Detections

Yara:

AgentTeslaV2

Analysis

Category Package Started Completed Duration Options Log
FILE exe 2020-06-30 05:19:29 2020-06-30 05:24:30 301 seconds Show Options Show Log
route = tor
2020-05-13 09:13:30,688 [root] INFO: Date set to: 20200630T05:19:27, timeout set to: 200
2020-06-30 05:19:27,046 [root] DEBUG: Starting analyzer from: C:\tmpq_mrpfl7
2020-06-30 05:19:27,046 [root] DEBUG: Storing results at: C:\OguFmUuD
2020-06-30 05:19:27,046 [root] DEBUG: Pipe server name: \\.\PIPE\WTwZZn
2020-06-30 05:19:27,046 [root] DEBUG: Python path: C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32
2020-06-30 05:19:27,046 [root] DEBUG: No analysis package specified, trying to detect it automagically.
2020-06-30 05:19:27,062 [root] INFO: Automatically selected analysis package "exe"
2020-06-30 05:19:27,062 [root] DEBUG: Trying to import analysis package "exe"...
2020-06-30 05:19:27,062 [root] DEBUG: Imported analysis package "exe".
2020-06-30 05:19:27,062 [root] DEBUG: Trying to initialize analysis package "exe"...
2020-06-30 05:19:27,062 [root] DEBUG: Initialized analysis package "exe".
2020-06-30 05:19:27,093 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.browser"...
2020-06-30 05:19:27,109 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser".
2020-06-30 05:19:27,109 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.curtain"...
2020-06-30 05:19:27,171 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain".
2020-06-30 05:19:27,171 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.digisig"...
2020-06-30 05:19:27,234 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig".
2020-06-30 05:19:27,249 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.disguise"...
2020-06-30 05:19:27,328 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise".
2020-06-30 05:19:27,328 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.human"...
2020-06-30 05:19:27,343 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human".
2020-06-30 05:19:27,343 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.procmon"...
2020-06-30 05:19:27,343 [root] DEBUG: Imported auxiliary module "modules.auxiliary.procmon".
2020-06-30 05:19:27,359 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.screenshots"...
2020-06-30 05:19:27,375 [modules.auxiliary.screenshots] DEBUG: Importing 'time'
2020-06-30 05:19:27,375 [modules.auxiliary.screenshots] DEBUG: Importing 'StringIO'
2020-06-30 05:19:27,375 [modules.auxiliary.screenshots] DEBUG: Importing 'Thread'
2020-06-30 05:19:27,375 [modules.auxiliary.screenshots] DEBUG: Importing 'Auxiliary'
2020-06-30 05:19:27,375 [modules.auxiliary.screenshots] DEBUG: Importing 'NetlogFile'
2020-06-30 05:19:27,375 [modules.auxiliary.screenshots] DEBUG: Importing 'Screenshot'
2020-06-30 05:19:27,390 [lib.api.screenshot] DEBUG: Importing 'math'
2020-06-30 05:19:27,390 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2020-06-30 05:19:27,515 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2020-06-30 05:19:27,515 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2020-06-30 05:19:27,546 [modules.auxiliary.screenshots] DEBUG: Imports OK
2020-06-30 05:19:27,546 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots".
2020-06-30 05:19:27,546 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.sysmon"...
2020-06-30 05:19:27,546 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon".
2020-06-30 05:19:27,546 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.usage"...
2020-06-30 05:19:27,578 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage".
2020-06-30 05:19:27,578 [root] DEBUG: Trying to initialize auxiliary module "Browser"...
2020-06-30 05:19:27,578 [root] DEBUG: Initialized auxiliary module "Browser".
2020-06-30 05:19:27,578 [root] DEBUG: Trying to start auxiliary module "Browser"...
2020-06-30 05:19:27,578 [root] DEBUG: Started auxiliary module Browser
2020-06-30 05:19:27,578 [root] DEBUG: Trying to initialize auxiliary module "Curtain"...
2020-06-30 05:19:27,578 [root] DEBUG: Initialized auxiliary module "Curtain".
2020-06-30 05:19:27,578 [root] DEBUG: Trying to start auxiliary module "Curtain"...
2020-06-30 05:19:27,578 [root] DEBUG: Started auxiliary module Curtain
2020-06-30 05:19:27,578 [root] DEBUG: Trying to initialize auxiliary module "DigiSig"...
2020-06-30 05:19:27,578 [root] DEBUG: Initialized auxiliary module "DigiSig".
2020-06-30 05:19:27,578 [root] DEBUG: Trying to start auxiliary module "DigiSig"...
2020-06-30 05:19:27,578 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature.
2020-06-30 05:19:27,765 [modules.auxiliary.digisig] DEBUG: File is not signed.
2020-06-30 05:19:27,765 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2020-06-30 05:19:27,781 [root] DEBUG: Started auxiliary module DigiSig
2020-06-30 05:19:27,781 [root] DEBUG: Trying to initialize auxiliary module "Disguise"...
2020-06-30 05:19:27,781 [root] DEBUG: Initialized auxiliary module "Disguise".
2020-06-30 05:19:27,781 [root] DEBUG: Trying to start auxiliary module "Disguise"...
2020-06-30 05:19:27,812 [root] DEBUG: Started auxiliary module Disguise
2020-06-30 05:19:27,812 [root] DEBUG: Trying to initialize auxiliary module "Human"...
2020-06-30 05:19:27,812 [root] DEBUG: Initialized auxiliary module "Human".
2020-06-30 05:19:27,812 [root] DEBUG: Trying to start auxiliary module "Human"...
2020-06-30 05:19:27,828 [root] DEBUG: Started auxiliary module Human
2020-06-30 05:19:27,828 [root] DEBUG: Trying to initialize auxiliary module "Procmon"...
2020-06-30 05:19:27,828 [root] DEBUG: Initialized auxiliary module "Procmon".
2020-06-30 05:19:27,828 [root] DEBUG: Trying to start auxiliary module "Procmon"...
2020-06-30 05:19:27,828 [root] DEBUG: Started auxiliary module Procmon
2020-06-30 05:19:27,843 [root] DEBUG: Trying to initialize auxiliary module "Screenshots"...
2020-06-30 05:19:27,843 [root] DEBUG: Initialized auxiliary module "Screenshots".
2020-06-30 05:19:27,843 [root] DEBUG: Trying to start auxiliary module "Screenshots"...
2020-06-30 05:19:27,843 [root] DEBUG: Started auxiliary module Screenshots
2020-06-30 05:19:27,843 [root] DEBUG: Trying to initialize auxiliary module "Sysmon"...
2020-06-30 05:19:27,843 [root] DEBUG: Initialized auxiliary module "Sysmon".
2020-06-30 05:19:27,843 [root] DEBUG: Trying to start auxiliary module "Sysmon"...
2020-06-30 05:19:27,843 [root] DEBUG: Started auxiliary module Sysmon
2020-06-30 05:19:27,843 [root] DEBUG: Trying to initialize auxiliary module "Usage"...
2020-06-30 05:19:27,843 [root] DEBUG: Initialized auxiliary module "Usage".
2020-06-30 05:19:27,843 [root] DEBUG: Trying to start auxiliary module "Usage"...
2020-06-30 05:19:27,843 [root] DEBUG: Started auxiliary module Usage
2020-06-30 05:19:27,843 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL option
2020-06-30 05:19:27,843 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL_64 option
2020-06-30 05:19:27,859 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option
2020-06-30 05:19:27,859 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option
2020-06-30 05:19:27,921 [lib.api.process] INFO: Successfully executed process from path "C:\Users\Rebecca\AppData\Local\Temp\payment.exe" with arguments "" with pid 5092
2020-06-30 05:19:27,937 [lib.api.process] INFO: Monitor config for process 5092: C:\tmpq_mrpfl7\dll\5092.ini
2020-06-30 05:19:27,937 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpq_mrpfl7\dll\lDrinxqX.dll, loader C:\tmpq_mrpfl7\bin\flSPpxj.exe
2020-06-30 05:19:27,968 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WTwZZn.
2020-06-30 05:19:27,984 [root] DEBUG: Loader: Injecting process 5092 (thread 3340) with C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:28,000 [root] DEBUG: Process image base: 0x01350000
2020-06-30 05:19:28,000 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 05:19:28,000 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 05:19:28,000 [root] DEBUG: Successfully injected DLL C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:28,000 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 5092
2020-06-30 05:19:30,000 [lib.api.process] INFO: Successfully resumed process with pid 5092
2020-06-30 05:19:30,062 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 05:19:30,062 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 05:19:30,078 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 5092 at 0x6b650000, image base 0x1350000, stack from 0x215000-0x220000
2020-06-30 05:19:30,078 [root] DEBUG: Commandline: C:\Users\Rebecca\AppData\Local\Temp\"C:\Users\Rebecca\AppData\Local\Temp\payment.exe".
2020-06-30 05:19:30,093 [root] INFO: Loaded monitor into process with pid 5092
2020-06-30 05:19:30,109 [root] DEBUG: set_caller_info: Adding region at 0x00120000 to caller regions list (advapi32::RegQueryInfoKeyW).
2020-06-30 05:19:30,109 [root] DEBUG: set_caller_info: Adding region at 0x01430000 to caller regions list (ntdll::RtlDispatchException).
2020-06-30 05:19:30,125 [root] DEBUG: DLL loaded at 0x75B30000: C:\Windows\system32\cryptbase (0xc000 bytes).
2020-06-30 05:19:30,125 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x1430000
2020-06-30 05:19:30,171 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x01430000 size 0x400000.
2020-06-30 05:19:30,171 [root] DEBUG: DumpPEsInRange: Scanning range 0x1430000 - 0x1431000.
2020-06-30 05:19:30,187 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x1430000-0x1431000.
2020-06-30 05:19:30,234 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\OguFmUuD\CAPE\5092_9369521543039530262020 (size 0xfc8)
2020-06-30 05:19:30,249 [root] DEBUG: DumpRegion: Dumped stack region from 0x01430000, size 0x1000.
2020-06-30 05:19:30,249 [root] DEBUG: set_caller_info: Failed to dumping calling PE image at 0x00120000.
2020-06-30 05:19:30,249 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xbc amd local view 0x71720000 to global list.
2020-06-30 05:19:30,249 [root] DEBUG: DLL loaded at 0x71720000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x7d000 bytes).
2020-06-30 05:19:30,265 [root] DEBUG: DLL unloaded from 0x76A30000.
2020-06-30 05:19:30,281 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xd0 amd local view 0x004B0000 to global list.
2020-06-30 05:19:30,281 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xcc amd local view 0x004B0000 to global list.
2020-06-30 05:19:30,296 [root] DEBUG: DLL loaded at 0x750B0000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-30 05:19:30,296 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6A530000 for section view with handle 0xd0.
2020-06-30 05:19:30,296 [root] DEBUG: DLL loaded at 0x6A530000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr (0x6ef000 bytes).
2020-06-30 05:19:30,312 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6C1F0000 for section view with handle 0xd0.
2020-06-30 05:19:30,328 [root] DEBUG: DLL loaded at 0x6C1F0000: C:\Windows\system32\MSVCR120_CLR0400 (0xf5000 bytes).
2020-06-30 05:19:30,343 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 5092, handle 0xf0.
2020-06-30 05:19:30,343 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xf4 amd local view 0x00100000 to global list.
2020-06-30 05:19:30,343 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xf8 amd local view 0x00110000 to global list.
2020-06-30 05:19:30,343 [root] INFO: Disabling sleep skipping.
2020-06-30 05:19:30,359 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 5092.
2020-06-30 05:19:30,359 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 5092.
2020-06-30 05:19:30,375 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 5092.
2020-06-30 05:19:30,375 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1e0 amd local view 0x05890000 to global list.
2020-06-30 05:19:30,406 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1e4 amd local view 0x66A40000 to global list.
2020-06-30 05:19:30,421 [root] DEBUG: DLL loaded at 0x66A40000: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni (0x1393000 bytes).
2020-06-30 05:19:30,437 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x200 amd local view 0x6B5D0000 to global list.
2020-06-30 05:19:30,453 [root] DEBUG: DLL loaded at 0x6B5D0000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit (0x80000 bytes).
2020-06-30 05:19:30,453 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1fc amd local view 0x76500000 to global list.
2020-06-30 05:19:30,453 [root] DEBUG: DLL loaded at 0x76500000: C:\Windows\system32\OLEAUT32 (0x91000 bytes).
2020-06-30 05:19:30,500 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x214 amd local view 0x65690000 to global list.
2020-06-30 05:19:30,500 [root] DEBUG: DLL loaded at 0x65690000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni (0xa10000 bytes).
2020-06-30 05:19:30,515 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6B250000 for section view with handle 0x214.
2020-06-30 05:19:30,515 [root] DEBUG: DLL loaded at 0x6B250000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni (0x194000 bytes).
2020-06-30 05:19:30,531 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x210 amd local view 0x64970000 to global list.
2020-06-30 05:19:30,531 [root] DEBUG: DLL loaded at 0x64970000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni (0xd1d000 bytes).
2020-06-30 05:19:30,546 [root] DEBUG: set_caller_info: Adding region at 0x002A0000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-06-30 05:19:30,562 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x2affff
2020-06-30 05:19:30,562 [root] DEBUG: DumpMemory: Nothing to dump at 0x002A0000!
2020-06-30 05:19:30,562 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x002A0000 size 0x10000.
2020-06-30 05:19:30,562 [root] DEBUG: DumpPEsInRange: Scanning range 0x2a0000 - 0x2a1000.
2020-06-30 05:19:30,593 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\OguFmUuD\CAPE\5092_1907904445039530262020 (size 0x474)
2020-06-30 05:19:30,593 [root] DEBUG: DumpRegion: Dumped stack region from 0x002A0000, size 0x1000.
2020-06-30 05:19:30,609 [root] DEBUG: DLL loaded at 0x74790000: C:\Windows\system32\uxtheme (0x40000 bytes).
2020-06-30 05:19:30,609 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x220 amd local view 0x682F0000 to global list.
