Analysis

Category Package Started Completed Duration Options Log
FILE Unpacker 2020-06-05 13:47:20 2020-06-05 14:04:56 1056 seconds Show Options Show Log
procdump = yes
2020-05-13 09:31:01,860 [root] INFO: Date set to: 20200605T14:00:30, timeout set to: 200
2020-06-05 14:00:30,078 [root] DEBUG: Starting analyzer from: C:\tmplodztmkc
2020-06-05 14:00:30,078 [root] DEBUG: Storing results at: C:\JcblWXUU
2020-06-05 14:00:30,078 [root] DEBUG: Pipe server name: \\.\PIPE\TEexVLcl
2020-06-05 14:00:30,078 [root] DEBUG: Python path: C:\Users\Louise\AppData\Local\Programs\Python\Python38-32
2020-06-05 14:00:30,078 [root] INFO: Analysis package "Unpacker" has been specified.
2020-06-05 14:00:30,078 [root] DEBUG: Trying to import analysis package "Unpacker"...
2020-06-05 14:00:30,187 [root] DEBUG: Imported analysis package "Unpacker".
2020-06-05 14:00:30,187 [root] DEBUG: Trying to initialize analysis package "Unpacker"...
2020-06-05 14:00:30,187 [root] DEBUG: Initialized analysis package "Unpacker".
2020-06-05 14:00:30,531 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.browser"...
2020-06-05 14:00:30,546 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser".
2020-06-05 14:00:30,546 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.curtain"...
2020-06-05 14:00:30,812 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain".
2020-06-05 14:00:30,812 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.digisig"...
2020-06-05 14:00:30,906 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig".
2020-06-05 14:00:30,906 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.disguise"...
2020-06-05 14:00:30,906 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise".
2020-06-05 14:00:30,906 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.human"...
2020-06-05 14:00:30,937 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human".
2020-06-05 14:00:30,937 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.procmon"...
2020-06-05 14:00:30,968 [root] DEBUG: Imported auxiliary module "modules.auxiliary.procmon".
2020-06-05 14:00:30,968 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.screenshots"...
2020-06-05 14:00:31,046 [modules.auxiliary.screenshots] DEBUG: Importing 'time'
2020-06-05 14:00:31,046 [modules.auxiliary.screenshots] DEBUG: Importing 'StringIO'
2020-06-05 14:00:31,046 [modules.auxiliary.screenshots] DEBUG: Importing 'Thread'
2020-06-05 14:00:31,046 [modules.auxiliary.screenshots] DEBUG: Importing 'Auxiliary'
2020-06-05 14:00:31,062 [modules.auxiliary.screenshots] DEBUG: Importing 'NetlogFile'
2020-06-05 14:00:31,062 [modules.auxiliary.screenshots] DEBUG: Importing 'Screenshot'
2020-06-05 14:00:31,078 [lib.api.screenshot] DEBUG: Importing 'math'
2020-06-05 14:00:31,078 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2020-06-05 14:00:32,906 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2020-06-05 14:00:32,921 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2020-06-05 14:00:32,953 [modules.auxiliary.screenshots] DEBUG: Imports OK
2020-06-05 14:00:32,953 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots".
2020-06-05 14:00:32,953 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.sysmon"...
2020-06-05 14:00:32,953 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon".
2020-06-05 14:00:32,953 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.usage"...
2020-06-05 14:00:32,968 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage".
2020-06-05 14:00:32,968 [root] DEBUG: Trying to initialize auxiliary module "Browser"...
2020-06-05 14:00:32,968 [root] DEBUG: Initialized auxiliary module "Browser".
2020-06-05 14:00:32,968 [root] DEBUG: Trying to start auxiliary module "Browser"...
2020-06-05 14:00:32,984 [root] DEBUG: Started auxiliary module Browser
2020-06-05 14:00:32,984 [root] DEBUG: Trying to initialize auxiliary module "Curtain"...
2020-06-05 14:00:32,984 [root] DEBUG: Initialized auxiliary module "Curtain".
2020-06-05 14:00:32,984 [root] DEBUG: Trying to start auxiliary module "Curtain"...
2020-06-05 14:00:32,984 [root] DEBUG: Started auxiliary module Curtain
2020-06-05 14:00:32,984 [root] DEBUG: Trying to initialize auxiliary module "DigiSig"...
2020-06-05 14:00:32,984 [root] DEBUG: Initialized auxiliary module "DigiSig".
2020-06-05 14:00:32,984 [root] DEBUG: Trying to start auxiliary module "DigiSig"...
2020-06-05 14:00:32,984 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature.
2020-06-05 14:00:34,453 [modules.auxiliary.digisig] DEBUG: File is not signed.
2020-06-05 14:00:34,453 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2020-06-05 14:00:34,468 [root] DEBUG: Started auxiliary module DigiSig
2020-06-05 14:00:34,468 [root] DEBUG: Trying to initialize auxiliary module "Disguise"...
2020-06-05 14:00:34,468 [root] DEBUG: Initialized auxiliary module "Disguise".
2020-06-05 14:00:34,468 [root] DEBUG: Trying to start auxiliary module "Disguise"...
2020-06-05 14:00:34,484 [root] DEBUG: Started auxiliary module Disguise
2020-06-05 14:00:34,484 [root] DEBUG: Trying to initialize auxiliary module "Human"...
2020-06-05 14:00:34,484 [root] DEBUG: Initialized auxiliary module "Human".
2020-06-05 14:00:34,484 [root] DEBUG: Trying to start auxiliary module "Human"...
2020-06-05 14:00:34,484 [root] DEBUG: Started auxiliary module Human
2020-06-05 14:00:34,484 [root] DEBUG: Trying to initialize auxiliary module "Procmon"...
2020-06-05 14:00:34,484 [root] DEBUG: Initialized auxiliary module "Procmon".
2020-06-05 14:00:34,484 [root] DEBUG: Trying to start auxiliary module "Procmon"...
2020-06-05 14:00:34,484 [root] DEBUG: Started auxiliary module Procmon
2020-06-05 14:00:34,484 [root] DEBUG: Trying to initialize auxiliary module "Screenshots"...
2020-06-05 14:00:34,484 [root] DEBUG: Initialized auxiliary module "Screenshots".
2020-06-05 14:00:34,484 [root] DEBUG: Trying to start auxiliary module "Screenshots"...
2020-06-05 14:00:34,500 [root] DEBUG: Started auxiliary module Screenshots
2020-06-05 14:00:34,500 [root] DEBUG: Trying to initialize auxiliary module "Sysmon"...
2020-06-05 14:00:34,500 [root] DEBUG: Initialized auxiliary module "Sysmon".
2020-06-05 14:00:34,500 [root] DEBUG: Trying to start auxiliary module "Sysmon"...
2020-06-05 14:00:34,500 [root] DEBUG: Started auxiliary module Sysmon
2020-06-05 14:00:34,500 [root] DEBUG: Trying to initialize auxiliary module "Usage"...
2020-06-05 14:00:34,500 [root] DEBUG: Initialized auxiliary module "Usage".
2020-06-05 14:00:34,500 [root] DEBUG: Trying to start auxiliary module "Usage"...
2020-06-05 14:00:34,500 [root] DEBUG: Started auxiliary module Usage
2020-06-05 14:00:34,500 [root] INFO: Analyzer: Package modules.packages.Unpacker does not specify a DLL option
2020-06-05 14:00:34,500 [root] INFO: Analyzer: Package modules.packages.Unpacker does not specify a DLL_64 option
2020-06-05 14:00:34,500 [root] INFO: Analyzer: Package modules.packages.Unpacker does not specify a loader option
2020-06-05 14:00:34,500 [root] INFO: Analyzer: Package modules.packages.Unpacker does not specify a loader_64 option
2020-06-05 14:00:34,843 [lib.api.process] INFO: Successfully executed process from path "C:\Users\Louise\AppData\Local\Temp\R070161.exe" with arguments "" with pid 1524
2020-06-05 14:00:34,843 [lib.api.process] INFO: Monitor config for process 1524: C:\tmplodztmkc\dll\1524.ini
2020-06-05 14:00:34,875 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-06-05 14:00:34,875 [lib.api.process] INFO: Option 'unpacker' with value '1' sent to monitor
2020-06-05 14:00:34,875 [lib.api.process] INFO: Option 'injection' with value '0' sent to monitor
2020-06-05 14:00:34,875 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmplodztmkc\dll\Ijuocmtu.dll, loader C:\tmplodztmkc\bin\FLpLkyn.exe
2020-06-05 14:00:35,000 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TEexVLcl.
2020-06-05 14:00:35,000 [root] DEBUG: Loader: Injecting process 1524 (thread 3512) with C:\tmplodztmkc\dll\Ijuocmtu.dll.
2020-06-05 14:00:35,000 [root] DEBUG: Process image base: 0x011F0000
2020-06-05 14:00:35,000 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-05 14:00:35,000 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-05 14:00:35,000 [root] DEBUG: Successfully injected DLL C:\tmplodztmkc\dll\Ijuocmtu.dll.
2020-06-05 14:00:35,015 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1524
2020-06-05 14:00:37,015 [lib.api.process] INFO: Successfully resumed process with pid 1524
2020-06-05 14:00:37,781 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-05 14:00:37,781 [root] DEBUG: Process dumps disabled.
2020-06-05 14:00:37,781 [root] DEBUG: Auto-unpacking of payloads enabled.
2020-06-05 14:00:37,781 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-05 14:00:37,796 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 1524 at 0x6f520000, image base 0x11f0000, stack from 0x3c5000-0x3d0000
2020-06-05 14:00:37,796 [root] DEBUG: Commandline: C:\Users\Louise\AppData\Local\Temp\"C:\Users\Louise\AppData\Local\Temp\R070161.exe".
2020-06-05 14:00:37,843 [root] DEBUG: WoW64 detected: 64-bit ntdll base: 0x76de0000, KiUserExceptionDispatcher: 0x0, NtSetContextThread: 0x76e4b5f0, Wow64PrepareForException: 0x0
2020-06-05 14:00:37,843 [root] DEBUG: WoW64 workaround: KiUserExceptionDispatcher hook installed at: 0xa0000
2020-06-05 14:00:37,843 [root] DEBUG: UnpackerInit: Debugger initialised.
2020-06-05 14:00:37,843 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x011F0000.
2020-06-05 14:00:37,859 [root] DEBUG: set_caller_info: Adding region at 0x00080000 to caller regions list (ntdll::RtlDispatchException).
2020-06-05 14:00:37,875 [root] DEBUG: CAPEExceptionFilter: Exception 0xc0000005 caught at RVA 0x1bf4 in capemon caught accessing 0x11f1000 (expected in memory scans), passing to next handler.
2020-06-05 14:00:37,875 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:37,875 [root] DEBUG: AddTrackedRegion: GetEntropy failed.
2020-06-05 14:00:37,890 [root] DEBUG: AddTrackedRegion: New region at 0x011F0000 size 0x1000 added to tracked regions: EntryPoint 0x72457cef, Entropy 0.000000e+00
2020-06-05 14:00:37,906 [root] DEBUG: UnpackerInit: Adding main image base to tracked regions.
2020-06-05 14:00:37,906 [root] INFO: loaded: b'1524'
2020-06-05 14:00:37,906 [root] INFO: Loaded monitor into process with pid 1524
2020-06-05 14:00:37,906 [root] DEBUG: set_caller_info: Adding region at 0x002D0000 to caller regions list (advapi32::RegQueryInfoKeyW).
2020-06-05 14:00:37,906 [root] DEBUG: set_caller_info: Adding region at 0x00990000 to caller regions list (advapi32::RegOpenKeyExW).
2020-06-05 14:00:37,906 [root] DEBUG: set_caller_info: Adding region at 0x00500000 to caller regions list (kernel32::FindFirstFileExW).
2020-06-05 14:00:37,921 [root] DEBUG: DLL loaded at 0x729C0000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x7d000 bytes).
2020-06-05 14:00:37,968 [root] DEBUG: DLL unloaded from 0x74A80000.
2020-06-05 14:00:38,031 [root] DEBUG: DLL loaded at 0x73390000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-05 14:00:38,093 [root] DEBUG: DLL loaded at 0x6EF60000: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks (0x5b1000 bytes).
2020-06-05 14:00:38,109 [root] DEBUG: DLL loaded at 0x6EEC0000: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCR80 (0x9b000 bytes).
2020-06-05 14:00:38,156 [root] DEBUG: CreateThread: Initialising breakpoints for thread 3980.
2020-06-05 14:00:38,156 [root] DEBUG: DLL unloaded from 0x76FA0000.
2020-06-05 14:00:38,156 [root] INFO: Disabling sleep skipping.
2020-06-05 14:00:38,156 [root] DEBUG: Allocation: 0x0023A000 - 0x0023B000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:38,156 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:38,171 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:00:38,171 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:38,171 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:00:38,171 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x0023A000, size: 0x1000.
2020-06-05 14:00:38,171 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x0023A000.
2020-06-05 14:00:38,171 [root] DEBUG: AddTrackedRegion: New region at 0x00230000 size 0x1000 added to tracked regions.
2020-06-05 14:00:38,171 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x00230000, TrackedRegion->RegionSize: 0x1000, thread 3512
2020-06-05 14:00:38,171 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 3512 type 1 at address 0x0023A000, size 2 with Callback 0x6f53a080.
2020-06-05 14:00:38,187 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x0023A000
2020-06-05 14:00:38,187 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 3512 type 1 at address 0x0023003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:00:38,187 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x0023003C
2020-06-05 14:00:38,187 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x0023A000 (size 0x1000).
2020-06-05 14:00:38,187 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFEC1D8 (thread 3512)
2020-06-05 14:00:38,187 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x0023A000.
2020-06-05 14:00:38,187 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x23a000: 0x0.
2020-06-05 14:00:38,187 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-06-05 14:00:38,203 [root] DEBUG: Allocation: 0x00232000 - 0x00233000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:38,203 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:38,203 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:00:38,203 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:38,203 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:00:38,203 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00230000.
2020-06-05 14:00:38,203 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00230000, size: 0x1000.
2020-06-05 14:00:38,218 [root] DEBUG: DLL loaded at 0x75180000: C:\Windows\syswow64\shell32 (0xc4c000 bytes).
2020-06-05 14:00:38,234 [root] DEBUG: DLL loaded at 0x740A0000: C:\Windows\system32\profapi (0xb000 bytes).
2020-06-05 14:00:38,281 [root] DEBUG: CreateThread: Initialising breakpoints for thread 1412.
2020-06-05 14:00:38,281 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 1412 type 1 at address 0x0023A000, size 2 with Callback 0x6f53a080.
2020-06-05 14:00:38,296 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 1412 type 1 at address 0x0023003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:00:38,296 [root] DEBUG: SetThreadBreakpoint: Set bp 2 thread id 1412 type 0 at address 0x0023A000, size 0 with Callback 0x6f539ed0.
2020-06-05 14:00:38,328 [root] DEBUG: DLL loaded at 0x6E3C0000: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\f8420d8c6ede777377fcff48a4beaa2a\mscorlib.ni (0xafe000 bytes).
2020-06-05 14:00:38,343 [root] DEBUG: Allocation: 0x00282000 - 0x00283000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:38,343 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:38,343 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:00:38,343 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:38,343 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:00:38,343 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00230000.
2020-06-05 14:00:38,343 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x00282000, size: 0x1000.
2020-06-05 14:00:38,343 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00282000.
2020-06-05 14:00:38,375 [root] DEBUG: AddTrackedRegion: New region at 0x00280000 size 0x1000 added to tracked regions.
2020-06-05 14:00:38,406 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x00280000, TrackedRegion->RegionSize: 0x1000, thread 3512
2020-06-05 14:00:38,406 [root] DEBUG: ActivateBreakpoints: Switching breakpoints from region 0x00230000 to 0x00280000.
2020-06-05 14:00:38,406 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x230000
2020-06-05 14:00:38,406 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 3512 type 1 at address 0x00282000, size 2 with Callback 0x6f53a080.
2020-06-05 14:00:38,406 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x00282000
2020-06-05 14:00:38,421 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 3512 type 1 at address 0x0028003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:00:38,421 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x0028003C
2020-06-05 14:00:38,421 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x00282000 (size 0x1000).
2020-06-05 14:00:38,421 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFEC1D8 (thread 3512)
2020-06-05 14:00:38,421 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x00282000.
2020-06-05 14:00:38,421 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x282000: 0x0.
2020-06-05 14:00:38,421 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-06-05 14:00:38,515 [root] DEBUG: DLL unloaded from 0x74DF0000.
2020-06-05 14:00:38,515 [root] DEBUG: Allocation: 0x00283000 - 0x00284000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:38,531 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:38,531 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:00:38,531 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:38,531 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:00:38,531 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00230000.
2020-06-05 14:00:38,531 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00280000.
2020-06-05 14:00:38,531 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00280000, size: 0x1000.
2020-06-05 14:00:38,531 [root] DEBUG: set_caller_info: Adding region at 0x03960000 to caller regions list (kernel32::SetErrorMode).
2020-06-05 14:00:38,546 [root] DEBUG: Allocation: 0x003FB000 - 0x003FC000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:38,546 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:38,546 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:00:38,546 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:38,546 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:00:38,546 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00230000.
2020-06-05 14:00:38,546 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00280000.
2020-06-05 14:00:38,546 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x003FB000, size: 0x1000.
2020-06-05 14:00:38,546 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x003FB000.
2020-06-05 14:00:38,546 [root] DEBUG: AddTrackedRegion: New region at 0x003F0000 size 0x1000 added to tracked regions.
2020-06-05 14:00:38,562 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x003F0000, TrackedRegion->RegionSize: 0x1000, thread 3512
2020-06-05 14:00:38,562 [root] DEBUG: ActivateBreakpoints: Switching breakpoints from region 0x00280000 to 0x003F0000.
2020-06-05 14:00:38,562 [root] DEBUG: DumpPEsInRange: Scanning range 0x280000 - 0x281000.
2020-06-05 14:00:38,562 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x280000-0x281000.
2020-06-05 14:00:38,562 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x00280000 - 0x00281000.
2020-06-05 14:00:38,562 [root] INFO: ('dump_file', 'C:\\JcblWXUU\\CAPE\\1524_1561408456380205562020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?0x00280000;?', ['1524'], 'CAPE')
2020-06-05 14:00:38,625 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JcblWXUU\CAPE\1524_1561408456380205562020 (size 0xf7a)
2020-06-05 14:00:38,640 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x00280000.
2020-06-05 14:00:38,640 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x280000 - 0x281000.
2020-06-05 14:00:38,640 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 3512 type 1 at address 0x003FB000, size 2 with Callback 0x6f53a080.
2020-06-05 14:00:38,640 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x003FB000
2020-06-05 14:00:38,640 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 3512 type 1 at address 0x003F003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:00:38,656 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x003F003C
2020-06-05 14:00:38,656 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x003FB000 (size 0x1000).
2020-06-05 14:00:38,656 [root] DEBUG: DLL unloaded from 0x76FA0000.
2020-06-05 14:00:38,656 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFEC1D8 (thread 3512)
2020-06-05 14:00:38,656 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x003FB000.
2020-06-05 14:00:38,656 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x3fb000: 0x0.
2020-06-05 14:00:38,656 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-06-05 14:00:38,656 [root] DEBUG: Allocation: 0x003F7000 - 0x003F8000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:38,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:38,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:00:38,671 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:38,671 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:00:38,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00230000.
2020-06-05 14:00:38,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00280000.
2020-06-05 14:00:38,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003F0000.
2020-06-05 14:00:38,671 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x003F0000, size: 0x1000.
2020-06-05 14:00:38,765 [root] DEBUG: Allocation: 0x0028C000 - 0x0028D000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:38,765 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:00:38,765 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00230000.
2020-06-05 14:00:38,781 [root] DEBUG: DLL loaded at 0x6E360000: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit (0x5b000 bytes).
2020-06-05 14:00:39,375 [root] DEBUG: Allocation: 0x00930000 - 0x00931000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:39,375 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:39,375 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:00:39,390 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00230000.
2020-06-05 14:00:39,390 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x3f0000
2020-06-05 14:00:39,390 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 3512 type 1 at address 0x00930000, size 2 with Callback 0x6f53a080.
2020-06-05 14:00:39,390 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 3512 type 1 at address 0x0093003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:00:39,406 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFEC1D8 (thread 3512)
2020-06-05 14:00:39,406 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x00930000.
2020-06-05 14:00:39,406 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x930000: 0x0.
2020-06-05 14:00:39,406 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-06-05 14:00:39,406 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFFCA24 (thread 3512)
2020-06-05 14:00:39,406 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0093003C.
2020-06-05 14:00:39,406 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x930044 (at 0x0093003C).
2020-06-05 14:00:39,406 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFFCB4B (thread 3512)
2020-06-05 14:00:39,421 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x00930000 already exists for thread 3512 (process 1524), skipping.
2020-06-05 14:00:39,421 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x00930000.
2020-06-05 14:00:39,421 [root] DEBUG: set_caller_info: Adding region at 0x00930000 to caller regions list (ntdll::NtQueryPerformanceCounter).
2020-06-05 14:00:39,421 [root] DEBUG: DumpPEsInRange: Scanning range 0x930000 - 0x931000.
2020-06-05 14:00:39,437 [root] INFO: ('dump_file', 'C:\\JcblWXUU\\CAPE\\1524_484989908494936662020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?0x00930000;?', ['1524'], 'CAPE')
2020-06-05 14:00:39,468 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JcblWXUU\CAPE\1524_484989908494936662020 (size 0x91)
2020-06-05 14:00:39,468 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x00930000.
2020-06-05 14:00:39,468 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x00930000.
2020-06-05 14:00:39,484 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x0093003C.
2020-06-05 14:00:39,484 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 2 address 0x00930000.
2020-06-05 14:00:40,593 [root] DEBUG: Allocation: 0x00931000 - 0x00932000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:40,593 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:40,593 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00930000, size: 0x1000.
2020-06-05 14:00:40,625 [root] DEBUG: Allocation: 0x00932000 - 0x00933000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:40,625 [root] DEBUG: Allocation: 0x00933000 - 0x00934000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:40,625 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:40,625 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00930000.
2020-06-05 14:00:40,640 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00930000, size: 0x1000.
2020-06-05 14:00:40,750 [root] DEBUG: Allocation: 0x00934000 - 0x00935000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:40,765 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:40,765 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:40,765 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:00:43,093 [root] DEBUG: Allocation: 0x00284000 - 0x00285000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:43,093 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:43,093 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:43,093 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:00:43,156 [root] DEBUG: DLL loaded at 0x6DB70000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System\0a65164b17e5c64bacdc694ea2439c43\System.ni (0x7a5000 bytes).
2020-06-05 14:00:43,156 [root] DEBUG: DLL loaded at 0x6D9E0000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\175df210b784212def386595c25caefb\System.Drawing.ni (0x189000 bytes).
2020-06-05 14:00:43,171 [root] DEBUG: DLL loaded at 0x6CE00000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\5669120680b52abf616f3876387ca2cc\System.Windows.Forms.ni (0xbdf000 bytes).
2020-06-05 14:00:43,187 [root] DEBUG: Allocation: 0x00285000 - 0x00286000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:43,187 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:43,187 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:00:43,187 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:43,187 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:00:43,187 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00230000.
2020-06-05 14:00:43,187 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00280000.
2020-06-05 14:00:43,203 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003F0000.
2020-06-05 14:00:43,203 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00930000.
2020-06-05 14:00:43,203 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00280000, size: 0x1000.
2020-06-05 14:00:43,203 [root] DEBUG: Allocation: 0x00286000 - 0x00287000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:43,203 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:43,203 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:00:43,203 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:43,203 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:00:43,203 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00230000.
2020-06-05 14:00:43,218 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00280000.
2020-06-05 14:00:43,218 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003F0000.
2020-06-05 14:00:43,218 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00930000.
2020-06-05 14:00:43,218 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00280000, size: 0x1000.
2020-06-05 14:00:43,249 [root] DEBUG: Allocation: 0x00287000 - 0x00288000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:43,249 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:43,249 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00280000.
2020-06-05 14:00:43,281 [root] DEBUG: DLL loaded at 0x73FA0000: C:\Windows\system32\uxtheme (0x80000 bytes).
2020-06-05 14:00:43,281 [root] DEBUG: set_caller_info: Adding region at 0x00230000 to caller regions list (ntdll::LdrGetProcedureAddress).
2020-06-05 14:00:43,390 [root] DEBUG: Allocation: 0x00935000 - 0x00936000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:43,390 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:00:43,468 [root] DEBUG: Allocation: 0x003DA000 - 0x003DB000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:43,468 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:43,468 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:00:43,484 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:43,484 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:00:43,484 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00230000.
2020-06-05 14:00:43,484 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x230000
2020-06-05 14:00:43,484 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00280000.
2020-06-05 14:00:43,484 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003F0000.
2020-06-05 14:00:43,484 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x003DA000.
2020-06-05 14:00:43,484 [root] DEBUG: AddTrackedRegion: New region at 0x003D0000 size 0x1000 added to tracked regions.
2020-06-05 14:00:43,500 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x003D0000, TrackedRegion->RegionSize: 0x1000, thread 3512
2020-06-05 14:00:43,500 [root] DEBUG: ActivateBreakpoints: Switching breakpoints from region 0x00930000 to 0x003D0000.
2020-06-05 14:00:43,500 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 3512 type 1 at address 0x003DA000, size 2 with Callback 0x6f53a080.
2020-06-05 14:00:43,500 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x003DA000
2020-06-05 14:00:43,515 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 3512 type 1 at address 0x003D003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:00:43,515 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x003D003C
2020-06-05 14:00:43,515 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x003DA000 (size 0x1000).
2020-06-05 14:00:43,593 [root] DEBUG: Allocation: 0x003EA000 - 0x003EB000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:43,609 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:43,609 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:00:43,609 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x003EA000, size: 0x1000.
2020-06-05 14:00:43,609 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x3d0000
2020-06-05 14:00:43,609 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 3512 type 1 at address 0x003EA000, size 2 with Callback 0x6f53a080.
2020-06-05 14:00:43,609 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 3512 type 1 at address 0x003E003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:00:43,625 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x003E003C
2020-06-05 14:00:43,625 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFEC1D8 (thread 3512)
2020-06-05 14:00:43,625 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x003EA000.
2020-06-05 14:00:43,625 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x3ea000: 0x0.
2020-06-05 14:00:43,625 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-06-05 14:00:43,671 [root] DEBUG: Allocation: 0x0023B000 - 0x0023C000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:43,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:43,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:00:43,671 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:43,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-06-05 14:00:43,671 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00230000, size: 0x1000.
2020-06-05 14:00:44,578 [root] DEBUG: Allocation: 0x003D6000 - 0x003D7000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:44,578 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x230000
2020-06-05 14:00:44,593 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-06-05 14:00:44,593 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x003D0000, size: 0x1000.
2020-06-05 14:00:44,859 [root] DEBUG: Allocation: 0x00936000 - 0x00937000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:44,875 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:44,875 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:00:44,875 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:44,875 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:00:44,875 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00230000.
2020-06-05 14:00:45,703 [root] DEBUG: DLL loaded at 0x6CC60000: C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\4ac828c8c4c76f3ba59f8f9c7dab1cb3\Microsoft.VisualBasic.ni (0x19b000 bytes).
2020-06-05 14:00:46,046 [root] DEBUG: Allocation: 0x00937000 - 0x00938000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:46,046 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:46,046 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-06-05 14:00:46,375 [root] DEBUG: Allocation: 0x003E2000 - 0x003E3000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:46,375 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:46,375 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:00:46,375 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x230000
2020-06-05 14:00:46,656 [root] DEBUG: Allocation: 0x003F5000 - 0x003F6000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:46,656 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:46,656 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:00:46,671 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:46,671 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x230000
2020-06-05 14:00:46,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00280000.
2020-06-05 14:00:46,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003F0000.
2020-06-05 14:00:46,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:00:46,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-06-05 14:00:46,828 [root] DEBUG: DLL loaded at 0x732B0000: C:\Windows\Microsoft.NET\Framework\v2.0.50727\culture (0x8000 bytes).
2020-06-05 14:00:46,843 [root] DEBUG: DLL unloaded from 0x732B0000.
2020-06-05 14:00:57,046 [root] DEBUG: DLL loaded at 0x70DD0000: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\gdiplus (0x192000 bytes).
2020-06-05 14:00:57,078 [root] DEBUG: CreateThread: Initialising breakpoints for thread 3468.
2020-06-05 14:00:57,078 [root] DEBUG: DLL unloaded from 0x76FA0000.
2020-06-05 14:00:57,093 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 3468 type 1 at address 0x003EA000, size 2 with Callback 0x6f53a080.
2020-06-05 14:00:57,093 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 3468 type 1 at address 0x003E003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:00:57,093 [root] DEBUG: SetThreadBreakpoint: Set bp 2 thread id 3468 type 0 at address 0x003EA000, size 0 with Callback 0x6f539ed0.
2020-06-05 14:00:57,125 [root] DEBUG: Allocation: 0x03961000 - 0x03962000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:57,140 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:57,140 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:00:57,140 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:57,140 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:00:57,140 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:00:57,156 [root] DEBUG: DumpPEsInRange: Scanning range 0x3e0000 - 0x3e1000.
2020-06-05 14:00:57,156 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3e0000-0x3e1000.
2020-06-05 14:00:57,156 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x003E0000 - 0x003E1000.
2020-06-05 14:00:57,171 [root] INFO: ('dump_file', 'C:\\JcblWXUU\\CAPE\\1524_379930708570205562020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?0x003E0000;?', ['1524'], 'CAPE')
2020-06-05 14:00:57,203 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JcblWXUU\CAPE\1524_379930708570205562020 (size 0x47)
2020-06-05 14:00:57,203 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x003E0000.
2020-06-05 14:00:57,218 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 3512 type 1 at address 0x03961000, size 2 with Callback 0x6f53a080.
2020-06-05 14:00:57,218 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 3512 type 1 at address 0x0396003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:00:57,218 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x76FDAAB7 (thread 3512)
2020-06-05 14:00:57,234 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0396003C.
2020-06-05 14:00:57,234 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header zero.
2020-06-05 14:00:57,234 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EED500A (thread 3512)
2020-06-05 14:00:57,234 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x03961000.
2020-06-05 14:00:57,234 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x3961000: 0x83.
2020-06-05 14:00:57,234 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-06-05 14:00:57,234 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x03961000 (thread 3512)
2020-06-05 14:00:57,234 [root] DEBUG: ShellcodeExecCallback: About to scan region for a PE image (base 0x03960000, size 0x2000).
2020-06-05 14:00:57,249 [root] INFO: ('dump_file', 'C:\\JcblWXUU\\CAPE\\1524_144259662405836662020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?0x03960000;?', ['1524'], 'CAPE')
2020-06-05 14:00:57,265 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JcblWXUU\CAPE\1524_144259662405836662020 (size 0x1ffe)
2020-06-05 14:00:57,265 [root] DEBUG: ShellcodeExecCallback: successfully dumped memory range at 0x03960000 (size 0x2000).
2020-06-05 14:00:57,281 [root] DEBUG: DLL loaded at 0x70C90000: C:\Windows\system32\WindowsCodecs (0x131000 bytes).
2020-06-05 14:00:57,812 [root] DEBUG: Allocation: 0x00288000 - 0x00289000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:57,812 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:57,812 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:00:57,812 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00230000.
2020-06-05 14:00:58,031 [root] DEBUG: Allocation: 0x06651000 - 0x06652000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:58,031 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:58,031 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00230000.
2020-06-05 14:00:58,031 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x230000
2020-06-05 14:00:58,031 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x06651000.
2020-06-05 14:00:58,046 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 3512 type 1 at address 0x06651000, size 2 with Callback 0x6f53a080.
2020-06-05 14:00:58,046 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x06651000
2020-06-05 14:00:58,046 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 3512 type 1 at address 0x0665003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:00:58,046 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x0665003C
2020-06-05 14:00:58,046 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x06651000 (size 0x1000).
2020-06-05 14:00:58,062 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x76FDAAB7 (thread 3512)
2020-06-05 14:00:58,062 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header zero.
2020-06-05 14:00:58,062 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x76FCE025 (thread 3512)
2020-06-05 14:00:58,062 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x6651000: 0x0.
2020-06-05 14:00:58,062 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EED72F9 (thread 3512)
2020-06-05 14:00:58,062 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x06651000.
2020-06-05 14:00:58,062 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x06651000 already exists for thread 3512 (process 1524), skipping.
2020-06-05 14:00:58,156 [root] DEBUG: Allocation: 0x06652000 - 0x06653000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:58,156 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:58,156 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:00:58,171 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:58,171 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:00:58,171 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00230000.
2020-06-05 14:00:58,171 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x230000
2020-06-05 14:00:58,171 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00280000.
2020-06-05 14:00:58,171 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003F0000.
2020-06-05 14:00:58,203 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00930000.
2020-06-05 14:00:58,203 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:00:58,203 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-06-05 14:00:58,203 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03960000.
2020-06-05 14:00:58,203 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x06650000.
2020-06-05 14:00:58,218 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x06650000, size: 0x1000.
2020-06-05 14:00:58,218 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x76FDAAB7 (thread 3512)
2020-06-05 14:00:58,218 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0665003C.
2020-06-05 14:00:58,218 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header zero.
2020-06-05 14:00:58,218 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x76FDA99E (thread 3512)
2020-06-05 14:00:58,218 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0665003C.
2020-06-05 14:00:58,218 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header zero.
2020-06-05 14:00:58,265 [root] DEBUG: Allocation: 0x06653000 - 0x06654000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:58,265 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:58,265 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:00:58,265 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00230000.
2020-06-05 14:00:58,281 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x06650000, size: 0x1000.
2020-06-05 14:00:58,296 [root] DEBUG: Allocation: 0x06654000 - 0x06655000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:58,328 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:58,328 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:00:58,328 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:58,328 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:00:58,328 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00230000.
2020-06-05 14:00:58,328 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-06-05 14:00:58,328 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03960000.
2020-06-05 14:00:58,328 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x06650000.
2020-06-05 14:00:58,328 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x06650000, size: 0x1000.
2020-06-05 14:00:58,343 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x76FDAAB7 (thread 3512)
2020-06-05 14:00:58,343 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header zero.
2020-06-05 14:00:58,343 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x76FDA99E (thread 3512)
2020-06-05 14:00:58,343 [root] DEBUG: Allocation: 0x06655000 - 0x06656000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:58,343 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:58,343 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:00:58,343 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:58,343 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:00:58,343 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00230000.
2020-06-05 14:00:58,359 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x230000
2020-06-05 14:00:58,359 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00280000.
2020-06-05 14:00:58,359 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03960000.
2020-06-05 14:00:58,359 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x06650000.
2020-06-05 14:00:58,359 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x76FDAAB7 (thread 3512)
2020-06-05 14:00:58,359 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0665003C.
2020-06-05 14:00:58,359 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header zero.
2020-06-05 14:00:58,359 [root] DEBUG: Allocation: 0x06656000 - 0x06658000, size: 0x2000, protection: 0x40.
2020-06-05 14:00:58,359 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:58,359 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:00:58,375 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:58,375 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:00:58,375 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03960000.
2020-06-05 14:00:58,375 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x06650000.
2020-06-05 14:00:58,375 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x06650000, size: 0x1000.
2020-06-05 14:00:58,375 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x76FDAAB7 (thread 3512)
2020-06-05 14:00:58,375 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0665003C.
2020-06-05 14:00:58,390 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header zero.
2020-06-05 14:00:58,390 [root] DEBUG: Allocation: 0x06658000 - 0x0665C000, size: 0x4000, protection: 0x40.
2020-06-05 14:00:58,390 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:58,390 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x06650000, size: 0x1000.
2020-06-05 14:00:58,390 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x76FDAAB7 (thread 3512)
2020-06-05 14:00:58,390 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0665003C.
2020-06-05 14:00:58,390 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header zero.
2020-06-05 14:00:58,406 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x76FDA99E (thread 3512)
2020-06-05 14:00:58,406 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:58,406 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x76FDAAB7 (thread 3512)
2020-06-05 14:00:58,406 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0665003C.
2020-06-05 14:00:58,406 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header zero.
2020-06-05 14:00:58,406 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x76FDA99E (thread 3512)
2020-06-05 14:00:58,406 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0665003C.
2020-06-05 14:00:58,406 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header zero.
2020-06-05 14:00:58,421 [root] DEBUG: Allocation: 0x00289000 - 0x0028A000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:58,437 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x230000
2020-06-05 14:00:58,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00280000.
2020-06-05 14:00:58,468 [root] DEBUG: Allocation: 0x00938000 - 0x00939000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:58,484 [root] DEBUG: Allocation: 0x0666D000 - 0x0666E000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:58,484 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:58,484 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:00:58,500 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:58,500 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:00:58,500 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00230000.
2020-06-05 14:00:58,500 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x230000
2020-06-05 14:00:58,500 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00280000.
2020-06-05 14:00:58,500 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x76FDA99E (thread 3512)
2020-06-05 14:00:58,500 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0665003C.
2020-06-05 14:00:58,500 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header zero.
2020-06-05 14:00:58,515 [root] DEBUG: Allocation: 0x0666E000 - 0x0666F000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:58,515 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00280000.
2020-06-05 14:00:58,515 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003F0000.
2020-06-05 14:00:58,515 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header zero.
2020-06-05 14:00:58,515 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x76FDA99E (thread 3512)
2020-06-05 14:00:58,515 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0665003C.
2020-06-05 14:00:58,531 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header zero.
2020-06-05 14:00:58,593 [root] DEBUG: Allocation: 0x00939000 - 0x0093A000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:58,593 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:58,593 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:00:58,593 [root] DEBUG: Allocation: 0x0666F000 - 0x06670000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:58,593 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:00:58,593 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-06-05 14:00:58,609 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03960000.
2020-06-05 14:00:58,609 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x06650000.
2020-06-05 14:00:58,609 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x06650000, size: 0x1000.
2020-06-05 14:00:58,609 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x76FDAAB7 (thread 3512)
2020-06-05 14:00:58,609 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0665003C.
2020-06-05 14:00:58,609 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header zero.
2020-06-05 14:00:58,609 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x76FDA99E (thread 3512)
2020-06-05 14:00:58,609 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0665003C.
2020-06-05 14:00:58,875 [root] DEBUG: Allocation: 0x0093A000 - 0x0093B000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:58,890 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:58,890 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:00:58,890 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:58,890 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x230000
2020-06-05 14:00:59,015 [root] DEBUG: Allocation: 0x0028A000 - 0x0028B000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:59,015 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:59,015 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:00:59,031 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:59,031 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:00:59,031 [root] INFO: Announced 32-bit process name: R070161.exe pid: 1744
