Analysis

Category Package Started Completed Duration Options Log
FILE Unpacker 2020-06-05 13:58:17 2020-06-05 14:06:21 484 seconds Show Options Show Log
procdump = yes
2020-05-13 09:27:48,880 [root] INFO: Date set to: 20200605T14:02:07, timeout set to: 200
2020-06-05 14:02:07,062 [root] DEBUG: Starting analyzer from: C:\tmpt2nfl3rg
2020-06-05 14:02:07,062 [root] DEBUG: Storing results at: C:\LEGJCJ
2020-06-05 14:02:07,062 [root] DEBUG: Pipe server name: \\.\PIPE\QaeyIcitc
2020-06-05 14:02:07,062 [root] DEBUG: Python path: C:\Users\Louise\AppData\Local\Programs\Python\Python38-32
2020-06-05 14:02:07,062 [root] INFO: Analysis package "Unpacker" has been specified.
2020-06-05 14:02:07,062 [root] DEBUG: Trying to import analysis package "Unpacker"...
2020-06-05 14:02:07,109 [root] DEBUG: Imported analysis package "Unpacker".
2020-06-05 14:02:07,109 [root] DEBUG: Trying to initialize analysis package "Unpacker"...
2020-06-05 14:02:07,109 [root] DEBUG: Initialized analysis package "Unpacker".
2020-06-05 14:02:07,171 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.browser"...
2020-06-05 14:02:07,171 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser".
2020-06-05 14:02:07,171 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.curtain"...
2020-06-05 14:02:07,249 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain".
2020-06-05 14:02:07,249 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.digisig"...
2020-06-05 14:02:07,296 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig".
2020-06-05 14:02:07,296 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.disguise"...
2020-06-05 14:02:07,296 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise".
2020-06-05 14:02:07,296 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.human"...
2020-06-05 14:02:07,312 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human".
2020-06-05 14:02:07,312 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.procmon"...
2020-06-05 14:02:07,312 [root] DEBUG: Imported auxiliary module "modules.auxiliary.procmon".
2020-06-05 14:02:07,312 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.screenshots"...
2020-06-05 14:02:07,312 [modules.auxiliary.screenshots] DEBUG: Importing 'time'
2020-06-05 14:02:07,312 [modules.auxiliary.screenshots] DEBUG: Importing 'StringIO'
2020-06-05 14:02:07,312 [modules.auxiliary.screenshots] DEBUG: Importing 'Thread'
2020-06-05 14:02:07,312 [modules.auxiliary.screenshots] DEBUG: Importing 'Auxiliary'
2020-06-05 14:02:07,328 [modules.auxiliary.screenshots] DEBUG: Importing 'NetlogFile'
2020-06-05 14:02:07,328 [modules.auxiliary.screenshots] DEBUG: Importing 'Screenshot'
2020-06-05 14:02:07,359 [lib.api.screenshot] DEBUG: Importing 'math'
2020-06-05 14:02:07,359 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2020-06-05 14:02:07,906 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2020-06-05 14:02:07,921 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2020-06-05 14:02:08,234 [modules.auxiliary.screenshots] DEBUG: Imports OK
2020-06-05 14:02:08,234 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots".
2020-06-05 14:02:08,234 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.sysmon"...
2020-06-05 14:02:08,234 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon".
2020-06-05 14:02:08,234 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.usage"...
2020-06-05 14:02:08,249 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage".
2020-06-05 14:02:08,249 [root] DEBUG: Trying to initialize auxiliary module "Browser"...
2020-06-05 14:02:08,249 [root] DEBUG: Initialized auxiliary module "Browser".
2020-06-05 14:02:08,249 [root] DEBUG: Trying to start auxiliary module "Browser"...
2020-06-05 14:02:08,265 [root] DEBUG: Started auxiliary module Browser
2020-06-05 14:02:08,265 [root] DEBUG: Trying to initialize auxiliary module "Curtain"...
2020-06-05 14:02:08,265 [root] DEBUG: Initialized auxiliary module "Curtain".
2020-06-05 14:02:08,265 [root] DEBUG: Trying to start auxiliary module "Curtain"...
2020-06-05 14:02:08,265 [root] DEBUG: Started auxiliary module Curtain
2020-06-05 14:02:08,265 [root] DEBUG: Trying to initialize auxiliary module "DigiSig"...
2020-06-05 14:02:08,265 [root] DEBUG: Initialized auxiliary module "DigiSig".
2020-06-05 14:02:08,265 [root] DEBUG: Trying to start auxiliary module "DigiSig"...
2020-06-05 14:02:08,265 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature.
2020-06-05 14:02:09,156 [modules.auxiliary.digisig] DEBUG: File is not signed.
2020-06-05 14:02:09,156 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2020-06-05 14:02:09,156 [root] DEBUG: Started auxiliary module DigiSig
2020-06-05 14:02:09,171 [root] DEBUG: Trying to initialize auxiliary module "Disguise"...
2020-06-05 14:02:09,171 [root] DEBUG: Initialized auxiliary module "Disguise".
2020-06-05 14:02:09,171 [root] DEBUG: Trying to start auxiliary module "Disguise"...
2020-06-05 14:02:09,203 [root] DEBUG: Started auxiliary module Disguise
2020-06-05 14:02:09,203 [root] DEBUG: Trying to initialize auxiliary module "Human"...
2020-06-05 14:02:09,203 [root] DEBUG: Initialized auxiliary module "Human".
2020-06-05 14:02:09,203 [root] DEBUG: Trying to start auxiliary module "Human"...
2020-06-05 14:02:09,218 [root] DEBUG: Started auxiliary module Human
2020-06-05 14:02:09,218 [root] DEBUG: Trying to initialize auxiliary module "Procmon"...
2020-06-05 14:02:09,218 [root] DEBUG: Initialized auxiliary module "Procmon".
2020-06-05 14:02:09,218 [root] DEBUG: Trying to start auxiliary module "Procmon"...
2020-06-05 14:02:09,218 [root] DEBUG: Started auxiliary module Procmon
2020-06-05 14:02:09,218 [root] DEBUG: Trying to initialize auxiliary module "Screenshots"...
2020-06-05 14:02:09,218 [root] DEBUG: Initialized auxiliary module "Screenshots".
2020-06-05 14:02:09,218 [root] DEBUG: Trying to start auxiliary module "Screenshots"...
2020-06-05 14:02:09,218 [root] DEBUG: Started auxiliary module Screenshots
2020-06-05 14:02:09,218 [root] DEBUG: Trying to initialize auxiliary module "Sysmon"...
2020-06-05 14:02:09,218 [root] DEBUG: Initialized auxiliary module "Sysmon".
2020-06-05 14:02:09,218 [root] DEBUG: Trying to start auxiliary module "Sysmon"...
2020-06-05 14:02:09,218 [root] DEBUG: Started auxiliary module Sysmon
2020-06-05 14:02:09,234 [root] DEBUG: Trying to initialize auxiliary module "Usage"...
2020-06-05 14:02:09,234 [root] DEBUG: Initialized auxiliary module "Usage".
2020-06-05 14:02:09,234 [root] DEBUG: Trying to start auxiliary module "Usage"...
2020-06-05 14:02:09,234 [root] DEBUG: Started auxiliary module Usage
2020-06-05 14:02:09,234 [root] INFO: Analyzer: Package modules.packages.Unpacker does not specify a DLL option
2020-06-05 14:02:09,234 [root] INFO: Analyzer: Package modules.packages.Unpacker does not specify a DLL_64 option
2020-06-05 14:02:09,234 [root] INFO: Analyzer: Package modules.packages.Unpacker does not specify a loader option
2020-06-05 14:02:09,234 [root] INFO: Analyzer: Package modules.packages.Unpacker does not specify a loader_64 option
2020-06-05 14:02:09,343 [lib.api.process] INFO: Successfully executed process from path "C:\Users\Louise\AppData\Local\Temp\scan-4109384_pdf.exe" with arguments "" with pid 4804
2020-06-05 14:02:09,343 [lib.api.process] INFO: Monitor config for process 4804: C:\tmpt2nfl3rg\dll\4804.ini
2020-06-05 14:02:09,343 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-06-05 14:02:09,343 [lib.api.process] INFO: Option 'unpacker' with value '1' sent to monitor
2020-06-05 14:02:09,343 [lib.api.process] INFO: Option 'injection' with value '0' sent to monitor
2020-06-05 14:02:09,375 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpt2nfl3rg\dll\qQtePz.dll, loader C:\tmpt2nfl3rg\bin\ozWYWNB.exe
2020-06-05 14:02:09,437 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\QaeyIcitc.
2020-06-05 14:02:09,437 [root] DEBUG: Loader: Injecting process 4804 (thread 3504) with C:\tmpt2nfl3rg\dll\qQtePz.dll.
2020-06-05 14:02:09,453 [root] DEBUG: Process image base: 0x00400000
2020-06-05 14:02:09,468 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpt2nfl3rg\dll\qQtePz.dll.
2020-06-05 14:02:09,468 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-05 14:02:09,468 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\qQtePz.dll.
2020-06-05 14:02:09,468 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 4804
2020-06-05 14:02:11,468 [lib.api.process] INFO: Successfully resumed process with pid 4804
2020-06-05 14:02:13,234 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-05 14:02:13,234 [root] DEBUG: Process dumps disabled.
2020-06-05 14:02:13,234 [root] DEBUG: Auto-unpacking of payloads enabled.
2020-06-05 14:02:13,234 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-05 14:02:13,249 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-05 14:02:13,249 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 4804 at 0x707c0000, image base 0x400000, stack from 0x186000-0x190000
2020-06-05 14:02:13,249 [root] DEBUG: Commandline: C:\Users\Louise\AppData\Local\Temp\"C:\Users\Louise\AppData\Local\Temp\scan-4109384_pdf.exe".
2020-06-05 14:02:13,281 [root] INFO: Disabling sleep skipping.
2020-06-05 14:02:13,296 [root] INFO: Disabling sleep skipping.
2020-06-05 14:02:13,296 [root] DEBUG: WoW64 detected: 64-bit ntdll base: 0x777d0000, KiUserExceptionDispatcher: 0x0, NtSetContextThread: 0x7783b5f0, Wow64PrepareForException: 0x0
2020-06-05 14:02:13,296 [root] INFO: Disabling sleep skipping.
2020-06-05 14:02:13,296 [root] DEBUG: WoW64 workaround: KiUserExceptionDispatcher hook installed at: 0x2b0000
2020-06-05 14:02:13,296 [root] INFO: Disabling sleep skipping.
2020-06-05 14:02:13,296 [root] DEBUG: UnpackerInit: Debugger initialised.
2020-06-05 14:02:13,296 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00400000.
2020-06-05 14:02:13,312 [root] DEBUG: AddTrackedRegion: New region at 0x00400000 size 0x1000 added to tracked regions: EntryPoint 0x62474, Entropy 6.814660e+00
2020-06-05 14:02:13,312 [root] DEBUG: UnpackerInit: Adding main image base to tracked regions.
2020-06-05 14:02:13,312 [root] INFO: loaded: b'4804'
2020-06-05 14:02:13,312 [root] INFO: Loaded monitor into process with pid 4804
2020-06-05 14:02:13,328 [root] DEBUG: Allocation: 0x002C0000 - 0x002C1000, size: 0x1000, protection: 0x40.
2020-06-05 14:02:13,328 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 3504 type 1 at address 0x002C0000, size 2 with Callback 0x707da080.
2020-06-05 14:02:13,343 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2748.
2020-06-05 14:02:13,343 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 2748 type 1 at address 0x002C0000, size 2 with Callback 0x707da080.
2020-06-05 14:02:13,343 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 2748 type 1 at address 0x002C003C, size 4 with Callback 0x707d9cc0.
2020-06-05 14:02:13,343 [root] DEBUG: SetThreadBreakpoint: Set bp 2 thread id 2748 type 0 at address 0x002C0000, size 0 with Callback 0x707d9ed0.
2020-06-05 14:02:13,343 [root] DEBUG: ProtectionHandler: Address 0x0045AA26 already in tracked region at 0x00400000, size 0x1000
2020-06-05 14:02:13,359 [root] DEBUG: ProtectionHandler: Address: 0x0045AA26 (alloc base 0x00400000), NumberOfBytesToProtect: 0x739c, NewAccessProtection: 0x40
2020-06-05 14:02:13,359 [root] DEBUG: ProtectionHandler: Increased region size at 0x0045AA26 to 0x61dc2.
2020-06-05 14:02:13,359 [root] DEBUG: ProtectionHandler: Updated region protection at 0x0045AA26 to 0x40.
2020-06-05 14:02:13,359 [root] DEBUG: ProcessImageBase: EP 0x00062474 image base 0x00400000 size 0x0 entropy 6.821886e+00.
2020-06-05 14:02:13,359 [root] DEBUG: Allocation: 0x003E0000 - 0x003E1000, size: 0x1000, protection: 0x40.
2020-06-05 14:02:13,359 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:02:13,359 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:02:13,375 [root] DEBUG: ProcessImageBase: EP 0x00062474 image base 0x00400000 size 0x0 entropy 6.800588e+00.
2020-06-05 14:02:13,375 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x002C0000.
2020-06-05 14:02:13,375 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x003E0000, size: 0x1000.
2020-06-05 14:02:13,375 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x003E0000.
2020-06-05 14:02:13,375 [root] DEBUG: AddTrackedRegion: New region at 0x003E0000 size 0x1000 added to tracked regions.
2020-06-05 14:02:13,375 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x003E0000, TrackedRegion->RegionSize: 0x1000, thread 2748
2020-06-05 14:02:13,375 [root] DEBUG: ActivateBreakpoints: Switching breakpoints from region 0x002C0000 to 0x003E0000.
2020-06-05 14:02:13,375 [root] DEBUG: DumpPEsInRange: Scanning range 0x2c0000 - 0x2c1000.
2020-06-05 14:02:13,375 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x2c0000-0x2c1000.
2020-06-05 14:02:13,375 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x002C0000 - 0x002C1000.
2020-06-05 14:02:13,718 [root] INFO: ('dump_file', 'C:\\LEGJCJ\\CAPE\\4804_1739578473132205562020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\scan-4109384_pdf.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\scan-4109384_pdf.exe;?0x002C0000;?', ['4804'], 'CAPE')
2020-06-05 14:02:14,015 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\LEGJCJ\CAPE\4804_1739578473132205562020 (size 0xffb)
2020-06-05 14:02:14,015 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x002C0000.
2020-06-05 14:02:14,015 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x2c0000 - 0x2c1000.
2020-06-05 14:02:14,015 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 2748 type 1 at address 0x003E0000, size 2 with Callback 0x707da080.
2020-06-05 14:02:14,015 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x003E0000
2020-06-05 14:02:14,031 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 2748 type 1 at address 0x003E003C, size 4 with Callback 0x707d9cc0.
2020-06-05 14:02:14,031 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x003E003C
2020-06-05 14:02:14,031 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x003E0000 (size 0x1000).
2020-06-05 14:02:14,031 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x0045C4E4 (thread 2748)
2020-06-05 14:02:14,031 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x003E0000.
2020-06-05 14:02:14,031 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x3e0000: 0x0.
2020-06-05 14:02:14,031 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-06-05 14:02:14,031 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x0045C4E4 (thread 2748)
2020-06-05 14:02:14,046 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x003E0000.
2020-06-05 14:02:14,046 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x003E0000 already exists for thread 2748 (process 4804), skipping.
2020-06-05 14:02:14,046 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x3e0000: 0x0.
2020-06-05 14:02:14,062 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-06-05 14:02:14,062 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x0045C4E4 (thread 2748)
2020-06-05 14:02:14,062 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x003E003C.
2020-06-05 14:02:14,062 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header zero.
2020-06-05 14:02:14,062 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x0045C4E4 (thread 2748)
2020-06-05 14:02:14,062 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x003E003C.
2020-06-05 14:02:14,078 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header zero.
2020-06-05 14:02:14,078 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x0045C4E4 (thread 2748)
2020-06-05 14:02:14,078 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x003E003C.
2020-06-05 14:02:14,078 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header zero.
2020-06-05 14:02:14,078 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x0045C4E4 (thread 2748)
2020-06-05 14:02:14,078 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x003E003C.
2020-06-05 14:02:14,078 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header zero.
2020-06-05 14:02:14,078 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x004613EE (thread 2748)
2020-06-05 14:02:14,093 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x003E0000.
2020-06-05 14:02:14,093 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x003E0000 already exists for thread 2748 (process 4804), skipping.
2020-06-05 14:02:14,093 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x3e0000: 0xb8.
2020-06-05 14:02:14,093 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-06-05 14:02:14,093 [root] DEBUG: set_caller_info: Adding region at 0x003E0000 to caller regions list (ntdll::memcpy).
2020-06-05 14:02:14,125 [root] INFO: Announced 32-bit process name: scan-4109384_pdf.exe pid: 1496
2020-06-05 14:02:14,125 [lib.api.process] INFO: Monitor config for process 1496: C:\tmpt2nfl3rg\dll\1496.ini
2020-06-05 14:02:14,125 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-06-05 14:02:14,125 [lib.api.process] INFO: Option 'unpacker' with value '1' sent to monitor
2020-06-05 14:02:14,125 [lib.api.process] INFO: Option 'injection' with value '0' sent to monitor
2020-06-05 14:02:14,187 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpt2nfl3rg\dll\qQtePz.dll, loader C:\tmpt2nfl3rg\bin\ozWYWNB.exe
2020-06-05 14:02:14,249 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\QaeyIcitc.
2020-06-05 14:02:14,249 [root] DEBUG: Loader: Injecting process 1496 (thread 3720) with C:\tmpt2nfl3rg\dll\qQtePz.dll.
2020-06-05 14:02:14,249 [root] DEBUG: Process image base: 0x00400000
2020-06-05 14:02:14,265 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpt2nfl3rg\dll\qQtePz.dll.
2020-06-05 14:02:14,265 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-05 14:02:14,265 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\qQtePz.dll.
2020-06-05 14:02:14,265 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1496
2020-06-05 14:02:14,265 [root] DEBUG: DLL loaded at 0x75300000: C:\Windows\system32\apphelp (0x4c000 bytes).
2020-06-05 14:02:14,296 [root] DEBUG: DLL unloaded from 0x00400000.
2020-06-05 14:02:14,296 [root] INFO: Announced 32-bit process name: scan-4109384_pdf.exe pid: 1496
2020-06-05 14:02:14,296 [lib.api.process] INFO: Monitor config for process 1496: C:\tmpt2nfl3rg\dll\1496.ini
2020-06-05 14:02:14,296 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-06-05 14:02:14,296 [lib.api.process] INFO: Option 'unpacker' with value '1' sent to monitor
2020-06-05 14:02:14,296 [lib.api.process] INFO: Option 'injection' with value '0' sent to monitor
2020-06-05 14:02:14,296 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpt2nfl3rg\dll\qQtePz.dll, loader C:\tmpt2nfl3rg\bin\ozWYWNB.exe
2020-06-05 14:02:14,328 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\QaeyIcitc.
2020-06-05 14:02:14,328 [root] DEBUG: Loader: Injecting process 1496 (thread 3720) with C:\tmpt2nfl3rg\dll\qQtePz.dll.
2020-06-05 14:02:14,328 [root] DEBUG: Process image base: 0x00400000
2020-06-05 14:02:14,328 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpt2nfl3rg\dll\qQtePz.dll.
2020-06-05 14:02:14,328 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-06-05 14:02:14,328 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\qQtePz.dll.
2020-06-05 14:02:14,328 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1496
2020-06-05 14:02:14,328 [root] INFO: Announced 32-bit process name: scan-4109384_pdf.exe pid: 1496
2020-06-05 14:02:14,343 [lib.api.process] INFO: Monitor config for process 1496: C:\tmpt2nfl3rg\dll\1496.ini
2020-06-05 14:02:14,343 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-06-05 14:02:14,343 [lib.api.process] INFO: Option 'unpacker' with value '1' sent to monitor
2020-06-05 14:02:14,343 [lib.api.process] INFO: Option 'injection' with value '0' sent to monitor
2020-06-05 14:02:14,343 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpt2nfl3rg\dll\qQtePz.dll, loader C:\tmpt2nfl3rg\bin\ozWYWNB.exe
2020-06-05 14:02:14,359 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\QaeyIcitc.
2020-06-05 14:02:14,359 [root] DEBUG: Loader: Injecting process 1496 (thread 0) with C:\tmpt2nfl3rg\dll\qQtePz.dll.
2020-06-05 14:02:14,359 [root] DEBUG: Error 0 (0x0) - GetProcessInitialThreadId: Remote PEB 0x7EFDE000 Local PEB 0x7EFDD000 Local TEB 0x7EFDE000: The operation completed successfully.
2020-06-05 14:02:14,359 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 3720, handle 0xc4
2020-06-05 14:02:14,359 [root] DEBUG: Process image base: 0x00400000
2020-06-05 14:02:14,359 [root] DEBUG: InjectDllViaIAT: Executable DOS header zero.
2020-06-05 14:02:14,375 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\qQtePz.dll.
2020-06-05 14:02:14,375 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1496
2020-06-05 14:02:14,375 [root] INFO: Announced 32-bit process name: scan-4109384_pdf.exe pid: 1496
2020-06-05 14:02:14,375 [lib.api.process] INFO: Monitor config for process 1496: C:\tmpt2nfl3rg\dll\1496.ini
2020-06-05 14:02:14,375 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-06-05 14:02:14,375 [lib.api.process] INFO: Option 'unpacker' with value '1' sent to monitor
2020-06-05 14:02:14,375 [lib.api.process] INFO: Option 'injection' with value '0' sent to monitor
2020-06-05 14:02:14,375 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpt2nfl3rg\dll\qQtePz.dll, loader C:\tmpt2nfl3rg\bin\ozWYWNB.exe
2020-06-05 14:02:14,390 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\QaeyIcitc.
2020-06-05 14:02:14,390 [root] DEBUG: Loader: Injecting process 1496 (thread 3720) with C:\tmpt2nfl3rg\dll\qQtePz.dll.
2020-06-05 14:02:14,406 [root] DEBUG: Process image base: 0x00400000
2020-06-05 14:02:14,406 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpt2nfl3rg\dll\qQtePz.dll.
2020-06-05 14:02:14,406 [root] DEBUG: InjectDllViaIAT: Memory region at 0x07000000 not empty.
2020-06-05 14:02:14,406 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-05 14:02:14,406 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\qQtePz.dll.
2020-06-05 14:02:14,437 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1496
2020-06-05 14:02:14,437 [root] DEBUG: NtTerminateProcess hook: Processing tracked regions before shutdown (process 4804).
2020-06-05 14:02:14,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:02:14,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:02:14,453 [root] DEBUG: ProcessImageBase: EP 0x00062474 image base 0x00400000 size 0x0 entropy 6.800588e+00.
2020-06-05 14:02:14,453 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x002C0000.
2020-06-05 14:02:14,453 [root] DEBUG: DumpPEsInRange: Scanning range 0x2c0000 - 0x2c1000.
2020-06-05 14:02:14,453 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x2c0000-0x2c1000.
2020-06-05 14:02:14,453 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x002C0000 - 0x002C1000.
2020-06-05 14:02:14,468 [root] INFO: ('dump_file', 'C:\\LEGJCJ\\CAPE\\4804_86278134242816662020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\scan-4109384_pdf.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\scan-4109384_pdf.exe;?0x002C0000;?', ['4804'], 'CAPE')
2020-06-05 14:02:14,468 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-05 14:02:14,484 [root] DEBUG: Process dumps disabled.
2020-06-05 14:02:14,484 [root] DEBUG: Auto-unpacking of payloads enabled.
2020-06-05 14:02:14,484 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-05 14:02:14,484 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\LEGJCJ\CAPE\4804_86278134242816662020 (size 0xffb)
2020-06-05 14:02:14,484 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x002C0000.
2020-06-05 14:02:14,484 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x2c0000 - 0x2c1000.
2020-06-05 14:02:14,500 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-06-05 14:02:14,500 [root] INFO: Disabling sleep skipping.
2020-06-05 14:02:14,500 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-05 14:02:14,500 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 1496 at 0x707c0000, image base 0x400000, stack from 0x186000-0x190000
2020-06-05 14:02:14,500 [root] DEBUG: Commandline: C:\Users\Louise\AppData\Local\Temp\"C:\Users\Louise\AppData\Local\Temp\scan-4109384_pdf.exe".
2020-06-05 14:02:14,500 [root] DEBUG: DLL unloaded from 0x75770000.
2020-06-05 14:02:14,500 [root] WARNING: Unable to open termination event for pid 4804.
2020-06-05 14:02:14,546 [root] DEBUG: NtTerminateProcess hook: Processing tracked regions before shutdown (process 4804).
2020-06-05 14:02:14,546 [root] DEBUG: WoW64 detected: 64-bit ntdll base: 0x777d0000, KiUserExceptionDispatcher: 0x0, NtSetContextThread: 0x7783b5f0, Wow64PrepareForException: 0x0
2020-06-05 14:02:14,546 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:02:14,562 [root] DEBUG: WoW64 workaround: KiUserExceptionDispatcher hook installed at: 0x2c0000
2020-06-05 14:02:14,562 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-06-05 14:02:14,578 [root] DEBUG: UnpackerInit: Debugger initialised.
2020-06-05 14:02:14,578 [root] DEBUG: ProcessImageBase: EP 0x00062474 image base 0x00400000 size 0x0 entropy 6.800588e+00.
2020-06-05 14:02:14,578 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00400000.
2020-06-05 14:02:14,578 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x002C0000.
2020-06-05 14:02:14,578 [root] DEBUG: DumpPEsInRange: Scanning range 0x2c0000 - 0x2c1000.
2020-06-05 14:02:14,578 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x2c0000-0x2c1000.
2020-06-05 14:02:14,593 [root] DEBUG: AddTrackedRegion: New region at 0x00400000 size 0xa2000 added to tracked regions: EntryPoint 0x139de, Entropy 1.392737e+00
2020-06-05 14:02:14,609 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x002C0000 - 0x002C1000.
2020-06-05 14:02:14,609 [root] DEBUG: UnpackerInit: Adding main image base to tracked regions.
2020-06-05 14:02:14,609 [root] INFO: loaded: b'1496'
2020-06-05 14:02:14,609 [root] INFO: Loaded monitor into process with pid 1496
2020-06-05 14:02:14,625 [root] DEBUG: DLL loaded at 0x75D90000: C:\Windows\syswow64\SHELL32 (0xc4c000 bytes).
2020-06-05 14:02:14,625 [root] INFO: ('dump_file', 'C:\\LEGJCJ\\CAPE\\4804_460693214442916662020', b'9;?C:\\Users\\Louise\\AppData\\Local\\Temp\\scan-4109384_pdf.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\scan-4109384_pdf.exe;?0x002C0000;?', ['4804'], 'CAPE')
2020-06-05 14:02:14,656 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\LEGJCJ\CAPE\4804_460693214442916662020 (size 0xffb)
2020-06-05 14:02:14,656 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x002C0000.
2020-06-05 14:02:14,656 [root] DEBUG: DLL loaded at 0x74A50000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-06-05 14:02:14,656 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x2c0000 - 0x2c1000.
2020-06-05 14:02:14,671 [root] DEBUG: DLL loaded at 0x748F0000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-06-05 14:02:14,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-06-05 14:02:14,718 [root] DEBUG: ClearAllBreakpoints: Error getting thread context (thread 3504, handle 0xd0).
2020-06-05 14:02:14,750 [root] DEBUG: DLL loaded at 0x6FD50000: C:\Program Files (x86)\Mozilla Firefox\nss3 (0x22f000 bytes).
2020-06-05 14:02:14,765 [root] DEBUG: DLL loaded at 0x70410000: C:\Program Files (x86)\Mozilla Firefox\mozglue (0x71000 bytes).
2020-06-05 14:02:14,781 [root] DEBUG: DLL loaded at 0x77270000: C:\Windows\syswow64\CRYPT32 (0x122000 bytes).
2020-06-05 14:02:14,796 [root] DEBUG: DLL loaded at 0x76DE0000: C:\Windows\syswow64\MSASN1 (0xc000 bytes).
2020-06-05 14:02:14,812 [root] DEBUG: DLL loaded at 0x73D80000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-05 14:02:14,812 [root] DEBUG: DLL loaded at 0x77540000: C:\Windows\syswow64\WINTRUST (0x2f000 bytes).
2020-06-05 14:02:14,812 [root] DEBUG: DLL loaded at 0x73BA0000: C:\Windows\system32\dbghelp (0xeb000 bytes).
2020-06-05 14:02:14,843 [root] DEBUG: DLL loaded at 0x70390000: C:\Windows\system32\MSVCP140 (0x71000 bytes).
2020-06-05 14:02:14,875 [root] DEBUG: DLL loaded at 0x70370000: C:\Windows\system32\VCRUNTIME140 (0x15000 bytes).
2020-06-05 14:02:14,875 [root] DEBUG: DLL loaded at 0x74DF0000: C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0 (0x4000 bytes).
2020-06-05 14:02:14,890 [root] DEBUG: DLL loaded at 0x74D10000: C:\Windows\system32\ucrtbase (0xe0000 bytes).
2020-06-05 14:02:14,921 [root] DEBUG: DLL loaded at 0x74CD0000: C:\Windows\system32\api-ms-win-core-timezone-l1-1-0 (0x3000 bytes).
2020-06-05 14:02:14,937 [root] DEBUG: DLL loaded at 0x74CC0000: C:\Windows\system32\api-ms-win-core-file-l2-1-0 (0x3000 bytes).
2020-06-05 14:02:14,968 [root] DEBUG: DLL loaded at 0x74CB0000: C:\Windows\system32\api-ms-win-core-localization-l1-2-0 (0x3000 bytes).
2020-06-05 14:02:15,000 [root] DEBUG: DLL loaded at 0x714A0000: C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0 (0x5000 bytes).
2020-06-05 14:02:15,031 [root] DEBUG: DLL loaded at 0x74C10000: C:\Windows\system32\api-ms-win-crt-time-l1-1-0 (0x3000 bytes).
2020-06-05 14:02:15,031 [root] DEBUG: DLL loaded at 0x74BD0000: C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0 (0x3000 bytes).
2020-06-05 14:02:15,046 [root] DEBUG: DLL loaded at 0x74BF0000: C:\Windows\system32\api-ms-win-crt-environment-l1-1-0 (0x3000 bytes).
2020-06-05 14:02:15,062 [root] DEBUG: DLL loaded at 0x74D00000: C:\Windows\system32\api-ms-win-crt-utility-l1-1-0 (0x3000 bytes).
2020-06-05 14:02:15,125 [root] DEBUG: DLL loaded at 0x70330000: C:\Windows\system32\WINMM (0x32000 bytes).
2020-06-05 14:02:15,140 [root] DEBUG: DLL loaded at 0x70320000: C:\Windows\system32\WSOCK32 (0x7000 bytes).
2020-06-05 14:02:15,171 [root] DEBUG: DLL loaded at 0x702B0000: C:\Program Files (x86)\Mozilla Firefox\softokn3 (0x37000 bytes).
2020-06-05 14:02:15,187 [root] DEBUG: DLL loaded at 0x6FCE0000: C:\Program Files (x86)\Mozilla Firefox\freebl3 (0x6f000 bytes).
2020-06-05 14:02:15,406 [root] DEBUG: DLL unloaded from 0x6FCE0000.
2020-06-05 14:02:15,421 [root] DEBUG: DLL unloaded from 0x702B0000.
2020-06-05 14:02:15,437 [root] DEBUG: DLL unloaded from 0x6FD50000.
2020-06-05 14:02:15,468 [root] DEBUG: DLL unloaded from 0x75350000.
2020-06-05 14:02:15,468 [root] DEBUG: DLL unloaded from 0x76E00000.
2020-06-05 14:02:15,562 [root] DEBUG: DLL unloaded from 0x75350000.
2020-06-05 14:02:15,562 [root] DEBUG: DLL unloaded from 0x76E00000.
2020-06-05 14:02:15,562 [root] DEBUG: DLL unloaded from 0x75AE0000.
2020-06-05 14:02:15,578 [root] DEBUG: DLL unloaded from 0x75350000.
2020-06-05 14:02:15,578 [root] DEBUG: DLL unloaded from 0x76E00000.
2020-06-05 14:02:16,015 [root] DEBUG: DLL loaded at 0x714A0000: C:\Windows\system32\vaultcli (0xc000 bytes).
2020-06-05 14:02:16,031 [root] DEBUG: DLL unloaded from 0x75600000.
2020-06-05 14:02:16,265 [root] INFO: Announced starting service "b'VaultSvc'"
2020-06-05 14:02:16,265 [lib.api.process] INFO: Monitor config for process 472: C:\tmpt2nfl3rg\dll\472.ini
2020-06-05 14:02:16,296 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-06-05 14:02:16,296 [lib.api.process] INFO: Option 'unpacker' with value '1' sent to monitor
2020-06-05 14:02:16,296 [lib.api.process] INFO: Option 'injection' with value '0' sent to monitor
2020-06-05 14:02:16,296 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpt2nfl3rg\dll\chFNVzwV.dll, loader C:\tmpt2nfl3rg\bin\mkTmyKlu.exe
2020-06-05 14:02:16,406 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\QaeyIcitc.
2020-06-05 14:02:16,453 [root] DEBUG: Loader: Injecting process 472 (thread 0) with C:\tmpt2nfl3rg\dll\chFNVzwV.dll.
2020-06-05 14:02:16,484 [root] DEBUG: Error 0 (0x0) - GetProcessInitialThreadId: Remote PEB 0x000007FFFFFD4000 Local PEB 0x000007FFFFFDE000 Local TEB 0x000007FFFFFD7000: The operation completed successfully.
2020-06-05 14:02:16,500 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2020-06-05 14:02:16,546 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-05 14:02:16,546 [root] DEBUG: Process dumps disabled.
2020-06-05 14:02:16,546 [root] DEBUG: Auto-unpacking of payloads enabled.
2020-06-05 14:02:16,546 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-05 14:02:16,562 [root] INFO: Disabling sleep skipping.
2020-06-05 14:02:16,562 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 472 at 0x0000000070390000, image base 0x00000000FFBB0000, stack from 0x0000000002926000-0x0000000002930000
2020-06-05 14:02:16,562 [root] DEBUG: Commandline: C:\Windows\sysnative\services.exe.
2020-06-05 14:02:16,640 [root] WARNING: b'Unable to place hook on LockResource'
2020-06-05 14:02:16,640 [root] WARNING: b'Unable to hook LockResource'
2020-06-05 14:02:16,656 [root] DEBUG: UnpackerInit: Debugger initialised.
2020-06-05 14:02:16,671 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00000000FFBB0000.
2020-06-05 14:02:16,671 [root] DEBUG: AddTrackedRegion: New region at 0x00000000FFBB0000 size 0x1000 added to tracked regions: EntryPoint 0x1331c, Entropy 6.074961e+00
2020-06-05 14:02:16,687 [root] DEBUG: UnpackerInit: Adding main image base to tracked regions.
2020-06-05 14:02:16,718 [root] INFO: loaded: b'472'
2020-06-05 14:02:16,718 [root] INFO: Loaded monitor into process with pid 472
2020-06-05 14:02:16,718 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-05 14:02:16,718 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-05 14:02:16,734 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\chFNVzwV.dll.
2020-06-05 14:02:17,750 [root] INFO: Announced 64-bit process name: lsass.exe pid: 3456
2020-06-05 14:02:17,765 [lib.api.process] INFO: Monitor config for process 3456: C:\tmpt2nfl3rg\dll\3456.ini
2020-06-05 14:02:17,765 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-06-05 14:02:17,765 [lib.api.process] INFO: Option 'unpacker' with value '1' sent to monitor
2020-06-05 14:02:17,765 [lib.api.process] INFO: Option 'injection' with value '0' sent to monitor
2020-06-05 14:02:17,765 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpt2nfl3rg\dll\chFNVzwV.dll, loader C:\tmpt2nfl3rg\bin\mkTmyKlu.exe
2020-06-05 14:02:17,796 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\QaeyIcitc.
2020-06-05 14:02:17,796 [root] DEBUG: Loader: Injecting process 3456 (thread 3468) with C:\tmpt2nfl3rg\dll\chFNVzwV.dll.
2020-06-05 14:02:17,796 [root] DEBUG: Process image base: 0x00000000FF730000
2020-06-05 14:02:17,796 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpt2nfl3rg\dll\chFNVzwV.dll.
2020-06-05 14:02:17,796 [root] DEBUG: InjectDllViaIAT: Failed to allocate region in target process for new import table.
2020-06-05 14:02:17,812 [root] DEBUG: InjectDll: IAT patching failed, falling back to thread injection.
2020-06-05 14:02:17,828 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-05 14:02:17,828 [root] DEBUG: Process dumps disabled.
2020-06-05 14:02:17,843 [root] DEBUG: Auto-unpacking of payloads enabled.
2020-06-05 14:02:17,843 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-05 14:02:17,843 [root] INFO: Disabling sleep skipping.
2020-06-05 14:02:17,843 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 3456 at 0x0000000070390000, image base 0x00000000FF730000, stack from 0x0000000000194000-0x00000000001A0000
2020-06-05 14:02:17,843 [root] DEBUG: Commandline: C:\Windows\sysnative\lsass.exe.
2020-06-05 14:02:17,906 [root] WARNING: b'Unable to place hook on LockResource'
2020-06-05 14:02:17,906 [root] WARNING: b'Unable to hook LockResource'
2020-06-05 14:02:17,906 [root] DEBUG: UnpackerInit: Debugger initialised.
2020-06-05 14:02:17,921 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00000000FF730000.
2020-06-05 14:02:17,921 [root] DEBUG: AddTrackedRegion: New region at 0x00000000FF730000 size 0x1000 added to tracked regions: EntryPoint 0x1850, Entropy 3.559719e+00
2020-06-05 14:02:17,921 [root] DEBUG: UnpackerInit: Adding main image base to tracked regions.
2020-06-05 14:02:17,921 [root] INFO: loaded: b'3456'
2020-06-05 14:02:17,921 [root] INFO: Loaded monitor into process with pid 3456
2020-06-05 14:02:17,937 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-05 14:02:17,937 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-05 14:02:17,937 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\chFNVzwV.dll.
2020-06-05 14:02:48,015 [root] WARNING: Unable to open termination event for pid 3456.
2020-06-05 14:02:48,421 [root] DEBUG: DLL loaded at 0x74A70000: C:\Windows\system32\profapi (0xb000 bytes).
2020-06-05 14:02:49,078 [root] DEBUG: DLL loaded at 0x735E0000: C:\Program Files (x86)\Mozilla Thunderbird\nss3 (0x134000 bytes).
2020-06-05 14:02:49,093 [root] DEBUG: DLL loaded at 0x73840000: C:\Program Files (x86)\Mozilla Thunderbird\mozglue (0x24000 bytes).
2020-06-05 14:02:49,109 [root] DEBUG: DLL loaded at 0x73BA0000: C:\Windows\system32\dbghelp (0xeb000 bytes).
2020-06-05 14:02:49,125 [root] DEBUG: DLL loaded at 0x73D80000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-05 14:02:49,125 [root] DEBUG: DLL loaded at 0x737C0000: C:\Windows\system32\MSVCP140 (0x71000 bytes).
2020-06-05 14:02:49,140 [root] DEBUG: DLL loaded at 0x737A0000: C:\Windows\system32\VCRUNTIME140 (0x15000 bytes).
2020-06-05 14:02:49,140 [root] DEBUG: DLL loaded at 0x74DF0000: C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0 (0x4000 bytes).
2020-06-05 14:02:49,140 [root] DEBUG: DLL loaded at 0x74D10000: C:\Windows\system32\ucrtbase (0xe0000 bytes).
2020-06-05 14:02:49,156 [root] DEBUG: DLL loaded at 0x74CD0000: C:\Windows\system32\api-ms-win-core-timezone-l1-1-0 (0x3000 bytes).
2020-06-05 14:02:49,156 [root] DEBUG: DLL loaded at 0x74CC0000: C:\Windows\system32\api-ms-win-core-file-l2-1-0 (0x3000 bytes).
2020-06-05 14:02:49,171 [root] DEBUG: DLL loaded at 0x74CB0000: C:\Windows\system32\api-ms-win-core-localization-l1-2-0 (0x3000 bytes).
2020-06-05 14:02:49,171 [root] DEBUG: DLL loaded at 0x74CA0000: C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1 (0x3000 bytes).
2020-06-05 14:02:49,171 [root] DEBUG: DLL loaded at 0x74C90000: C:\Windows\system32\api-ms-win-core-file-l1-2-0 (0x3000 bytes).
2020-06-05 14:02:49,187 [root] DEBUG: DLL loaded at 0x74C70000: C:\Windows\system32\api-ms-win-crt-string-l1-1-0 (0x4000 bytes).
2020-06-05 14:02:49,187 [root] DEBUG: DLL loaded at 0x74C60000: C:\Windows\system32\api-ms-win-crt-heap-l1-1-0 (0x3000 bytes).
2020-06-05 14:02:49,203 [root] DEBUG: DLL loaded at 0x74C50000: C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0 (0x4000 bytes).
2020-06-05 14:02:49,203 [root] DEBUG: DLL loaded at 0x74C40000: C:\Windows\system32\api-ms-win-crt-convert-l1-1-0 (0x4000 bytes).
2020-06-05 14:02:49,203 [root] DEBUG: DLL loaded at 0x74C20000: C:\Windows\system32\api-ms-win-crt-locale-l1-1-0 (0x3000 bytes).
2020-06-05 14:02:49,218 [root] DEBUG: DLL loaded at 0x74C30000: C:\Windows\system32\api-ms-win-crt-math-l1-1-0 (0x5000 bytes).
2020-06-05 14:02:49,218 [root] DEBUG: DLL loaded at 0x735D0000: C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0 (0x5000 bytes).
2020-06-05 14:02:49,234 [root] DEBUG: DLL loaded at 0x74C10000: C:\Windows\system32\api-ms-win-crt-time-l1-1-0 (0x3000 bytes).
2020-06-05 14:02:49,234 [root] DEBUG: DLL loaded at 0x74BD0000: C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0 (0x3000 bytes).
2020-06-05 14:02:49,234 [root] DEBUG: DLL loaded at 0x74BF0000: C:\Windows\system32\api-ms-win-crt-environment-l1-1-0 (0x3000 bytes).
2020-06-05 14:02:49,249 [root] DEBUG: DLL loaded at 0x74D00000: C:\Windows\system32\api-ms-win-crt-utility-l1-1-0 (0x3000 bytes).
2020-06-05 14:02:49,265 [root] DEBUG: DLL loaded at 0x73590000: C:\Windows\system32\WINMM (0x32000 bytes).
2020-06-05 14:02:49,265 [root] DEBUG: DLL loaded at 0x73580000: C:\Windows\system32\WSOCK32 (0x7000 bytes).
2020-06-05 14:02:49,296 [root] DEBUG: DLL unloaded from 0x735E0000.
2020-06-05 14:02:49,312 [root] DEBUG: DLL unloaded from 0x75350000.
2020-06-05 14:02:49,312 [root] DEBUG: DLL unloaded from 0x76E00000.
2020-06-05 14:02:49,375 [root] DEBUG: DLL unloaded from 0x75350000.
2020-06-05 14:02:49,375 [root] DEBUG: DLL unloaded from 0x76E00000.
2020-06-05 14:02:49,375 [root] DEBUG: DLL unloaded from 0x75AE0000.
2020-06-05 14:02:49,375 [root] DEBUG: DLL unloaded from 0x75350000.
2020-06-05 14:02:49,390 [root] DEBUG: DLL unloaded from 0x76E00000.
2020-06-05 14:02:49,812 [root] DEBUG: DLL loaded at 0x73860000: C:\Windows\system32\SAMCLI (0xf000 bytes).
2020-06-05 14:02:49,828 [root] DEBUG: DLL loaded at 0x74AF0000: C:\Windows\system32\WKSCLI (0xf000 bytes).
2020-06-05 14:02:49,828 [root] DEBUG: DLL loaded at 0x74CE0000: C:\Windows\system32\NETAPI32 (0x11000 bytes).
2020-06-05 14:02:49,828 [root] DEBUG: DLL loaded at 0x74C80000: C:\Windows\system32\netutils (0x9000 bytes).
2020-06-05 14:02:49,828 [root] DEBUG: DLL loaded at 0x74B00000: C:\Windows\system32\srvcli (0x19000 bytes).
2020-06-05 14:02:49,843 [root] DEBUG: DLL loaded at 0x73840000: C:\Windows\system32\SAMLIB (0x12000 bytes).
2020-06-05 14:02:49,859 [root] DEBUG: DLL loaded at 0x74AD0000: C:\Windows\system32\USERENV (0x17000 bytes).
2020-06-05 14:02:49,875 [root] DEBUG: DLL loaded at 0x77270000: C:\Windows\syswow64\CRYPT32 (0x122000 bytes).
2020-06-05 14:02:49,875 [root] DEBUG: DLL loaded at 0x76DE0000: C:\Windows\syswow64\MSASN1 (0xc000 bytes).
2020-06-05 14:02:49,890 [root] DEBUG: DLL loaded at 0x74A90000: C:\Windows\System32\mswsock (0x3c000 bytes).
2020-06-05 14:02:49,906 [root] DEBUG: DLL loaded at 0x737F0000: C:\Windows\system32\DNSAPI (0x44000 bytes).
2020-06-05 14:02:49,906 [root] DEBUG: DLL loaded at 0x74EB0000: C:\Windows\system32\IPHLPAPI (0x1c000 bytes).
2020-06-05 14:02:49,921 [root] DEBUG: DLL loaded at 0x74EA0000: C:\Windows\system32\WINNSI (0x7000 bytes).
2020-06-05 14:03:04,171 [root] DEBUG: DLL loaded at 0x737E0000: C:\Windows\system32\rasadhlp (0x6000 bytes).
2020-06-05 14:03:04,171 [root] DEBUG: DLL loaded at 0x737D0000: C:\Windows\System32\wship6 (0x6000 bytes).
2020-06-05 14:03:18,500 [root] INFO: ('dump_file', 'C:\\Users\\Louise\\AppData\\Roaming\\E5A3EA\\ACE282.lck', '', False, 'files')
2020-06-05 14:03:18,562 [root] INFO: ('delete_file', 'C:\\Users\\Louise\\AppData\\Roaming\\E5A3EA\\ACE282.lck')
2020-06-05 14:03:18,562 [root] INFO: ('dump_file', 'C:\\Users\\Louise\\AppData\\Roaming\\E5A3EA\\ACE282.lck', '', False, 'files')
2020-06-05 14:03:47,203 [root] INFO: ('dump_file', 'C:\\Users\\Louise\\AppData\\Roaming\\E5A3EA\\ACE282.exe', '', None, 'files')
2020-06-05 14:03:47,265 [root] INFO: ('dump_file', 'C:\\Users\\Louise\\AppData\\Roaming\\E5A3EA\\ACE282.exe', '', False, 'files')
2020-06-05 14:05:32,000 [root] INFO: Analysis timeout hit, terminating analysis.
2020-06-05 14:05:32,000 [lib.api.process] ERROR: Failed to open terminate event for pid 4804
2020-06-05 14:05:32,000 [root] INFO: Terminate event set for process 4804.
2020-06-05 14:05:32,000 [lib.api.process] INFO: Terminate event set for process 1496
2020-06-05 14:05:37,031 [lib.api.process] INFO: Termination confirmed for process 1496
2020-06-05 14:05:37,031 [root] INFO: Terminate event set for process 1496.
2020-06-05 14:05:37,031 [lib.api.process] INFO: Terminate event set for process 472
2020-06-05 14:05:37,031 [root] DEBUG: Terminate Event: Processing tracked regions before shutdown (process 1496).
2020-06-05 14:05:37,125 [root] DEBUG: Terminate Event: Processing tracked regions before shutdown (process 472).
2020-06-05 14:05:42,031 [lib.api.process] INFO: Termination confirmed for process 472
2020-06-05 14:05:42,031 [root] INFO: Terminate event set for process 472.
2020-06-05 14:05:42,031 [lib.api.process] ERROR: Failed to open terminate event for pid 3456
2020-06-05 14:05:42,031 [root] INFO: Terminate event set for process 3456.
2020-06-05 14:05:42,031 [root] INFO: Created shutdown mutex.
2020-06-05 14:05:42,750 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-06-05 14:05:43,031 [root] INFO: Shutting down package.
2020-06-05 14:05:43,031 [root] INFO: Stopping auxiliary modules.
2020-06-05 14:06:08,015 [lib.common.results] WARNING: File C:\LEGJCJ\bin\procmon.xml doesn't exist anymore
2020-06-05 14:06:08,015 [root] INFO: Finishing auxiliary modules.
2020-06-05 14:06:08,015 [root] INFO: Shutting down pipe server and dumping dropped files.
2020-06-05 14:06:08,015 [root] WARNING: Folder at path "C:\LEGJCJ\debugger" does not exist, skip.
2020-06-05 14:06:08,062 [root] INFO: Analysis completed.

