wminet_utils.dll.EndMethodEnumeration
wminet_utils.dll.GetMethodQualifierSet
wminet_utils.dll.GetMethodOrigin
wminet_utils.dll.QualifierSet_Get
wminet_utils.dll.QualifierSet_Put
wminet_utils.dll.QualifierSet_Delete
wminet_utils.dll.QualifierSet_GetNames
wminet_utils.dll.QualifierSet_BeginEnumeration
wminet_utils.dll.QualifierSet_Next
wminet_utils.dll.QualifierSet_EndEnumeration
wminet_utils.dll.GetCurrentApartmentType
wminet_utils.dll.GetDemultiplexedStub
wminet_utils.dll.CreateInstanceEnumWmi
wminet_utils.dll.CreateClassEnumWmi
wminet_utils.dll.ExecQueryWmi
wminet_utils.dll.ExecNotificationQueryWmi
wminet_utils.dll.PutInstanceWmi
wminet_utils.dll.PutClassWmi
wminet_utils.dll.CloneEnumWbemClassObject
wminet_utils.dll.ConnectServerWmi
wminet_utils.dll.GetErrorInfo
wminet_utils.dll.Initialize
oleaut32.dll.SysStringLen
kernel32.dll.RtlZeroMemory
oleaut32.dll.#500
cryptsp.dll.CryptHashData
cryptsp.dll.CryptGetHashParam
cryptsp.dll.CryptDestroyHash
kernel32.dll.GetEnvironmentVariableW
advapi32.dll.GetUserNameW
kernel32.dll.GetComputerNameW
kernel32.dll.CreateIoCompletionPort
kernel32.dll.PostQueuedCompletionStatus
ntdll.dll.NtQueryInformationThread
ntdll.dll.NtGetCurrentProcessorNumber
kernel32.dll.GetSystemTimeAsFileTime
user32.dll.GetLastInputInfo
kernel32.dll.FindFirstFileW
kernel32.dll.FindClose
oleaut32.dll.#201
ole32.dll.CLSIDFromProgIDEx
sxs.dll.SxsLookupClrGuid
sxs.dll.SxsOleAut32RedirectTypeLibrary
advapi32.dll.RegOpenKeyW
advapi32.dll.RegQueryValueW
sxs.dll.SxsOleAut32MapConfiguredClsidToReferenceClsid
oleaut32.dll.#9
oleaut32.dll.#4
kernel32.dll.ReadFile
kernel32.dll.GetFileSize
oleaut32.dll.#204
oleaut32.dll.#203
kernel32.dll.GetACP
kernel32.dll.UnmapViewOfFile
kernel32.dll.FindNextFileW
oleaut32.dll.#179
vaultcli.dll.VaultEnumerateVaults
user32.dll.SetClipboardViewer
ole32.dll.OleInitialize
ole32.dll.OleGetClipboard
kernel32.dll.GlobalLock
kernel32.dll.GlobalUnlock
kernel32.dll.GlobalFree
user32.dll.SendMessageW
user32.dll.SetWindowsHookExW
user32.dll.GetSystemMetrics
user32.dll.GetDC
user32.dll.GetMonitorInfoW
gdi32.dll.GetDeviceCaps
user32.dll.ReleaseDC
user32.dll.GetUserObjectInformationA
kernel32.dll.SetConsoleCtrlHandler
user32.dll.GetClassInfoW
user32.dll.MsgWaitForMultipleObjectsEx
gdiplus.dll.GdipCreateBitmapFromScan0
gdiplus.dll.GdipGetImageEncodersSize
gdiplus.dll.GdipGetImageEncoders
mscoree.dll.ND_WI4
mscoreei.dll.ND_WI4
gdiplus.dll.GdipGetImagePixelFormat
gdiplus.dll.GdipGetImageGraphicsContext
gdi32.dll.GetCurrentObject
gdiplus.dll.GdipGetDC
gdi32.dll.BitBlt
gdiplus.dll.GdipReleaseDC
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#10
user32.dll.GetClientRect
user32.dll.GetWindowRect
user32.dll.GetParent
ole32.dll.CoRegisterMessageFilter
user32.dll.PeekMessageW
user32.dll.WaitMessage
user32.dll.IsWindowUnicode
user32.dll.GetMessageW
user32.dll.TranslateMessage
user32.dll.DispatchMessageW
gdiplus.dll.GdipDisposeImage
gdiplus.dll.GdipDeleteGraphics
kernel32.dll.SetFilePointer
vssapi.dll.CreateWriter
advapi32.dll.LookupAccountNameW
samcli.dll.NetLocalGroupGetMembers
samlib.dll.SamConnect
rpcrt4.dll.NdrClientCall3
rpcrt4.dll.RpcStringBindingComposeW
rpcrt4.dll.RpcBindingFromStringBindingW
rpcrt4.dll.RpcStringFreeW
rpcrt4.dll.RpcBindingFree
samlib.dll.SamOpenDomain
samlib.dll.SamLookupNamesInDomain
samlib.dll.SamOpenAlias
samlib.dll.SamFreeMemory
samlib.dll.SamCloseHandle
samlib.dll.SamGetMembersInAlias
netutils.dll.NetApiBufferFree
ole32.dll.CoTaskMemRealloc
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VosWhPpNqq" /XML "C:\Users\Louise\AppData\Local\Temp\tmp1A91.tmp"
schtasks.exe /Create /TN "Updates\VosWhPpNqq" /XML "C:\Users\Louise\AppData\Local\Temp\tmp1A91.tmp"
"{path}"
C:\Users\Louise\AppData\Local\Temp\942XyvI5QYgF.exe "{path}"
C:\Windows\system32\lsass.exe
Global\CLR_CASOFF_MUTEX
VaultSvc

BinGraph Download graph

PE Information

Image Base Entry Point Reported Checksum Actual Checksum Minimum OS Version Compile Time Import Hash Icon Icon Exact Hash Icon Similarity Hash
0x00400000 0x00462182 0x00000000 0x00064ebb 4.0 2020-06-30 10:41:02 f34d5f2d4577ed6d9ceec516c1f5a744 ed25334148385ad211335726a2387704 f8297471c00220e7cc0ee3014b923876

Sections

Name RAW Address Virtual Address Virtual Size Size of Raw Data Characteristics Entropy
.text 0x00000200 0x00002000 0x00060188 0x00060200 IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 7.91
.rsrc 0x00060400 0x00064000 0x0000422c 0x00004400 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 4.28
.reloc 0x00064800 0x0006a000 0x0000000c 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 0.10

Resources

Name Offset Size Language Sub-language Entropy File type
RT_ICON 0x000656d0 0x000025a8 LANG_NEUTRAL SUBLANG_NEUTRAL 3.52 None
RT_ICON 0x000656d0 0x000025a8 LANG_NEUTRAL SUBLANG_NEUTRAL 3.52 None
RT_ICON 0x000656d0 0x000025a8 LANG_NEUTRAL SUBLANG_NEUTRAL 3.52 None
RT_GROUP_ICON 0x00067ca8 0x00000030 LANG_NEUTRAL SUBLANG_NEUTRAL 2.46 None
RT_GROUP_ICON 0x00067ca8 0x00000030 LANG_NEUTRAL SUBLANG_NEUTRAL 2.46 None
RT_VERSION 0x00067cd8 0x00000366 LANG_NEUTRAL SUBLANG_NEUTRAL 3.39 None
RT_MANIFEST 0x00068040 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL 5.00 None

Imports


Assembly Information

Name XhsNyehgHEUoht
Version 1.98.4.0

Assembly References

Name Version
mscorlib 2.0.0.0
System.Windows.Forms 2.0.0.0
System 2.0.0.0
System.Drawing 2.0.0.0
System.Xml 2.0.0.0
System.Data 2.0.0.0

Custom Attributes

Type Name Value
Assembly [mscorlib]System.Reflection.AssemblyTitleAttribute Winform Sandb
Assembly [mscorlib]System.Reflection.AssemblyProductAttribute Winform Sandb
Assembly [mscorlib]System.Reflection.AssemblyCopyrightAttribute Copyright \xa9 2017 - 20
Assembly [mscorlib]System.Runtime.InteropServices.GuidAttribute D7AFF0CC-F635-4140-A9B4-0FEA7D211F
Assembly [mscorlib]System.Reflection.AssemblyFileVersionAttribute 1.98.4