2020-06-05 14:00:59,046 [lib.api.process] INFO: Monitor config for process 1744: C:\tmplodztmkc\dll\1744.ini
2020-06-05 14:00:59,062 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-06-05 14:00:59,062 [lib.api.process] INFO: Option 'unpacker' with value '1' sent to monitor
2020-06-05 14:00:59,062 [lib.api.process] INFO: Option 'injection' with value '0' sent to monitor
2020-06-05 14:00:59,062 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmplodztmkc\dll\Ijuocmtu.dll, loader C:\tmplodztmkc\bin\FLpLkyn.exe
2020-06-05 14:00:59,125 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TEexVLcl.
2020-06-05 14:00:59,125 [root] DEBUG: Loader: Injecting process 1744 (thread 4520) with C:\tmplodztmkc\dll\Ijuocmtu.dll.
2020-06-05 14:00:59,125 [root] DEBUG: Process image base: 0x011F0000
2020-06-05 14:00:59,125 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-05 14:00:59,140 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-05 14:00:59,140 [root] DEBUG: Successfully injected DLL C:\tmplodztmkc\dll\Ijuocmtu.dll.
2020-06-05 14:00:59,140 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1744
2020-06-05 14:00:59,156 [root] DEBUG: DLL loaded at 0x74930000: C:\Windows\system32\apphelp (0x4c000 bytes).
2020-06-05 14:00:59,203 [root] INFO: Announced 32-bit process name: R070161.exe pid: 1744
2020-06-05 14:00:59,203 [lib.api.process] INFO: Monitor config for process 1744: C:\tmplodztmkc\dll\1744.ini
2020-06-05 14:00:59,203 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-06-05 14:00:59,203 [lib.api.process] INFO: Option 'unpacker' with value '1' sent to monitor
2020-06-05 14:00:59,203 [lib.api.process] INFO: Option 'injection' with value '0' sent to monitor
2020-06-05 14:00:59,203 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmplodztmkc\dll\Ijuocmtu.dll, loader C:\tmplodztmkc\bin\FLpLkyn.exe
2020-06-05 14:00:59,265 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TEexVLcl.
2020-06-05 14:00:59,265 [root] DEBUG: Loader: Injecting process 1744 (thread 4520) with C:\tmplodztmkc\dll\Ijuocmtu.dll.
2020-06-05 14:00:59,265 [root] DEBUG: Process image base: 0x011F0000
2020-06-05 14:00:59,265 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-05 14:00:59,281 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-05 14:00:59,281 [root] DEBUG: Successfully injected DLL C:\tmplodztmkc\dll\Ijuocmtu.dll.
2020-06-05 14:00:59,328 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1744
2020-06-05 14:00:59,484 [root] DEBUG: Allocation: 0x00D90000 - 0x00D91000, size: 0x1000, protection: 0x40.
2020-06-05 14:00:59,484 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:00:59,484 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:00:59,484 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:00:59,484 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:00:59,500 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-06-05 14:00:59,500 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03960000.
2020-06-05 14:00:59,500 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x06650000.
2020-06-05 14:00:59,500 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00D90000.
2020-06-05 14:00:59,500 [root] DEBUG: AddTrackedRegion: New region at 0x00D90000 size 0x1000 added to tracked regions.
2020-06-05 14:00:59,515 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 3512 type 1 at address 0x00D90000, size 2 with Callback 0x6f53a080.
2020-06-05 14:00:59,515 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 3512 type 1 at address 0x00D9003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:00:59,515 [root] DEBUG: set_caller_info: Adding region at 0x00D90000 to caller regions list (ntdll::NtClose).
2020-06-05 14:00:59,515 [root] DEBUG: DumpPEsInRange: Scanning range 0xd90000 - 0xd91000.
2020-06-05 14:00:59,515 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0xd90000-0xd91000.
2020-06-05 14:00:59,531 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x00D90000 - 0x00D91000.
2020-06-05 14:00:59,531 [root] INFO: ('dump_file', 'C:\\JcblWXUU\\CAPE\\1524_122277266822146662020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?0x00D90000;?', ['1524'], 'CAPE')
2020-06-05 14:00:59,562 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JcblWXUU\CAPE\1524_122277266822146662020 (size 0x18a)
2020-06-05 14:00:59,562 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x00D90000.
2020-06-05 14:00:59,562 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x00D9003C.
2020-06-05 14:00:59,562 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 2 address 0x00D90000.
2020-06-05 14:00:59,734 [root] INFO: Announced 32-bit process name: R070161.exe pid: 1588
2020-06-05 14:00:59,734 [lib.api.process] INFO: Monitor config for process 1588: C:\tmplodztmkc\dll\1588.ini
2020-06-05 14:00:59,796 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-06-05 14:00:59,796 [lib.api.process] INFO: Option 'unpacker' with value '1' sent to monitor
2020-06-05 14:00:59,796 [lib.api.process] INFO: Option 'injection' with value '0' sent to monitor
2020-06-05 14:00:59,796 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmplodztmkc\dll\Ijuocmtu.dll, loader C:\tmplodztmkc\bin\FLpLkyn.exe
2020-06-05 14:00:59,812 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TEexVLcl.
2020-06-05 14:00:59,828 [root] DEBUG: Loader: Injecting process 1588 (thread 2852) with C:\tmplodztmkc\dll\Ijuocmtu.dll.
2020-06-05 14:00:59,828 [root] DEBUG: Process image base: 0x011F0000
2020-06-05 14:00:59,828 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-05 14:00:59,828 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-05 14:00:59,828 [root] DEBUG: Successfully injected DLL C:\tmplodztmkc\dll\Ijuocmtu.dll.
2020-06-05 14:00:59,843 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1588
2020-06-05 14:00:59,890 [root] INFO: Announced 32-bit process name: R070161.exe pid: 1588
2020-06-05 14:00:59,890 [lib.api.process] INFO: Monitor config for process 1588: C:\tmplodztmkc\dll\1588.ini
2020-06-05 14:00:59,890 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-06-05 14:00:59,890 [lib.api.process] INFO: Option 'unpacker' with value '1' sent to monitor
2020-06-05 14:00:59,890 [lib.api.process] INFO: Option 'injection' with value '0' sent to monitor
2020-06-05 14:00:59,890 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmplodztmkc\dll\Ijuocmtu.dll, loader C:\tmplodztmkc\bin\FLpLkyn.exe
2020-06-05 14:00:59,906 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TEexVLcl.
2020-06-05 14:00:59,906 [root] DEBUG: Loader: Injecting process 1588 (thread 2852) with C:\tmplodztmkc\dll\Ijuocmtu.dll.
2020-06-05 14:00:59,906 [root] DEBUG: Process image base: 0x011F0000
2020-06-05 14:00:59,921 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-05 14:00:59,921 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-05 14:00:59,921 [root] DEBUG: Successfully injected DLL C:\tmplodztmkc\dll\Ijuocmtu.dll.
2020-06-05 14:00:59,921 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1588
2020-06-05 14:00:59,921 [root] INFO: Announced 32-bit process name: R070161.exe pid: 1588
2020-06-05 14:00:59,937 [lib.api.process] INFO: Monitor config for process 1588: C:\tmplodztmkc\dll\1588.ini
2020-06-05 14:00:59,937 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-06-05 14:00:59,937 [lib.api.process] INFO: Option 'unpacker' with value '1' sent to monitor
2020-06-05 14:00:59,937 [lib.api.process] INFO: Option 'injection' with value '0' sent to monitor
2020-06-05 14:00:59,937 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmplodztmkc\dll\Ijuocmtu.dll, loader C:\tmplodztmkc\bin\FLpLkyn.exe
2020-06-05 14:00:59,953 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TEexVLcl.
2020-06-05 14:00:59,953 [root] DEBUG: Loader: Injecting process 1588 (thread 0) with C:\tmplodztmkc\dll\Ijuocmtu.dll.
2020-06-05 14:00:59,953 [root] DEBUG: Error 0 (0x0) - GetProcessInitialThreadId: Remote PEB 0x7EFDE000 Local PEB 0x7EFDD000 Local TEB 0x7EFDE000: The operation completed successfully.
2020-06-05 14:00:59,968 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 2852, handle 0xc4
2020-06-05 14:00:59,968 [root] DEBUG: Process image base: 0x011F0000
2020-06-05 14:00:59,968 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-05 14:00:59,968 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-05 14:00:59,968 [root] DEBUG: Successfully injected DLL C:\tmplodztmkc\dll\Ijuocmtu.dll.
2020-06-05 14:00:59,984 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1588
2020-06-05 14:00:59,984 [root] INFO: Announced 32-bit process name: R070161.exe pid: 1588
2020-06-05 14:00:59,984 [lib.api.process] INFO: Monitor config for process 1588: C:\tmplodztmkc\dll\1588.ini
2020-06-05 14:00:59,984 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-06-05 14:00:59,984 [lib.api.process] INFO: Option 'unpacker' with value '1' sent to monitor
2020-06-05 14:00:59,984 [lib.api.process] INFO: Option 'injection' with value '0' sent to monitor
2020-06-05 14:00:59,984 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmplodztmkc\dll\Ijuocmtu.dll, loader C:\tmplodztmkc\bin\FLpLkyn.exe
2020-06-05 14:01:00,015 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TEexVLcl.
2020-06-05 14:01:00,015 [root] DEBUG: Loader: Injecting process 1588 (thread 0) with C:\tmplodztmkc\dll\Ijuocmtu.dll.
2020-06-05 14:01:00,015 [root] DEBUG: Error 0 (0x0) - GetProcessInitialThreadId: Remote PEB 0x7EFDE000 Local PEB 0x7EFDD000 Local TEB 0x7EFDE000: The operation completed successfully.
2020-06-05 14:01:00,015 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 2852, handle 0xc4
2020-06-05 14:01:00,015 [root] DEBUG: Process image base: 0x011F0000
2020-06-05 14:01:00,015 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-05 14:01:00,015 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-05 14:01:00,031 [root] DEBUG: Successfully injected DLL C:\tmplodztmkc\dll\Ijuocmtu.dll.
2020-06-05 14:01:00,031 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1588
2020-06-05 14:01:00,031 [root] INFO: Announced 32-bit process name: R070161.exe pid: 1588
2020-06-05 14:01:00,031 [lib.api.process] INFO: Monitor config for process 1588: C:\tmplodztmkc\dll\1588.ini
2020-06-05 14:01:00,031 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-06-05 14:01:00,046 [lib.api.process] INFO: Option 'unpacker' with value '1' sent to monitor
2020-06-05 14:01:00,046 [lib.api.process] INFO: Option 'injection' with value '0' sent to monitor
2020-06-05 14:01:00,046 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmplodztmkc\dll\Ijuocmtu.dll, loader C:\tmplodztmkc\bin\FLpLkyn.exe
2020-06-05 14:01:00,062 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TEexVLcl.
2020-06-05 14:01:00,062 [root] DEBUG: Loader: Injecting process 1588 (thread 0) with C:\tmplodztmkc\dll\Ijuocmtu.dll.
2020-06-05 14:01:00,062 [root] DEBUG: Error 0 (0x0) - GetProcessInitialThreadId: Remote PEB 0x7EFDE000 Local PEB 0x7EFDD000 Local TEB 0x7EFDE000: The operation completed successfully.
2020-06-05 14:01:00,062 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 2852, handle 0xc4
2020-06-05 14:01:00,078 [root] DEBUG: Process image base: 0x011F0000
2020-06-05 14:01:00,078 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-05 14:01:00,078 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-05 14:01:00,078 [root] DEBUG: Successfully injected DLL C:\tmplodztmkc\dll\Ijuocmtu.dll.
2020-06-05 14:01:00,078 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1588
2020-06-05 14:01:00,078 [root] INFO: Announced 32-bit process name: R070161.exe pid: 1588
2020-06-05 14:01:00,093 [lib.api.process] INFO: Monitor config for process 1588: C:\tmplodztmkc\dll\1588.ini
2020-06-05 14:01:00,093 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-06-05 14:01:00,093 [lib.api.process] INFO: Option 'unpacker' with value '1' sent to monitor
2020-06-05 14:01:00,093 [lib.api.process] INFO: Option 'injection' with value '0' sent to monitor
2020-06-05 14:01:00,093 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmplodztmkc\dll\Ijuocmtu.dll, loader C:\tmplodztmkc\bin\FLpLkyn.exe
2020-06-05 14:01:00,109 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TEexVLcl.
2020-06-05 14:01:00,125 [root] DEBUG: Loader: Injecting process 1588 (thread 0) with C:\tmplodztmkc\dll\Ijuocmtu.dll.
2020-06-05 14:01:00,125 [root] DEBUG: Error 0 (0x0) - GetProcessInitialThreadId: Remote PEB 0x7EFDE000 Local PEB 0x7EFDD000 Local TEB 0x7EFDE000: The operation completed successfully.
2020-06-05 14:01:00,125 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 2852, handle 0xc4
2020-06-05 14:01:00,125 [root] DEBUG: Process image base: 0x011F0000
2020-06-05 14:01:00,125 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-05 14:01:00,125 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-05 14:01:00,125 [root] DEBUG: Successfully injected DLL C:\tmplodztmkc\dll\Ijuocmtu.dll.
2020-06-05 14:01:00,140 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1588
2020-06-05 14:01:00,140 [root] INFO: Announced 32-bit process name: R070161.exe pid: 1588
2020-06-05 14:01:00,140 [lib.api.process] INFO: Monitor config for process 1588: C:\tmplodztmkc\dll\1588.ini
2020-06-05 14:01:00,140 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-06-05 14:01:00,140 [lib.api.process] INFO: Option 'unpacker' with value '1' sent to monitor
2020-06-05 14:01:00,140 [lib.api.process] INFO: Option 'injection' with value '0' sent to monitor
2020-06-05 14:01:00,140 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmplodztmkc\dll\Ijuocmtu.dll, loader C:\tmplodztmkc\bin\FLpLkyn.exe
2020-06-05 14:01:00,171 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TEexVLcl.
2020-06-05 14:01:00,171 [root] DEBUG: Loader: Injecting process 1588 (thread 0) with C:\tmplodztmkc\dll\Ijuocmtu.dll.
2020-06-05 14:01:00,171 [root] DEBUG: Error 0 (0x0) - GetProcessInitialThreadId: Remote PEB 0x7EFDE000 Local PEB 0x7EFDD000 Local TEB 0x7EFDE000: The operation completed successfully.
2020-06-05 14:01:00,171 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 2852, handle 0xc4
2020-06-05 14:01:00,187 [root] DEBUG: Process image base: 0x00400000
2020-06-05 14:01:00,187 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-05 14:01:00,187 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-05 14:01:00,187 [root] DEBUG: Successfully injected DLL C:\tmplodztmkc\dll\Ijuocmtu.dll.
2020-06-05 14:01:00,187 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1588
2020-06-05 14:01:00,203 [root] INFO: Announced 32-bit process name: R070161.exe pid: 1588
2020-06-05 14:01:00,203 [lib.api.process] INFO: Monitor config for process 1588: C:\tmplodztmkc\dll\1588.ini
2020-06-05 14:01:00,203 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-06-05 14:01:00,203 [lib.api.process] INFO: Option 'unpacker' with value '1' sent to monitor
2020-06-05 14:01:00,203 [lib.api.process] INFO: Option 'injection' with value '0' sent to monitor
2020-06-05 14:01:00,203 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmplodztmkc\dll\Ijuocmtu.dll, loader C:\tmplodztmkc\bin\FLpLkyn.exe
2020-06-05 14:01:00,218 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TEexVLcl.
2020-06-05 14:01:00,218 [root] DEBUG: Loader: Injecting process 1588 (thread 2852) with C:\tmplodztmkc\dll\Ijuocmtu.dll.
2020-06-05 14:01:00,218 [root] DEBUG: Process image base: 0x00400000
2020-06-05 14:01:00,218 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-05 14:01:00,234 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-05 14:01:00,234 [root] DEBUG: Successfully injected DLL C:\tmplodztmkc\dll\Ijuocmtu.dll.
2020-06-05 14:01:00,234 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1588
2020-06-05 14:01:00,265 [root] DEBUG: CreateThread: Initialising breakpoints for thread 4624.
2020-06-05 14:01:00,265 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-05 14:01:00,265 [root] DEBUG: Process dumps disabled.
2020-06-05 14:01:00,281 [root] DEBUG: Auto-unpacking of payloads enabled.
2020-06-05 14:01:00,281 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-05 14:01:00,296 [root] INFO: Disabling sleep skipping.
2020-06-05 14:01:00,296 [root] DEBUG: DLL loaded at 0x74130000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-06-05 14:01:00,312 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 1588 at 0x6f520000, image base 0x400000, stack from 0x266000-0x270000
2020-06-05 14:01:00,312 [root] DEBUG: Commandline: C:\Users\Louise\AppData\Local\Temp\"{path}".
2020-06-05 14:01:00,312 [root] DEBUG: DLL loaded at 0x74040000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-06-05 14:01:00,328 [root] DEBUG: DLL loaded at 0x732F0000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-06-05 14:01:00,328 [root] DEBUG: CreateThread: Initialising breakpoints for thread 3440.
2020-06-05 14:01:00,328 [root] DEBUG: NtTerminateProcess hook: Processing tracked regions before shutdown (process 1524).
2020-06-05 14:01:00,375 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:00,375 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:01:00,375 [root] DEBUG: WoW64 detected: 64-bit ntdll base: 0x76de0000, KiUserExceptionDispatcher: 0x0, NtSetContextThread: 0x76e4b5f0, Wow64PrepareForException: 0x0
2020-06-05 14:01:00,375 [root] DEBUG: CAPEExceptionFilter: Exception 0xc0000005 caught at RVA 0x1bf4 in capemon caught accessing 0x11f1000 (expected in memory scans), passing to next handler.
2020-06-05 14:01:00,375 [root] DEBUG: WoW64 workaround: KiUserExceptionDispatcher hook installed at: 0x150000
2020-06-05 14:01:00,375 [root] DEBUG: GetEntropy: Exception occured attempting to get PE entropy at 0x011F1000
2020-06-05 14:01:00,375 [root] DEBUG: AddTrackedRegion: New region at 0x00400000 size 0x50000 added to tracked regions: EntryPoint 0x73247cef, Entropy 6.251166e+00
2020-06-05 14:01:00,390 [root] DEBUG: ProcessImageBase: EP 0x72457CEF image base 0x011F0000 size 0x0 entropy 0.000000e+00.
2020-06-05 14:01:00,390 [root] DEBUG: UnpackerInit: Adding main image base to tracked regions.
2020-06-05 14:01:00,406 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00230000.
2020-06-05 14:01:00,421 [root] DEBUG: CAPEExceptionFilter: Exception 0xc0000005 caught at RVA 0x1d70 in capemon caught accessing 0x230000 (expected in memory scans), passing to next handler.
2020-06-05 14:01:00,406 [root] INFO: loaded: b'1588'
2020-06-05 14:01:00,421 [root] INFO: Loaded monitor into process with pid 1588
2020-06-05 14:01:00,421 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x230000
2020-06-05 14:01:00,421 [root] DEBUG: set_caller_info: Adding region at 0x00090000 to caller regions list (ntdll::LdrLoadDll).
2020-06-05 14:01:00,421 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00280000.
2020-06-05 14:01:00,437 [root] DEBUG: DLL loaded at 0x010C0000: C:\tmplodztmkc\dll\Ijuocmtu (0xd5000 bytes).
2020-06-05 14:01:00,437 [root] DEBUG: DumpPEsInRange: Scanning range 0x280000 - 0x281000.
2020-06-05 14:01:00,437 [root] DEBUG: DLL unloaded from 0x731E0000.
2020-06-05 14:01:00,437 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x280000-0x281000.
2020-06-05 14:01:00,437 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x00280000 - 0x00281000.
2020-06-05 14:01:00,437 [root] DEBUG: DLL unloaded from 0x763D0000.
2020-06-05 14:01:00,437 [root] DEBUG: DLL unloaded from 0x731E0000.
2020-06-05 14:01:00,437 [root] INFO: ('dump_file', 'C:\\JcblWXUU\\CAPE\\1524_126760290323146662020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?0x00280000;?', ['1524'], 'CAPE')
2020-06-05 14:01:00,437 [root] DEBUG: DLL unloaded from 0x763D0000.
2020-06-05 14:01:00,453 [root] DEBUG: DLL unloaded from 0x010C0000.
2020-06-05 14:01:00,453 [root] DEBUG: set_caller_info: Adding region at 0x000A0000 to caller regions list (ntdll::LdrLoadDll).
2020-06-05 14:01:00,453 [root] DEBUG: DLL loaded at 0x010C0000: C:\tmplodztmkc\dll\Ijuocmtu (0xd5000 bytes).
2020-06-05 14:01:00,453 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JcblWXUU\CAPE\1524_126760290323146662020 (size 0xf7a)
2020-06-05 14:01:00,468 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x00280000.
2020-06-05 14:01:00,468 [root] DEBUG: DLL unloaded from 0x731E0000.
2020-06-05 14:01:00,468 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x280000 - 0x281000.
2020-06-05 14:01:00,468 [root] DEBUG: DLL unloaded from 0x763D0000.
2020-06-05 14:01:00,468 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003F0000.
2020-06-05 14:01:00,468 [root] DEBUG: DumpPEsInRange: Scanning range 0x3f0000 - 0x3f1000.
2020-06-05 14:01:00,468 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3f0000-0x3f1000.
2020-06-05 14:01:00,468 [root] DEBUG: set_caller_info: Adding region at 0x000B0000 to caller regions list (ntdll::LdrLoadDll).
2020-06-05 14:01:00,468 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x003F0000 - 0x003F1000.
2020-06-05 14:01:00,468 [root] DEBUG: DLL loaded at 0x010C0000: C:\tmplodztmkc\dll\Ijuocmtu (0xd5000 bytes).
2020-06-05 14:01:00,484 [root] INFO: ('dump_file', 'C:\\JcblWXUU\\CAPE\\1524_21846683623146662020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?0x003F0000;?', ['1524'], 'CAPE')
2020-06-05 14:01:00,484 [root] DEBUG: DLL unloaded from 0x731E0000.
2020-06-05 14:01:00,484 [root] DEBUG: DLL unloaded from 0x763D0000.
2020-06-05 14:01:00,484 [root] DEBUG: DLL unloaded from 0x731E0000.
2020-06-05 14:01:00,500 [root] DEBUG: DLL unloaded from 0x763D0000.
2020-06-05 14:01:00,500 [root] DEBUG: DLL unloaded from 0x010C0000.
2020-06-05 14:01:00,500 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JcblWXUU\CAPE\1524_21846683623146662020 (size 0x8a)
2020-06-05 14:01:00,500 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x003F0000.
2020-06-05 14:01:00,500 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x3f0000 - 0x3f1000.
2020-06-05 14:01:00,500 [root] DEBUG: set_caller_info: Adding region at 0x000C0000 to caller regions list (ntdll::LdrLoadDll).
2020-06-05 14:01:00,500 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00930000.
2020-06-05 14:01:00,515 [root] DEBUG: DLL loaded at 0x010C0000: C:\tmplodztmkc\dll\Ijuocmtu (0xd5000 bytes).
2020-06-05 14:01:00,515 [root] DEBUG: DLL unloaded from 0x731E0000.
2020-06-05 14:01:00,515 [root] DEBUG: DLL unloaded from 0x763D0000.
2020-06-05 14:01:00,515 [root] DEBUG: set_caller_info: Adding region at 0x000D0000 to caller regions list (ntdll::LdrLoadDll).
2020-06-05 14:01:00,515 [root] INFO: ('dump_file', 'C:\\JcblWXUU\\CAPE\\1524_156518727623146662020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?0x00930000;?', ['1524'], 'CAPE')
2020-06-05 14:01:00,515 [root] DEBUG: DLL loaded at 0x010C0000: C:\tmplodztmkc\dll\Ijuocmtu (0xd5000 bytes).
2020-06-05 14:01:00,531 [root] DEBUG: DLL unloaded from 0x731E0000.
2020-06-05 14:01:00,531 [root] DEBUG: DLL unloaded from 0x763D0000.
2020-06-05 14:01:00,562 [root] DEBUG: DLL unloaded from 0x731E0000.
2020-06-05 14:01:00,562 [root] DEBUG: DLL unloaded from 0x763D0000.
2020-06-05 14:01:00,562 [root] DEBUG: DLL unloaded from 0x010C0000.
2020-06-05 14:01:00,578 [root] DEBUG: set_caller_info: Adding region at 0x000E0000 to caller regions list (ntdll::LdrLoadDll).
2020-06-05 14:01:00,578 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JcblWXUU\CAPE\1524_156518727623146662020 (size 0xfff)
2020-06-05 14:01:00,578 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x00930000.
2020-06-05 14:01:00,578 [root] DEBUG: DLL loaded at 0x010C0000: C:\tmplodztmkc\dll\Ijuocmtu (0xd5000 bytes).
2020-06-05 14:01:00,578 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x930000 - 0x931000.
2020-06-05 14:01:00,578 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:01:00,578 [root] DEBUG: DLL unloaded from 0x731E0000.
2020-06-05 14:01:00,578 [root] DEBUG: DLL unloaded from 0x763D0000.
2020-06-05 14:01:00,578 [root] DEBUG: DLL unloaded from 0x731E0000.
2020-06-05 14:01:00,578 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3d0000-0x3d1000.
2020-06-05 14:01:00,593 [root] DEBUG: DLL unloaded from 0x763D0000.
2020-06-05 14:01:00,593 [root] DEBUG: DLL unloaded from 0x010C0000.
2020-06-05 14:01:00,593 [root] INFO: ('dump_file', 'C:\\JcblWXUU\\CAPE\\1524_54328671623146662020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?0x003D0000;?', ['1524'], 'CAPE')
2020-06-05 14:01:00,593 [root] DEBUG: set_caller_info: Adding region at 0x000F0000 to caller regions list (ntdll::LdrLoadDll).
2020-06-05 14:01:00,609 [root] DEBUG: DLL loaded at 0x010C0000: C:\tmplodztmkc\dll\Ijuocmtu (0xd5000 bytes).
2020-06-05 14:01:00,609 [root] DEBUG: DLL unloaded from 0x731E0000.
2020-06-05 14:01:00,609 [root] DEBUG: DLL unloaded from 0x763D0000.
2020-06-05 14:01:00,609 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JcblWXUU\CAPE\1524_54328671623146662020 (size 0x8a)
2020-06-05 14:01:00,609 [root] DEBUG: DLL unloaded from 0x731E0000.
2020-06-05 14:01:00,609 [root] DEBUG: DumpPEsInRange: Scanning range 0x3e0000 - 0x3e1000.
2020-06-05 14:01:00,609 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3e0000-0x3e1000.
2020-06-05 14:01:00,625 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x003E0000 - 0x003E1000.
2020-06-05 14:01:00,625 [root] DEBUG: set_caller_info: Adding region at 0x00170000 to caller regions list (advapi32::RegQueryInfoKeyW).
2020-06-05 14:01:00,625 [root] INFO: ('dump_file', 'C:\\JcblWXUU\\CAPE\\1524_148230754823146662020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?0x003E0000;?', ['1524'], 'CAPE')
2020-06-05 14:01:00,625 [root] DEBUG: set_caller_info: Adding region at 0x00BB0000 to caller regions list (advapi32::RegOpenKeyExW).
2020-06-05 14:01:00,625 [root] DEBUG: set_caller_info: Adding region at 0x00480000 to caller regions list (kernel32::FindFirstFileExW).
2020-06-05 14:01:00,640 [root] DEBUG: set_caller_info: Adding region at 0x00110000 to caller regions list (advapi32::RegOpenKeyExW).
2020-06-05 14:01:00,640 [root] DEBUG: DLL loaded at 0x729C0000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x7d000 bytes).
2020-06-05 14:01:00,640 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JcblWXUU\CAPE\1524_148230754823146662020 (size 0x9e)
2020-06-05 14:01:00,640 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x003E0000.
2020-06-05 14:01:00,640 [root] DEBUG: DLL unloaded from 0x74A80000.
2020-06-05 14:01:00,640 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x3e0000 - 0x3e1000.
2020-06-05 14:01:00,656 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03960000.
2020-06-05 14:01:00,656 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x06650000.
2020-06-05 14:01:00,656 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00D90000.
2020-06-05 14:01:00,656 [root] DEBUG: DumpPEsInRange: Scanning range 0xd90000 - 0xd91000.
2020-06-05 14:01:00,656 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0xd90000-0xd91000.
2020-06-05 14:01:00,656 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x00D90000 - 0x00D91000.
2020-06-05 14:01:00,671 [root] DEBUG: DLL loaded at 0x73390000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-05 14:01:00,671 [root] INFO: ('dump_file', 'C:\\JcblWXUU\\CAPE\\1524_214481891223146662020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?0x00D90000;?', ['1524'], 'CAPE')
2020-06-05 14:01:00,671 [root] DEBUG: DLL loaded at 0x6EF60000: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks (0x5b1000 bytes).
2020-06-05 14:01:00,687 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JcblWXUU\CAPE\1524_214481891223146662020 (size 0x78a)
2020-06-05 14:01:00,687 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x00D90000.
2020-06-05 14:01:00,687 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0xd90000 - 0xd91000.
2020-06-05 14:01:00,687 [root] DEBUG: DLL loaded at 0x6EEC0000: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCR80 (0x9b000 bytes).
2020-06-05 14:01:00,703 [root] DEBUG: DLL unloaded from 0x76AB0000.
2020-06-05 14:01:00,703 [root] DEBUG: DLL unloaded from 0x6EF60000.
2020-06-05 14:01:00,718 [root] DEBUG: DLL unloaded from 0x729C0000.
2020-06-05 14:01:00,718 [root] WARNING: Unable to open termination event for pid 1524.
2020-06-05 14:01:00,718 [root] DEBUG: NtTerminateProcess hook: Processing tracked regions before shutdown (process 1524).
2020-06-05 14:01:00,734 [root] DEBUG: CreateThread: Initialising breakpoints for thread 436.
2020-06-05 14:01:00,734 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:00,750 [root] DEBUG: DLL unloaded from 0x76FA0000.
2020-06-05 14:01:00,781 [root] DEBUG: Allocation: 0x0039A000 - 0x0039B000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:00,781 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x011F0000.
2020-06-05 14:01:00,781 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:00,781 [root] DEBUG: CAPEExceptionFilter: Exception 0xc0000005 caught at RVA 0x1bf4 in capemon caught accessing 0x11f1000 (expected in memory scans), passing to next handler.
2020-06-05 14:01:00,796 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 2852 type 1 at address 0x0039A000, size 2 with Callback 0x6f53a080.
2020-06-05 14:01:00,796 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 2852 type 1 at address 0x0039003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:01:00,812 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:00,812 [root] INFO: ('dump_file', 'C:\\JcblWXUU\\CAPE\\1524_8904380083346662020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?0x00280000;?', ['1524'], 'CAPE')
2020-06-05 14:01:00,828 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:01:00,828 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00390000, size: 0x1000.
2020-06-05 14:01:00,859 [root] DEBUG: DLL loaded at 0x75180000: C:\Windows\syswow64\shell32 (0xc4c000 bytes).
2020-06-05 14:01:00,875 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JcblWXUU\CAPE\1524_8904380083346662020 (size 0xf7a)
2020-06-05 14:01:00,875 [root] DEBUG: CreateThread: Initialising breakpoints for thread 5068.
2020-06-05 14:01:00,890 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x00280000.
2020-06-05 14:01:00,906 [root] INFO: ('dump_file', 'C:\\JcblWXUU\\CAPE\\1524_9471722403346662020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?0x003F0000;?', ['1524'], 'CAPE')
2020-06-05 14:01:00,906 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 5068 type 1 at address 0x0039003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:01:00,921 [root] DEBUG: SetThreadBreakpoint: Set bp 2 thread id 5068 type 0 at address 0x0039A000, size 0 with Callback 0x6f539ed0.
2020-06-05 14:01:00,937 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JcblWXUU\CAPE\1524_9471722403346662020 (size 0x8a)
2020-06-05 14:01:00,937 [root] DEBUG: DLL loaded at 0x6E3C0000: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\f8420d8c6ede777377fcff48a4beaa2a\mscorlib.ni (0xafe000 bytes).
2020-06-05 14:01:00,937 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x003F0000.
2020-06-05 14:01:00,937 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x3f0000 - 0x3f1000.
2020-06-05 14:01:00,953 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00930000.
2020-06-05 14:01:00,953 [root] DEBUG: DumpPEsInRange: Scanning range 0x930000 - 0x931000.
2020-06-05 14:01:00,953 [root] DEBUG: Allocation: 0x003A2000 - 0x003A3000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:01,000 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:01,000 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x930000-0x931000.
2020-06-05 14:01:01,046 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:01:01,046 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x00930000 - 0x00931000.
2020-06-05 14:01:01,046 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 2852 type 1 at address 0x003A2000, size 2 with Callback 0x6f53a080.
2020-06-05 14:01:01,062 [root] INFO: ('dump_file', 'C:\\JcblWXUU\\CAPE\\1524_13049200984346662020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?0x00930000;?', ['1524'], 'CAPE')
2020-06-05 14:01:01,062 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x003A2000
2020-06-05 14:01:01,062 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 2852 type 1 at address 0x003A003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:01:01,062 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x003A003C
2020-06-05 14:01:01,062 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x003A2000 (size 0x1000).
2020-06-05 14:01:01,078 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JcblWXUU\CAPE\1524_13049200984346662020 (size 0xfff)
2020-06-05 14:01:01,078 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFEC1D8 (thread 2852)
2020-06-05 14:01:01,078 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x00930000.
2020-06-05 14:01:01,078 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x003A2000.
2020-06-05 14:01:01,078 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x930000 - 0x931000.
2020-06-05 14:01:01,078 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x3a2000: 0x0.
2020-06-05 14:01:01,093 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-06-05 14:01:01,093 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:01:01,125 [root] DEBUG: DLL unloaded from 0x74DF0000.
2020-06-05 14:01:01,125 [root] DEBUG: DLL unloaded from 0x74DF0000.
2020-06-05 14:01:01,140 [root] DEBUG: DumpPEsInRange: Scanning range 0x3d0000 - 0x3d1000.
2020-06-05 14:01:01,140 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:01,140 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3d0000-0x3d1000.
2020-06-05 14:01:01,140 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:01:01,140 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x003D0000 - 0x003D1000.
2020-06-05 14:01:01,156 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:01,218 [root] INFO: ('dump_file', 'C:\\JcblWXUU\\CAPE\\1588_54541000911205562020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?0x003A0000;?', ['1588'], 'CAPE')
2020-06-05 14:01:01,234 [root] INFO: ('dump_file', 'C:\\JcblWXUU\\CAPE\\1524_3838335164346662020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?0x003E0000;?', ['1524'], 'CAPE')
2020-06-05 14:01:01,265 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JcblWXUU\CAPE\1524_3838335164346662020 (size 0x9e)
2020-06-05 14:01:01,265 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x003E0000.
2020-06-05 14:01:01,265 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x3e0000 - 0x3e1000.
2020-06-05 14:01:01,296 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03960000.
2020-06-05 14:01:01,296 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x06650000.
2020-06-05 14:01:01,296 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JcblWXUU\CAPE\1588_54541000911205562020 (size 0x14)
2020-06-05 14:01:01,312 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00D90000.
2020-06-05 14:01:01,312 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x003A0000.
2020-06-05 14:01:01,312 [root] DEBUG: DumpPEsInRange: Scanning range 0xd90000 - 0xd91000.
2020-06-05 14:01:01,312 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0xd90000-0xd91000.
2020-06-05 14:01:01,312 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x3a0000 - 0x3a1000.
2020-06-05 14:01:01,312 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x00D90000 - 0x00D91000.
2020-06-05 14:01:01,328 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 2852 type 1 at address 0x003DB000, size 2 with Callback 0x6f53a080.
2020-06-05 14:01:01,328 [root] INFO: ('dump_file', 'C:\\JcblWXUU\\CAPE\\1524_5724364804346662020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?0x00D90000;?', ['1524'], 'CAPE')
2020-06-05 14:01:01,343 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x003DB000
2020-06-05 14:01:01,359 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 2852 type 1 at address 0x003D003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:01:01,359 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x003D003C
2020-06-05 14:01:01,359 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JcblWXUU\CAPE\1524_5724364804346662020 (size 0x78a)
2020-06-05 14:01:01,359 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x003DB000 (size 0x1000).
2020-06-05 14:01:01,359 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x00D90000.
2020-06-05 14:01:01,406 [root] DEBUG: DLL unloaded from 0x76FA0000.
2020-06-05 14:01:01,406 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0xd90000 - 0xd91000.
2020-06-05 14:01:01,406 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFEC1D8 (thread 2852)
2020-06-05 14:01:01,421 [root] DEBUG: ClearAllBreakpoints: Error getting thread context (thread 3980, handle 0x13c).
2020-06-05 14:01:01,500 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x003DB000.
2020-06-05 14:01:01,515 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x3db000: 0x0.
2020-06-05 14:01:01,546 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-06-05 14:01:01,546 [root] DEBUG: Allocation: 0x003D7000 - 0x003D8000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:01,562 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:01,562 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:01:01,593 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:01,593 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:01:01,671 [root] DEBUG: Allocation: 0x03730000 - 0x03731000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:01,687 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:01,687 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:01:01,703 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:01,718 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:01:01,734 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:01:01,750 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:01:01,765 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x03730000, size: 0x1000.
2020-06-05 14:01:01,765 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x03730000.
2020-06-05 14:01:01,765 [root] DEBUG: AddTrackedRegion: New region at 0x03730000 size 0x1000 added to tracked regions.
2020-06-05 14:01:01,765 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x03730000, TrackedRegion->RegionSize: 0x1000, thread 2852
2020-06-05 14:01:01,796 [root] DEBUG: ActivateBreakpoints: Switching breakpoints from region 0x003D0000 to 0x03730000.
2020-06-05 14:01:01,796 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x3d0000
2020-06-05 14:01:01,796 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 2852 type 1 at address 0x03730000, size 2 with Callback 0x6f53a080.
2020-06-05 14:01:01,812 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 2852 type 1 at address 0x0373003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:01:01,828 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x0373003C
2020-06-05 14:01:01,828 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x03730000 (size 0x1000).
2020-06-05 14:01:01,843 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFEC1D8 (thread 2852)
2020-06-05 14:01:01,843 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x03730000.
2020-06-05 14:01:01,843 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x3730000: 0x0.
2020-06-05 14:01:01,875 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-06-05 14:01:01,890 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFFCA24 (thread 2852)
2020-06-05 14:01:01,890 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0373003C.
2020-06-05 14:01:01,890 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x03730000.
2020-06-05 14:01:01,890 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFFCB4B (thread 2852)
2020-06-05 14:01:01,906 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0373003C.
2020-06-05 14:01:01,921 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x3730050 (at 0x0373003C).
2020-06-05 14:01:01,921 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x03730000 already exists for thread 2852 (process 1588), skipping.
2020-06-05 14:01:01,937 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x03730000.
2020-06-05 14:01:01,937 [root] DEBUG: Allocation: 0x03731000 - 0x0373E000, size: 0xd000, protection: 0x40.
2020-06-05 14:01:01,937 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:01,937 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:01:01,953 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:01:01,953 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:01:01,968 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:01:01,968 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x03730000, size: 0x1000.
2020-06-05 14:01:01,984 [root] DEBUG: set_caller_info: Adding region at 0x03730000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-06-05 14:01:01,984 [root] DEBUG: DumpPEsInRange: Scanning range 0x3730000 - 0x3731000.
2020-06-05 14:01:02,000 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3730000-0x3731000.
2020-06-05 14:01:02,000 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x03730000 - 0x03731000.
2020-06-05 14:01:02,015 [root] INFO: ('dump_file', 'C:\\JcblWXUU\\CAPE\\1588_0125036662020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?0x03730000;?', ['1588'], 'CAPE')
2020-06-05 14:01:02,046 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JcblWXUU\CAPE\1588_0125036662020 (size 0xffc)
2020-06-05 14:01:02,046 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x03730000.
2020-06-05 14:01:02,046 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x0373003C.
2020-06-05 14:01:02,062 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 2 address 0x03730000.
2020-06-05 14:01:02,062 [root] DEBUG: Allocation: 0x003A6000 - 0x003A7000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:02,062 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:02,078 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:01:02,078 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:02,093 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:01:02,093 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:01:02,093 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:01:02,093 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x003A0000, size: 0x1000.
2020-06-05 14:01:02,171 [root] DEBUG: DLL loaded at 0x707C0000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System\0a65164b17e5c64bacdc694ea2439c43\System.ni (0x7a5000 bytes).
2020-06-05 14:01:02,187 [root] DEBUG: DLL loaded at 0x70630000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\175df210b784212def386595c25caefb\System.Drawing.ni (0x189000 bytes).
2020-06-05 14:01:02,218 [root] DEBUG: DLL loaded at 0x6D740000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\5669120680b52abf616f3876387ca2cc\System.Windows.Forms.ni (0xbdf000 bytes).
2020-06-05 14:01:02,218 [root] DEBUG: Allocation: 0x003A7000 - 0x003A8000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:02,249 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:02,249 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:01:02,249 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:02,265 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:01:02,265 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:01:02,265 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:01:02,281 [root] DEBUG: Allocation: 0x003A8000 - 0x003A9000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:02,296 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:02,296 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:01:02,328 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:02,375 [root] DEBUG: Allocation: 0x003B6000 - 0x003B7000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:02,375 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:02,390 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:01:02,390 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:02,390 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:01:02,390 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:01:02,406 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:01:02,406 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:01:02,421 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x003B6000, size: 0x1000.
2020-06-05 14:01:02,421 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x003B6000.
2020-06-05 14:01:02,421 [root] DEBUG: AddTrackedRegion: New region at 0x003B0000 size 0x1000 added to tracked regions.
2020-06-05 14:01:02,421 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x003B0000, TrackedRegion->RegionSize: 0x1000, thread 2852
2020-06-05 14:01:02,421 [root] DEBUG: ActivateBreakpoints: Switching breakpoints from region 0x03730000 to 0x003B0000.
2020-06-05 14:01:02,437 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 2852 type 1 at address 0x003B6000, size 2 with Callback 0x6f53a080.
2020-06-05 14:01:02,437 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x003B6000
2020-06-05 14:01:02,437 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 2852 type 1 at address 0x003B003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:01:02,453 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x003B003C
2020-06-05 14:01:02,453 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x003B6000 (size 0x1000).
2020-06-05 14:01:02,453 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFEC1D8 (thread 2852)
2020-06-05 14:01:02,453 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x003B6000.
2020-06-05 14:01:02,453 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x3b6000: 0x0.
2020-06-05 14:01:02,468 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-06-05 14:01:02,468 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EF7F9CD (thread 2852)
2020-06-05 14:01:02,484 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x003B003C.
2020-06-05 14:01:02,500 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header zero.
2020-06-05 14:01:02,531 [root] DEBUG: set_caller_info: Adding region at 0x00390000 to caller regions list (ntdll::memcpy).
2020-06-05 14:01:02,531 [root] DEBUG: CAPEExceptionFilter: Exception 0xc0000005 caught at RVA 0x1d70 in capemon caught accessing 0x390000 (expected in memory scans), passing to next handler.
2020-06-05 14:01:02,546 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:01:02,593 [root] DEBUG: Allocation: 0x003CA000 - 0x003CB000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:02,593 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:02,593 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:01:02,609 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:02,609 [root] DEBUG: DumpPEsInRange: Scanning range 0x3b0000 - 0x3b1000.
2020-06-05 14:01:02,609 [root] INFO: ('dump_file', 'C:\\JcblWXUU\\CAPE\\1588_104805595221205562020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?0x003B0000;?', ['1588'], 'CAPE')
2020-06-05 14:01:02,656 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JcblWXUU\CAPE\1588_104805595221205562020 (size 0x8a)
2020-06-05 14:01:02,656 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 2852 type 1 at address 0x003CA000, size 2 with Callback 0x6f53a080.
2020-06-05 14:01:02,671 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x003CA000
2020-06-05 14:01:02,671 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 2852 type 1 at address 0x003C003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:01:02,671 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFEC1D8 (thread 2852)
2020-06-05 14:01:02,671 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x003CA000.
2020-06-05 14:01:02,671 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x3ca000: 0x0.
2020-06-05 14:01:02,687 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-06-05 14:01:02,703 [root] DEBUG: Allocation: 0x003C2000 - 0x003C3000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:02,703 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:02,703 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:01:02,718 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:02,750 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:01:02,750 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:01:02,750 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:01:02,750 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:01:02,750 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:01:02,765 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:01:02,781 [root] DEBUG: DLL loaded at 0x74430000: C:\Windows\system32\bcrypt (0x17000 bytes).
2020-06-05 14:01:02,796 [root] DEBUG: Allocation: 0x003BA000 - 0x003BB000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:02,812 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:02,812 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:01:02,812 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:02,812 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:01:02,828 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:01:02,828 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:01:02,828 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:01:02,828 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:01:02,828 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:01:02,828 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:01:02,828 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x003B0000, size: 0x1000.
2020-06-05 14:01:02,828 [root] DEBUG: Allocation: 0x003B7000 - 0x003B8000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:02,859 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:02,875 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:01:02,890 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:03,000 [root] DEBUG: DLL loaded at 0x70490000: C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\4ac828c8c4c76f3ba59f8f9c7dab1cb3\Microsoft.VisualBasic.ni (0x19b000 bytes).
2020-06-05 14:01:03,015 [root] DEBUG: Allocation: 0x01181000 - 0x01182000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:03,015 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:03,015 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:03,015 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:01:03,015 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x01181000.
2020-06-05 14:01:03,015 [root] DEBUG: AddTrackedRegion: New region at 0x01180000 size 0x1000 added to tracked regions.
2020-06-05 14:01:03,062 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x01180000, TrackedRegion->RegionSize: 0x1000, thread 2852