2020-06-30 05:19:30,640 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x228 amd local view 0x68010000 to global list.
2020-06-30 05:19:30,656 [root] DEBUG: DLL loaded at 0x68010000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni (0x7e0000 bytes).
2020-06-30 05:19:30,656 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x224 amd local view 0x6B150000 to global list.
2020-06-30 05:19:30,656 [root] DEBUG: DLL loaded at 0x6B150000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2f61c87db96dbe27deea0e525a665761\System.Configuration.ni (0xfc000 bytes).
2020-06-30 05:19:30,671 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x21c amd local view 0x6F470000 to global list.
2020-06-30 05:19:30,671 [root] DEBUG: DLL loaded at 0x6F470000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting (0x13000 bytes).
2020-06-30 05:19:30,671 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x05D70000 for section view with handle 0x21c.
2020-06-30 05:19:30,687 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x66300000 for section view with handle 0x224.
2020-06-30 05:19:30,687 [root] DEBUG: DLL loaded at 0x66300000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\a3abb36b9f9e867b09bb3a670b074c45\System.Xml.ni (0x73e000 bytes).
2020-06-30 05:19:30,703 [root] DEBUG: DLL loaded at 0x76AE0000: C:\Windows\system32\shell32 (0xc4c000 bytes).
2020-06-30 05:19:30,703 [root] DEBUG: DLL loaded at 0x75BE0000: C:\Windows\system32\profapi (0xb000 bytes).
2020-06-30 05:19:30,718 [root] DEBUG: set_caller_info: Adding region at 0x00230000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-06-30 05:19:30,718 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x23ffff
2020-06-30 05:19:30,718 [root] DEBUG: DumpMemory: Nothing to dump at 0x00230000!
2020-06-30 05:19:30,718 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00230000 size 0x10000.
2020-06-30 05:19:30,734 [root] DEBUG: DumpPEsInRange: Scanning range 0x230000 - 0x231000.
2020-06-30 05:19:30,734 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x230000-0x231000.
2020-06-30 05:19:30,765 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\OguFmUuD\CAPE\5092_1343286585039530262020 (size 0x14)
2020-06-30 05:19:30,765 [root] DEBUG: DumpRegion: Dumped stack region from 0x00230000, size 0x1000.
2020-06-30 05:19:30,781 [root] DEBUG: DLL loaded at 0x75750000: C:\Windows\system32\bcrypt (0x17000 bytes).
2020-06-30 05:19:30,781 [root] DEBUG: DLL loaded at 0x75600000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-06-30 05:19:30,796 [root] DEBUG: DLL loaded at 0x75390000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-06-30 05:19:30,812 [root] DEBUG: DLL loaded at 0x66130000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32 (0x84000 bytes).
2020-06-30 05:19:30,828 [root] DEBUG: set_caller_info: Adding region at 0x00240000 to caller regions list (ntdll::LdrGetProcedureAddress).
2020-06-30 05:19:30,828 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x24ffff
2020-06-30 05:19:30,828 [root] DEBUG: DumpMemory: Nothing to dump at 0x00240000!
2020-06-30 05:19:30,828 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00240000 size 0x10000.
2020-06-30 05:19:30,859 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\OguFmUuD\CAPE\5092_17199775525039530262020 (size 0x93f3)
2020-06-30 05:19:30,859 [root] DEBUG: DumpRegion: Dumped stack region from 0x00240000, size 0xa000.
2020-06-30 05:19:31,421 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x26c amd local view 0x74560000 to global list.
2020-06-30 05:19:31,421 [root] DEBUG: DLL loaded at 0x74560000: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\gdiplus (0x192000 bytes).
2020-06-30 05:19:31,437 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x27c amd local view 0x004C0000 to global list.
2020-06-30 05:19:31,453 [root] INFO: Added new file to list with pid None and path C:\Users\Rebecca\AppData\Local\GDIPFONTCACHEV1.DAT
2020-06-30 05:19:31,453 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x278 amd local view 0x004C0000 to global list.
2020-06-30 05:19:31,468 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x288 amd local view 0x004D0000 to global list.
2020-06-30 05:19:31,484 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x05490000 for section view with handle 0x288.
2020-06-30 05:19:31,500 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x02EB0000 for section view with handle 0x288.
2020-06-30 05:19:31,515 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x05490000 for section view with handle 0x288.
2020-06-30 05:19:31,546 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x02EB0000 for section view with handle 0x288.
2020-06-30 05:19:31,562 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x06260000 for section view with handle 0x288.
2020-06-30 05:19:31,640 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x05490000 for section view with handle 0x288.
2020-06-30 05:19:31,671 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x02EB0000 for section view with handle 0x288.
2020-06-30 05:19:31,687 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x05490000 for section view with handle 0x288.
2020-06-30 05:19:31,718 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x02EB0000 for section view with handle 0x288.
2020-06-30 05:19:31,734 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:31,796 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x01310000 for section view with handle 0x288.
2020-06-30 05:19:31,828 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x013D0000 for section view with handle 0x288.
2020-06-30 05:19:31,859 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x06260000 for section view with handle 0x288.
2020-06-30 05:19:31,953 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:31,968 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x02EB0000 for section view with handle 0x288.
2020-06-30 05:19:31,984 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x013D0000 for section view with handle 0x288.
2020-06-30 05:19:31,984 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x01310000 for section view with handle 0x288.
2020-06-30 05:19:32,015 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:32,046 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x013D0000 for section view with handle 0x288.
2020-06-30 05:19:32,078 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:32,218 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x06260000 for section view with handle 0x288.
2020-06-30 05:19:32,296 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x01310000 for section view with handle 0x288.
2020-06-30 05:19:32,328 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:32,343 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x06260000 for section view with handle 0x288.
2020-06-30 05:19:32,562 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x02EB0000 for section view with handle 0x288.
2020-06-30 05:19:32,578 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x07FF0000 for section view with handle 0x288.
2020-06-30 05:19:32,625 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x06260000 for section view with handle 0x288.
2020-06-30 05:19:32,671 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x07FF0000 for section view with handle 0x288.
2020-06-30 05:19:32,718 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x06260000 for section view with handle 0x288.
2020-06-30 05:19:32,765 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x07FF0000 for section view with handle 0x288.
2020-06-30 05:19:32,890 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x013D0000 for section view with handle 0x288.
2020-06-30 05:19:32,906 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x06260000 for section view with handle 0x288.
2020-06-30 05:19:32,968 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:33,000 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x02EB0000 for section view with handle 0x288.
2020-06-30 05:19:33,031 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:33,156 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x02EB0000 for section view with handle 0x288.
2020-06-30 05:19:33,249 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x013D0000 for section view with handle 0x288.
2020-06-30 05:19:33,265 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x02EB0000 for section view with handle 0x288.
2020-06-30 05:19:33,296 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x013D0000 for section view with handle 0x288.
2020-06-30 05:19:33,296 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x05B60000 for section view with handle 0x288.
2020-06-30 05:19:33,328 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x013D0000 for section view with handle 0x288.
2020-06-30 05:19:33,343 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x01310000 for section view with handle 0x288.
2020-06-30 05:19:33,359 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x06260000 for section view with handle 0x288.
2020-06-30 05:19:33,437 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x01310000 for section view with handle 0x288.
2020-06-30 05:19:33,437 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:33,468 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x05B60000 for section view with handle 0x288.
2020-06-30 05:19:33,484 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x05490000 for section view with handle 0x288.
2020-06-30 05:19:33,484 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x05B60000 for section view with handle 0x288.
2020-06-30 05:19:33,578 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x02EB0000 for section view with handle 0x288.
2020-06-30 05:19:33,593 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:33,625 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x01310000 for section view with handle 0x288.
2020-06-30 05:19:33,640 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x013D0000 for section view with handle 0x288.
2020-06-30 05:19:33,687 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x05490000 for section view with handle 0x288.
2020-06-30 05:19:33,687 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x02EB0000 for section view with handle 0x288.
2020-06-30 05:19:33,718 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:33,750 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x01310000 for section view with handle 0x288.
2020-06-30 05:19:33,796 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:33,843 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x013D0000 for section view with handle 0x288.
2020-06-30 05:19:33,875 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:33,890 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x01310000 for section view with handle 0x288.
2020-06-30 05:19:33,937 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:33,968 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x01310000 for section view with handle 0x288.
2020-06-30 05:19:34,000 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x013D0000 for section view with handle 0x288.
2020-06-30 05:19:34,015 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:34,031 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x01310000 for section view with handle 0x288.
2020-06-30 05:19:34,093 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:34,171 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x02EB0000 for section view with handle 0x288.
2020-06-30 05:19:34,187 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:34,234 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x013D0000 for section view with handle 0x288.
2020-06-30 05:19:34,296 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:34,453 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x06260000 for section view with handle 0x288.
2020-06-30 05:19:34,546 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:35,140 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x06260000 for section view with handle 0x288.
2020-06-30 05:19:35,218 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x013D0000 for section view with handle 0x288.
2020-06-30 05:19:35,234 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:35,234 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x05B60000 for section view with handle 0x288.
2020-06-30 05:19:35,296 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:35,343 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x05B60000 for section view with handle 0x288.
2020-06-30 05:19:35,406 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:35,453 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x02EB0000 for section view with handle 0x288.
2020-06-30 05:19:35,500 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x013D0000 for section view with handle 0x288.
2020-06-30 05:19:35,515 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:35,671 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x05B60000 for section view with handle 0x288.
2020-06-30 05:19:35,703 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x05490000 for section view with handle 0x288.
2020-06-30 05:19:35,796 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:36,625 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x01310000 for section view with handle 0x288.
2020-06-30 05:19:36,656 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:37,890 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x01310000 for section view with handle 0x288.
2020-06-30 05:19:37,921 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:37,953 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x05B60000 for section view with handle 0x288.
2020-06-30 05:19:38,062 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:38,484 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x02EB0000 for section view with handle 0x288.
2020-06-30 05:19:38,500 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:38,687 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x08FC0000 for section view with handle 0x288.
2020-06-30 05:19:38,750 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x06340000 for section view with handle 0x288.
2020-06-30 05:19:38,796 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x08FC0000 for section view with handle 0x288.
2020-06-30 05:19:38,843 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x06340000 for section view with handle 0x288.
2020-06-30 05:19:38,890 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x08FC0000 for section view with handle 0x288.
2020-06-30 05:19:38,937 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:38,968 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x05B60000 for section view with handle 0x288.
2020-06-30 05:19:39,000 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x01310000 for section view with handle 0x288.
2020-06-30 05:19:39,015 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x013D0000 for section view with handle 0x288.
2020-06-30 05:19:39,031 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x02EB0000 for section view with handle 0x288.
2020-06-30 05:19:39,046 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x01310000 for section view with handle 0x288.
2020-06-30 05:19:39,078 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:39,109 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x01310000 for section view with handle 0x288.
2020-06-30 05:19:39,125 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:39,171 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x05B60000 for section view with handle 0x288.
2020-06-30 05:19:39,265 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x01310000 for section view with handle 0x288.
2020-06-30 05:19:39,296 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x013D0000 for section view with handle 0x288.
2020-06-30 05:19:39,359 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x02EB0000 for section view with handle 0x288.
2020-06-30 05:19:39,406 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x013D0000 for section view with handle 0x288.
2020-06-30 05:19:39,453 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:39,468 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x01310000 for section view with handle 0x288.
2020-06-30 05:19:39,484 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:39,500 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x01310000 for section view with handle 0x288.
2020-06-30 05:19:39,515 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x288.
2020-06-30 05:19:39,656 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x64790000 for section view with handle 0x27c.
2020-06-30 05:19:39,656 [root] DEBUG: DLL loaded at 0x64790000: C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni (0x1d1000 bytes).
2020-06-30 05:19:39,750 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x02EB0000 for section view with handle 0x27c.
2020-06-30 05:19:39,781 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x27c.
2020-06-30 05:19:49,890 [root] DEBUG: DLL loaded at 0x73E10000: C:\Windows\system32\WindowsCodecs (0x131000 bytes).
2020-06-30 05:19:49,906 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x28c amd local view 0x01310000 to global list.
2020-06-30 05:19:49,906 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x01320000 for section view with handle 0x28c.
2020-06-30 05:19:49,906 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x01330000 for section view with handle 0x28c.
2020-06-30 05:19:50,109 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 5092.
2020-06-30 05:19:50,125 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 5092.
2020-06-30 05:19:50,187 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x2a4 amd local view 0x013D0000 to global list.
2020-06-30 05:19:50,281 [root] INFO: Added new file to list with pid None and path C:\Users\Rebecca\AppData\Roaming\SPjfKyKDmOO.exe
2020-06-30 05:19:50,296 [root] INFO: Added new file to list with pid None and path C:\Users\Rebecca\AppData\Local\Temp\tmp3B3.tmp
2020-06-30 05:19:50,312 [root] DEBUG: DLL loaded at 0x747E0000: C:\Windows\system32\PROPSYS (0xf5000 bytes).
2020-06-30 05:19:50,312 [root] DEBUG: DLL loaded at 0x74AC0000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32 (0x19e000 bytes).
2020-06-30 05:19:50,328 [root] DEBUG: DLL loaded at 0x75AE0000: C:\Windows\system32\apphelp (0x4c000 bytes).
2020-06-30 05:19:50,328 [root] DEBUG: DLL loaded at 0x76010000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2020-06-30 05:19:50,343 [root] DEBUG: DLL loaded at 0x6C300000: C:\Windows\System32\ieframe (0xaba000 bytes).
2020-06-30 05:19:50,343 [root] DEBUG: DLL loaded at 0x75CE0000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes).
2020-06-30 05:19:50,359 [root] DEBUG: DLL loaded at 0x75CD0000: C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0 (0x4000 bytes).
2020-06-30 05:19:50,359 [root] DEBUG: DLL loaded at 0x75C80000: C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes).
2020-06-30 05:19:50,359 [root] DEBUG: DLL loaded at 0x6C2F0000: C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0 (0x4000 bytes).