Type References

Assembly Type Name
mscorlib System.Runtime.CompilerServices.CompilationRelaxationsAttribute
mscorlib System.Runtime.CompilerServices.RuntimeCompatibilityAttribute
mscorlib System.Diagnostics.DebuggableAttribute
mscorlib System.Diagnostics.DebuggableAttribute/DebuggingModes
mscorlib System.Reflection.AssemblyTitleAttribute
mscorlib System.Reflection.AssemblyDescriptionAttribute
mscorlib System.Reflection.AssemblyConfigurationAttribute
mscorlib System.Reflection.AssemblyCompanyAttribute
mscorlib System.Reflection.AssemblyProductAttribute
mscorlib System.Reflection.AssemblyCopyrightAttribute
mscorlib System.Reflection.AssemblyTrademarkAttribute
mscorlib System.Runtime.InteropServices.ComVisibleAttribute
mscorlib System.Runtime.InteropServices.GuidAttribute
mscorlib System.Reflection.AssemblyFileVersionAttribute
System.Windows.Forms System.Windows.Forms.Form
mscorlib System.Collections.Generic.List`1
System System.ComponentModel.IContainer
System.Windows.Forms System.Windows.Forms.ComboBox
System.Windows.Forms System.Windows.Forms.Label
System.Windows.Forms System.Windows.Forms.Button
System.Windows.Forms System.Windows.Forms.ListBox
mscorlib System.Object
mscorlib System.EventArgs
mscorlib System.Decimal
mscorlib System.Enum
mscorlib System.Runtime.CompilerServices.CompilerGeneratedAttribute
mscorlib System.Diagnostics.DebuggerBrowsableState
mscorlib System.Diagnostics.DebuggerBrowsableAttribute
mscorlib System.Collections.Generic.List`1/Enumerator
mscorlib System.Reflection.Assembly
mscorlib System.Type
mscorlib System.Reflection.MethodInfo
mscorlib System.STAThreadAttribute
System System.CodeDom.Compiler.GeneratedCodeAttribute
mscorlib System.Diagnostics.DebuggerNonUserCodeAttribute
mscorlib System.Resources.ResourceManager
mscorlib System.Globalization.CultureInfo
System.Drawing System.Drawing.Bitmap
System System.ComponentModel.EditorBrowsableState
System System.ComponentModel.EditorBrowsableAttribute
System System.Configuration.ApplicationSettingsBase
System.Windows.Forms System.Windows.Forms.DataGridView
System.Windows.Forms System.Windows.Forms.DataGridViewTextBoxColumn
System.Windows.Forms System.Windows.Forms.DataGridViewCellEventArgs
System System.ComponentModel.INotifyPropertyChanged
System System.ComponentModel.PropertyChangedEventHandler
mscorlib System.Collections.Generic.IList`1
mscorlib System.Collections.Generic.ICollection`1
mscorlib System.Collections.Generic.IEnumerable`1
mscorlib System.Collections.IEnumerable
mscorlib System.Guid
System System.ComponentModel.BindingList`1
System System.ComponentModel.ListSortDirection
System System.ComponentModel.PropertyDescriptor
mscorlib System.IComparable
System.Windows.Forms System.Windows.Forms.GroupBox
System.Windows.Forms System.Windows.Forms.TextBox
mscorlib System.Exception
System.Windows.Forms System.Windows.Forms.DataGridViewRow
System.Windows.Forms System.Windows.Forms.DataGridViewCellStyle
System.Xml System.Xml.Serialization.XmlSerializer
System.Data System.Data.DataSet
System.Data System.Data.DataTable
System.Windows.Forms System.Windows.Forms.BindingSource
System.Windows.Forms System.Windows.Forms.ListBox/ObjectCollection
System.Windows.Forms System.Windows.Forms.Control
System.Windows.Forms System.Windows.Forms.ListControl
mscorlib System.IDisposable
System.Windows.Forms System.Windows.Forms.AutoCompleteMode
System.Windows.Forms System.Windows.Forms.AutoCompleteSource
System.Drawing System.Drawing.Point
System.Drawing System.Drawing.Size
mscorlib System.EventHandler
System.Windows.Forms System.Windows.Forms.ButtonBase
System.Drawing System.Drawing.SizeF
System.Windows.Forms System.Windows.Forms.ContainerControl
System.Windows.Forms System.Windows.Forms.AutoScaleMode
System.Windows.Forms System.Windows.Forms.Control/ControlCollection
mscorlib System.Convert
mscorlib System.AppDomain
mscorlib System.Reflection.MethodBase
System System.ComponentModel.Container
System.Windows.Forms System.Windows.Forms.Application
mscorlib System.RuntimeTypeHandle
System System.Configuration.SettingsBase
System.Windows.Forms System.Windows.Forms.ControlBindingsCollection
System.Windows.Forms System.Windows.Forms.Binding
System.Windows.Forms System.Windows.Forms.DataGridViewCellEventHandler
System System.ComponentModel.ISupportInitialize
System.Windows.Forms System.Windows.Forms.DataGridViewColumnHeadersHeightSizeMode
System.Windows.Forms System.Windows.Forms.DataGridViewColumnCollection
System.Windows.Forms System.Windows.Forms.DataGridViewColumn
System.Windows.Forms System.Windows.Forms.DataGridViewBand
System.Windows.Forms System.Windows.Forms.DataGridViewAutoSizeColumnMode
System.Drawing System.Drawing.Font
System.Drawing System.Drawing.FontStyle
System.Drawing System.Drawing.GraphicsUnit
mscorlib System.Delegate
mscorlib System.Threading.Interlocked
System System.ComponentModel.PropertyChangedEventArgs
mscorlib System.Collections.ObjectModel.Collection`1
System.Windows.Forms System.Windows.Forms.DataGridViewRowCollection
mscorlib System.Math
mscorlib System.String
mscorlib System.Comparison`1
System System.ComponentModel.ListChangedEventArgs
System System.ComponentModel.ListChangedType
mscorlib System.StringComparison
System.Windows.Forms System.Windows.Forms.MessageBox
System.Windows.Forms System.Windows.Forms.DialogResult
System.Data System.Data.DataRowCollection
System.Data System.Data.DataRow
System.Windows.Forms System.Windows.Forms.BorderStyle
System.Windows.Forms System.Windows.Forms.TextBoxBase
System.Windows.Forms System.Windows.Forms.ScrollBars
System.Drawing System.Drawing.Color
System.Windows.Forms System.Windows.Forms.DataGridViewTriState
System.Windows.Forms System.Windows.Forms.DataGridViewSelectedRowCollection
System.Windows.Forms System.Windows.Forms.DataGridViewCellCollection
System.Windows.Forms System.Windows.Forms.DataGridViewCell
System.Windows.Forms System.Windows.Forms.DataGridViewAutoSizeColumnsMode
System.Windows.Forms System.Windows.Forms.DataGridViewAutoSizeRowsMode
System.Windows.Forms System.Windows.Forms.DataGridViewContentAlignment
System.Drawing System.Drawing.SystemColors
System.Windows.Forms System.Windows.Forms.DataGridViewEditMode
System.Windows.Forms System.Windows.Forms.DataGridViewRowHeadersWidthSizeMode
System.Windows.Forms System.Windows.Forms.DataGridViewSelectionMode
System.Windows.Forms System.Windows.Forms.FormStartPosition
System.Windows.Forms System.Windows.Forms.FormBorderStyle
System.Windows.Forms System.Windows.Forms.FormClosingEventHandler
System.Data System.Data.XmlReadMode
System.Data System.Data.DataTableCollection
System.Windows.Forms System.Windows.Forms.DockStyle