Machine

Name Label Manager Started On Shutdown On
win7x64_2 win7x64_6 KVM 2020-06-05 13:58:18 2020-06-05 14:06:21

File Details

File Name scan-4109384_pdf.exe
File Size 577024 bytes
File Type PE32 executable (GUI) Intel 80386, for MS Windows
PE timestamp 1992-06-19 22:22:17
MD5 f9ae03f53f99519ece3a8cfe30c84b72
SHA1 a0678b8625d66349c8e99c6598045772c43b74dd
SHA256 9026d8e80e90cca993c9c0a5978d2fc1eb92727127593d677441cf0909271e10
SHA512 f5f56d0ba4d007df3e5f222dc209c3e414a1859990d855a9161101a331e91b7f3a8e1db48a0815edf39d218e85264041113e657c4605b02be2aea635bedba7c2
CRC32 8BFA4030
Ssdeep 12288:/u3EjrY6vfxKKlxl+amOCaOGJxB7g466vWdvQVIQdFb+PZR:W0jUEfx3+D8l6yWIdFbIR
Download Download ZIP Resubmit sample

Signatures

Behavioural detection: Executable code extraction - unpacking
Dynamic (imported) function loading detected
DynamicLoader: IMM32.DLL/ImmCreateContext
DynamicLoader: IMM32.DLL/ImmDestroyContext
DynamicLoader: IMM32.DLL/ImmNotifyIME
DynamicLoader: IMM32.DLL/ImmAssociateContext
DynamicLoader: IMM32.DLL/ImmReleaseContext
DynamicLoader: IMM32.DLL/ImmGetContext
DynamicLoader: IMM32.DLL/ImmGetCompositionStringA
DynamicLoader: IMM32.DLL/ImmSetCompositionStringA
DynamicLoader: IMM32.DLL/ImmGetCompositionStringW
DynamicLoader: IMM32.DLL/ImmSetCompositionStringW
DynamicLoader: IMM32.DLL/ImmSetCandidateWindow
DynamicLoader: kernel32.dll/GetDiskFreeSpaceExA
DynamicLoader: oleaut32.dll/VariantChangeTypeEx
DynamicLoader: oleaut32.dll/VarNeg
DynamicLoader: oleaut32.dll/VarNot
DynamicLoader: oleaut32.dll/VarAdd
DynamicLoader: oleaut32.dll/VarSub
DynamicLoader: oleaut32.dll/VarMul
DynamicLoader: oleaut32.dll/VarDiv
DynamicLoader: oleaut32.dll/VarIdiv
DynamicLoader: oleaut32.dll/VarMod
DynamicLoader: oleaut32.dll/VarAnd
DynamicLoader: oleaut32.dll/VarOr
DynamicLoader: oleaut32.dll/VarXor
DynamicLoader: oleaut32.dll/VarCmp
DynamicLoader: oleaut32.dll/VarI4FromStr
DynamicLoader: oleaut32.dll/VarR4FromStr
DynamicLoader: oleaut32.dll/VarR8FromStr
DynamicLoader: oleaut32.dll/VarDateFromStr
DynamicLoader: oleaut32.dll/VarCyFromStr
DynamicLoader: oleaut32.dll/VarBoolFromStr
DynamicLoader: oleaut32.dll/VarBstrFromCy
DynamicLoader: oleaut32.dll/VarBstrFromDate
DynamicLoader: oleaut32.dll/VarBstrFromBool
DynamicLoader: USER32.dll/GetMonitorInfoA
DynamicLoader: USER32.dll/GetSystemMetrics
DynamicLoader: USER32.dll/EnumDisplayMonitors
DynamicLoader: USER32.dll/AnimateWindow
DynamicLoader: comctl32.dll/InitializeFlatSB
DynamicLoader: comctl32.dll/UninitializeFlatSB
DynamicLoader: comctl32.dll/FlatSB_GetScrollProp
DynamicLoader: comctl32.dll/FlatSB_SetScrollProp
DynamicLoader: comctl32.dll/FlatSB_EnableScrollBar
DynamicLoader: comctl32.dll/FlatSB_ShowScrollBar
DynamicLoader: comctl32.dll/FlatSB_GetScrollRange
DynamicLoader: comctl32.dll/FlatSB_GetScrollInfo
DynamicLoader: comctl32.dll/FlatSB_GetScrollPos
DynamicLoader: comctl32.dll/FlatSB_SetScrollPos
DynamicLoader: comctl32.dll/FlatSB_SetScrollInfo
DynamicLoader: comctl32.dll/FlatSB_SetScrollRange
DynamicLoader: USER32.dll/SetLayeredWindowAttributes
DynamicLoader: kernel32.dll/FileTimeToSystemTime
DynamicLoader: kernel32.dll/VirtualProtect
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptCreateHash
DynamicLoader: CRYPTSP.dll/CryptHashData
DynamicLoader: CRYPTSP.dll/CryptGetHashParam
DynamicLoader: CRYPTSP.dll/CryptDestroyHash
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: nss3.dll/NSS_Init
DynamicLoader: nss3.dll/NSS_Shutdown
DynamicLoader: nss3.dll/PK11_GetInternalKeySlot
DynamicLoader: nss3.dll/PK11_FreeSlot
DynamicLoader: nss3.dll/PK11_Authenticate
DynamicLoader: nss3.dll/PK11SDR_Decrypt
DynamicLoader: nss3.dll/PK11_CheckUserPassword
DynamicLoader: nss3.dll/SECITEM_FreeItem
DynamicLoader: kernel32.dll/SetThreadDescription
DynamicLoader: kernel32.dll/InitializeCriticalSectionEx
DynamicLoader: softokn3.dll/NSC_GetFunctionList
DynamicLoader: softokn3.dll/NSC_ModuleDBFunc
DynamicLoader: softokn3.dll/NSC_GetFunctionList
DynamicLoader: freebl3.dll/FREEBL_GetVector
DynamicLoader: CRYPTBASE.dll/SystemFunction001
DynamicLoader: CRYPTBASE.dll/SystemFunction002
DynamicLoader: CRYPTBASE.dll/SystemFunction003
DynamicLoader: CRYPTBASE.dll/SystemFunction004
DynamicLoader: CRYPTBASE.dll/SystemFunction005
DynamicLoader: CRYPTBASE.dll/SystemFunction028
DynamicLoader: CRYPTBASE.dll/SystemFunction029
DynamicLoader: CRYPTBASE.dll/SystemFunction034
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: CRYPTBASE.dll/SystemFunction040
DynamicLoader: CRYPTBASE.dll/SystemFunction041
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: vaultcli.dll/VaultEnumerateItems
DynamicLoader: vaultcli.dll/VaultEnumerateVaults
DynamicLoader: vaultcli.dll/VaultFree
DynamicLoader: vaultcli.dll/VaultGetItem
DynamicLoader: vaultcli.dll/VaultOpenVault
DynamicLoader: vaultcli.dll/VaultCloseVault
DynamicLoader: nss3.dll/NSS_Init
DynamicLoader: nss3.dll/NSS_Shutdown
DynamicLoader: nss3.dll/PK11_GetInternalKeySlot
DynamicLoader: nss3.dll/PK11_FreeSlot
DynamicLoader: nss3.dll/PK11_Authenticate
DynamicLoader: nss3.dll/PK11SDR_Decrypt
DynamicLoader: nss3.dll/PK11_CheckUserPassword
DynamicLoader: nss3.dll/SECITEM_FreeItem
DynamicLoader: nss3.dll/sqlite3_finalize
DynamicLoader: nss3.dll/sqlite3_step
DynamicLoader: nss3.dll/sqlite3_close
DynamicLoader: nss3.dll/sqlite3_column_text
DynamicLoader: nss3.dll/sqlite3_open16
DynamicLoader: nss3.dll/sqlite3_prepare_v2
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: NETAPI32.DLL/NetUserGetInfo
DynamicLoader: CRYPTSP.dll/CryptImportKey
DynamicLoader: CRYPTSP.dll/CryptSetKeyParam
DynamicLoader: CRYPTSP.dll/CryptDecrypt
DynamicLoader: CRYPTSP.dll/CryptDestroyKey
DynamicLoader: NETAPI32.DLL/NetUserGetInfo
DynamicLoader: NETAPI32.DLL/NetUserGetInfo
CAPE extracted potentially suspicious content
scan-4109384_pdf.exe: Unpacked Shellcode
Attempts to mimic the file extension of a PDF document by having 'pdf' in the file name.
Queries or connects to DNS-Over-HTTPS/DNS-Over-TLS domain or IP address
ip: 1.1.1.1
Queries or connects to DNS-Over-HTTPS/DNS-Over-TLS domain or IP address
ip: 1.1.1.1
The binary contains an unknown PE section name indicative of packing
unknown section: name: CODE, entropy: 6.56, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00061600, virtual_size: 0x000614bc
unknown section: name: DATA, entropy: 3.89, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00001400, virtual_size: 0x0000121c
unknown section: name: BSS, entropy: 0.00, characteristics: IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x00000be9
The binary likely contains encrypted or compressed data.
section: name: .rsrc, entropy: 7.45, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ, raw_size: 0x00021200, virtual_size: 0x000210e8
Authenticode signature is invalid
authenticode error: No signature found. SignTool Error File not valid C\Users\Louise\AppData\Local\Temp\scan-4109384_pdf.exe
Behavioural detection: Injection (Process Hollowing)
Injection: scan-4109384_pdf.exe(4804) -> scan-4109384_pdf.exe(1496)
Executed a process and injected code into it, probably while unpacking
Injection: scan-4109384_pdf.exe(4804) -> scan-4109384_pdf.exe(1496)
Deletes its original binary from disk
Behavioural detection: Injection (inter-process)
Attempts to repeatedly call a single API many times in order to delay analysis time
Spam: services.exe (472) called API GetSystemTimeAsFileTime 4464159 times
Steals private information from local Internet browsers
file: C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Default\Login Data
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\logins.json
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\pkcs11.txt
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\cert9.db
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\profiles.ini
A process attempted to collect browser passwords
Process: scan-4109384_pdf.exe (1496)
File has been identified by 29 Antiviruses on VirusTotal as malicious
FireEye: Generic.mg.f9ae03f53f99519e
Cylance: Unsafe
CrowdStrike: win/malicious_confidence_70% (D)
Alibaba: Trojan:Win32/Injector.89f84e22
K7GW: Trojan ( 005680341 )
K7AntiVirus: Trojan ( 005680341 )
Invincea: heuristic
BitDefenderTheta: AI:Packer.B1D1592921
Symantec: Infostealer.Lokibot!43
APEX: Malicious
Kaspersky: UDS:DangerousObject.Multi.Generic
Paloalto: generic.ml
Tencent: Win32.Backdoor.Fareit.Auto
McAfee-GW-Edition: BehavesLike.Win32.Fareit.hc
Fortinet: W32/Injector.EHDJ!tr
Trapmine: malicious.moderate.ml.score
Endgame: malicious (high confidence)
Microsoft: Trojan:Win32/Pwsteal.Q!bit
ZoneAlarm: UDS:DangerousObject.Multi.Generic
AhnLab-V3: Suspicious/Win.Delphiless.X2066
Acronis: suspicious
McAfee: Fareit-FTB!F9AE03F53F99
ESET-NOD32: a variant of Win32/Injector.EMGH
Rising: Trojan.Lokibot!8.F1B5 (CLOUD)
Yandex: Trojan.AvsArher.bTOmTw
Ikarus: Win32.Outbreak
eGambit: Unsafe.AI_Score_99%
Cybereason: malicious.625d66
Qihoo-360: HEUR/QVM05.1.B130.Malware.Gen
Creates a copy of itself
copy: C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.exe
Harvests credentials from local FTP client softwares
file: C:\Users\Louise\AppData\Roaming\FileZilla\sitemanager.xml
file: C:\Users\Louise\AppData\Roaming\FileZilla\recentservers.xml
file: C:\Users\Louise\AppData\Roaming\Far Manager\Profile\PluginsData\42E4AEB1-A230-44F4-B33C-F195BB654931.db
file: C:\Users\Louise\AppData\Roaming\FTPGetter\servers.xml
file: C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file: C:\Users\Louise\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
key: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
key: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
key: HKEY_CURRENT_USER\Software\Ghisler\Total Commander
key: HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
Harvests information related to installed instant messenger clients
file: C:\Users\Louise\AppData\Roaming\.purple\accounts.xml
Harvests information related to installed mail clients
file: C:\Users\Louise\AppData\Roaming\Thunderbird\profiles.ini
key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
key: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook
key: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook
Collects information to fingerprint the system
Anomalous binary characteristics
anomaly: Timestamp on binary predates the release date of the OS version it requires by at least a year

Screenshots


Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
Y 1.1.1.1 [VT] Australia

DNS

Name Response Post-Analysis Lookup
fuscon.cf [VT] 104.27.135.34 [VT]