2020-06-05 14:01:03,062 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 2852 type 1 at address 0x0118003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:01:03,078 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x0118003C
2020-06-05 14:01:03,078 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x01181000 (size 0x1000).
2020-06-05 14:01:03,078 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x76FDAAB7 (thread 2852)
2020-06-05 14:01:03,078 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0118003C.
2020-06-05 14:01:03,078 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header zero.
2020-06-05 14:01:03,093 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x76FDA99E (thread 2852)
2020-06-05 14:01:03,093 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0118003C.
2020-06-05 14:01:03,156 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EF9BE5C (thread 2852)
2020-06-05 14:01:03,156 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x01181000.
2020-06-05 14:01:03,171 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x1181000: 0x10.
2020-06-05 14:01:03,171 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-06-05 14:01:03,187 [root] DEBUG: Allocation: 0x0373F000 - 0x03740000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:03,203 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:03,203 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:01:03,203 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:03,203 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:01:03,218 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:01:03,218 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:01:03,218 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01180000.
2020-06-05 14:01:03,218 [root] DEBUG: Allocation: 0x003AA000 - 0x003AB000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:03,234 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:03,249 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:01:03,249 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:03,249 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:01:03,265 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:01:03,265 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:01:03,265 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:01:03,281 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:01:03,281 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:01:03,281 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:01:03,281 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01180000.
2020-06-05 14:01:03,296 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x003A0000, size: 0x1000.
2020-06-05 14:01:03,296 [root] DEBUG: Allocation: 0x0039B000 - 0x0039C000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:03,296 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:03,296 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:03,640 [root] DEBUG: DLL loaded at 0x74130000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-06-05 14:01:03,640 [root] DEBUG: DLL loaded at 0x74040000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-06-05 14:01:03,734 [root] DEBUG: DLL loaded at 0x732F0000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-06-05 14:01:03,734 [root] DEBUG: CreateThread: Initialising breakpoints for thread 4240.
2020-06-05 14:01:03,750 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 4240 type 1 at address 0x01181000, size 2 with Callback 0x6f53a080.
2020-06-05 14:01:03,750 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 4240 type 1 at address 0x0118003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:01:03,750 [root] DEBUG: SetThreadBreakpoint: Set bp 2 thread id 4240 type 0 at address 0x01181000, size 0 with Callback 0x6f539ed0.
2020-06-05 14:01:03,796 [root] DEBUG: DLL loaded at 0x75DD0000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes).
2020-06-05 14:01:03,812 [root] DEBUG: DLL loaded at 0x76930000: C:\Windows\syswow64\OLEAUT32 (0x91000 bytes).
2020-06-05 14:01:03,859 [root] DEBUG: DLL loaded at 0x72AB0000: C:\Windows\system32\wbem\wbemdisp (0x31000 bytes).
2020-06-05 14:01:03,953 [root] DEBUG: DLL loaded at 0x72A50000: C:\Windows\system32\wbemcomn (0x5c000 bytes).
2020-06-05 14:01:03,984 [root] DEBUG: DLL loaded at 0x74A10000: C:\Windows\syswow64\WS2_32 (0x35000 bytes).
2020-06-05 14:01:03,984 [root] DEBUG: DLL loaded at 0x76780000: C:\Windows\syswow64\NSI (0x6000 bytes).
2020-06-05 14:01:04,015 [root] INFO: Stopping WMI Service
2020-06-05 14:01:11,890 [root] INFO: Stopped WMI Service
2020-06-05 14:01:12,249 [lib.api.process] INFO: Monitor config for process 592: C:\tmplodztmkc\dll\592.ini
2020-06-05 14:01:12,281 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-06-05 14:01:12,281 [lib.api.process] INFO: Option 'unpacker' with value '1' sent to monitor
2020-06-05 14:01:12,281 [lib.api.process] INFO: Option 'injection' with value '0' sent to monitor
2020-06-05 14:01:12,281 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmplodztmkc\dll\FyTPkO.dll, loader C:\tmplodztmkc\bin\XmFrASFL.exe
2020-06-05 14:01:12,312 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TEexVLcl.
2020-06-05 14:01:12,328 [root] DEBUG: Loader: Injecting process 592 (thread 0) with C:\tmplodztmkc\dll\FyTPkO.dll.
2020-06-05 14:01:12,328 [root] DEBUG: Error 0 (0x0) - GetProcessInitialThreadId: Remote PEB 0x000007FFFFFDC000 Local PEB 0x000007FFFFFDE000 Local TEB 0x000007FFFFFDA000: The operation completed successfully.
2020-06-05 14:01:12,328 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-05 14:01:12,328 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2020-06-05 14:01:12,375 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-05 14:01:12,390 [root] DEBUG: Process dumps disabled.
2020-06-05 14:01:12,390 [root] DEBUG: Auto-unpacking of payloads enabled.
2020-06-05 14:01:12,390 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-05 14:01:12,390 [root] INFO: Disabling sleep skipping.
2020-06-05 14:01:12,406 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 592 at 0x0000000070390000, image base 0x00000000FFAF0000, stack from 0x0000000001406000-0x0000000001410000
2020-06-05 14:01:12,406 [root] DEBUG: Commandline: C:\Windows\sysnative\svchost.exe -k DcomLaunch.
2020-06-05 14:01:12,468 [root] WARNING: b'Unable to place hook on LockResource'
2020-06-05 14:01:12,484 [root] WARNING: b'Unable to hook LockResource'
2020-06-05 14:01:12,531 [root] DEBUG: UnpackerInit: Debugger initialised.
2020-06-05 14:01:12,531 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00000000FFAF0000.
2020-06-05 14:01:12,546 [root] DEBUG: AddTrackedRegion: New region at 0x00000000FFAF0000 size 0x1000 added to tracked regions: EntryPoint 0x246c, Entropy 3.675947e+00
2020-06-05 14:01:12,546 [root] DEBUG: UnpackerInit: Adding main image base to tracked regions.
2020-06-05 14:01:12,546 [root] INFO: loaded: b'592'
2020-06-05 14:01:12,546 [root] INFO: Loaded monitor into process with pid 592
2020-06-05 14:01:12,562 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-05 14:01:12,562 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-05 14:01:12,593 [root] DEBUG: Successfully injected DLL C:\tmplodztmkc\dll\FyTPkO.dll.
2020-06-05 14:01:14,593 [root] INFO: Starting WMI Service
2020-06-05 14:01:16,765 [root] INFO: Started WMI Service
2020-06-05 14:01:16,765 [lib.api.process] INFO: Monitor config for process 2228: C:\tmplodztmkc\dll\2228.ini
2020-06-05 14:01:16,812 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-06-05 14:01:16,812 [lib.api.process] INFO: Option 'unpacker' with value '1' sent to monitor
2020-06-05 14:01:16,812 [lib.api.process] INFO: Option 'injection' with value '0' sent to monitor
2020-06-05 14:01:16,812 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmplodztmkc\dll\FyTPkO.dll, loader C:\tmplodztmkc\bin\XmFrASFL.exe
2020-06-05 14:01:16,828 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TEexVLcl.
2020-06-05 14:01:16,843 [root] DEBUG: Loader: Injecting process 2228 (thread 0) with C:\tmplodztmkc\dll\FyTPkO.dll.
2020-06-05 14:01:16,843 [root] DEBUG: Error 0 (0x0) - GetProcessInitialThreadId: Remote PEB 0x000007FFFFFD7000 Local PEB 0x000007FFFFFDE000 Local TEB 0x000007FFFFFDD000: The operation completed successfully.
2020-06-05 14:01:16,859 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 2868, handle 0xa8
2020-06-05 14:01:16,875 [root] DEBUG: Process image base: 0x00000000FFAF0000
2020-06-05 14:01:16,875 [root] DEBUG: InjectDllViaIAT: Not a new process, aborting IAT patch
2020-06-05 14:01:16,875 [root] DEBUG: InjectDll: IAT patching failed, falling back to thread injection.
2020-06-05 14:01:16,890 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-05 14:01:16,921 [root] DEBUG: Process dumps disabled.
2020-06-05 14:01:16,921 [root] DEBUG: Auto-unpacking of payloads enabled.
2020-06-05 14:01:16,921 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-05 14:01:16,921 [root] INFO: Disabling sleep skipping.
2020-06-05 14:01:16,921 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 2228 at 0x0000000070390000, image base 0x00000000FFAF0000, stack from 0x0000000001336000-0x0000000001340000
2020-06-05 14:01:16,937 [root] DEBUG: Commandline: C:\Windows\sysnative\svchost.exe -k netsvcs.
2020-06-05 14:01:17,000 [root] WARNING: b'Unable to place hook on LockResource'
2020-06-05 14:01:17,015 [root] WARNING: b'Unable to hook LockResource'
2020-06-05 14:01:17,015 [root] DEBUG: UnpackerInit: Debugger initialised.
2020-06-05 14:01:17,031 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00000000FFAF0000.
2020-06-05 14:01:17,031 [root] DEBUG: AddTrackedRegion: New region at 0x00000000FFAF0000 size 0x1000 added to tracked regions: EntryPoint 0x246c, Entropy 3.663277e+00
2020-06-05 14:01:17,031 [root] DEBUG: UnpackerInit: Adding main image base to tracked regions.
2020-06-05 14:01:17,031 [root] INFO: loaded: b'2228'
2020-06-05 14:01:17,031 [root] INFO: Loaded monitor into process with pid 2228
2020-06-05 14:01:17,031 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-05 14:01:17,046 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-05 14:01:17,046 [root] DEBUG: Successfully injected DLL C:\tmplodztmkc\dll\FyTPkO.dll.
2020-06-05 14:01:19,093 [root] DEBUG: DLL loaded at 0x732B0000: C:\Windows\system32\wbem\wbemprox (0xb000 bytes).
2020-06-05 14:01:19,093 [root] DEBUG: DLL loaded at 0x70320000: C:\Windows\system32\wbemcomn2 (0x61000 bytes).
2020-06-05 14:01:19,171 [root] DEBUG: DLL loaded at 0x73200000: C:\Windows\system32\wbem\wmiutils (0x1a000 bytes).
2020-06-05 14:01:19,406 [root] DEBUG: Allocation: 0x003D5000 - 0x003D6000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:19,437 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:19,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:01:19,437 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:01:19,500 [root] DEBUG: DLL loaded at 0x70210000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\81ab4c39c6a7c9f50721aca2db09b417\System.Management.ni (0x106000 bytes).
2020-06-05 14:01:19,546 [root] DEBUG: CreateThread: Initialising breakpoints for thread 760.
2020-06-05 14:01:19,562 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 760 type 1 at address 0x01181000, size 2 with Callback 0x6f53a080.
2020-06-05 14:01:19,562 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 760 type 1 at address 0x0118003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:01:19,562 [root] DEBUG: SetThreadBreakpoint: Set bp 2 thread id 760 type 0 at address 0x01181000, size 0 with Callback 0x6f539ed0.
2020-06-05 14:01:19,578 [root] DEBUG: Allocation: 0x7EF40000 - 0x7EF90000, size: 0x50000, protection: 0x40.
2020-06-05 14:01:19,578 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:19,609 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:01:19,609 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:19,609 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:01:19,609 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:01:19,609 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:01:19,609 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:01:19,625 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:01:19,625 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:01:19,625 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:01:19,640 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01180000.
2020-06-05 14:01:19,640 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x7EF40000, size: 0x50000.
2020-06-05 14:01:19,640 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x7EF40000.
2020-06-05 14:01:19,656 [root] DEBUG: AddTrackedRegion: New region at 0x7EF40000 size 0x50000 added to tracked regions.
2020-06-05 14:01:19,656 [root] DEBUG: AllocationHandler: Memory reserved but not committed at 0x7EF40000.
2020-06-05 14:01:19,656 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:19,656 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:01:19,718 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:01:19,750 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:01:19,750 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:01:19,765 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:01:19,796 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:01:19,812 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 760 type 1 at address 0x7EF40000, size 2 with Callback 0x6f53a080.
2020-06-05 14:01:19,812 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x7EF40000
2020-06-05 14:01:19,812 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 760 type 1 at address 0x7EF4003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:01:19,828 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x7EF4003C
2020-06-05 14:01:19,828 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x7EF40000 (size 0x1000).
2020-06-05 14:01:19,828 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EED500A (thread 760)
2020-06-05 14:01:19,843 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x7EF40000.
2020-06-05 14:01:19,843 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x7ef40000: 0xec.
2020-06-05 14:01:19,843 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-06-05 14:01:19,843 [root] DEBUG: Allocation: 0x7EF40000 - 0x7EF41000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:19,843 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:19,843 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:01:19,843 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:19,859 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:01:19,875 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:01:19,890 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:01:19,890 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:01:19,890 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:01:19,890 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:01:19,890 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01180000.
2020-06-05 14:01:19,906 [root] DEBUG: Allocation: 0x7EF30000 - 0x7EF40000, size: 0x10000, protection: 0x40.
2020-06-05 14:01:19,906 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:19,906 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:01:19,921 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:19,921 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:01:19,921 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:01:19,937 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:01:19,953 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:01:19,968 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:01:19,968 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:01:19,984 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:01:19,984 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01180000.
2020-06-05 14:01:20,000 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF40000.
2020-06-05 14:01:20,015 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x7EF30000, size: 0x10000.
2020-06-05 14:01:20,015 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x7EF30000.
2020-06-05 14:01:20,015 [root] DEBUG: AddTrackedRegion: New region at 0x7EF30000 size 0x10000 added to tracked regions.
2020-06-05 14:01:20,015 [root] DEBUG: AllocationHandler: Memory reserved but not committed at 0x7EF30000.
2020-06-05 14:01:20,046 [root] DEBUG: Allocation: 0x7EF30000 - 0x7EF31000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:20,046 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:20,062 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:01:20,062 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:20,062 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:01:20,062 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:01:20,062 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:01:20,078 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:01:20,078 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:01:20,078 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:01:20,078 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:01:20,078 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01180000.
2020-06-05 14:01:20,093 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF40000.
2020-06-05 14:01:20,093 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-06-05 14:01:20,093 [root] DEBUG: AllocationHandler: Previously reserved region 0x7EF30000 - 0x7EF40000, committing at: 0x7EF30000.
2020-06-05 14:01:20,093 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x7EF30000, TrackedRegion->RegionSize: 0x10000, thread 760
2020-06-05 14:01:20,093 [root] DEBUG: ActivateBreakpoints: Switching breakpoints from region 0x7EF40000 to 0x7EF30000.
2020-06-05 14:01:20,109 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 760 type 1 at address 0x7EF30000, size 2 with Callback 0x6f53a080.
2020-06-05 14:01:20,109 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x7EF30000
2020-06-05 14:01:20,109 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 760 type 1 at address 0x7EF3003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:01:20,109 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x7EF3003C
2020-06-05 14:01:20,125 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x7EF30000 (size 0x1000).
2020-06-05 14:01:20,125 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6F050FE6 (thread 760)
2020-06-05 14:01:20,140 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x7EF30000.
2020-06-05 14:01:20,140 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x7ef30000: 0x0.
2020-06-05 14:01:20,140 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-06-05 14:01:20,140 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6F050F43 (thread 760)
2020-06-05 14:01:20,140 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x7EF3003C.
2020-06-05 14:01:20,171 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header zero.
2020-06-05 14:01:20,171 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0xe900 (at 0x7EF3003C).
2020-06-05 14:01:20,171 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x7EF30000 already exists for thread 760 (process 1588), skipping.
2020-06-05 14:01:20,171 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x7EF30000.
2020-06-05 14:01:20,171 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6F050F57 (thread 760)
2020-06-05 14:01:20,187 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x7EF3003C.
2020-06-05 14:01:20,203 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0xfeae900 (at 0x7EF3003C).
2020-06-05 14:01:20,203 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x7EF30000 already exists for thread 760 (process 1588), skipping.
2020-06-05 14:01:20,203 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x7EF30000.
2020-06-05 14:01:20,281 [root] DEBUG: CreateThread: Initialising breakpoints for thread 4540.
2020-06-05 14:01:20,312 [root] DEBUG: DLL loaded at 0x701F0000: C:\Windows\Microsoft.NET\Framework\v2.0.50727\wminet_utils (0x1e000 bytes).
2020-06-05 14:01:20,343 [root] DEBUG: Allocation: 0x003AB000 - 0x003AC000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:20,359 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:20,359 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:20,359 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:01:20,375 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:01:20,375 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:01:20,375 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:01:20,375 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:01:20,375 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:01:20,390 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:01:20,390 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01180000.
2020-06-05 14:01:20,390 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF40000.
2020-06-05 14:01:20,406 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-06-05 14:01:20,406 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x003A0000, size: 0x1000.
2020-06-05 14:01:20,406 [root] DEBUG: Allocation: 0x00760000 - 0x00761000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:20,421 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:20,421 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:01:20,421 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:20,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:01:20,437 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:01:20,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:01:20,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:01:20,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:01:20,453 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:01:20,453 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:01:20,453 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01180000.
2020-06-05 14:01:20,453 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF40000.
2020-06-05 14:01:20,453 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-06-05 14:01:20,468 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x00760000, size: 0x1000.
2020-06-05 14:01:20,468 [root] DEBUG: AddTrackedRegion: DEBUG Warning - number of tracked regions 11.
2020-06-05 14:01:20,468 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00760000.
2020-06-05 14:01:20,468 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x00760000, TrackedRegion->RegionSize: 0x1000, thread 4540
2020-06-05 14:01:20,468 [root] DEBUG: ActivateBreakpoints: Switching breakpoints from region 0x7EF30000 to 0x00760000.
2020-06-05 14:01:20,484 [root] DEBUG: DumpPEsInRange: Scanning range 0x7ef30000 - 0x7ef40000.
2020-06-05 14:01:20,484 [root] DEBUG: ScanForDisguisedPE: Exception occured scanning buffer at 0x7ef30fc1
2020-06-05 14:01:20,484 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x7EF30000 - 0x7EF40000.
2020-06-05 14:01:20,500 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:01:20,500 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:01:20,500 [root] DEBUG: ProcessTrackedRegion: failed to dump executable memory range at 0x7EF30000.
2020-06-05 14:01:20,500 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 4540 type 1 at address 0x00760000, size 2 with Callback 0x6f53a080.
2020-06-05 14:01:20,500 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x00760000
2020-06-05 14:01:20,515 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 4540 type 1 at address 0x0076003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:01:20,515 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x0076003C
2020-06-05 14:01:20,515 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x00760000 (size 0x1000).
2020-06-05 14:01:20,515 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFEC1D8 (thread 4540)
2020-06-05 14:01:20,531 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x00760000.
2020-06-05 14:01:20,531 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x760000: 0x0.
2020-06-05 14:01:20,546 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-06-05 14:01:20,562 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EF9BE5C (thread 4540)
2020-06-05 14:01:20,562 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0076003C.
2020-06-05 14:01:20,578 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x007600B8.
2020-06-05 14:01:20,593 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EED50F0 (thread 4540)
2020-06-05 14:01:20,593 [root] DEBUG: AddressOfEPWriteCallback: Breakpoint 3 at Address 0x007600B8.
2020-06-05 14:01:20,593 [root] DEBUG: GetHookCallerBase: thread 4540 (handle 0x2fc), return address 0x003923E7, allocation base 0x00390000.
2020-06-05 14:01:20,593 [root] DEBUG: AddressOfEPWriteCallback: Not in a hooked function, setting callback in enter_hook() to catch next hook (return address 0x00390000).
2020-06-05 14:01:20,593 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EED5108 (thread 4540)
2020-06-05 14:01:20,593 [root] DEBUG: MagicWriteCallback: Breakpoint 0 at Address 0x007600A8.
2020-06-05 14:01:20,593 [root] DEBUG: GetHookCallerBase: thread 4540 (handle 0x2fc), return address 0x003923E7, allocation base 0x00390000.
2020-06-05 14:01:20,625 [root] DEBUG: MagicWriteCallback: Magic value not valid NT: 0x215a (at 0x007600A8).
2020-06-05 14:01:20,625 [root] DEBUG: Allocation: 0x00761000 - 0x00762000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:20,625 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:20,625 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:01:20,640 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:20,640 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:01:20,640 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:01:20,640 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:01:20,656 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:01:20,656 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:01:20,656 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:01:20,656 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:01:20,656 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01180000.
2020-06-05 14:01:20,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF40000.
2020-06-05 14:01:20,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-06-05 14:01:20,687 [root] DEBUG: DumpPEsInRange: Scanning range 0x7ef30000 - 0x7ef40000.
2020-06-05 14:01:20,687 [root] DEBUG: ScanForDisguisedPE: Exception occured scanning buffer at 0x7ef30fc1
2020-06-05 14:01:20,687 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x7EF30000 - 0x7EF40000.
2020-06-05 14:01:20,687 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:01:20,687 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:01:20,703 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00760000.
2020-06-05 14:01:20,703 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00760000, size: 0x1000.
2020-06-05 14:01:20,703 [root] DEBUG: Allocation: 0x00762000 - 0x00763000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:20,750 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:20,765 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:01:20,765 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:20,796 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:01:20,812 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:01:20,828 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:01:20,828 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00760000, size: 0x1000.
2020-06-05 14:01:20,828 [root] DEBUG: set_caller_info: Adding region at 0x00760000 to caller regions list (ole32::CoCreateInstance).
2020-06-05 14:01:20,828 [root] DEBUG: DumpPEsInRange: Scanning range 0x760000 - 0x761000.
2020-06-05 14:01:20,843 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x760000-0x761000.
2020-06-05 14:01:20,843 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x00760000 - 0x00761000.
2020-06-05 14:01:20,843 [root] INFO: ('dump_file', 'C:\\JcblWXUU\\CAPE\\1588_133363511930746662020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?0x00760000;?', ['1588'], 'CAPE')
2020-06-05 14:01:20,906 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JcblWXUU\CAPE\1588_133363511930746662020 (size 0xfff)
2020-06-05 14:01:20,906 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x00760000.
2020-06-05 14:01:20,906 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x760000 - 0x761000.
2020-06-05 14:01:20,906 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x007600A8.
2020-06-05 14:01:20,906 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x0076003C.
2020-06-05 14:01:20,906 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 2 address 0x00760000.
2020-06-05 14:01:20,921 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 3 address 0x007600B8.
2020-06-05 14:01:20,984 [root] DEBUG: Allocation: 0x00910000 - 0x00911000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:21,000 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:21,000 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:01:21,000 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:21,000 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:01:21,015 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:01:21,015 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:01:21,015 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:01:21,031 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:01:21,031 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:01:21,031 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:01:21,031 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01180000.
2020-06-05 14:01:21,046 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF40000.
2020-06-05 14:01:21,046 [root] DEBUG: DumpPEsInRange: Scanning range 0x7ef30000 - 0x7ef40000.
2020-06-05 14:01:21,062 [root] DEBUG: ScanForDisguisedPE: Exception occured scanning buffer at 0x7ef30fc1
2020-06-05 14:01:21,078 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:01:21,109 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:01:21,109 [root] DEBUG: ProcessTrackedRegion: failed to dump executable memory range at 0x7EF30000.
2020-06-05 14:01:21,109 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00760000.
2020-06-05 14:01:21,109 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x00910000, size: 0x1000.
2020-06-05 14:01:21,109 [root] DEBUG: AddTrackedRegion: DEBUG Warning - number of tracked regions 12.
2020-06-05 14:01:21,109 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00910000.
2020-06-05 14:01:21,125 [root] DEBUG: AddTrackedRegion: New region at 0x00910000 size 0x1000 added to tracked regions.
2020-06-05 14:01:21,125 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x00910000, TrackedRegion->RegionSize: 0x1000, thread 4540
2020-06-05 14:01:21,125 [root] DEBUG: ActivateBreakpoints: Switching breakpoints from region 0x00760000 to 0x00910000.
2020-06-05 14:01:21,125 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 4540 type 1 at address 0x00910000, size 2 with Callback 0x6f53a080.
2020-06-05 14:01:21,140 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 4540 type 1 at address 0x0091003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:01:21,140 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x00910000 (size 0x1000).
2020-06-05 14:01:21,140 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFEC1D8 (thread 4540)
2020-06-05 14:01:21,140 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x00910000.
2020-06-05 14:01:21,156 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x910000: 0x0.
2020-06-05 14:01:21,156 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-06-05 14:01:21,156 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EED500C (thread 4540)
2020-06-05 14:01:21,171 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0091003C.
2020-06-05 14:01:21,171 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x7b8b0000 (at 0x0091003C).
2020-06-05 14:01:21,171 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x00910000 already exists for thread 4540 (process 1588), skipping.
2020-06-05 14:01:21,187 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x00910000.
2020-06-05 14:01:21,249 [root] DEBUG: CreateThread: Initialising breakpoints for thread 4676.
2020-06-05 14:01:21,281 [root] DEBUG: Allocation: 0x00920000 - 0x00921000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:21,296 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:21,296 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:21,296 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:01:21,296 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:01:21,296 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:01:21,312 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:01:21,312 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:01:21,312 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:01:21,312 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:01:21,312 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:01:21,312 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:01:21,312 [root] DEBUG: ProcessTrackedRegion: failed to dump executable memory range at 0x7EF30000.
2020-06-05 14:01:21,328 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00760000.
2020-06-05 14:01:21,359 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00910000.
2020-06-05 14:01:21,359 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x00920000, size: 0x1000.
2020-06-05 14:01:21,359 [root] DEBUG: AddTrackedRegion: DEBUG Warning - number of tracked regions 13.
2020-06-05 14:01:21,359 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00920000.
2020-06-05 14:01:21,359 [root] DEBUG: AddTrackedRegion: New region at 0x00920000 size 0x1000 added to tracked regions.
2020-06-05 14:01:21,375 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x00920000, TrackedRegion->RegionSize: 0x1000, thread 2852
2020-06-05 14:01:21,375 [root] DEBUG: ActivateBreakpoints: Switching breakpoints from region 0x00910000 to 0x00920000.
2020-06-05 14:01:21,375 [root] DEBUG: ClearAllBreakpoints: Error getting thread context (thread 4540, handle 0x2fc).
2020-06-05 14:01:21,375 [root] DEBUG: DumpPEsInRange: Scanning range 0x910000 - 0x911000.
2020-06-05 14:01:21,375 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x910000-0x911000.
2020-06-05 14:01:21,390 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x00910000 - 0x00911000.
2020-06-05 14:01:21,406 [root] INFO: ('dump_file', 'C:\\JcblWXUU\\CAPE\\1588_761977838211205562020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?0x00910000;?', ['1588'], 'CAPE')
2020-06-05 14:01:21,437 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JcblWXUU\CAPE\1588_761977838211205562020 (size 0xb2)
2020-06-05 14:01:21,437 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x00910000.
2020-06-05 14:01:21,437 [root] DEBUG: ClearAllBreakpoints: Error getting thread context (thread 4540, handle 0x2fc).
2020-06-05 14:01:21,437 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 2852 type 1 at address 0x00920000, size 2 with Callback 0x6f53a080.
2020-06-05 14:01:21,453 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x00920000
2020-06-05 14:01:21,453 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 2852 type 1 at address 0x0092003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:01:21,453 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x0092003C
2020-06-05 14:01:21,468 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x00920000 (size 0x1000).
2020-06-05 14:01:21,468 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFEC1D8 (thread 2852)
2020-06-05 14:01:21,468 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x00920000.
2020-06-05 14:01:21,468 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x920000: 0x0.
2020-06-05 14:01:21,468 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-06-05 14:01:21,484 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFFCA24 (thread 2852)
2020-06-05 14:01:21,484 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0092003C.
2020-06-05 14:01:21,484 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x920044 (at 0x0092003C).
2020-06-05 14:01:21,500 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x00920000 already exists for thread 2852 (process 1588), skipping.
2020-06-05 14:01:21,500 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x00920000.
2020-06-05 14:01:21,500 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFFCB4B (thread 2852)
2020-06-05 14:01:21,546 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0092003C.
2020-06-05 14:01:21,546 [root] DEBUG: set_caller_info: Adding region at 0x00920000 to caller regions list (ntdll::LdrGetProcedureAddress).
2020-06-05 14:01:21,546 [root] DEBUG: DumpPEsInRange: Scanning range 0x920000 - 0x921000.
2020-06-05 14:01:21,562 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x920000-0x921000.
2020-06-05 14:01:21,562 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x00920000 - 0x00921000.
2020-06-05 14:01:21,562 [root] INFO: ('dump_file', 'C:\\JcblWXUU\\CAPE\\1588_2095940264111446662020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?0x00920000;?', ['1588'], 'CAPE')
2020-06-05 14:01:21,593 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JcblWXUU\CAPE\1588_2095940264111446662020 (size 0x21e)
2020-06-05 14:01:21,609 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x00920000.
2020-06-05 14:01:21,609 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:01:21,609 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:01:21,625 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:01:21,625 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:01:21,625 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x0092003C.
2020-06-05 14:01:21,625 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:01:21,640 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:01:21,640 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:01:21,656 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:01:21,656 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 2 address 0x00920000.
2020-06-05 14:01:21,671 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:01:21,671 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:01:21,671 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:01:21,671 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:01:27,718 [root] DEBUG: CreateThread: Initialising breakpoints for thread 4140.
2020-06-05 14:01:27,750 [root] DEBUG: Allocation: 0x00AE0000 - 0x00AE1000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:27,796 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:27,812 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:01:27,812 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:27,828 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:01:27,843 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:01:27,843 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:01:27,843 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:01:27,859 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:01:27,859 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:01:27,859 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:01:27,859 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01180000.
2020-06-05 14:01:27,859 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF40000.
2020-06-05 14:01:27,890 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-06-05 14:01:27,890 [root] DEBUG: DumpPEsInRange: Scanning range 0x7ef30000 - 0x7ef40000.
2020-06-05 14:01:27,890 [root] DEBUG: ScanForDisguisedPE: Exception occured scanning buffer at 0x7ef30fc1
2020-06-05 14:01:27,890 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x7EF30000 - 0x7EF40000.
2020-06-05 14:01:27,906 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:01:27,906 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:01:27,906 [root] DEBUG: ProcessTrackedRegion: failed to dump executable memory range at 0x7EF30000.
2020-06-05 14:01:27,937 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00760000.
2020-06-05 14:01:27,937 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00910000.
2020-06-05 14:01:27,937 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00920000.
2020-06-05 14:01:27,953 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x00AE0000, size: 0x1000.
2020-06-05 14:01:27,953 [root] DEBUG: AddTrackedRegion: DEBUG Warning - number of tracked regions 14.
2020-06-05 14:01:27,953 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00AE0000.
2020-06-05 14:01:27,953 [root] DEBUG: AddTrackedRegion: New region at 0x00AE0000 size 0x1000 added to tracked regions.
2020-06-05 14:01:27,968 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x00AE0000, TrackedRegion->RegionSize: 0x1000, thread 4140
2020-06-05 14:01:27,968 [root] DEBUG: ClearAllBreakpoints: Error getting thread context (thread 4540, handle 0x2fc).
2020-06-05 14:01:27,968 [root] DEBUG: ClearAllBreakpoints: Error getting thread context (thread 4540, handle 0x2fc).
2020-06-05 14:01:27,984 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 4140 type 1 at address 0x00AE0000, size 2 with Callback 0x6f53a080.
2020-06-05 14:01:27,984 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x00AE0000
2020-06-05 14:01:27,984 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 4140 type 1 at address 0x00AE003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:01:27,984 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x00AE003C
2020-06-05 14:01:27,984 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x00AE0000 (size 0x1000).
2020-06-05 14:01:28,000 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFEC1D8 (thread 4140)
2020-06-05 14:01:28,000 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x00AE0000.
2020-06-05 14:01:28,000 [root] DEBUG: BaseAddressWriteCallback: byte written to 0xae0000: 0x0.
2020-06-05 14:01:28,015 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-06-05 14:01:28,031 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EF94EDF (thread 4140)
2020-06-05 14:01:28,031 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x00AE003C.
2020-06-05 14:01:28,046 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x50000 (at 0x00AE003C).
2020-06-05 14:01:28,046 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x00AE0000 already exists for thread 4140 (process 1588), skipping.
2020-06-05 14:01:28,046 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x00AE0000.
2020-06-05 14:01:28,078 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EF99072 (thread 4140)
2020-06-05 14:01:28,093 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x00AE003C.
2020-06-05 14:01:28,109 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x50080 (at 0x00AE003C).
2020-06-05 14:01:28,125 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x00AE0000 already exists for thread 4140 (process 1588), skipping.
2020-06-05 14:01:28,140 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x00AE0000.
2020-06-05 14:01:28,140 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EF94900 (thread 4140)
2020-06-05 14:01:28,140 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x00AE003C.
2020-06-05 14:01:28,187 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x50081 (at 0x00AE003C).
2020-06-05 14:01:28,187 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x00AE0000 already exists for thread 4140 (process 1588), skipping.
2020-06-05 14:01:28,187 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x00AE0000.
2020-06-05 14:01:28,265 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EF8293A (thread 4140)
2020-06-05 14:01:31,750 [root] DEBUG: CreateThread: Initialising breakpoints for thread 3756.
2020-06-05 14:01:40,249 [root] DEBUG: DLL unloaded from 0x74DF0000.
2020-06-05 14:01:41,796 [root] DEBUG: CreateThread: Initialising breakpoints for thread 3748.
2020-06-05 14:01:41,796 [root] DEBUG: DLL unloaded from 0x76FA0000.
2020-06-05 14:01:41,796 [root] DEBUG: set_caller_info: Adding region at 0x00910000 to caller regions list (kernel32::GetSystemTimeAsFileTime).
2020-06-05 14:01:41,812 [root] DEBUG: DumpPEsInRange: Scanning range 0x910000 - 0x911000.
2020-06-05 14:01:41,812 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x910000-0x911000.
2020-06-05 14:01:41,812 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x00910000 - 0x00911000.
2020-06-05 14:01:41,812 [root] INFO: ('dump_file', 'C:\\JcblWXUU\\CAPE\\1588_229854808411946662020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?0x00910000;?', ['1588'], 'CAPE')
2020-06-05 14:01:41,828 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JcblWXUU\CAPE\1588_229854808411946662020 (size 0x235)
2020-06-05 14:01:41,828 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x00910000.
2020-06-05 14:01:41,828 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x910000 - 0x911000.
2020-06-05 14:01:44,812 [root] DEBUG: DLL loaded at 0x000007FEF6570000: C:\Windows\system32\VSSAPI (0x1b0000 bytes).
2020-06-05 14:01:44,859 [root] DEBUG: DLL loaded at 0x000007FEFAA30000: C:\Windows\system32\ATL (0x19000 bytes).
2020-06-05 14:01:44,859 [root] DEBUG: DLL loaded at 0x000007FEF64E0000: C:\Windows\system32\VssTrace (0x17000 bytes).
2020-06-05 14:01:44,921 [root] DEBUG: DLL loaded at 0x000007FEFA150000: C:\Windows\system32\samcli (0x14000 bytes).
2020-06-05 14:01:44,937 [root] DEBUG: DLL loaded at 0x000007FEFB1C0000: C:\Windows\system32\SAMLIB (0x1d000 bytes).
2020-06-05 14:01:45,578 [root] DEBUG: DLL unloaded from 0x000007FEF64E0000.
2020-06-05 14:01:51,843 [root] DEBUG: CreateThread: Initialising breakpoints for thread 3460.
2020-06-05 14:01:59,765 [root] DEBUG: Allocation: 0x00AE1000 - 0x00AE2000, size: 0x1000, protection: 0x40.
2020-06-05 14:01:59,781 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:01:59,781 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:01:59,828 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:59,828 [root] DEBUG: DumpPEsInRange: Scanning range 0x7ef30000 - 0x7ef40000.
2020-06-05 14:01:59,859 [root] DEBUG: ScanForDisguisedPE: Exception occured scanning buffer at 0x7ef30fc1
2020-06-05 14:01:59,875 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:01:59,875 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:01:59,875 [root] DEBUG: ProcessTrackedRegion: failed to dump executable memory range at 0x7EF30000.
2020-06-05 14:01:59,875 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00760000.
2020-06-05 14:01:59,875 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00910000.
2020-06-05 14:01:59,890 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00920000.
2020-06-05 14:01:59,906 [root] DEBUG: Allocation: 0x00921000 - 0x00924000, size: 0x3000, protection: 0x40.
2020-06-05 14:01:59,906 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:01:59,906 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:01:59,906 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:01:59,953 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:01:59,953 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:02:00,000 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:02:00,000 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:02:00,000 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:02:00,000 [root] DEBUG: ScanForDisguisedPE: Exception occured scanning buffer at 0x7ef30fc1
2020-06-05 14:02:00,000 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x7EF30000 - 0x7EF40000.
2020-06-05 14:02:00,015 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:02:00,015 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:02:00,015 [root] DEBUG: ProcessTrackedRegion: failed to dump executable memory range at 0x7EF30000.
2020-06-05 14:02:00,015 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00760000.
2020-06-05 14:02:00,015 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00910000.
2020-06-05 14:02:00,015 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00920000.
2020-06-05 14:02:00,015 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00AE0000.
2020-06-05 14:02:00,046 [root] DEBUG: DLL loaded at 0x731F0000: C:\Windows\system32\shfolder (0x5000 bytes).
2020-06-05 14:02:00,078 [root] DEBUG: Allocation: 0x003CC000 - 0x003CD000, size: 0x1000, protection: 0x40.
2020-06-05 14:02:00,078 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:02:00,078 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:02:00,078 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:02:00,078 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:02:00,093 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:02:00,093 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:02:00,093 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:02:00,093 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:02:00,093 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:02:00,093 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:02:00,093 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:02:00,109 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x003C0000, size: 0x1000.
2020-06-05 14:02:00,125 [root] DEBUG: Allocation: 0x00924000 - 0x00925000, size: 0x1000, protection: 0x40.
2020-06-05 14:02:00,125 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:02:00,171 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:02:00,171 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:02:00,171 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:02:00,171 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:02:00,171 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:02:00,187 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:02:00,187 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:02:00,218 [root] DEBUG: ProcessTrackedRegion: failed to dump executable memory range at 0x7EF30000.
2020-06-05 14:02:00,218 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00760000.
2020-06-05 14:02:00,218 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00910000.
2020-06-05 14:02:00,218 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00920000.
2020-06-05 14:02:00,218 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00AE0000.
2020-06-05 14:02:00,265 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00920000, size: 0x1000.
2020-06-05 14:02:00,359 [root] DEBUG: Allocation: 0x00925000 - 0x00926000, size: 0x1000, protection: 0x40.