!This program cannot be run in DOS mode.
.text
`.rsrc
@.reloc
*BSJB
v2.0.50727
#Strings
#GUID
#Blob
IEnumerable`1
ICollection`1
Comparison`1
IList`1
SortableBindingList`1
label1
Form1
dataGridView1
groupBox1
label2
get_unify2
button3
Class3
<Module>
SizeF
labelTM
textBoxTM
SDSDSDS
CVVVVVVVVV
value__
System.Data
SaveData
mscorlib
System.Collections.Generic
get_zhinmqIxKminYxfsSRhEfPGwc
get_Id
add_Load
OrderForm_Load
buttonAdd
OnListChanged
add_SelectedIndexChanged
lstOrder_SelectedIndexChanged
cbMenus_SelectedIndexChanged
add_PropertyChanged
remove_PropertyChanged
INotifyPropertyChanged
Interlocked
set_Enabled
set_FormattingEnabled
_isSorted
Synchronized
PopulateDataGrid
SelectedGroupDataGrid
GroupsDataGrid
NewGuid
<Id>k__BackingField
<Price>k__BackingField
<ProductsTable>k__BackingField
<Title>k__BackingField
<Name>k__BackingField
<GroupName>k__BackingField
<ProductName>k__BackingField
<MenuType>k__BackingField
<TradeMark>k__BackingField
<Description>k__BackingField
<PhoneNumber>k__BackingField
<SkuNumber>k__BackingField
<Supplier>k__BackingField
<ProductDetails>k__BackingField
<OrderItems>k__BackingField
<MenuItems>k__BackingField
<StorageUnit>k__BackingField
<Category>k__BackingField
DataGridViewBand
buttonAmend
SBind
GetMethod
get_Price
set_Price
get_TotalPrice
RefreshTotalPrice
lblTotalPrice
labelPrice
textBoxPrice
defaultInstance
set_DataSource
set_AutoCompleteSource
BindingSource
source
XmlReadMode
set_AutoScaleMode
set_AutoCompleteMode
set_RowHeadersWidthSizeMode
DataGridViewRowHeadersWidthSizeMode
set_AutoSizeMode
set_ColumnHeadersHeightSizeMode
DataGridViewColumnHeadersHeightSizeMode
DataGridViewAutoSizeColumnMode
set_SelectionMode
DataGridViewSelectionMode
set_WrapMode
set_AutoSizeColumnsMode
DataGridViewAutoSizeColumnsMode
set_AutoSizeRowsMode
DataGridViewAutoSizeRowsMode
set_EditMode
DataGridViewEditMode
AddRange
CompareExchange
get_WhiteSmoke
Invoke
DataTable
get_ProductsTable
set_ProductsTable
IComparable
IEnumerable
IDisposable
dtable
set_RowHeadersVisible
RuntimeTypeHandle
GetTypeFromHandle
numberOfPeople
get_Title
set_Title
DockStyle
get_DefaultCellStyle
set_DefaultCellStyle
set_ColumnHeadersDefaultCellStyle
DataGridViewCellStyle
set_BorderStyle
set_FormBorderStyle
FontStyle
get_Name
set_Name
PersonName
get_GroupName
set_GroupName
groupName
labelPrName
textBoxPrName
get_ProductName
set_ProductName
set_DataPropertyName
Combine
set_Multiline
Phone
ListChangedType
GetType
get_MenuType
set_MenuType
Compare
get_IsSortedCore
get_SupportsSortingCore
get_SortDirectionCore
GroupCore
RemoveSortCore
ApplySortCore
get_SortPropertyCore
get_Culture
set_Culture
resourceCulture
MethodBase
ButtonBase
ApplicationSettingsBase
TextBoxBase
Close
Dispose
Delegate
DebuggerBrowsableState
EditorBrowsableState
DataGridViewTriState
Delete
get_White
STAThreadAttribute
CompilerGeneratedAttribute
GuidAttribute
GeneratedCodeAttribute
DebuggerNonUserCodeAttribute
DebuggableAttribute
DebuggerBrowsableAttribute
EditorBrowsableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
labelCatalogue
get_Value
GetValue
value
buttonSave
Remove
XhsNyehgHEUoht.exe
set_Size
set_MinimumSize
set_MaximumSize
set_AutoSize
set_ClientSize
myserialize
ISupportInitialize
IndexOf
get_Tag
set_Tag
System.Threading
Binding
FromBase64String
ToString
GetString
MainForm_Closing
add_FormClosing
disposing
Operating
System.Drawing
ShowDialog
set_MaxLength
buttonAdd_Click
add_Click
buttonAmend_Click
buttonDelete_Click
buttonSave_Click
buttonCancel_Click
btnClearMenus_Click
buttonEdit_Click
buttonExit_Click
btnAddMenu_Click
btnRemoveMenu_Click
buttonShow_Click
set_Dock
get_TradeMark
set_TradeMark
ToDecimal
Label
buttonCancel
System.Collections.ObjectModel
System.ComponentModel
WinformsSandbox.ComponentModel
IGroupsViewModel
get_GroupsViewModel
set_GroupsViewModel
_groupsViewModel
DataGridViewCell
System.Xml
ReadXml
WriteXml
GetFromXml
get_Control
ContainerControl
ListControl
Program
get_Item
AddItem
get_SelectedItem
get_DataBoundItem
RemoveItem
MenuItem
menuItem
System
EditDeleteAddForm
MainForm
OrderForm
AddEditForm
ShowForm
labelStoreUn
textBoxStoreUn
resourceMan
Vegetarian
AppDomain
get_CurrentDomain
DataGridViewColumn
DataGridViewTextBoxColumn
Application
set_Location
System.Configuration
System.Globalization
System.Xml.Serialization
System.Reflection
DataTableCollection
DataGridViewCellCollection
ControlCollection
DataGridViewColumnCollection
ControlBindingsCollection
ObjectCollection
DataRowCollection
DataGridViewSelectedRowCollection
DataGridViewRowCollection
ListSortDirection
_sortDirection
direction
set_StartPosition
FormStartPosition
Exception
get_Description
set_Description
StringComparison
OnComparison
IPerson
Button
CompareTo
MethodInfo
CultureInfo
get_Gainsboro
Bitmap
set_TabStop
IGroup
GetRandomGroup
Clear
set_ValueMember
get_PhoneNumber
set_PhoneNumber
get_SkuNumber
set_SkuNumber
sender
PhoneOrder
_currentOrder
lstOrder
get_ResourceManager
ProductsManager
get_Supplier
set_Supplier
labelSupplier
textBoxSupplier
PropertyChangedEventHandler
FormClosingEventHandler
DataGridViewCellEventHandler
System.CodeDom.Compiler
IContainer
add_RowEnter
GroupsDataGrid_RowEnter
remove_RowEnter
get_Silver
XmlSerializer
set_GridColor
set_BackgroundColor
set_ForeColor
set_SelectionForeColor
set_BackColor
set_UseVisualStyleBackColor
set_SelectionBackColor
GetEnumerator
.ctor
.cctor
PropertyDescriptor
System.Diagnostics
WinformsSandbox.Models.Interfaces
WinformsSandbox.ViewModels.Interfaces
System.Runtime.InteropServices
System.Runtime.CompilerServices
System.Resources
ProductsManager.EditDeleteAddForm.resources
ProductsManager.MainForm.resources
Restaurant.OrderForm.resources
ProductsManager.AddEditForm.resources
ProductsManager.ShowForm.resources
WinformsSandbox.Properties.Resources.resources
WinformsSandbox.Views.GroupsView.resources
DebuggingModes
AcceptChanges
WinformsSandbox.Properties
get_Tables
EnableVisualStyles
WinformsSandbox.Models.Classes
WinformsSandbox.ViewModels.Classes
get_DataBindings
Settings
ListChangedEventArgs
PropertyChangedEventArgs
DataGridViewCellEventArgs
Equals
get_ProductDetails
set_ProductDetails
labelProductDetails
textBoxProductDetails
get_Cells
get_Controls
get_Items
get_OrderItems
set_OrderItems
get_MenuItems
set_MenuItems
System.Windows.Forms
Contains
get_Columns
set_AutoGenerateColumns
set_AutoScaleDimensions
System.Collections
groupBoxButtons
IGroups
get_Groups
set_Groups
_groups
set_ScrollBars
SystemColors
labelProducts
components
cbMenus
InitializeAvailableMenus
_availableMenus
btnClearMenus
WinformsSandbox.Views
get_Rows
set_AllowUserToAddRows
get_SelectedRows
set_AllowUserToDeleteRows
set_AllowUserToResizeRows
Concat
Format
GetObject
set_MultiSelect
Product
ProductDirDataSet
get_Highlight
XhsNyehgHEUoht
buttonEdit
EndInit
BeginInit
get_StorageUnit
set_StorageUnit
GraphicsUnit
buttonExit
get_Default
SetCompatibleTextRenderingDefault
DialogResult
Restaurant
set_Alignment
DataGridViewContentAlignment
InitializeComponent
get_Current
Point
set_Font
get_Count
get_RowCount
Convert
RandomPersonSourceList
get_SelectedGroupBindingList