Summary

C:\Users\Louise\AppData\Local\Temp\scan-4109384_pdf.ENU
C:\Users\Louise\AppData\Local\Temp\scan-4109384_pdf.ENU.DLL
C:\Users\Louise\AppData\Local\Temp\scan-4109384_pdf.EN
C:\Users\Louise\AppData\Local\Temp\scan-4109384_pdf.EN.DLL
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Program Files (x86)\Mozilla Firefox\nss3.dll
C:\Users\Louise\AppData\Local\Temp\mozglue.dll
C:\Windows\System32\mozglue.dll
C:\Windows\system\mozglue.dll
C:\Windows\mozglue.dll
C:\Python27\mozglue.dll
C:\Python27\Scripts\mozglue.dll
C:\Windows\System32\wbem\mozglue.dll
C:\Windows\System32\WindowsPowerShell\v1.0\mozglue.dll
C:\ProgramData\chocolatey\bin\mozglue.dll
C:\Users\Louise\AppData\Local\Programs\Python\Python38-32\Scripts\mozglue.dll
C:\Users\Louise\AppData\Local\Programs\Python\Python38-32\mozglue.dll
C:\Users\Louise\AppData\Roaming\Python\Scripts\mozglue.dll
C:\Program Files (x86)\Mozilla Firefox\mozglue.dll
C:\Users\Louise\AppData\Local\Temp\VERSION.dll
C:\Windows\System32\version.dll
C:\Users\Louise\AppData\Local\Temp\dbghelp.dll
C:\Windows\System32\dbghelp.dll
C:\Users\Louise\AppData\Local\Temp\MSVCP140.dll
C:\Windows\System32\msvcp140.dll
C:\Users\Louise\AppData\Local\Temp\VCRUNTIME140.dll
C:\Windows\System32\VCRUNTIME140.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-runtime-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\ucrtbase.DLL
C:\Windows\System32\ucrtbase.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-core-timezone-l1-1-0.dll
C:\Windows\System32\api-ms-win-core-timezone-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-core-file-l2-1-0.dll
C:\Windows\System32\api-ms-win-core-file-l2-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-core-localization-l1-2-0.dll
C:\Windows\System32\api-ms-win-core-localization-l1-2-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-core-processthreads-l1-1-1.dll
C:\Windows\System32\api-ms-win-core-processthreads-l1-1-1.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-core-file-l1-2-0.dll
C:\Windows\System32\api-ms-win-core-file-l1-2-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-string-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-string-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-heap-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-heap-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-stdio-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-stdio-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-convert-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-convert-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-locale-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-locale-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-math-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-math-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-multibyte-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-multibyte-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-time-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-time-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-filesystem-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-filesystem-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-environment-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-environment-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-utility-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-utility-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\WINMM.dll
C:\Windows\System32\winmm.dll
C:\Users\Louise\AppData\Local\Temp\WSOCK32.dll
C:\Windows\System32\wsock32.dll
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\profiles.ini
C:\Program Files (x86)\Mozilla Firefox\softokn3.dll
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\pkcs11.txt
C:\Program Files (x86)\Mozilla Firefox\freebl3.dll
C:\Windows\System32\api-ms-win-core-sysinfo-l1-2-1.DLL
C:\
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\cert9.db
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\cert9.db-journal
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\cert9.db-wal
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db-journal
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db-wal
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\nssckbi.dll
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\signons.sqlite
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\logins.json
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\signons.txt
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\signons2.txt
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\signons3.txt
C:\Program Files\NETGATE\Black Hawk
C:\Program Files (x86)\Lunascape\Lunascape6\plugins\{9BDD5314-20A6-4d98-AB30-8325A95771EE}
C:\Users\Louise\AppData\Local\Comodo\Dragon\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Comodo\Dragon\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalComodo\Dragon\Login Data
C:\Users\Louise\AppData\LocalComodo\Dragon\Default\Login Data
C:\Users\Louise\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalMapleStudio\ChromePlus\Login Data
C:\Users\Louise\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Nichrome\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Nichrome\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalNichrome\Login Data
C:\Users\Louise\AppData\LocalNichrome\Default\Login Data
C:\Users\Louise\AppData\Local\RockMelt\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\RockMelt\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalRockMelt\Login Data
C:\Users\Louise\AppData\LocalRockMelt\Default\Login Data
C:\Users\Louise\AppData\Local\Spark\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Spark\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalSpark\Login Data
C:\Users\Louise\AppData\LocalSpark\Default\Login Data
C:\Users\Louise\AppData\Local\Chromium\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Chromium\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalChromium\Login Data
C:\Users\Louise\AppData\LocalChromium\Default\Login Data
C:\Users\Louise\AppData\Local\Titan Browser\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Titan Browser\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalTitan Browser\Login Data
C:\Users\Louise\AppData\LocalTitan Browser\Default\Login Data
C:\Users\Louise\AppData\Local\Torch\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Torch\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalTorch\Login Data
C:\Users\Louise\AppData\LocalTorch\Default\Login Data
C:\Users\Louise\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalYandex\YandexBrowser\Login Data
C:\Users\Louise\AppData\LocalYandex\YandexBrowser\Default\Login Data
C:\Users\Louise\AppData\Local\Epic Privacy Browser\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Epic Privacy Browser\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalEpic Privacy Browser\Login Data
C:\Users\Louise\AppData\LocalEpic Privacy Browser\Default\Login Data
C:\Users\Louise\AppData\Local\CocCoc\Browser\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\CocCoc\Browser\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalCocCoc\Browser\Login Data
C:\Users\Louise\AppData\LocalCocCoc\Browser\Default\Login Data
C:\Users\Louise\AppData\Local\Vivaldi\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Vivaldi\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalVivaldi\Login Data
C:\Users\Louise\AppData\LocalVivaldi\Default\Login Data
C:\Users\Louise\AppData\Local\Comodo\Chromodo\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Comodo\Chromodo\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalComodo\Chromodo\Login Data
C:\Users\Louise\AppData\LocalComodo\Chromodo\Default\Login Data
C:\Users\Louise\AppData\Local\Superbird\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Superbird\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalSuperbird\Login Data
C:\Users\Louise\AppData\LocalSuperbird\Default\Login Data
C:\Users\Louise\AppData\Local\Coowon\Coowon\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Coowon\Coowon\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalCoowon\Coowon\Login Data
C:\Users\Louise\AppData\LocalCoowon\Coowon\Default\Login Data
C:\Users\Louise\AppData\Local\Mustang Browser\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Mustang Browser\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalMustang Browser\Login Data
C:\Users\Louise\AppData\LocalMustang Browser\Default\Login Data
C:\Users\Louise\AppData\Local\360Browser\Browser\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\360Browser\Browser\User Data\Default\Web Data
C:\Users\Louise\AppData\Local360Browser\Browser\Login Data
C:\Users\Louise\AppData\Local360Browser\Browser\Default\Login Data
C:\Users\Louise\AppData\Local\CatalinaGroup\Citrio\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\CatalinaGroup\Citrio\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalCatalinaGroup\Citrio\Login Data
C:\Users\Louise\AppData\LocalCatalinaGroup\Citrio\Default\Login Data
C:\Users\Louise\AppData\Local\Google\Chrome SxS\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Google\Chrome SxS\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalGoogle\Chrome SxS\Login Data
C:\Users\Louise\AppData\LocalGoogle\Chrome SxS\Default\Login Data
C:\Users\Louise\AppData\Local\Orbitum\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Orbitum\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalOrbitum\Login Data
C:\Users\Louise\AppData\LocalOrbitum\Default\Login Data
C:\Users\Louise\AppData\Local\Iridium\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Iridium\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalIridium\Login Data
C:\Users\Louise\AppData\LocalIridium\Default\Login Data
C:\Users\Louise\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
C:\Users\Louise\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
C:\Users\Louise\AppData\Roaming\Opera\Opera Next\data\Login Data
C:\Users\Louise\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
C:\Users\Louise\AppData\Roaming\Opera Software\Opera Stable\User Data\Default\Login Data
C:\Users\Louise\AppData\Roaming\Opera Software\Opera Stable\User Data\Default\Web Data
C:\Users\Louise\AppData\Roaming\Opera Software\Opera Stable\Login Data
C:\Users\Louise\AppData\Roaming\Opera Software\Opera Stable\Default\Login Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir\setting\modules\ChromiumViewer\User Data\Default\Login Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir\setting\modules\ChromiumViewer\User Data\Default\Web Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir\setting\modules\ChromiumViewer\Login Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir\setting\modules\ChromiumViewer\Default\Login Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\User Data\Default\Login Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\User Data\Default\Web Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\Login Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\Default\Login Data
C:\Users\Louise\AppData\Local\QupZilla\profiles\default\browsedata.db
C:\Users\Louise\AppData\Roaming\Opera
C:\Users\Louise\AppData\Roaming\.purple\accounts.xml
C:\Users\Louise\Documents\SuperPutty
C:\Program Files (x86)\FTPShell\ftpshell.fsi
C:\Users\Louise\AppData\Roaming\Notepad++\plugins\config\NppFTP\NppFTP.xml
C:\Program Files (x86)\oZone3D\MyFTP\myftp.ini
C:\Users\Louise\AppData\Roaming\FTPBox\profiles.conf
C:\Program Files (x86)\Sherrod Computers\sherrod FTP\favorites
C:\Program Files (x86)\FTP Now\sites.xml
C:\Program Files (x86)\NexusFile\userdata\ftpsite.ini
C:\Users\Louise\AppData\Roaming\NexusFile\ftpsite.ini
C:\Users\Louise\Documents\NetSarang\Xftp\Sessions
C:\Users\Louise\AppData\Roaming\NetSarang\Xftp\Sessions
C:\Program Files (x86)\EasyFTP\data
C:\Users\Louise\AppData\Roaming\SftpNetDrive
C:\Program Files (x86)\AbleFTP7\encPwd.jsd
C:\Program Files (x86)\AbleFTP7\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP7\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP8\encPwd.jsd
C:\Program Files (x86)\AbleFTP8\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP8\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP9\encPwd.jsd
C:\Program Files (x86)\AbleFTP9\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP9\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP10\encPwd.jsd
C:\Program Files (x86)\AbleFTP10\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP10\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP11\encPwd.jsd
C:\Program Files (x86)\AbleFTP11\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP11\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP12\encPwd.jsd
C:\Program Files (x86)\AbleFTP12\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP12\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP13\encPwd.jsd
C:\Program Files (x86)\AbleFTP13\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP13\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP14\encPwd.jsd
C:\Program Files (x86)\AbleFTP14\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP14\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp7\encPwd.jsd
C:\Program Files (x86)\JaSFtp7\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp7\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp8\encPwd.jsd
C:\Program Files (x86)\JaSFtp8\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp8\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp9\encPwd.jsd
C:\Program Files (x86)\JaSFtp9\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp9\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp10\encPwd.jsd
C:\Program Files (x86)\JaSFtp10\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp10\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp11\encPwd.jsd
C:\Program Files (x86)\JaSFtp11\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp11\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp12\encPwd.jsd
C:\Program Files (x86)\JaSFtp12\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp12\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp13\encPwd.jsd
C:\Program Files (x86)\JaSFtp13\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp13\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp14\encPwd.jsd
C:\Program Files (x86)\JaSFtp14\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp14\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize7\encPwd.jsd
C:\Program Files (x86)\Automize7\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize7\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize8\encPwd.jsd
C:\Program Files (x86)\Automize8\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize8\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize9\encPwd.jsd
C:\Program Files (x86)\Automize9\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize9\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize10\encPwd.jsd
C:\Program Files (x86)\Automize10\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize10\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize11\encPwd.jsd
C:\Program Files (x86)\Automize11\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize11\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize12\encPwd.jsd
C:\Program Files (x86)\Automize12\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize12\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize13\encPwd.jsd
C:\Program Files (x86)\Automize13\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize13\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize14\encPwd.jsd
C:\Program Files (x86)\Automize14\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize14\data\settings\ftpProfiles-j.jsd
C:\Users\Louise\AppData\Roaming\Cyberduck
C:\Users\Louise\AppData\Roaming\iterate_GmbH
C:\Users\Louise\.config\fullsync\profiles.xml
C:\Users\Louise\AppData\Roaming\FTPInfo\ServerList.xml
C:\Users\Louise\AppData\Roaming\FTPInfo\ServerList.cfg
C:\Program Files (x86)\FileZilla\Filezilla.xml
C:\Users\Louise\AppData\Roaming\FileZilla\filezilla.xml
C:\Users\Louise\AppData\Roaming\FileZilla\recentservers.xml
C:\Users\Louise\AppData\Roaming\FileZilla\sitemanager.xml
C:\Program Files (x86)\Staff-FTP\sites.ini
C:\Users\Louise\AppData\Roaming\BlazeFtp\site.dat
C:\Program Files (x86)\Fastream NETFile\My FTP Links
C:\Program Files (x86)\GoFTP\settings\Connections.txt
C:\Users\Louise\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
C:\Program Files (x86)\DeluxeFTP\sites.xml
C:\Windows\wcx_ftp.ini
C:\Users\Louise\AppData\Roaming\wcx_ftp.ini
C:\Users\Louise\wcx_ftp.ini
C:\Users\Louise\AppData\Roaming\GHISLER\wcx_ftp.ini
C:\Program Files (x86)\FTPGetter\Profile\servers.xml
C:\Users\Louise\AppData\Roaming\FTPGetter\servers.xml
C:\Program Files (x86)\WS_FTP\WS_FTP.INI
C:\Windows\WS_FTP.INI
C:\Users\Louise\AppData\Roaming\Ipswitch
C:\Users\Louise\site.xml
C:\Users\Louise\AppData\Local\PokerStars*
C:\Users\Louise\AppData\Local\ExpanDrive
C:\Users\Louise\AppData\Roaming\Steed\bookmarks.txt
C:\Users\Louise\AppData\Roaming\FlashFXP
C:\ProgramData\FlashFXP
C:\Users\Louise\AppData\Local\INSoftware\NovaFTP\NovaFTP.db
C:\Users\Louise\AppData\Roaming\NetDrive\NDSites.ini
C:\Users\Louise\AppData\Roaming\NetDrive2\drives.dat
C:\ProgramData\NetDrive2\drives.dat
C:\Users\Louise\AppData\Roaming\SmartFTP
C:\Users\Louise\AppData\Roaming\Far Manager\Profile\PluginsData\42E4AEB1-A230-44F4-B33C-F195BB654931.db
C:\Users\Louise\Documents\*.tlp
C:\Users\Louise\Documents\*.bscp
C:\Users\Louise\Documents\*.vnc
C:\Users\Louise\Desktop\*.vnc
C:\Users\Louise\Documents\mSecure
C:\ProgramData\Syncovery
C:\Program Files (x86)\FreshWebmaster\FreshFTP\FtpSites.SMF
C:\Users\Louise\AppData\Roaming\BitKinex\bitkinex.ds
C:\Users\Louise\AppData\Roaming\UltraFXP\sites.xml
C:\Users\Louise\AppData\Roaming\FTP Now\sites.xml
C:\Program Files (x86)\Odin Secure FTP Expert\QFDefault.QFQ
C:\Program Files (x86)\Odin Secure FTP Expert\SiteInfo.QFP
C:\Program Files (x86)\Mozilla Thunderbird
C:\Program Files (x86)\Mozilla Thunderbird\nss3.dll
C:\Program Files (x86)\Mozilla Thunderbird\mozglue.dll
C:\Program Files (x86)\Mozilla Thunderbird\sqlite3.dll
C:\Program Files (x86)\Mozilla Thunderbird\mozsqlite3.dll
C:\Users\Louise\AppData\Roaming\Thunderbird\profiles.ini
C:\Program Files (x86)\Foxmail\mail
C:\Foxmail*
C:\Users\Louise\AppData\Roaming\Pocomail\accounts.ini
C:\Users\Louise\Documents\Pocomail\accounts.ini
C:\Users\Louise\AppData\Roaming\GmailNotifierPro\ConfigData.xml
C:\Users\Louise\AppData\Roaming\DeskSoft\CheckMail
C:\Program Files (x86)\WinFtp Client\Favorites.dat
C:\Windows\32BitFtp.TMP
C:\Windows\32BitFtp.ini
C:\FTP Navigator\Ftplist.txt
C:\Softwarenetz\Mailing\Daten\mailing.vdt
C:\Users\Louise\AppData\Roaming\Opera Mail\Opera Mail\wand.dat
C:\Users\Louise\Documents\*Mailbox.ini
C:\Users\Louise\Documents\yMail2\POP3.xml
C:\Users\Louise\Documents\yMail2\SMTP.xml
C:\Users\Louise\Documents\yMail2\Accounts.xml
C:\Users\Louise\Documents\yMail\ymail.ini
C:\Users\Louise\AppData\Roaming\TrulyMail\Data\Settings\user.config
C:\Users\Louise\Documents\*.spn
C:\Users\Louise\Desktop\*.spn
C:\Users\Louise\AppData\Roaming\To-Do DeskList\tasks.db
C:\Users\Louise\AppData\Roaming\stickies\images
C:\Users\Louise\AppData\Roaming\stickies\rtf
C:\Users\Louise\AppData\Roaming\NoteFly\notes
C:\Users\Louise\AppData\Roaming\Conceptworld\Notezilla\Notes8.db
C:\Users\Louise\AppData\Roaming\Microsoft\Sticky Notes\StickyNotes.snt
C:\Users\Louise\Documents
C:\Users\Louise\Documents\*.kdbx
C:\Users\Louise\Desktop
C:\Users\Louise\Desktop\*.kdbx
C:\Users\Louise\Documents\*.kdb
C:\Users\Louise\Desktop\*.kdb
C:\Users\Louise\Documents\Enpass
C:\Users\Louise\Documents\My RoboForm Data
C:\Users\Louise\Documents\1Password
C:\Users\Louise\AppData\Local\Temp\Mikrotik\Winbox
C:\Users\Louise\AppData\Local\Temp\NETAPI32.DLL
C:\Windows\System32\netapi32.dll
C:\Users\Louise\AppData\Local\Temp\netutils.dll
C:\Windows\System32\netutils.dll
C:\Users\Louise\AppData\Local\Temp\srvcli.dll
C:\Windows\System32\srvcli.dll
C:\Users\Louise\AppData\Roaming\E5A3EA
C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.lck
C:\Users\Louise\AppData\Roaming\Microsoft\Credentials
C:\Users\Louise\AppData\Roaming\Microsoft\Credentials\*
C:\Users\Louise\AppData\Local\Microsoft\Credentials
C:\Users\Louise\AppData\Local\Microsoft\Credentials\*
C:\Users\Louise\AppData\Local\Temp\scan-4109384_pdf.exe
C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.exe
C:\Windows\Temp
C:\Windows\sysnative\LogFiles\Scm\29426f51-958b-4ad3-b441-3699bc2c0e69
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Program Files (x86)\Mozilla Firefox\nss3.dll
C:\Program Files (x86)\Mozilla Firefox\mozglue.dll
C:\Windows\System32\version.dll
C:\Windows\System32\dbghelp.dll
C:\Windows\System32\msvcp140.dll
C:\Windows\System32\VCRUNTIME140.dll
C:\Windows\System32\api-ms-win-crt-runtime-l1-1-0.dll
C:\Windows\System32\ucrtbase.dll
C:\Windows\System32\api-ms-win-core-timezone-l1-1-0.dll
C:\Windows\System32\api-ms-win-core-file-l2-1-0.dll
C:\Windows\System32\api-ms-win-core-localization-l1-2-0.dll
C:\Windows\System32\api-ms-win-core-processthreads-l1-1-1.dll
C:\Windows\System32\api-ms-win-core-file-l1-2-0.dll
C:\Windows\System32\api-ms-win-crt-string-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-heap-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-stdio-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-convert-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-locale-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-math-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-multibyte-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-time-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-filesystem-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-environment-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-utility-l1-1-0.dll
C:\Windows\System32\winmm.dll
C:\Windows\System32\wsock32.dll
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\profiles.ini
C:\Program Files (x86)\Mozilla Firefox\softokn3.dll
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\pkcs11.txt
C:\Program Files (x86)\Mozilla Firefox\freebl3.dll
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\cert9.db
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\logins.json
C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Default\Login Data
C:\Program Files (x86)\Mozilla Thunderbird\nss3.dll
C:\Program Files (x86)\Mozilla Thunderbird\mozglue.dll
C:\Windows\System32\netapi32.dll
C:\Windows\System32\netutils.dll
C:\Windows\System32\srvcli.dll
C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.lck
C:\Windows\sysnative\LogFiles\Scm\29426f51-958b-4ad3-b441-3699bc2c0e69
C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.lck
C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.exe
C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.lck
C:\Users\Louise\AppData\Local\Temp\scan-4109384_pdf.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT
HKEY_CURRENT_USER
DisableUserModeCallbackFilter
HKEY_CURRENT_USER\Software\Borland\Locales
HKEY_LOCAL_MACHINE\Software\Borland\Locales
HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\00060101.00060101
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography
\x8ad0\x224EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox\75.0 (x86 en-GB)\Main
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\75.0 (x86 en-GB)\Main\Install Directory
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\ComodoGroup\IceDragon\Setup
HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\Safari
HKEY_LOCAL_MACHINE\SOFTWARE\K-Meleon
HKEY_LOCAL_MACHINE\SOFTWARE\mozilla.org\SeaMonkey
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Flock
HKEY_CURRENT_USER\Software\QtWeb.NET\QtWeb Internet Browser\AutoComplete
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2
HKEY_LOCAL_MACHINE\SOFTWARE\8pecxstudios\Cyberfox86
HKEY_LOCAL_MACHINE\SOFTWARE\8pecxstudios\Cyberfox
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Pale Moon
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Waterfox
HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
HKEY_CURRENT_USER\Software\Ghisler\Total Commander
HKEY_CURRENT_USER\Software
HKEY_CURRENT_USER\Software\7-Zip
HKEY_CURRENT_USER\Software\Adobe
HKEY_CURRENT_USER\Software\AppDataLow
HKEY_CURRENT_USER\Software\Clients
HKEY_CURRENT_USER\Software\Google
HKEY_CURRENT_USER\Software\IM Providers
HKEY_CURRENT_USER\Software\JavaSoft
HKEY_CURRENT_USER\Software\Macromedia
HKEY_CURRENT_USER\Software\Microsoft
HKEY_CURRENT_USER\Software\Mozilla
HKEY_CURRENT_USER\Software\Netscape
HKEY_CURRENT_USER\Software\ODBC
HKEY_CURRENT_USER\Software\Piriform
HKEY_CURRENT_USER\Software\Policies
HKEY_CURRENT_USER\Software\Python
HKEY_CURRENT_USER\Software\WinRAR
HKEY_CURRENT_USER\Software\WinRAR SFX
HKEY_CURRENT_USER\Software\Wow6432Node
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
HKEY_CURRENT_USER\Software\Bitvise\BvSshClient
HKEY_CURRENT_USER\Software\VanDyke\SecureFX
HKEY_LOCAL_MACHINE\Software\NCH Software\Fling\Accounts
HKEY_CURRENT_USER\Software\NCH Software\Fling\Accounts
HKEY_LOCAL_MACHINE\Software\NCH Software\ClassicFTP\FTPAccounts
HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts
HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions
HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
HKEY_LOCAL_MACHINE\Software\9bis.com\KiTTY\Sessions
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Thunderbird\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird\60.5.0 (en-US)\Main
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Thunderbird\60.5.0 (en-US)\Main\Install Directory
HKEY_CURRENT_USER\Software\IncrediMail\Identities
HKEY_LOCAL_MACHINE\Software\IncrediMail\Identities
HKEY_CURRENT_USER\Software\Martin Prikryl
HKEY_LOCAL_MACHINE\Software\Martin Prikryl
HKEY_LOCAL_MACHINE\SOFTWARE\Postbox\Postbox
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\FossaMail
HKEY_CURRENT_USER\Software\WinChips\UserAccounts
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook
HKEY_CURRENT_USER\SOFTWARE\flaska.net\trojita
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\Parameters\RpcCacheTimeout
HKEY_LOCAL_MACHINE\http://fuscon.cf/LO4/fre.php
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\WOW64
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_USERS\S-1-5-18
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_USERS\.DEFAULT\Environment
HKEY_USERS\.DEFAULT\Volatile Environment
HKEY_USERS\.DEFAULT\Volatile Environment\0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\RequiredPrivileges
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ObjectName
DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\00060101.00060101
\x8ad0\x224EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\75.0 (x86 en-GB)\Main\Install Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Thunderbird\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Thunderbird\60.5.0 (en-US)\Main\Install Directory
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\Parameters\RpcCacheTimeout
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\WOW64
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\RequiredPrivileges
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ObjectName
kernel32.dll.FlsAlloc
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.FlsFree
kernelbase.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.ProcessIdToSessionId
imm32.dll.ImmCreateContext
imm32.dll.ImmDestroyContext
imm32.dll.ImmNotifyIME
imm32.dll.ImmAssociateContext
imm32.dll.ImmReleaseContext
imm32.dll.ImmGetContext
imm32.dll.ImmGetCompositionStringA
imm32.dll.ImmSetCompositionStringA
imm32.dll.ImmGetCompositionStringW
imm32.dll.ImmSetCompositionStringW
imm32.dll.ImmSetCandidateWindow
kernel32.dll.GetDiskFreeSpaceExA
oleaut32.dll.VariantChangeTypeEx
oleaut32.dll.VarNeg
oleaut32.dll.VarNot
oleaut32.dll.VarAdd
oleaut32.dll.VarSub
oleaut32.dll.VarMul
oleaut32.dll.VarDiv
oleaut32.dll.VarIdiv
oleaut32.dll.VarMod
oleaut32.dll.VarAnd
oleaut32.dll.VarOr
oleaut32.dll.VarXor
oleaut32.dll.VarCmp
oleaut32.dll.VarI4FromStr
oleaut32.dll.VarR4FromStr
oleaut32.dll.VarR8FromStr
oleaut32.dll.VarDateFromStr
oleaut32.dll.VarCyFromStr
oleaut32.dll.VarBoolFromStr
oleaut32.dll.VarBstrFromCy
oleaut32.dll.VarBstrFromDate
oleaut32.dll.VarBstrFromBool
user32.dll.GetMonitorInfoA
user32.dll.GetSystemMetrics
user32.dll.EnumDisplayMonitors
user32.dll.AnimateWindow
comctl32.dll.InitializeFlatSB
comctl32.dll.UninitializeFlatSB
comctl32.dll.FlatSB_GetScrollProp
comctl32.dll.FlatSB_SetScrollProp
comctl32.dll.FlatSB_EnableScrollBar
comctl32.dll.FlatSB_ShowScrollBar
comctl32.dll.FlatSB_GetScrollRange
comctl32.dll.FlatSB_GetScrollInfo
comctl32.dll.FlatSB_GetScrollPos
comctl32.dll.FlatSB_SetScrollPos
comctl32.dll.FlatSB_SetScrollInfo
comctl32.dll.FlatSB_SetScrollRange
user32.dll.SetLayeredWindowAttributes
kernel32.dll.FileTimeToSystemTime
kernel32.dll.VirtualProtect
kernel32.dll.SortGetHandle
kernel32.dll.SortCloseHandle
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptCreateHash
cryptsp.dll.CryptHashData
cryptsp.dll.CryptGetHashParam
cryptsp.dll.CryptDestroyHash
cryptsp.dll.CryptReleaseContext
nss3.dll.NSS_Init
nss3.dll.NSS_Shutdown
nss3.dll.PK11_GetInternalKeySlot
nss3.dll.PK11_FreeSlot
nss3.dll.PK11_Authenticate
nss3.dll.PK11SDR_Decrypt
nss3.dll.PK11_CheckUserPassword
nss3.dll.SECITEM_FreeItem
kernel32.dll.InitializeCriticalSectionEx
softokn3.dll.NSC_GetFunctionList
softokn3.dll.NSC_ModuleDBFunc
freebl3.dll.FREEBL_GetVector
cryptbase.dll.SystemFunction001
cryptbase.dll.SystemFunction002
cryptbase.dll.SystemFunction003
cryptbase.dll.SystemFunction004
cryptbase.dll.SystemFunction005
cryptbase.dll.SystemFunction028
cryptbase.dll.SystemFunction029
cryptbase.dll.SystemFunction034
cryptbase.dll.SystemFunction036
cryptbase.dll.SystemFunction040
cryptbase.dll.SystemFunction041
vaultcli.dll.VaultEnumerateItems
vaultcli.dll.VaultEnumerateVaults
vaultcli.dll.VaultFree
vaultcli.dll.VaultGetItem
vaultcli.dll.VaultOpenVault
vaultcli.dll.VaultCloseVault
nss3.dll.sqlite3_finalize
nss3.dll.sqlite3_step
nss3.dll.sqlite3_close
nss3.dll.sqlite3_column_text
nss3.dll.sqlite3_open16
nss3.dll.sqlite3_prepare_v2
sechost.dll.LookupAccountSidLocalW
netapi32.dll.NetUserGetInfo
cryptsp.dll.CryptImportKey
cryptsp.dll.CryptSetKeyParam
cryptsp.dll.CryptDecrypt
cryptsp.dll.CryptDestroyKey
"C:\Users\Louise\AppData\Local\Temp\scan-4109384_pdf.exe"
C:\Windows\system32\lsass.exe
300134BE5A3EACE282B993B6
VaultSvc

BinGraph Download graph

PE Information

Image Base Entry Point Reported Checksum Actual Checksum Minimum OS Version Compile Time Import Hash Icon Icon Exact Hash Icon Similarity Hash
0x00400000 0x00462474 0x00000000 0x0008fbdc 4.0 1992-06-19 22:22:17 a0f2ef0c3f2e6d478baacafaefbb4c2b ff6bc86ac6825ff77a7971bdb265bb0d 462674fdd3ff43ac7db568fb5677cbb1

Sections

Name RAW Address Virtual Address Virtual Size Size of Raw Data Characteristics Entropy
CODE 0x00000400 0x00001000 0x000614bc 0x00061600 IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 6.56
DATA 0x00061a00 0x00063000 0x0000121c 0x00001400 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 3.89
BSS 0x00062e00 0x00065000 0x00000be9 0x00000000 IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 0.00
.idata 0x00062e00 0x00066000 0x000021d6 0x00002200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 4.90
.tls 0x00065000 0x00069000 0x00000010 0x00000000 IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 0.00
.rdata 0x00065000 0x0006a000 0x00000018 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ 0.20
.reloc 0x00065200 0x0006b000 0x00006820 0x00006a00 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ 6.64
.rsrc 0x0006bc00 0x00072000 0x000210e8 0x00021200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ 7.45

Resources

Name Offset Size Language Sub-language Entropy File type
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x00092488 0x00000219 LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_ICON 0x000926a4 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US 4.90 None
RT_RCDATA 0x00092fe8 0x000000e9 LANG_ENGLISH SUBLANG_ENGLISH_US 7.12 None
RT_RCDATA 0x00092fe8 0x000000e9 LANG_ENGLISH SUBLANG_ENGLISH_US 7.12 None
RT_RCDATA 0x00092fe8 0x000000e9 LANG_ENGLISH SUBLANG_ENGLISH_US 7.12 None
RT_RCDATA 0x00092fe8 0x000000e9 LANG_ENGLISH SUBLANG_ENGLISH_US 7.12 None
RT_GROUP_ICON 0x000930d4 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 1.92 None