2020-06-05 14:02:00,390 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:02:00,390 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:02:00,390 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:02:00,390 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:02:00,390 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:02:00,390 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:02:00,390 [root] DEBUG: ProcessTrackedRegion: failed to dump executable memory range at 0x7EF30000.
2020-06-05 14:02:00,406 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00760000.
2020-06-05 14:02:00,406 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00910000.
2020-06-05 14:02:00,406 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00920000.
2020-06-05 14:02:00,421 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00AE0000.
2020-06-05 14:02:00,421 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00920000, size: 0x1000.
2020-06-05 14:02:00,421 [root] DEBUG: Allocation: 0x00AE2000 - 0x00AE3000, size: 0x1000, protection: 0x40.
2020-06-05 14:02:00,421 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:02:00,421 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:02:00,421 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:02:00,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:02:00,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:02:00,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:02:00,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:02:00,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:02:00,437 [root] DEBUG: ScanForDisguisedPE: Exception occured scanning buffer at 0x7ef30fc1
2020-06-05 14:02:00,437 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x7EF30000 - 0x7EF40000.
2020-06-05 14:02:00,437 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:02:00,437 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:02:00,437 [root] DEBUG: ProcessTrackedRegion: failed to dump executable memory range at 0x7EF30000.
2020-06-05 14:02:00,453 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00AE0000, size: 0x1000.
2020-06-05 14:02:00,468 [root] DEBUG: Allocation: 0x00926000 - 0x00927000, size: 0x1000, protection: 0x40.
2020-06-05 14:02:00,468 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:02:00,468 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:02:00,468 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:02:00,468 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:02:00,468 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:02:00,484 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:02:00,484 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:02:00,484 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:02:00,484 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:02:00,484 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:02:00,531 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:02:00,531 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:02:00,531 [root] DEBUG: ProcessTrackedRegion: failed to dump executable memory range at 0x7EF30000.
2020-06-05 14:02:00,531 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00760000.
2020-06-05 14:02:00,531 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00910000.
2020-06-05 14:02:00,546 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00920000.
2020-06-05 14:02:00,562 [root] DEBUG: Allocation: 0x00927000 - 0x00928000, size: 0x1000, protection: 0x40.
2020-06-05 14:02:00,562 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:02:00,593 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:02:00,593 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:02:00,593 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:02:00,593 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01180000.
2020-06-05 14:02:00,593 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF40000.
2020-06-05 14:02:00,593 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-06-05 14:02:00,593 [root] DEBUG: DumpPEsInRange: Scanning range 0x7ef30000 - 0x7ef40000.
2020-06-05 14:02:00,593 [root] DEBUG: ScanForDisguisedPE: Exception occured scanning buffer at 0x7ef30fc1
2020-06-05 14:02:00,593 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:02:00,609 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:02:00,609 [root] DEBUG: ProcessTrackedRegion: failed to dump executable memory range at 0x7EF30000.
2020-06-05 14:02:00,609 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00760000.
2020-06-05 14:02:00,609 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00910000.
2020-06-05 14:02:00,609 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00920000.
2020-06-05 14:02:00,609 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00AE0000.
2020-06-05 14:02:00,609 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00920000, size: 0x1000.
2020-06-05 14:02:00,625 [root] DEBUG: Allocation: 0x00393000 - 0x00394000, size: 0x1000, protection: 0x40.
2020-06-05 14:02:00,640 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:02:00,640 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:02:00,640 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:02:00,640 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:02:00,640 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:02:00,640 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:02:00,640 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:02:00,640 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:02:00,656 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:02:00,656 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:02:00,656 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01180000.
2020-06-05 14:02:00,656 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF40000.
2020-06-05 14:02:00,656 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-06-05 14:02:00,656 [root] DEBUG: DumpPEsInRange: Scanning range 0x7ef30000 - 0x7ef40000.
2020-06-05 14:02:00,656 [root] DEBUG: ScanForDisguisedPE: Exception occured scanning buffer at 0x7ef30fc1
2020-06-05 14:02:00,656 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x7EF30000 - 0x7EF40000.
2020-06-05 14:02:00,656 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:02:00,671 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:02:00,671 [root] DEBUG: ProcessTrackedRegion: failed to dump executable memory range at 0x7EF30000.
2020-06-05 14:02:00,687 [root] DEBUG: Allocation: 0x003C3000 - 0x003C4000, size: 0x1000, protection: 0x40.
2020-06-05 14:02:00,687 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:02:00,718 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:02:00,718 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:02:00,718 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:02:00,765 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:02:00,765 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:02:00,765 [root] DEBUG: ScanForDisguisedPE: Exception occured scanning buffer at 0x7ef30fc1
2020-06-05 14:02:00,765 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x7EF30000 - 0x7EF40000.
2020-06-05 14:02:00,765 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:02:00,765 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:02:00,765 [root] DEBUG: ProcessTrackedRegion: failed to dump executable memory range at 0x7EF30000.
2020-06-05 14:02:00,765 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00760000.
2020-06-05 14:02:00,781 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00910000.
2020-06-05 14:02:00,781 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00920000.
2020-06-05 14:02:00,781 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00AE0000.
2020-06-05 14:02:00,781 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x003C0000, size: 0x1000.
2020-06-05 14:02:00,796 [root] DEBUG: Allocation: 0x00928000 - 0x0092B000, size: 0x3000, protection: 0x40.
2020-06-05 14:02:00,828 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:02:00,828 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:02:00,828 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:02:00,828 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:02:00,828 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:02:00,828 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:02:00,828 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:02:00,828 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:02:00,843 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:02:00,843 [root] DEBUG: ProcessTrackedRegion: failed to dump executable memory range at 0x7EF30000.
2020-06-05 14:02:00,890 [root] DEBUG: Allocation: 0x039F0000 - 0x039F1000, size: 0x1000, protection: 0x40.
2020-06-05 14:02:00,921 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:02:00,921 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:02:00,921 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:02:00,968 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:02:00,968 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:02:00,968 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:02:00,968 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:02:00,968 [root] INFO: ('dump_file', 'C:\\JcblWXUU\\CAPE\\1588_79074340002205562020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\R070161.exe;?0x00AE0000;?', ['1588'], 'CAPE')
2020-06-05 14:02:00,984 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JcblWXUU\CAPE\1588_79074340002205562020 (size 0xffe)
2020-06-05 14:02:00,984 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0xae0000 - 0xae1000.
2020-06-05 14:02:01,000 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x00AE0000.
2020-06-05 14:02:01,000 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:01,000 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:01,000 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:01,000 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:01,000 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:01,000 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:01,000 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:01,000 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:01,015 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x00AE003C.
2020-06-05 14:02:01,015 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:01,015 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:01,015 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:01,015 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:01,015 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:01,046 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:01,046 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:01,046 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:01,046 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 2 address 0x00AE0000.
2020-06-05 14:02:01,046 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:01,046 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:01,046 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:01,046 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:01,046 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:01,046 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:01,093 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:01,093 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:01,093 [root] DEBUG: ClearAllBreakpoints: Error getting thread context (thread 4240, handle 0x264).
2020-06-05 14:02:01,093 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 2852 type 1 at address 0x039F0000, size 2 with Callback 0x6f53a080.
2020-06-05 14:02:01,093 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x039F0000
2020-06-05 14:02:01,093 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 2852 type 1 at address 0x039F003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:02:01,109 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x039F003C
2020-06-05 14:02:01,109 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x039F0000 (size 0x1000).
2020-06-05 14:02:01,109 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFEC1D8 (thread 2852)
2020-06-05 14:02:01,109 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x039F0000.
2020-06-05 14:02:01,140 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x39f0000: 0x0.
2020-06-05 14:02:01,140 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-06-05 14:02:01,140 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFFCA24 (thread 2852)
2020-06-05 14:02:01,140 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x039F003C.
2020-06-05 14:02:01,140 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x39f0044 (at 0x039F003C).
2020-06-05 14:02:01,140 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x039F0000 already exists for thread 2852 (process 1588), skipping.
2020-06-05 14:02:01,140 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x039F0000.
2020-06-05 14:02:01,140 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFFCB4B (thread 2852)
2020-06-05 14:02:01,187 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x039F003C.
2020-06-05 14:02:01,187 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x39f0050 (at 0x039F003C).
2020-06-05 14:02:01,187 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x039F0000 already exists for thread 2852 (process 1588), skipping.
2020-06-05 14:02:01,187 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x039F0000.
2020-06-05 14:02:01,187 [root] DEBUG: Allocation: 0x039F1000 - 0x039F7000, size: 0x6000, protection: 0x40.
2020-06-05 14:02:01,187 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:02:01,187 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:02:01,187 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:02:01,187 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:02:01,187 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:02:01,187 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:02:01,187 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:02:01,203 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:02:01,203 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:02:01,234 [root] DEBUG: ProcessTrackedRegion: failed to dump executable memory range at 0x7EF30000.
2020-06-05 14:02:01,234 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00760000.
2020-06-05 14:02:01,234 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00910000.
2020-06-05 14:02:01,234 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00920000.
2020-06-05 14:02:01,249 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:01,249 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:01,281 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:01,281 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:01,281 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:01,281 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:01,281 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:01,281 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:01,281 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x039F003C.
2020-06-05 14:02:01,281 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:01,296 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:01,296 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:01,296 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:01,296 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:01,296 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:01,296 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:01,296 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 2 address 0x039F0000.
2020-06-05 14:02:01,375 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:01,375 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:01,375 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:01,375 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:01,375 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:01,375 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:01,390 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:01,421 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:01,437 [root] DEBUG: Allocation: 0x039F7000 - 0x039F8000, size: 0x1000, protection: 0x40.
2020-06-05 14:02:01,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:02:01,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:02:01,437 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:02:01,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:02:01,437 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:02:01,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:02:01,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:02:01,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:02:01,453 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:02:01,484 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:02:01,484 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01180000.
2020-06-05 14:02:01,484 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF40000.
2020-06-05 14:02:01,484 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-06-05 14:02:01,484 [root] DEBUG: DumpPEsInRange: Scanning range 0x7ef30000 - 0x7ef40000.
2020-06-05 14:02:01,531 [root] DEBUG: ScanForDisguisedPE: Exception occured scanning buffer at 0x7ef30fc1
2020-06-05 14:02:01,531 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x7EF30000 - 0x7EF40000.
2020-06-05 14:02:01,562 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:02:01,562 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:02:01,562 [root] DEBUG: ProcessTrackedRegion: failed to dump executable memory range at 0x7EF30000.
2020-06-05 14:02:01,562 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00760000.
2020-06-05 14:02:01,562 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00910000.
2020-06-05 14:02:01,578 [root] DEBUG: Allocation: 0x039F8000 - 0x039FC000, size: 0x4000, protection: 0x40.
2020-06-05 14:02:01,578 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:02:01,593 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:02:01,625 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:02:01,625 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:02:01,671 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:02:01,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:02:01,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:02:01,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:02:01,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:02:01,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:02:01,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01180000.
2020-06-05 14:02:01,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF40000.
2020-06-05 14:02:01,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-06-05 14:02:01,671 [root] DEBUG: DumpPEsInRange: Scanning range 0x7ef30000 - 0x7ef40000.
2020-06-05 14:02:01,671 [root] DEBUG: ScanForDisguisedPE: Exception occured scanning buffer at 0x7ef30fc1
2020-06-05 14:02:01,687 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x7EF30000 - 0x7EF40000.
2020-06-05 14:02:01,687 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:02:01,687 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:02:01,734 [root] DEBUG: ProcessTrackedRegion: failed to dump executable memory range at 0x7EF30000.
2020-06-05 14:02:01,734 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00760000.
2020-06-05 14:02:01,734 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00910000.
2020-06-05 14:02:01,734 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00920000.
2020-06-05 14:02:01,734 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00AE0000.
2020-06-05 14:02:01,734 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x039F0000.
2020-06-05 14:02:01,734 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x039F0000, size: 0x1000.
2020-06-05 14:02:01,750 [root] DEBUG: Allocation: 0x039FC000 - 0x039FD000, size: 0x1000, protection: 0x40.
2020-06-05 14:02:01,781 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:02:01,781 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:02:01,781 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:02:01,781 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:02:01,781 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:02:01,781 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:02:01,781 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:02:01,781 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:02:01,828 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:02:01,828 [root] DEBUG: ProcessTrackedRegion: failed to dump executable memory range at 0x7EF30000.
2020-06-05 14:02:01,828 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00760000.
2020-06-05 14:02:01,828 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00910000.
2020-06-05 14:02:01,828 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00920000.
2020-06-05 14:02:01,843 [root] DEBUG: Allocation: 0x039FD000 - 0x039FE000, size: 0x1000, protection: 0x40.
2020-06-05 14:02:01,843 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:02:01,843 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:02:01,859 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:02:01,859 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:02:01,875 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:02:01,875 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:02:01,921 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:02:01,921 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:02:01,921 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:02:01,921 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:02:01,921 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01180000.
2020-06-05 14:02:01,921 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF40000.
2020-06-05 14:02:01,921 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-06-05 14:02:01,921 [root] DEBUG: DumpPEsInRange: Scanning range 0x7ef30000 - 0x7ef40000.
2020-06-05 14:02:01,921 [root] DEBUG: ScanForDisguisedPE: Exception occured scanning buffer at 0x7ef30fc1
2020-06-05 14:02:01,921 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x7EF30000 - 0x7EF40000.
2020-06-05 14:02:01,968 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:02:01,968 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:02:01,968 [root] DEBUG: ProcessTrackedRegion: failed to dump executable memory range at 0x7EF30000.
2020-06-05 14:02:01,968 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00760000.
2020-06-05 14:02:01,968 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00910000.
2020-06-05 14:02:01,968 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00920000.
2020-06-05 14:02:02,015 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00AE0000.
2020-06-05 14:02:02,015 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x039F0000.
2020-06-05 14:02:02,062 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x039F0000, size: 0x1000.
2020-06-05 14:02:02,156 [root] DEBUG: DLL loaded at 0x70130000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\51fb28e8a54a8d8f6021415d47477ab4\System.Security.ni (0xb3000 bytes).
2020-06-05 14:02:02,156 [root] DEBUG: Allocation: 0x00AE3000 - 0x00AE4000, size: 0x1000, protection: 0x40.
2020-06-05 14:02:02,156 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:02:02,203 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:02:02,203 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:02:02,203 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:02:02,249 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:02:02,296 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:02:02,296 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:02:02,296 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:02:02,296 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:02:02,296 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:02:02,296 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01180000.
2020-06-05 14:02:02,296 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF40000.
2020-06-05 14:02:02,296 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-06-05 14:02:02,296 [root] DEBUG: DumpPEsInRange: Scanning range 0x7ef30000 - 0x7ef40000.
2020-06-05 14:02:02,296 [root] DEBUG: ScanForDisguisedPE: Exception occured scanning buffer at 0x7ef30fc1
2020-06-05 14:02:02,296 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x7EF30000 - 0x7EF40000.
2020-06-05 14:02:02,312 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:02:02,312 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:02:02,312 [root] DEBUG: ProcessTrackedRegion: failed to dump executable memory range at 0x7EF30000.
2020-06-05 14:02:02,312 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00760000.
2020-06-05 14:02:02,312 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00910000.
2020-06-05 14:02:02,359 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00920000.
2020-06-05 14:02:02,359 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00AE0000.
2020-06-05 14:02:02,359 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x039F0000.
2020-06-05 14:02:02,359 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00AE0000, size: 0x1000.
2020-06-05 14:02:02,390 [root] DEBUG: Allocation: 0x00BAF000 - 0x00BB0000, size: 0x1000, protection: 0x40.
2020-06-05 14:02:02,406 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:02:02,421 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:02:02,421 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:02:02,421 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:02:02,421 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:02:02,421 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:02:02,421 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:02:02,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:02:02,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:02:02,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:02:02,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01180000.
2020-06-05 14:02:02,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF40000.
2020-06-05 14:02:02,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-06-05 14:02:02,437 [root] DEBUG: DumpPEsInRange: Scanning range 0x7ef30000 - 0x7ef40000.
2020-06-05 14:02:02,437 [root] DEBUG: ScanForDisguisedPE: Exception occured scanning buffer at 0x7ef30fc1
2020-06-05 14:02:02,437 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x7EF30000 - 0x7EF40000.
2020-06-05 14:02:02,437 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:02:02,453 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:02:02,453 [root] DEBUG: ProcessTrackedRegion: failed to dump executable memory range at 0x7EF30000.
2020-06-05 14:02:02,453 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00760000.
2020-06-05 14:02:02,453 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00910000.
2020-06-05 14:02:02,453 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00920000.
2020-06-05 14:02:02,453 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00AE0000.
2020-06-05 14:02:02,453 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x039F0000.
2020-06-05 14:02:02,453 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x00BAF000, size: 0x1000.
2020-06-05 14:02:02,453 [root] DEBUG: AddTrackedRegion: DEBUG Warning - number of tracked regions 16.
2020-06-05 14:02:02,453 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00BAF000.
2020-06-05 14:02:02,500 [root] DEBUG: AddTrackedRegion: New region at 0x00BA0000 size 0x1000 added to tracked regions.
2020-06-05 14:02:02,500 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x00BA0000, TrackedRegion->RegionSize: 0x1000, thread 2852
2020-06-05 14:02:02,500 [root] DEBUG: ActivateBreakpoints: Switching breakpoints from region 0x039F0000 to 0x00BA0000.
2020-06-05 14:02:02,500 [root] DEBUG: ClearAllBreakpoints: Error getting thread context (thread 4240, handle 0x264).
2020-06-05 14:02:02,500 [root] DEBUG: ClearAllBreakpoints: Error getting thread context (thread 4240, handle 0x264).
2020-06-05 14:02:02,500 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 2852 type 1 at address 0x00BAF000, size 2 with Callback 0x6f53a080.
2020-06-05 14:02:02,546 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x00BAF000
2020-06-05 14:02:02,546 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 2852 type 1 at address 0x00BA003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:02:02,593 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x00BA003C
2020-06-05 14:02:02,593 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:02:02,593 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:02:02,593 [root] DEBUG: ProcessTrackedRegion: failed to dump executable memory range at 0x7EF30000.
2020-06-05 14:02:02,593 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00760000.
2020-06-05 14:02:02,593 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00910000.
2020-06-05 14:02:02,593 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00920000.
2020-06-05 14:02:02,593 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00AE0000.
2020-06-05 14:02:02,609 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x039F0000.
2020-06-05 14:02:02,609 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00BA0000.
2020-06-05 14:02:02,609 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00BA0000, size: 0x1000.
2020-06-05 14:02:02,609 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6F1BFC94 (thread 2852)
2020-06-05 14:02:02,609 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x00BA003C.
2020-06-05 14:02:02,609 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header zero.
2020-06-05 14:02:02,609 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFFCB48 (thread 2852)
2020-06-05 14:02:02,609 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x00BA003C.
2020-06-05 14:02:02,609 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header zero.
2020-06-05 14:02:02,625 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EF8CA3D (thread 2852)
2020-06-05 14:02:02,656 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x00BAF000.
2020-06-05 14:02:02,656 [root] DEBUG: BaseAddressWriteCallback: byte written to 0xbaf000: 0x0.
2020-06-05 14:02:02,656 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-06-05 14:02:02,671 [root] DEBUG: DLL loaded at 0x761F0000: C:\Windows\syswow64\crypt32 (0x122000 bytes).
2020-06-05 14:02:02,671 [root] DEBUG: DLL loaded at 0x76AA0000: C:\Windows\syswow64\MSASN1 (0xc000 bytes).
2020-06-05 14:02:02,671 [root] DEBUG: Allocation: 0x039FE000 - 0x039FF000, size: 0x1000, protection: 0x40.
2020-06-05 14:02:02,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:02:02,687 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:02:02,687 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:02:02,687 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:02:02,687 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:02:02,703 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:02:02,750 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:02:02,750 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:02:02,750 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:02:02,750 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:02:02,750 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01180000.
2020-06-05 14:02:02,750 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF40000.
2020-06-05 14:02:02,796 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-06-05 14:02:02,796 [root] DEBUG: DumpPEsInRange: Scanning range 0x7ef30000 - 0x7ef40000.
2020-06-05 14:02:02,796 [root] DEBUG: ScanForDisguisedPE: Exception occured scanning buffer at 0x7ef30fc1
2020-06-05 14:02:02,796 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x7EF30000 - 0x7EF40000.
2020-06-05 14:02:02,796 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:02:02,796 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:02:02,843 [root] DEBUG: ProcessTrackedRegion: failed to dump executable memory range at 0x7EF30000.
2020-06-05 14:02:02,843 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00760000.
2020-06-05 14:02:02,890 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00910000.
2020-06-05 14:02:02,890 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00920000.
2020-06-05 14:02:02,890 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00AE0000.
2020-06-05 14:02:02,890 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x039F0000.
2020-06-05 14:02:02,890 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00BA0000.
2020-06-05 14:02:02,890 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x039F0000, size: 0x1000.
2020-06-05 14:02:02,906 [root] DEBUG: Allocation: 0x039FF000 - 0x03A00000, size: 0x1000, protection: 0x40.
2020-06-05 14:02:02,906 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:02:02,906 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:02:02,906 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:02:02,937 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:02:02,937 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:02:02,937 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:02:02,937 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:02:02,937 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:02:02,937 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:02:02,984 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:02:02,984 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01180000.
2020-06-05 14:02:02,984 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF40000.
2020-06-05 14:02:02,984 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-06-05 14:02:02,984 [root] DEBUG: DumpPEsInRange: Scanning range 0x7ef30000 - 0x7ef40000.
2020-06-05 14:02:02,984 [root] DEBUG: ScanForDisguisedPE: Exception occured scanning buffer at 0x7ef30fc1
2020-06-05 14:02:02,984 [root] DEBUG: ClearAllBreakpoints: Error getting thread context (thread 4240, handle 0x264).
2020-06-05 14:02:03,000 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 2852 type 1 at address 0x00930000, size 2 with Callback 0x6f53a080.
2020-06-05 14:02:03,000 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x00930000
2020-06-05 14:02:03,000 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 2852 type 1 at address 0x0093003C, size 4 with Callback 0x6f539cc0.
2020-06-05 14:02:03,046 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x0093003C
2020-06-05 14:02:03,046 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x00930000 (size 0x1000).
2020-06-05 14:02:03,046 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFEC1D8 (thread 2852)
2020-06-05 14:02:03,046 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x00930000.
2020-06-05 14:02:03,046 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x930000: 0x0.
2020-06-05 14:02:03,046 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-06-05 14:02:03,046 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x6EFFCA24 (thread 2852)
2020-06-05 14:02:03,046 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0093003C.
2020-06-05 14:02:03,093 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x930044 (at 0x0093003C).
2020-06-05 14:02:03,093 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x00930000 already exists for thread 2852 (process 1588), skipping.
2020-06-05 14:02:03,093 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:03,093 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:03,093 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:03,093 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:03,093 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:03,109 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:03,109 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 2 address 0x00930000.
2020-06-05 14:02:03,140 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:03,140 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:03,140 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:03,140 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:03,140 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:03,187 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:03,187 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-06-05 14:02:03,187 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-06-05 14:02:03,218 [root] DEBUG: DLL loaded at 0x72A40000: C:\Windows\Microsoft.NET\Framework\v2.0.50727\culture (0x8000 bytes).
2020-06-05 14:02:03,218 [root] DEBUG: DLL unloaded from 0x72A40000.
2020-06-05 14:02:03,234 [root] DEBUG: Allocation: 0x00931000 - 0x00932000, size: 0x1000, protection: 0x40.
2020-06-05 14:02:03,234 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:02:03,234 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:02:03,234 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:02:03,234 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:02:03,249 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:02:03,249 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:02:03,249 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF40000.
2020-06-05 14:02:03,249 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-06-05 14:02:03,249 [root] DEBUG: DumpPEsInRange: Scanning range 0x7ef30000 - 0x7ef40000.
2020-06-05 14:02:03,249 [root] DEBUG: ScanForDisguisedPE: Exception occured scanning buffer at 0x7ef30fc1
2020-06-05 14:02:03,249 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x7EF30000 - 0x7EF40000.
2020-06-05 14:02:03,249 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:02:03,265 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:02:03,265 [root] DEBUG: ProcessTrackedRegion: failed to dump executable memory range at 0x7EF30000.
2020-06-05 14:02:03,265 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00760000.
2020-06-05 14:02:03,265 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00910000.
2020-06-05 14:02:03,265 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00920000.
2020-06-05 14:02:03,265 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00AE0000.
2020-06-05 14:02:03,265 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x039F0000.
2020-06-05 14:02:03,265 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00BA0000.
2020-06-05 14:02:03,265 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00930000.
2020-06-05 14:02:03,265 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00930000, size: 0x1000.
2020-06-05 14:02:03,343 [root] DEBUG: Allocation: 0x00AE4000 - 0x00AE5000, size: 0x1000, protection: 0x40.
2020-06-05 14:02:03,343 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:02:03,343 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:02:03,343 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:02:03,343 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00390000.
2020-06-05 14:02:03,343 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x390000
2020-06-05 14:02:03,343 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003A0000.
2020-06-05 14:02:03,343 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-06-05 14:02:03,343 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x03730000.
2020-06-05 14:02:03,359 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003B0000.
2020-06-05 14:02:03,359 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003C0000.
2020-06-05 14:02:03,359 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01180000.
2020-06-05 14:02:03,359 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF40000.
2020-06-05 14:02:03,359 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-06-05 14:02:03,359 [root] DEBUG: DumpPEsInRange: Scanning range 0x7ef30000 - 0x7ef40000.
2020-06-05 14:02:03,359 [root] DEBUG: ScanForDisguisedPE: Exception occured scanning buffer at 0x7ef30fc1
2020-06-05 14:02:03,359 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x7EF30000 - 0x7EF40000.
2020-06-05 14:02:03,390 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7ef3ffff
2020-06-05 14:02:03,390 [root] DEBUG: DumpMemory: Nothing to dump at 0x7EF30000!
2020-06-05 14:02:03,406 [root] DEBUG: ProcessTrackedRegion: failed to dump executable memory range at 0x7EF30000.
2020-06-05 14:02:03,406 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00760000.
2020-06-05 14:02:03,406 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00910000.
2020-06-05 14:02:03,406 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00920000.
2020-06-05 14:02:03,406 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00AE0000.
2020-06-05 14:02:03,468 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x039F0000.
2020-06-05 14:02:03,515 [root] DEBUG: DLL loaded at 0x72A40000: C:\Windows\system32\vaultcli (0xc000 bytes).
2020-06-05 14:02:03,515 [root] DEBUG: DLL unloaded from 0x76560000.
2020-06-05 14:02:03,687 [root] INFO: Announced starting service "b'VaultSvc'"
2020-06-05 14:02:03,687 [lib.api.process] INFO: Monitor config for process 472: C:\tmplodztmkc\dll\472.ini
2020-06-05 14:02:03,687 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-06-05 14:02:03,687 [lib.api.process] INFO: Option 'unpacker' with value '1' sent to monitor
2020-06-05 14:02:03,687 [lib.api.process] INFO: Option 'injection' with value '0' sent to monitor
2020-06-05 14:02:03,687 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmplodztmkc\dll\FyTPkO.dll, loader C:\tmplodztmkc\bin\XmFrASFL.exe
2020-06-05 14:02:03,734 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TEexVLcl.
2020-06-05 14:02:03,781 [root] DEBUG: Loader: Injecting process 472 (thread 0) with C:\tmplodztmkc\dll\FyTPkO.dll.
2020-06-05 14:02:03,781 [root] DEBUG: Error 0 (0x0) - GetProcessInitialThreadId: Remote PEB 0x000007FFFFFD5000 Local PEB 0x000007FFFFFDD000 Local TEB 0x000007FFFFFDF000: The operation completed successfully.
2020-06-05 14:02:03,781 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 836, handle 0xa8
2020-06-05 14:02:03,781 [root] DEBUG: Process image base: 0x00000000FF540000
2020-06-05 14:02:03,781 [root] DEBUG: InjectDllViaIAT: Not a new process, aborting IAT patch
2020-06-05 14:02:03,781 [root] DEBUG: InjectDll: IAT patching failed, falling back to thread injection.
2020-06-05 14:02:03,796 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-05 14:02:03,796 [root] DEBUG: Process dumps disabled.
2020-06-05 14:02:03,796 [root] DEBUG: Auto-unpacking of payloads enabled.
2020-06-05 14:02:03,796 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-05 14:02:03,796 [root] INFO: Disabling sleep skipping.
2020-06-05 14:02:03,796 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 472 at 0x0000000070390000, image base 0x00000000FF540000, stack from 0x0000000001736000-0x0000000001740000
2020-06-05 14:02:03,796 [root] DEBUG: Commandline: C:\Windows\sysnative\services.exe.
2020-06-05 14:02:03,843 [root] WARNING: b'Unable to place hook on LockResource'
2020-06-05 14:02:03,843 [root] WARNING: b'Unable to hook LockResource'
2020-06-05 14:02:03,843 [root] DEBUG: UnpackerInit: Debugger initialised.
2020-06-05 14:02:03,843 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00000000FF540000.
2020-06-05 14:02:03,890 [root] DEBUG: AddTrackedRegion: New region at 0x00000000FF540000 size 0x1000 added to tracked regions: EntryPoint 0x1331c, Entropy 6.074739e+00
2020-06-05 14:02:03,890 [root] DEBUG: UnpackerInit: Adding main image base to tracked regions.
2020-06-05 14:02:03,937 [root] INFO: loaded: b'472'
2020-06-05 14:02:03,937 [root] INFO: Loaded monitor into process with pid 472
2020-06-05 14:02:03,937 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-05 14:02:03,937 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-05 14:02:03,937 [root] DEBUG: Successfully injected DLL C:\tmplodztmkc\dll\FyTPkO.dll.
2020-06-05 14:02:04,984 [root] INFO: Announced 64-bit process name: lsass.exe pid: 3892
2020-06-05 14:02:04,984 [lib.api.process] INFO: Monitor config for process 3892: C:\tmplodztmkc\dll\3892.ini
2020-06-05 14:02:04,984 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-06-05 14:02:04,984 [lib.api.process] INFO: Option 'unpacker' with value '1' sent to monitor
2020-06-05 14:02:04,984 [lib.api.process] INFO: Option 'injection' with value '0' sent to monitor
2020-06-05 14:02:04,984 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmplodztmkc\dll\FyTPkO.dll, loader C:\tmplodztmkc\bin\XmFrASFL.exe
2020-06-05 14:02:05,031 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TEexVLcl.
2020-06-05 14:02:05,031 [root] DEBUG: Loader: Injecting process 3892 (thread 1508) with C:\tmplodztmkc\dll\FyTPkO.dll.
2020-06-05 14:02:05,031 [root] DEBUG: Process image base: 0x00000000FFA50000
2020-06-05 14:02:05,031 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmplodztmkc\dll\FyTPkO.dll.
2020-06-05 14:02:05,031 [root] DEBUG: InjectDllViaIAT: Failed to allocate region in target process for new import table.
2020-06-05 14:02:05,031 [root] DEBUG: InjectDll: IAT patching failed, falling back to thread injection.
2020-06-05 14:02:05,046 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-05 14:02:05,046 [root] DEBUG: Process dumps disabled.
2020-06-05 14:02:05,046 [root] DEBUG: Auto-unpacking of payloads enabled.
2020-06-05 14:02:05,062 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-05 14:02:05,062 [root] INFO: Disabling sleep skipping.
2020-06-05 14:02:05,062 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 3892 at 0x0000000070390000, image base 0x00000000FFA50000, stack from 0x00000000002D4000-0x00000000002E0000
2020-06-05 14:02:05,062 [root] DEBUG: Commandline: C:\Windows\sysnative\lsass.exe.
2020-06-05 14:02:05,093 [root] WARNING: b'Unable to place hook on LockResource'
2020-06-05 14:02:05,093 [root] WARNING: b'Unable to hook LockResource'
2020-06-05 14:02:05,093 [root] DEBUG: UnpackerInit: Debugger initialised.
2020-06-05 14:02:05,093 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00000000FFA50000.
2020-06-05 14:02:05,109 [root] DEBUG: AddTrackedRegion: New region at 0x00000000FFA50000 size 0x1000 added to tracked regions: EntryPoint 0x1850, Entropy 3.569271e+00
2020-06-05 14:02:05,109 [root] DEBUG: UnpackerInit: Adding main image base to tracked regions.
2020-06-05 14:02:05,109 [root] INFO: loaded: b'3892'
2020-06-05 14:02:05,109 [root] INFO: Loaded monitor into process with pid 3892
2020-06-05 14:02:05,109 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-05 14:02:05,109 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-05 14:02:05,109 [root] DEBUG: Successfully injected DLL C:\tmplodztmkc\dll\FyTPkO.dll.
2020-06-05 14:02:14,781 [root] DEBUG: DLL unloaded from 0x000007FEFD7A0000.
2020-06-05 14:02:35,171 [root] WARNING: Unable to open termination event for pid 3892.
2020-06-05 14:02:35,281 [root] DEBUG: Allocation: 0x00934000 - 0x00935000, size: 0x1000, protection: 0x40.
2020-06-05 14:02:41,687 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:02:41,765 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:02:44,984 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:03:57,031 [root] INFO: Analysis timeout hit, terminating analysis.
2020-06-05 14:03:57,031 [lib.api.process] ERROR: Failed to open terminate event for pid 1524
2020-06-05 14:03:57,031 [root] INFO: Terminate event set for process 1524.
2020-06-05 14:03:57,031 [lib.api.process] INFO: Terminate event set for process 1588
2020-06-05 14:03:57,031 [root] DEBUG: Terminate Event: Processing tracked regions before shutdown (process 1588).
2020-06-05 14:04:01,796 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:04:01,812 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:04:01,890 [root] DEBUG: ProcessImageBase: EP 0x73247CEF image base 0x00400000 size 0x0 entropy 6.251166e+00.
2020-06-05 14:04:01,953 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2588.
2020-06-05 14:04:01,953 [lib.api.process] INFO: Termination confirmed for process 1588
2020-06-05 14:04:01,953 [root] INFO: Terminate event set for process 1588.
2020-06-05 14:04:01,953 [lib.api.process] INFO: Terminate event set for process 592
2020-06-05 14:04:01,968 [lib.api.process] INFO: Termination confirmed for process 592
2020-06-05 14:04:01,968 [root] INFO: Terminate event set for process 592.
2020-06-05 14:04:01,968 [lib.api.process] INFO: Terminate event set for process 2228
2020-06-05 14:04:01,968 [root] DEBUG: Terminate Event: Processing tracked regions before shutdown (process 2228).
2020-06-05 14:04:02,015 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x0000000000000000.
2020-06-05 14:04:02,031 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000FFAF0000.
2020-06-05 14:04:06,968 [lib.api.process] INFO: Termination confirmed for process 2228
2020-06-05 14:04:06,968 [root] INFO: Terminate event set for process 2228.
2020-06-05 14:04:06,968 [lib.api.process] INFO: Terminate event set for process 472
2020-06-05 14:04:07,687 [root] DEBUG: ProcessImageBase: EP 0x000000000000246C image base 0x00000000FFAF0000 size 0x0 entropy 3.663277e+00.
2020-06-05 14:04:07,687 [root] DEBUG: Terminate Event: Processing tracked regions before shutdown (process 472).
2020-06-05 14:04:07,750 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x0000000000000000.
2020-06-05 14:04:07,750 [root] DEBUG: ClearAllBreakpoints: Error getting thread context (thread 3204, handle 0x1d0).
2020-06-05 14:04:07,750 [lib.api.process] INFO: Termination confirmed for process 472
2020-06-05 14:04:07,750 [root] INFO: Terminate event set for process 472.
2020-06-05 14:04:07,750 [lib.api.process] ERROR: Failed to open terminate event for pid 3892
2020-06-05 14:04:07,796 [root] INFO: Terminate event set for process 3892.
2020-06-05 14:04:07,796 [root] INFO: Created shutdown mutex.
2020-06-05 14:04:08,812 [root] INFO: Shutting down package.
2020-06-05 14:04:08,812 [root] INFO: Stopping auxiliary modules.
2020-06-05 14:04:21,812 [lib.common.results] WARNING: File C:\JcblWXUU\bin\procmon.xml doesn't exist anymore
2020-06-05 14:04:21,812 [root] INFO: Finishing auxiliary modules.
2020-06-05 14:04:21,812 [root] INFO: Shutting down pipe server and dumping dropped files.
2020-06-05 14:04:21,812 [root] WARNING: Folder at path "C:\JcblWXUU\debugger" does not exist, skip.
2020-06-05 14:04:21,843 [root] WARNING: Monitor injection attempted but failed for process 1744.
2020-06-05 14:04:21,843 [root] INFO: Analysis completed.