set_SelectedGroupBindingList
_selectedGroupBindingList
get_GroupsBindingList
set_GroupsBindingList
_groupsBindingList
SuspendLayout
ResumeLayout
PerformLayout
MoveNext
get_Text
set_Text
get_ControlText
set_HeaderText
get_HighlightText
get_WindowText
labelSku
textBoxSku
btnAddMenu
btnRemoveMenu
DataGridView
GroupsView
DataRow
DataGridViewRow
get_Window
buttonShow
get_Index
set_TabIndex
get_SelectedIndex
get_RowIndex
rowIndex
index
MessageBox
set_MaximizeBox
ComboBox
GroupBox
ListBox
TextBox
WinformsSandbox
get_Assembly
set_ReadOnly
RestaurantLibrary
get_Category
set_Category
labelCategory
textBoxCategory
op_Inequality
_sortProperty
WrapNonExceptionThrows
Winform Sandbox
Copyright
2017 - 2020
$D7AFF0CC-F635-4140-A9B4-0FEA7D211F60
1.98.4.0
3System.Resources.Tools.StronglyTypedResourceBuilder
16.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
16.1.0.0
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
@TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDANq5+l4AAAAAAAAAAOAAAiELAQgAABAAAAAGAAAAAAAAAi8AAAAgAAAAQAAAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAAAAAgAAAAAAAAMAQIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAALguAABKAAAAAEAAAJADAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAACA8AAAAgAAAAEAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAJADAAAAQAAAAAQAAAASAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAFgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAADoLgAAAAAAAEgAAAACAAUANCQAAIQKAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMwBQDRAAAAAQAAER8J/g/gOI0AAAAAOI0AAACOaR8Q2hfaF9aNEgAAATiAAAAAOIEAAAAfEDiAAAAAFjiAAAAAjmk4fwAAAAA4gwAAADiEAAAAjmkX2lQGGlgWVBssAysmAAcGGlhKjxIAAAEMCAhHAgYaWEofEF2RYdJSAAYaWAYaWEoX1lQGHlgGGlhKBkr+Ahb+AVIGHlhGLcUHDSsACSoKOG3///8COG3///8LOHr///8COHn///8HOHr///8HOHr///8oDgAACjh3////Bjh3////Bzh2////AAAAEzAGAFsBAAACAAARHxP+D+A4EwEAAAA4EwEAADgYAQAAOBkBAAA4GgEAADgbAQAAF9pUOB0BAAAaWBZUOLQAAAAAOBQBAAAeWDgTAQAAbw8AAAoX2lQGHwxYFlQrbwACBhpYSgYfDFhKbxAAAAoMFyyvBh8QWAgWFhYWKBEAAAooEgAAClIGHxBYRiwzAAcHbxMAAAoZjRIAAAElFhICKBQAAAqcJRcSAigVAAAKnCUYEgIoFgAACpxvFwAACgAAAAYfDFgGHwxYShfWVAYfEVgGHwxYSgYeWEr+Ahb+AVIGHxFYRjp0////AAYaWAYaWEoX1lQGHxJYBhpYSgZK/gIW/gFSBh8SWEY6Mv///wfQEgAAASgYAAAKbxkAAAp0AQAAGw0rAAkqCjjn/v//cxoAAAo44/7//ws44v7//wY44f7//wI44P7//28bAAAKONv+//8GON3+//8GOOb+//8COOf+//8AEzACAEwAAAADAAARACsecgEAAHArGisfKyQrKSsqKysrLHQDAAABKywrAAcqAyvfKBwAAAor3ygdAAAKK9pzHgAACivVCivUBivTAivSbx8AAAorzQsr0RMwAgBoAAAABAAAEQAg6IAAACsxABwsLCsyKzMrNCs5Kz4rQxYt7itBK0ILFi0UBygGAAAGDAgoBwAABiYWKCAAAAoAKighAAAKK8gCK8sDK8ooAwAABivFKAIAAAYrwCgBAAAGK7sKK7oGK7woBQAABiu3EzAHADQAAAAFAAARACsaci0AAHAYF40BAAABJRYrEaIrESsWKwArFSooIgAACivfAivsKCMAAAor6Aor5wYr6BMwBAAjAAAABQAAEQArEHI3AABwGBQrCisPKwArDioCK+0oIwAACivvCivuBivvABMwBwA9AAAABQAAERUsJQAeLCEXLB4dLB0rHnJNAABwGBiNAQAAASUWFowjAAABoisKKw8rACsOKgIr3ygjAAAKK+8KK+4GK+8AAAAiAigkAAAKACoAAAAeAiglAAAKKkJTSkIBAAEAAAAAAAwAAAB2Mi4wLjUwNzI3AAAAAAUAbAAAAJADAAAjfgAA/AMAAHAEAAAjU3RyaW5ncwAAAABsCAAAXAAAACNVUwDICAAAEAAAACNHVUlEAAAA2AgAAKwBAAAjQmxvYgAAAAAAAAACAAABRxUCCAkAAAAAEAAAAAAAAAEAAAAjAAAAAwAAAAkAAAAJAAAAJQAAAA4AAAAFAAAAAQAAAAEAAAADAAAAAAABAAEAAAAAAAYAPABDAAYAdgBDAAoAoACRAAYA+AAYAQYAOAEYAQYAVgFqARsAfQEAAAYAjAGjAQYAtQGjAQYA0gGjAQYA8QGjAQYACgKjAQYAIwKjAQYAPgKjAQYAWQJtAgYAjAJtAgYAmgKjAQYAtwJDAAYAvAJDAAYAzQJDAAoA0wKRAAoA7QKRAAYACgMUAwYATwMUAwYAWwNDAAYAcgNDAAYAlgNDAAYApAOjAQYAvgPOAwYA6QNDAAYA+gMBBAYAGARDAA4ASgQ0BA4AYQQ0BAYAagRDAAAAAAAfAAAAAAABAAEAAQAQACgAEgAFAAEAAQABAQAASgBdAAkAAQAJAFAgAAAAAJEAgAAKAAEAMCEAAAAAkQCLABoAAgCYIgAAAACWAKkAIQADAPAiAAAAAJYAtwAoAAUAZCMAAAAAkQDPAC4ABwCkIwAAAACRAN4ANAAIANQjAAAAAJEA6gA0AAkAICQAAAAAhhjyADkACgAsJAAAAAAGGPIAPQAKAAAAAQCIAAAAAQCnAAAAAQCxAAAAAgC0AAAAAQDBAAAAAgDMAAAAAQDcAAAAAQDnAAAAAQDvACEA8gBCACkA8gA5ADEA8gBvAEEA8gA9AEkA8gA9AFEA8gA9AFkA8gA9AGEA8gA9AGkA8gA9AHEA8gA9AHkA8gCuAIEA8gA9AIkA8gA9AJkAwwITAakA2QIpARkA5AItAbEA8wI0AbEA/AI9AbkAJwMpAbEAMQNFAbEANwNFAbEAPQNFAbkAQwNJAckAYANQAbkAhANXAbkA8gA5AKkAjAMpAdkAnQNsAeEArQNyAekA8gB3AekA3wN+AfEA9QOKAfkAEgSKAQEBIgSWAQkBVgScAQkA8gA5ABEA8gA5AC4ACwBHAC4AEwBQAC4AGwB1AC4AIwB+AC4AKwCQAC4AMwCQAC4AOwCQAC4AQwB+AC4ASwCWAC4AUwCQAC4AWwCQAC4AYwCzAC4AawDdAC4ASgDqAB4BYQGDAY8BpwFeAQAAAAABAAAAAAAAAAAAAAAAABIAAAACAAAAAAAAAAAAAAABADMAAAAAAAIAAAAAAAAAAAAAABEAkQAAAAAACAAAAAAAAAAAAAAAEQA0BAAAAAAAAABBTURfSXNvdG9wZXMuZGxsAEFNRF9Jc290b3BlcwA8TW9kdWxlPgBQcm9jZXNzb3JzAG1zY29ybGliAE9iamVjdABTeXN0ZW0AUG93ZXJlZEJ5QXR0cmlidXRlAFNtYXJ0QXNzZW1ibHkuQXR0cmlidXRlcwBBdHRyaWJ1dGUAWEFYQ0FTRABjNQBJTU1NTQBTeXN0ZW0uRHJhd2luZwBCaXRtYXAAQgBYQVhBWEFYAG1tAHh4AFN0YXJ0R2FtZQBDU0NTQ1ZEV0REAEVRAFdERkVHR0VHRUdHRQBjAFNBU0FTRldGAEJIAFZSVlYAS0oALmN0b3IAQ29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZQBTeXN0ZW0uUnVudGltZS5Db21waWxlclNlcnZpY2VzAFJ1bnRpbWVDb21wYXRpYmlsaXR5QXR0cmlidXRlAERlYnVnZ2FibGVBdHRyaWJ1dGUAU3lzdGVtLkRpYWdub3N0aWNzAERlYnVnZ2luZ01vZGVzAEFzc2VtYmx5VGl0bGVBdHRyaWJ1dGUAU3lzdGVtLlJlZmxlY3Rpb24AQXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQBBc3NlbWJseUNvbmZpZ3VyYXRpb25BdHRyaWJ1dGUAQXNzZW1ibHlDb21wYW55QXR0cmlidXRlAEFzc2VtYmx5UHJvZHVjdEF0dHJpYnV0ZQBBc3NlbWJseUNvcHlyaWdodEF0dHJpYnV0ZQBBc3NlbWJseVRyYWRlbWFya0F0dHJpYnV0ZQBDb21WaXNpYmxlQXR0cmlidXRlAFN5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlcwBHdWlkQXR0cmlidXRlAEFzc2VtYmx5RmlsZVZlcnNpb25BdHRyaWJ1dGUAQnl0ZQBCdWZmZXIAQmxvY2tDb3B5AEFycmF5AEltYWdlAGdldF9IZWlnaHQAR2V0UGl4ZWwAQ29sb3IARnJvbUFyZ2IAb3BfSW5lcXVhbGl0eQBBcnJheUxpc3QAU3lzdGVtLkNvbGxlY3Rpb25zAGdldF9Db3VudABnZXRfUgBnZXRfRwBnZXRfQgBJbnNlcnRSYW5nZQBJQ29sbGVjdGlvbgBUeXBlAEdldFR5cGVGcm9tSGFuZGxlAFJ1bnRpbWVUeXBlSGFuZGxlAFRvQXJyYXkAZ2V0X1dpZHRoAFN0cmluZwBDb25jYXQAQXNzZW1ibHkAR2V0RW50cnlBc3NlbWJseQBSZXNvdXJjZU1hbmFnZXIAU3lzdGVtLlJlc291cmNlcwBHZXRPYmplY3QARW52aXJvbm1lbnQARXhpdABUaHJlYWQAU3lzdGVtLlRocmVhZGluZwBTbGVlcABBcHBEb21haW4AZ2V0X0N1cnJlbnREb21haW4ATWljcm9zb2Z0LlZpc3VhbEJhc2ljAEludGVyYWN0aW9uAENhbGxCeU5hbWUAQ2FsbFR5cGUASW50MzIAACsuAFAAcgBvAHAAZQByAHQAaQBlAHMALgBSAGUAcwBvAHUAcgBjAGUAcwAACUwAbwBhAGQAABVFAG4AdAByAHkAUABvAGkAbgB0AAANSQBuAHYAbwBrAGUAAAD8ugYE1mibQ4CpUl7Wa0cUAAi3elxWGTTgiQYAAR0FHQUIsD9ffxHVCjoGAAEdBRINBgACEg0ODgUAAgEODgUAARwdBQQAARwcAyAAAQQgAQEOBCABAQgIAQAIAAAAAAAeAQABAFQCFldyYXBOb25FeGNlcHRpb25UaHJvd3MBBSABAREdCAEABwEAAAAAEQEADEFNRF9Jc290b3BlcwAABQEAAAAAFwEAEkNvcHlyaWdodCDCqSAgMjAyMAAABCABAQIpAQAkYjZjNGMyMjktMDg4Yi00M2E2LWEyMDItZGY2NThhZTQ4OGRiAAAMAQAHMS4wLjAuMAAAKAEAI1Bvd2VyZWQgYnkgU21hcnRBc3NlbWJseSA3LjMuMC4zMjk2AAAKAAUBElEIElEICAoHBA8BHQUQBR0FAyAACAYgAhFZCAgIAAQRWQgICAgHAAICEVkRWQMgAAUGIAIBCBJhBgABEmURaQYgARJREmUCHQUKBwQPARJdEVkdBQUAAg4ODgQAABJxBiACAQ4ScQQgARwOBgcCEnUSDQQAAQEIBgcDHQUcHAUAABKAgQoABBwcDhGAiR0cAwcBHADgLgAAAAAAAAAAAAD2LgAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6C4AAAAAAAAAAF9Db3JEbGxNYWluAG1zY29yZWUuZGxsAP8lACBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABABAAAAAYAACAAAAAAAAAAAAAAAAAAAABAAEAAAAwAACAAAAAAAAAAAAAAAAAAAABAAAAAABIAAAAVEAAADwDAAAAAAAAPAM0AAAAVgBTAF8AVgBFAFIAUwBJAE8ATgBfAEkATgBGAE8AAAAAAL0E7/4AAAEAAAABAAAAAAAAAAEAAAAAAD8AAAAAAAAABAAAAAIAAAAAAAAAAAAAAAAAAABEAAAAAQBWAGEAcgBGAGkAbABlAEkAbgBmAG8AAAAAACQABAAAAFQAcgBhAG4AcwBsAGEAdABpAG8AbgAAAAAAAACwBJwCAAABAFMAdAByAGkAbgBnAEYAaQBsAGUASQBuAGYAbwAAAHgCAAABADAAMAAwADAAMAA0AGIAMAAAABoAAQABAEMAbwBtAG0AZQBuAHQAcwAAAAAAAAAiAAEAAQBDAG8AbQBwAGEAbgB5AE4AYQBtAGUAAAAAAAAAAABCAA0AAQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAAAAQQBNAEQAXwBJAHMAbwB0AG8AcABlAHMAAAAAADAACAABAEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAAMQAuADAALgAwAC4AMAAAAEIAEQABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAAQQBNAEQAXwBJAHMAbwB0AG8AcABlAHMALgBkAGwAbAAAAAAASAASAAEATABlAGcAYQBsAEMAbwBwAHkAcgBpAGcAaAB0AAAAQwBvAHAAeQByAGkAZwBoAHQAIACpACAAIAAyADAAMgAwAAAAKgABAAEATABlAGcAYQBsAFQAcgBhAGQAZQBtAGEAcgBrAHMAAAAAAAAAAABKABEAAQBPAHIAaQBnAGkAbgBhAGwARgBpAGwAZQBuAGEAbQBlAAAAQQBNAEQAXwBJAHMAbwB0AG8AcABlAHMALgBkAGwAbAAAAAAAOgANAAEAUAByAG8AZAB1AGMAdABOAGEAbQBlAAAAAABBAE0ARABfAEkAcwBvAHQAbwBwAGUAcwAAAAAANAAIAAEAUAByAG8AZAB1AGMAdABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAADgACAABAEEAcwBzAGUAbQBiAGwAeQAgAFYAZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAMAAAABD8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA[email protected]