2020-06-30 05:19:50,359 [root] DEBUG: DLL loaded at 0x75CC0000: C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes).
2020-06-30 05:19:50,375 [root] DEBUG: DLL loaded at 0x75C60000: C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes).
2020-06-30 05:19:50,375 [root] DEBUG: DLL loaded at 0x75F50000: C:\Windows\system32\normaliz (0x3000 bytes).
2020-06-30 05:19:50,375 [root] DEBUG: DLL loaded at 0x779D0000: C:\Windows\system32\iertutil (0x215000 bytes).
2020-06-30 05:19:50,406 [root] DEBUG: DLL loaded at 0x77830000: C:\Windows\system32\SETUPAPI (0x19d000 bytes).
2020-06-30 05:19:50,437 [root] DEBUG: DLL loaded at 0x75C90000: C:\Windows\system32\CFGMGR32 (0x27000 bytes).
2020-06-30 05:19:50,437 [root] DEBUG: DLL loaded at 0x75CF0000: C:\Windows\system32\DEVOBJ (0x12000 bytes).
2020-06-30 05:19:50,453 [root] DEBUG: DLL loaded at 0x74900000: C:\Windows\system32\ntmarta (0x21000 bytes).
2020-06-30 05:19:50,453 [root] DEBUG: DLL loaded at 0x761A0000: C:\Windows\system32\WLDAP32 (0x45000 bytes).
2020-06-30 05:19:50,468 [root] DEBUG: DLL unloaded from 0x76AE0000.
2020-06-30 05:19:50,468 [root] DEBUG: DLL loaded at 0x761F0000: C:\Windows\system32\urlmon (0x124000 bytes).
2020-06-30 05:19:50,484 [root] DEBUG: DLL loaded at 0x75C70000: C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0 (0x4000 bytes).
2020-06-30 05:19:50,484 [root] DEBUG: DLL loaded at 0x76790000: C:\Windows\system32\WININET (0x1c4000 bytes).
2020-06-30 05:19:50,500 [root] DEBUG: DLL loaded at 0x758C0000: C:\Windows\system32\Secur32 (0x8000 bytes).
2020-06-30 05:19:50,515 [root] INFO: Announced 32-bit process name: schtasks.exe pid: 6108
2020-06-30 05:19:50,515 [lib.api.process] INFO: Monitor config for process 6108: C:\tmpq_mrpfl7\dll\6108.ini
2020-06-30 05:19:50,515 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpq_mrpfl7\dll\lDrinxqX.dll, loader C:\tmpq_mrpfl7\bin\flSPpxj.exe
2020-06-30 05:19:50,546 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WTwZZn.
2020-06-30 05:19:50,546 [root] DEBUG: Loader: Injecting process 6108 (thread 4280) with C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:50,562 [root] DEBUG: Process image base: 0x001A0000
2020-06-30 05:19:50,562 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:50,562 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-30 05:19:50,562 [root] DEBUG: Successfully injected DLL C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:50,562 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 6108
2020-06-30 05:19:50,578 [root] DEBUG: CreateProcessHandler: Injection info set for new process 6108, ImageBase: 0x001A0000
2020-06-30 05:19:50,578 [root] INFO: Announced 32-bit process name: schtasks.exe pid: 6108
2020-06-30 05:19:50,578 [lib.api.process] INFO: Monitor config for process 6108: C:\tmpq_mrpfl7\dll\6108.ini
2020-06-30 05:19:50,578 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpq_mrpfl7\dll\lDrinxqX.dll, loader C:\tmpq_mrpfl7\bin\flSPpxj.exe
2020-06-30 05:19:50,593 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WTwZZn.
2020-06-30 05:19:50,593 [root] DEBUG: Loader: Injecting process 6108 (thread 4280) with C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:50,593 [root] DEBUG: Process image base: 0x001A0000
2020-06-30 05:19:50,593 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:50,593 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-06-30 05:19:50,593 [root] DEBUG: Successfully injected DLL C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:50,609 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 6108
2020-06-30 05:19:50,625 [root] DEBUG: DLL loaded at 0x75BD0000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-06-30 05:19:50,656 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 05:19:50,656 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 05:19:50,671 [root] INFO: Disabling sleep skipping.
2020-06-30 05:19:50,671 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-30 05:19:50,687 [root] INFO: Loaded monitor into process with pid 6108
2020-06-30 05:19:50,703 [root] DEBUG: DLL loaded at 0x750B0000: C:\Windows\System32\VERSION (0x9000 bytes).
2020-06-30 05:19:50,703 [root] DEBUG: DLL unloaded from 0x001A0000.
2020-06-30 05:19:50,703 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xc4 amd local view 0x02710000 to global list.
2020-06-30 05:19:50,718 [root] DEBUG: DLL loaded at 0x75B30000: C:\Windows\System32\CRYPTBASE (0xc000 bytes).
2020-06-30 05:19:50,718 [root] DEBUG: ResumeThreadHandler: CurrentInjectionInfo 0x0 (Pid 6108).
2020-06-30 05:19:50,734 [root] INFO: Stopping Task Scheduler Service
2020-06-30 05:19:50,843 [root] INFO: Stopped Task Scheduler Service
2020-06-30 05:19:50,875 [root] INFO: Starting Task Scheduler Service
2020-06-30 05:19:50,937 [root] INFO: Started Task Scheduler Service
2020-06-30 05:19:50,937 [lib.api.process] INFO: Monitor config for process 844: C:\tmpq_mrpfl7\dll\844.ini
2020-06-30 05:19:50,937 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpq_mrpfl7\dll\lDrinxqX.dll, loader C:\tmpq_mrpfl7\bin\flSPpxj.exe
2020-06-30 05:19:50,953 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WTwZZn.
2020-06-30 05:19:50,953 [root] DEBUG: Loader: Injecting process 844 (thread 0) with C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:50,953 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 05:19:50,953 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2020-06-30 05:19:50,968 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 05:19:50,968 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 05:19:50,984 [root] INFO: Disabling sleep skipping.
2020-06-30 05:19:50,984 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 844 at 0x6b650000, image base 0x3c0000, stack from 0xbb6000-0xbc0000
2020-06-30 05:19:50,984 [root] DEBUG: Commandline: C:\Windows\System32\svchost.exe -k netsvcs.
2020-06-30 05:19:51,000 [root] INFO: Loaded monitor into process with pid 844
2020-06-30 05:19:51,000 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-30 05:19:51,000 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-30 05:19:51,000 [root] DEBUG: Successfully injected DLL C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:53,000 [root] DEBUG: DLL loaded at 0x76010000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2020-06-30 05:19:53,000 [root] DEBUG: DLL loaded at 0x742F0000: C:\Windows\system32\taskschd (0x7d000 bytes).
2020-06-30 05:19:53,546 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 6108
2020-06-30 05:19:53,546 [root] DEBUG: GetHookCallerBase: thread 4280 (handle 0x0), return address 0x001B7569, allocation base 0x001A0000.
2020-06-30 05:19:53,546 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x001A0000.
2020-06-30 05:19:53,546 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x001A0000.
2020-06-30 05:19:53,546 [root] DEBUG: DumpProcess: Module entry point VA is 0x00017683.
2020-06-30 05:19:53,593 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x2b400.
2020-06-30 05:19:53,593 [root] DEBUG: DLL unloaded from 0x76730000.
2020-06-30 05:19:53,625 [root] INFO: Process with pid 6108 has terminated
2020-06-30 05:19:53,765 [root] INFO: Announced 32-bit process name: payment.exe pid: 3020
2020-06-30 05:19:53,781 [lib.api.process] INFO: Monitor config for process 3020: C:\tmpq_mrpfl7\dll\3020.ini
2020-06-30 05:19:53,812 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpq_mrpfl7\dll\lDrinxqX.dll, loader C:\tmpq_mrpfl7\bin\flSPpxj.exe
2020-06-30 05:19:53,828 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WTwZZn.
2020-06-30 05:19:53,859 [root] DEBUG: Loader: Injecting process 3020 (thread 4448) with C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:53,859 [root] DEBUG: Process image base: 0x01350000
2020-06-30 05:19:53,859 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 05:19:53,890 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 05:19:53,921 [root] DEBUG: Successfully injected DLL C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:53,937 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3020
2020-06-30 05:19:53,968 [root] DEBUG: CreateProcessHandler: Injection info set for new process 3020, ImageBase: 0x01350000
2020-06-30 05:19:53,984 [root] INFO: Announced 32-bit process name: payment.exe pid: 3020
2020-06-30 05:19:53,984 [lib.api.process] INFO: Monitor config for process 3020: C:\tmpq_mrpfl7\dll\3020.ini
2020-06-30 05:19:53,984 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpq_mrpfl7\dll\lDrinxqX.dll, loader C:\tmpq_mrpfl7\bin\flSPpxj.exe
2020-06-30 05:19:54,046 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WTwZZn.
2020-06-30 05:19:54,046 [root] DEBUG: Loader: Injecting process 3020 (thread 4448) with C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:54,046 [root] DEBUG: Process image base: 0x01350000
2020-06-30 05:19:54,046 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 05:19:54,062 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 05:19:54,062 [root] DEBUG: Successfully injected DLL C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:54,078 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3020
2020-06-30 05:19:54,093 [root] DEBUG: set_caller_info: Adding region at 0x02F20000 to caller regions list (kernel32::ReadProcessMemory).
2020-06-30 05:19:54,093 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x2f2ffff
2020-06-30 05:19:54,093 [root] DEBUG: DumpMemory: Nothing to dump at 0x02F20000!
2020-06-30 05:19:54,109 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x02F20000 size 0x10000.
2020-06-30 05:19:54,109 [root] DEBUG: DumpPEsInRange: Scanning range 0x2f20000 - 0x2f21000.
2020-06-30 05:19:54,109 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x2f20000-0x2f21000.
2020-06-30 05:19:54,187 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\OguFmUuD\CAPE\5092_10630710382741530262020 (size 0xf7)
2020-06-30 05:19:54,187 [root] DEBUG: DumpRegion: Dumped stack region from 0x02F20000, size 0x1000.
2020-06-30 05:19:54,203 [root] DEBUG: WriteMemoryHandler: Executable binary injected into process 3020 (ImageBase 0x400000)
2020-06-30 05:19:54,218 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-30 05:19:54,218 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x045BB9B0.
2020-06-30 05:19:54,390 [root] DEBUG: DumpPE: PE file in memory dumped successfully - dump size 0x44600.
2020-06-30 05:19:54,390 [root] DEBUG: WriteMemoryHandler: Dumped PE image from buffer at 0x45bb9b0, SizeOfImage 0x4a000.
2020-06-30 05:19:54,406 [root] INFO: Announced 32-bit process name: payment.exe pid: 3020
2020-06-30 05:19:54,406 [lib.api.process] INFO: Monitor config for process 3020: C:\tmpq_mrpfl7\dll\3020.ini
2020-06-30 05:19:54,406 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpq_mrpfl7\dll\lDrinxqX.dll, loader C:\tmpq_mrpfl7\bin\flSPpxj.exe
2020-06-30 05:19:54,421 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WTwZZn.
2020-06-30 05:19:54,437 [root] DEBUG: Loader: Injecting process 3020 (thread 0) with C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:54,437 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 05:19:54,437 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 05:19:54,437 [root] DEBUG: Failed to inject DLL C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:54,437 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 3020, error: 4294967281
2020-06-30 05:19:54,468 [root] DEBUG: WriteMemoryHandler: injection of section of PE image which has already been dumped.
2020-06-30 05:19:54,484 [root] INFO: Announced 32-bit process name: payment.exe pid: 3020
2020-06-30 05:19:54,500 [lib.api.process] INFO: Monitor config for process 3020: C:\tmpq_mrpfl7\dll\3020.ini
2020-06-30 05:19:54,500 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpq_mrpfl7\dll\lDrinxqX.dll, loader C:\tmpq_mrpfl7\bin\flSPpxj.exe
2020-06-30 05:19:54,515 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WTwZZn.
2020-06-30 05:19:54,515 [root] DEBUG: Loader: Injecting process 3020 (thread 0) with C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:54,515 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 05:19:54,531 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 05:19:54,546 [root] DEBUG: Failed to inject DLL C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:54,578 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 3020, error: 4294967281
2020-06-30 05:19:54,578 [root] DEBUG: WriteMemoryHandler: shellcode at 0x034B5990 (size 0x600) injected into process 3020.
2020-06-30 05:19:54,609 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\OguFmUuD\CAPE\5092_11431372162741530262020 (size 0x515)
2020-06-30 05:19:54,609 [root] DEBUG: WriteMemoryHandler: Dumped injected code/data from buffer.
2020-06-30 05:19:54,625 [root] INFO: Announced 32-bit process name: payment.exe pid: 3020
2020-06-30 05:19:54,671 [lib.api.process] INFO: Monitor config for process 3020: C:\tmpq_mrpfl7\dll\3020.ini
2020-06-30 05:19:54,687 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpq_mrpfl7\dll\lDrinxqX.dll, loader C:\tmpq_mrpfl7\bin\flSPpxj.exe
2020-06-30 05:19:54,687 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WTwZZn.
2020-06-30 05:19:54,703 [root] DEBUG: Loader: Injecting process 3020 (thread 0) with C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:54,703 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 05:19:54,703 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 05:19:54,703 [root] DEBUG: Failed to inject DLL C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:54,718 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 3020, error: 4294967281
2020-06-30 05:19:54,750 [root] DEBUG: WriteMemoryHandler: shellcode at 0x034B5F9C (size 0x200) injected into process 3020.
2020-06-30 05:19:54,859 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\OguFmUuD\CAPE\5092_21156198742741530262020 (size 0x9)
2020-06-30 05:19:54,875 [root] DEBUG: WriteMemoryHandler: Dumped injected code/data from buffer.
2020-06-30 05:19:54,875 [root] INFO: Announced 32-bit process name: payment.exe pid: 3020
2020-06-30 05:19:54,890 [lib.api.process] INFO: Monitor config for process 3020: C:\tmpq_mrpfl7\dll\3020.ini
2020-06-30 05:19:54,937 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpq_mrpfl7\dll\lDrinxqX.dll, loader C:\tmpq_mrpfl7\bin\flSPpxj.exe
2020-06-30 05:19:54,937 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WTwZZn.