Machine

Name Label Manager Started On Shutdown On
win7x64_4 win7x64_8 KVM 2020-06-05 13:55:42 2020-06-05 14:04:56

File Details

File Name R070161.exe
File Size 747008 bytes
File Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
PE timestamp 2020-06-04 17:56:10
MD5 507341709bdd760052640f07bd5acd80
SHA1 894e770c57597dc4865822712d6ede1a1c980bf3
SHA256 130d22d52d43b7bcc72740f05b270d9dcf9e9a178ab081dfbf5ffe30de0f4c54
SHA512 6c4b79bb47fc81c6d6460c83244c0d0dd3b20888b9057917e151ec2c24f1331ed3461b49970fa67c858a434e3c17aeabe939cff0786c3a1dbbb24dbebdd62505
CRC32 CBAF9E32
Ssdeep 12288:y1mrFUPInk/gy1nQjDcqn/xadb2syThgu3kN52JuvLcSy/K5aGt5VX9dKg:15UPInmp1nQjPY2ngu+2JuvLcbWhW
Download Download ZIP Resubmit sample

Signatures

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction - unpacking
Guard pages use detected - possible anti-debugging.
A process attempted to delay the analysis task.
Process: R070161.exe tried to sleep 803.12 seconds, actually delayed analysis time by 0.0 seconds
Dynamic (imported) function loading detected
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: MSCOREE.DLL/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/_CorExeMain_RetAddr
DynamicLoader: mscoreei.dll/_CorExeMain
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: VERSION.dll/GetFileVersionInfoW
DynamicLoader: VERSION.dll/VerQueryValueW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionAndSpinCount
DynamicLoader: KERNEL32.dll/IsProcessorFeaturePresent
DynamicLoader: msvcrt.dll/_set_error_mode
DynamicLoader: msvcrt.dll/[email protected]@[email protected]
DynamicLoader: msvcrt.dll/_get_terminate
DynamicLoader: KERNEL32.dll/FindActCtxSectionStringW
DynamicLoader: KERNEL32.dll/GetSystemWindowsDirectoryW
DynamicLoader: MSCOREE.DLL/GetProcessExecutableHeap
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap_RetAddr
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap
DynamicLoader: mscorwks.dll/SetLoadedByMscoree
DynamicLoader: USER32.dll/GetProcessWindowStation
DynamicLoader: USER32.dll/GetUserObjectInformationW
DynamicLoader: mscorwks.dll/_CorExeMain
DynamicLoader: mscorwks.dll/GetCLRFunction
DynamicLoader: ADVAPI32.dll/RegisterTraceGuidsW
DynamicLoader: ADVAPI32.dll/UnregisterTraceGuids
DynamicLoader: ADVAPI32.dll/GetTraceLoggerHandle
DynamicLoader: ADVAPI32.dll/GetTraceEnableLevel
DynamicLoader: ADVAPI32.dll/GetTraceEnableFlags
DynamicLoader: ADVAPI32.dll/TraceEvent
DynamicLoader: MSCOREE.DLL/IEE
DynamicLoader: mscoreei.dll/IEE_RetAddr
DynamicLoader: mscoreei.dll/IEE
DynamicLoader: mscorwks.dll/IEE
DynamicLoader: MSCOREE.DLL/GetStartupFlags
DynamicLoader: mscoreei.dll/GetStartupFlags_RetAddr
DynamicLoader: mscoreei.dll/GetStartupFlags
DynamicLoader: MSCOREE.DLL/GetHostConfigurationFile
DynamicLoader: mscoreei.dll/GetHostConfigurationFile_RetAddr
DynamicLoader: mscoreei.dll/GetHostConfigurationFile
DynamicLoader: mscoreei.dll/GetCORVersion_RetAddr
DynamicLoader: mscoreei.dll/GetCORVersion
DynamicLoader: MSCOREE.DLL/GetCORSystemDirectory
DynamicLoader: mscoreei.dll/GetCORSystemDirectory_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream
DynamicLoader: ntdll.dll/RtlUnwind
DynamicLoader: KERNEL32.dll/IsWow64Process
DynamicLoader: KERNEL32.dll/GetSystemWindowsDirectoryW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/AddVectoredContinueHandler
DynamicLoader: KERNEL32.dll/RemoveVectoredContinueHandler
DynamicLoader: ADVAPI32.dll/ConvertSidToStringSidW
DynamicLoader: shell32.dll/SHGetFolderPathW
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/GetWriteWatch
DynamicLoader: KERNEL32.dll/ResetWriteWatch
DynamicLoader: KERNEL32.dll/CreateMemoryResourceNotification
DynamicLoader: KERNEL32.dll/QueryMemoryResourceNotification
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: KERNEL32.dll/QueryActCtxW
DynamicLoader: ole32.dll/CoGetContextToken
DynamicLoader: KERNEL32.dll/GetFullPathName
DynamicLoader: KERNEL32.dll/GetFullPathNameW
DynamicLoader: KERNEL32.dll/GetVersionEx
DynamicLoader: KERNEL32.dll/GetVersionExW
DynamicLoader: KERNEL32.dll/GetVersionEx
DynamicLoader: KERNEL32.dll/GetVersionExW
DynamicLoader: ADVAPI32.dll/CryptAcquireContextA
DynamicLoader: ADVAPI32.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/CryptCreateHash
DynamicLoader: ADVAPI32.dll/CryptDestroyHash
DynamicLoader: ADVAPI32.dll/CryptHashData
DynamicLoader: ADVAPI32.dll/CryptGetHashParam
DynamicLoader: ADVAPI32.dll/CryptImportKey
DynamicLoader: ADVAPI32.dll/CryptExportKey
DynamicLoader: ADVAPI32.dll/CryptGenKey
DynamicLoader: ADVAPI32.dll/CryptGetKeyParam
DynamicLoader: ADVAPI32.dll/CryptDestroyKey
DynamicLoader: ADVAPI32.dll/CryptVerifySignatureA
DynamicLoader: ADVAPI32.dll/CryptSignHashA
DynamicLoader: ADVAPI32.dll/CryptGetProvParam
DynamicLoader: ADVAPI32.dll/CryptGetUserKey
DynamicLoader: ADVAPI32.dll/CryptEnumProvidersA
DynamicLoader: MSCOREE.DLL/GetMetaDataInternalInterface
DynamicLoader: mscoreei.dll/GetMetaDataInternalInterface_RetAddr
DynamicLoader: mscoreei.dll/GetMetaDataInternalInterface
DynamicLoader: mscorwks.dll/GetMetaDataInternalInterface
DynamicLoader: mscorjit.dll/getJit
DynamicLoader: KERNEL32.dll/IsWow64Process
DynamicLoader: KERNEL32.dll/GlobalMemoryStatusEx
DynamicLoader: uxtheme.dll/IsAppThemed
DynamicLoader: uxtheme.dll/IsAppThemedW
DynamicLoader: KERNEL32.dll/CreateActCtx
DynamicLoader: KERNEL32.dll/CreateActCtxA
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: USER32.dll/RegisterWindowMessage
DynamicLoader: USER32.dll/RegisterWindowMessageW
DynamicLoader: USER32.dll/GetSystemMetrics
DynamicLoader: USER32.dll/AdjustWindowRectEx
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: KERNEL32.dll/GetCurrentThread
DynamicLoader: KERNEL32.dll/DuplicateHandle
DynamicLoader: KERNEL32.dll/GetCurrentThreadId
DynamicLoader: KERNEL32.dll/GetCurrentActCtx
DynamicLoader: KERNEL32.dll/ActivateActCtx
DynamicLoader: KERNEL32.dll/lstrlen
DynamicLoader: KERNEL32.dll/lstrlenW
DynamicLoader: KERNEL32.dll/GetModuleHandle
DynamicLoader: KERNEL32.dll/GetModuleHandleW
DynamicLoader: KERNEL32.dll/GetProcAddress
DynamicLoader: USER32.dll/DefWindowProcW
DynamicLoader: GDI32.dll/GetStockObject
DynamicLoader: KERNEL32.dll/GetUserDefaultUILanguage
DynamicLoader: USER32.dll/RegisterClass
DynamicLoader: USER32.dll/RegisterClassW
DynamicLoader: USER32.dll/CreateWindowEx
DynamicLoader: USER32.dll/CreateWindowExW
DynamicLoader: USER32.dll/SetWindowLong
DynamicLoader: USER32.dll/SetWindowLongW
DynamicLoader: USER32.dll/GetWindowLong
DynamicLoader: USER32.dll/GetWindowLongW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegOpenKeyEx
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueEx
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: USER32.dll/SetWindowLong
DynamicLoader: USER32.dll/SetWindowLongW
DynamicLoader: USER32.dll/CallWindowProc
DynamicLoader: USER32.dll/CallWindowProcW
DynamicLoader: USER32.dll/GetClientRect
DynamicLoader: USER32.dll/GetWindowRect
DynamicLoader: USER32.dll/GetParent
DynamicLoader: KERNEL32.dll/DeactivateActCtx
DynamicLoader: KERNEL32.dll/SetErrorMode
DynamicLoader: KERNEL32.dll/GetFileAttributesEx
DynamicLoader: KERNEL32.dll/GetFileAttributesExW
DynamicLoader: mscoreei.dll/LoadLibraryShim_RetAddr
DynamicLoader: mscoreei.dll/LoadLibraryShim
DynamicLoader: culture.dll/ConvertLangIdToCultureName
DynamicLoader: KERNEL32.dll/GetCurrentProcessId
DynamicLoader: KERNEL32.dll/GetCurrentProcessIdW
DynamicLoader: KERNEL32.dll/FindAtom
DynamicLoader: KERNEL32.dll/FindAtomW
DynamicLoader: KERNEL32.dll/AddAtom
DynamicLoader: KERNEL32.dll/AddAtomW
DynamicLoader: MSCOREE.DLL/LoadLibraryShim
DynamicLoader: gdiplus.dll/GdiplusStartup
DynamicLoader: KERNEL32.dll/IsProcessorFeaturePresent
DynamicLoader: USER32.dll/GetWindowInfo
DynamicLoader: USER32.dll/GetAncestor
DynamicLoader: USER32.dll/GetMonitorInfoA
DynamicLoader: USER32.dll/EnumDisplayMonitors
DynamicLoader: USER32.dll/EnumDisplayDevicesA
DynamicLoader: GDI32.dll/ExtTextOutW
DynamicLoader: GDI32.dll/GdiIsMetaPrintDC
DynamicLoader: gdiplus.dll/GdipLoadImageFromStream
DynamicLoader: WindowsCodecs.dll/DllGetClassObject
DynamicLoader: gdiplus.dll/GdipImageForceValidation
DynamicLoader: gdiplus.dll/GdipGetImageType
DynamicLoader: gdiplus.dll/GdipGetImageRawFormat
DynamicLoader: gdiplus.dll/GdipGetImageWidth
DynamicLoader: gdiplus.dll/GdipGetImageHeight
DynamicLoader: gdiplus.dll/GdipBitmapGetPixel
DynamicLoader: gdiplus.dll/GdipDisposeImage
DynamicLoader: KERNEL32.dll/OpenMutex
DynamicLoader: KERNEL32.dll/OpenMutexW
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: KERNEL32.dll/ReleaseMutex
DynamicLoader: KERNEL32.dll/CreateMutex
DynamicLoader: KERNEL32.dll/CreateMutexW
DynamicLoader: KERNEL32.dll/CreateProcess
DynamicLoader: KERNEL32.dll/CreateProcessW
DynamicLoader: KERNEL32.dll/GetThreadContext
DynamicLoader: KERNEL32.dll/ReadProcessMemory
DynamicLoader: KERNEL32.dll/VirtualAllocEx
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValue
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValueW
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/OpenProcessTokenW
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivileges
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivilegesW
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: PSAPI.DLL/EnumProcesses
DynamicLoader: PSAPI.DLL/EnumProcessesW
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: KERNEL32.dll/OpenProcess
DynamicLoader: KERNEL32.dll/OpenProcessW
DynamicLoader: KERNEL32.dll/TerminateProcess
DynamicLoader: KERNEL32.dll/TerminateProcessW
DynamicLoader: KERNEL32.dll/WriteProcessMemory
DynamicLoader: KERNEL32.dll/SetThreadContext
DynamicLoader: KERNEL32.dll/ResumeThread
DynamicLoader: ole32.dll/CoWaitForMultipleHandles
DynamicLoader: USER32.dll/SetClassLong
DynamicLoader: USER32.dll/SetClassLongW
DynamicLoader: USER32.dll/PostMessage
DynamicLoader: USER32.dll/PostMessageW
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: USER32.dll/UnregisterClass
DynamicLoader: USER32.dll/UnregisterClassW
DynamicLoader: KERNEL32.dll/DeleteAtom
DynamicLoader: KERNEL32.dll/DeleteAtomW
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: ole32.dll/NdrOleInitializeExtension
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: KERNEL32.dll/CreateActCtxW
DynamicLoader: KERNEL32.dll/AddRefActCtx
DynamicLoader: KERNEL32.dll/ReleaseActCtx
DynamicLoader: KERNEL32.dll/ActivateActCtx
DynamicLoader: KERNEL32.dll/DeactivateActCtx
DynamicLoader: KERNEL32.dll/GetCurrentActCtx
DynamicLoader: KERNEL32.dll/QueryActCtxW
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/EventUnregister
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: MSCOREE.DLL/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/_CorExeMain_RetAddr
DynamicLoader: mscoreei.dll/_CorExeMain
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: VERSION.dll/GetFileVersionInfoW
DynamicLoader: VERSION.dll/VerQueryValueW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionAndSpinCount
DynamicLoader: KERNEL32.dll/IsProcessorFeaturePresent
DynamicLoader: msvcrt.dll/_set_error_mode
DynamicLoader: msvcrt.dll/[email protected]@[email protected]
DynamicLoader: msvcrt.dll/_get_terminate
DynamicLoader: KERNEL32.dll/FindActCtxSectionStringW
DynamicLoader: KERNEL32.dll/GetSystemWindowsDirectoryW
DynamicLoader: MSCOREE.DLL/GetProcessExecutableHeap
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap_RetAddr
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap
DynamicLoader: mscorwks.dll/SetLoadedByMscoree
DynamicLoader: USER32.dll/GetProcessWindowStation
DynamicLoader: USER32.dll/GetUserObjectInformationW
DynamicLoader: mscorwks.dll/_CorExeMain
DynamicLoader: mscorwks.dll/GetCLRFunction
DynamicLoader: ADVAPI32.dll/RegisterTraceGuidsW
DynamicLoader: ADVAPI32.dll/UnregisterTraceGuids
DynamicLoader: ADVAPI32.dll/GetTraceLoggerHandle
DynamicLoader: ADVAPI32.dll/GetTraceEnableLevel
DynamicLoader: ADVAPI32.dll/GetTraceEnableFlags
DynamicLoader: ADVAPI32.dll/TraceEvent
DynamicLoader: MSCOREE.DLL/IEE
DynamicLoader: mscoreei.dll/IEE_RetAddr
DynamicLoader: mscoreei.dll/IEE
DynamicLoader: mscorwks.dll/IEE
DynamicLoader: MSCOREE.DLL/GetStartupFlags
DynamicLoader: mscoreei.dll/GetStartupFlags_RetAddr
DynamicLoader: mscoreei.dll/GetStartupFlags
DynamicLoader: MSCOREE.DLL/GetHostConfigurationFile
DynamicLoader: mscoreei.dll/GetHostConfigurationFile_RetAddr
DynamicLoader: mscoreei.dll/GetHostConfigurationFile
DynamicLoader: mscoreei.dll/GetCORVersion_RetAddr
DynamicLoader: mscoreei.dll/GetCORVersion
DynamicLoader: MSCOREE.DLL/GetCORSystemDirectory
DynamicLoader: mscoreei.dll/GetCORSystemDirectory_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream
DynamicLoader: ntdll.dll/RtlUnwind
DynamicLoader: KERNEL32.dll/IsWow64Process
DynamicLoader: KERNEL32.dll/GetSystemWindowsDirectoryW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/AddVectoredContinueHandler
DynamicLoader: KERNEL32.dll/RemoveVectoredContinueHandler
DynamicLoader: ADVAPI32.dll/ConvertSidToStringSidW
DynamicLoader: shell32.dll/SHGetFolderPathW
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/GetWriteWatch
DynamicLoader: KERNEL32.dll/ResetWriteWatch
DynamicLoader: KERNEL32.dll/CreateMemoryResourceNotification
DynamicLoader: KERNEL32.dll/QueryMemoryResourceNotification
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: KERNEL32.dll/QueryActCtxW
DynamicLoader: ole32.dll/CoGetContextToken
DynamicLoader: KERNEL32.dll/GetFullPathName
DynamicLoader: KERNEL32.dll/GetFullPathNameW
DynamicLoader: KERNEL32.dll/GetVersionEx
DynamicLoader: KERNEL32.dll/GetVersionExW
DynamicLoader: KERNEL32.dll/GetVersionEx
DynamicLoader: KERNEL32.dll/GetVersionExW
DynamicLoader: ADVAPI32.dll/CryptAcquireContextA
DynamicLoader: ADVAPI32.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/CryptCreateHash
DynamicLoader: ADVAPI32.dll/CryptDestroyHash
DynamicLoader: ADVAPI32.dll/CryptHashData
DynamicLoader: ADVAPI32.dll/CryptGetHashParam
DynamicLoader: ADVAPI32.dll/CryptImportKey
DynamicLoader: ADVAPI32.dll/CryptExportKey
DynamicLoader: ADVAPI32.dll/CryptGenKey
DynamicLoader: ADVAPI32.dll/CryptGetKeyParam
DynamicLoader: ADVAPI32.dll/CryptDestroyKey
DynamicLoader: ADVAPI32.dll/CryptVerifySignatureA
DynamicLoader: ADVAPI32.dll/CryptSignHashA
DynamicLoader: ADVAPI32.dll/CryptGetProvParam
DynamicLoader: ADVAPI32.dll/CryptGetUserKey
DynamicLoader: ADVAPI32.dll/CryptEnumProvidersA
DynamicLoader: MSCOREE.DLL/GetMetaDataInternalInterface
DynamicLoader: mscoreei.dll/GetMetaDataInternalInterface_RetAddr
DynamicLoader: mscoreei.dll/GetMetaDataInternalInterface
DynamicLoader: mscorwks.dll/GetMetaDataInternalInterface
DynamicLoader: mscorjit.dll/getJit
DynamicLoader: KERNEL32.dll/IsWow64Process
DynamicLoader: KERNEL32.dll/GetUserDefaultUILanguage
DynamicLoader: KERNEL32.dll/SetErrorMode
DynamicLoader: KERNEL32.dll/GetFileAttributesEx
DynamicLoader: KERNEL32.dll/GetFileAttributesExW
DynamicLoader: bcrypt.dll/BCryptGetFipsAlgorithmMode
DynamicLoader: KERNEL32.dll/lstrlen
DynamicLoader: KERNEL32.dll/lstrlenW
DynamicLoader: KERNEL32.dll/GetModuleHandle
DynamicLoader: KERNEL32.dll/GetModuleHandleW
DynamicLoader: KERNEL32.dll/GetProcAddress
DynamicLoader: USER32.dll/DefWindowProcW
DynamicLoader: GDI32.dll/GetStockObject
DynamicLoader: USER32.dll/RegisterClass
DynamicLoader: USER32.dll/RegisterClassW
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: USER32.dll/CreateWindowEx
DynamicLoader: USER32.dll/CreateWindowExW
DynamicLoader: USER32.dll/SetWindowLong
DynamicLoader: USER32.dll/SetWindowLongW
DynamicLoader: USER32.dll/GetWindowLong
DynamicLoader: USER32.dll/GetWindowLongW
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: KERNEL32.dll/GetCurrentThread
DynamicLoader: KERNEL32.dll/DuplicateHandle
DynamicLoader: KERNEL32.dll/GetCurrentThreadId
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegOpenKeyEx
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueEx
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: USER32.dll/SetWindowLong
DynamicLoader: USER32.dll/SetWindowLongW
DynamicLoader: USER32.dll/CallWindowProc
DynamicLoader: USER32.dll/CallWindowProcW
DynamicLoader: USER32.dll/RegisterWindowMessage
DynamicLoader: USER32.dll/RegisterWindowMessageW
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: KERNEL32.dll/GetCurrentProcessId
DynamicLoader: KERNEL32.dll/GetCurrentProcessIdW
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValue
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValueW
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/OpenProcessTokenW
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivileges
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivilegesW
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: ntdll.dll/NtQuerySystemInformation
DynamicLoader: ntdll.dll/NtQuerySystemInformationW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptCreateHash
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoGetObjectContext
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: ole32.dll/NdrOleInitializeExtension
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: ole32.dll/MkParseDisplayName
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: KERNEL32.dll/CreateEvent
DynamicLoader: KERNEL32.dll/CreateEventW
DynamicLoader: KERNEL32.dll/SwitchToThread
DynamicLoader: KERNEL32.dll/SetEvent
DynamicLoader: ole32.dll/CoWaitForMultipleHandles
DynamicLoader: ole32.dll/IIDFromString
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: KERNEL32.dll/LoadLibrary
DynamicLoader: KERNEL32.dll/LoadLibraryA
DynamicLoader: KERNEL32.dll/GetProcAddress
DynamicLoader: wminet_utils.dll/ResetSecurity
DynamicLoader: wminet_utils.dll/SetSecurity
DynamicLoader: wminet_utils.dll/BlessIWbemServices
DynamicLoader: wminet_utils.dll/BlessIWbemServicesObject
DynamicLoader: wminet_utils.dll/GetPropertyHandle
DynamicLoader: wminet_utils.dll/WritePropertyValue
DynamicLoader: wminet_utils.dll/Clone
DynamicLoader: wminet_utils.dll/VerifyClientKey
DynamicLoader: wminet_utils.dll/GetQualifierSet
DynamicLoader: wminet_utils.dll/Get
DynamicLoader: wminet_utils.dll/Put
DynamicLoader: wminet_utils.dll/Delete
DynamicLoader: wminet_utils.dll/GetNames
DynamicLoader: wminet_utils.dll/BeginEnumeration
DynamicLoader: wminet_utils.dll/Next
DynamicLoader: wminet_utils.dll/EndEnumeration
DynamicLoader: wminet_utils.dll/GetPropertyQualifierSet
DynamicLoader: wminet_utils.dll/Clone
DynamicLoader: wminet_utils.dll/GetObjectText
DynamicLoader: wminet_utils.dll/SpawnDerivedClass
DynamicLoader: wminet_utils.dll/SpawnInstance
DynamicLoader: wminet_utils.dll/CompareTo
DynamicLoader: wminet_utils.dll/GetPropertyOrigin
DynamicLoader: wminet_utils.dll/InheritsFrom
DynamicLoader: wminet_utils.dll/GetMethod
DynamicLoader: wminet_utils.dll/PutMethod
DynamicLoader: wminet_utils.dll/DeleteMethod
DynamicLoader: wminet_utils.dll/BeginMethodEnumeration
DynamicLoader: wminet_utils.dll/NextMethod
DynamicLoader: wminet_utils.dll/EndMethodEnumeration
DynamicLoader: wminet_utils.dll/GetMethodQualifierSet
DynamicLoader: wminet_utils.dll/GetMethodOrigin
DynamicLoader: wminet_utils.dll/QualifierSet_Get
DynamicLoader: wminet_utils.dll/QualifierSet_Put
DynamicLoader: wminet_utils.dll/QualifierSet_Delete
DynamicLoader: wminet_utils.dll/QualifierSet_GetNames
DynamicLoader: wminet_utils.dll/QualifierSet_BeginEnumeration
DynamicLoader: wminet_utils.dll/QualifierSet_Next
DynamicLoader: wminet_utils.dll/QualifierSet_EndEnumeration
DynamicLoader: wminet_utils.dll/GetCurrentApartmentType
DynamicLoader: wminet_utils.dll/GetDemultiplexedStub
DynamicLoader: wminet_utils.dll/CreateInstanceEnumWmi
DynamicLoader: wminet_utils.dll/CreateClassEnumWmi
DynamicLoader: wminet_utils.dll/ExecQueryWmi
DynamicLoader: wminet_utils.dll/ExecNotificationQueryWmi
DynamicLoader: wminet_utils.dll/PutInstanceWmi
DynamicLoader: wminet_utils.dll/PutClassWmi
DynamicLoader: wminet_utils.dll/CloneEnumWbemClassObject
DynamicLoader: wminet_utils.dll/ConnectServerWmi
DynamicLoader: wminet_utils.dll/GetErrorInfo
DynamicLoader: wminet_utils.dll/Initialize
DynamicLoader: OLEAUT32.dll/SysStringLen
DynamicLoader: KERNEL32.dll/ZeroMemory
DynamicLoader: KERNEL32.dll/ZeroMemoryA
DynamicLoader: KERNEL32.dll/RtlZeroMemory
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: OLEAUT32.dll/
DynamicLoader: CRYPTSP.dll/CryptHashData
DynamicLoader: CRYPTSP.dll/CryptGetHashParam
DynamicLoader: CRYPTSP.dll/CryptDestroyHash
DynamicLoader: ADVAPI32.dll/GetUserName
DynamicLoader: ADVAPI32.dll/GetUserNameW
DynamicLoader: KERNEL32.dll/GetComputerName
DynamicLoader: KERNEL32.dll/GetComputerNameW
DynamicLoader: KERNEL32.dll/GetEnvironmentVariable
DynamicLoader: KERNEL32.dll/GetEnvironmentVariableW
DynamicLoader: KERNEL32.dll/CreateIoCompletionPort
DynamicLoader: KERNEL32.dll/PostQueuedCompletionStatus
DynamicLoader: ntdll.dll/NtQueryInformationThread
DynamicLoader: ntdll.dll/NtQuerySystemInformation
DynamicLoader: ntdll.dll/NtGetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetSystemTimeAsFileTime
DynamicLoader: USER32.dll/GetLastInputInfo
DynamicLoader: shfolder.dll/SHGetFolderPath
DynamicLoader: shfolder.dll/SHGetFolderPathW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: KERNEL32.dll/CreateFile
DynamicLoader: KERNEL32.dll/CreateFileW
DynamicLoader: KERNEL32.dll/GetFileType
DynamicLoader: KERNEL32.dll/ReadFile
DynamicLoader: KERNEL32.dll/GetFileSize
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: KERNEL32.dll/GetACP
DynamicLoader: KERNEL32.dll/UnmapViewOfFile
DynamicLoader: KERNEL32.dll/FindFirstFile
DynamicLoader: KERNEL32.dll/FindFirstFileW
DynamicLoader: KERNEL32.dll/FindClose
DynamicLoader: KERNEL32.dll/FindNextFile
DynamicLoader: KERNEL32.dll/FindNextFileW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: KERNEL32.dll/LocalFree
DynamicLoader: KERNEL32.dll/ZeroMemory
DynamicLoader: KERNEL32.dll/ZeroMemoryA
DynamicLoader: KERNEL32.dll/RtlZeroMemory
DynamicLoader: crypt32.dll/CryptUnprotectData
DynamicLoader: crypt32.dll/CryptUnprotectDataW
DynamicLoader: RPCRT4.dll/RpcStringBindingComposeW
DynamicLoader: RPCRT4.dll/RpcBindingFromStringBindingW
DynamicLoader: RPCRT4.dll/NdrClientCall2
DynamicLoader: CRYPTBASE.dll/SystemFunction041
DynamicLoader: RPCRT4.dll/RpcStringFreeW
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: mscoreei.dll/LoadLibraryShim_RetAddr
DynamicLoader: mscoreei.dll/LoadLibraryShim
DynamicLoader: culture.dll/ConvertLangIdToCultureName
DynamicLoader: vaultcli.dll/VaultEnumerateVaults
DynamicLoader: ole32.dll/CoCreateGuid
DynamicLoader: USER32.dll/GetSystemMetrics
DynamicLoader: USER32.dll/GetClientRect
DynamicLoader: USER32.dll/GetWindowRect
DynamicLoader: USER32.dll/GetParent
DynamicLoader: ole32.dll/OleInitialize
DynamicLoader: ole32.dll/CoRegisterMessageFilter
DynamicLoader: USER32.dll/PeekMessage
DynamicLoader: USER32.dll/PeekMessageW
DynamicLoader: USER32.dll/WaitMessage
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: kernel32.dll/ResolveDelayLoadedAPI
DynamicLoader: VSSAPI.DLL/CreateWriter
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ADVAPI32.dll/LookupAccountNameW
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: samcli.dll/NetLocalGroupGetMembers
DynamicLoader: SAMLIB.dll/SamConnect
DynamicLoader: RPCRT4.dll/NdrClientCall3
DynamicLoader: RPCRT4.dll/RpcStringBindingComposeW
DynamicLoader: RPCRT4.dll/RpcBindingFromStringBindingW
DynamicLoader: RPCRT4.dll/RpcStringFreeW
DynamicLoader: RPCRT4.dll/I_RpcMapWin32Status
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: ole32.dll/CoTaskMemRealloc
DynamicLoader: ADVAPI32.dll/RegisterEventSourceW
DynamicLoader: ADVAPI32.dll/ReportEventW
DynamicLoader: ADVAPI32.dll/DeregisterEventSource
DynamicLoader: SAMLIB.dll/SamOpenDomain
DynamicLoader: SAMLIB.dll/SamLookupNamesInDomain
DynamicLoader: SAMLIB.dll/SamCloseHandle
DynamicLoader: SAMLIB.dll/SamEnumerateDomainsInSamServer
DynamicLoader: SAMLIB.dll/SamLookupDomainInSamServer
DynamicLoader: SAMLIB.dll/SamFreeMemory
DynamicLoader: SAMLIB.dll/SamOpenAlias
DynamicLoader: SAMLIB.dll/SamGetMembersInAlias
DynamicLoader: ole32.dll/CoCreateGuid
DynamicLoader: ole32.dll/CoCreateInstance
CAPE extracted potentially suspicious content
R070161.exe: Unpacked Shellcode
R070161.exe: Unpacked Shellcode
R070161.exe: Unpacked Shellcode
R070161.exe: Unpacked Shellcode
R070161.exe: Unpacked Shellcode
R070161.exe: Unpacked Shellcode
R070161.exe: Unpacked Shellcode
R070161.exe: Unpacked Shellcode
R070161.exe: Unpacked Shellcode
R070161.exe: Unpacked Shellcode
R070161.exe: Unpacked Shellcode
R070161.exe: Unpacked Shellcode
R070161.exe: Unpacked Shellcode
R070161.exe: Unpacked Shellcode
R070161.exe: Unpacked Shellcode
R070161.exe: Unpacked Shellcode
R070161.exe: Unpacked Shellcode
R070161.exe: Unpacked Shellcode
R070161.exe: Unpacked Shellcode
Queries or connects to DNS-Over-HTTPS/DNS-Over-TLS domain or IP address
ip: 1.1.1.1
Queries or connects to DNS-Over-HTTPS/DNS-Over-TLS domain or IP address
ip: 1.1.1.1
The binary likely contains encrypted or compressed data.
section: name: .text, entropy: 7.87, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x000aba00, virtual_size: 0x000ab8b4
Authenticode signature is invalid
authenticode error: No signature found. SignTool Error File not valid C\Users\Louise\AppData\Local\Temp\R070161.exe
Behavioural detection: Injection (Process Hollowing)
Injection: R070161.exe(1524) -> R070161.exe(1588)
Executed a process and injected code into it, probably while unpacking
Injection: R070161.exe(1524) -> R070161.exe(1588)
Behavioural detection: Injection (inter-process)
Behavioural detection: Injection with CreateRemoteThread in a remote process
Attempts to repeatedly call a single API many times in order to delay analysis time
Spam: services.exe (472) called API GetSystemTimeAsFileTime 2202073 times
Steals private information from local Internet browsers
file: C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Default\Login Data
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\profiles.ini
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db
Network activity detected but not expressed in API logs
File has been identified by 11 Antiviruses on VirusTotal as malicious
Cylance: Unsafe
APEX: Malicious
Paloalto: generic.ml
FireEye: Generic.mg.507341709bdd7600
Ikarus: Win32.Outbreak
ZoneAlarm: UDS:DangerousObject.Multi.Generic
Microsoft: Trojan:Win32/Sonbokli.A!cl
SentinelOne: DFI - Malicious PE
eGambit: Unsafe.AI_Score_100%
BitDefenderTheta: Gen:[email protected]
Qihoo-360: HEUR/QVM03.0.AFC8.Malware.Gen
Harvests information related to installed mail clients
file: C:\Users\Louise\AppData\Roaming\Thunderbird\profiles.ini
key: HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
key: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
key: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Screenshots


Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
Y 1.1.1.1 [VT] Australia

DNS

No domains contacted.