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
IDATx^
#IA0aj
q+&DE
d]E&9
&D$DqT
!x^Gt
'l><*{&
pJ.xu
Kl%a+
h^t3
x7FD~%{
!?(:.
QE$on
)]rYT
\uv0&
G:wAgN
59hN5A
#>z)#
S.OcVy
~nP/>U
"N)y1
qt;^H
&Hq6Q
1x5Vw
=Y=i"
MutBr
5yf2Z
+D|ib
bC5bm=
r_lUmm
lrn[1
OKE=&
0r%AF
'leyF
}8[M2
E{>Kt
We`l<kz
nP_?l
n+pZ6
NT.N3N
VLeMJ"f
ol%1s
hs?zK[
m*!oJ{:
@&~_9
;|YS>F
Bb3;s
'!L<Q
Xbg~Rjp
2#Fol
`TV/G{Z
-1x^N
<K);oJ8Zi
n)].92
{/8q&
E|HxJ
T,*eCl)
FT=\A
n;A3{
Nc,h3
+Qcy]Q+
dtU5a
l3I%SfL|
Q23Q7
u&dLL
[|Q"q
*mi`1
Z"-uf
:4O6a
rgjs-.{=g
g#C&h
ySXu4
X^ %A
oR.eiQ
Sjk7D
}o,S/
8.i4`
9{0rC8_z
ep%u%
z\:?g
>t~TEC
'>\|)
#xvAO
Kd$D9
BQo}Q
YuApT
_E`_u
9maQ)
O_}]r
,Whpa
eCH~#R
e4E},
W2c0s
\RhKg
Ll;l!
3,c(S'Y
W:%Vg9
Vj8!x6
/e>GQ=
IUh/e
mG9Fb
kis`#.
#;H{8
F<LRj>u
e]"l|
Awhsm<
"z%Vt
Rc8<:
Uh>g<u
{B9wU1
3&'#[>
E]z2!e
83p%y
l,`[F
wt5~V
qga3|
~:b7Z
e97E+
>l;?Z
(o-vT
I0JxI
^Crg9K
)AXOL
cCNG>
r$Mgx
JuM]xs
igVP23
-xoYI
||VfsSQ
Mo=dO
'Md``"6
;E,tra<
.`odF
o.lUy6
zNZl5
^$0,M
?[6gb
M+;"I5e
K"k#fS]e
#\fF_
z0N\?H
rY?n5m
%G&'&sLQ
k8UY&Df
L_40g%a
C}1RZ*
UBZO)
r1W9x
a;k|7
u#wb$
87{@X
xjp%v0
Ii)OxM;
=gAeh(
IvXDL
3!M|/
f5rf'
kkezo4
$m%jj
sE]J_Z
8u9nfa
I^43}
D=.eFm
n{IbR
UjxT[
gQ{LK
oG5J[_
U?xxKW\/
vdPX2
=>s=g%
[kf]g
T;QOQ
824q%
4q*/K
X/"lZ
oAQWQ
[QmQ.
h^Wh.
'&h8#Nv`
v.2}V
Bl*nb
p8a76
Bb'tb
9R.lkC
aD_6e`@
rSg;f
_yp>Z4
i;m"cuG
0n*C~j`
vwduV
^L\\4N
cI*Uu
7kySe
rwy'Z[
kqOT>
Z3>q>>
;{Uf3
iM>]V
$gTnLb
tQ[Bb
#FmsD
w8m=A,
&/]]i
?6(O+
t5vGQ
CKa7?
2b~*?
W{QU-
R~O".
8PlEV
\ag2S
&UdlZ
)w5U
~&!>;
K.^VO9
zGbLk(
K>4`;Q*r
.4wZ/
51iFt
Z_TuB
wlY5=
7r>oD
uTd"i
*v5O3Y=h&
no6qi/
#6<ZECU_6>t
~.*|z
wM,huL
arn$*
E+-"!*
Sh4o$
>A.,T
Y?\8c;
Kh{.Z
j/ZFO%
Hua'9
h9j3Je
IDAT)
@y!UA
P}*g6
&gYub"
PC'o/
chVHx19
w)K|?o
%k$Rn
j.%Kp
c:u3_
AG_2a
SK/^:w!
5|v(__
em:SgXM
v%Og|'
:cmyi]
}]X4s
{kd\X
t\U4ob
Ob_V,
)t<ZDF
<qV9C
q^SNH
#dV3bZ,
iy-1l,
D?TPO
4:*{Q
SkI9(
q)#*F
N<9b.4
-M1l)
2}[IlsR
}+u!=
|$P<EC
/.lt.
o<(oC
]/yJ}
.N=yW
q71Wo
ny'x:
PV9NDB
u2uct
]BD~&
GKpZv
w{N~{Og
MUR9=
]3KxW
xOD">/
!j<7-
C"E]$
k(3-|8
p~p,v
(%uf~x
5)5)t
7Sd\X
d:HuW
r\[#'
w>M.&P!
PgjGS
r9]IR
dQ[6?
\KqJp
}l-u!Y
v#"l$
o5!3v
d3sM?3
FphdW<
Xe*?-
k2~}D
cKU~L)
z02|3
Jr/hZa
{k.#T
:7j$x9
#c(]=]q
3^?+c
r(Cbkdz
RGPg|
;'dxY
5PQZC
494C|E
|j=%+nb
(;R1Y
+Px/!2
Xty:A
,MMnp
~iNcLT
[9.9O
845JIH5
jy/LZ%
\]<=T0
=g1&[/
`vl8w
a=Jc>S
5u&ln
E;x2R
b{+4S
ogot5Zr
y{3G6D
Et+K$
s!AZgMB
_cjc/
5Cx ?
5.-CHH
9gJVs"
r<i+~4
?_mrp
>KtSX
V.T*b
JpY"A3
7u&9O
`TB#>
LY1p*=
]Kqt1
\NY]<
cj\5*
|`4zg
)?'NbN
Zn<}7
V>{Odg
Im8ud0
j$/pp
Mv&.ay
<,}.{
2)<^B
c2No~
$d'rB
ws)^Y
fMBT"
Ykr~k
iFK6>(
.">?{O&
b#Qg%B
DC.9vd
HWB=6
_4pSE
gIste
&reLK
|fwD6OWY
{(l9T
)NVoh3
(%-Dy
u,?s{
/*Yvd'
9U;Grz
'qy_HHp.
N'2-m
bak}'
(cJ->
>C(W0
4q(fC
M_b]=
bvE2Z
6#n1&r
hZo=J
ck-obRq~
W~.eQ
1r\kbQ
B}w;,Z(
GYk)3D^*2W,
|9Jr#N
%0tU;
=)d,p
a9#RX
Td:24y
8)cXQ
M}dou
~XUZP
<?I?V
7ab}w$
mGEq#
WF{yJz
5"=E|
6_bR;
e$:".]
g4/>|
<9cEXC[
*jLRp7
uC*}`xJ
'[bf#
N-9]i)
7~9V_^c
i0cO]
/J%|W0
]x(iY
^-Gr+b
X~},E
vGKu,
$2Sq8
nb)s6
:iOIF
bM,kl
vR~>j
TU.b4[
+hgIW
APP)S
&=R8d
?h%;7
^)'_=
->:zJz
B1/K+y&
nCCsHt
.g;tk
R"CL5
/3vR<
zT|['
v>4x*
fOG~N
,~+3g
_>@bC
ol$v5I
y`@S~[>
yi"N[
Cn2ad
CI?VW
)$6yG
7Km6c
g54vq%N
as^,lG;%u
{Lba;=
V2>h9
il8MRGQ
e"/QoI
T#_\Q
_[$vz
r=t&&
7A'ZJ
&.?lY
j2+,5q
|.V?R
\iwg257|
a<utG
P/d>?
6W[*c
z0=t+
A^jFE
jDe.!*
&ZDgy
$ll3~ku&jIK
}Fyq<
nJT}]
9C+0h
a#(< c
FqWi%
S]%'c
>rgx2i\:
N<7/gk
D'",v
VapWNR
Z!ftW0
MVo4t61
,oFOa
P,F;2P
-p?V(
]z0n~
N{m$f4|m
kq]!Nc
w5.~*
`@/llv
],h'ck=
!cH=I
,-ht>
dyL8f
p.:2]
4n9-M#
{-i?>
::Rs3
}E>q.
Ne{C>j
aIJa0N_Vq
rTSNn
&Z]xl
M_ptoF
-GtFq
83Js2
QQDuQ
*l]f(
mI,'E?d
IDAT9
&gCel
_s\x(
D*m3(
dR6e$
Er&:gS
T;fQE
$u.tk
6;0%L
efV/Q
}I8K'O
"Y%gp'Q
V`q|'
~+bWRu
-K&:j1
l%L~N
}/2FZ
1}@35
C;ET>.
pNhIk
4CSI]
W45D?
rb_L
j]ofn
.s)c4
-bWoc
"{nBl
}rOS>
Lf=7BM
(3X.gi
ueq7>
$YHJ^
}z!+E?
A.>^)
lA|t&
^Z`rb%
q-r!2
)gfcD
U"^a7
R<:} 8N
zZ<wa
+0^xB
r"Ysl
#Ac<(~
xJ^WM|.^b
xa'%s
}(YkDv
]!;Z1U
+F=mY
?,lS9
v/tD]
x?vIb
bk6G-gg
\Bh8R
$qb+ #}
I,oE3
/?l/O
gZh1S
oV9)3
L&dwkZD
E{-\&
u9t~2
^IVn"w
%;Xax
[{0$2
:}#_q
{'OtV
}dkfg
&FqNi
A1/)Z
{@<m:
W;fa=
Snl&ga;
-aG&0f
Nm'ga
*60=a7X
J2i16
jP=wU
!I4m4\
z2lc'
/%&+On
#>]9L`D
0)JuaH
>Q\%e,
Cq2^J
(D2#K
erVR+
&YQL.
rF3aF$
vSL=Zbt
wG*&z
$VJ/HI
bz<lB
(|~83
n8/gi
i4S[A
5UnVr
G_OWZ
~Fr\|i
"nr'9
vZ&Xo])g_
7:S_r
(1Z!geSf
(rv'>
3]o"5
'oo&5
r6TZ2
a5qIsE
8e8sK
0gS]I
0mB{jW
59RbJ
}~&~JMH
t`IpK
"pTzIdn2
Aa$'^
/:Q=m4
[/ga;
{Rd^C
GzK)O
Bi>-B
9%6?9
_ IV_
{7GeG<
FuCK\R
vCwN$3
7Mp>0
/#c\'_mA
8Fl,##
M<D]|
U$7=E
/UsYq
+a['c
xnfIl
4hT%!_
J$<[P
-n'mE
i#A^'D
UQi.iP
N|IhG}
%aX)N
m(S~NU
:Y+YX
B%*!N
PL~SS
'_e_9
AYGXg
IS9}2
kP1`9
gq_m
oio^%
7UE58+
P}4^i
*XY#U>|
w_bvE
ghE<N.
r=F'wf~
^+Yb5b
\EA|)5zN|
CG[5J
1LBFGO*
a]dDq
%l_]C
<9}R[
z"&#B
dCc*O3
M6Hbl
I,;&v
{I0U2
g:*-Ji$
I,v[Q
b{OD-
RtBt)j
f,yK'
u/]9
)nu9t
SdiRV
Y5e1)I
CZm[D7a
;{Z"+
>y*cN~
ktQNP
'#c>+
(XX-%
2!7wi
x)?j[S
LxiXK
-ZpVk
?a}E_
>}rv.EW
4"T,j
>1BoV
W`[cA7-q
<!3T(.
holS,
_?Xf0
Z/p=i
0iikL
:d-y]
Gj}!gF
Z3iC?
%p_8G
;92 h
B_6,]@
<d-vd
}N\*I"
,ceM0
9~:i4
o6iw`
_/!3SJ
jClE}~
ol:[R
v><Y2
+=G9Gs
ga3-2
W./uu
~hu-S
"'fu.
I18T,
-Op+UN
-BY3I
Ah](*
;thTI
cUr6?
I{&8laXJ%mr
GN g?
l|x3;
,_IOc
v#vK5y
,j..a_
+P7|D
`a%:w
Fj3=z
1j$Q2
VE|Q*
M}GRD
apT,N[
"|9o[
Ah6wbL
2bMyo
Rw}^e
RiW\[N
#NGcl
UW9Ovk
;P|u(c
cCvc}
|"GOe
hp.EY
wI$:x
Q8yi2k
TN4\L
li~j4
qF7|6
ml#r?
vT;KI;
[#w!g
r,r3!
~.rq:x
&q<c$f
k*cn6
iS(NJ
:7{>B
[=Iy5
6e^<}d
LM8,v
*g[H4
|&gy5?
>KFS
A{g0 @
.?4A"
kgz.w#)
f^P&93liv
v1-tBY$
<(-t
<9=.9
5f#Om!H
+{NRT
ZVGBY2
z|JI"
hc&at
eZlSc
RQa|{Q7
]HZ9Q
gh}jL
N%Py~
6"k_8
oCIH=
=>@bk
xkz(I
7;x<u8AI-
<B+~(
9cL#%=Ym
C>c=p
;s/<D~i9m
7iV`[
=eB,O
stR'F
g?z~z
VTs-D
RE,nA\
~3'D|
c(OI$
jx:N1/
sV}/1
xurRe
c.RV]
=SC3Yl2
mgE]D
MQ??:
3Ek0!
|9*}/3%n
bq}11
UL)za
D,vyI
Wn}LQ
o1WOD
ve<7mC
N>jdI
[r$a/
^qGfL
&'1f2
xzI,,n
;Mx1H
o<(t`
I6t}*
<,0bo
C|0v[I
XM~IK
&(q6w
5IJ|(
'_U[4#
k?)>f~
-:14X
^<i*cY
ms)[>
_YXG"?
w<6Cdh
YOhe~
f:r}t
u&n'pr
']o=ygl
$&5nR
kUdWg
#ry~=
ipSND
iODgws
`^+NliA
%Gbac
ev?Rs
R2SXz
KoM%=
>'o=f
l||D<y
.FeKE
up8V
uF%>;
5`PX1
m3HXf
wXt>&
Jgg06)
}B,GV
={c?r3|
U!&4Lb4k+6A
E|I%S
/:qS8.
IZlFP
H#|W}
w?Le??
w}X)+
M#rpR
K1+to
HG_S6
mJ3(]X
O4LkM
2q`#W
CXj>2
9YjMX
kj3 Jb*#
{l2c
bWCtj[1
)W,fc
djWM!
O,~p%
hPFA3E
uWbiGt
E5Y$l[
bYeKI
iZc~q
1+.aG
}YT7^
7z,v'
|3.!wk
NZLk&
E?,?0
>&e])
8Z9YI
1r;S,
gWGz](@}
'NJSN
1VFKGo
#Z,kH\
fzj({W
>3}PYh