Imports

0x46613c VirtualFree
0x466140 VirtualAlloc
0x466144 LocalFree
0x466148 LocalAlloc
0x46614c GetVersion
0x466150 GetCurrentThreadId
0x46615c VirtualQuery
0x466160 WideCharToMultiByte
0x466164 MultiByteToWideChar
0x466168 lstrlenA
0x46616c lstrcpynA
0x466170 LoadLibraryExA
0x466174 GetThreadLocale
0x466178 GetStartupInfoA
0x46617c GetProcAddress
0x466180 GetModuleHandleA
0x466184 GetModuleFileNameA
0x466188 GetLocaleInfoA
0x46618c GetCommandLineA
0x466190 FreeLibrary
0x466194 FindFirstFileA
0x466198 FindClose
0x46619c ExitProcess
0x4661a0 WriteFile
0x4661a8 RtlUnwind
0x4661ac RaiseException
0x4661b0 GetStdHandle
0x4661b8 GetKeyboardType
0x4661bc LoadStringA
0x4661c0 MessageBoxA
0x4661c4 CharNextA
0x4661cc RegQueryValueExA
0x4661d0 RegOpenKeyExA
0x4661d4 RegCloseKey
0x4661dc SysFreeString
0x4661e0 SysReAllocStringLen
0x4661e4 SysAllocStringLen
0x4661ec TlsSetValue
0x4661f0 TlsGetValue
0x4661f4 LocalAlloc
0x4661f8 GetModuleHandleA
0x466200 RegQueryValueExA
0x466204 RegOpenKeyExA
0x466208 RegCloseKey
0x466210 lstrcpyA
0x466214 WriteFile
0x46621c WaitForSingleObject
0x466220 VirtualQuery
0x466224 VirtualAlloc
0x466228 Sleep
0x46622c SizeofResource
0x466230 SetThreadLocale
0x466234 SetFilePointer
0x466238 SetEvent
0x46623c SetErrorMode
0x466240 SetEndOfFile
0x466244 ResetEvent
0x466248 ReadFile
0x46624c MulDiv
0x466250 LockResource
0x466254 LoadResource
0x466258 LoadLibraryA
0x466264 GlobalUnlock
0x466268 GlobalReAlloc
0x46626c GlobalHandle
0x466270 GlobalLock
0x466274 GlobalFree
0x466278 GlobalFindAtomA
0x46627c GlobalDeleteAtom
0x466280 GlobalAlloc
0x466284 GlobalAddAtomA
0x466288 GetVersionExA
0x46628c GetVersion
0x466290 GetTickCount
0x466294 GetThreadLocale
0x46629c GetSystemTime
0x4662a0 GetSystemInfo
0x4662a4 GetStringTypeExA
0x4662a8 GetStdHandle
0x4662ac GetProcAddress
0x4662b0 GetModuleHandleA
0x4662b4 GetModuleFileNameA
0x4662b8 GetLocaleInfoA
0x4662bc GetLocalTime
0x4662c0 GetLastError
0x4662c4 GetFullPathNameA
0x4662c8 GetFileAttributesA
0x4662cc GetDiskFreeSpaceA
0x4662d0 GetDateFormatA
0x4662d4 GetCurrentThreadId
0x4662d8 GetCurrentProcessId
0x4662dc GetCPInfo
0x4662e0 GetACP
0x4662e4 FreeResource
0x4662e8 InterlockedExchange
0x4662ec FreeLibrary
0x4662f0 FormatMessageA
0x4662f4 FindResourceA
0x4662f8 FindFirstFileA
0x4662fc FindClose
0x466308 ExitThread
0x46630c EnumCalendarInfoA
0x466318 CreateThread
0x46631c CreateFileA
0x466320 CreateEventA
0x466324 CompareStringA
0x466328 CloseHandle
0x466330 VerQueryValueA
0x466338 GetFileVersionInfoA
0x466340 UnrealizeObject
0x466344 StretchBlt
0x466348 SetWindowOrgEx
0x46634c SetWinMetaFileBits
0x466350 SetViewportOrgEx
0x466354 SetTextColor
0x466358 SetStretchBltMode
0x46635c SetROP2
0x466360 SetPixel
0x466364 SetEnhMetaFileBits
0x466368 SetDIBColorTable
0x46636c SetBrushOrgEx
0x466370 SetBkMode
0x466374 SetBkColor
0x466378 SelectPalette
0x46637c SelectObject
0x466380 SelectClipRgn
0x466384 SaveDC
0x466388 RestoreDC
0x46638c Rectangle
0x466390 RectVisible
0x466394 RealizePalette
0x466398 Polyline
0x46639c PlayEnhMetaFile
0x4663a0 PatBlt
0x4663a4 MoveToEx
0x4663a8 MaskBlt
0x4663ac LineTo
0x4663b0 IntersectClipRect
0x4663b4 GetWindowOrgEx
0x4663b8 GetWinMetaFileBits
0x4663bc GetTextMetricsA
0x4663c8 GetStockObject
0x4663cc GetPixel
0x4663d0 GetPaletteEntries
0x4663d4 GetObjectA
0x4663e0 GetEnhMetaFileBits
0x4663e4 GetDeviceCaps
0x4663e8 GetDIBits
0x4663ec GetDIBColorTable
0x4663f0 GetDCOrgEx
0x4663f8 GetClipBox
0x4663fc GetBrushOrgEx
0x466400 GetBitmapBits
0x466404 ExcludeClipRect
0x466408 DeleteObject
0x46640c DeleteEnhMetaFile
0x466410 DeleteDC
0x466414 CreateSolidBrush
0x466418 CreatePenIndirect
0x46641c CreatePalette
0x466424 CreateFontIndirectA
0x466428 CreateDIBitmap
0x46642c CreateDIBSection
0x466430 CreateCompatibleDC
0x466438 CreateBrushIndirect
0x46643c CreateBitmap
0x466440 CopyEnhMetaFileA
0x466444 BitBlt
0x46644c CreateWindowExA
0x466450 WindowFromPoint
0x466454 WinHelpA
0x466458 WaitMessage
0x46645c UpdateWindow
0x466460 UnregisterClassA
0x466464 UnhookWindowsHookEx
0x466468 TranslateMessage
0x466470 TrackPopupMenu
0x466478 ShowWindow
0x46647c ShowScrollBar
0x466480 ShowOwnedPopups
0x466484 ShowCursor
0x466488 SetWindowsHookExA
0x46648c SetWindowPos
0x466490 SetWindowPlacement
0x466494 SetWindowLongA
0x466498 SetTimer
0x46649c SetScrollRange
0x4664a0 SetScrollPos
0x4664a4 SetScrollInfo
0x4664a8 SetRect
0x4664ac SetPropA
0x4664b0 SetParent
0x4664b4 SetMenuItemInfoA
0x4664b8 SetMenu
0x4664bc SetForegroundWindow
0x4664c0 SetFocus
0x4664c4 SetCursor
0x4664c8 SetClassLongA
0x4664cc SetCapture
0x4664d0 SetActiveWindow
0x4664d4 SendMessageA
0x4664d8 ScrollWindow
0x4664dc ScreenToClient
0x4664e0 RemovePropA
0x4664e4 RemoveMenu
0x4664e8 ReleaseDC
0x4664ec ReleaseCapture
0x4664f8 RegisterClassA
0x4664fc RedrawWindow
0x466500 PtInRect
0x466504 PostQuitMessage
0x466508 PostMessageA
0x46650c PeekMessageA
0x466510 OffsetRect
0x466514 OemToCharA
0x466518 MessageBoxA
0x46651c MapWindowPoints
0x466520 MapVirtualKeyA
0x466524 LoadStringA
0x466528 LoadKeyboardLayoutA
0x46652c LoadIconA
0x466530 LoadCursorA
0x466534 LoadBitmapA
0x466538 KillTimer
0x46653c IsZoomed
0x466540 IsWindowVisible
0x466544 IsWindowEnabled
0x466548 IsWindow
0x46654c IsRectEmpty
0x466550 IsIconic
0x466554 IsDialogMessageA
0x466558 IsChild
0x46655c InvalidateRect
0x466560 IntersectRect
0x466564 InsertMenuItemA
0x466568 InsertMenuA
0x46656c InflateRect
0x466574 GetWindowTextA
0x466578 GetWindowRect
0x46657c GetWindowPlacement
0x466580 GetWindowLongA
0x466584 GetWindowDC
0x466588 GetTopWindow
0x46658c GetSystemMetrics
0x466590 GetSystemMenu
0x466594 GetSysColorBrush
0x466598 GetSysColor
0x46659c GetSubMenu
0x4665a0 GetScrollRange
0x4665a4 GetScrollPos
0x4665a8 GetScrollInfo
0x4665ac GetPropA
0x4665b0 GetParent
0x4665b4 GetWindow
0x4665b8 GetMenuStringA
0x4665bc GetMenuState
0x4665c0 GetMenuItemInfoA
0x4665c4 GetMenuItemID
0x4665c8 GetMenuItemCount
0x4665cc GetMenu
0x4665d0 GetLastActivePopup
0x4665d4 GetKeyboardState
0x4665dc GetKeyboardLayout
0x4665e0 GetKeyState
0x4665e4 GetKeyNameTextA
0x4665e8 GetIconInfo
0x4665ec GetForegroundWindow
0x4665f0 GetFocus
0x4665f4 GetDlgItem
0x4665f8 GetDesktopWindow
0x4665fc GetDCEx
0x466600 GetDC
0x466604 GetCursorPos
0x466608 GetCursor
0x46660c GetClipboardData
0x466610 GetClientRect
0x466614 GetClassNameA
0x466618 GetClassInfoA
0x46661c GetCapture
0x466620 GetActiveWindow
0x466624 FrameRect
0x466628 FindWindowA
0x46662c FillRect
0x466630 EqualRect
0x466634 EnumWindows
0x466638 EnumThreadWindows
0x46663c EndPaint
0x466640 EnableWindow
0x466644 EnableScrollBar
0x466648 EnableMenuItem
0x46664c DrawTextA
0x466650 DrawMenuBar
0x466654 DrawIconEx
0x466658 DrawIcon
0x46665c DrawFrameControl
0x466660 DrawEdge
0x466664 DispatchMessageA
0x466668 DestroyWindow
0x46666c DestroyMenu
0x466670 DestroyIcon
0x466674 DestroyCursor
0x466678 DeleteMenu
0x46667c DefWindowProcA
0x466680 DefMDIChildProcA
0x466684 DefFrameProcA
0x466688 CreatePopupMenu
0x46668c CreateMenu
0x466690 CreateIcon
0x466694 ClientToScreen
0x466698 CheckMenuItem
0x46669c CallWindowProcA
0x4666a0 CallNextHookEx
0x4666a4 BeginPaint
0x4666a8 CharNextA
0x4666ac CharLowerBuffA
0x4666b0 CharLowerA
0x4666b4 CharToOemA
0x4666b8 AdjustWindowRectEx
0x4666c4 Sleep
0x4666cc SafeArrayPtrOfIndex
0x4666d0 SafeArrayGetUBound
0x4666d4 SafeArrayGetLBound
0x4666d8 SafeArrayCreate
0x4666dc VariantChangeType
0x4666e0 VariantCopy
0x4666e4 VariantClear
0x4666e8 VariantInit
0x4666f8 ImageList_Write
0x4666fc ImageList_Read
0x46670c ImageList_DragMove
0x466710 ImageList_DragLeave
0x466714 ImageList_DragEnter
0x466718 ImageList_EndDrag
0x46671c ImageList_BeginDrag
0x466720 ImageList_Remove
0x466724 ImageList_DrawEx
0x466728 ImageList_Replace
0x46672c ImageList_Draw
0x46673c ImageList_Add
0x466744 ImageList_Destroy
0x466748 ImageList_Create
0x46674c InitCommonControls
0x466754 GetOpenFileNameA