2020-06-30 05:19:54,937 [root] DEBUG: Loader: Injecting process 3020 (thread 0) with C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:54,953 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 05:19:54,984 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 05:19:55,015 [root] DEBUG: Failed to inject DLL C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:55,015 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 3020, error: 4294967281
2020-06-30 05:19:55,015 [root] INFO: Announced 32-bit process name: payment.exe pid: 3020
2020-06-30 05:19:55,015 [lib.api.process] INFO: Monitor config for process 3020: C:\tmpq_mrpfl7\dll\3020.ini
2020-06-30 05:19:55,078 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpq_mrpfl7\dll\lDrinxqX.dll, loader C:\tmpq_mrpfl7\bin\flSPpxj.exe
2020-06-30 05:19:55,093 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WTwZZn.
2020-06-30 05:19:55,109 [root] DEBUG: Loader: Injecting process 3020 (thread 0) with C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:55,109 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 05:19:55,125 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 05:19:55,140 [root] DEBUG: Failed to inject DLL C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:55,140 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 3020, error: 4294967281
2020-06-30 05:19:55,140 [root] DEBUG: SetThreadContextHandler: Hollow process entry point reset via NtSetContextThread to 0x00045BEE (process 3020).
2020-06-30 05:19:55,156 [root] INFO: Announced 32-bit process name: payment.exe pid: 3020
2020-06-30 05:19:55,156 [lib.api.process] INFO: Monitor config for process 3020: C:\tmpq_mrpfl7\dll\3020.ini
2020-06-30 05:19:55,171 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpq_mrpfl7\dll\lDrinxqX.dll, loader C:\tmpq_mrpfl7\bin\flSPpxj.exe
2020-06-30 05:19:55,171 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WTwZZn.
2020-06-30 05:19:55,187 [root] DEBUG: Loader: Injecting process 3020 (thread 4448) with C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:55,187 [root] DEBUG: Process image base: 0x00400000
2020-06-30 05:19:55,203 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 05:19:55,203 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 05:19:55,203 [root] DEBUG: Successfully injected DLL C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:19:55,218 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3020
2020-06-30 05:19:55,218 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3020.
2020-06-30 05:19:55,234 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 05:19:55,234 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 5092
2020-06-30 05:19:55,249 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 05:19:55,249 [root] DEBUG: GetHookCallerBase: thread 3340 (handle 0x0), return address 0x002A38D0, allocation base 0x002A0000.
2020-06-30 05:19:55,281 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x01350000.
2020-06-30 05:19:55,281 [root] INFO: Disabling sleep skipping.
2020-06-30 05:19:55,281 [root] DEBUG: LooksLikeSectionBoundary: Exception occured reading around suspected boundary at 0x01352000
2020-06-30 05:19:55,296 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-30 05:19:55,296 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 3020 at 0x6b650000, image base 0x400000, stack from 0x186000-0x190000
2020-06-30 05:19:55,296 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x01350000.
2020-06-30 05:19:55,296 [root] DEBUG: Commandline: C:\Users\Rebecca\AppData\Local\Temp\"{path}".
2020-06-30 05:19:55,312 [root] INFO: Loaded monitor into process with pid 3020
2020-06-30 05:19:55,312 [root] DEBUG: DumpPE: Empty or inaccessible last section, file image seems incomplete (from 0x013BD000 to 0x013BD600).
2020-06-30 05:19:55,312 [root] DEBUG: set_caller_info: Adding region at 0x00070000 to caller regions list (ntdll::LdrLoadDll).
2020-06-30 05:19:55,343 [root] DEBUG: set_caller_info: Adding region at 0x008B0000 to caller regions list (kernel32::GetSystemTime).
2020-06-30 05:19:55,359 [root] DEBUG: DLL loaded at 0x75B30000: C:\Windows\system32\cryptbase (0xc000 bytes).
2020-06-30 05:19:55,359 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x8b0000
2020-06-30 05:19:55,359 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x008B0000 size 0x400000.
2020-06-30 05:19:55,359 [root] DEBUG: DumpPEsInRange: Scanning range 0x8b0000 - 0x8b1000.
2020-06-30 05:19:55,375 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x8b0000-0x8b1000.
2020-06-30 05:19:55,375 [root] DEBUG: DumpPE: Error: Cannot dump PE file from memory.
2020-06-30 05:19:55,375 [root] DEBUG: DumpImageInCurrentProcess: Failed to dump 'raw' PE image from 0x01350000, dumping memory region.
2020-06-30 05:19:55,421 [root] DEBUG: DLL unloaded from 0x76650000.
2020-06-30 05:19:55,484 [root] DEBUG: DLL unloaded from 0x747E0000.
2020-06-30 05:19:55,500 [root] DEBUG: DLL unloaded from 0x76730000.
2020-06-30 05:19:55,515 [root] DEBUG: DLL unloaded from 0x74900000.
2020-06-30 05:19:55,515 [root] DEBUG: DLL unloaded from 0x6A530000.
2020-06-30 05:19:55,531 [root] DEBUG: DLL unloaded from 0x71720000.
2020-06-30 05:19:55,531 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 5092
2020-06-30 05:19:55,531 [root] DEBUG: GetHookCallerBase: thread 3340 (handle 0x0), return address 0x002A38D0, allocation base 0x002A0000.
2020-06-30 05:19:55,531 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\OguFmUuD\CAPE\3020_11367942715539530262020 (size 0xffe)
2020-06-30 05:19:55,531 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x01350000.
2020-06-30 05:19:55,546 [root] DEBUG: DumpRegion: Dumped stack region from 0x008B0000, size 0x1000.
2020-06-30 05:19:55,546 [root] DEBUG: LooksLikeSectionBoundary: Exception occured reading around suspected boundary at 0x01352000
2020-06-30 05:19:55,546 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-30 05:19:55,546 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x01350000.
2020-06-30 05:19:55,546 [root] DEBUG: DumpPE: Empty or inaccessible last section, file image seems incomplete (from 0x013BD000 to 0x013BD600).
2020-06-30 05:19:55,593 [root] DEBUG: DumpPE: Error: Cannot dump PE file from memory.
2020-06-30 05:19:55,593 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\OguFmUuD\CAPE\3020_3190344385539530262020 (size 0x12b)
2020-06-30 05:19:55,593 [root] DEBUG: DumpImageInCurrentProcess: Failed to dump 'raw' PE image from 0x01350000, dumping memory region.
2020-06-30 05:19:55,609 [root] DEBUG: DumpRegion: Dumped stack region from 0x00070000, size 0x1000.
2020-06-30 05:19:55,609 [root] INFO: Process with pid 5092 has terminated
2020-06-30 05:19:55,609 [root] DEBUG: DLL loaded at 0x00F90000: C:\tmpq_mrpfl7\dll\lDrinxqX (0xd5000 bytes).
2020-06-30 05:19:55,687 [root] DEBUG: DLL loaded at 0x00F90000: C:\tmpq_mrpfl7\dll\lDrinxqX (0xd5000 bytes).
2020-06-30 05:19:55,687 [root] DEBUG: DLL unloaded from 0x72490000.
2020-06-30 05:19:55,703 [root] DEBUG: DLL unloaded from 0x76650000.
2020-06-30 05:19:55,718 [root] DEBUG: DLL unloaded from 0x72490000.
2020-06-30 05:19:55,718 [root] DEBUG: DLL unloaded from 0x76650000.
2020-06-30 05:19:55,718 [root] DEBUG: DLL unloaded from 0x00F90000.
2020-06-30 05:19:55,734 [root] DEBUG: set_caller_info: Adding region at 0x00090000 to caller regions list (advapi32::RegQueryInfoKeyW).
2020-06-30 05:19:55,734 [root] DEBUG: set_caller_info: Failed to dumping calling PE image at 0x00090000.
2020-06-30 05:19:55,734 [root] DEBUG: set_caller_info: Adding region at 0x00520000 to caller regions list (kernel32::FindFirstFileExW).
2020-06-30 05:19:55,875 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\OguFmUuD\CAPE\3020_8535686185539530262020 (size 0x100099)
2020-06-30 05:19:55,875 [root] DEBUG: DumpRegion: Dumped stack region from 0x00520000, size 0x101000.
2020-06-30 05:19:55,890 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xb4 amd local view 0x71720000 to global list.
2020-06-30 05:19:55,906 [root] DEBUG: DLL loaded at 0x71720000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x7d000 bytes).
2020-06-30 05:19:55,906 [root] DEBUG: DLL unloaded from 0x76A30000.
2020-06-30 05:19:55,921 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xd0 amd local view 0x00230000 to global list.
2020-06-30 05:19:55,937 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xcc amd local view 0x00230000 to global list.
2020-06-30 05:19:55,937 [root] DEBUG: DLL loaded at 0x750B0000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-30 05:19:55,953 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6A530000 for section view with handle 0xd0.
2020-06-30 05:19:55,953 [root] DEBUG: DLL loaded at 0x6A530000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr (0x6ef000 bytes).
2020-06-30 05:19:55,968 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6C1F0000 for section view with handle 0xd0.
2020-06-30 05:19:55,968 [root] DEBUG: DLL loaded at 0x6C1F0000: C:\Windows\system32\MSVCR120_CLR0400 (0xf5000 bytes).
2020-06-30 05:19:56,000 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 3020, handle 0xf0.
2020-06-30 05:19:56,000 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xf4 amd local view 0x00230000 to global list.
2020-06-30 05:19:56,000 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xf8 amd local view 0x00240000 to global list.
2020-06-30 05:19:56,015 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3020.
2020-06-30 05:19:56,015 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3020.
2020-06-30 05:19:56,031 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1b0 amd local view 0x05790000 to global list.
2020-06-30 05:19:56,078 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1b4 amd local view 0x64D00000 to global list.
2020-06-30 05:19:56,078 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3020.
2020-06-30 05:19:56,078 [root] DEBUG: DLL loaded at 0x64D00000: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni (0x1393000 bytes).
2020-06-30 05:19:56,109 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x200 amd local view 0x6B550000 to global list.
2020-06-30 05:19:56,109 [root] DEBUG: DLL loaded at 0x6B550000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit (0x80000 bytes).
2020-06-30 05:19:56,109 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1fc amd local view 0x76500000 to global list.
2020-06-30 05:19:56,125 [root] DEBUG: DLL loaded at 0x76500000: C:\Windows\system32\OLEAUT32 (0x91000 bytes).
2020-06-30 05:19:56,156 [root] DEBUG: set_caller_info: Adding region at 0x003D0000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-06-30 05:19:56,203 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\OguFmUuD\CAPE\3020_10157712321640530262020 (size 0xf41b)
2020-06-30 05:19:56,218 [root] DEBUG: DumpRegion: Dumped stack region from 0x003D0000, size 0x10000.
2020-06-30 05:19:56,265 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x214 amd local view 0x673D0000 to global list.
2020-06-30 05:19:56,265 [root] DEBUG: DLL loaded at 0x673D0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni (0xa10000 bytes).
2020-06-30 05:19:56,281 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6A390000 for section view with handle 0x214.
2020-06-30 05:19:56,281 [root] DEBUG: DLL loaded at 0x6A390000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni (0x194000 bytes).
2020-06-30 05:19:56,296 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x210 amd local view 0x666B0000 to global list.
2020-06-30 05:19:56,312 [root] DEBUG: DLL loaded at 0x666B0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni (0xd1d000 bytes).
2020-06-30 05:19:56,328 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x218 amd local view 0x6E5B0000 to global list.
2020-06-30 05:19:56,359 [root] DEBUG: DLL loaded at 0x6E5B0000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting (0x13000 bytes).
2020-06-30 05:19:56,375 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x05B60000 for section view with handle 0x218.
2020-06-30 05:19:56,375 [root] DEBUG: DLL loaded at 0x76AE0000: C:\Windows\system32\shell32 (0xc4c000 bytes).
2020-06-30 05:19:56,390 [root] DEBUG: DLL loaded at 0x75BE0000: C:\Windows\system32\profapi (0xb000 bytes).
2020-06-30 05:19:56,390 [root] DEBUG: set_caller_info: Adding region at 0x00260000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-06-30 05:19:56,390 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x26ffff
2020-06-30 05:19:56,406 [root] DEBUG: DumpMemory: Nothing to dump at 0x00260000!
2020-06-30 05:19:56,406 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00260000 size 0x10000.
2020-06-30 05:19:56,406 [root] DEBUG: DumpPEsInRange: Scanning range 0x260000 - 0x261000.
2020-06-30 05:19:56,406 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x260000-0x261000.
2020-06-30 05:19:56,484 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\OguFmUuD\CAPE\3020_2553706561640530262020 (size 0x14)
2020-06-30 05:19:56,500 [root] DEBUG: DLL loaded at 0x75750000: C:\Windows\system32\bcrypt (0x17000 bytes).
2020-06-30 05:19:56,546 [root] DEBUG: set_caller_info: Adding region at 0x00270000 to caller regions list (ntdll::LdrGetProcedureAddress).
2020-06-30 05:19:56,562 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x27ffff
2020-06-30 05:19:56,593 [root] DEBUG: DumpMemory: Nothing to dump at 0x00270000!
2020-06-30 05:19:56,609 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00270000 size 0x10000.
2020-06-30 05:19:56,609 [root] DEBUG: DumpPEsInRange: Scanning range 0x270000 - 0x27b000.
2020-06-30 05:19:56,609 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x270000-0x27b000.
2020-06-30 05:19:56,687 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\OguFmUuD\CAPE\3020_14799833921640530262020 (size 0xaf97)
2020-06-30 05:19:56,687 [root] DEBUG: DumpRegion: Dumped stack region from 0x00270000, size 0xb000.
2020-06-30 05:19:56,734 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x260 amd local view 0x64520000 to global list.
2020-06-30 05:19:56,734 [root] DEBUG: DLL loaded at 0x64520000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni (0x7e0000 bytes).