Summary

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Louise\AppData\Local\Temp\R070161.exe.config
C:\Users\Louise\AppData\Local\Temp\R070161.exe
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-2.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\R070161.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Louise\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Louise\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index39c.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\f8420d8c6ede777377fcff48a4beaa2a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Louise
C:\Users\Louise\AppData
C:\Users\Louise\AppData\Local
C:\Users\Louise\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Louise\AppData\Local\Temp\R070161.config
C:\Users\Louise\AppData\Local\Temp\R070161.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol214.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\0a65164b17e5c64bacdc694ea2439c43\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\175df210b784212def386595c25caefb\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\5669120680b52abf616f3876387ca2cc\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\4ac828c8c4c76f3ba59f8f9c7dab1cb3\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Louise\AppData\Local\Temp\en-US\mcHElSpfLvoBbuEl.resources.dll
C:\Users\Louise\AppData\Local\Temp\en-US\mcHElSpfLvoBbuEl.resources\mcHElSpfLvoBbuEl.resources.dll
C:\Users\Louise\AppData\Local\Temp\en-US\mcHElSpfLvoBbuEl.resources.exe
C:\Users\Louise\AppData\Local\Temp\en-US\mcHElSpfLvoBbuEl.resources\mcHElSpfLvoBbuEl.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
C:\Windows\Globalization\en.nlp
C:\Users\Louise\AppData\Local\Temp\en\mcHElSpfLvoBbuEl.resources.dll
C:\Users\Louise\AppData\Local\Temp\en\mcHElSpfLvoBbuEl.resources\mcHElSpfLvoBbuEl.resources.dll
C:\Users\Louise\AppData\Local\Temp\en\mcHElSpfLvoBbuEl.resources.exe
C:\Users\Louise\AppData\Local\Temp\en\mcHElSpfLvoBbuEl.resources\mcHElSpfLvoBbuEl.resources.exe
C:\Users\Louise\AppData\Local\Temp\LopRfArQtmSGYrpggstZqheNvTXK.dll
C:\Users\Louise\AppData\Local\Temp\LopRfArQtmSGYrpggstZqheNvTXK\LopRfArQtmSGYrpggstZqheNvTXK.dll
C:\Users\Louise\AppData\Local\Temp\LopRfArQtmSGYrpggstZqheNvTXK.exe
C:\Users\Louise\AppData\Local\Temp\LopRfArQtmSGYrpggstZqheNvTXK\LopRfArQtmSGYrpggstZqheNvTXK.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\GdiPlus.dll
C:\Users\Louise\AppData\Local\Temp\en-US\ReZer0V2.resources.dll
C:\Users\Louise\AppData\Local\Temp\en-US\ReZer0V2.resources\ReZer0V2.resources.dll
C:\Users\Louise\AppData\Local\Temp\en-US\ReZer0V2.resources.exe
C:\Users\Louise\AppData\Local\Temp\en-US\ReZer0V2.resources\ReZer0V2.resources.exe
C:\Users\Louise\AppData\Local\Temp\en\ReZer0V2.resources.dll
C:\Users\Louise\AppData\Local\Temp\en\ReZer0V2.resources\ReZer0V2.resources.dll
C:\Users\Louise\AppData\Local\Temp\en\ReZer0V2.resources.exe
C:\Users\Louise\AppData\Local\Temp\en\ReZer0V2.resources\ReZer0V2.resources.exe
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.1524.29373921
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.1524.29373921
C:\Users\Louise\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.1524.29373984
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bcrypt.dll
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll
C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\81ab4c39c6a7c9f50721aca2db09b417\System.Management.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\wminet_utils.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\oleaut32.dll
C:\Windows\System32\tzres.dll
C:\%insfolder%\%insname%
C:\Users\Louise\AppData\Local\CentBrowser\User Data
C:\Users\Louise\AppData\Local\Elements Browser\User Data
C:\Users\Louise\AppData\Local\Vivaldi\User Data
C:\Users\Louise\AppData\Local\Iridium\User Data
C:\Users\Louise\AppData\Local\BraveSoftware\Brave-Browser\User Data
C:\Users\Louise\AppData\Roaming\Opera Software\Opera Stable
C:\Users\Louise\AppData\Local\uCozMedia\Uran\User Data
C:\Users\Louise\AppData\Local\liebao\User Data
C:\Users\Louise\AppData\Local\Chromium\User Data
C:\Users\Louise\AppData\Local\Comodo\Dragon\User Data
C:\Users\Louise\AppData\Local\Torch\User Data
C:\Users\Louise\AppData\Local\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
C:\Users\Louise\AppData\Local\7Star\7Star\User Data
C:\Users\Louise\AppData\Local\QIP Surf\User Data
C:\Users\Louise\AppData\Local\CocCoc\Browser\User Data
C:\Users\Louise\AppData\Local\Kometa\User Data
C:\Users\Louise\AppData\Local\MapleStudio\ChromePlus\User Data
C:\Users\Louise\AppData\Local\Amigo\User Data
C:\Users\Louise\AppData\Local\CatalinaGroup\Citrio\User Data
C:\Users\Louise\AppData\Local\Sputnik\Sputnik\User Data
C:\Users\Louise\AppData\Local\Orbitum\User Data
C:\Users\Louise\AppData\Local\Yandex\YandexBrowser\User Data
C:\Users\Louise\AppData\Local\Chedot\User Data
C:\Users\Louise\AppData\Local\360Chrome\Chrome\User Data
C:\Users\Louise\AppData\Local\Epic Privacy Browser\User Data
C:\Users\Louise\AppData\Local\Coowon\Coowon\User Data
C:\Users\Louise\AppData\Roaming\Thunderbird\profiles.ini
C:\Users\Louise\AppData\Roaming\Trillian\users\global\accounts.dat
C:\Users\Louise\AppData\Roaming\Flock\Browser\profiles.ini
C:\Users\Louise\AppData\Roaming\Postbox\profiles.ini
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\plutil.exe
C:\Users\Louise\AppData\Roaming\Opera Mail\Opera Mail\wand.dat
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\profiles.ini
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\logins.json
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\signons.sqlite
C:\Users\Louise\AppData\Roaming\Pocomail\accounts.ini
C:\Users\Louise\AppData\Roaming\Mozilla\SeaMonkey\profiles.ini
C:\Users\Louise\AppData\Local\Google\Chrome\User Data\
C:\Users\Louise\AppData\Local\Google\Chrome\User Data\*
C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Default\Login Data
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\51fb28e8a54a8d8f6021415d47477ab4\System.Security.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.INI
C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Local State
C:\Windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\crypt32.dll
C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Login Data
C:\Storage\
C:\mail\
C:\Users\Louise\AppData\Local\VirtualStore\Program Files\Foxmail\mail\
C:\Users\Louise\AppData\Local\VirtualStore\Program Files (x86)\Foxmail\mail\
C:\Users\Louise\AppData\Roaming\Comodo\IceDragon\profiles.ini
C:\Users\Louise\AppData\Local\Temp\Folder.lst
C:\Users\Louise\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
C:\Users\Louise\AppData\Local\UCBrowser\*
C:\Users\Louise\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
C:\Users\Louise\AppData\Roaming\Waterfox\profiles.ini
C:\Users\Louise\AppData\Roaming\K-Meleon\profiles.ini
C:\Users\Louise\AppData\Roaming\The Bat!
C:\Users\Louise\AppData\Local\Microsoft\Edge\User Data
C:\Users\Louise\AppData\Local\Temp\vaultcli.dll
C:\Users\Louise\AppData\Roaming\Claws-mail
C:\Users\Louise\AppData\Roaming\Claws-mail\clawsrc
C:\Users\Louise\AppData\Roaming\Moonchild Productions\Pale Moon\profiles.ini
C:\Users\Louise\AppData\Local\falkon\profiles\profiles.ini
C:\Users\Louise\AppData\Local\Tencent\QQBrowser\User Data
C:\Users\Louise\AppData\Local\Tencent\QQBrowser\User Data\Default\EncryptedStorage
C:\Users\Louise\AppData\Roaming\Mozilla\icecat\profiles.ini
C:\Windows\Temp
\??\PIPE\samr
C:\DosDevices\pipe\
C:\Windows\sysnative\en-US\KERNELBASE.dll.mui
C:\Windows\sysnative\LogFiles\Scm\eaca24ff-236c-401d-a1e7-b3d5267b8a50
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Louise\AppData\Local\Temp\R070161.exe.config
C:\Users\Louise\AppData\Local\Temp\R070161.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Louise\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Louise\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index39c.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\f8420d8c6ede777377fcff48a4beaa2a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol214.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\0a65164b17e5c64bacdc694ea2439c43\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\175df210b784212def386595c25caefb\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\5669120680b52abf616f3876387ca2cc\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\4ac828c8c4c76f3ba59f8f9c7dab1cb3\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\GdiPlus.dll
C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\81ab4c39c6a7c9f50721aca2db09b417\System.Management.ni.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\wminet_utils.dll
C:\Windows\System32\tzres.dll
C:\Users\Louise\AppData\Roaming\Thunderbird\profiles.ini
C:\Users\Louise\AppData\Roaming\Flock\Browser\profiles.ini
C:\Users\Louise\AppData\Roaming\Postbox\profiles.ini
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\profiles.ini
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db
C:\Users\Louise\AppData\Roaming\Mozilla\SeaMonkey\profiles.ini
C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Default\Login Data
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\51fb28e8a54a8d8f6021415d47477ab4\System.Security.ni.dll
C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Local State
C:\Users\Louise\AppData\Roaming\Comodo\IceDragon\profiles.ini
C:\Users\Louise\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
C:\Users\Louise\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
C:\Users\Louise\AppData\Roaming\Waterfox\profiles.ini
C:\Users\Louise\AppData\Roaming\K-Meleon\profiles.ini
C:\Users\Louise\AppData\Roaming\Moonchild Productions\Pale Moon\profiles.ini
C:\Users\Louise\AppData\Local\falkon\profiles\profiles.ini
C:\Users\Louise\AppData\Roaming\Mozilla\icecat\profiles.ini
\??\PIPE\samr
C:\Windows\sysnative\en-US\KERNELBASE.dll.mui
C:\Windows\sysnative\LogFiles\Scm\eaca24ff-236c-401d-a1e7-b3d5267b8a50
\??\PIPE\samr
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.1524.29373921
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.1524.29373921
C:\Users\Louise\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.1524.29373984
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\R070161.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\NGen\Policy\v2.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1339698970-4093829097-1161395185-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index39c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index39c\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index39c\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\c9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\c9\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\c9\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\c9\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\c9\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\c9\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d1537c7\379ed6ac
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index214
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\cb
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\cb\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\cb\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\cb\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\cb\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\cb\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\cf
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\cf\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\cf\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\cf\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\cf\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\cf\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\cc
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\cc\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\cc\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\cc\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\cc\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\cc\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\ce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\ce\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\ce\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\ce\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\ce\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\ce\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\c0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\c0\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\c0\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\c0\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\c0\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\c0\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\c6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\c6\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\c6\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\c6\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\c6\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\c6\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\c1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\c1\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\c1\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\c1\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\c1\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\c1\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\d0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\d0\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\d0\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\d0\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\d0\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\d0\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\c8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\c8\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\c8\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\c8\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\c8\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\c8\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\b7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\b7\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\b7\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\b7\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\b7\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\b7\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\5d
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\5d\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\5d\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\5d\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\5d\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\5d\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\b6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\b6\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\b6\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\b6\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\b6\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\b6\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\3f
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\3f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\3f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\3f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\3f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\3f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Web__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\2948e15e\283165e0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1339698970-4093829097-1161395185-1000\Installer\Assemblies\C:|Users|Louise|AppData|Local|Temp|R070161.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Louise|AppData|Local|Temp|R070161.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Louise|AppData|Local|Temp|R070161.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1339698970-4093829097-1161395185-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\2948e15e\3f29ba0c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5575181f\4874cbdf
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\25fd5cf0\fe3ad34
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\25fd5cf0\21bb12f8
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\AppID\R070161.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\AppCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\B730BBB
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1631eb85\6ee1e384
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_CURRENT_USER\Software\Classes\WinMgmts
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WINMGMTS\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WINMGMTS\CLSID\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Scripting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\WBEM\Scripting\Default Namespace
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Hostname
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\System\DNSclient
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Domain
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\ae
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\ae\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\ae\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\ae\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\ae\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\ae\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\5b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\5b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\5b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\5b\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\5b\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\5b\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.JScript__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.JScript,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727\WMIDisableCOMSecurity
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6f06001f\475dce40
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6f06001f\475dce40\c0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6f06001f\475dce40\c0\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6f06001f\475dce40\c0\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6f06001f\475dce40\c0\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6f06001f\475dce40\c0\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6f06001f\475dce40\c0\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6f06001f\475dce40\c0\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6f06001f\475dce40\c0\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6f06001f\475dce40\c0\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6f06001f\475dce40\c0\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\c2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\c2\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\c2\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\c2\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\c2\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\c2\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Data.SqlXml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Data.SqlXml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_CURRENT_USER\Software\IncrediMail\Identities
HKEY_CURRENT_USER\Software\Aerofox\FoxmailPreview
HKEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1
HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
HKEY_CURRENT_USER\Software\Qualcomm\Eudora\CommandLine
HKEY_CURRENT_USER\Software\RimArts\B2\Settings
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Power\PowerRequestOverride
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Power\PowerRequestOverride
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Power\PowerRequestOverride\Driver
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1339698970-4093829097-1161395185-1000\ProfileImagePath
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Environment
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Volatile Environment
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Volatile Environment\0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\Setup
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SYSTEM\Setup\UpgradeInProgress
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Safeboot\Option
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Settings
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\ActiveWriterStateTimeout
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\(Default)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\WMI Writer
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\TornComponentsMax
HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\CIMOM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssNeedsLoading
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\WOW64
HKEY_USERS\S-1-5-18
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_USERS\.DEFAULT\Environment
HKEY_USERS\.DEFAULT\Volatile Environment
HKEY_USERS\.DEFAULT\Volatile Environment\0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\RequiredPrivileges
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ObjectName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index39c\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index39c\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\c8\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\c9\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\c9\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\c9\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\c9\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\c9\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index214
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\ba\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\cb\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\cb\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\cb\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\cb\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\cb\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\cf\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\cf\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\cf\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\cf\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\cf\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\cc\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\cc\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\cc\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\cc\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\cc\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\ce\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\ce\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\ce\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\ce\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\ce\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\c0\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\c0\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\c0\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\c0\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\c0\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\c6\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\c6\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\c6\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\c6\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\c6\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\c1\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\c1\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\c1\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\c1\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\c1\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\c7\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\d0\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\d0\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\d0\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\d0\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\d0\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\bb\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\c8\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\c8\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\c8\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\c8\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\c8\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\47\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\b7\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\b7\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\b7\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\b7\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\b7\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\5d\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\5d\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\5d\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\5d\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\5d\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\b6\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\b6\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\b6\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\b6\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\b6\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\3f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\3f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\3f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\3f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\3f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\B730BBB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WINMGMTS\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\WBEM\Scripting\Default Namespace
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Hostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Domain
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\5c\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\ae\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\ae\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\ae\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\ae\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\ae\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\5b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\5b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\5b\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\5b\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\5b\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.JScript,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727\WMIDisableCOMSecurity
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6f06001f\475dce40\c0\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6f06001f\475dce40\c0\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6f06001f\475dce40\c0\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6f06001f\475dce40\c0\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6f06001f\475dce40\c0\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6f06001f\475dce40\c0\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6f06001f\475dce40\c0\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6f06001f\475dce40\c0\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6f06001f\475dce40\c0\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\c2\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\c2\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\c2\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\c2\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\c2\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Data.SqlXml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1339698970-4093829097-1161395185-1000\ProfileImagePath
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SYSTEM\Setup\UpgradeInProgress
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\ActiveWriterStateTimeout
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\(Default)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\TornComponentsMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssNeedsLoading
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\WOW64
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\RequiredPrivileges
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ObjectName
advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.SetDefaultDllDirectories
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
kernel32.dll.AcquireSRWLockExclusive
kernel32.dll.ReleaseSRWLockExclusive
advapi32.dll.EventRegister
advapi32.dll.EventSetInformation
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
[email protected]@[email protected]
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
user32.dll.GetProcessWindowStation
user32.dll.GetUserObjectInformationW
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
kernel32.dll.QueryActCtxW
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.GlobalMemoryStatusEx
uxtheme.dll.IsAppThemed
kernel32.dll.CreateActCtxA
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
user32.dll.RegisterWindowMessageW
user32.dll.GetSystemMetrics
user32.dll.AdjustWindowRectEx
kernel32.dll.GetCurrentProcess
kernel32.dll.GetCurrentThread
kernel32.dll.DuplicateHandle
kernel32.dll.GetCurrentThreadId
kernel32.dll.GetCurrentActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
kernel32.dll.GetModuleHandleW
kernel32.dll.GetProcAddress
user32.dll.DefWindowProcW
gdi32.dll.GetStockObject
kernel32.dll.GetUserDefaultUILanguage
user32.dll.RegisterClassW
user32.dll.CreateWindowExW
user32.dll.SetWindowLongW
user32.dll.GetWindowLongW
user32.dll.CallWindowProcW
user32.dll.GetClientRect
user32.dll.GetWindowRect
user32.dll.GetParent
kernel32.dll.DeactivateActCtx
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.GetCurrentProcessId
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipBitmapGetPixel
gdiplus.dll.GdipDisposeImage
kernel32.dll.OpenMutexW
kernel32.dll.CloseHandle
kernel32.dll.ReleaseMutex
kernel32.dll.CreateMutexW
kernel32.dll.CreateProcessW
kernel32.dll.GetThreadContext
kernel32.dll.ReadProcessMemory
kernel32.dll.VirtualAllocEx
advapi32.dll.LookupPrivilegeValueW
advapi32.dll.AdjustTokenPrivileges
psapi.dll.EnumProcesses
kernel32.dll.OpenProcess
kernel32.dll.TerminateProcess
kernel32.dll.WriteProcessMemory
kernel32.dll.SetThreadContext
kernel32.dll.ResumeThread
ole32.dll.CoWaitForMultipleHandles
user32.dll.SetClassLongW
user32.dll.PostMessageW
sechost.dll.LookupAccountNameLocalW
user32.dll.UnregisterClassW
kernel32.dll.DeleteAtom
advapi32.dll.LookupAccountSidW
sechost.dll.LookupAccountSidLocalW
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptGenRandom
ole32.dll.NdrOleInitializeExtension
ole32.dll.CoGetClassObject
ole32.dll.CoGetMarshalSizeMax
ole32.dll.CoMarshalInterface
ole32.dll.CoUnmarshalInterface
ole32.dll.StringFromIID
ole32.dll.CoGetPSClsid
ole32.dll.CoCreateInstance
ole32.dll.CoReleaseMarshalData
ole32.dll.DcomChannelSetHResult
rpcrtremote.dll.I_RpcExtInitializeExtensionPoint
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
cryptsp.dll.CryptReleaseContext
advapi32.dll.EventUnregister
bcrypt.dll.BCryptGetFipsAlgorithmMode
ntdll.dll.NtQuerySystemInformation
cryptsp.dll.CryptCreateHash
ole32.dll.CreateBindCtx
ole32.dll.CoGetObjectContext
ole32.dll.MkParseDisplayName
oleaut32.dll.#200
oleaut32.dll.#2
oleaut32.dll.#7
oleaut32.dll.#6
kernel32.dll.CreateEventW
kernel32.dll.SwitchToThread
kernel32.dll.SetEvent
ole32.dll.IIDFromString
kernel32.dll.LoadLibraryA
wminet_utils.dll.ResetSecurity
wminet_utils.dll.SetSecurity
wminet_utils.dll.BlessIWbemServices
wminet_utils.dll.BlessIWbemServicesObject
wminet_utils.dll.GetPropertyHandle
wminet_utils.dll.WritePropertyValue
wminet_utils.dll.Clone
wminet_utils.dll.VerifyClientKey
wminet_utils.dll.GetQualifierSet
wminet_utils.dll.Get
wminet_utils.dll.Put
wminet_utils.dll.Delete
wminet_utils.dll.GetNames
wminet_utils.dll.BeginEnumeration
wminet_utils.dll.Next
wminet_utils.dll.EndEnumeration
wminet_utils.dll.GetPropertyQualifierSet
wminet_utils.dll.GetObjectText
wminet_utils.dll.SpawnDerivedClass
wminet_utils.dll.SpawnInstance
wminet_utils.dll.CompareTo
wminet_utils.dll.GetPropertyOrigin
wminet_utils.dll.InheritsFrom
wminet_utils.dll.GetMethod
wminet_utils.dll.PutMethod
wminet_utils.dll.DeleteMethod
wminet_utils.dll.BeginMethodEnumeration
wminet_utils.dll.NextMethod
wminet_utils.dll.EndMethodEnumeration
wminet_utils.dll.GetMethodQualifierSet
wminet_utils.dll.GetMethodOrigin
wminet_utils.dll.QualifierSet_Get
wminet_utils.dll.QualifierSet_Put
wminet_utils.dll.QualifierSet_Delete
wminet_utils.dll.QualifierSet_GetNames
wminet_utils.dll.QualifierSet_BeginEnumeration
wminet_utils.dll.QualifierSet_Next
wminet_utils.dll.QualifierSet_EndEnumeration
wminet_utils.dll.GetCurrentApartmentType
wminet_utils.dll.GetDemultiplexedStub
wminet_utils.dll.CreateInstanceEnumWmi
wminet_utils.dll.CreateClassEnumWmi
wminet_utils.dll.ExecQueryWmi
wminet_utils.dll.ExecNotificationQueryWmi
wminet_utils.dll.PutInstanceWmi
wminet_utils.dll.PutClassWmi
wminet_utils.dll.CloneEnumWbemClassObject
wminet_utils.dll.ConnectServerWmi
wminet_utils.dll.GetErrorInfo
wminet_utils.dll.Initialize
oleaut32.dll.SysStringLen
kernel32.dll.RtlZeroMemory
ole32.dll.CoUninitialize
oleaut32.dll.#500
cryptsp.dll.CryptHashData
cryptsp.dll.CryptGetHashParam
cryptsp.dll.CryptDestroyHash
advapi32.dll.GetUserNameW
kernel32.dll.GetComputerNameW
kernel32.dll.GetEnvironmentVariableW
kernel32.dll.CreateIoCompletionPort
kernel32.dll.PostQueuedCompletionStatus
ntdll.dll.NtQueryInformationThread
ntdll.dll.NtGetCurrentProcessorNumber
kernel32.dll.GetSystemTimeAsFileTime
user32.dll.GetLastInputInfo
shfolder.dll.SHGetFolderPathW
kernel32.dll.CreateFileW
kernel32.dll.GetFileType
kernel32.dll.ReadFile
kernel32.dll.GetFileSize
oleaut32.dll.#204
oleaut32.dll.#203
kernel32.dll.GetACP
kernel32.dll.UnmapViewOfFile
kernel32.dll.FindFirstFileW
kernel32.dll.FindClose
kernel32.dll.FindNextFileW
oleaut32.dll.#179
kernel32.dll.LocalFree
crypt32.dll.CryptUnprotectData
rpcrt4.dll.RpcStringBindingComposeW
rpcrt4.dll.RpcBindingFromStringBindingW
rpcrt4.dll.NdrClientCall2
cryptbase.dll.SystemFunction041
rpcrt4.dll.RpcStringFreeW
rpcrt4.dll.RpcBindingFree
vaultcli.dll.VaultEnumerateVaults
ole32.dll.CoCreateGuid
ole32.dll.OleInitialize
ole32.dll.CoRegisterMessageFilter
user32.dll.PeekMessageW
user32.dll.WaitMessage
vssapi.dll.CreateWriter
advapi32.dll.LookupAccountNameW
samcli.dll.NetLocalGroupGetMembers
samlib.dll.SamConnect
rpcrt4.dll.NdrClientCall3
rpcrt4.dll.I_RpcMapWin32Status
sechost.dll.ConvertSidToStringSidW
ole32.dll.CoTaskMemRealloc
advapi32.dll.RegisterEventSourceW
advapi32.dll.ReportEventW
advapi32.dll.DeregisterEventSource
samlib.dll.SamOpenDomain
samlib.dll.SamLookupNamesInDomain
samlib.dll.SamCloseHandle
samlib.dll.SamEnumerateDomainsInSamServer
samlib.dll.SamLookupDomainInSamServer
samlib.dll.SamFreeMemory
samlib.dll.SamOpenAlias
samlib.dll.SamGetMembersInAlias
"{path}"
C:\Users\Louise\AppData\Local\Temp\R070161.exe "{path}"
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
C:\Windows\system32\lsass.exe
Global\CLR_CASOFF_MUTEX
nNZORIFQNHkZmOpy
VaultSvc

BinGraph Download graph

PE Information

Image Base Entry Point Reported Checksum Actual Checksum Minimum OS Version Compile Time Import Hash Icon Icon Exact Hash Icon Similarity Hash
0x00400000 0x004ad8ae 0x00000000 0x000bfe48 4.0 2020-06-04 17:56:10 f34d5f2d4577ed6d9ceec516c1f5a744 22fa9cc1567d93cae3cd037c60282da5 be45f8ac3e168e3b718f7b3403548845

Sections

Name RAW Address Virtual Address Virtual Size Size of Raw Data Characteristics Entropy
.text 0x00000200 0x00002000 0x000ab8b4 0x000aba00 IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 7.87
.rsrc 0x000abc00 0x000ae000 0x0000a6f0 0x0000a800 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 6.36
.reloc 0x000b6400 0x000ba000 0x0000000c 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 0.10

Resources

Name Offset Size Language Sub-language Entropy File type
RT_ICON 0x000b7be0 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL 4.30 None
RT_ICON 0x000b7be0 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL 4.30 None
RT_ICON 0x000b7be0 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL 4.30 None
RT_ICON 0x000b7be0 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL 4.30 None
RT_ICON 0x000b7be0 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL 4.30 None
RT_ICON 0x000b7be0 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL 4.30 None
RT_ICON 0x000b7be0 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL 4.30 None
RT_ICON 0x000b7be0 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL 4.30 None
RT_ICON 0x000b7be0 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL 4.30 None
RT_ICON 0x000b7be0 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL 4.30 None
RT_GROUP_ICON 0x000b8048 0x00000092 LANG_NEUTRAL SUBLANG_NEUTRAL 2.38 None
RT_VERSION 0x000b80dc 0x00000426 LANG_NEUTRAL SUBLANG_NEUTRAL 3.41 None
RT_MANIFEST 0x000b8504 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL 5.00 None

Imports


Assembly Information

Name mcHElSpfLvoBbuEl
Version 87.4.0.0

Assembly References

Name Version
mscorlib 2.0.0.0
System.Windows.Forms 2.0.0.0
System 2.0.0.0
System.Data 2.0.0.0
System.Drawing 2.0.0.0
LopRfArQtmSGYrpggstZqheNvTXK 1.0.0.0
Microsoft.VisualBasic 8.0.0.0

Custom Attributes

Type Name Value
Assembly [mscorlib]System.Reflection.AssemblyTrademarkAttribute Best Assistant Education Online Limit
Assembly [mscorlib]System.Reflection.AssemblyCopyrightAttribute Copyright \xa9 2018 Best Assistant Education Online Limit
Assembly [mscorlib]System.Reflection.AssemblyProductAttribute Edmo
Assembly [mscorlib]System.Reflection.AssemblyFileVersionAttribute 87.4.0
Assembly [mscorlib]System.Runtime.InteropServices.GuidAttribute 34e6a87c-bca2-4ac0-8b5a-ddef73345f
Assembly [mscorlib]System.Reflection.AssemblyTitleAttribute Edmo
Assembly [mscorlib]System.Reflection.AssemblyCompanyAttribute NetDragon Webso
Assembly [mscorlib]System.Reflection.AssemblyDescriptionAttribute Educational Technolo

Type References

Assembly Type Name
mscorlib System.Reflection.Assembly
mscorlib System.ResolveEventArgs
mscorlib System.ValueType
mscorlib System.Object
mscorlib System.IO.Stream
System.Windows.Forms System.Windows.Forms.Form
System System.ComponentModel.IContainer
System.Windows.Forms System.Windows.Forms.Label
System.Windows.Forms System.Windows.Forms.PictureBox
System.Windows.Forms System.Windows.Forms.Timer
mscorlib System.EventArgs
mscorlib System.IO.StreamWriter
mscorlib System.IO.StreamReader
System.Data System.Data.SqlClient.SqlCommand
System.Data System.Data.SqlClient.SqlConnection
System.Windows.Forms System.Windows.Forms.Panel
System.Windows.Forms System.Windows.Forms.Button
System.Windows.Forms System.Windows.Forms.GroupBox
System.Windows.Forms System.Windows.Forms.TextBox
mscorlib System.Resources.ResourceManager
mscorlib System.Globalization.CultureInfo
System.Drawing System.Drawing.Bitmap
System System.Configuration.ApplicationSettingsBase
mscorlib System.Runtime.CompilerServices.CompilationRelaxationsAttribute
mscorlib System.Runtime.CompilerServices.RuntimeCompatibilityAttribute
mscorlib System.Diagnostics.DebuggableAttribute
mscorlib System.Diagnostics.DebuggableAttribute/DebuggingModes
mscorlib System.Reflection.AssemblyTitleAttribute
mscorlib System.Reflection.AssemblyDescriptionAttribute
mscorlib System.Reflection.AssemblyConfigurationAttribute
mscorlib System.Reflection.AssemblyCompanyAttribute
mscorlib System.Reflection.AssemblyProductAttribute
mscorlib System.Reflection.AssemblyCopyrightAttribute
mscorlib System.Reflection.AssemblyTrademarkAttribute
mscorlib System.Runtime.InteropServices.ComVisibleAttribute
mscorlib System.Runtime.InteropServices.GuidAttribute
mscorlib System.Reflection.AssemblyFileVersionAttribute
mscorlib System.STAThreadAttribute
System System.CodeDom.Compiler.GeneratedCodeAttribute
mscorlib System.Diagnostics.DebuggerNonUserCodeAttribute
mscorlib System.Runtime.CompilerServices.CompilerGeneratedAttribute
System System.ComponentModel.EditorBrowsableAttribute
System System.ComponentModel.EditorBrowsableState
mscorlib System.IO.MemoryStream
mscorlib System.Byte
mscorlib System.UInt32
mscorlib System.AppDomain
mscorlib System.ResolveEventHandler
mscorlib System.Runtime.CompilerServices.RuntimeHelpers
mscorlib System.Array
mscorlib System.RuntimeFieldHandle
mscorlib System.String
mscorlib System.Math
mscorlib System.Buffer
mscorlib System.Type
mscorlib System.Reflection.MethodInfo
mscorlib System.Reflection.MethodBase
Microsoft.VisualBasic Microsoft.VisualBasic.CompilerServices.ProjectData
System System.Media.SystemSounds
System System.Media.SystemSound
System.Windows.Forms System.Windows.Forms.Control
System.Drawing System.Drawing.Point
System.Drawing System.Drawing.Image
mscorlib System.IDisposable
System System.ComponentModel.Container
System.Windows.Forms System.Windows.Forms.FormStartPosition
System.Drawing System.Drawing.Font
System.Drawing System.Drawing.FontStyle
System.Drawing System.Drawing.GraphicsUnit
System.Drawing System.Drawing.Color
System.Windows.Forms System.Windows.Forms.Control/ControlCollection
System.Drawing System.Drawing.SystemColors
System.Windows.Forms System.Windows.Forms.Padding
System System.ComponentModel.ISupportInitialize
System.Windows.Forms System.Windows.Forms.Cursors
System.Windows.Forms System.Windows.Forms.Cursor
mscorlib System.EventHandler
System.Drawing System.Drawing.SizeF
System.Windows.Forms System.Windows.Forms.ContainerControl
System.Windows.Forms System.Windows.Forms.ImageLayout
System.Drawing System.Drawing.Size
System.Windows.Forms System.Windows.Forms.FlatStyle
System.Windows.Forms System.Windows.Forms.FormBorderStyle
System.Windows.Forms System.Windows.Forms.AutoScaleMode
System.Windows.Forms System.Windows.Forms.TextBoxBase
mscorlib System.DateTime
System.Windows.Forms System.Windows.Forms.MessageBox
System.Windows.Forms System.Windows.Forms.DialogResult
System.Windows.Forms System.Windows.Forms.MessageBoxButtons
System.Windows.Forms System.Windows.Forms.MessageBoxIcon
mscorlib System.Exception
mscorlib System.IO.TextWriter
System.Data System.Data.SqlClient.SqlDataReader
mscorlib System.FormatException
mscorlib System.ArgumentOutOfRangeException
mscorlib System.IO.PathTooLongException
mscorlib System.IO.IOException
System.Data System.Data.Common.DbDataReader
System.Data System.Data.Common.DbConnection
mscorlib System.IO.TextReader
System.Data System.Data.SqlClient.SqlException
mscorlib System.Int32
mscorlib System.Boolean
mscorlib System.Char
mscorlib System.IO.FileNotFoundException
System.Data System.Data.Common.DbCommand
System System.ComponentModel.ComponentResourceManager
System.Windows.Forms System.Windows.Forms.ButtonBase
System.Windows.Forms System.Windows.Forms.ScrollBars
System.Windows.Forms System.Windows.Forms.BorderStyle
System.Windows.Forms System.Windows.Forms.FlatButtonAppearance
mscorlib System.RuntimeTypeHandle
System.Drawing System.Drawing.Icon
System.Windows.Forms System.Windows.Forms.Application
System.Data System.Data.SqlClient.SqlParameterCollection
System.Data System.Data.SqlClient.SqlParameter
mscorlib System.Random
System System.Configuration.SettingsBase