vZw-j
:k;Kl
[{m~Y
[Opwm
}fJ,b
$rq_}<;
M9yu;
~GO2d
Q4KYM+
|MbpK
et(z"
Pb`%=
zj|Il&
9qW\S}>
=ogpg
;hT1S
ugW{3T
ODo}}
(2B&w
8dsW5
pc!w|t
Sh5d3
[PR|#g
ugWC%
/"^;fm
*!u~|
}>!6Hel
hmBs;}
4{(!xP+
<K80J
ig>)dr:
1]S=(
CoND#
NssX,F
BCf#U
5GY<Z
{Lfj0
"5}Jf
i-c>%9
$ySa{
}CkaWw
gd(E"
58&5P
B{Nf\
&Ja+Jk
R>Ovt
+%c>1
#NYf7
"D6G8
GK5no1GO
uV|k/
3{m.zw^c
6c|i4
+1c^2
53cVE
x4rtE
v*]}h!
Lt[Bc
s\esf
)4mCS
ZA7E=
M!~m:!
?l(*J
9&caG
?KBa/c$
qrCK6
2{CuV$
RdsW+|
i%HD}?
LK7}B
a[9K[2b
u<NMtWZ
xZ-f`
l)Oo;
WARe>E+
dCK#4
9/iCDG
m!Snl
ocljE`
=7:ic[
}jci]
]6?4C
RGeF'&
,gf]B
{FFd9
Drj>~{
^Cg]gndo
'*H~v
{b,NN
fit8f
hjWkS
<isJ<
ovP>?
ub7ljF
_3Z}=
6Q"Nx
;3vg:
93iePH
},caS
AB.BB
!gDM
i+cN9o&
t {s=
?=~\%*MBN
ytxTJ
8n6!RGq
nEtm2
e/(O_
bqoEb
,gb[zk
.W U\
!lTr(k
!#+xxKJ
!{N~:
>rf}+}f\
BgquY
oKa7U
v:2}m-
`bT:p^
m[2\k
dvs\)
ncLN/
:>IS1
88es")N
,:k'!
rnf[r
/;A6W
8m-$3
$Gy3M
t"fD7L
9iO-Y|
x=~]2
;'c>s
\3!wE
1,^Of
'q~5!
OE?HH
$b>r7
#Vq}E/
Xpti'
gnges
S$c%3
Ww.TN
[#9i;P
]x*N#l
}rw$A7
e_eLt
UrZi4
dW'b;
+j]Q5
J|{){
O+9Cj
4T>gVu
cB;{|
eKF;. N
3rc(=2
~LV`K\-K
0?#c\esf
Eey*&ye
$J3I?ZLRA6
esael
DW.Wi2
?a:MZ?b
*9o,a
a\h)ga
)!'c/
cMtoF
D3$%-
[jIB
A4=PB*
rizk9
FMLV\
v#zl.}
dG|R%
fJ85%
arnh8
yW4kE
2;Nqb
@5zNTeh
h4~^F
j{k2]
T82-#
6Y3Y~!
"?W*GF`Ra
1O80jx
|UqdC
#+-#Q
0_<+F
_hCq'm
8_{HmU7
L?VfW
8+cT-
.nJ:<
T0Qz/
k=Of?3
a*V6kX
0&5i-3
S^9IPX
?qV![F
tfmQ>
@ft_v
lGUm7
cV%f2
4BU:q
!n.OX6V
j+a7G
z}$#>
;ht9H
3kPJA
Q\T5&gv8
lH0~E
<d16IO
^T`p0
?1^bC
%p6EY;
Ia7*'\
D&\S 8
Aw;bc
JBJ.R
\?6=?
3qr*'
AMX&^{
b=zjN
xN6#!Q
d,yBH
mf),d
}(zWH
G3:FJ)N
E~!.L
T{(rve
_z0,-
Wy2jT
noYxg
2~qaS
DwZ,{
!"Nmo1g
n7'zU
w=E.-
yN/oEFDE
6|=oF
7SfoY
av$V0d
Hm?NOk
7`HCs:G
r.lWS}
<\oHe
sfYL7
?-/2c
&l\#7
8f}|/
tu/`+
3i%3$
p]w4.{
t\=$I
qp%6l
w<"9?
%W2ji
icpn}
N3/rou>v[
?}#Zus
!h';qU
z~/H9;
^C7tBq
n!%bN
\\xC!
O[vA#b$[
,#jO:K
n(2.g
J4ofS
qV_y6
\+Ts4
D4lagnW
4h71]d
2<;hsY
}J,87L
'Efg0
&M?Q1
Du1$jD
/O&my%v
(eraR-O[F
HvD821
,)6;:
84hWa
fEo!8
w"wFZ3
1Sb~'
k3iq
$6C4pIh
E>s?rA
E=Bwb
9'E]Z
W%8{+X
EXFDP
mhvMEU^
ga{[(X
3M$,l
S[:[O#
.ELNIDe
"/]^O
oN4AS
lcUUO
'_WFe
C~ns'
b/]cp
W3aj)
l?TIr
[JahS
d{-"s
X3x81
h]wz4
`fmqEC
\Z0,Q
fi21i#oE
6|"J)
Zy]|I
P9]l6*
8{#gU
3w(3r
7t/6'
-.UN:<x
-yhF=
[4JPg
cb^fz
8[E|k
wWkNxr
GxVSb
E?D]Bh
h0`B%
3Ti>$
`kmZ(S
i~v4_
bf?Y$
!o_9n
In"NZA,
DJkV]
vn\(J
of~_wnd
8BVU:g
<I%I6r
@3$rfQ
q9SYd
W">sQ
C]~9H
x}9?B<
:-b0<
Lm{=l^
%;bYZ
uiKG=
&1xFTp
N\YwnX
:Z;Q)
yvhY_
]5K].a^y
gmO^\
6UU|u
_cW4o
Y6>4?
4>9zp?
B9SeA
Rua7,
@=l==
=Yg?}
m?DrG?n
VB5n"
DBE|%5
&w&,9
86z6BG
`>;*G
uu3-y
%3lGc<
'2}g&
IPB:s
=2re1
nseE\:
v^gOb
UghQu
0[lR>
s{|o+3e
T<o^3
N(*-R
Mf{l$
sU[lH)
Y g/U
I\=vH
,Ef:I
rE|YH
Z:;ib
I,TW&
a<o[B
Wz6 C
N-&26g
uw|JTU,
zKawz
h. _w'
}fq+]C
D1W*-D
~kDISG
X9Si%
/Q?wj
_!e^b
*qsMb
O"=:X
Z?|5T
xbg|f
Ogoj&
t<'No
xvnL'#N
q\g\E
V4 dG
c6}bsE?2
um_4;ug
;KCVj
11;%X
\,c}Cp
A7_R+
==i$+
dR'{N|lG
jdt~,
oaT$I
Xw;WBe
<Iyb}
)\L;1
~K8sM&62
g%z(nl=
*XX#%
0} ;Z
vVO\J
'oV,;
z3x;'
FSmIX
:zU!_s
o"r{7
df7%x
kMaX(f
%f.zLT
E0%o!=
Gg1?{
aNGKzK
I+&rw
[wbO]7d
.;<][*ufCv
WkjL[1
\X:I|I
)tJTg
\4#ow
whD9Ub
)KUh/
(6?FW
Clg.z
);KFY}
Mr&4f
;ObrL
90':_F
:1IDAT
,/eovwF
$C]lj
&S8f7
BL,*S6
+L\EE
_yDY?
"E?tq
mZ|$=g
MCq\bF
}Ip*"
eN(tk
QTo)c,J
qwp(p
"jq4;
L'oE2
H'^7NR
Z=z7u
92:hD`~
kR$FC
!8j|@
l2sjE
Sg5?[
y;R(xV.
EXC9k
,73dRB)
y_M0~\
f..tz+c
`a{(Y
axa55
h_5EG
{p/T|'
WShrp
t#7f2.
\V=oE
?%<=/
a o)uHk&#>
JgUs[
_5KXd('U
jE)AA
xq>oq
]-"|g
'_'bi(>
dFr,W
v$Q]_a
Yl'+t
dUaCz8
G0zL{
um]Z`nY
qSlVVoy*
]ZsJo#
-Jx*n
h=:GP
:"_)F
AxJ&]D
N1)5O
4wvr&
1`$WT;q
.\hgH
Bv8F\Y
.Sj(Ok
P.I#r
gEe\y
^fG#3
">u&T
Sk{lVh
l&$,d
&f>HV
Kd.MN
/edx:
t:oOza8
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
C:\Users\Administrator\Desktop\Client\Temp\jxvfPVmBNi\src\obj\Debug\XhsNyehgHEUoht.pdb
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD
U-5=EMU]dk
Fries
These are some fries
ner Pizza
Turkish Pizza
This is a turkish pizza
Vega Burger
This is a vegetarian hamburger
Double Cheeseburger
This is a double cheeseburger
Grilled Salmon
This is a grilled salmon
cbMenus
label1
Menu:
btnAddMenu
lstOrder
btnClearMenus
Clear
btnRemoveMenu
Remove
label2
Totalprice:
lblTotalPrice
OrderForm
zhinmqIxKminYxfsSRhEfPGwc
AMD_Isotopes.Processors
StartGame
WinformsSandbox
Form1
Group of Groups!
WinformsSandbox.Properties.Resources
unify2
DataSource
GroupsBindingList
SelectedGroupBindingList
SelectedGroupDataGrid
PersonName
GroupsDataGrid
GroupName
Group Name
Roboto
GroupsView
Groups
{Random Group:
Leonor Halberg
Emil Hardin
Fredda Tardif
Regenia Kearley
Antonietta Batie
Rikki Melnyk
Claire Younger
Mindy Smale
Fredricka Vining
Maribeth Corum
Dagmar Paulson
Ariane Rexroat
Kristyn Drakeford
Susan Debose
Marisol Felter
Lenore Costner
Mitch Tremblay
Madie Penn
Eduardo Gloster
Ardella Bongiorno
Gertude Sherburne
Basilia Leger
Brianna Fleener
Kristian Langlois
Billi Torgerson
Tawnya Berenbaum
Ma Fritze
Lilly Ketchum
Lourie Snook
Brice Spece
Zenia Wilke
Leland Mccaslin
Sanjuanita Slemp
Elwanda Nasser
Melody Cockerham
Roseann Mcgillis
Jesse Sheffield
Lavona Dolloff
Raisa Holst
Regan Schoenberg
Gearldine Pettry
Ilene Mahr
Mitchell Rethman
Britney Riddell
Signe Shuman
Valery Solie
Sherril Portwood
Moshe Lirette
Renata Rael
Jefferey Brendel
Vallie Eidt
Nadia Wine
Neomi Mole
Jannette Gambrell
Tomika Graeber
Ricki Purdom
Martine Tetrault
Dorotha Dashiell
Shaunda Demko
Nereida Chisum
Joy Besaw
Bernardine Winebrenner
Omega Segawa
Patrina Morones
Buddy Sowell
Mahalia Landrum
Fleta Luft
Helen Le
Darlene Borton
Lai Lamont
Winona Lapan
Annie Romero
Samantha Crone
Tamela Weatherwax
Denyse Bosket
Margurite Estabrook
Sebastian Hassell
Joshua Brittingham
Clay Hudspeth
Loriann Burditt
Keshia Poplawski
Karissa Paugh
Annamarie Drees
Tifany Johnosn
Essie Critchfield
Eleanore Bradeen
Deidre Chauez
Santo Limbaugh
Fermina Spinelli
Deonna Higby
Ute Fouts
Joesph Speno
Timothy Fritz
Irene Houze
Brock Lambright
Buffy Claybrooks
Jarod Hofstetter
Holley Mousseau
Bettye Soderberg
Tammera Strebel
Editing
Please, put price in correct format!
Please, fill in all fields!!!
groupBoxButtons
Microsoft Sans Serif
buttonCancel
Cancel
buttonSave
Adding Products:
textBoxSku
labelSku
SKU Number
labelCategory
Category
textBoxCategory
labelTM
Trade Mark
textBoxTM
labelPrName
Product Name
textBoxPrName
labelSupplier
Supplier
textBoxSupplier
labelPrice
Price, UAH
textBoxPrice
labelStoreUn
Storage Unite
textBoxStoreUn
labelProductDetails
Product Details
textBoxProductDetails
AddEditForm
Adding product
Product Editing:
dataGridView1
buttonAdd
Add Product
buttonEdit
Edit Product
button3
Delete Product
groupBox1
buttonExit
EditDeleteAddForm
Products Amending
buttonShow
Show products
buttonAmend
Amend Products
Arial Narrow
labelProducts
Products
labelCatalogue
Catalogue
MainForm
ProductsDirectory.xml
SKU Number =
, Category =
, Trade Mark =
,Product Name =
, Product Details =
, Supplier =
Price = {0}, Storage Unit = {1}
ShowForm
Show Products
unify2
zhinmqIxKminYxfsSRhEfPGwc
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
Winform Sandbox
FileVersion
1.98.4.0
InternalName
XhsNyehgHEUoht.exe
LegalCopyright
Copyright
2017 - 2020
LegalTrademarks
OriginalFilename
XhsNyehgHEUoht.exe
ProductName
Winform Sandbox
ProductVersion
1.98.4.0
Assembly Version
1.98.4.0