2020-06-30 05:19:56,734 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x25c amd local view 0x6B210000 to global list.
2020-06-30 05:19:56,750 [root] DEBUG: DLL loaded at 0x6B210000: C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni (0x1d1000 bytes).
2020-06-30 05:19:56,765 [root] DEBUG: set_caller_info: Adding region at 0x00650000 to caller regions list (ntdll::NtQueryPerformanceCounter).
2020-06-30 05:19:56,765 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x65ffff
2020-06-30 05:19:56,765 [root] DEBUG: DumpMemory: Nothing to dump at 0x00650000!
2020-06-30 05:19:56,781 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00650000 size 0x10000.
2020-06-30 05:19:56,781 [root] DEBUG: DumpPEsInRange: Scanning range 0x650000 - 0x651000.
2020-06-30 05:19:56,781 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x650000-0x651000.
2020-06-30 05:19:56,828 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\OguFmUuD\CAPE\3020_4091520881640530262020 (size 0xbb2)
2020-06-30 05:19:56,828 [root] DEBUG: DumpRegion: Dumped stack region from 0x00650000, size 0x1000.
2020-06-30 05:20:07,859 [root] DEBUG: DLL loaded at 0x75600000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-06-30 05:20:07,875 [root] DEBUG: DLL loaded at 0x75390000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-06-30 05:20:07,890 [root] DEBUG: DLL loaded at 0x75BD0000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-06-30 05:20:07,906 [root] DEBUG: DLL loaded at 0x76010000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2020-06-30 05:20:07,906 [root] DEBUG: DLL loaded at 0x6B8F0000: C:\Windows\system32\wbem\wbemdisp (0x31000 bytes).
2020-06-30 05:20:07,921 [root] DEBUG: DLL loaded at 0x6B5F0000: C:\Windows\system32\wbemcomn (0x5c000 bytes).
2020-06-30 05:20:07,937 [root] DEBUG: DLL loaded at 0x76750000: C:\Windows\system32\WS2_32 (0x35000 bytes).
2020-06-30 05:20:07,937 [root] DEBUG: DLL loaded at 0x77D80000: C:\Windows\system32\NSI (0x6000 bytes).
2020-06-30 05:20:07,937 [root] INFO: Stopping WMI Service
2020-06-30 05:20:08,000 [root] DEBUG: DLL unloaded from 0x6F740000.
2020-06-30 05:20:08,078 [root] DEBUG: set_caller_info: Adding region at 0x6F0C0000 to caller regions list (msvcrt::memcpy).
2020-06-30 05:20:08,078 [root] DEBUG: set_caller_info: Calling region at 0x6F0C0000 skipped.
2020-06-30 05:20:08,093 [root] DEBUG: set_caller_info: Adding region at 0x6EAE0000 to caller regions list (ntdll::NtCreateEvent).
2020-06-30 05:20:08,093 [root] DEBUG: set_caller_info: Calling region at 0x6EAE0000 skipped.
2020-06-30 05:20:08,109 [root] DEBUG: set_caller_info: Adding region at 0x6D9D0000 to caller regions list (msvcrt::memcpy).
2020-06-30 05:20:08,109 [root] DEBUG: set_caller_info: Calling region at 0x6D9D0000 skipped.
2020-06-30 05:20:08,109 [root] DEBUG: set_caller_info: Adding region at 0x6E9F0000 to caller regions list (msvcrt::memcpy).
2020-06-30 05:20:08,125 [root] DEBUG: set_caller_info: Calling region at 0x6E9F0000 skipped.
2020-06-30 05:20:10,515 [root] DEBUG: DLL unloaded from 0x6F040000.
2020-06-30 05:20:10,531 [root] DEBUG: set_caller_info: Adding region at 0x71060000 to caller regions list (ntdll::NtClose).
2020-06-30 05:20:10,531 [root] DEBUG: set_caller_info: Calling region at 0x71060000 skipped.
2020-06-30 05:20:10,578 [root] INFO: Added new file to list with pid None and path C:\Windows\Temp\fwtsqmfile00.sqm
2020-06-30 05:20:13,062 [root] DEBUG: DLL unloaded from 0x6F740000.
2020-06-30 05:20:13,078 [root] DEBUG: set_caller_info: Adding region at 0x6F600000 to caller regions list (ole32::CoCreateInstance).
2020-06-30 05:20:13,078 [root] DEBUG: set_caller_info: Calling region at 0x6F600000 skipped.
2020-06-30 05:20:13,093 [root] DEBUG: set_caller_info: Adding region at 0x74190000 to caller regions list (ole32::CoGetClassObject).
2020-06-30 05:20:13,093 [root] DEBUG: set_caller_info: Calling region at 0x74190000 skipped.
2020-06-30 05:20:13,187 [root] DEBUG: set_caller_info: Adding region at 0x6DC00000 to caller regions list (ntdll::LdrGetDllHandle).
2020-06-30 05:20:13,187 [root] DEBUG: set_caller_info: Calling region at 0x6DC00000 skipped.
2020-06-30 05:20:13,203 [root] DEBUG: set_caller_info: Adding region at 0x6F570000 to caller regions list (msvcrt::memcpy).
2020-06-30 05:20:13,203 [root] DEBUG: set_caller_info: Calling region at 0x6F570000 skipped.
2020-06-30 05:20:13,218 [root] DEBUG: set_caller_info: Adding region at 0x6DBD0000 to caller regions list (ntdll::NtWaitForSingleObject).
2020-06-30 05:20:13,218 [root] DEBUG: set_caller_info: Calling region at 0x6DBD0000 skipped.
2020-06-30 05:20:13,234 [root] DEBUG: set_caller_info: Adding region at 0x6E420000 to caller regions list (ntdll::NtWaitForSingleObject).
2020-06-30 05:20:13,249 [root] DEBUG: set_caller_info: Calling region at 0x6E420000 skipped.
2020-06-30 05:20:13,249 [root] DEBUG: DLL unloaded from 0x6EAE0000.
2020-06-30 05:20:13,265 [root] DEBUG: DLL unloaded from 0x74190000.
2020-06-30 05:20:13,265 [root] DEBUG: DLL unloaded from 0x750C0000.
2020-06-30 05:20:13,265 [root] DEBUG: DLL unloaded from 0x74190000.
2020-06-30 05:20:13,265 [root] DEBUG: DLL unloaded from 0x6F570000.
2020-06-30 05:20:13,281 [root] DEBUG: DLL unloaded from 0x6E9F0000.
2020-06-30 05:20:13,296 [root] DEBUG: DLL unloaded from 0x6D9D0000.
2020-06-30 05:20:13,296 [root] DEBUG: DLL unloaded from 0x6E540000.
2020-06-30 05:20:13,312 [root] DEBUG: DLL unloaded from 0x71060000.
2020-06-30 05:20:13,312 [root] DEBUG: DLL unloaded from 0x739C0000.
2020-06-30 05:20:13,328 [root] DEBUG: DLL unloaded from 0x6F740000.
2020-06-30 05:20:15,593 [root] INFO: Stopped WMI Service
2020-06-30 05:20:15,703 [lib.api.process] INFO: Monitor config for process 576: C:\tmpq_mrpfl7\dll\576.ini
2020-06-30 05:20:15,734 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpq_mrpfl7\dll\lDrinxqX.dll, loader C:\tmpq_mrpfl7\bin\flSPpxj.exe
2020-06-30 05:20:15,734 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WTwZZn.
2020-06-30 05:20:15,734 [root] DEBUG: Loader: Injecting process 576 (thread 0) with C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:20:15,750 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 05:20:15,750 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2020-06-30 05:20:15,765 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 05:20:15,765 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 05:20:15,765 [root] INFO: Disabling sleep skipping.
2020-06-30 05:20:15,765 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 576 at 0x6b650000, image base 0x3c0000, stack from 0x9b6000-0x9c0000
2020-06-30 05:20:15,781 [root] DEBUG: Commandline: C:\Windows\System32\svchost.exe -k DcomLaunch.
2020-06-30 05:20:15,796 [root] INFO: Loaded monitor into process with pid 576
2020-06-30 05:20:15,796 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-30 05:20:15,796 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-30 05:20:15,796 [root] DEBUG: Successfully injected DLL C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:20:17,796 [root] INFO: Starting WMI Service
2020-06-30 05:20:19,890 [root] INFO: Started WMI Service
2020-06-30 05:20:19,906 [lib.api.process] INFO: Monitor config for process 968: C:\tmpq_mrpfl7\dll\968.ini
2020-06-30 05:20:19,906 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpq_mrpfl7\dll\lDrinxqX.dll, loader C:\tmpq_mrpfl7\bin\flSPpxj.exe
2020-06-30 05:20:19,921 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WTwZZn.
2020-06-30 05:20:19,937 [root] DEBUG: Loader: Injecting process 968 (thread 0) with C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:20:19,937 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 05:20:19,937 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2020-06-30 05:20:19,937 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 05:20:19,953 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 05:20:19,953 [root] INFO: Disabling sleep skipping.
2020-06-30 05:20:19,953 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 968 at 0x6b650000, image base 0x3c0000, stack from 0xc06000-0xc10000
2020-06-30 05:20:19,953 [root] DEBUG: Commandline: C:\Windows\System32\svchost.exe -k netsvcs.
2020-06-30 05:20:19,984 [root] INFO: Loaded monitor into process with pid 968
2020-06-30 05:20:19,984 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-30 05:20:19,984 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-30 05:20:20,015 [root] DEBUG: Successfully injected DLL C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:20:22,015 [root] DEBUG: DLL loaded at 0x6EE20000: C:\Windows\system32\wbem\wbemprox (0xb000 bytes).
2020-06-30 05:20:22,031 [root] DEBUG: DLL loaded at 0x6F590000: C:\Windows\system32\wbemcomn2 (0x61000 bytes).
2020-06-30 05:20:22,031 [root] DEBUG: DLL loaded at 0x6E500000: C:\Windows\system32\wbem\wmiutils (0x1a000 bytes).
2020-06-30 05:20:22,062 [root] DEBUG: DLL loaded at 0x6F600000: C:\Windows\system32\VSSAPI (0x116000 bytes).
2020-06-30 05:20:22,062 [root] DEBUG: DLL loaded at 0x74230000: C:\Windows\system32\ATL (0x14000 bytes).
2020-06-30 05:20:22,062 [root] DEBUG: DLL loaded at 0x70F90000: C:\Windows\system32\VssTrace (0x10000 bytes).
2020-06-30 05:20:22,078 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1bc amd local view 0x00370000 to global list.
2020-06-30 05:20:22,093 [root] DEBUG: DLL loaded at 0x73B00000: C:\Windows\system32\samcli (0xf000 bytes).
2020-06-30 05:20:22,093 [root] DEBUG: DLL loaded at 0x74700000: C:\Windows\system32\SAMLIB (0x12000 bytes).
2020-06-30 05:20:22,125 [root] DEBUG: DLL loaded at 0x74970000: C:\Windows\system32\netutils (0x9000 bytes).
2020-06-30 05:20:22,125 [root] DEBUG: DLL loaded at 0x74190000: C:\Windows\system32\es (0x47000 bytes).
2020-06-30 05:20:22,140 [root] DEBUG: DLL loaded at 0x747E0000: C:\Windows\system32\PROPSYS (0xf5000 bytes).
2020-06-30 05:20:22,171 [root] DEBUG: DLL loaded at 0x6EAE0000: C:\Windows\system32\wbem\wbemcore (0xf1000 bytes).
2020-06-30 05:20:22,171 [root] DEBUG: DLL loaded at 0x750B0000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-30 05:20:22,187 [root] DEBUG: DLL loaded at 0x6E9F0000: C:\Windows\system32\wbem\esscli (0x4a000 bytes).
2020-06-30 05:20:22,187 [root] DEBUG: DLL loaded at 0x6F0C0000: C:\Windows\system32\wbem\FastProx (0xa6000 bytes).
2020-06-30 05:20:22,203 [root] DEBUG: DLL loaded at 0x6F020000: C:\Windows\system32\NTDSAPI (0x18000 bytes).
2020-06-30 05:20:22,203 [root] DEBUG: DLL loaded at 0x6E580000: C:\Windows\system32\wbem\wbemsvc (0xf000 bytes).
2020-06-30 05:20:22,234 [root] DEBUG: DLL loaded at 0x757B0000: C:\Windows\system32\authZ (0x1b000 bytes).
2020-06-30 05:20:22,234 [root] DEBUG: DLL loaded at 0x6E500000: C:\Windows\system32\wbem\wmiutils (0x1a000 bytes).
2020-06-30 05:20:22,249 [root] DEBUG: DLL loaded at 0x6E420000: C:\Windows\system32\wbem\repdrvfs (0x47000 bytes).
2020-06-30 05:20:22,281 [root] DEBUG: DLL loaded at 0x75800000: C:\Windows\system32\Wevtapi (0x42000 bytes).
2020-06-30 05:20:22,296 [root] DEBUG: DLL unloaded from 0x75800000.
2020-06-30 05:20:22,656 [root] DEBUG: DLL loaded at 0x6DC00000: C:\Windows\system32\wbem\wmiprvsd (0x91000 bytes).
2020-06-30 05:20:22,671 [root] DEBUG: DLL loaded at 0x6DBD0000: C:\Windows\system32\NCObjAPI (0xf000 bytes).
2020-06-30 05:20:22,687 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 576, handle 0x2c8.
2020-06-30 05:20:22,687 [root] DEBUG: DLL loaded at 0x6C010000: C:\Windows\system32\wbem\wbemess (0x5b000 bytes).
2020-06-30 05:20:22,921 [root] DEBUG: DLL loaded at 0x75B40000: C:\Windows\system32\SXS (0x5f000 bytes).
2020-06-30 05:20:22,953 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x2f4 amd local view 0x007E0000 to global list.
2020-06-30 05:20:23,046 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x2e4 amd local view 0x01260000 to global list.
2020-06-30 05:20:23,140 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6F750000 for section view with handle 0x2f8.