!This program cannot be run in DOS mode.
.text
`.rsrc
@.reloc
}]K#f
R_RVp
~HOTUoy
1a"C<Y
27=8e
>en9y>
C*m 6
b>|xwww
HNcr=G
QG72U
!m\Wx
R$|2b
?0JR+
0zIf'>
IGhS;
0QxQ!
;'HMQ7
*UV3?q ^.,&
EJ!v>
T YpYR-
TZ*n)
ypu1Cz
=U)]2q!w8
.\HF^W
f}a`?
^{7*`
Z5j8k
2?7([c
E6E{%@
)'/D9
k[7J*
TQLeu
gSufa
[bQ$=D
KyeJv
(h:|'
q+}V.I3
,ll?!
~v;k.
mF4xC*
p:|%&
hin|aYy+
B]TLfi|f
QM*\~
bQ =A
>8+ID
B5of0[W1
N_ >~
tn[YI;
V "T>
p[x^F
tO$JH
J{UNzkz
PVU0s
6`AhP
dyOB5
i8(w^
d2~4M
3n5A>;
w!,y!\o*
vAUS:=F
:gkb3\
<8Wz5
c5h3E
{&?in
7uz{E
x"UV'
+.H9)
EseZO
|5VSw
q<U{YPy
g),("
W%zLL
{u6]'+
f!/}c
\K9?z
=^_$W
^)QFx
-raDJ
FraAB
Bd#Ei
&fA<s
s2kiY
kv#^a
!rI}k+
yRh*1;
dEMWQ
'u8IX*
MiRe"
Or9|6qI~
f/3m5
o&Yt;AQ_
qhQlvgR
:/42O
y+}M48O\
*F`7c
,qn;5
"(xc,
NrAhl*
$\_C*
ZlNE/
K0S=,qcf
AQxuc
A*)5F
(2RXI
iq!SL
<'w3)
)gj]r
`o2yn
T<C'S
B-4p7
|i-cH
C*x87
}xG<K
g[!MsZ
aKSXJ
"^gfX
e;aWR
^zpK2
msH'k
=T|CBIh{!U.\
Ki9SO<w
F1T~l
w#&SM^7G
!ixK;
=-SWM
Ah(WV
mx7sJ
%B]I$
h6:dH
}WngP
<n~6_
>c$lL
hrBmU~?nh
.?DaQ
THb\{Q;
Ad W(9G5Ut
x+_<D%
~H>69d
K904<V
/kva?
5v#v5
pK|7t
9Avmx\
Z9A23
:*I/F
@M-V~
$ am(z~
O{f ;
*?%L2
-yTPVn
w'L]
6<@L!{3~
kzFA?
-ABye
dIi6x
O&=]~
Iz9Cx
eckV/F
3+i`uI
BYZ<%
U[*SX
u4z#m-pn
++OM=
69:=H
j"#|t
b.TZf
)}lB9
TI<Rq
hwDAk"
5>bX8
u-[k8u
YB"2w
EyAe+y
~Tm:(
L>kmTL
$49"|
=4,(xg,
I,p9T
5x12b
p\s1m
T~0U_z^k
+DK8{
ja7(4
b1~5c
"sej*a
j?'#>{
{2Ze(
Qy(6w
oeNR,
arf1\
Ok5L,(
72!yd<
1e8W~
8hy~-p
(:~t9?I
b#B}B
_?FS*
(.aLv
NeLP'<
6<n>J
`h:rh
AQc\8
|D&>q
Aua^N
zCC^;
vIA7&
B(:Cf<
;ey57
p!+:*h
H7qKi
v|oMT
vsc6W
c>fI)9
n~DVKx
k cXG
2CfHr
3 ?O^J
<~gTO
]@gAV
)!1bj
@`iB0
w8$F#
:<L8
Oz3T#u
n"!l9t
_+8_m
0%uDM
~AHGnb
u[2xyZYe|
EKbxh$
.+"n]
MLvZ3"
+=M+E
a?q3*
TAXw9
x;br9
y=.Ip
sD"k]
M{Py$8
rsmsp
&_!Y,-
\H4&1
$6L}\
7\<%U
[5OF`
v1fl'\
(U.hY
(]9d[
GlpL
K]B"d\
;79+<)
ba6+V'
%bLq8fP
l$S:q
vzd+pI
Ki+3>
Og3ne
z+l`;
*8(ot
G\C._
Y7m`\
\DEPH
w}6\u{
\S>QQ
!h&wO0
93]gP
M9e]~F
V?`_pAt
F!jd#}
]Q<}*u
+3-r}*
oK0_Mr/
fc^OwkZ
*l4p\
/(Jp3J
AF%jD"
#$X$f
V"33]
P\SJ1
;Z=67Aq
Ya;TN
5cII,
WsXAp+
5}H]q
k_/{US
/*E???
-uD_>
h[akg
8Q9Br
t-`q
WyL?s
LF0QG
Jb7g*S
Pv}c;K
gmD|E;
X]/6x
Pjdty
jB\X{sa
T1;&||r}
itby`W
0&Kc!
]Ld25
<^_EK
G~%;R
QEZ<lQ
)PQ{w
|;0jcs
~Q]WbG
Zqn9k
tGW^ay
LoM)Z
kfx*u
kFfEw
DF+D5M
:;UyG
wwuSU
hRKWO
tM-1W
xb`BkwdZ
5}xV, H
3f5g'
Ky+ur
eRf)Tu9
&6hU;
brG]L
>f^GAj
'lwea
/I>zcA
*st3_&
fJBe2
iI^'F+
{ j3D
X|~pR78L>/?
ukuc7WNH
`vA$s
$Q:_}>
3z^.[;K&a=
mSoD2
Qo+H$
Ee/&^
Vy`KT7
8PGN^V~-
#~VtP
7s80T
l;>)J
m<oTn25I
90{7f
fu^)l
#a~23ih
.[4V ^?
M`d`(U
'ea:9
Koz#jj
3M(Wu
:)&hw
JbC13z
E6wY3
7FA\-a
p_8Ot
],t_^PL
>P/Jt7-H
?`>bwE
-\v6D
6/yr~OC
f9ZI`Ack'
lL!_G
_I4|4u8
@ ,F)
_*k`,
UX~&=
I~oYK
G&D:+
sqp42
X^Nuy
8:Hmi
%%HjhJ
W)4:S
-:b`X:
6S|}a
U]ORu4
-RP^u
-#_ Rq
(z\#R
}inqT
|FCKQ
ILWtRL
;jAUA
[B^f.
nst>h7
uWwxqt>2:9
;xdu_f
O>nR}
32#S=
%K23c<=2
+DN=z
arIrF
C%b^7b
X/fHo
Ks&j-9
^M/m7
d`$|N
Z3Faaw2f
tfb*96
1}cH.!
Eg4t<^?-
6]H?o
x_x5J
NfSV=
"9}`Sq
6x4V50
w]My
qn x~8
!U0Z#
ka9Ya
Lxr(;
74SN=
obdi,
F<5CW
qX!l8
_iZJp;0
qubO"YR
$VnFJ
l$1oSh
:9me7$
R_,rg
L<ta8
PUhn'tR
()gOZJ'
pR6y}
x5| ?
ogr)l
Y'Zo:1P
|jKx0
'4QzM
/u(LY
__R(f
iN/Xz
~ZAeK
pR*Dp
DdMi2*w
El?c0
L^Q !
ot"bv
UBTpM
:33H.
en`3WN
/x6dx
r?kVJ|w
k[i,)L
#[C=F
T=br1X
q=E}z>
WZeL<C
3OZ7w
}@7(%:
}c(no];
"K'&Y
feOW%FU4
*KMl&
c^a}{
ooG/v
^L)xM
&>NGV
qiLw*
#w$uow
<MS\G!
fUL\;+0
Y?E"Q
=(5?e
f}`41
&}sT{Nn
G*+*^
=:b)0
z[=JU6
"""if
/v3V4
n|0ts
CcDeM+;
sQ]G`w'
z:Vw"
oK;^!Z
V#m.3a
CvBt}qu
l2nL7
{*(||"4
Xzppa;n+T;
J+;^n*[n
7+ORs
!LNp6/
Ou> !d;
t6SHb
{%%}&
H<H;n
,z$_A
wkNh
TgEbl
OvdPR
k>;;Sa
+"oFw!
qPQ_?
AU+tM+
~r{a/
i:>YC
1j1^=
Cq`s]J
9'$H:
q>UeL
\F^]'
1#De3>
Ja0]c
JcCa&AOG
cZvG3
1njpm
s^f*3uA
S]hcw
j`'V,
<UraL
mzowkgO
dfU#'|
#Z3*~J
,L9[1
=v/se3n
tiSq).bi
Dc*}-
klc68/
T5Q"_
<Exu9
7lGz!
#/R#!>
u+[3k
u.+$n
':Kfq
#D4#u
\+d)"
#2tYok
l%/yZF
+/Of|
2{2;v;!F
S\=zMi
2zyTVq
;`HpA/{t
Mre>~
qVMI`:
x7X7?
r#}t$
c5_XO1
I,,'B,
Dx|}0
M{I8O
AjFywY
H=YhWN
g&h{F
4B{u8
<rf\7
kULz`E
c0^"\p
M`b1<
xfN_
U[Ywx
B]<HE_
n"q5i?-
q5o~$
=*Q&2P?_E
,q+k{
S)&v/
njl]g}
X{<|o+]
.|!~%
g<a%z
u);i9A
OVQR9{
y#|?<
Yd9uE
Nw*jW
-Z8H.W
.VrA3t
i6CEe
K(5pC
IyLxgp
0QT&o
K'Ayu
A bPNC
|b'nBX
oZnd?
j3Uj}
!K~Mo
68=;RW4BV
dCpp?
fa?Ju
:c*Br>
-__}<u
}O[np `
7[8#V7I]
v!i`d
OcHB1
^K4~!;
A+#\1>
:'+#(
N({2}
- C|p
q-y3W(
TqN(e,
pt>G7M
Qwwc9
jhbkm
WB]9y
*_E2I
[=lXC
%9>$oouQ
AKR#t
[sc^@
W<3^`
9Jx*=+
=,-ww[y
w,|3w
FA'//
2>nW6o
nQ*8I
hd\<N
8G,(:
-npWiz
\)*U"
OH9T%
/JaGzE
Fs[Ad_
wkL^Rr
WLKPFl
1x4sX!
dUnh#`
+/*v#
</2iLxGp
:8=(Z
<}7Bo
HP[}*U
dUZva
5GA<(K_%%
@.m::
\CCa<G
f}H%-
dsz|vsg
E.=xeQ
/_i4G
KF]sSJ
DE-c$*x
7<!f}
?/4n::T
fv_;o
Sy#-s
h-&;IH)
W;ZExCf
?N.JR
QW5Q|
1`Q7.
8MoN=^
_65u.
s]n(C
#By&Z)n
=W~YB
wp!11
l6*DO
4=47+
U< !6k
j>qxH
^i6_X
8383G
YnrSY
oF}@*?
dj]91
MbOTR
-]f_+
kmI?=
eah|F;$
TgYqc
d_XA|
=Yv%D
)@D;(
Z'"!~
]/Kh]Z
Q')`Q
L9k0Nh
$;)`.
_PzOq
gbMZro
f_=R[
epISD:qKM
$p_il]
LmtY4
G#if/
:CJ<_
>Oh3'yM
m,Qu2h
Ykb2g6
JJRZD
9ntu{
nH=VPl
`G~vk
m*krf-
9?)#`
UjEkE
|j=OjlO
E+Q$\_&
V`=IC
I7-xb
H<1Hju
GtX*+
]8-I}8
O3N.R
{(g"(
o~yZu
jXtm_
+pP^8
M(|YCMF
T;R[6
{G'-S
G,:%8
du_?&
h'RTV$o
(biG-C
P /^c
~^R(1
xlPJ?
c}>`]
f8I&-t_rq
t^c)H
M8NKy
:O#\]
54]q;@M
gAJ3D>e
?=;G6
Am(VlK'
JDPCH\
5t?,J
.j<p?
VmF%}
"l.ja
^x**=
jeguT)R[
"'Q!WL
m$PNy
!(2Vfjp
|c;6n7
"6]u1
Iae9j2
jcLy,(
v/RO^
V:-_mb
#Q(`>
kydwV
+K1CfA
5LusV
FRg7!
my2Rn
SNj-V
:K4v^
kL\t8
"^[5+
]d.1.[
\G+02UcWM
Yz#D\9h
'uXFvfq
29-O-
$cDH(
gl&)N
.#q3c
TA3W/
M~[{$S
^e1bD
1c0A5i
#Jg=1
=5($&]
Pq8h-
B_ezPU
WUPKI
maqB5
>X6"y
?.)_X
]cOD,
jnP>/a
s$u"\
"*}Z);
wPMW7
qThH9
1d33T
R"H_I<A
/*>~TaO
R=Bd,
19K^C
Js5f_{
!]fJj
6> kT
{o*!p
.Gdu{r
i!A&GX
i Q"!
~]@$BS-i
4.-7[
+2H4<
u/=<l
#iYMIAY
k*ohN|
*Xjk6
uB}y
xJB3LSw
Gm$z9
T9?5$
+v^~A
$jm%V
[)`s|
u>Oun*
_[/@f<E
<.Af#
vbs6`
Ty#9B
j`hrZ
Oim17
M(4U3
S5<]D
ab*[:Y
/{t:\r
v_3CW
<k0k4d
dh1>q
eBb9J
qe|&EK
"fFdr
%p-_x5S
g#x~f
P"G|N
na%WO]
k2jpL
9gF#r
$R&?r
">{ksq
MH0d[
^s\0c
'?lAK
pk10\
klwE/
2)Y>=
K:sE`
2(XHn
^h'MS
OX`@:
{}eVQ
F\PC:
Eu`sK
6]G^K
0plb
VhlOu
YqGtlK
eK{1<i
KxUan
_El-e
@4l&QgP
LUqnd
!!qc3
~ur?*O
DqN(K1
X_\vB
_e0.?
J YKjl
3Q*""X
+^_uc
~;W]3R
|ZG-G
0/mV>V
RhA?8
YD:|*Z
H&FLb
MZ2yc
V=B=WA
K/Tpu
*6"AK
Z-h:e
-#^,B
73BRcc~ 5
n<7i'
-")rx
zOray
{s Ip[
/wa/x
f<?<%
\!q=_
/I:.h
-)Q/q
{U~nl
3;=s{
O2.Ezho
v|>~y
D{1L>
Y%uKJt
:u(&[
=r<){
}9[t~
0%wo`
@/R>7C<
{*8`a
Lgnqh
2 q5v
B mC8 Q
'y,02
jBMKO:
pX13):
u,CAQJ
48< }
*+1W>2
Z!p-y=e
#sv6a9
5ev)\
yyX_6
/29r'MGrq-
Q6~To
%-.N[m
QEwL&r
!k4)<
?~U$g
Ssc[u
"p`3k
(%jqj
w6lK!
Ek'%<
:p?,0
v^\Y*
voY]j
qN.tq#
y2kSvW
]]5& c[2
d~+tQ
??eQy
P3|F1
K&p]1.fI
&f4C&
qlM^a
;zG?A
[c+zz3
Wq[SE
aLj\W
T,ds1
ktMpH
BlE:6]
K&opb
3UD2G
Da4CvB
8AJ}~F
`|t?b
)c/9U}
v']^/
^E)fJ
Q`nMF
c54qn
&\r<'w
G6E Ki
B\8ur
RIlFl
hvBe$
;IOGi
0^%L>
OHA<:o
U`]6%<
z3i/u
Q+B+M
/yTzr
0|ql5K9
<9oVO
yUd".[2
[~%#Yj
!"<#a
Rvm""l
0ZxI<
;4jqj}
Cvp7(
Y0WbS
ad7iX
i$EU)>`=}u
L1:PS1
/1RlD
n[ZN4
+j~2aA
TR$h/6
9oQ(s
%=c7Z
1<jnv*
:db^'
Tmxbt
9/yHD
Bj]DAL
Ajtil
Vv*i-
W;sa9
$%.<{
H.z8a
=~Bhxl;R1'~2
lg|_8
=v6$
3\)dw
u F8OQ4a}w
.q%oc
fRe-6
r^?Jx4f
akQ4`
$U6+j7
_3#DR+u
"&~024
!~l=Pn
[<hh.
59yiSf
RDl;@
gsa9G
P+MIt
mz"a(
8%0?|
0v/+^r
ymrdh3
(Xc ?
i!Yh/g
E&fIE]
:t>\_
VGc\Z
x#a&Tn
ljk.x
@Kxo(
(5.f%m
&z-%0
_`!Pb
g\yac
sDHIV
a(,*3_
cCj8j
n R&r
^9fP^
QVSc*
64I]&
u.+em
A]c9D
L)}?z,
Z2,W5
p1t]c
lZNXX
laRFt=]
G4aZ*
eN=98
OSNGQ
='5wMj
5%pX_
%cw84
qXe{,
b)/p7O
uY{if
3Zl/d
})T>pa
~$:A<
06z`A
>8jS;
|dXn0=
gd$%LY
E R,c
<1HS&bm6
l^N9jK_
SPPlH
B$ui|9D
;,!nVJEY
,5Yh^
P;R%I:
^%w%.
%3^|B
2Ref^
@K(*B
Kyj9-<0
{tE0\
<7m8?V
^!mPq
S|Vi8
R{ep?
!=%V{x
m2Ji"M
SV8u,
/*m]
.C7 o
qM_uQ
S!FNF
&UYf;
LQ*lN"$
^sgJY
-EY\1
cmTp#
)upJA
MOM!9
K)vXb
-K(k|;F
o'CeZL
1>)"
3GDm.
(e3*&C;e
{1giO4[qLG
fxeFGa
tyR&n
vyDu$<
"o3Vt
[x16PV>
z,ei
XXv2^(
}Qw,!
oRg=b
=JjT YCw
O"~E6
0#XA<
7$kqz
]x*Wy
e$1T9
|LfcD
OdR:'
L86Yb]
~1Tk(
P%}fiF
OMcCc
ngQ[f*qax
AVn]V
ha1dX$A
i#QDye
dp%SP1
i6eIVV
1,}BD
&ay2V
9;-iG
PpTmN
L_w+`"n
@U:r^
\O&jP(G
x=w&X
L0cpv(~u
k=V]n
hq=%-
{gtc%
&X!/V^
jvTt{D
Ov,mHr9
sjB%/
>Z'cQ
jNd,>B
SE[Q~
t%]mo
XTbfm
Xz!>SX~{
%jL!)
qMvdkHf
ApRz'
tS2-v
CN E{7
e#Jir
@*GDL
Pt;R3w
VRq/$
*0Lt6
OW:YW
G$QO?^r
m6e0O
AG}|^y
DN:df
L{xE<X
aGYwVk
"|[LP
C~;;}
k#bvm
(D<).2
B&ng0
@`rQ(
GNxY&1~W2
CWDw!q
/uuSvI
"KAJI
+$\H:
eg*uS3"
@+6#0
O?9qP
5;umPNW
pGkd3
T` =[J`
"I1`'=(D
x(&7/
AH-{Qu
^DHCR
xIZl{s
nY`D.
}70KNP
$vnu"
CUb#?Y
jD4iid$
+J`97
B2k,db
;r&Ye
7h\~ZB
E[^C.Y&
`)P\T!
F.!ZO%
F^H),x
)}JjL
N0*)\7
YoZYG
2G'm\3
g3^pa
x% HD]
^8X|!<
/2g&d
\#&R[
cz;$w
1.6Ct
v;2L=71
HCCdms
W*K#ElNrN
hbiN6
PC2;#
6K_-3
\>i>B
HWMzd
fKZ;?r
OV^qf
fOW%w
$4}Zu~
3]pawq
xA1kG<
m,PCV(
9v'XS
g!6;t
\T<:#
U=_9&e
<(D"3,
Sb=R"1
\BX8##
qhq{.hu
_j)|7
oFtftq
lzDu`tu$
\`(vD
3Q?`n
r3t5e
r8R.wg
Mx$!Z
FO]PY
/E'Y3=
^;h61
CF7.h
_h75; a
8RbJH
nFP$b
-t#1>
*~L,e
(!Yco.+
yZD^M)
J#h>[
<L29kc
VC-J(
}F51O
D8pq$p
I%QS9
\<~v/
}z?zD
#!-N~!7C
h}Rd=o%'
>`>xm
MHJi5
{J8N?:
=s A1L)
5t%&F
.`uw3L
mD.LL
ob</d
/4|?;
sbphe
<58jr
iUiih
DaSVZ
qHqTaf}
0KF';O
2aP*(
L*%7x
2n):6
DlVKZ^
u0b\+
b%\|a6
>^W_<
=uKzt
3eNQG
M:Ol
[_XY6
!'!f>Xy
fJCo{
LUACi
3-5JE_
`0nC&
YdR3uj&%
!8(g(,
k^)nlo
bM8C10m
DDM3b%
"KM2U
J46bZ
(c#Y(-
X]DDX
T[mFLu
=xSp}
M5V$)O&4
Dp0-\
{U$+a
Y\L-7`
!/Mu=
m=zYEfe
dw_xY.
>%&%
~Q_{6q
p;DP3
8W|Sc,o1
i3Zwzw
Mf,4)
-gsk#
zaen_\b
&RyFq
[" Xj
AU%$2U_
9D1a!
i;tUw
e{K`%P
;\'L(
Ly83
S-=\?,
["FKLr
}z~?C
L[,X3
6iV>9l
2yF .
^&h|$
"Q|r|c}\
=Zijd
h=^rW
r,Y,q
.PX5f
B#[KF
+whe7
In]zFM
a U#v
@ZD
7-u%9
vb^J`#>Re
xq::&
(f$nm
'GgGP
Ec0#[
~!0RO
'8ZF#
4;4-+pErt
n:ukH
AVOA#
2XlX!<
l/qNij
p/EKc
qFxc&}H
FzmBh
_p4kD.t%
A|m GT
)H(I"192
`YplN
z/1ja;(
Yy.4f;^
iA\9Gyn
BfOR.o
341Y_
5_\<BmC,
1*spF
?d0f9
s (of
h{uf1
mYa)(
2$QwFyP&_~
hOjR`
QD?;*
Go<)D
|yw/4w
e%>k'^F
L&G2
-=Xbe
A-=%W
+Ew}?
oNp9Y
rzr-Z
JdQ+0
d]!/X
<>7mCr
EMc>#
(FdMOo
Hw'%T
t;6\9gJ
J?1^c
M2,&n2T$F
=:PW4
^t9\l
<8gQr>
a/a5C
)[Elkj
x=eVn
3-=4C:T1
s!v[*
(B#49
8l~H>\2
U_:lf\
t##[0
25|x4y->
!ZPJW
9M#GPr
go: VA
ptb?b\QL].
JlzDD
0fg)v[
(13kA
qn#c~<,
pwC?8
$Sl{]9
Nk4/%
P6nOm
0u'_^
g|Yg.HCV
yBeqm7t
eNE=p
e4q(+e
8~7+M
U.%2=
VV+)>
-:' P{F
G [$)h
F}u|=
KQ8I7
3a1gA
O#fS5
s><hBe
I8WO(
\i]@8
6 &Wf
N'Z4G
33kGm
WL=i"
P$=HnW6|
Hl~DOa
Z>+rS
N*SMF2*
_zZ(h
Ghvny
Wuv}Kh
_M/(H
ix{z8
MpV%|
qekZC
Zos}%
S,)j;$z#
qy3.=
hRsROP
+ =MU4
/YmNe
Xc6J>
'Zz,qp
[e'?"S
'@]f;o
SN+/[{|$
i#Q<J?[
bT3aJ|c
a/<MG
Am!nG#B
M-S]rf3
t{~(N
(_A+{
Z 'Yc}"
b0Ti2
=%%)R
7scfG
dN`)Z
)"++e
o^q/x^VU
lC)n\
=HjTc
>,bqR
w7iPn
U:Cgq
U*ZafwO$$
=b1;%
oI.*X
eGJ*7
^YMt"
S\r(
>oV.;
E;h/0
'<iJR
f,;)2
oq]I%Y
Xd-2`M
PPFS)!
IRa4{
wy_J!E
u1o(B
Ink4/\
Gz3,L
V]JY=
\\o\t>0
.u!PA++'
gKz],
7Cpzq.
sZ?'C
]gNXd
lw4t\D
GiZWH:
@A>Or
,"Bry
,HC n=
![dB'
C~H4!
IU?B;
hTt;N~J
BV{i)_p)
d"80;H
Q|%x&(F
<5(j|
KS(9R
e}>_8|I
m jX!ek
{\=Jpn
BPsD5
zAhK3
[)jd>u
O*xRL
N_+jPX
boMo?l
KFM1S
ZoWoTr
v>cw2
i$w9y
3LvLv
faV-v
')Na8
~FhHW
cqtn%/
l{:_^T
5$tqf
+8c`K
b/hn$
jo3UU
9<*w%#6
lG1MUF
G.C"r
Hv]to
7E4Y>e
N_)Q8K
%LCs1
QDd=`
*EFJZz$
\XVN3
zj*<Yo
_JjR*U
1A=K,
l~=G2
+80K9
o mbn
a{UX+
:]L>\
DL{%3
\HfH+L'
B8]W
a(M$!
"f9oa4
jmIKRk~
v;$gw
IQ,\|
8e`Q^@
hGq}Z
6Ax!T>
y\EfiB.J
YMaXh
=s=6q
$XD0H
(H0F[
-[a=0
Wh_![d
H. v(
h8<6}a
`CUc%
nbwbv
&yBl^
p82 l<
t(YC'W g
t_`Xo^
[@ujP^
4o?k9}
gyxM%
zgK~&
Z9$O_
%)v}%3
\ WIF
NxAq3['6n
$`y1V
ZI~q+ F(
1vq}~
'Wu?}
Kx,{A
:0 ]S
N]^l5
a5e"~
lF{G>
N,0,R
.N,cE,
{jhOkJ
B2't/
)zic`
uw"p'
|~[ss
^j{%+
YyjZJ#
otaV5
sxRb#y7
fsR),
>L;!~
^ K-n
YP3J*
RRq0'&O0
G#1'J
oZ(&>
tM!X%
VsHx=
jrX;5N
*\zt+
1aK%"
u.DZy8
Y!5wd
@CeyL
k06_*
<RH+<
W`9ch
]3$Rt
+DjN0
\%r_H`?
J(hlL
Od]}<g
KJdZU
[e6_n7
YTcjI&=
_UtH0
kD8'&r
%7"o+R5
M}5}@
jk:Nd
^8iC}
Wg1s+
t=+A8c
rSN,G
GJ>r%
< >`f
TpW}h}
hd112
K/gVP5
92gYC
s(U*E
4iFNp
j-{v
E;\]U
fO M8
HJK"F
qxVHW
[iPsBF7
!#)f|
K<R|F
'qCA)G8Wc
[dN.'
B</e,
p0<&%
9{!wM
F;'RW
pyfDR
(ycgO
vd.82
HQ8C4k
_M<Wc
Daz`N
1>^vGB
Tl&B
@uY54
5s/k,
>'D'Q5
p5O2*
C:vH4
1WXV.
1[/f*
y8~4IYK
0jQ9<
Pb%RZ
{ ;VS
S. mt
Udo^I
)-aaof
_5+mvgK
0IXN%%
VSvP<
!~#f=Sv
[Z(@4
cSUPTXu
S!Z&hw
d8})p
oQbIH
Z|Jz^K
LKID9
2t;(?
}7f^MW{
:j"nz5
vW4_!
!R}u\p
aH+s.:@
Hp~oH
btK{A
Hr5v28
^j$g}
&QGh9
gWfPrQ
)b?_&5
I2H`1
>aOSf1d
(%yt]
vbz>N
hc#hN
-F6^Az't
-4$[{
d> $(
AKR!|:|
VRy2~
Y`$7`
hIU7^
g=\>G
$(4]X
JP<ENd
Ee!L+
w>GozN
|D41"
lbf;5
+/k~od3
_OQ#~
,nA}
v&MA -
%tu_6
r!j\*h
u%$L'
yj<im
BR%j
<j14%
TG'0fas
0{)<4
`dcys
Kpr<3
a^}")
v$C2'a
QD?^m
lZ^tB
[KEN9
Vg}U^tG
4e2Ia
NxOT\
|--0D
(I\G,
LAcf{
B^.F5Q
<,HfE
Z}2x2
a):*8
TO2i
dI$LsN
<rx h
ubm6S?
5Pc`=
h#>%?3
NZ?j7
ngPT8h
Yj| /Fb
Fq#gyF
a_c|+
6T-U 8
z:m/r
m1`j1
{$FZm
?Q*;)
9l%~h{x
%v.(i7D
".uz"
#n_g5n
~NXI*Z
}0cNP
FowhiV
po((x
>PP8m
jC"|Q,
Y7Eo_
T{A_+
}=y|M
he0H|
HM]HMZ
q{yr5Z
kN5L8R4
)-!+]
/x>[=<
hU"m!)
v: tI
,,N85]
S9[X^
j\@4F
Bv*(|
b*ka>
wUkc*
iZ-;jig
>9uL~s
5`Uw
!M5_v
8=e::
wYd9#{k
wXOLE
LJw(p
g2AF~
Ib4ov
T*Pm"5
PN3b{
HmwTb
WT;>7
UiZ]1
s*I,R
p." am
=71%!
>L~PJ(p
qxY[!hX
x`9D\
bU5I;
|=cfB
X++O/
-[4q]
Am8.:
^Y~OA
~^V~U|
(Ms:#U
gW4i'
afcIg
=;jB>e
{?e|1
saW&>
ff4~LHK
,Fkjy
556J(]y
3tY;I
>gi.n
+_gp*
6mw"Y'P
:/q3 j
[1IM%
;m-:)
f:)AJ
zMh'v
QTe}K
u3b>vq0
,}m4E
5)`a_
7b;IJg
|^jJni
`SyD~}
zs`y^
5N)JG
_6k_>
UM=D(8
nLoTk
*`(#+k*
we1wN
syCR$
M(<T=
lw$}1
| ]/
#Y-r~
tZI!PH
O18MC
ZG'*I
&]=Q1
tf8w;?
4$gQkA
)2R9{
r;R J
D7jn`
"|8tuDn<
{1s&.t
MxCs4
|/-\c/
2H'=pMm
p;wpe
Ju~R>RY
yE]3k
;)IS2
=N#9&t
$x\sD
q.E5om
3uEF%
uXz(:t
H-_=P#
D^]?U
&_SIi
CP.#F
wqAF&
peXFv
3(wt8
E&5TC
l^SkW
J7kL0
V$'NP
Z2$A2S
tIg-9|
@u]%:
IIjlN
cdHFf
5}up
<6&PD>|
)r?[jw_6r
QO?-l
{o%&\N
o\36S
_~Xg_
)?^K*
e!+D}E
g{9,+
XD8e!Lt
Ji=v4DWT
I|?dm
l+r[xs
P!NL,<
S @[cx
:FSNWQL
3iX7
.w_!]
neyt2oV
.]FQg3
4#zEY
;+$.XN
_}($E__H
;F51FQ~
"@N=0
Bns1*!
}`=qq
Q{_xlkR]
1c];m
^=gr8
hnYKT
c?l~u
i#7P<
jZsC}
F`M,SM
_S'<h
&h v\
CPj!{+
0j2fuc
"oKV
5wR1BG
&/$1g
Q6?l"
"HLt)
d)RWj
HS7?&
XEe\#N#
}w|/y
K]ckYml}n%G$
aLM<k
xPrE<
I<z_!\
5%GW&
>0JGO
RMT_8
iw[AV
_Yiq
(-`*O
O++06
IpZa>
/VQcN
-?P?3r
7$b9KK
4e4_m$
cJ7Op
Hx]i2
Hjxdmk
x~d/L
;$_XD;
&x|P|U
xmX&V5,
QyO1T7
E5S!H
mmjXH
Rpc,Q<
%dD8WT:
;FCa&
iG7DT
pUyChe)QO
Ngyrw
-bU%Y
^dX)9
cY;<@
`>e4QXo
E~{`=V>
$yl4hA(t
jj\|(m
SZ}Z2|u
XOu(;
>LOZ\"P2!
4K|Ehcm
!o?((
Q.{/y
ckc`f
#|/T!
X1zIw%P '
{7} <`!
?)bK>
"g>#v
R,PMn=
cWL];g{
Eebr-c
TkLPW
/V: <
b~(~bQ
MvP.f
b<sp=!D*
"P(^:
*`rD"
$JF9]
mCtr7
q"qOS
e=D_|'>^
Y*!Vm
`aQTM
;:*4Xo
3WM1O
2XPF_
+c:nzh
!s8hM
$Z 57
`.2)(
\2LAn
<.E6&d
E3C%N)
B16x*
Ai$-x
[3x_z
a F1e*
eE4bR
w8pU&y tBdo
5&#{S
0O$Q-o
*MHRQR
yeTqu
=i{~|L\
Fu[/tX
J]oCq
OZC0|
p`#j:;x
bV$*N
]FjU=J
XI*#Y
<jK!.J;PE
WLne$
TI_s1
(]/M<\S
SX.tpI
:}uqD
(i<=b
@g5ou
Io:YTK
1fm7e
oEh\-
-"fWA
gLv%f
&/q t{
CU$.a
Hxrf-u<0
=>~4F
{563m
h) ?qQ
[[WnQhVE
r^7S&-
Gp^)Yk
`4i&l
XUaN2
9R'd~
[bs?q
@3fF-
[X7R~
_1g[9
-yD6f
$5>'B
G|<biV]
S}}70]*
N/wy4w{
z7JSg
;7dpG
A2F363
@(>e2
Ag[":
lFF57
HtDvVv&4
V1wfc
9Ud(F-|
qj5oN
"l,_c
,zSP\
/NXBk
h{m3d
Rf\+<
mhvd7{
@ >j~
r\|_l
0Sk72
fdd!2r
vN?(88
GJ5%]u
n]jKF`
e<SA3
Q=^:u
Tq4G3
zj`I\
%I)li
5*w^Q
m|Qs]
fJ9O:
M7\//
L`N<4'
i.q*rMF
2W.#r47*
?lP!J
uJv1i
e(YX>O
xp{j,
nvrAp
v|Rh{tf
`PAdk
\G-21
I)&\M
SX6W
T9>5a
[+_"aW
VS\+E2
sDyIH
;TT SQ
0E6 \
&CI|<
gA]O0
p68eb
zT4Vi
lQ7vX[
`-.E%
1bGE8;
}~#C;
~ d`p
"cP`I
&SzsxM
>@Aq6
P0SC;
=edsG
<sU4s
3:v5\@
wZCPF
?<dM)
xwZOt
}}pFg
b6k(i
j"BOl)
1F=+v
.2rPb1-
FbZ<#
om\GK
{=qf7%g
PIgv2
T8Z;m!
j_'5P
Tu<>n
CSx^Z
p:Y$aM
ggQ~#
4tB%
T;l=J
_[#Rs+9
(bu,0
ad(%Pw
cLEV$
6l[W;H
J6%H%]-Q
+UL<{
{wfXx
z+x,<
DOnqm}
x^E8P
:##2'
RgF*E
dQV?L;
654Kz[%A
\J/{aYf
rQ8U-
J<jG7%
S"9",Z
#F:[g
7:|HWx
^K+!R
w/GEY
{[Xo^
LdD6J
"epe[[
E"t%.
sXz!Z
e6U74
<SQfg
4<vQZ(>
4lA+L
$*YKQ)
4ufDNZ!
xs^@w
hkT=h0RjY
-}r2x
vwLI/
T>*dH
+/s%@
hy!~g
uSq8R
V-?}k3
)c~T)
I=_5B[
di 7WP\
B,@X&
#]"[8H
`.Lcm
^*!!X
f6m&m
*Uw5;=U
[_"i!
l]W$Q
e,|j_07|fE
we934
sk?F}\
OYQlxy
]^kNM
AEi\2"
AXy4E^
9N'Gh
0SFOS
k2Y:c
r+'I(
APkNn_J
]rPa-
/!zw0
qP~&|
"iRS1
A~Pig
VN#A8"`
!vbT5p
<\zg`
f:]AT
k#e_K
)H/l5
aEKP.=
q~iu5W
cv)Zm6
Q+%%'
\HH(,
h3w6[x
`/5NR
f_f1u
pE,[n
j9:`a
]CIN&<
r&{{`_H
W1)oW
l+;H2
4=r&_
t'0A?
EYbKdH
ODAFn
x+;NbSD2
&l*yC
l5;K;W
@YXQN
>9YmQs
BkH8a~:
8E%m/
$vZcSm
M"Sgx
*Bac6:
qlr&8
EA`hct
U8-?;
R9q<;
UW.BA
vGGJ~
Ip%Eg
kxX5_
bp+7Y6
nS~e#
h^=Ml
5KP(AU
(;K*P
?Q.^.
QY4B5
F 4liv
&tWo4Sy
\ZfE6
}BhXR
J1C{S
VyGOs
sfcZ8+
Y<:UYe.
,gw m
5$0F)G
Z\V{)
`0c0a
,_zMWr
[YSS&
GFT92
)eK"n
0 IaB
n1-Lplc
(Htte
WFq}s
OxKSPZ
]?yleu
xJM&B
T#pgs
K:JcS
F5jIS
i~r<M
Ri\x?
4DX%A:
@o6c3Hw
N&,.Q
VnUj8
C{elZ
OR#!QQ
u&6_K
%xo`/
X&R56
<c#qb
s`5 |V
B)DOn
yKBEs
Y<N5KP
HZnVA-
;-=HEb|'
AIUS5T
4AhjX
nnks<
wgk&=
m~`5d
RyRY<k
=N(<3
1i94I
OH*6[5~
_Z1+O`
sX^YO
A|_jj
ks/cu
W!KeyO
-O:T,s\
sVo=[
(VA2"9'
+*zyd
@vctg
<kEJ9
4fwYNu
VuB(e
t>Rp-
QDDG\
gveXc
poK/9
HK8m3
eaH9A
<DvFUx
][y$g
[w *~
]P{P.
O(-uE
~&oNS
?#jFfX
&//B%
9b N_
<$88+
Gjk#Ye
ZI^E<w
n\{ij
'nx]wWmW
)MN!9a
;U%}H_
g_#:}C
/s!v^o
c|SVw#
gG!hUK'i
iy:hB,
V\%.M
meMMZ
?c\{>
~&(J
t#4=A
lX%K,
i|]2-
`V|@+
+|{o*
.JL*/K
-]96<
+,)IsJT#
b'D=~
zGn#8
_3??w<=
E=<=$
z% LBZh
<O-g9Z
D%"m%
Icn/xh
#qpYJ
Yx;qf
{Ok+
94!:TO?%
(v}K_
[Yr-ni
g<.)6
QHi3l_
ggsR\@
lOi^D%
tO%}h
gt38xr.w
*wqJC
(~qKn
&0F*9F
:7JX1nQv
~sV*rB
bds>3j
Vs=u"
)#Is0
MUDRyU<-
is,q4m
Dr1:{
;$Q6E
#FN=l
('S%:
U?,(&
-L<E<f
oMs]P
0^+2y
jp/Bo
#vXo;
M7C_S
j}]Kp
Va5KX t
54}b;
\JW8Y
~>#Sj
NF=xhv
jFENi
T0`_FF
XsRx)
tRPjvO)&W
|B"h
24<)b
{JqRb
X.J{>
>"9(S
_'2J|
xmwsO
^Wl'%
Y?v4r
1cc M
/><v&
~h~*6(
]js\N3
'D}:J
c'cp<Ef
g-R9#
k&LQP
bVHAq
8gkGl
}+;;d
M=0+.x4
0hHoE*
F)[id
K+nOGF
VX~6Jm:
EE|D9
}P*oifQ
}P*oifQ
0ka8%
`%&8+
)%&8{
x%&85
Z 16;|a8
4$9Z v
KGZ .
_*a89
vZ cG
Z N[*Oa86
-^&NZ
Z $fO6a+
ouZ eTg
HG)%&8r
4+Z '3=Ra8=
xQa8:
DzZ To
3 |a8
sS%&8
Cg+%&8
l:r%+
wn5%&8
Xg%&8e
p?Z em
vRZ hG
B&?Z I
m/Z W
[i%G%&
'da8D
h-?(%+
y%&8'
iKZ z=
BWqZ
O{%&+
+B i'
_x>ea%
fumZ
Z N}(
[_<Z <o
7OZa8(
`<*a%
0F%&8d
isa8(
/VZa8
y=Z E
WfI g
Z KbH
.6e-Z
Z X4,
Y!Z .A
){CZ
|cpa8
(Z @V
L3y%&
)<ja8
1jVa8
7vZ "
qoPa8F
]#Z|Z
k{mZ
b>Za8M
~(a8$
Z TB\=a8
Z 2~|
L"8%+
tpta8`
qTz_Z
zIa8M
-Ga8Z
oZ er
ePjZ
4/jGZ
\Z Vi#
([KEZ
df!a8
:iaa8g
]kZ R
f&Z A
-0OGZ 2
D`4a8
EwHZ
Aqf>Z
+Ha8}
0,$\Z
cZ (h
.a8m
2~t5Z
+ZJa8
'R$AZ
vB1a8
.;Z \4:Ia8
;3a87
teNZ o
P)Z V
7O(Z
Z >$#.a8
Z d[t
CO3a8$
##+a8
@'PZ j
Z };+Qa8
NZ ^d
Z nmc
p"[a8F
]1Va+
sTZ 5<
*[Z *H
0Ja8T
)TVa8F
ioVZ \
XhPU%&
WodZ
UZ _pN
Q7a8R
Z Gop
%Z }n
`]Ja+
a0a84
x%Z T/O&a8
1Pqa8&
Z Txs
xZ !6BTa8i
"LG%Z
u7cZa8
-dZ *
b`[aZ
HZ Tk
!#DXZ ,
{"E;Z
.,NZ
B0a8X
6NJN l
Z Wzn
Z $ h6a8
ej%&8
-"Z d^C
x)TZ
"CZ IMU
0.,%+
T%&8m
Skj4%&8|
1R<%+
R:%&8V
Y8Z v
Z Bmr
}C8a8
S"`pZ F
F[a8]
7n+Z n
!VZ 2
bxAZ
Po7a+
A9|xZ
yZ 5P
U{Z BQ
f4bZ
Z wH'
KwF|Z |
aZ }j
c.ba%
=?za+
`Sa8M
Z D`d;a8
yl!%+
w4WZ
\:}a8
rZ wK
Z dC>
"RZ s2W
%}NZ
Z N>_
Z ^r{
z#EZ W9
x=a8.
23Z <
}!IZ
|BUZ
-s!Z
@<Z n
h#qZ
;Va8:
aZ m9*
clca8
sZ Ai
iZ 1m
Z uwj
Zua87
4*va8x
pZ r4
x,a8Q
K{a8/
z'hkZ I$
,rQZ {
rZ @)
^AZ 2
?Y{0Z
c6HZ Y
ukZ sIm]a8
;{gmZ
jra8A
r`da8
;2Z G
3q%Z
LP*Z
<zSa8
axZ v
Q?a8U
<MZ _
h7/eZ \
o[Z gQ<
xYa8d
W+Z D
|?<5Z
@Z r.
C3lvZ 4
J%a81
Z g2+
Z komWa8=
bYma8
]Z F:
iZ jf
iZ f1<
Stxa8
7Z $b
H)MXZ |
bZ JPFja8
Z 0%z
6-LZ ,+M
Z EHe
Z `OG
Z JI ea8Q
Q$Z 19
T?>a8
Z cH6
"vAZ Upr?a88
s>&yZ
]YnZ wh)
}Va8L
]Z \!
Z (Tq
B]'a8
S8ea8
.Z =+6Ma8?
YiZ 3
Z BGr_a8
6k1a8r
9Z `w
kZ i<
F{a8!
)lZ v
6Z R{<
M Z ~
`dka8
! a8c
#~~,Z o
Bda8w
]bDZ
,d4a8
s1a8z
vZ WE
lna84
eq<Z
e~CZ
z Z hRDMa8
~%a8D
yyZ :
Z *_i
70Z MI
Xja8{
s$5a8U
bvdZ +J
qZ ]T
$"Z Mo
joa8Q
FYZ )
Z `)!la8
Z "uM
L5ja8
d-Z !
F[a87
Mx\Z zC
6e1a8
{MLVZ
&Z !.m_a8\
3Z CK
`s<a8
Db?a8i
D=Z )\
0!a86
l0a8|
Z }5W
d Va8
Z $ 1
vHOZ
9X|pZ
*`a8[
0Iga8
Z ~4v
V5Oa8
l6Z !
EC,a8v
Z ^s~ia8
KZ 03
LZ xY
YCRZ
|BJZ
MsZ ,`E
5>Z >
>Ta8*
gZ @$
kt]rZ
6F1tZ
}v3a8
_[Z t
=*ZZ
b:8Z
7wa8}
h?a8j
yF|a8
9_a8m
b$Ka8
7`F;Z
Z #kR
Nr'a8
3#ADZ 0
F~rgZ
oZ t<*:a8
MZ zC
KGa8[
@da8p
E`,a8]
I\Z ]Y-
x#ZZ
y1Z !
PZa8L
VZ |X
eAa8W
zIa87
%Z A
:@Va87
<VGa8o
]8a8I
A#fa8
[g*a+
,hiZ RK
W)xa+
!fZ s
eca8r
M<5,
;HUZ
k^ a8x
Z Gvp&a8
w;,Z
M#a8W
Z g.T
6O1uZ
Z N21wa8
f].aa%
iZ \pC
)1*a8
CZ u-
rZ M{H
Z ":`
f].aa%
VZ F=^
f].aa%
}Eba+
,; 0UC
f].aa%
C f].aa%
o f].aa%
O:Z -_V
f].aa%
pq(Z
X^m0Z
]D^a+
c a8-
Z T#h
H\Z L-
5Z B2
6Z *D
bzZ _N
+!_Z &
,j!a8
@&DZ
ODlrZ
Z hjb
2[!Z j
jJZ ":
7I1a8S
n)Z t
-nbZ
?u56Z
Z >u$qa8
-Z K}
)w|CZ
Qm9Z Q
1Z _J
"*Z m
:Na8t
.R3ZZ
*IZ >
!Z x%
>tL8Z tXJ
_Z X[
4oa80
9Z X.
uxZ z
`$VZ ]
Z -0[{a8
~!<Z
% &B.ua%
Y :4YIa%
LZ b4A
<.ZH
p)1a8L
Z "3t
aSZ :
PZ kB
#Dc%+
/]]Z
y`Z ?y\
;Z <5
]Za8r
>sZ 4
%\ OZ
Z R?o
Z @kf
xZ UBh1a8
wFZ /
3cnZ UM
Z 6/XIa8"
Z 8fy|a8
Uo$DZ
`Z :w
o7'>Z s
V{~Z
#\~a8
]oYa+
`Z Ki
[gZ A
_A%&8e
"Nd,8Z
y,Na%
$Ve$%+
B|F K3
Z |L2
Z uHl#a+
TxdsZ
{N) @c
ctH /
730a%
_&`Z 9
Z +a=
y.KZ
|?Z :
v2.0.50727
#Strings
#GUID
#Blob
?4?k
mcHElSpfLvoBbuEl.exe
<Module>
mscorlib
Assembly
System.Reflection
.cctor
ResolveEventArgs
System
ValueType
.ctor
Object
Stream
System.IO
MultipleChoice
SeriousG
ErrorReport
System.Windows.Forms
increment
components
IContainer
System.ComponentModel
label1
Label
label2
pictureBox1
PictureBox
label3
pictureArrowBox
pictureBox3
timer1
Timer
btnDismiss
lblDismiss
label4
timer1_Tick
EventArgs
sender
lblDismiss_Click
btnDismiss_Click
btnDismiss_MouseLeave
lblDismiss_Leave
Dispose
disposing
InitializeComponent
student
resultsAndMemo
question1
question2
question3
question4
number
totalNumber
studentMark
studentNo
numberOpen
count
check
username
password
firstname
surname
dateOf
email
write
StreamWriter
StreamReader
System.Data
SqlCommand
System.Data.SqlClient
SqlConnection
connectionString
panel1
Panel
panel2
panel3
btnTakeTest
Button
btnMemo
btnViewClass
btnSetTest
lblQuestion1
groupBox1
GroupBox
label5
txtQuestion1Correct1
TextBox
txtQuestion1Possible4
txtQuestion1Possible3
txtQuestion1Possible2
txtQuestion1Possible1
txtQuestion1
groupBox2
label6
txtQuestion2Correct2
txtQuestion2Possible4
txtQuestion2Possible3
txtQuestion2Possible2
txtQuestion2Possible1
txtQuestion2
groupBox3
label7
txtQuestion3Correct3
txtQuestion3Possible4
txtQuestion3Possible3
txtQuestion3Possible2
txtQuestion3Possible1
txtQuestion3
groupBox4
label8
txtQuestion4Correct4
txtQuestion4Possible4
txtQuestion4Possible3
txtQuestion4Possible2
txtQuestion4Possible1
txtQuestion4
pictureBox2
loginPanel
panelLogin
txtSurname
txtName
txtUserId
lblSignIn
btnSignIn
btnStudentCenter
panelLecture
btnHideLecture
btnSignOut
lblSignedIn
panel4
label9
label11
label12
panelStudentCenter
lblTime
timerUpdateTime
lblQuestion1Possible
txtUserAnswer1
txtUserAnswer2
lblQuestion2Possible
lblQuestion2
txtUserAnswer3
lblQuestion3Possible
lblQuestion3
txtUserAnswer4
lblQuestion4Possible
lblQuestion4
btnRegsiter
lblRegister
lblNameSign
btnPastPaper
btnSignIn_Click
btnStudentCenter_Click
btnSignOut_Click
lblSignIn_Click
btnSignIn_Click_1
btnSignOut_Click_1
setUserID
timerUpdateTime_Tick
btnHideLecture_Click
btnSetTest_Click
possibleAnswersAndQuestion
checkQuestions
sqlMemorandum
btnMemo_Click
btnTakeTest_Click
getClassList
loadStudents
btnViewClass_Click
lblRegister_Click
btnRegsiter_Click
signIn
btnPastPaper_Click
txtQuestion1Correct1_TextChanged
txtQuestion2Correct2_TextChanged
txtQuestion3Correct3_TextChanged
txtQuestion4Correct4_TextChanged
databseConnection
Program
Register
register
txtUsername
txtPassword
txtFirstName
txtLastName
txtDateOF
txtEmailAddress
btnRegister
txtDateOF_MouseEnter
txtDateOF_MouseLeave
txtEmailAddress_MouseEnter
txtEmailAddress_MouseLeave
btnRegister_Click
registerButton
databaseConnection
RegisterUsers
firstName
lastName
datetOfBirth
setUsername
setPassword
setFirstName
first
setLastName
setDateOfBirth
setEmail
getUsername
getPassword
getFirstName
getLastName
getDateOfBirth
getEmail
SplashScreen
start
lblLoading
timerLoading
timerCircular
timerLoading_Tick
timerCircular_Tick
Students
student_id
setStudenID
getStudentID
StudentID
Resources
MultipleChoice.Properties
resourceMan
ResourceManager
System.Resources
resourceCulture
CultureInfo
System.Globalization
get_ResourceManager
get_Culture
set_Culture
value
get_arrow
System.Drawing
Bitmap
get_btnbefore
get_btnbefore1
get_btnSignIn
get_buttonAgree
get_code_school
get_codeschoollogos
get_img_test_overview_45_75
get_Notepad_plus_plus
get_NvidiaDriver2
get_onlickBlue
get_LldziVPqtHEafkgVuZol
get_register
get_registerButton
get_stableBlue
get_studentApplication
get_studentlogin
Culture
arrow
btnbefore
btnbefore1
buttonAgree
code_school
codeschoollogos
img_test_overview_45_75
Notepad_plus_plus
NvidiaDriver2
onlickBlue
LldziVPqtHEafkgVuZol
stableBlue
studentApplication
studentlogin
Settings
ApplicationSettingsBase
System.Configuration
defaultInstance
get_Default
Default
mcHElSpfLvoBbuEl
CompilationRelaxationsAttribute
System.Runtime.CompilerServices
RuntimeCompatibilityAttribute
DebuggableAttribute
System.Diagnostics
DebuggingModes
AssemblyTitleAttribute
AssemblyDescriptionAttribute
AssemblyConfigurationAttribute
AssemblyCompanyAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyTrademarkAttribute
ComVisibleAttribute
System.Runtime.InteropServices
GuidAttribute
AssemblyFileVersionAttribute
STAThreadAttribute
GeneratedCodeAttribute
System.CodeDom.Compiler
DebuggerNonUserCodeAttribute
CompilerGeneratedAttribute
EditorBrowsableAttribute
EditorBrowsableState
MultipleChoice.ErrorReport.resources
LopRfArQtmSGYrpggstZqheNvTXK
MultipleChoice.MultipleChoice.resources
MultipleChoice.Properties.Resources.resources
MultipleChoice.Register.resources
MultipleChoice.SplashScreen.resources
MemoryStream
ReadByte
get_Length
UInt32
AppDomain
get_CurrentDomain
ResolveEventHandler
add_AssemblyResolve
RuntimeHelpers
InitializeArray
Array
RuntimeFieldHandle
get_FullName
get_Name
String
op_Equality
Buffer
BlockCopy
Write
GetTypes
GetMethod
MethodInfo
MethodBase
Invoke
Microsoft.VisualBasic
ProjectData
Microsoft.VisualBasic.CompilerServices
EndApp
SystemSounds
System.Media
get_Asterisk
SystemSound
Start
Control
set_Text
Point
set_Location
set_BackgroundImage
Image
IDisposable
Container
set_StartPosition
FormStartPosition
FontStyle
GraphicsUnit
set_Font
Color
get_White
set_ForeColor
get_Controls
ControlCollection
SystemColors
get_ControlLight
set_AutoSize
set_Name
Padding
set_Padding
PerformLayout
set_TabIndex
ISupportInitialize
BeginInit
set_TabStop
FromArgb
set_BackColor
Cursors
get_IBeam
Cursor
set_Cursor
EventHandler
add_Click
EndInit
SizeF
ContainerControl
set_AutoScaleDimensions
get_Transparent
set_BackgroundImageLayout
ImageLayout
set_Size
add_MouseLeave
set_FlatStyle
FlatStyle
SuspendLayout
get_ButtonHighlight
ResumeLayout
get_Hand
set_ShowIcon
set_FormBorderStyle
FormBorderStyle
add_Leave
set_AutoScaleMode
AutoScaleMode
add_Tick
set_Interval
set_ClientSize
set_Visible
TextBoxBase
Clear
ToString
DateTime
get_Now
ToLocalTime
MessageBox
DialogResult
MessageBoxButtons
MessageBoxIcon
get_Text
Concat
Exception
op_Inequality
TextWriter
WriteLine
Close
get_Message
SqlDataReader
FormatException
ArgumentOutOfRangeException
PathTooLongException
IOException
ShowDialog
DbDataReader
System.Data.Common
DbConnection
ExecuteReader
TextReader
ReadToEnd
SqlException
Int32
ToLower
ToUpper
Boolean
ReadLine
Contains
Split
FileNotFoundException
DbCommand
ExecuteNonQuery
ComponentResourceManager
ButtonBase
set_UseVisualStyleBackColor
set_ScrollBars
ScrollBars
set_Multiline
set_BorderStyle
BorderStyle
set_ReadOnly
set_MaxLength
set_UseCompatibleTextRendering
get_WindowFrame
add_TextChanged
get_FlatAppearance
FlatButtonAppearance
set_BorderSize
GetTypeFromHandle
RuntimeTypeHandle
GetObject
set_Icon
set_PasswordChar
set_Tag
get_Black
Application
EnableVisualStyles
SetCompatibleTextRenderingDefault
get_WaitCursor
get_Parameters
SqlParameterCollection
AddWithValue
SqlParameter
add_MouseEnter
get_WhiteSmoke
get_ControlDark
Random
get_Assembly
SettingsBase
Synchronized
WrapNonExceptionThrows
Edmodo
Educational Technology
NetDragon Websoft
:Copyright
2018 Best Assistant Education Online Limited
'Best Assistant Education Online Limited
$34e6a87c-bca2-4ac0-8b5a-ddef73345f4e
87.4.0.0
3System.Resources.Tools.StronglyTypedResourceBuilder
16.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
16.0.0.0
_CorExeMain
mscoree.dll
wwwwwwwwwwwwwwwwp
DDDDO
DDDDO
tDDDO
DDDDDDDDDDDDDDDO
DDDDDDDDDDDDDDDO
DDDDDDDDDDDDDDDO
DDDDO
DDDDH
wwwwwwwwwwwp
wwwwwwwwwwp
pDDDDDDDDDDD
pDDDDDDDDDDD
wwwwwwp
wwwwww
DDDDD
{wwwwwwwwwwwwwwwwwwwwwwwwwwwwwww
{>wwwwwwwwwww>>>>>>>>>>>>>>>>>>>
{>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
{>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
{>>>>>>>
>>>>>>>>>>>>>>>>>>>
{>>>>>>>
>>>>>>>>>>>>>>>>>>
{>>>>>>>
>>>>>>>>>>>>>>>>>
{>>>>>>>
I>>>>>>>>>>>>>
{>>>>>>>>
>>>>>>>>>>>>>>>
{>>>>>>>>>>
">>>>>>>>>>>
{>>>>>>>>>>>I
>>>>>>>>
{>>>>>>>>>>>>,
">>>>>>
{>>>>>>>>>>>>
{>>>>>>>>>>>>
{>>>>>>>>>>>>>1
{>>>>>>>>>>>>>
{>>>>>>>>>>>>
{>>>>>>>>>>>
{>>>>>>>>
{>>>>>
KKKKK
7777WW}}
AAAAA
AAAAA
9999999
9999999
aaac5
c%ap5
AZZJJJT_&]54J
5+Z55jaE5
''''''
C5)5-
(+|(555
LLnnnDs
'(5Y&Z
K>wK$
osm=5[(5|TJZ
/SwwK
(5((TZ
Bdd....d
MDzB)
KKKKKKK
{KKKKKK
{{{{{{{{{{{{
FFFFFFFF
hhhhhhhhhhhhhhhhhhhhhh
HBBBBBBBBBBBBBBBBBBBBh
HB%%%%%%%%%%%%%%%%%%Bh
HB%%%%%%%%%%%%%%%%%%Bh
HB%%%%5
%%%%%%%%%%%Bh
HB%%%%
%%%%%%%%%%h
HB%%%%
%%%%%%%%%%h
HB%%%%%%855
%%%%%%%u%h
HB%%%%%%
%%Ruu%h
HB%%%%%%%
%uuuu%h
HB%%%%%%%
uuuuu%h
HB%%%%%%%%J
uuuuu%h
HB%%%%%%%u
8uuuuuu%h
HB%%%%%uuuuJ
uuuuuh
HB%%uuuuuuu#k
uuuuuh
HBuuuuuuuuuuulk
uuuuuh
H%uuuuuuuuuuuuuuuuuu
H%uuuuuuuuuuuuu
zzzzz
---FFFg
xx*DDT2D*
YYY111O
OCOyr
db\/>1
<<<<)f&
:>>1$K
]ImEa1
HHHHHHHHHHHHHH
444,///////////
444,//
*//////
444,/
444,/
444,/
444,/
''''2
44444,
444444,,,,,,,,
IDATx
hh404
hh404
hh40B
y7`B8
X)uey
&!KG<
|X;v`
B=uxB:
KqI9H<
,yltt
sv? :
8?L:!
Z}hQ#'
pX:SP
QzN6BP
RPa_f
i>2G u
B ;T(
Kw9G2
#2YP%
nE9I
;IDAT
@6./v
`t` o
]E =8
Fgg'FFFf<
vtvvbtt
reNAQA
|F_/P9
hooo?
sU#f4\V
LH2*5^
hnnF<
!de?2
}m/~-K
hooG<
z477#
po/>y
OW(g'
U)/2c
RmM4h
\39f,[
Pg(7}
`+W8U
6S8nl
B;8%B;8eB;8eB;8eB;8eB;8eB;8eB;8eB;8eB;8eB;8eB;8eB;8eB;8eB;8eB;8eB;8eB;8eB;8fB;8fB;8fB;[email protected]
B;8EB;8EB;8EB;8EB;8EB;8EB;8EB;8EB;8EB;8EB;8EB;8EB;8ENNN_
%cccz___}]]]}___}]]]}]]]}]]]}___z
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
LldziVPqtHEafkgVuZol
George Floyd </3
GetLib
MultipleChoice
Offline Mode
Segoe UI
label4
Dismiss
label1
pictureBox1
label3
pictureArrowBox
lblDismiss
Microsoft Sans Serif
*We apologize for any inconvenience this may cause and thanks for their understanding*
using files till database comes back online
label2
Tekton Pro Ext
ErrorReport
Connecting to database failed.....
pictureBox3
btnDismiss
data source = LENOVO-PC\SQLEXPRESS;database = Code_School;integrated security =SSPI
Please click student and login then return here!!!!
Student login is required
Past Paper
Past Paper.txt
Test has been successfully set and saved.
setting completed
Please fill-in all questions and answers.
Ooops
SELECT * from Users where userName='
' and userPassword='
Test Results.txt
Name:
Surname:
Your answers
Marking
_____________________________________________________________________
Total:
______________________________________________________________________
Name:
Surname:
Marks:
_________________________________________________________________
please answer questions first!!!!!!!
Error
Test was successfully completed and marked, please check the results and memo. The test and memo were successfully saved.
Test completed
Class List.txt
Please wait for lecture to set the the
Please wait.....
Avaible students
__Code School Class List__
studentDetails.txt
Invalid username and password
login failed
File not found please register before trying to login...
File Not Found
Please enter only A - D
UPDATE Users SET lastLogin='
' where userName='
Invalid username or password.
Student Center
txtUserAnswer2
btnSignIn
lblTime
Minion Pro SmBd
txtQuestion3Possible4
Question 2
btnRegsiter
Segoe UI Symbol
txtQuestion2
btnViewClass
Sign in!
USERNAME
txtQuestion4Correct4
lblQuestion1
txtName
txtQuestion1
Lecture Center
Lucida Bright
panelLogin
Welcome,
txtQuestion4Possible1
Segoe Print
txtUserId
txtQuestion3Correct3
btnTakeTest
lblQuestion2Possible
Register
txtQuestion1Correct1
txtQuestion2Possible2
groupBox3
Marks and Memo
lblNameSign
groupBox1
groupBox4
txtQuestion4Possible2
label5
label10
Trajan Pro
txtQuestion4
txtUserAnswer3
txtQuestion2Correct2
panel3
USER ID
btnTakeTest.BackgroundImage
panel1
PASSWORD
txtQuestion1Possible4
txtUserAnswer1
$this.Icon
correct letter
txtQuestion3Possible2
txtQuestion3
btnSetTest
lblSignIn
txtQuestion2Possible1
lblQuestion3Possible
loginPanel
pictureBox2
btnSetTest.BackgroundImage
Monotype Corsiva
btnPastPaper.BackgroundImage
txtQuestion4Possible4
panel4
button5
txtQuestion2Possible4
Question 4
label6
btnHideLecture
lblQuestion4Possible
btnPastPaper
Question 1
lblQuestion1Possible
Set Test and Save
panel2
btnMemo
label11
Mark Test and Save
Question 3
txtQuestion1Possible3
lblQuestion3
btnStudentCenter
groupBox2
label7
Past Test
txtQuestion2Possible3
lblSignedIn
txtQuestion3Possible3
View Class
panelStudentCenter
txtSurname
label12
lblRegister
label9
txtQuestion1Possible2
Sign Out
lblQuestion2
btnSignOut
btnViewClass.BackgroundImage
panelLecture
txtQuestion1Possible1
btnMemo.BackgroundImage
txtQuestion4Possible3
txtUserAnswer4
lblQuestion4
txtQuestion3Possible1
label8
Day / Month / Year
Registration was sucessful
Registration
Please fill in all the required fields
Registration Error
Your email format is not correct please enter correct email
username is already taken
INSERT INTO Users(userName,userPassword) values (@userName,@userPassword)
@userName
@userPassword
btnRegister
txtUsername
txtPassword
txtEmailAddress
txtLastName
txtFirstName
txtDateOF
loading..
loading...
loading.....
loading.
loading......
loading....
Segoe UI Black
v.2.1.6
lblLoading
Mistral
SplashScreen
loading
Error: please enter name
Error: please enter last name
MultipleChoice.Properties.Resources
arrow
btnbefore
btnbefore1
buttonAgree
code_school
codeschoollogos
img_test_overview_45_75
Notepad_plus_plus
NvidiaDriver2
onlickBlue
register
registerButton
stableBlue
studentApplication
studentlogin
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
Educational Technology
CompanyName
NetDragon Websoft
FileDescription
Edmodo
FileVersion
87.4.0.0
InternalName
mcHElSpfLvoBbuEl.exe
LegalCopyright
Copyright
2018 Best Assistant Education Online Limited
LegalTrademarks
Best Assistant Education Online Limited
OriginalFilename
mcHElSpfLvoBbuEl.exe
ProductName
Edmodo
ProductVersion
87.4.0.0
Assembly Version
87.4.0.0