This program must be run under Win32
`DATA
.idata
.rdata
P.reloc
P.rsrc
Boolean
False
Smallint
Integer
Cardinal
String
TObject
TObject
System
IInterface
System
TInterfacedObject
SVWUQ
Z]_^[
YZ]_^[
w;;t$
SVWUQ
Z]_^[
YZ]_^[
Uh|"@
_^[YY]
_^[Y]
YZ]_^[
_^[Y]
C<"u1S
Q<"u8S
,$YXZ
~KxI[)
BkU'9
SOFTWARE\Borland\Delphi\RTL
FPUMaskValue
_^[YY]
PPRTj
YZXtp
YZXtm1
ZTUWVSPRTj
t=HtN
Uh~<@
t-Rf;
t f;J
SVWRP
Z_^[X
tVSVWU
t1SVW
t-Rf;
t f;J
kernel32.dll
GetLongPathNameA
Software\Borland\Locales
Software\Borland\Delphi\Locales
_^[YY]
FFF;M
^[YY]
Uh*\@
Uh5^@
odSelected
odGrayed
odDisabled
odChecked
odFocused
odDefault
odHotLight
odInactive
odNoAccel
odNoFocusRect
odReserved1
odReserved2
odComboBoxEdit
Windows
TOwnerDrawState
_^[Y]
_^[Y]
_^[Y]
Magellan MSWHEEL
MouseZ
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
TFileName
Exception
EHeapException
EOutOfMemory
EInOutError
EExternal
EExternalException
EIntError
EDivByZero
EIntOverflow
EMathError
EInvalidOp
EZeroDivide
EOverflow
EUnderflow
EInvalidPointer
EInvalidCast
EConvertError
EAccessViolation
EPrivilege
EStackOverflow
EControlC
EVariantError
EAssertionFailed
EAbstractError
EIntfCastError
EOSError
ESafecallException
SysUtils
SysUtils
TThreadLocalCounter
$TMultiReadExclusiveWriteSynchronizer
SWSVj
False
_^[Y]
TStrData
^[YY]
$Z_^[
$Z_^[
^[YY]
<*t"<0r=<9w9i
INFNAN
QS<$t
_^[YY]
t%HtIHtm
AM/PM
_^[YY]
SVWUQ
$Z]_^[
_^[Y]
QQQQQQSVW3
QQQQQSVW
D$PPj
D$LPj
_^[Y]
_^[YY]
TErrorRec
TExceptRec
t<HtH
$YZ^[
$YZ^[
WUWSj
YZ]_^[
_^[Y]
m/d/yy
mmmm d, yyyy
AMPM
AMPM
:mm:ss
kernel32.dll
GetDiskFreeSpaceExA
SVWUQ
(Z]_^[
SVWUQ
;w$t|
Z]_^[
;F$t=
;C$t4
_^[Y]
oleaut32.dll
VariantChangeTypeEx
VarNeg
VarNot
VarAdd
VarSub
VarMul
VarDiv
VarIdiv
VarMod
VarAnd
VarOr
VarXor
VarCmp
VarI4FromStr
VarR4FromStr
VarR8FromStr
VarDateFromStr
VarCyFromStr
VarBoolFromStr
VarBstrFromCy
VarBstrFromDate
VarBstrFromBool
TCustomVariantType
TCustomVariantType
Variants
EVariantInvalidOpError
EVariantTypeCastError
EVariantOverflowError
EVariantInvalidArgError(
EVariantBadVarTypeError
EVariantBadIndexError
EVariantArrayLockedError
EVariantArrayCreateError
EVariantNotImplError
EVariantOutOfMemoryError
EVariantUnexpectedError
EVariantDispatchError
t?Htb
QQQQSV
Empty
Smallint
Integer
Single
Double
Currency
OleStr
Dispatch
Error
Boolean
Variant
Unknown
Decimal
ShortInt
LongWord
Int64
String
Array
ByRef
Variants
_^[YY]
_^[Y]
SVWUQ
Z]_^[
t~h$XF
_^[Y]
False
_^[Y]
_^[YY]
$YZ^[
TAlignment
taLeftJustify
taRightJustify
taCenter
Classes
TBiDiMode
bdLeftToRight
bdRightToLeft
bdRightToLeftNoAlign
bdRightToLeftReadingOnly
Classes
ssShift
ssAlt
ssCtrl
ssLeft
ssRight
ssMiddle
ssDouble
Classes
TShiftState
THelpContext
THelpType
htKeyword
htContext
Classes4
TShortCut
TNotifyEvent
Sender
TObject
EStreamError
EFileStreamError
EFCreateError
EFOpenError0
EFilerError
EReadError
EWriteError8
EClassNotFound
EResNotFound
EListError
EBitsError
EStringListError
EComponentError\
EOutOfResources
EInvalidOperation
TList
TThreadList
TBits
TPersistent
TPersistent(
Classes
TInterfacedPersistentT
TInterfacedPersistent
Classes
IStringsAdapter,
Classes
TStrings
TStrings
Classes
TStringItem
TStringList
TStringList4
Classes
TStream
THandleStream
TFileStream
TCustomMemoryStream$
TMemoryStream
TResourceStream
TStreamAdapter
TClassFinder
TFiler
TReader
EThread
TComponentName$#A
IDesignerNotify,
Classes
TComponent
TComponentL$A
Classes
NameT
TBasicActionLink
TBasicAction
TBasicAction,&A
Classes
TIdentMapEntry
TRegGroup
TRegGroups
YZ]_^[
_^[Y]
_^[Y]
SVWUQ
u%CNu
Z]_^[
SVWUQ
$Z]_^[
SVWUQ
Z]_^[
SVWUQ
Z]_^[
SVWUQ
Z]_^[
SVWUQ
$Z]_^[
_^[YY]
Uh42A
Uhf3A
Uh^4A
TIntConst
_^[Y]
_^[Y]
_^[YY]
UhX7A
_^[Y]
SVWUQ
Z]_^[
UhuBA
W<CNu
PhtPA
Strings
_^[Y]
Uh^HA
UhgKA
S$_^[Y]
Uh$LA
^[YY]
Uh}MA
Uh`MA
_^[YY]
SVWUQ
SdZ]_^[
UhhNA
UhCNA
UhdPA
UhGPA
SVWUQ
$Z]_^[
^[YY]
Uhl[A
_^[Y]
TPropFixup
TPropIntfFixup
_^[YY]
Owner
UhqfA
_^[YY]
Uh3hA
_^[Y]
Uh$kA
Uh?lA
Uh"lA
C0_^[
UhgnA
Classes
_^[Y]
UhhrA
UhUuA
Uh%uA
False
Uhm|A
UhF|A
_^[YY]
QQQQ3
Uh^~A
%s_%d
_^[YY]
^[YY]
QQQQQQQS
SVWUQ
Z]_^[
_^[Y]
S _^[
SVWUQ
Z]_^[
YZ_^[
SVWUQ
Z]_^[
G0_^[
;CDt:
R0_^[]
_^[YY]
TPUtilWindow
TColor
EInvalidGraphic(
EInvalidGraphicOperation
TFontPitch
fpDefault
fpVariable
fpFixed
Graphics
TFontName
TFontCharset
TFontStyle
fsBold
fsItalic
fsUnderline
fsStrikeOut
Graphics
TFontStyles
TPenStyle
psSolid
psDash
psDot
psDashDot
psDashDotDot
psClear
psInsideFrame
Graphics
TPenMode
pmBlack
pmWhite
pmNop
pmNot
pmCopy
pmNotCopy
pmMergePenNot
pmMaskPenNot
pmMergeNotPen
pmMaskNotPen
pmMerge
pmNotMerge
pmMask
pmNotMask
pmXor
pmNotXor
Graphics
TBrushStyle
bsSolid
bsClear
bsHorizontal
bsVertical
bsFDiagonal
bsBDiagonal
bsCross
bsDiagCross
Graphics
TGraphicsObject0
TGraphicsObject
Graphics
IChangeNotifier,
Graphics
TFont
TFont
Graphics
Charseth
ColorT
Height
NameD
PitchT
Style
TPenX
Graphics
Color
StyleT
Width
TBrush
TBrushX
Graphics
Style
TCanvas
Graphics
BrushT
CopyMode
Fontl
TProgressStage
psStarting
psRunning
psEnding
Graphics,
TProgressEvent
Sender
TObject
Stage
TProgressStage
PercentDone
RedrawNow
Boolean
TRect
String
TGraphic
TGraphicx
Graphics
TPicture
TPicture
Graphics
TSharedImage
TMetafileImage
TMetafile
TMetafile8
Graphics
TBitmapImage
TBitmap
TBitmapx
Graphics
TIconImage
TIcon
TIcon
Graphics
TResourceManager
^[YY]
_^[YY]
_^[Y]
^[YY]
clBlack
clMaroon
clGreen
clOlive
clNavy
clPurple
clTeal
clGray
clSilver
clRed
clLime
clYellow
clBlue
clFuchsia
clAqua
clWhite
clMoneyGreen
clSkyBlue
clCream
clMedGray
clActiveBorder
clActiveCaption
clAppWorkSpace
clBackground
clBtnFace
clBtnHighlight
clBtnShadow
clBtnText
clCaptionText
clDefault
clGradientActiveCaption
clGradientInactiveCaption
clGrayText
clHighlight
clHighlightText
clHotLight
clInactiveBorder
clInactiveCaption
clInactiveCaptionText
clInfoBk
clInfoText
clMenu
clMenuBar
clMenuHighlight
clMenuText
clNone
clScrollBar
cl3DDkShadow
cl3DLight
clWindow
clWindowFrame
clWindowText
ANSI_CHARSET
DEFAULT_CHARSET
SYMBOL_CHARSET
MAC_CHARSET
SHIFTJIS_CHARSET
HANGEUL_CHARSET
JOHAB_CHARSET
GB2312_CHARSET
CHINESEBIG5_CHARSET
GREEK_CHARSET
TURKISH_CHARSET
HEBREW_CHARSET
ARABIC_CHARSET
BALTIC_CHARSET
RUSSIAN_CHARSET
THAI_CHARSET
EASTEUROPE_CHARSET
OEM_CHARSET
Default
_^[Y]
$YZ^[
E$PVSj
YZ_^[
$Z_^[
_^[YY]
C ;C$s
TFileFormat
TFileFormatsList
QQQQSV
_^[YY]
%s%s (*.%s)|*.%2:s
%s*.%s
%s (%s)|%1:s|%s
TClipboardFormats
_^[YY]
_^[Y]
3TjdP
kD$TdP
3TjdP
kD$PdP
EMFt
?TjdR
D$LPkD$XdPV
?TjdR
D$HPkD$TdPV
|$( EMFt
^[YY]
TBitmapCanvas
TBitmapCanvasX
Graphics
@pPV3
Uhw!B
Uh;$B
_^[YY]
UhG)B
<$BMt
UhO+B
T]_^[
s(;~ t8
;V4tA
D$*Ph
Uh>2B
Uh)5B
UhH6B
C(_^[Y]
UhY7B
\$4Vj
SVWjH
TPatternManagerSV
_^[YY]
Uh+;B
UhY<B
TObjectList\>B
TOrderedList
TStack
comctl32.dll
InitCommonControlsEx
_^[Y]
GetMonitorInfoA
GetSystemMetrics
MonitorFromRect
MonitorFromWindow
MonitorFromPoint
>(r[j
GetMonitorInfo
DISPLAY
>(r[j
GetMonitorInfoA
DISPLAY
>(r[j
GetMonitorInfoW
DISPLAY
EnumDisplayMonitors
USER32.DLL
UheIB
IHelpSelector,
HelpIntfs
IHelpSystem,
HelpIntfs
ICustomHelpViewer,
HelpIntfs
IExtendedHelpViewer$JB
HelpIntfs
ISpecialWinHelpViewer`JB
HelpIntfs
IHelpManager,
HelpIntfs
EHelpSystemException
THelpViewerNode
THelpManager
R(FKu
Uh*RB
UhEUB
UhGVB
UhKWB
Uh]XB
_^[Y]
comctl32.dll
InitializeFlatSB
UninitializeFlatSB
FlatSB_GetScrollProp
FlatSB_SetScrollProp
FlatSB_EnableScrollBar
FlatSB_ShowScrollBar
FlatSB_GetScrollRange
FlatSB_GetScrollInfo
FlatSB_GetScrollPos
FlatSB_SetScrollPos
FlatSB_SetScrollInfo
FlatSB_SetScrollRange
Uh1]B
TSynchroObject
TCriticalSection
UhcdB
uxtheme.dll
OpenThemeData
CloseThemeData
DrawThemeBackground
DrawThemeText
GetThemeBackgroundContentRect
GetThemePartSize
GetThemeTextExtent
GetThemeTextMetrics
GetThemeBackgroundRegion
HitTestThemeBackground
DrawThemeEdge
DrawThemeIcon
IsThemePartDefined
IsThemeBackgroundPartiallyTransparent
GetThemeColor
GetThemeMetric
GetThemeString
GetThemeBool
GetThemeInt
GetThemeEnumValue
GetThemePosition
GetThemeFont
GetThemeRect
GetThemeMargins
GetThemeIntList
GetThemePropertyOrigin
SetWindowTheme
GetThemeFilename
GetThemeSysColor
GetThemeSysColorBrush
GetThemeSysBool
GetThemeSysSize
GetThemeSysFont
GetThemeSysString
GetThemeSysInt
IsThemeActive
IsAppThemed
GetWindowTheme
EnableThemeDialogTexture
IsThemeDialogTextureEnabled
GetThemeAppProperties
SetThemeAppProperties
GetCurrentThemeName
GetThemeDocumentationProperty
DrawThemeParentBackground
EnableTheming
UhAiB
UhyiB
IShellFolder,
ShlObj
UhUjB
TCommonDialog
TCommonDialog,kB
Dialogs
Ctl3D
HelpContextH
OnCloseH
OnShowPlB
TOpenOption
ofReadOnly
ofOverwritePrompt
ofHideReadOnly
ofNoChangeDir
ofShowHelp
ofNoValidate
ofAllowMultiSelect
ofExtensionDifferent
ofPathMustExist
ofFileMustExist
ofCreatePrompt
ofShareAware
ofNoReadOnlyReturn
ofNoTestFileCreate
ofNoNetworkButton
ofNoLongNames
ofOldStyleDialog
ofNoDereferenceLinks
ofEnableIncludeNotify
ofEnableSizing
ofDontAddToRecent
ofForceShowHidden
Dialogs
TOpenOptions
TOpenOptionEx
ofExNoPlacesBar
Dialogs4nB
TOpenOptionsEx
TOFNotifyEx
TIncludeItemEvent
TOFNotifyEx
Include
Boolean
TOpenDialog
TOpenDialog
Dialogs
DefaultExt
FileName
FilterT
FilterIndex
InitialDir
Options0nB
OptionsEx
Title,
OnCanCloseH
OnFolderChangeH
OnSelectionChangeH
OnTypeChangepnB
OnIncludeItemSVW
_^[Y]
_^[Y]
;Ght4
UhNxB
FileEditStyle
8Z|03
@\@t*U
u"Vh_
Cancel
Abort
Retry
Ignore
NoToAll
YesToAll
commdlg_help
commdlg_FindReplace
WndProcPtr%.8X%.8X
TImage
TImage
ExtCtrls
Align(HC
Anchors
AutoSize
Center
Constraints
DragCursor
DragKind
DragMode
Enabled
IncrementalDisplay
ParentShowHint
Picture
PopupMenu
Proportional
ShowHint
Stretch
Transparent
VisibleH
OnClick
OnContextPopupH
OnDblClickxKC
OnDragDrop
OnDragOver LC
OnEndDock LC
OnEndDrag
OnMouseDown
OnMouseMove
OnMouseUp(
OnProgress
OnStartDock
OnStartDrag
TTimer
TTimer\
ExtCtrls
Enabled
IntervalH
OnTimerp
TCustomPanel
TCustomPanelp
ExtCtrls
TPanel
TPanel
ExtCtrls7
Align
Alignment(HC
Anchors
AutoSize,VC
BevelInner,VC
BevelOutertVC
BevelWidth
BiDiMode
BorderWidth$
BorderStyle
Captionh
Color
Constraints
Ctl3D
UseDockManager
DockSite
DragCursor
DragKind
DragMode
Enabled
FullRepaint
Locked
ParentBiDiMode
ParentBackground
ParentColor
ParentCtl3D
ParentFont
ParentShowHint
PopupMenu
ShowHint
TabOrder
TabStop
Visible
OnCanResizeH
OnClick(OC
OnConstrainedResize
OnContextPopup|LC
OnDockDrop
OnDockOverH
OnDblClickxKC
OnDragDrop
OnDragOver LC
OnEndDock LC
OnEndDragH
OnEnterH
OnExit,NC
OnGetSiteInfo
OnMouseDown
OnMouseMove
OnMouseUpH
OnResize
OnStartDock
OnStartDragtMC
OnUnDockU
_^[Y]
_^[Y]
Delphi Picture
Delphi Component
TButtonLayout
blGlyphLeft
blGlyphRight
blGlyphTop
blGlyphBottom
Buttons
TNumGlyphs
TSpeedButtonActionLink
TSpeedButton
TSpeedButton\
Buttons
Action
AllowAllUp(HC
Anchors
BiDiMode
ConstraintsT
GroupIndex
Caption
Enabled
Glyph
LayoutT
Margin
NumGlyphs
ParentFont
ParentShowHint
ParentBiDiMode
PopupMenu
ShowHintT
Spacing
Transparent
VisibleH
OnClickH
OnDblClick
OnMouseDown
OnMouseMove
OnMouseUp
TGlyphList
TGlyphList
Buttons
TGlyphCache
TButtonGlyph
SVWUQ
Z]_^[
_^[Y]
_^[Y]
Y^[Y]
TOpenPictureDialog
TOpenPictureDialog8
ExtDlgs
Filter
TSilentPaintPanel
TSilentPaintPanelX
ExtDlgs
_^[YY]
_^[YY]
PicturePanel
PictureLabel
PreviewButton
PREVIEWGLYPH
PaintPanel
PaintBox
DLGTEMPLATE
_^[YY]
PreviewForm
Panel
Image
MAPI32.DLL
TProgressBarOrientation
pbHorizontal
pbVertical
ComCtrls
TProgressBar
TProgressBar4
ComCtrls!
Align(HC
Anchors
BorderWidth
DragCursor
DragKind
DragMode
Enabled
ConstraintsT
Orientation
ParentShowHint
PopupMenuT
Position
SmoothT
ShowHint
TabOrder
TabStop
Visible
OnContextPopupxKC
OnDragDrop
OnDragOver LC
OnEndDock LC
OnEndDragH
OnEnterH
OnExit
OnMouseDown
OnMouseMove
OnMouseUp
OnStartDock
OnStartDrag
TConversion(
TConversionFormat
TUDAlignButton
udLeft
udRight
ComCtrls
TUDOrientation
udHorizontal
udVertical
ComCtrls
TUDBtnType
btNext
btPrev
ComCtrls
TUpDownDirection
updNone
updUp
updDown
ComCtrls
TUDClickEvent
Sender
TObject
Button
TUDBtnType
TUDChangingEvent
Sender
TObject
AllowChange
Boolean
TUDChangingEventEx
Sender
TObject
AllowChange
Boolean
NewValue
Smallint
Direction
TUpDownDirection
TCustomUpDown
TCustomUpDown
ComCtrls
TUpDown
TUpDown
ComCtrls
AlignButton(HC
AnchorsxZC
Associate
ArrowKeys
Enabled
Hint<
Increment
Constraints
Orientation
ParentShowHint
PopupMenu<
Position
ShowHint
TabOrder
TabStop
Thousands
Visible
OnChanging
OnChangingEx
OnContextPopupD
OnClickH
OnEnterH
OnExit
OnMouseDown
OnMouseMove
OnMouseUp
comctl32.dll
msctls_progress32
msctls_updown32
F0;C0
TDBEdit
TDBMemo
_^[Y]
TThemeServices
Theme manager
2001, 2002 Mike Lischke
^[YY]
!"#$%
TCustomGroupBox
TCustomGroupBox
StdCtrls
TGroupBox
TGroupBox4
StdCtrls*
Align(HC
Anchors
BiDiMode
Captionh
Color
Constraints
Ctl3D
DockSite
DragCursor
DragKind
DragMode
Enabled
ParentBackground
ParentBiDiMode
ParentColor
ParentCtl3D
ParentFont
ParentShowHint
PopupMenu
ShowHint
TabOrder
TabStop
VisibleH
OnClick
OnContextPopupH
OnDblClickxKC
OnDragDrop|LC
OnDockDrop
OnDockOver
OnDragOver LC
OnEndDock LC
OnEndDragH
OnEnterH
OnExit,NC
OnGetSiteInfo
OnMouseDown
OnMouseMove
OnMouseUp
OnStartDock
OnStartDragtMC
OnUnDock
TTextLayout
tlTop
tlCenter
tlBottom
StdCtrls
TCustomLabel
TCustomLabel
StdCtrls
TLabel
TLabel
StdCtrls'
Align
Alignment(HC
Anchors
AutoSize
BiDiMode
Captionh
Color
Constraints
DragCursor
DragKind
DragMode
EnabledxZC
FocusControl
ParentBiDiMode
ParentColor
ParentFont
ParentShowHint
PopupMenu
ShowAccelChar
ShowHint
Transparent
Layout
Visible
WordWrapH
OnClick
OnContextPopupH
OnDblClickxKC
OnDragDrop
OnDragOver LC
OnEndDock LC
OnEndDrag
OnMouseDown
OnMouseMove
OnMouseUpH
OnMouseEnterH
OnMouseLeave
OnStartDock
OnStartDrag<
TScrollCode
scLineUp
scLineDown
scPageUp
scPageDown
scPosition
scTrack
scTop
scBottom
scEndScroll
StdCtrls
TScrollEvent
Sender
TObject
ScrollCode
TScrollCode
ScrollPos
Integer
TScrollBar
TScrollBar`
StdCtrls&
Align(HC
Anchors
BiDiMode
Constraints
Ctl3D
DragCursor
DragKind
DragMode
Enabled
LargeChangeT
PageSize
ParentBiDiMode
ParentCtl3D
ParentShowHint
PopupMenuT
Position
ShowHint
SmallChange
TabOrder
TabStop
Visible
OnContextPopupH
OnChangexKC
OnDragDrop
OnDragOver LC
OnEndDock LC
OnEndDragH
OnEnterH
OnExithJC
OnKeyDown
OnKeyPresshJC
OnKeyUp
OnScroll
OnStartDock
OnStartDrag
Uh2%C
_^[Y]
_^[Y]
<Eh:F
<E`:F
CL+D$
CL+D$
GH+D$
_^[Y]
SCROLLBAR
_^[YY]
UhM2C
THintAction
THintAction
StdActns
TWinHelpViewer
Uh)6C
_^[YY]
_^[YY]
Uh 9C
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
_^[Y]
JumpID("","%s")
_^[YY]
Uh0<C
_^[Y]
Uh+=C
MS_WINHELP
#32770
TCursor
TAlign
alNone
alTop
alBottom
alLeft
alRight
alClient
alCustom
Controls
TDragObject
TDragObject
Controls
TBaseDragControlObject
TBaseDragControlObjectLBC
Controls
TDragControlObject
TDragControlObjectEx
TDragDockObject|DC
TDragDockObject,DC
Controls
TDragDockObjectEx
TControlCanvas
TControlCanvas
Controls
TControlActionLink
TMouseButton
mbLeft
mbRight
mbMiddle
Controls
TDragMode
dmManual
dmAutomatic
Controls
TDragState