2020-06-30 05:20:23,140 [root] DEBUG: DLL loaded at 0x6F750000: C:\Windows\Microsoft.Net\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers (0x18000 bytes).
2020-06-30 05:20:23,156 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x00830000 for section view with handle 0x2f8.
2020-06-30 05:20:23,156 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x2ec amd local view 0x00830000 to global list.
2020-06-30 05:20:23,171 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x2fc amd local view 0x00830000 to global list.
2020-06-30 05:20:23,171 [root] DEBUG: DLL unloaded from 0x6A530000.
2020-06-30 05:20:23,265 [root] DEBUG: DLL unloaded from 0x6EAE0000.
2020-06-30 05:20:23,359 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x68570000 for section view with handle 0x2f8.
2020-06-30 05:20:23,375 [root] DEBUG: DLL loaded at 0x68570000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d3e15922b03ec29aed46615adda73f3d\System.Management.ni (0x123000 bytes).
2020-06-30 05:20:23,375 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3020.
2020-06-30 05:20:23,437 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3020.
2020-06-30 05:20:23,453 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x340 amd local view 0x6EE40000 to global list.
2020-06-30 05:20:23,453 [root] DEBUG: DLL loaded at 0x6EE40000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\wminet_utils (0x21000 bytes).
2020-06-30 05:20:24,843 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3020.
2020-06-30 05:20:28,171 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3020.
2020-06-30 05:20:33,484 [root] DEBUG: DLL unloaded from 0x763A0000.
2020-06-30 05:20:46,281 [root] DEBUG: set_caller_info: Adding region at 0x00CF0000 to caller regions list (kernel32::VirtualProtectEx).
2020-06-30 05:20:46,281 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0xcfffff
2020-06-30 05:20:46,281 [root] DEBUG: DumpMemory: Nothing to dump at 0x00CF0000!
2020-06-30 05:20:46,281 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00CF0000 size 0x10000.
2020-06-30 05:20:46,281 [root] DEBUG: DumpPEsInRange: Scanning range 0xcf0000 - 0xcf4000.
2020-06-30 05:20:46,296 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0xcf0000-0xcf4000.
2020-06-30 05:20:46,406 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\OguFmUuD\CAPE\3020_5486406534556530262020 (size 0x3103)
2020-06-30 05:20:46,406 [root] DEBUG: DumpRegion: Dumped stack region from 0x00CF0000, size 0x4000.
2020-06-30 05:20:46,421 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x35c amd local view 0x00850000 to global list.
2020-06-30 05:20:46,531 [root] DEBUG: DLL loaded at 0x6F740000: C:\Windows\system32\vaultcli (0xc000 bytes).
2020-06-30 05:20:46,546 [root] DEBUG: DLL unloaded from 0x77D90000.
2020-06-30 05:20:46,671 [root] INFO: Announced starting service "b'VaultSvc'"
2020-06-30 05:20:46,671 [lib.api.process] INFO: Monitor config for process 460: C:\tmpq_mrpfl7\dll\460.ini
2020-06-30 05:20:46,703 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpq_mrpfl7\dll\lDrinxqX.dll, loader C:\tmpq_mrpfl7\bin\flSPpxj.exe
2020-06-30 05:20:46,718 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WTwZZn.
2020-06-30 05:20:46,734 [root] DEBUG: Loader: Injecting process 460 (thread 0) with C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:20:46,734 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 2480, handle 0xa0
2020-06-30 05:20:46,734 [root] DEBUG: Process image base: 0x00D00000
2020-06-30 05:20:46,734 [root] DEBUG: InjectDllViaIAT: Not a new process, aborting IAT patch
2020-06-30 05:20:46,734 [root] DEBUG: InjectDll: IAT patching failed, falling back to thread injection.
2020-06-30 05:20:46,750 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 05:20:46,750 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 05:20:46,750 [root] INFO: Disabling sleep skipping.
2020-06-30 05:20:46,765 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 460 at 0x6b650000, image base 0xd00000, stack from 0x706000-0x710000
2020-06-30 05:20:46,765 [root] DEBUG: Commandline: C:\Windows\System32\services.exe.
2020-06-30 05:20:46,781 [root] INFO: Loaded monitor into process with pid 460
2020-06-30 05:20:46,781 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-30 05:20:46,796 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-30 05:20:46,796 [root] DEBUG: Successfully injected DLL C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:20:47,812 [root] INFO: Announced 32-bit process name: lsass.exe pid: 2652
2020-06-30 05:20:47,843 [lib.api.process] INFO: Monitor config for process 2652: C:\tmpq_mrpfl7\dll\2652.ini
2020-06-30 05:20:47,875 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpq_mrpfl7\dll\lDrinxqX.dll, loader C:\tmpq_mrpfl7\bin\flSPpxj.exe
2020-06-30 05:20:47,890 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WTwZZn.
2020-06-30 05:20:47,890 [root] DEBUG: Loader: Injecting process 2652 (thread 1784) with C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:20:47,906 [root] DEBUG: Process image base: 0x00830000
2020-06-30 05:20:47,906 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:20:47,937 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-30 05:20:47,937 [root] DEBUG: Successfully injected DLL C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:20:47,937 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2652
2020-06-30 05:20:47,953 [root] DEBUG: CreateProcessHandler: using lpCommandLine: C:\Windows\system32\lsass.exe.
2020-06-30 05:20:47,953 [root] DEBUG: CreateProcessHandler: Injection info set for new process 2652, ImageBase: 0x00830000
2020-06-30 05:20:47,953 [root] INFO: Announced 32-bit process name: lsass.exe pid: 2652
2020-06-30 05:20:47,953 [lib.api.process] INFO: Monitor config for process 2652: C:\tmpq_mrpfl7\dll\2652.ini
2020-06-30 05:20:47,968 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpq_mrpfl7\dll\lDrinxqX.dll, loader C:\tmpq_mrpfl7\bin\flSPpxj.exe
2020-06-30 05:20:47,984 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\WTwZZn.
2020-06-30 05:20:48,000 [root] DEBUG: Loader: Injecting process 2652 (thread 1784) with C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:20:48,000 [root] DEBUG: Process image base: 0x00830000
2020-06-30 05:20:48,000 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:20:48,000 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-06-30 05:20:48,015 [root] DEBUG: Successfully injected DLL C:\tmpq_mrpfl7\dll\lDrinxqX.dll.
2020-06-30 05:20:48,015 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2652
2020-06-30 05:20:48,031 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 2652.
2020-06-30 05:20:48,046 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 05:20:48,046 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 05:20:48,046 [root] INFO: Disabling sleep skipping.
2020-06-30 05:20:48,046 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-30 05:20:48,046 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 2652 at 0x6b650000, image base 0x830000, stack from 0xa6000-0xb0000
2020-06-30 05:20:48,062 [root] DEBUG: Commandline: C:\Windows\System32\lsass.exe.
2020-06-30 05:20:48,078 [root] INFO: Loaded monitor into process with pid 2652
2020-06-30 05:20:48,687 [root] DEBUG: set_caller_info: Adding region at 0x6F770000 to caller regions list (kernel32::GetSystemTimeAsFileTime).
2020-06-30 05:20:48,687 [root] DEBUG: set_caller_info: Calling region at 0x6F770000 skipped.
2020-06-30 05:20:52,218 [root] DEBUG: DLL unloaded from 0x763A0000.
2020-06-30 05:20:58,062 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3020.
2020-06-30 05:20:58,078 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x404 amd local view 0x007D0000 to global list.
2020-06-30 05:20:58,078 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x408 amd local view 0x00870000 to global list.
2020-06-30 05:20:58,093 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x007D0000 for section view with handle 0x408.
2020-06-30 05:20:58,093 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x00870000 for section view with handle 0x404.
2020-06-30 05:20:58,109 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x410 amd local view 0x007D0000 to global list.
2020-06-30 05:20:58,109 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x3e8 amd local view 0x007D0000 to global list.
2020-06-30 05:20:58,125 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3020.
2020-06-30 05:21:18,031 [root] INFO: Process with pid 2652 has terminated
2020-06-30 05:21:18,062 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x38c amd local view 0x05FD0000 to global list.
2020-06-30 05:21:42,906 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x27c amd local view 0x68470000 to global list.
2020-06-30 05:21:42,937 [root] DEBUG: DLL loaded at 0x68470000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2f61c87db96dbe27deea0e525a665761\System.Configuration.ni (0xfc000 bytes).
2020-06-30 05:21:44,015 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x63DE0000 for section view with handle 0x27c.
2020-06-30 05:21:44,156 [root] DEBUG: DLL loaded at 0x63DE0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\a3abb36b9f9e867b09bb3a670b074c45\System.Xml.ni (0x73e000 bytes).
2020-06-30 05:21:44,249 [root] DEBUG: DLL loaded at 0x66130000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32 (0x84000 bytes).
2020-06-30 05:22:03,031 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3020.
2020-06-30 05:22:50,937 [root] INFO: Analysis timeout hit, terminating analysis.
2020-06-30 05:22:50,937 [lib.api.process] INFO: Terminate event set for process 844
2020-06-30 05:22:55,937 [lib.api.process] INFO: Termination confirmed for process 844
2020-06-30 05:22:55,937 [root] INFO: Terminate event set for process 844.
2020-06-30 05:22:55,937 [lib.api.process] INFO: Terminate event set for process 3020
2020-06-30 05:22:56,953 [root] DEBUG: Terminate Event: Attempting to dump process 3020
2020-06-30 05:22:56,953 [root] DEBUG: Terminate Event: Attempting to dump process 844
2020-06-30 05:23:00,968 [lib.api.process] INFO: Termination confirmed for process 3020
2020-06-30 05:23:00,968 [root] INFO: Terminate event set for process 3020.
2020-06-30 05:23:00,968 [lib.api.process] INFO: Terminate event set for process 576
2020-06-30 05:23:05,968 [lib.api.process] INFO: Termination confirmed for process 576
2020-06-30 05:23:05,968 [root] INFO: Terminate event set for process 576.
2020-06-30 05:23:05,968 [lib.api.process] INFO: Terminate event set for process 968
2020-06-30 05:23:06,906 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00400000.
2020-06-30 05:23:07,015 [root] DEBUG: Terminate Event: Attempting to dump process 576
2020-06-30 05:23:11,000 [lib.api.process] INFO: Termination confirmed for process 968
2020-06-30 05:23:11,000 [root] INFO: Terminate event set for process 968.
2020-06-30 05:23:11,000 [lib.api.process] INFO: Terminate event set for process 460
2020-06-30 05:23:12,906 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x003C0000.
2020-06-30 05:23:12,906 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x003C0000.
2020-06-30 05:23:12,937 [lib.api.process] INFO: Termination confirmed for process 460
2020-06-30 05:23:12,937 [root] INFO: Terminate event set for process 460.
2020-06-30 05:23:12,937 [root] INFO: Created shutdown mutex.
2020-06-30 05:23:13,937 [root] INFO: Shutting down package.
2020-06-30 05:23:13,937 [root] INFO: Stopping auxiliary modules.
2020-06-30 05:23:19,953 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3020.
2020-06-30 05:23:38,953 [lib.common.results] WARNING: File C:\OguFmUuD\bin\procmon.xml doesn't exist anymore
2020-06-30 05:23:38,953 [root] INFO: Finishing auxiliary modules.
2020-06-30 05:23:38,953 [root] INFO: Shutting down pipe server and dumping dropped files.
2020-06-30 05:23:40,984 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3020.
2020-06-30 05:23:41,515 [root] WARNING: Folder at path "C:\OguFmUuD\debugger" does not exist, skip.
2020-06-30 05:23:41,515 [root] INFO: Analysis completed.

Machine

Name Label Manager Started On Shutdown On
win7_4 win7_4 KVM 2020-06-30 05:19:29 2020-06-30 05:24:30

File Details

File Name payment.exe
File Size 448000 bytes
File Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
PE timestamp 2020-06-29 18:48:46
MD5 435dee0b278745f125024d035dee61dd
SHA1 7d5fc4b66fafaa341900fffa1ef494973b10703e
SHA256 f2ff168cde9f84daeaa4329a4c62fbaa4682fb257062fe8162fe6da08084cabe
SHA512 fc66bfc4197735bb6dbe7a21eb3c19297b2d1a03f7312a361a444e58b296545e542a5e4d4c0f5361f3a027d71f63a4c8fb956221add39fc4455eca3da7bccb73
CRC32 A5AB6375
Ssdeep 12288:AAdwd5wWYfnjF3tvWbNwijE32xi7lXJtXgs5fT:ArdpenjF3sNjjEGUBXN5b
Download Download ZIP Resubmit sample

Signatures

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction - unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Hit: PID 3020 trigged the Yara rule 'shellcode_patterns'
Hit: PID 5092 trigged the Yara rule 'AgentTeslaV2'
Creates RWX memory
Guard pages use detected - possible anti-debugging.
A process attempted to delay the analysis task.