Full Results

Engine Signature Engine Signature Engine Signature
Bkav Clean MicroWorld-eScan Clean CMC Clean
CAT-QuickHeal Clean ALYac Clean Cylance Unsafe
VIPRE Clean Sangfor Clean K7AntiVirus Clean
BitDefender Clean K7GW Clean Cybereason Clean
TrendMicro Clean Baidu Clean F-Prot Clean
Symantec Clean TotalDefense Clean APEX Malicious
Paloalto generic.ml ClamAV Clean GData Clean
Kaspersky Clean Alibaba Clean NANO-Antivirus Clean
ViRobot Clean AegisLab Clean Avast Clean
Rising Clean Ad-Aware Clean Sophos Clean
Comodo Clean F-Secure Clean DrWeb Clean
Zillya Clean Invincea Clean McAfee-GW-Edition Clean
Trapmine Clean FireEye Generic.mg.507341709bdd7600 Emsisoft Clean
Ikarus Win32.Outbreak Cyren Clean Jiangmin Clean
Webroot Clean Avira Clean MAX Clean
Antiy-AVL Clean Kingsoft Clean Endgame Clean
Arcabit Clean SUPERAntiSpyware Clean ZoneAlarm UDS:DangerousObject.Multi.Generic
Avast-Mobile Clean Microsoft Trojan:Win32/Sonbokli.A!cl AhnLab-V3 Clean
Acronis Clean McAfee Clean TACHYON Clean
VBA32 Clean Malwarebytes Clean Zoner Clean
ESET-NOD32 Clean TrendMicro-HouseCall Clean Tencent Clean
Yandex Clean SentinelOne DFI - Malicious PE eGambit Unsafe.AI_Score_100%
Fortinet Clean BitDefenderTheta Gen:[email protected] AVG Clean
Panda Clean CrowdStrike Clean Qihoo-360 HEUR/QVM03.0.AFC8.Malware.Gen
Sorry! No behavior.

Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
Y 1.1.1.1 [VT] Australia

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.1.9 51751 1.1.1.1 53
192.168.1.9 53599 1.1.1.1 53
192.168.1.9 54609 1.1.1.1 53
192.168.1.9 55233 1.1.1.1 53
192.168.1.9 55319 1.1.1.1 53
192.168.1.9 59058 1.1.1.1 53
192.168.1.9 59225 1.1.1.1 53
192.168.1.9 64674 1.1.1.1 53
192.168.1.9 137 192.168.1.255 137
192.168.1.9 51751 8.8.8.8 53
192.168.1.9 53599 8.8.8.8 53
192.168.1.9 54190 8.8.8.8 53
192.168.1.9 54609 8.8.8.8 53
192.168.1.9 55233 8.8.8.8 53
192.168.1.9 55319 8.8.8.8 53
192.168.1.9 57309 8.8.8.8 53
192.168.1.9 59058 8.8.8.8 53
192.168.1.9 59225 8.8.8.8 53
192.168.1.9 62770 8.8.8.8 53
192.168.1.9 63630 8.8.8.8 53
192.168.1.9 64674 8.8.8.8 53

DNS

No domains contacted.

HTTP Requests

No HTTP requests performed.

SMTP traffic

No SMTP traffic performed.

IRC traffic

No IRC requests performed.

ICMP traffic

No ICMP traffic performed.

CIF Results

No CIF Results

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Suricata HTTP

No Suricata HTTP

Sorry! No dropped Suricata Extracted files.

JA3

No JA3 hashes found.

Sorry! No dropped files.
Sorry! No CAPE files.
Sorry! No process dumps.
Defense Evasion Credential Access Collection Privilege Escalation
  • T1116 - Code Signing
    • Signature - invalid_authenticode_signature
  • T1055 - Process Injection
    • Signature - InjectionInterProcess
  • T1045 - Software Packing
    • Signature - packer_entropy
  • T1003 - Credential Dumping
    • Signature - infostealer_browser
  • T1081 - Credentials in Files
    • Signature - infostealer_browser
  • T1005 - Data from Local System
    • Signature - infostealer_browser
  • T1055 - Process Injection
    • Signature - InjectionInterProcess

    Processing ( 10.983999999999998 seconds )

    • 5.222 Suricata
    • 3.889 BehaviorAnalysis
    • 0.657 Static
    • 0.391 NetworkAnalysis
    • 0.256 CAPE
    • 0.224 static_dotnet
    • 0.213 VirusTotal
    • 0.056 TargetInfo
    • 0.029 Deduplicate
    • 0.019 Strings
    • 0.018 AnalysisInfo
    • 0.005 Debug
    • 0.005 peid

    Signatures ( 2.2969999999999975 seconds )

    • 0.243 antiav_detectreg
    • 0.165 antivm_generic_disk
    • 0.13 mimics_filetime
    • 0.123 virus
    • 0.11 reads_self
    • 0.104 bootkit
    • 0.1 stealth_file
    • 0.092 decoy_document
    • 0.091 stealth_timeout
    • 0.088 infostealer_ftp
    • 0.081 territorial_disputes_sigs
    • 0.079 Doppelganging
    • 0.078 api_spamming
    • 0.063 NewtWire Behavior
    • 0.06 Vidar Behavior
    • 0.058 neshta_files
    • 0.051 infostealer_im
    • 0.05 antianalysis_detectreg
    • 0.044 hancitor_behavior
    • 0.027 antivm_vbox_keys
    • 0.024 masquerade_process_name
    • 0.022 antiav_detectfile
    • 0.021 rat_luminosity
    • 0.021 stack_pivot_file_created
    • 0.019 infostealer_mail
    • 0.018 antivm_vmware_keys
    • 0.014 infostealer_bitcoin
    • 0.013 antivm_parallels_keys
    • 0.013 antivm_xen_keys
    • 0.011 antiemu_wine_func
    • 0.011 antianalysis_detectfile
    • 0.011 ransomware_files
    • 0.01 dynamic_function_loading
    • 0.009 InjectionCreateRemoteThread
    • 0.009 malicious_dynamic_function_loading
    • 0.009 antivm_generic_diskreg
    • 0.009 antivm_vbox_files
    • 0.009 antivm_vpc_keys
    • 0.008 injection_createremotethread
    • 0.008 geodo_banking_trojan
    • 0.007 antivm_generic_scsi
    • 0.007 infostealer_browser_password
    • 0.007 ransomware_extensions
    • 0.006 kovter_behavior
    • 0.005 antiav_avast_libs
    • 0.005 antidebug_guardpages
    • 0.005 exploit_heapspray
    • 0.005 kibex_behavior
    • 0.005 predatorthethief_files
    • 0.005 qulab_files
    • 0.004 InjectionInterProcess
    • 0.004 antisandbox_sleep
    • 0.004 betabot_behavior
    • 0.004 blackrat_registry_keys
    • 0.004 recon_programs
    • 0.004 shifu_behavior
    • 0.004 antivm_xen_keys
    • 0.004 antivm_hyperv_keys
    • 0.004 bypass_firewall
    • 0.003 Unpacker
    • 0.003 antidbg_windows
    • 0.003 antisandbox_sunbelt_libs
    • 0.003 exec_crash
    • 0.003 exploit_getbasekerneladdress
    • 0.003 exploit_gethaldispatchtable
    • 0.003 persistence_autorun
    • 0.003 antidbg_devices
    • 0.003 antivm_generic_bios
    • 0.003 antivm_generic_system
    • 0.003 antivm_vmware_files
    • 0.003 ketrican_regkeys
    • 0.003 darkcomet_regkeys
    • 0.003 limerat_regkeys
    • 0.003 recon_fingerprint
    • 0.002 InjectionProcessHollowing
    • 0.002 antiav_bitdefender_libs
    • 0.002 antiav_bullgaurd_libs
    • 0.002 antiav_emsisoft_libs
    • 0.002 antiav_qurb_libs
    • 0.002 antiav_apioverride_libs
    • 0.002 antiav_nthookengine_libs
    • 0.002 antisandbox_sboxie_libs
    • 0.002 antivm_generic_services
    • 0.002 antivm_vbox_libs
    • 0.002 encrypted_ioc
    • 0.002 hawkeye_behavior
    • 0.002 infostealer_browser
    • 0.002 injection_runpe
    • 0.002 network_tor
    • 0.002 OrcusRAT Behavior
    • 0.002 stack_pivot
    • 0.002 remcos_regkeys
    • 0.001 PlugX
    • 0.001 uac_bypass_eventvwr
    • 0.001 kazybot_behavior
    • 0.001 tinba_behavior
    • 0.001 vawtrak_behavior
    • 0.001 antivm_vbox_devices
    • 0.001 browser_security
    • 0.001 codelux_behavior
    • 0.001 disables_browser_warn
    • 0.001 packer_armadillo_regkey
    • 0.001 medusalocker_regkeys
    • 0.001 revil_mutexes
    • 0.001 obliquerat_files
    • 0.001 rat_pcclient
    • 0.001 warzonerat_regkeys
    • 0.001 sniffer_winpcap
    • 0.001 targeted_flame

    Reporting ( 13.196 seconds )

    • 13.154 BinGraph
    • 0.039 MITRE_TTPS
    • 0.003 PCAP2CERT