dsDragEnter
dsDragLeave
dsDragMove
Controls
TDragKind
dkDrag
dkDock
Controls
TTabOrder
TCaption
TAnchorKind
akLeft
akTop
akRight
akBottom
Controls
TAnchors
TConstraintSize
TSizeConstraints
TSizeConstraints
Controls
MaxHeight<HC
MaxWidth<HC
MinHeight<HC
MinWidth
TMouseEvent
Sender
TObject
Button
TMouseButton
Shift
TShiftState
Integer
Integer
TMouseMoveEvent
Sender
TObject
Shift
TShiftState
Integer
Integer
TKeyEvent
Sender
TObject
Shift
TShiftState
TKeyPressEvent
Sender
TObject
TDragOverEvent
Sender
TObject
Source
TObject
Integer
Integer
State
TDragState
Accept
Boolean
TDragDropEvent
Sender
TObject
Source
TObject
Integer
Integer
TStartDragEvent
Sender
TObject
DragObject
TDragObject
TEndDragEvent
Sender
TObject
Target
TObject
Integer
Integer
TDockDropEvent
Sender
TObject
Source
TDragDockObject
Integer
Integer
TDockOverEvent
Sender
TObject
Source
TDragDockObject
Integer
Integer
State
TDragState
Accept
Boolean
TUnDockEvent
Sender
TObject
Client
TControl
NewTarget
TWinControl
Allow
Boolean
TStartDockEvent
Sender
TObject
DragObject
TDragDockObject
TGetSiteInfoEvent
Sender
TObject
DockClient
TControl
InfluenceRect
TRect
MousePos
TPoint
CanDock
Boolean
TCanResizeEvent
Sender
TObject
NewWidth
Integer
NewHeight
Integer
Resize
Boolean
TConstrainedResizeEvent
Sender
TObject
MinWidth
Integer
MinHeight
Integer
MaxWidth
Integer
MaxHeight
Integer
TMouseWheelEvent
Sender
TObject
Shift
TShiftState
WheelDelta
Integer
MousePos
TPoint
Handled
Boolean
TMouseWheelUpDownEvent
Sender
TObject
Shift
TShiftState
MousePos
TPoint
Handled
Boolean
TContextPopupEvent
Sender
TObject
MousePos
TPoint
Handled
Boolean
TControl
TControl\QC
Controls
LeftT
WidthT
Height
Cursor
HelpType
HelpKeyword
HelpContextlUC
TWinControlActionLink
TImeName
TBorderWidth
TBevelCut
bvNone
bvLowered
bvRaised
bvSpace
Controls
TBevelWidth
IDockManager,
Controls
TWinControl
TWinControl
Controls
TGraphicControl
TGraphicControl
Controls
TCustomControl
TCustomControl
Controls
THintWindow
THintWindowh]C
Controls
TDragImageList
TDragImageList
Controls
TImageList
TImageList
Controls
BlendColorh
BkColorT
AllocBy0aD
DrawingStyleT
Height
ImageType
MaskedH
OnChange
ShareImagesT
Width
TDockZone
TDockTree
TMouse
crDefault
crArrow
crCross
crIBeam
crSizeNESW
crSizeNS
crSizeNWSE
crSizeWE
crUpArrow
crHourGlass
crDrag
crNoDrop
crHSplit
crVSplit
crMultiDrag
crSQLWait
crAppStart
crHelp
crHandPoint
crSizeAll
crSize
TSiteList
_^[YY]
UhNkC
tPHt8
_^[Y]
S$_^[]
;B0t'
Ph$oC
;B8t=
CQ tA
YZ_^[
Uhp~C
YZ]_^[
YZ_^[
t%Jt?Jt[
%s (%s)
Z:Pjt
YZ]_^[
$:Cat
u$;~|u
;CLtX3
Qh_^[
YZ_^[
YZ_^[
V:P\t
GP t;
_^[YY]
CH+D$
CL+D$
;s0t=;
:_Wt+
f;Pxt
KHQRP
Ht7Ht
IsControl
_^[YY]
YZ_^[
_^[YY]
_^[Y]
8]_^[
,]_^[
YZ_^[
^[YY]
RD;PD
:_[up
SVWUQ
Z]_^[
C$PVj
C$_^[
:GauOFKu
_^[Y]
DesignSize
_^[YY]
_^[Y]
t2HtY
,;=0[F
]_^[
_^[Y]
_^[Y]
$Z_^[
_^[YY]
_^[Y]
^[YY]
SVWUQ
Z]_^[
SVWUQ
Z]_^[
SVWUQ
Z]_^[
_^[YY]
;XDt#
SVWUQ
Z]_^[
t&j7j
YZ]_^[
YZ]_^[
YZ]_^[
t4VS
R|FOu
YZ]_^[
^[YY]
S8_^[]
+CH+E
+SL+U
;5<;F
_^[Y]
f;Pht
_^[Y]
t9;wlt4
YZ_^[
;Bdt*
;Bh|3
Uh$#D
R|_^[
FLVh`;D
_^[Y]
Y_^[]
Y[YY]
Uh62D
t$;C8u
QQQQSVW
;Fdu;
Uh?9D
^[YY]
Uh4:D
Q8FKu
;Xdt>
t#;^dt
YZ_^[
Y_^[]
^[YY]
+W$;U
+G$;E
_^[Y]
BP_^[]
USER32
WINNLSEnableIME
imm32.dll
ImmGetContext
ImmReleaseContext
ImmGetConversionStatus
ImmSetConversionStatus
ImmSetOpenStatus
ImmSetCompositionWindow
ImmSetCompositionFontA
ImmGetCompositionStringA
ImmIsIME
ImmNotifyIME
YZ_^[
Delphi%.8X
ControlOfs%.8X%.8X
USER32
AnimateWindow
Uh2ND
TContainedAction
TContainedAction
ActnList
Category
TCustomActionList
TCustomActionList
ActnList
TShortCutList
TShortCutList
ActnList
TCustomAction
TCustomAction
ActnList
TActionLinkSV
^[YY]
u*;~8u
R0GNu
SVWUQ
Z]_^[
QLGNu
R0Z_^[
Uh4\D
QPFOu
_^[Y]
$:Cjt_
QTGNu
R0Z_^[
Q`FOu
R0]_^[
$;Ctt?
Q\GNu
R0Z_^[
QhGNu
R0Z_^[
QlGNu
R0Z_^[
SVWQf
QpGNu
R0Z_^[
QtFOu
R0]_^[
SVWUQ
$Z]_^[
TChangeLink4aD
TDrawingStyle
dsFocus
dsSelected
dsNormal
dsTransparent
ImgList
TImageType
itImage
itMask
ImgList
TImageIndex
TCustomImageList
TCustomImageList bD
ImgList
UheeD
;V4t8
;V0t8
Rd_^[
s8VV3
UhohD
UhRhD
UhMiD
UhtkD
UhWkD
UhslD
S0_^[]
R ;C0|
R,;C4}!
S`]_^[
Bitmap
Uhz{D
_^[Y]
comctl32.dll
comctl32.dll
ImageList_WriteEx
UhY|D
EMenuError
TMenuBreak
mbNone
mbBreak
mbBarBreak
Menus
TMenuChangeEvent
Sender
TObject
Source
TMenuItem
Rebuild
Boolean
TMenuDrawItemEvent
Sender
TObject
ACanvas
TCanvas
ARect
TRect
Selected
Boolean
TAdvancedMenuDrawItemEvent
Sender
TObject
ACanvas
TCanvas
ARect
TRect
State
TOwnerDrawState
TMenuMeasureItemEvent
Sender
TObject
ACanvas
TCanvas
Width
Integer
Height
Integer
TMenuItemAutoFlag
maAutomatic
maManual
maParent
Menus
TMenuAutoFlag
Menus
TMenuActionLinkD
TMenuItem
TMenuItemD
Menus
Action
AutoCheck
AutoHotkeys
AutoLineReduction
Bitmap
Break
Caption
Checked
SubMenuImages
Default
Enabledl
GroupIndex
HelpContext
ImageIndex
RadioItem0
ShortCut
VisibleH
OnClick\}D
OnDrawItem
OnMeasureItem
TMenu
TMenuh
Menus
Items
TMainMenu
TMainMenu\
Menus
AutoHotkeys
AutoLineReduction
AutoMerge
BiDiMode
Images
OwnerDraw
ParentBiDiMode
OnChange
TPopupAlignment
paLeft
paRight
paCenter
Menus4
TTrackButton
tbRightButton
tbLeftButton
Menust
TMenuAnimations
maLeftToRight
maRightToLeft
maTopToBottom
maBottomToTop
maNone
Menus
TMenuAnimation
TPopupMenu
Menus
Alignment
AutoHotkeys
AutoLineReduction
AutoPopup
BiDiMode
HelpContext
Images
MenuAnimation
OwnerDraw
ParentBiDiMode0
TrackButton
OnChangeH
OnPopup
TPopupList
TMenuItemStack
1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ
_^[YY]
f;B`t
CPPVj
Q<]_^[
SVWUQ
:X?s&
X?ENu
Z]_^[
ShortCutText
_^[Y]
_^[Y]
P?:S?u
:^8tB
:^9tg
Q<_^[
:^?t1
f;P`t
:]:tJ
Q<]_^[
@?:F?v
Q<]_^[
Q<_^[
W<CNu
SpFOu
$YZ]_^[
_^[Y]
_^[Y]
SVWUQ
Z]_^[
_^[YY]
S0^[]
_^[Y]
_^[Y]
Ih;J4u
_^[Y]
YZ]_^[
S0_^[
S<&uO
^[YY]
TScrollBarKind
sbHorizontal
sbVertical
Forms
TScrollBarInc
TScrollBarStyle
ssRegular
ssFlat
ssHotTrack
Forms
TControlScrollBar
TControlScrollBar
Forms
ButtonSizeh
Color
Increment
Margin
ParentColorT
PositionT
Range
SmoothT
StyleT
ThumbSize
Tracking
Visible
TWindowState
wsNormal
wsMinimized
wsMaximized
Forms
TScrollingWinControl
TScrollingWinControl0
Forms
HorzScrollBar
VertScrollBar
TFormBorderStyle
bsNone
bsSingle
bsSizeable
bsDialog
bsToolWindow
bsSizeToolWin
Forms(
TBorderStyle
Forms
IDesignerHook #A
Forms
IOleForm,
Forms
TFormStyle
fsNormal
fsMDIChild
fsMDIForm
fsStayOnTop
Forms
TBorderIcon
biSystemMenu
biMinimize
biMaximize
biHelp
Forms
TBorderIcons
TPosition
poDesigned
poDefault
poDefaultPosOnly
poDefaultSizeOnly
poScreenCenter
poDesktopCenter
poMainFormCenter
poOwnerFormCenter
Forms
TDefaultMonitor
dmDesktop
dmPrimary
dmMainForm
dmActiveForm
Forms\
TPrintScale
poNone
poProportional
poPrintToFit
Forms
TCloseAction
caNone
caHide
caFree
caMinimize
Forms
TCloseEvent
Sender
TObject
Action
TCloseAction
TCloseQueryEvent
Sender
TObject
CanClose
Boolean
TShortCutEvent
TWMKey
Handled
Boolean
THelpEvent
Command
Integer
CallHelp
Boolean
Boolean
TCustomForm
TCustomFormT
Forms
TForm
TFormX
FormsU
ActionxZC
ActiveControl
Align
AlphaBlendl
AlphaBlendValue(HC
Anchors
AutoScroll
AutoSize
BiDiModeP
BorderIcons
BorderStyle
BorderWidth
CaptionT
ClientHeightT
ClientWidthh
Color
TransparentColorh
TransparentColorValue
Constraints
Ctl3D
UseDockManager
DefaultMonitor
DockSite
DragKind
DragMode
Enabled
ParentFont
FormStyleT
Height
HelpFile
HorzScrollBar(
KeyPreview
OldCreateOrder
ObjectMenuItem
ParentBiDiModeT
PixelsPerInch
PopupMenuh
PositionX
PrintScale
Scaled
ScreenSnap
ShowHintT
SnapBuffer
VertScrollBar
VisibleT
Width
WindowState
WindowMenuH
OnActivate
OnCanResizeH
OnClick
OnClose,
OnCloseQuery(OC
OnConstrainedResize
OnContextPopupH
OnCreateH
OnDblClickH
OnDestroyH
OnDeactivate|LC
OnDockDrop
OnDockOverxKC
OnDragDrop
OnDragOver LC
OnEndDock,NC
OnGetSiteInfoH
OnHide
OnHelphJC
OnKeyDown
OnKeyPresshJC
OnKeyUp
OnMouseDown
OnMouseMove
OnMouseUp
OnMouseWheelUpH
OnPaintH
OnResizep
OnShortCutH
OnShow
OnStartDocktMC
OnUnDock
TCustomDockForm8
TCustomDockForm
Forms
PixelsPerInch
TMonitor
TScreen
TScreen(
Forms
TApplication
TApplication
Forms
t:GNu
^[YY]
;S$t6
;S0t6
]_^[
_^[Y]
_^[Y]
Shh#E
PixelsPerInch
TextHeight
IgnoreFontProperty
_^[YY]
S,_^[]
Uhd+E
Uhk,E
Uh-1E
SVWUQ
$Z]_^[
Uhn7E
;Cpu'
F(Z_^[
MDICLIENT
UhXBE
_^[Y]
UhDEE
_^[Y]
;ADti
f#CTf
_^[Y]
UhuRE
Uh*ZE
UhxUE
_^[YY]
t"GNu
$Z_^[
_^[YY]
Uh~]E
Uhp`E
UhS`E
Uh1`E
_^[Y]
Y_^[]
_^[Y]
_^[Y]
_^[YY]
Ch;Ctt
Cd;Cpt
C\_^[
UhsqE
Uh/qE
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
layout text
f;sDtsf
PWj W
CHYZ]_^[
UhMtE
RD;PD
_^[YY]
UhAyE
TApplication
MAINICON
XD;PHu
sx;P`u
;B0uGj
_^[YY]
vcltest3.dll
RegisterAutomation
SVWUQ
$Z]_^[
~D_^[Y]
_^[Y]
_^[Y]
_^[Y]
;{HtK
YZ_^[
Y_^[Y]
;^`u0
]_^[
^[YY]
YZ]_^[
User32.dll
SetLayeredWindowAttributes
TaskbarCreated
GroupBox1
ScrollBar1
OpenPictureDialog1
UpDown1
ProgressBar1
TForm1
TForm1<
Unit1
VirtualProtect
kernel32
PPV,8
?VPQ$
h\teS
SVGW
p.`SVGK
DSVG?
87>[W
eW&F
c?IW&F
helhE
WjdWP
jdf&E
jsf&E
EIXj2
j f&E
EAXj
YXW&
SW3PWWj
ES(YY
3YFY;i
E[sbi
ll.hE
jwf&E
MCYjn
EgXje
jnf&E
CXS3oVW
EOt H
enVhE
Egprl
ypehE
jif&E
EgXje
UcZjt
jvf&U
juf&]
wjtf&]
jmf&E
C\S3oVW
EGVMK
KVMhE
Est H
MwahE
MXehE
"KtQP
C<S3oVW
EKKVM
MKVhE
EwMMX
jvf&E
EWjxX
eXf&E
PvPSF
jef&M
MEYjp
jcf&M
E{Xju
jnf&E
jif&E
sXf&E
P!6W&
PWPV`
EsXjo
jnf&E
EKXjd
jef&E
ECXji
jff&E
PV0Wh
}gSVG
;SVG{
XSVGW
SSVGK
Es;F4F%
MSQPj
EAXje
E]Xjs
QW3PWj
EGXja
jgf&E
M[Yjx
MQYjd
jwf&M
MyYja
jgf&M
jmf&E
EsXjv$
}Cjg_
f_f&}
}S_jB
};_jx
jGf&U
E[jsX
j%f&E
3ojDf&E
PVPWP_
UsZj
jsf&U
][f;F
MYYje
jsf&M
MSYjn
MKYjb
jof&M
jwf&M
PSPWL
jnf&E
jnf&E
EOXjb
jaf&E
opyhE
EW" "
PjZf&
Pjtf&
PrXf&
jef&E
lZf&U
UojbZ
jdf&U
FileTimeToSystemTime
kernel32
UhQ"F
ELF.EX
Error
Runtime error at 00000000
0123456789ABCDEF
MS Sans Serif
kernel32.dll
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
user32.dll
GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
advapi32.dll
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
oleaut32.dll
SysFreeString
SysReAllocStringLen
SysAllocStringLen
kernel32.dll
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
advapi32.dll
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
kernel32.dll
lstrcpyA
WriteFile
WaitForSingleObjectEx
WaitForSingleObject
VirtualQuery
VirtualAlloc
Sleep
SizeofResource
SetThreadLocale
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResetEvent
ReadFile
MulDiv
LockResource
LoadResource
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalReAlloc
GlobalHandle
GlobalLock
GlobalFree
GlobalFindAtomA
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomA
GetVersionExA
GetVersion
GetTickCount
GetThreadLocale
GetSystemTimeAsFileTime
GetSystemTime
GetSystemInfo
GetStringTypeExA
GetStdHandle
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileAttributesA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentProcessId
GetCPInfo
GetACP
FreeResource
InterlockedExchange
FreeLibrary
FormatMessageA
FindResourceA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
ExitThread
EnumCalendarInfoA
EnterCriticalSection
DeleteCriticalSection
CreateThread
CreateFileA
CreateEventA
CompareStringA
CloseHandle
version.dll
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
gdi32.dll
UnrealizeObject
StretchBlt
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetEnhMetaFileBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
SelectClipRgn
SaveDC
RestoreDC
Rectangle
RectVisible
RealizePalette
Polyline
PlayEnhMetaFile
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsA
GetTextExtentPoint32A
GetSystemPaletteEntries
GetStockObject
GetPixel
GetPaletteEntries
GetObjectA
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
ExcludeClipRect
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreatePenIndirect
CreatePalette
CreateHalftonePalette
CreateFontIndirectA
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileA
BitBlt
user32.dll
CreateWindowExA
WindowFromPoint
WinHelpA
WaitMessage
UpdateWindow
UnregisterClassA
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoA
ShowWindow
ShowScrollBar
ShowOwnedPopups
ShowCursor
SetWindowsHookExA
SetWindowPos
SetWindowPlacement
SetWindowLongA
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropA
SetParent
SetMenuItemInfoA
SetMenu
SetForegroundWindow
SetFocus
SetCursor
SetClassLongA
SetCapture
SetActiveWindow
SendMessageA
ScrollWindow
ScreenToClient
RemovePropA
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageA
RegisterClipboardFormatA
RegisterClassA
RedrawWindow
PtInRect
PostQuitMessage
PostMessageA
PeekMessageA
OffsetRect
OemToCharA
MessageBoxA
MapWindowPoints
MapVirtualKeyA
LoadStringA
LoadKeyboardLayoutA
LoadIconA
LoadCursorA
LoadBitmapA
KillTimer
IsZoomed
IsWindowVisible
IsWindowEnabled
IsWindow
IsRectEmpty
IsIconic
IsDialogMessageA
IsChild
InvalidateRect
IntersectRect
InsertMenuItemA
InsertMenuA
InflateRect
GetWindowThreadProcessId
GetWindowTextA
GetWindowRect
GetWindowPlacement
GetWindowLongA
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropA
GetParent
GetWindow
GetMenuStringA
GetMenuState
GetMenuItemInfoA
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
GetIconInfo
GetForegroundWindow
GetFocus
GetDlgItem
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClientRect
GetClassNameA
GetClassInfoA
GetCapture
GetActiveWindow
FrameRect
FindWindowA
FillRect
EqualRect
EnumWindows
EnumThreadWindows
EndPaint
EnableWindow
EnableScrollBar
EnableMenuItem
DrawTextA
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawEdge
DispatchMessageA
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcA
DefMDIChildProcA
DefFrameProcA
CreatePopupMenu
CreateMenu
CreateIcon
ClientToScreen
CheckMenuItem
CallWindowProcA
CallNextHookEx
BeginPaint
CharNextA
CharLowerBuffA
CharLowerA
CharToOemA
AdjustWindowRectEx
ActivateKeyboardLayout
kernel32.dll
Sleep
oleaut32.dll
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
comctl32.dll
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_SetDragCursorImage
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Remove
ImageList_DrawEx
ImageList_Replace
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Add
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
InitCommonControls
comdlg32.dll
GetOpenFileNameA
0(0<0T0l0
1,1}1
2&2.262>2F2N2V2^2f2n2v2~2
3J3R3Z3b3j3r3z3
4#4k5
516w6
:&:1:9:C:M:W:m:s:
;%;?;F;P;Z;d;p;{;
<6<><~<
=!=K>X>
?h?p?
131?1G1z1
2$2*2=2F2d2j2r2
363N3r3z3
5"5(50565<5C5M5
6;6G6O6
6#7<7U7
8^:f:
>$><>M>Y>
1%1;1R1g1
606H6V6j6
6'7T7]7
9#9U9\9|9
<?<T<
="=-=
>7>A>K>S>Y>g>
?j?s?
7":+:2;;;
5(5/5
<%<6<C<J<N<T<X<^<e<i<
="=J=t=
>#>0>B>
0&0.060>0F0N0V0^0f0n0v0~0
1&1.161>1F1N1V1^1f1n1v1~1
2&2.262>2F2N2V2^2f2n2v2~2
3&3.363>3F3N3V3^3f3n3v3~3
4&4.464>4F4N4V4^4f4n4v4~4
5&5.565>5F5N5V5^5f5n5v5~5
6&6.666>6F6N6V6^6f6n6v6~6
7&7.767>7F7N7V7^7f7n7v7~7
8&8.868>8F8N8V8^8f8n8v8~8
9S:X:d:s:
:C;O;\;n;{;
<$<,<4<<<D<L<T<\<d<l<t<|<
=$=,=4=<=D=L=T=\=d=l=t=|=
>$>,>4><>D>L>T>\>d>l>t>|>
?"?4?T?\?`?d?h?l?p?t?x?|?
0 0$0(0,00040D0d0l0p0t0x0|0
1$1(1,1014181<[email protected]|1