Process: payment.exe tried to sleep 828.01 seconds, actually delayed analysis time by 0.0 seconds
Process: svchost.exe tried to sleep 360.0 seconds, actually delayed analysis time by 0.0 seconds
Dynamic (imported) function loading detected
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: MSCOREE.DLL/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/_CorExeMain_RetAddr
DynamicLoader: mscoreei.dll/_CorExeMain
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: VERSION.dll/GetFileVersionInfoW
DynamicLoader: VERSION.dll/VerQueryValueW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: clr.dll/SetRuntimeInfo
DynamicLoader: USER32.dll/GetProcessWindowStation
DynamicLoader: USER32.dll/GetUserObjectInformationW
DynamicLoader: clr.dll/_CorExeMain
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: MSCOREE.DLL/CreateConfigStream
DynamicLoader: mscoreei.dll/CreateConfigStream_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream
DynamicLoader: KERNEL32.dll/GetNumaHighestNodeNumber
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/GetSystemWindowsDirectoryW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/AddSIDToBoundaryDescriptor
DynamicLoader: KERNEL32.dll/CreateBoundaryDescriptorW
DynamicLoader: KERNEL32.dll/CreatePrivateNamespaceW
DynamicLoader: KERNEL32.dll/OpenPrivateNamespaceW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/DeleteBoundaryDescriptor
DynamicLoader: KERNEL32.dll/WerRegisterRuntimeExceptionModule
DynamicLoader: KERNEL32.dll/RaiseException
DynamicLoader: MSCOREE.DLL/
DynamicLoader: mscoreei.dll/
DynamicLoader: KERNELBASE.dll/SetSystemFileCacheSize
DynamicLoader: ntdll.dll/NtSetSystemInformation
DynamicLoader: KERNELBASE.dll/PrivIsDllSynchronizationHeld
DynamicLoader: KERNEL32.dll/AddDllDirectory
DynamicLoader: KERNEL32.dll/SortGetHandle
DynamicLoader: KERNEL32.dll/SortCloseHandle
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoGetContextToken
DynamicLoader: clrjit.dll/sxsJitStartup
DynamicLoader: clrjit.dll/jitStartup
DynamicLoader: clrjit.dll/getJit
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/LocaleNameToLCID
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/LCIDToLocaleName
DynamicLoader: KERNEL32.dll/GetUserPreferredUILanguages
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegOpenKeyEx
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: KERNEL32.dll/GetFullPathName
DynamicLoader: KERNEL32.dll/GetFullPathNameW
DynamicLoader: uxtheme.dll/IsAppThemed
DynamicLoader: uxtheme.dll/IsAppThemedW
DynamicLoader: KERNEL32.dll/CreateActCtx
DynamicLoader: KERNEL32.dll/CreateActCtxA
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: USER32.dll/RegisterWindowMessage
DynamicLoader: USER32.dll/RegisterWindowMessageW
DynamicLoader: nlssorting.dll/SortGetHandle
DynamicLoader: nlssorting.dll/SortCloseHandle
DynamicLoader: KERNEL32.dll/CompareStringOrdinal
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: KERNEL32.dll/GetCurrentProcessW
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/OpenProcessTokenW
DynamicLoader: ntdll.dll/NtQuerySystemInformation
DynamicLoader: KERNEL32.dll/GetFileAttributesEx
DynamicLoader: KERNEL32.dll/GetFileAttributesExW
DynamicLoader: KERNEL32.dll/SetThreadErrorMode
DynamicLoader: KERNEL32.dll/CreateFile
DynamicLoader: KERNEL32.dll/CreateFileW
DynamicLoader: KERNEL32.dll/GetFileType
DynamicLoader: ADVAPI32.dll/ConvertSidToStringSidW
DynamicLoader: shell32.dll/SHGetFolderPathW
DynamicLoader: KERNEL32.dll/GetFileAttributesEx
DynamicLoader: KERNEL32.dll/GetFileAttributesExW
DynamicLoader: MSCOREE.DLL/GetProcessExecutableHeap
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap_RetAddr
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap
DynamicLoader: bcrypt.dll/BCryptGetFipsAlgorithmMode
DynamicLoader: CRYPTSP.dll/CryptGetDefaultProviderW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: KERNEL32.dll/GetFileSize
DynamicLoader: KERNEL32.dll/ReadFile
DynamicLoader: USER32.dll/GetSystemMetrics
DynamicLoader: KERNEL32.dll/GetModuleHandle
DynamicLoader: KERNEL32.dll/GetModuleHandleW
DynamicLoader: KERNEL32.dll/GetProcAddress
DynamicLoader: KERNEL32.dll/WideCharToMultiByte
DynamicLoader: KERNEL32.dll/AddDllDirectory
DynamicLoader: KERNEL32.dll/LoadLibraryEx
DynamicLoader: KERNEL32.dll/LoadLibraryExW
DynamicLoader: USER32.dll/AdjustWindowRectEx
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: KERNEL32.dll/GetCurrentThread
DynamicLoader: KERNEL32.dll/DuplicateHandle
DynamicLoader: KERNEL32.dll/GetCurrentThreadId
DynamicLoader: KERNEL32.dll/GetCurrentActCtx
DynamicLoader: KERNEL32.dll/ActivateActCtx
DynamicLoader: USER32.dll/DefWindowProcW
DynamicLoader: GDI32.dll/GetStockObject
DynamicLoader: USER32.dll/RegisterClass
DynamicLoader: USER32.dll/RegisterClassW
DynamicLoader: USER32.dll/CreateWindowEx
DynamicLoader: USER32.dll/CreateWindowExW
DynamicLoader: USER32.dll/SetWindowLong
DynamicLoader: USER32.dll/SetWindowLongW
DynamicLoader: USER32.dll/GetWindowLong
DynamicLoader: USER32.dll/GetWindowLongW
DynamicLoader: ADVAPI32.dll/RegQueryValueEx
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: USER32.dll/SetWindowLong
DynamicLoader: USER32.dll/SetWindowLongW
DynamicLoader: USER32.dll/CallWindowProc
DynamicLoader: USER32.dll/CallWindowProcW
DynamicLoader: USER32.dll/GetClientRect
DynamicLoader: USER32.dll/GetWindowRect
DynamicLoader: USER32.dll/GetParent
DynamicLoader: KERNEL32.dll/DeactivateActCtx
DynamicLoader: gdiplus.dll/GdiplusStartup
DynamicLoader: KERNEL32.dll/IsProcessorFeaturePresent
DynamicLoader: USER32.dll/GetWindowInfo
DynamicLoader: USER32.dll/GetAncestor
DynamicLoader: USER32.dll/GetMonitorInfoA
DynamicLoader: USER32.dll/EnumDisplayMonitors
DynamicLoader: USER32.dll/EnumDisplayDevicesA
DynamicLoader: GDI32.dll/ExtTextOutW
DynamicLoader: GDI32.dll/GdiIsMetaPrintDC
DynamicLoader: gdiplus.dll/GdipCreateFontFamilyFromName
DynamicLoader: KERNEL32.dll/RegOpenKeyExW
DynamicLoader: KERNEL32.dll/RegQueryInfoKeyA
DynamicLoader: KERNEL32.dll/RegCloseKey
DynamicLoader: KERNEL32.dll/RegCreateKeyExW
DynamicLoader: KERNEL32.dll/RegQueryValueExW
DynamicLoader: KERNEL32.dll/RegEnumValueW
DynamicLoader: gdiplus.dll/GdipCreateFont
DynamicLoader: gdiplus.dll/GdipGetFontSize
DynamicLoader: KERNEL32.dll/GetSystemDefaultLCID
DynamicLoader: KERNEL32.dll/GetSystemDefaultLCIDW
DynamicLoader: GDI32.dll/GetStockObject
DynamicLoader: GDI32.dll/GetObject
DynamicLoader: GDI32.dll/GetObjectW
DynamicLoader: USER32.dll/GetDC
DynamicLoader: gdiplus.dll/GdipCreateFontFromLogfontW
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: KERNEL32.dll/RegQueryInfoKeyW
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: MSCOREE.DLL/ND_RI2
DynamicLoader: mscoreei.dll/ND_RI2_RetAddr
DynamicLoader: mscoreei.dll/ND_RI2
DynamicLoader: MSCOREE.DLL/ND_RU1
DynamicLoader: mscoreei.dll/ND_RU1_RetAddr
DynamicLoader: mscoreei.dll/ND_RU1
DynamicLoader: gdiplus.dll/GdipGetFontUnit
DynamicLoader: gdiplus.dll/GdipGetFontStyle
DynamicLoader: gdiplus.dll/GdipGetFamily
DynamicLoader: USER32.dll/ReleaseDC
DynamicLoader: gdiplus.dll/GdipCreateFromHDC
DynamicLoader: gdiplus.dll/GdipGetDpiY
DynamicLoader: gdiplus.dll/GdipGetFontHeight
DynamicLoader: gdiplus.dll/GdipGetEmHeight
DynamicLoader: gdiplus.dll/GdipGetLineSpacing
DynamicLoader: gdiplus.dll/GdipDeleteGraphics
DynamicLoader: gdiplus.dll/GdipDeleteFont
DynamicLoader: USER32.dll/GetProcessWindowStation
DynamicLoader: USER32.dll/GetUserObjectInformation
DynamicLoader: USER32.dll/GetUserObjectInformationA
DynamicLoader: KERNEL32.dll/SetConsoleCtrlHandler
DynamicLoader: KERNEL32.dll/SetConsoleCtrlHandlerW
DynamicLoader: KERNEL32.dll/GetModuleHandle
DynamicLoader: KERNEL32.dll/GetModuleHandleW
DynamicLoader: USER32.dll/GetClassInfo
DynamicLoader: USER32.dll/GetClassInfoW
DynamicLoader: USER32.dll/RegisterClass
DynamicLoader: USER32.dll/RegisterClassW
DynamicLoader: USER32.dll/CreateWindowEx
DynamicLoader: USER32.dll/CreateWindowExW
DynamicLoader: USER32.dll/DefWindowProc
DynamicLoader: USER32.dll/DefWindowProcW
DynamicLoader: USER32.dll/GetSysColor
DynamicLoader: USER32.dll/GetSysColorW
DynamicLoader: GDI32.dll/CreateCompatibleDC
DynamicLoader: gdiplus.dll/GdipGetLogFontW
DynamicLoader: MSCOREE.DLL/ND_WU1
DynamicLoader: mscoreei.dll/ND_WU1_RetAddr
DynamicLoader: mscoreei.dll/ND_WU1
DynamicLoader: GDI32.dll/CreateFontIndirect
DynamicLoader: GDI32.dll/CreateFontIndirectW
DynamicLoader: GDI32.dll/SelectObject
DynamicLoader: GDI32.dll/GetTextMetricsW
DynamicLoader: GDI32.dll/GetTextExtentPoint32W
DynamicLoader: GDI32.dll/DeleteDC
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: KERNEL32.dll/ResolveLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: CRYPTSP.dll/CryptGetProvParam
DynamicLoader: CRYPTSP.dll/CryptImportKey
DynamicLoader: CRYPTSP.dll/CryptSetKeyParam
DynamicLoader: CRYPTSP.dll/CryptDecrypt
DynamicLoader: CRYPTSP.dll/CryptEncrypt
DynamicLoader: ole32.dll/CoCreateGuid
DynamicLoader: gdiplus.dll/GdipLoadImageFromStream
DynamicLoader: WindowsCodecs.dll/DllGetClassObject
DynamicLoader: gdiplus.dll/GdipImageForceValidation
DynamicLoader: gdiplus.dll/GdipGetImageType
DynamicLoader: gdiplus.dll/GdipGetImageRawFormat
DynamicLoader: gdiplus.dll/GdipGetImageWidth
DynamicLoader: gdiplus.dll/GdipGetImageHeight
DynamicLoader: gdiplus.dll/GdipBitmapGetPixel
DynamicLoader: CRYPTSP.dll/CryptDestroyKey
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: shell32.dll/SHGetFolderPath
DynamicLoader: shell32.dll/SHGetFolderPathW
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: KERNEL32.dll/CopyFile
DynamicLoader: KERNEL32.dll/CopyFileW
DynamicLoader: KERNEL32.dll/LocalFree
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/GetTokenInformationW
DynamicLoader: KERNEL32.dll/LocalAlloc
DynamicLoader: KERNEL32.dll/LocalAllocW
DynamicLoader: ADVAPI32.dll/LsaClose
DynamicLoader: ADVAPI32.dll/LsaFreeMemory
DynamicLoader: ADVAPI32.dll/LsaOpenPolicy
DynamicLoader: ADVAPI32.dll/LsaLookupSids
DynamicLoader: KERNEL32.dll/GetTempPath
DynamicLoader: KERNEL32.dll/GetTempPathW
DynamicLoader: KERNEL32.dll/GetTempFileName
DynamicLoader: KERNEL32.dll/GetTempFileNameW
DynamicLoader: KERNEL32.dll/WriteFile
DynamicLoader: KERNEL32.dll/LocalAlloc
DynamicLoader: shell32.dll/ShellExecuteEx
DynamicLoader: shell32.dll/ShellExecuteExW
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: KERNEL32.dll/DuplicateHandle
DynamicLoader: ole32.dll/CoWaitForMultipleHandles
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: ole32.dll/NdrOleInitializeExtension
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: KERNEL32.dll/DeleteFile
DynamicLoader: KERNEL32.dll/DeleteFileW
DynamicLoader: KERNEL32.dll/CreateProcess
DynamicLoader: KERNEL32.dll/CreateProcessW
DynamicLoader: KERNEL32.dll/GetThreadContext
DynamicLoader: KERNEL32.dll/ReadProcessMemory
DynamicLoader: KERNEL32.dll/VirtualAllocEx
DynamicLoader: KERNEL32.dll/WriteProcessMemory
DynamicLoader: KERNEL32.dll/SetThreadContext
DynamicLoader: KERNEL32.dll/ResumeThread
DynamicLoader: USER32.dll/SetClassLong
DynamicLoader: USER32.dll/SetClassLongW
DynamicLoader: USER32.dll/PostMessage
DynamicLoader: USER32.dll/PostMessageW
DynamicLoader: USER32.dll/UnregisterClass
DynamicLoader: USER32.dll/UnregisterClassW
DynamicLoader: USER32.dll/IsWindow
DynamicLoader: KERNEL32.dll/GetProcAddress
DynamicLoader: USER32.dll/DefWindowProcW
DynamicLoader: USER32.dll/SetWindowLong
DynamicLoader: USER32.dll/SetWindowLongW
DynamicLoader: USER32.dll/SetClassLong
DynamicLoader: USER32.dll/SetClassLongW
DynamicLoader: USER32.dll/DestroyWindow
DynamicLoader: USER32.dll/DestroyWindowW
DynamicLoader: USER32.dll/PostMessage
DynamicLoader: USER32.dll/PostMessageW
DynamicLoader: ADVAPI32.dll/EventUnregister
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: gdiplus.dll/GdipDisposeImage
DynamicLoader: GDI32.dll/DeleteObject
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/UnregisterTraceGuids
DynamicLoader: ADVAPI32.dll/UnregisterTraceGuids
DynamicLoader: comctl32.dll/
DynamicLoader: KERNEL32.dll/CreateActCtxW
DynamicLoader: KERNEL32.dll/AddRefActCtx