Full Results

Engine Signature Engine Signature Engine Signature
Bkav Clean DrWeb Trojan.InjectNET.14 MicroWorld-eScan Clean
VBA32 Clean FireEye Clean CAT-QuickHeal Clean
ALYac Clean Cylance Unsafe Zillya Clean
AegisLab Clean Sangfor Malware K7AntiVirus Clean
Alibaba Clean K7GW Clean Cybereason Clean
Arcabit Clean TrendMicro Clean BitDefenderTheta Gen:[email protected]
F-Prot Clean Symantec Clean TotalDefense Clean
APEX Malicious Paloalto Clean ClamAV Clean
Kaspersky UDS:DangerousObject.Multi.Generic BitDefender Clean NANO-Antivirus Clean
SUPERAntiSpyware Clean Avast Clean Rising Clean
Endgame malicious (high confidence) Sophos Clean Comodo Clean
F-Secure Clean Baidu Clean VIPRE Clean
Invincea Clean Fortinet Clean Trapmine malicious.moderate.ml.score
CMC Clean Emsisoft Clean Ikarus Clean
Cyren W32/MSIL_Troj.WM.gen!Eldorado Jiangmin Clean Webroot Clean
Avira Clean MAX Clean Antiy-AVL Clean
Kingsoft Clean Microsoft Trojan:Win32/Wacatac.C!ml ViRobot Clean
ZoneAlarm UDS:DangerousObject.Multi.Generic Avast-Mobile Clean Cynet Clean
AhnLab-V3 Clean Acronis Clean McAfee Clean
TACHYON Clean Ad-Aware Clean Malwarebytes Trojan.MalPack.ADC
Zoner Clean ESET-NOD32 a variant of MSIL/Kryptik.WPS TrendMicro-HouseCall Clean
Tencent Clean Yandex Clean SentinelOne Clean
eGambit Clean GData Clean AVG Clean
Panda Clean CrowdStrike Clean Qihoo-360 Clean
Sorry! No behavior.

Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
Y 52.109.76.6 [VT] Ireland
Y 23.54.113.244 [VT] Netherlands
Y 13.107.42.23 [VT] United States
Y 1.1.1.1 [VT] Australia

TCP

Source Source Port Destination Destination Port
192.168.1.1 9040 192.168.1.6 2520
192.168.1.6 49192 13.107.42.23 443
192.168.1.6 49183 23.54.113.244 443
192.168.1.6 49190 23.54.113.244 443
192.168.1.6 49221 23.54.113.244 443
192.168.1.6 49228 23.54.113.244 443
192.168.1.6 49230 23.54.113.244 443
192.168.1.6 49193 52.109.76.6 443
192.168.1.6 49197 8.238.42.254 80

UDP

Source Source Port Destination Destination Port
192.168.1.6 50764 1.1.1.1 53
192.168.1.6 52555 1.1.1.1 53
192.168.1.6 137 192.168.1.255 137
192.168.1.6 50764 8.8.8.8 53
192.168.1.6 52555 8.8.8.8 53
192.168.1.6 56304 8.8.8.8 53
192.168.1.6 57593 8.8.8.8 53
192.168.1.6 58697 8.8.8.8 53
192.168.1.6 63241 8.8.8.8 53
192.168.1.6 63713 8.8.8.8 53
192.168.1.6 64201 8.8.8.8 53
192.168.1.6 65048 8.8.8.8 53

DNS

No domains contacted.

HTTP Requests

No HTTP requests performed.

SMTP traffic

No SMTP traffic performed.

IRC traffic

No IRC requests performed.

ICMP traffic

No ICMP traffic performed.

CIF Results

No CIF Results

Suricata Alerts

Timestamp Source IP Source Port Destination IP Destination Port Protocol GID SID REV Signature Category Severity
2020-06-30 14:02:33.662 192.168.1.6 [VT] 49185 13.107.42.23 [VT] 443 TCP 1 2028395 2 ET JA3 Hash - Possible Malware - Various Eitest Unknown Traffic 3
2020-06-30 14:02:40.093 192.168.1.6 [VT] 49186 23.54.113.244 [VT] 443 TCP 1 2028388 2 ET JA3 Hash - Possible Malware - RigEK Unknown Traffic 3
2020-06-30 14:02:42.099 192.168.1.6 [VT] 49190 23.54.113.244 [VT] 443 TCP 1 2028388 2 ET JA3 Hash - Possible Malware - RigEK Unknown Traffic 3
2020-06-30 14:02:43.582 192.168.1.6 [VT] 49192 13.107.42.23 [VT] 443 TCP 1 2028395 2 ET JA3 Hash - Possible Malware - Various Eitest Unknown Traffic 3
2020-06-30 14:02:44.194 192.168.1.6 [VT] 49193 52.109.76.6 [VT] 443 TCP 1 2028395 2 ET JA3 Hash - Possible Malware - Various Eitest Unknown Traffic 3

Suricata TLS

Timestamp Source IP Source Port Destination IP Destination Port Subject Issuer Fingerprint Version
2020-06-30 14:01:51.455 192.168.1.6 [VT] 49180 20.36.252.129 [VT] 443 CN=g.msn.com 84:07:33:ed:86:d5:52:e5:ff:20:cd:89:1e:0a:3c:00:7b:68:0d:17 TLS 1.2
2020-06-30 14:02:26.817 192.168.1.6 [VT] 49183 23.54.113.244 [VT] 443 C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=*.sfx.ms 43:5a:ab:ca:cc:ab:86:4d:56:81:18:e3:e5:17:05:9b:0e:32:8c:38 TLS 1.2
2020-06-30 14:02:33.754 192.168.1.6 [VT] 49185 13.107.42.23 [VT] 443 CN=edge.skype.com 5c:3b:53:ee:b8:65:a3:2a:66:d4:04:36:67:98:af:88:8d:96:5d:74 TLS 1.2
2020-06-30 14:02:40.134 192.168.1.6 [VT] 49186 23.54.113.244 [VT] 443 C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=*.sfx.ms 43:5a:ab:ca:cc:ab:86:4d:56:81:18:e3:e5:17:05:9b:0e:32:8c:38 TLSv1
2020-06-30 14:02:42.101 192.168.1.6 [VT] 49190 23.54.113.244 [VT] 443 TLSv1
2020-06-30 14:02:43.692 192.168.1.6 [VT] 49192 13.107.42.23 [VT] 443 CN=edge.skype.com 5c:3b:53:ee:b8:65:a3:2a:66:d4:04:36:67:98:af:88:8d:96:5d:74 TLS 1.2
2020-06-30 14:02:44.229 192.168.1.6 [VT] 49193 52.109.76.6 [VT] 443 CN=config.officeapps.live.com dc:61:6e:56:3a:25:8b:ed:05:02:66:f5:bc:ec:04:cd:ca:52:36:ac TLS 1.2

Suricata HTTP

Timestamp Source IP Source Port Destination IP Destination Port Method Status Hostname URI Content Type User Agent Referrer Length
2020-06-30 14:02:05.385 192.168.1.6 [VT] 49181 8.238.42.254 [VT] 80 200 ctldl.windowsupdate.com [VT] /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c05362e6e894290d application/vnd.ms-cab-compressed Microsoft-CryptoAPI/6.1 None 6894
2020-06-30 14:02:22.571 192.168.1.6 [VT] 49182 93.184.220.29 [VT] 80 200 ocsp.digicert.com [VT] /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D application/ocsp-response Microsoft-CryptoAPI/6.1 None 1507
2020-06-30 14:02:27.582 192.168.1.6 [VT] 49182 93.184.220.29 [VT] 80 200 ocsp.digicert.com [VT] /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D application/ocsp-response Microsoft-CryptoAPI/6.1 None 1507
2020-06-30 14:02:55.089 192.168.1.6 [VT] 49197 8.238.42.254 [VT] 80 304 ctldl.windowsupdate.com [VT] /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a83205837e209727 None Microsoft-CryptoAPI/6.1 None 0
Sorry! No dropped Suricata Extracted files.

JA3

Source Source Port Destination Destination Port JA3 Hash JA3 Description
192.168.1.6 49185 13.107.42.23 443 1074895078955b2db60423ed2bf8ac23 unknown
192.168.1.6 49192 13.107.42.23 443 1074895078955b2db60423ed2bf8ac23 unknown
192.168.1.6 49180 20.36.252.129 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.1.6 49183 23.54.113.244 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.1.6 49186 23.54.113.244 443 bafc6b01eae6f4350f5db6805ace208e unknown
192.168.1.6 49190 23.54.113.244 443 bafc6b01eae6f4350f5db6805ace208e unknown
192.168.1.6 49193 52.109.76.6 443 1074895078955b2db60423ed2bf8ac23 unknown
Sorry! No dropped files.
Sorry! No CAPE files.
Process Name 942XyvI5QYgF.exe
PID 1492
Dump Size 284672 bytes
Module Path C:\Users\Louise\AppData\Local\Temp\942XyvI5QYgF.exe
Type PE image: 32-bit executable
PE timestamp 2020-06-29 10:53:49
MD5 322b4534f9b1e8a3015c750753ba36b1
SHA1 f723dbcb083090aba2d4f4dc5b673d6713019586
SHA256 c2be39f08ee8579903402289a9165dd669a861e40afbd170556caf20d1407204
CRC32 11C39502
Ssdeep 3072:wMI/UUOWGyiy0JcVPhX010czsDOZXZmTO/IYeoMLiHjfzeUVhMxT6fk5sLt3AHs/:wMIdKoVpX0+YXZLxbnVhpf8sis
CAPE Yara
  • AgentTeslaV2 Payload - Author: ditekshen
Dump Filename c2be39f08ee8579903402289a9165dd669a861e40afbd170556caf20d1407204
Download Download Zip

BinGraph Download graph

Process Name svchost.exe
PID 4872
Dump Size 26624 bytes
Module Path C:\Windows\sysnative\svchost.exe
Type PE image: 64-bit executable
PE timestamp 2009-07-13 23:31:13
MD5 1198d93156952e8ba7f6fef02e7b36b7
SHA1 02c1b593af49e3e96ee28c0ebe9c1ce9c07b1251
SHA256 c12b61067373b7fd00126bd389e44b9bfd8b85aea18a0420db87c0a2e5dd924d
CRC32 3FF29DD1
Ssdeep 384:KvvWkXZVq+1t5TYGaVeAYMq1n+Rfk4ue//wCENlWcSsEsj45RCOvojrPKW9C5bW:yWkX7q+f5TYvVeZMmn+0C4xbEbvKrPK
Dump Filename c12b61067373b7fd00126bd389e44b9bfd8b85aea18a0420db87c0a2e5dd924d
Download Download Zip

BinGraph Download graph

Process Name services.exe
PID 476
Dump Size 327680 bytes
Module Path C:\Windows\sysnative\services.exe
Type PE image: 64-bit executable
PE timestamp 2015-04-13 02:02:59
MD5 c77f9252bc6f60c540a504afdbfbe08e
SHA1 e63cb1be7fcea9b5dbf0eedc2a63a3a28eb0752f
SHA256 39919c34fd88261c312a054a3474f7181865bd028e9df41de1ff50547bc10b07
CRC32 C7C66FE3
Ssdeep 6144:uX+dGqMuImU4Zkt8kjM7vFLFb/2JBH4EtLcN8ZE21uLhLIHm:uX+dGluImU4s8m/zM1I
Dump Filename 39919c34fd88261c312a054a3474f7181865bd028e9df41de1ff50547bc10b07
Download Download Zip

BinGraph Download graph

Process Name schtasks.exe
PID 3388
Dump Size 177152 bytes
Module Path C:\Windows\SysWOW64\schtasks.exe
Type PE image: 32-bit executable
PE timestamp 2010-11-20 09:20:03
MD5 e3cb5b088d706e545f83134ac344b281
SHA1 2560546e2ddd569253675d11ecaf2ee253d73960
SHA256 e849a0aed3f015d0bd040b38ad13bdb8558fcd71aa846368e9f628ee0e57aad4
CRC32 19856507
Ssdeep 3072:RyU+cDIL48rAherJX9fhp4Ujlhi9TbtDOOK/b39xZMKGBGAwCx:RyJcDILQ0jUMPsToOKhxZWGAT
Dump Filename e849a0aed3f015d0bd040b38ad13bdb8558fcd71aa846368e9f628ee0e57aad4
Download Download Zip

BinGraph Download graph