2$2,2024282<[email protected]`2
5,5L5T5X5\5`5d5h5l5p5t5
6 6$6(6,[email protected]`6h6l6p6t6x6|6
7 7$7(7,7074787<7T7t7|7
: :$:(:,:0:4:8:<:
1(1w1
2&2?2[2d2
:!:%:):-:1:5:9:=:A:E:I:
.1C1N2
4c5?6
<$=+=h=l=p=t=x=|=
011n1
1'2;2n2
3*3H3
304A5
6R7s7
8F9\9i9n9
;G;t;
<6>N>S>_>
>%?_?i?
0K0Z0t0
2*2d273w3|3
7.757H7`7
7 8/8C8
8>9p9
9U:g:
:#;O;
<!<&<,<1<7<><D<I<O<T<Z<a<g<r<z<
>,>I>
0)1=1c1w1N2
3/4[4
5"5/5E5L5^5c5s5}5
6L6b6
7"757>7]7k7
7!808>8a8
:;:i:
<Z?s?
0*0D0h0l0p0t0x0|0
1 1$1(1,1014181<[email protected]`1d1l1p1x1|1
2 2$2,20282<2D2H2P2T2\2`2h2l2t2x2
3 3(3,3;3G3R3f3q3{3
4#4.484B4L4V4`4j4t4~4
565>5F5N5
6T6a6
6,797b7
8$8Y8
999{9
:#:(:3:9:>:I:O:T:_:e:j:u:{:
;%;+;0;;;A;F;Q;W;\;g;m;r;};
="=R=V=Z=r=
>4>8>L>l>t>x>|>
?4?<[email protected]?D?H?L?P?T?X?\?x?
0 [email protected]`0h0l0p0t0x0|0
2 [email protected]`2h2l2p2t2x2|2
3.3E3w3
454g4
5%5R5
6/6>6U6d6{6
7<7K7b7
=D>|>
><?t?
0A0Z0q0
0)1E1I1M1Q1U1Y1]1a1e1i1m1q1u1y1}1
4!4%4)4-4
6%7>7U7
8R8n8r8v8z8~8
;!;%;);-;1;5;9;=;A;E;I;
0&1=1P1b1
2<2V2[2-3
5)5A5F5{5
6)6W6c6o6y6
7$7+71787>7E7K7R7d7t7|7
8$8,848<8D8L8T8c8o8|8
8<9Q9
=B>c>g>k>o>s>w>
+070>0H0S0e0v0
202H2m2t2
303P3X3\3`3d3h3l3p3t3x3
4 4$4(4,4<4\4d4h4l4p4t4x4|4
5 5$5(5,50545H5h5p5t5x5|5
6$6(6,6064686<[email protected]|6
8 8$808P8X8\8`8d8h8l8p8t8x8
9 9$9(9,909:9>9P9a9e9
: :$:2:P:k:o:
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<
= =(=,=0=4=8=<[email protected]=D=H=L=P=T=X=\=`=d=p=
> >$>(>,>0>4>8><>@>D>H>L>\>|>
? ?$?(?,?0?4?8?<[email protected]?T?t?|?
1 1$1(1,1014181<[email protected]
2(242H2P2T2X2\2`2d2h2l2p2t2x2|2
3 353
4 4(4,4044484<[email protected]\4`4d4h4l4p4t4x4
5 5?5`5
6 6$6(6,6064686<[email protected]\6`6d6h6l6p6x6
9%949h:
:?<V<]<
0,0=0H0[0
0T1a1
2'2H2U2b2w2|2
3+383E3W3\3w3
4%404=4O4T4l4
575F5
5.686B6K6[6j6t6
7,7K7{7
7b8p8
9"9)9C9s9
=.>k>
>B?I?
1M2h2
3d4z4
5,5w5
6'656
6<7b7
7Q8n8
<F<\<
=S=p=
=6>[>
6)7Q8X8
:/;?;_;
2 242<[email protected]\2`2n2v2
464~4
6!7-7<7
7$8)8H8Y8w8~8
;E;a;
=(>Z>
? ?5?
3?4a4
555K5
8O8]8k8y8
;O<S<v<z<
</=]=
='>I>
? ?$?(?,?0?4?8?<?
2 2.2
393L3
3#4>4
9#9'9+9/93979;9?9C9G9K9O9S9N:t:
:6;p;
>)>0>^>{>
?"?&?*?.?2?6?:?>?B?F?J?N?R?V?Z?^?b?f?
3%353^3z3
4)474v4{4
5_6L7W7
9v:}:
112`2
4&5+5=5
7'7.787P7j7t7~7
8 8*818;8H8X8`8h8p8x8
9 9([email protected]`9h9p9x9
: :(:0:8:@:H:P:X:`:h:p:x:
; ;(;7;C;P;b;h;
< <$<D<]<
?,?A?E?X?m?
0(0,000J0R0j0n0r0
1,14181<[email protected]\1`1l1v1z1
2,24282<[email protected]\2`2l2x2|2
3 3$3(3,303<3I3M3^3f3~3
5,505<5H5L5T5X5\5`5d5h5l5p5t5x5|5
6J6N6R6V6Z6r6
7,7L7T7X7\7`7d7h7l7p7t7x7
8 8$8(8,8084888<[email protected]\8`8d8h8l8p8t8x8|8
9,9<9L9T9X9\9`9d9h9l9p9t9x9|9
:4:<:@:D:H:L:P:T:X:\:`:p:
;(;3;7;N;\;|;
=8>n>
?:?J?
+4;436C6^6
7#777g7
7-8J8
9"9/9
9>:C:c:C<H<
>->c>h>
?K?v?
>0N0`0~0
202=2Q2^2r2
2.3;3
5+5^5
8)858D8S8
9B:b:
;%;R;
;!<o<
==>z>
2K2`2
2-4n4
4%5J5h5Q6
?0Q0n0
1 1$1(1,1c1y1
2:3w3
:3:T:c:}:
<I<g<
>/?d?
5*5O5m5
:7:m:
;,;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;
<7<<<d<s<
4&4\4d5,6J6t6
9%:7:D:
:3;?;
;y<U=z=
>P?o?
2_3s3
3"4S4`4
4A5O5
6W7r7
4`5p5
7'7L7{7
8&858;8T8t8|8
;`;y;
<"<-<7<B<T<f<w<
=!=(=2=7=<=A=K=P=U=w=
>0>8><>@>D>H>L>P>T>X>\>`>d>x>
/0;0H0Z0b0j0r0|0
1&1.1B1J1R1Z1b1j1r1z1
2$2-2:2B2H2T2Z2s2
3v3~3
4"4*4
495A5G5S5[5
6'6/6k6v6
7?7J7j7
9!9%9+9/9G9S9`9r9
:$:;:`:y:
;4;<;@;D;H;L;P;T;X;\;x;
;o<s<w<{<
= =$=(=,=0=>=F=\=d=l=t=
>$>,>8>
?.?a?v?
405t5
5'606
7+747
7P8o9{9
:&:1:J:e:r:
;!;/;8;=;B;P;Y;^;c;q;z;
=,=>=L=l=t=x=|=
?)?5?B?I?P?W?^?e?l?s?z?
0"0)00070>0E0L0S0Z0a0h0o0v0}0
1(1-1:1?1L1Q1^1c1p1u1
2$2)262;2H2M2Z2_2l2q2~2
3 3%32373D3I3V3[3h3m3z3
8)8C8O8W8e8m8
9#9/9<9N9[9g9t9
:7:C:P:b:j:w:
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;x;|;
<+<L<f<
>0>E>L>e>p>
? ?$?(?,?0?4?8?<[email protected]?N?V?^?f?n?
02060X0`0}0
111]1
2J3X3
3i4~4
4V5^5p5
6%8A8i8t8
9*949>9H9R9l9
9%:G:X:b:l:v:
<[email protected]`0d0l0p0x0|0
1 1+1=1N1V1e1o1z1
2 2$2(2,2024282<[email protected]\2`2d2n2r2
3'3/3M3r3
40484R4Z4v4~4
5*565L5u5
6,6R6x6
7 7,70787<[email protected]\7`7d7h7l7p7t7x7|7
[email protected]\8`8d8h8l8p8t8x8|8
9 9$9(9,9094989L9P9T9X9\9`9d9x9
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
;%;-;1;G;j;r;
<"<*<H<L<P<T<j<r<v<
=A=d=
>8><>c>k>
?!?)?-?D?H?L?g?o?
!0J0o0
1'1K1m1
2&2I2o2
4"4O6
9R:x:
;b<j<
3 3([email protected]`3h3p3x3
4 4$4(4,4044484<[email protected]\4`4d4h4l4p4t4x4|4
5 5$5(5,505;5G5N5Y5k5~5
6*626=6B6M6T6
707P7X7\7`7d7h7l7p7t7x7|7
8 8,80888<[email protected]\8`8d8h8l8p8t8x8|8
9"9&9*9.92969:9>9B9F9J9\9n9r9
:3:;:X:`:w:{:
;!;:;B;[;_;c;
<"<&<=<E<_<g<
=:=`=p=
> >@>H>L>P>T>X>\>`>d>h>x>
0'1;1_1i1s1
= =$=,=0=8=<=D=H=P=T=\=`=h=l=t=x=
> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>h>l>p>t>x>|>
?(?,?4?8?<[email protected]?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
1.1G1Y1
2'2[2a2q2
5)6^6~6
777R7b7
8'838
9L:Z:~:
;2;W;c;j;u;
<'<0<8<K<^<k<w<
= =$=(=,=0=4=8=<[email protected]=D=H=L=P=T=X=\=`=d=h=l=p=t=x=|=
>">3>;>S>[>_>u>}>
?(?4?G?O?m?q?u?
0 0$0?0G0`0h0
121W1|1
2-2S2w2
3$3C3L3i3
4D4}4
4?5C5G5K5P5`5l5p5x5|5
6 6$6(6,6064686<[email protected]\6`6t6x6|6
7 7$7(7,7074787<[email protected]\7`7d7h7l7p7t7x7|7
8,84888N8V8r8z8
979?9]9e9
:9:A:[:c:
;5;W;y;
;R<Z<d<i<
<j=*?_?q?
6Z6a6
<"<(<:<J<P<p<x<|<
0"1E1
1*313
4"4&4*4.424
738?8F8P8b8r8x8
9 9$9(9,9094989<[email protected]\9`9d9h9l9p9t9x9|9
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
;0;8;P;X;\;r;~;
<%<@<e<
>!>%>)>D>L>f>n>r>
?B?g?
0?0e0
0 1:1`1p1|1
2 2$2(2,2024282<2P2T2X2\2`2d2h2|2
3 3$3(3,3034383<[email protected]\3`3d3h3l3p3t3x3|3
464B4Y4]4a4e4{4
5,585N5V5u5}5
61696U6]6}6
7,787N7w7
8.8T8z8
989R9
:$:0:4:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
; ;$;6;:;>;B;F;J;\;l;p;
<,<Q<t<
=$=:=B=]=
>$>(>?>e>i>m>
?=?b?
060X0{0
506l6
<!=9=
1/2;2H2Z2`2p2
3!323:3
3`4d4h4l4p4t4x4|4
5$5(5,5054585<[email protected]
7 707I7n7
8C8R8Y8
:F:g:
;U;c;};
;#<_<
>+>y>
0'0.090C0M0W0a0k0}0
1\1|1
2 2(2,2024282<[email protected]\2`2d2h2l2p2t2
3 3$3(3,3034383P3p3x3|3
4 4$4(4,4044484<[email protected]\4`4d4x4
5 5$5([email protected]`5h5l5p5t5x5|5
6 6$6(6,6064686<[email protected]\6`6d6h6l6p6t6x6|6
787Q7
7(878<8\8l8|8
9'9B9J9f9n9
:U:Y:]:a:h:
:_;c;g;k;o;s;x;
< <l<p<t<x<|<
<[=_=c=g=k=o=t=
=$>(>,>
?!?(?
1 1,10181<[email protected]\1`1d1h1l1p1t1x1|1
3"3&3*3.32363:3>3B3F3J3N3R3V3Z3^3b3f3j3n3r3v3z3~3
40484P4X4q4y4
5 [email protected]\5`5d5h5l5p5t5x5|5
6,6D6t6
7 7$7(7,7074787<[email protected]\7`7d7h7l7p7t7x7|7
9"9&9*9.92969:9>9B9F9J9N9R9V9Z9^9b9f9j9n9r9v9z9~9
:":&:*:.:2:6:::>:B:F:J:N:R:V:Z:^:b:f:x:
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<
=,=8=<=D=H=L=P=T=X=\=`=d=h=l=p=t=x=|=
> >$>(>,>0>4>8><>@>D>R>V>Z>^>p>
? ?$?8?L?P?d?t?
0%0J0N0R0l0
1>1d1l1
1x2|2
3 3$3(3,3034383<[email protected]|3
4"41494T4Z4
808P8X8\8`8d8h8l8p8t8x8|8
;(;U;d;
<O<S=
3)4d4q4z4
465>5K5R5`5k5q5
606<6L6]6j6
7!777R7^7f7x7
8#8)828?8D8N8T8\8
9&94999E9O9U9]9~9
:-:<:r:
;6;L;T;b;t;
<$<*<G<R<[<i<|<
=+=8=?=E=M=c=n=
>#>)>7>=>K>Q>_>j>~>
0)0.0K0[0
0D1S1
444x4
4'5_5b6
6H7R7f7k7w7
:k:O;
1_2O3U3x3~3
6C9g9v9
<V<n<
=)=p=y=
1N2[2j2A4Q4
9^:&;/;=;
>@>h>
0!1,1
6,7:7
;^;s;
;'<N=^=
8.9v91:
<[=w=
>T>f>
021m1v1
7S9[9n9=:
6/6f6
;"<)<
0Q2a2!3
5.646
8!9;9
=9=[=l=
2:2W2
4$5B5Y5^5
5E7Q7f7u7
;6;[;
3X3 6s6
6,7J7
8=8f8
;4=X=
1!191
7.8v8
829d9
9':^:x:
8$8)84898>8I8N8S8^8c8h8s8x8}8
:?:M:d:y:
;';,;7;B;M;X;c;k;
<$<)<9<@<J<V<`<i<t<
<K=W=^=m=x=
>-><>H>L>X>\>d>h>l>p>t>x>|>
?&?*?;?C?G?`?p?|?
0'0+0<0L0\0d0h0l0p0t0x0|0
101C1G1X1d1h1t1x1
2 2$282K2O2`2
5o5~5
9(9<9P9;:
1 101L1
2 2$2(2,2024282<[email protected]\2`2h2
464E4|4
4U5-7D7m7|7
7E8b8
9):6:F:o:
:$;3;J;g;
<+<f<^=
?g?t?
2D4T4k4{4
6-6X6
8B8R8
8[9k9
;!;O;V;m;;<G<T<f<l<
=P=T=X=\=
=0>4><>@>
? [email protected]?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
0 0$0(0,0004080<[email protected]\0`0d0h0l0p0t0x0|0
1B1J1h1p1
2!2A2I2c2k2o2
4(4,484<4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
5 50585<[email protected]\5`5d5h5l5p5t5x5|5
6;6C6G6^6f6
707K7p7
8 8$8(8,8084888<[email protected]\8`8d8h8l8p8t8x8|8
9(9L9T9X9o9s9w9
:+:Q:t:
;$;,;0;4;8;<;@;D;H;L;P;T;X;
<%=8=K=f=
>2>W>
?(?A?Z?
2#3W3/5C5v5
7)757A7O7[7j7v7
9;9i9
::;`;
;I<V<
Z1m1C2+4T5
8f:y:O;;=d>
2 2Q2
657G7
7C9i9
090y0
7#8H8\8
;R;a<
<G=T=}=
0&0S0
7B8W8
9$939M9
9&:U:
;G;s;
;"<N<
=L>b>v>
0 1$1(1,1014181<[email protected]\1`1d1h1l1p1t1x1|1
2"2*242>2I2N2Y2^2h2t2~2
3"3H3X3h3p3t3x3|3
4"4.4F4g4o4
50585T5w5
6 6$6(6,6064686<[email protected]\6`6d6h6l6p6t6x6|6
7$8?8L8_8
9P9c9h9
:":X:r:
:!;%;,;g;k;p;
<$<(<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<
= =$=(=,=0=4=8=<[email protected]=D=R=Z=b=
>">&>*>.>2>6>:>>>B>F>J>N>R>V>Z>^>b>f>j>n>r>v>z>~>
?,?4?8?<[email protected]?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
0 0$0(0,0004080<[email protected]_0c0q0y0
1)11151K1S1W1p1
2(2,20242J2N2R2V2q2u2y2}2
454=4Z4b4f4y4
5(545M5U5Y5l5
636;6?6V6b6{6
71797=7S7[7_7s7{7
8+878M8Y8t8
979C9^9
:>:J:_:
;7;C;[;
<@<L<a<
= =$=(=,=0=4=8=<[email protected]=D=H=L=P=T=X=\=`=d=h=l=p=t=x=|=
> >4>I>M>[>_>c>
? ?$?(?,?0?4?8?<[email protected]?D?H?L?P?T?b?t?
0 0$0(0,0:0B0J0R0Z0b0x0
1#191_1i1
2u2|2
3#3`3
4 5V5
6(717
7#9U9L:1<5<9<=<A<E<I<M<Q<s=y=k>
>m?~?
3w4(5
8)989c9
:.:::t:
<$<K<
<c=r=
718N8]8t8X9
;E;t;
<#<O<{<
3<3P3
6(6a7
959M9m9x9
:=:O:m:
:-;E;X;j;
=#='=+=/=3=O=
>G?R?j?
0'090S0
4(525L5|6
878r8
9K<6=
2,2A2V2h2
5-5X5
738e8
=D=S=q=
>9>F>c>k>s>
0"0D0I0c0
4b5q5
6r7K9
;M;V;[;d;|;
<@<P<`<
=#=O=[=g=s=
=\>t>
0!1c1
3"333?3I32484C4b5$6(6,6064686<6]8m8
:L:w:
;&;3;9;A;R;[;f;s;6<B<K<P<\<e<p<
>)><>A>N>
>*?B?Q?^?c?l?r?
0>1T1t1
363Y3
485<[email protected]\5`5d5h5l5p5t5x5|5
<5=/>;>
2$2q2
3J4o4
455D5
507k7
8L8b8<9
9":J:b:
:#;=;\;
0=1M1
5"6+616D6H6W6c6k6y6
7 7$7(7,7074787<[email protected]\7`7d7h7l7p7t7x7|7
8 8$8(8,828
8I9N9
2D2s2
3 3$3(3,3034383<[email protected]\3`3d3h3l3p3t3x3|3
4 4$4(4,4044484<[email protected]\4`4d4h4p4{4
2X2`2h2p2x2
[email protected]\3`3d3h3l3p3t3x3|3
4L4T4\4d4l4t4|4
5$5,545<5D5L5T5\5d5l5t5|5
6$6,646<6D6L6T6\6d6l6t6
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:
; ;(;0;8;
> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>h>l>p>t>x>|>
? ?$?(?,?0?4?8?<[email protected]?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
0 0$0(0,0004080<[email protected]\0`0d0h0l0p0t0x0|0
1 1$1(1,1014181<[email protected]\1`1d1h1l1p1t1x1|1
nd*3|?
7b mv
QBz_0
A1idJ
{$j:V
.t7'4M
Dy":=o
,/"iPAD.
bGlRJ
!<UX%|`
7o9).
{9Z%,9
mim[,#
|wZv#
PADz;+
cU*<S
n,uuq
?v+^\
fKa{*@2
Yt\rQ'#
!\-|e
Ra?)E3$
$(2.M}
l'5$U
~PADP
OMc+7
i(l^R!vI
3}AdnA
PAD4`
4B|%:&
<tn("F
1M+PAD\
5d),&pr
Oph`;z
UAu=K(
pPAD7
||!YDb
G~t4z
Ao.fn
DYe0U
jmJu^:
=dGAb
^5{Z1
$?q<$i
lY%S<
c4UD%<
^DL~o
|G<XsZ
6]PAD
UpMsA
PAD+N
nj4a1w[
gLY#OA
(`#s!
[!9|E
K1?dQ
}Ck``
dPAD_!
DvfC&
,mXVEFb
oO_$~
Q`{Esz
A9fsv
xv`+F6
Dd/$|v
/sR9%
FdX~Y
)%FBA
PADl(|2
jdMPAD0
BU#+%
lALXn
L2Ska
%:K'>
PADoR
/vZEls
L<@ Z
S=pd^
's0N-N=
{3h}Pw
Ho`z)f.f
\:>#v
3_PAD
M]{jB
aD0;Q
Jv7f*m
"%}pWN
RJ3&+F
HYh0C
G/SZq
PADq}
P-.//
{@r'^
;/b z
:]9PAD.
hM}jhEv
y8Gtfj
;|Zuh
osXDIt
TwtllS
PADrMx
hz7Tl
f-lEj
PADbx!#i
&_\et
$8_E3
P`y[#
O+/6g
PAD\O
*D}S{X
wJgXwD
HPADh4
d7nkWMI
o /ufM
;d1Cm
dSn{(
{xzJn!.
~WPAD
F4!sUVq
+4~O<
7NPGJ
^KO^7}
(qZ|+
IHmBq
+PADL
!aB)?
VBqoe
(:g);eH
3,`O
9l,:Z
4CmCw
]/{N`
?^9:
E<',ZC.
kxf2>ow.
[a?mG:^
G&=FJFx
$K\1R
5PADp
D'@voA
$;;}{C0
Wbkp"n
=KD&\vS
mFgv3
cQYro4
C1gu+
PADi6
i?e!SP
L&i&.DG
v}^cBt}
yx;lX9
1>\JQD
oPADz
Jr|**T
_fsR{
hWt;=#
'9 v1
)Bryxqf
/S`q|*J_
JC#PAD
A%*ROXt
/Na8w
.~gxDc
~WPAD
\:-!m
FL QqD
91%]U
>>R4[
B>&K{
E%dY6%0
X:D+I
dM1}l<)j\
BE#8M.
ynleP
h%PAD<
m<di>S
NHOH-
;3PH[
Qb>7}d
R:)H=
V)!{W
8L0WX
c<7n$
&}M +&
4M\n%
2<5om
EvunH
8JGt2e
Vx:@C
dn;9+]+<oy_
@94aLC
g]&-p1cI
FA|me$
cMb88Y
PAD+Q
Ga;@NnF
Uc*0JV_
Kt9DV
T*PAD2
p^}X&
4hz8]
JXbZz
mmPAD
8xYRO
J|9PADV
0F>*E
@}YN~
G>STBF
qm`l8
T{\Zu
.x_>0PK
)OkE{
B<7k}T8z7
}38`n[
L-.+~
q1bl"
UQ/Y"
.Pz A=
`?PAD
s'PADP2
[iF!K
2x[.0
5st k;
|/e4`'
4a=2!
(fp"P
?PAD8
ZDxu#KQ
3Rl{]+`
SD jGM
w}c)fN
5Iq8T
IbdHf
+Uv+4
~e""=
](b8G
K[bJ8E
bdPAD
x 6,o8
5rQ0:=
b.![_
SMo;!
T,F?,H'8_
~0<v,
k-8ZZX
L[YNV
GX-"0
#A>;`iS
xgenC
|EINR
tktRS
Q;{n,M
2!VVh
_PADV
@p3`|
`(} v
I4Pz9
K+8"2
LgwDY
?TYY^O
SiaT\
5EnL7
[gsJ!
5CXR(_0
3z.j9
]A'DB
8I.[>
& XBM2
m8%zo
^J9NzA
+|4Vb
*zKMU
NLX4sA
&VOd1
3<uLp5
nEIC+
G$4;G
F9Z/@|
]BCkk
x'"M
bc]<"J
QdiZh
Bx''2
5dStU
1P]qV
jPAD0
z8KKo<PAD
7WTCJr
+bh~yc
=,M$E
s<PG,
@Aj9Wi^i
\h]D~:@
K#q`/
<uDu}
KkQ~;
C/tM-
1^"#h
Nqpg/
AA7&3
?:/^"
l"NK;
CPADQ^
q=RJ;
>,/y5
7vntv
$ /lQ
v9yf=X
0RwY:
lhU:{
Yuk6'i7
wB5Ji
)vREoWp
3~f"{:
insgp
\0(|
PAD{z"&
PAD,>
BDz<k
Q_,u )
!9 Yh
sa9qtnK
F0UkT}
:pZJ1
:}R+9
Ne&{|
}[3*-
;{(v$x[
JgVyJ
(iz/LHv{
bGqi?
]!8oN
P?kN7
E0aEo.
q(2),6I3S
Ffs45
BOoeR R+|
E`Zu<%
&]&'9'
od"YH
PADf5
7.c0(
1j.r00R
.Dj}O
i7dk|
vc?p b
3L/tPAD
`&%x?
PAD";
[$:me
SVcHs/
R;PAD=
PXDzKY!
\ +_q
@VoPAD
|`tg|p>?
;-7Kyz
Z*3V)
"_L.ekB
9Qny5C
X!Y_f
.=^ku
fF/GH
|bPAD
|)cTaK
Xfs5{
%'xjT
+yI*A
$3t>c
Ktc9#
(},%I
7L6,{
6`=Tf
DRd;-j
Po#{W
l9PAD
m8h5|
;fp\1
p~2ft
al /E
N_,?&
L~(/C
@~vy
##;tr
UbXPPAD4H
4OW8>Y
/HiF^
,O=}^
ZiAg>
lq2DN
c^TKj
PADxt
LQiW,r
,rpk4
TMX^a,
1Atc1
T9Dtq
,$PAD95
I0Ot.
LZ+CJ
,YSYp5
v[q.R9}
b5^6<
7C<Dl
bq?zE(
>+#!e
I|RM)
x/dpu8
Q*WPj{
eEPADK
O9QEAQ
$})9CcAgw
TCxrPADe
4Ywow
qe8Ba
U-4sU[[
Lzyh#
HsN?E
$uToG*#(
9L2]l
wPADh
C2 a^O
SB8n$
/0><)[I`
lUryq
PADK;
=;yt\
<?U]iB
BPADm
R)nU$2
D(OKV
8EmX$
0Px03
2%.:!F
~nT(F
)!\gk
fsNQ.
"8r]Fj
'6Tr|
65Xtxs
x`<j~e
B$B^V
Lf2.J
EPADu
lVFIG<
yfaSeYS
@zlm!YG
wqT_Ly
o**-<
=T\C_
m>e:@
j}Od2
t\g7D!
[)@3c
"{3g<
Pkvs0
Clznt
qYfy$C
>1\0qez
Y(x6
Kptz$~1
7r_(~
;Sp={
u,PD*
NA'A!b/
zePAD
?Lx:5
'G8~}
cPn4
;YsF,
4vu+~'J
2sYqV
f$lC`
qIPADh
|}YC4"PT"
PCwC|+
D NbpA5
n3"-l
X%ETv
g%PADq)
PADZl
J=N^e
|/n'@@
tKLJY`
QJ=xR
lRr/z
b}*}wE$l
yHg0z
Hk'|^
AH,>1
@5'f9
3`6j"
Z.we7NY
N&w /
y~?%E
PADDy
C7TD2<
<Uwm
=\kPADm4#
z5e>
pa<3&
4R*3|h`
gcywa
$[S)S
uSPAD1fR
ZgO<U
E(wPAD*v
a:JX<
A9PAD
V}P90
xj[__
Nd*eSYS"
,q/R}
]}gAw
t!vcT
ffo(h
XN|Ef}
7Project1
FlatSB
System
SysInit
KWindows
UTypes
WinHelpViewer
RHelpIntfs
Contnrs
"RTLConsts
SysConst
SysUtils
^Classes
3Messages
CVariants
$VarUtils
QTypInfo
sActiveX
EActnList
Forms
Printers
Consts
WWinSpool
+Graphics
CommCtrl
StdActns
Clipbrd
YStrUtils
*ShellAPI
&Controls
5Themes
nComCtrls
ComStrs
ExtActns
0Mapi
dStdCtrls
vMenus
ImgList
Dialogs
ExtCtrls
IDlgs
3CommDlg
(ShlObj
RegStr
?WinInet
UrlMon
ExtDlgs
Buttons
8Registry
IniFiles
CUxTheme
SyncObjs
RichEdit
ToolWin
ListActns
MultiMon
Unit1
TForm1
Form1
Width
Height
Caption
,HrWzMj19c9UlRipU18UPUlUuYpBf66FpfDPbxQ5CVmw8
Color
clBtnFace
Font.Charset
DEFAULT_CHARSET
Font.Color
clWindowText
Font.Height
Font.Name
MS Sans Serif
Font.Style
OldCreateOrder
PixelsPerInch
TextHeight
TGroupBox
GroupBox1
Width
Height
Caption
GroupBox1
TabOrder
TScrollBar
ScrollBar1
Width
Height
PageSize
TabOrder
TUpDown
UpDown1
Width
Height
TabOrder
TProgressBar
ProgressBar1
Width
Height
TabOrder
TOpenPictureDialog
OpenPictureDialog1
`c[;,.
z0^89%
\1b:PAD
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
jjjjjj
ADBLB
ebutton
clock
combobox
explorerbar
header
listview
progress
rebar
scrollbar
startpanel
status
taskband
taskbar
toolbar
tooltip
trackbar
traynotify
treeview
window
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
A A0ADA
DVCLAL
PACKAGEINFO
TFORM1
MAINICON

Full Results

Engine Signature Engine Signature Engine Signature
Bkav Clean DrWeb Clean MicroWorld-eScan Clean
FireEye Generic.mg.f9ae03f53f99519e CAT-QuickHeal Clean ALYac Clean
Cylance Unsafe Zillya Clean SUPERAntiSpyware Clean
Sangfor Clean CrowdStrike win/malicious_confidence_70% (D) Alibaba Trojan:Win32/Injector.89f84e22
K7GW Trojan ( 005680341 ) K7AntiVirus Trojan ( 005680341 ) Arcabit Clean
Invincea heuristic BitDefenderTheta AI:Packer.B1D1592921 F-Prot Clean
Symantec Infostealer.Lokibot!43 TotalDefense Clean APEX Malicious
Avast Clean ClamAV Clean Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Clean NANO-Antivirus Clean Paloalto generic.ml
ViRobot Clean Tencent Win32.Backdoor.Fareit.Auto Ad-Aware Clean
Emsisoft Clean Comodo Clean F-Secure Clean
Baidu Clean VIPRE Clean TrendMicro Clean
McAfee-GW-Edition BehavesLike.Win32.Fareit.hc Fortinet W32/Injector.EHDJ!tr Trapmine malicious.moderate.ml.score
CMC Clean Sophos Clean SentinelOne Clean
Cyren Clean Jiangmin Clean Webroot Clean
Avira Clean MAX Clean Antiy-AVL Clean
Kingsoft Clean Endgame malicious (high confidence) Microsoft Trojan:Win32/Pwsteal.Q!bit
AegisLab Clean ZoneAlarm UDS:DangerousObject.Multi.Generic Avast-Mobile Clean
AhnLab-V3 Suspicious/Win.Delphiless.X2066 Acronis suspicious McAfee Fareit-FTB!F9AE03F53F99
TACHYON Clean VBA32 Clean Malwarebytes Clean
Zoner Clean ESET-NOD32 a variant of Win32/Injector.EMGH TrendMicro-HouseCall Clean
Rising Trojan.Lokibot!8.F1B5 (CLOUD) Yandex Trojan.AvsArher.bTOmTw Ikarus Win32.Outbreak
eGambit Unsafe.AI_Score_99% GData Clean MaxSecure Clean
AVG Clean Cybereason malicious.625d66 Panda Clean
Qihoo-360 HEUR/QVM05.1.B130.Malware.Gen
Sorry! No behavior.

Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
Y 1.1.1.1 [VT] Australia

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.1.7 53011 1.1.1.1 53
192.168.1.7 53423 1.1.1.1 53
192.168.1.7 54277 1.1.1.1 53
192.168.1.7 55169 1.1.1.1 53
192.168.1.7 56221 1.1.1.1 53
192.168.1.7 56328 1.1.1.1 53
192.168.1.7 56943 1.1.1.1 53
192.168.1.7 57251 1.1.1.1 53
192.168.1.7 57459 1.1.1.1 53
192.168.1.7 57642 1.1.1.1 53
192.168.1.7 59227 1.1.1.1 53
192.168.1.7 59353 1.1.1.1 53
192.168.1.7 59810 1.1.1.1 53
192.168.1.7 61313 1.1.1.1 53
192.168.1.7 62371 1.1.1.1 53
192.168.1.7 64247 1.1.1.1 53
192.168.1.7 65103 1.1.1.1 53
192.168.1.7 65119 1.1.1.1 53
192.168.1.7 137 192.168.1.255 137
192.168.1.7 53011 8.8.8.8 53
192.168.1.7 53423 8.8.8.8 53
192.168.1.7 54277 8.8.8.8 53
192.168.1.7 55169 8.8.8.8 53
192.168.1.7 56221 8.8.8.8 53
192.168.1.7 56328 8.8.8.8 53
192.168.1.7 56943 8.8.8.8 53
192.168.1.7 57251 8.8.8.8 53
192.168.1.7 57459 8.8.8.8 53
192.168.1.7 57642 8.8.8.8 53
192.168.1.7 59227 8.8.8.8 53
192.168.1.7 59353 8.8.8.8 53
192.168.1.7 59810 8.8.8.8 53
192.168.1.7 61313 8.8.8.8 53
192.168.1.7 62371 8.8.8.8 53
192.168.1.7 64247 8.8.8.8 53
192.168.1.7 65103 8.8.8.8 53
192.168.1.7 65119 8.8.8.8 53

DNS

Name Response Post-Analysis Lookup
fuscon.cf [VT] 104.27.135.34 [VT]

HTTP Requests

No HTTP requests performed.

SMTP traffic

No SMTP traffic performed.

IRC traffic

No IRC requests performed.

ICMP traffic

No ICMP traffic performed.

CIF Results

No CIF Results

Suricata Alerts

Timestamp Source IP Source Port Destination IP Destination Port Protocol GID SID REV Signature Category Severity
2020-06-05 14:03:01.499 192.168.1.7 [VT] 65119 1.1.1.1 [VT] 53 UDP 1 2025107 3 ET INFO DNS Query for Suspicious .cf Domain Potentially Bad Traffic 2
2020-06-05 14:05:34.461 192.168.1.7 [VT] 65103 1.1.1.1 [VT] 53 UDP 1 2025107 3 ET INFO DNS Query for Suspicious .cf Domain Potentially Bad Traffic 2

Suricata TLS

No Suricata TLS

Suricata HTTP

No Suricata HTTP

Sorry! No dropped Suricata Extracted files.

JA3

No JA3 hashes found.

Sorry! No dropped files.
Sorry! No CAPE files.
Sorry! No process dumps.
JSON Report Download
Defense Evasion Credential Access Collection Privilege Escalation
  • T1116 - Code Signing
    • Signature - invalid_authenticode_signature
  • T1055 - Process Injection
    • Signature - InjectionInterProcess
  • T1045 - Software Packing
    • Signature - packer_unknown_pe_section_name
  • T1003 - Credential Dumping
    • Signature - infostealer_browser
  • T1081 - Credentials in Files
    • Signature - infostealer_browser
  • T1005 - Data from Local System
    • Signature - infostealer_browser
  • T1055 - Process Injection
    • Signature - InjectionInterProcess

    Processing ( 14.459999999999999 seconds )

    • 5.806 NetworkAnalysis
    • 5.218 Suricata
    • 1.645 Static
    • 0.873 BehaviorAnalysis
    • 0.375 CAPE
    • 0.262 VirusTotal
    • 0.082 AnalysisInfo
    • 0.065 TargetInfo
    • 0.052 Deduplicate
    • 0.051 Dropped
    • 0.016 Strings
    • 0.008 Debug
    • 0.007 peid

    Signatures ( 0.9240000000000005 seconds )

    • 0.1 antiav_detectreg
    • 0.056 masquerade_process_name
    • 0.05 antiav_detectfile
    • 0.05 infostealer_ftp
    • 0.035 territorial_disputes_sigs
    • 0.031 infostealer_bitcoin
    • 0.03 infostealer_im
    • 0.029 antivm_vbox_libs
    • 0.026 decoy_document
    • 0.026 antianalysis_detectfile
    • 0.023 exec_crash
    • 0.022 api_spamming
    • 0.022 stealth_timeout
    • 0.02 antianalysis_detectreg
    • 0.02 antivm_vbox_files
    • 0.016 NewtWire Behavior
    • 0.015 infostealer_mail
    • 0.014 ransomware_files
    • 0.013 qulab_files
    • 0.012 Doppelganging
    • 0.012 antiav_avast_libs
    • 0.012 predatorthethief_files
    • 0.011 antivm_vbox_keys
    • 0.008 exploit_getbasekerneladdress
    • 0.008 antidbg_devices
    • 0.008 geodo_banking_trojan
    • 0.008 ransomware_extensions
    • 0.007 InjectionCreateRemoteThread
    • 0.007 exploit_gethaldispatchtable
    • 0.007 antivm_vmware_files
    • 0.007 antivm_vmware_keys
    • 0.006 antiav_bitdefender_libs
    • 0.006 antiav_emsisoft_libs
    • 0.006 antisandbox_sunbelt_libs
    • 0.006 antivm_generic_disk
    • 0.006 antivm_vmware_libs
    • 0.006 injection_createremotethread
    • 0.006 network_tor
    • 0.005 antiav_bullgaurd_libs
    • 0.005 antiav_qurb_libs
    • 0.005 antiav_apioverride_libs
    • 0.005 antiav_nthookengine_libs
    • 0.005 antisandbox_sboxie_libs
    • 0.005 betabot_behavior
    • 0.005 kibex_behavior
    • 0.005 shifu_behavior
    • 0.005 antivm_parallels_keys
    • 0.005 antivm_xen_keys
    • 0.004 InjectionInterProcess
    • 0.004 dynamic_function_loading
    • 0.004 malicious_dynamic_function_loading
    • 0.004 mimics_filetime
    • 0.004 virus
    • 0.004 antivm_vbox_devices
    • 0.004 antivm_vpc_keys
    • 0.003 InjectionProcessHollowing
    • 0.003 antidebug_guardpages
    • 0.003 bootkit
    • 0.003 regsvr32_squiblydoo_dll_load
    • 0.003 exploit_heapspray
    • 0.003 hawkeye_behavior
    • 0.003 infostealer_browser
    • 0.003 injection_runpe
    • 0.003 kazybot_behavior
    • 0.003 network_anomaly
    • 0.003 persistence_autorun
    • 0.003 reads_self
    • 0.003 stealth_file
    • 0.003 antivm_generic_diskreg
    • 0.003 codelux_behavior
    • 0.003 rat_pcclient
    • 0.002 encrypted_ioc
    • 0.002 hancitor_behavior
    • 0.002 ketrican_regkeys
    • 0.002 bypass_firewall
    • 0.002 network_torgateway
    • 0.002 limerat_regkeys
    • 0.002 obliquerat_files
    • 0.002 sniffer_winpcap
    • 0.002 targeted_flame
    • 0.001 InjectionSetWindowLong
    • 0.001 antiemu_wine_func
    • 0.001 antivm_generic_scsi
    • 0.001 infostealer_browser_password
    • 0.001 injection_explorer
    • 0.001 kovter_behavior
    • 0.001 rat_nanocore
    • 0.001 stack_pivot
    • 0.001 tinba_behavior
    • 0.001 antisandbox_cuckoo_files
    • 0.001 antisandbox_fortinet_files
    • 0.001 antisandbox_joe_anubis_files
    • 0.001 antisandbox_sunbelt_files
    • 0.001 antisandbox_threattrack_files
    • 0.001 antivm_xen_keys
    • 0.001 antivm_generic_bios
    • 0.001 antivm_generic_system
    • 0.001 antivm_hyperv_keys
    • 0.001 antivm_vpc_files
    • 0.001 banker_cridex
    • 0.001 browser_security
    • 0.001 darkcomet_regkeys
    • 0.001 disables_browser_warn
    • 0.001 network_dns_opennic
    • 0.001 network_tor_service
    • 0.001 medusalocker_regkeys
    • 0.001 revil_mutexes
    • 0.001 dcrat_files
    • 0.001 warzonerat_files
    • 0.001 warzonerat_regkeys
    • 0.001 recon_fingerprint
    • 0.001 remcos_files
    • 0.001 remcos_regkeys

    Reporting ( 3.327 seconds )

    • 3.039 BinGraph
    • 0.28 MITRE_TTPS
    • 0.008 PCAP2CERT