DynamicLoader: KERNEL32.dll/ReleaseActCtx
DynamicLoader: KERNEL32.dll/ActivateActCtx
DynamicLoader: KERNEL32.dll/DeactivateActCtx
DynamicLoader: KERNEL32.dll/GetCurrentActCtx
DynamicLoader: KERNEL32.dll/QueryActCtxW
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/EventUnregister
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: VERSION.dll/GetFileVersionInfoW
DynamicLoader: VERSION.dll/VerQueryValueW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: SspiCli.dll/GetUserNameExW
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: pcwum.dll/PerfDeleteInstance
DynamicLoader: pcwum.dll/PerfStopProvider
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: PROPSYS.dll/PropVariantToVariant
DynamicLoader: ole32.dll/CoDisconnectObject
DynamicLoader: wbemcore.dll/Shutdown
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: ole32.dll/CoDisconnectObject
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: kernel32.dll/RegDeleteValueW
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: MSCOREE.DLL/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/_CorExeMain_RetAddr
DynamicLoader: mscoreei.dll/_CorExeMain
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: VERSION.dll/GetFileVersionInfoW
DynamicLoader: VERSION.dll/VerQueryValueW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: clr.dll/SetRuntimeInfo
DynamicLoader: USER32.dll/GetProcessWindowStation
DynamicLoader: USER32.dll/GetUserObjectInformationW
DynamicLoader: clr.dll/_CorExeMain
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: MSCOREE.DLL/CreateConfigStream
DynamicLoader: mscoreei.dll/CreateConfigStream_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream
DynamicLoader: KERNEL32.dll/GetNumaHighestNodeNumber
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/GetSystemWindowsDirectoryW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/AddSIDToBoundaryDescriptor
DynamicLoader: KERNEL32.dll/CreateBoundaryDescriptorW
DynamicLoader: KERNEL32.dll/CreatePrivateNamespaceW
DynamicLoader: KERNEL32.dll/OpenPrivateNamespaceW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/DeleteBoundaryDescriptor
DynamicLoader: KERNEL32.dll/WerRegisterRuntimeExceptionModule
DynamicLoader: KERNEL32.dll/RaiseException
DynamicLoader: MSCOREE.DLL/
DynamicLoader: mscoreei.dll/
DynamicLoader: KERNELBASE.dll/SetSystemFileCacheSize
DynamicLoader: ntdll.dll/NtSetSystemInformation
DynamicLoader: KERNELBASE.dll/PrivIsDllSynchronizationHeld
DynamicLoader: KERNEL32.dll/AddDllDirectory
DynamicLoader: KERNEL32.dll/SortGetHandle
DynamicLoader: KERNEL32.dll/SortCloseHandle
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoGetContextToken
DynamicLoader: clrjit.dll/sxsJitStartup
DynamicLoader: clrjit.dll/jitStartup
DynamicLoader: clrjit.dll/getJit
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/LocaleNameToLCID
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/LCIDToLocaleName
DynamicLoader: KERNEL32.dll/GetUserPreferredUILanguages
DynamicLoader: nlssorting.dll/SortGetHandle
DynamicLoader: nlssorting.dll/SortCloseHandle
DynamicLoader: ADVAPI32.dll/ConvertSidToStringSidW
DynamicLoader: shell32.dll/SHGetFolderPathW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegOpenKeyEx
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: KERNEL32.dll/GetFullPathName
DynamicLoader: KERNEL32.dll/GetFullPathNameW
DynamicLoader: KERNEL32.dll/SetThreadErrorMode
DynamicLoader: KERNEL32.dll/GetFileAttributesEx
DynamicLoader: KERNEL32.dll/GetFileAttributesExW
DynamicLoader: MSCOREE.DLL/GetProcessExecutableHeap
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap_RetAddr
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap
DynamicLoader: bcrypt.dll/BCryptGetFipsAlgorithmMode
DynamicLoader: KERNEL32.dll/GetModuleHandle
DynamicLoader: KERNEL32.dll/GetModuleHandleW
DynamicLoader: KERNEL32.dll/GetProcAddress
DynamicLoader: KERNEL32.dll/WideCharToMultiByte
DynamicLoader: USER32.dll/DefWindowProcW
DynamicLoader: GDI32.dll/GetStockObject
DynamicLoader: USER32.dll/RegisterClass
DynamicLoader: USER32.dll/RegisterClassW
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: USER32.dll/CreateWindowEx
DynamicLoader: USER32.dll/CreateWindowExW
DynamicLoader: USER32.dll/SetWindowLong
DynamicLoader: USER32.dll/SetWindowLongW
DynamicLoader: USER32.dll/GetWindowLong
DynamicLoader: USER32.dll/GetWindowLongW
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: KERNEL32.dll/GetCurrentThread
DynamicLoader: KERNEL32.dll/DuplicateHandle
DynamicLoader: KERNEL32.dll/GetCurrentThreadId
DynamicLoader: ADVAPI32.dll/RegQueryValueEx
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: USER32.dll/SetWindowLong
DynamicLoader: USER32.dll/SetWindowLongW
DynamicLoader: USER32.dll/CallWindowProc
DynamicLoader: USER32.dll/CallWindowProcW
DynamicLoader: USER32.dll/RegisterWindowMessage
DynamicLoader: USER32.dll/RegisterWindowMessageW
DynamicLoader: KERNEL32.dll/GetCurrentProcessId
DynamicLoader: KERNEL32.dll/GetCurrentProcessIdW
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValue
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValueW
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/OpenProcessTokenW
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivileges
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivilegesW
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: ntdll.dll/NtQuerySystemInformation
DynamicLoader: ntdll.dll/NtQuerySystemInformationW
DynamicLoader: CRYPTSP.dll/CryptGetDefaultProviderW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptCreateHash
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoGetObjectContext
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: ole32.dll/NdrOleInitializeExtension
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: ole32.dll/MkParseDisplayName
DynamicLoader: KERNEL32.dll/GetThreadPreferredUILanguages
DynamicLoader: KERNEL32.dll/SetThreadPreferredUILanguages
DynamicLoader: KERNEL32.dll/LocaleNameToLCID
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/LCIDToLocaleName
DynamicLoader: KERNEL32.dll/GetSystemDefaultLocaleName
DynamicLoader: fastprox.dll/DllGetClassObject
DynamicLoader: fastprox.dll/DllCanUnloadNow
DynamicLoader: ole32.dll/BindMoniker
DynamicLoader: SXS.DLL/SxsOleAut32RedirectTypeLibrary
DynamicLoader: ADVAPI32.dll/RegOpenKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: ADVAPI32.dll/RegQueryValueW
DynamicLoader: SXS.DLL/SxsOleAut32MapConfiguredClsidToReferenceClsid
DynamicLoader: SXS.DLL/SxsLookupClrGuid
DynamicLoader: KERNEL32.dll/ReleaseActCtx
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: mscoreei.dll/_CorDllMain_RetAddr
DynamicLoader: mscoreei.dll/_CorDllMain
DynamicLoader: MSCOREE.DLL/GetTokenForVTableEntry
DynamicLoader: MSCOREE.DLL/SetTargetForVTableEntry
DynamicLoader: MSCOREE.DLL/GetTargetForVTableEntry
DynamicLoader: mscoreei.dll/GetTokenForVTableEntry_RetAddr
DynamicLoader: mscoreei.dll/GetTokenForVTableEntry
DynamicLoader: mscoreei.dll/SetTargetForVTableEntry_RetAddr
DynamicLoader: mscoreei.dll/SetTargetForVTableEntry
DynamicLoader: mscoreei.dll/GetTargetForVTableEntry_RetAddr
DynamicLoader: mscoreei.dll/GetTargetForVTableEntry
DynamicLoader: KERNEL32.dll/GetLastError
DynamicLoader: KERNEL32.dll/LocalAlloc
DynamicLoader: KERNEL32.dll/CreateEvent
DynamicLoader: KERNEL32.dll/CreateEventW
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: KERNEL32.dll/SetEvent
DynamicLoader: ole32.dll/CoWaitForMultipleHandles
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: ole32.dll/IIDFromString
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: KERNEL32.dll/LoadLibrary
DynamicLoader: KERNEL32.dll/LoadLibraryA
DynamicLoader: KERNEL32.dll/GetProcAddress
DynamicLoader: wminet_utils.dll/ResetSecurity
DynamicLoader: wminet_utils.dll/SetSecurity
DynamicLoader: wminet_utils.dll/BlessIWbemServices
DynamicLoader: wminet_utils.dll/BlessIWbemServicesObject
DynamicLoader: wminet_utils.dll/GetPropertyHandle
DynamicLoader: wminet_utils.dll/WritePropertyValue
DynamicLoader: wminet_utils.dll/Clone
DynamicLoader: wminet_utils.dll/VerifyClientKey
DynamicLoader: wminet_utils.dll/GetQualifierSet
DynamicLoader: wminet_utils.dll/Get
DynamicLoader: wminet_utils.dll/Put
DynamicLoader: wminet_utils.dll/Delete
DynamicLoader: wminet_utils.dll/GetNames
DynamicLoader: wminet_utils.dll/BeginEnumeration
DynamicLoader: wminet_utils.dll/Next
DynamicLoader: wminet_utils.dll/EndEnumeration
DynamicLoader: wminet_utils.dll/GetPropertyQualifierSet
DynamicLoader: wminet_utils.dll/Clone
DynamicLoader: wminet_utils.dll/GetObjectText
DynamicLoader: wminet_utils.dll/SpawnDerivedClass
DynamicLoader: wminet_utils.dll/SpawnInstance
DynamicLoader: wminet_utils.dll/CompareTo
DynamicLoader: wminet_utils.dll/GetPropertyOrigin
DynamicLoader: wminet_utils.dll/InheritsFrom
DynamicLoader: wminet_utils.dll/GetMethod
DynamicLoader: wminet_utils.dll/PutMethod
DynamicLoader: wminet_utils.dll/DeleteMethod
DynamicLoader: wminet_utils.dll/BeginMethodEnumeration
DynamicLoader: wminet_utils.dll/NextMethod
DynamicLoader: wminet_utils.dll/EndMethodEnumeration
DynamicLoader: wminet_utils.dll/GetMethodQualifierSet
DynamicLoader: wminet_utils.dll/GetMethodOrigin
DynamicLoader: wminet_utils.dll/QualifierSet_Get
DynamicLoader: wminet_utils.dll/QualifierSet_Put
DynamicLoader: wminet_utils.dll/QualifierSet_Delete
DynamicLoader: wminet_utils.dll/QualifierSet_GetNames
DynamicLoader: wminet_utils.dll/QualifierSet_BeginEnumeration
DynamicLoader: wminet_utils.dll/QualifierSet_Next
DynamicLoader: wminet_utils.dll/QualifierSet_EndEnumeration
DynamicLoader: wminet_utils.dll/GetCurrentApartmentType
DynamicLoader: wminet_utils.dll/GetDemultiplexedStub
DynamicLoader: wminet_utils.dll/CreateInstanceEnumWmi
DynamicLoader: wminet_utils.dll/CreateClassEnumWmi
DynamicLoader: wminet_utils.dll/ExecQueryWmi
DynamicLoader: wminet_utils.dll/ExecNotificationQueryWmi
DynamicLoader: wminet_utils.dll/PutInstanceWmi
DynamicLoader: wminet_utils.dll/PutClassWmi
DynamicLoader: wminet_utils.dll/CloneEnumWbemClassObject
DynamicLoader: wminet_utils.dll/ConnectServerWmi
DynamicLoader: wminet_utils.dll/GetErrorInfo
DynamicLoader: wminet_utils.dll/Initialize
DynamicLoader: OLEAUT32.dll/SysStringLen
DynamicLoader: KERNEL32.dll/RtlZeroMemory
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: KERNEL32.dll/RegOpenKeyExW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: CRYPTSP.dll/CryptHashData
DynamicLoader: CRYPTSP.dll/CryptGetHashParam
DynamicLoader: CRYPTSP.dll/CryptDestroyHash
DynamicLoader: KERNEL32.dll/GetEnvironmentVariable
DynamicLoader: KERNEL32.dll/GetEnvironmentVariableW
DynamicLoader: ADVAPI32.dll/GetUserName
DynamicLoader: ADVAPI32.dll/GetUserNameW
DynamicLoader: KERNEL32.dll/GetComputerName
DynamicLoader: KERNEL32.dll/GetComputerNameW
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ntdll.dll/NtQueryInformationThread
DynamicLoader: ntdll.dll/NtQuerySystemInformation
DynamicLoader: KERNEL32.dll/CreateWaitableTimerExW
DynamicLoader: KERNEL32.dll/SetWaitableTimerEx
DynamicLoader: OLEAUT32.dll/
DynamicLoader: shell32.dll/SHGetFolderPath
DynamicLoader: shell32.dll/SHGetFolderPathW
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: CRYPTSP.dll/CryptAcquireContextA
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: CRYPTSP.dll/CryptImportKey
DynamicLoader: CRYPTSP.dll/CryptExportKey
DynamicLoader: CRYPTSP.dll/CryptDestroyKey
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: KERNEL32.dll/FindFirstFile
DynamicLoader: KERNEL32.dll/FindFirstFileW
DynamicLoader: KERNEL32.dll/FindClose
DynamicLoader: KERNEL32.dll/CreateFile
DynamicLoader: KERNEL32.dll/CreateFileW
DynamicLoader: KERNEL32.dll/GetFileType
DynamicLoader: KERNEL32.dll/ReadFile
DynamicLoader: KERNEL32.dll/GetFileSize
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: KERNEL32.dll/GetACP
DynamicLoader: KERNEL32.dll/UnmapViewOfFile
DynamicLoader: vaultcli.dll/VaultEnumerateVaults
DynamicLoader: KERNEL32.dll/GetSystemTimeAsFileTime
DynamicLoader: ntdll.dll/NtQuerySystemInformation
DynamicLoader: KERNEL32.dll/GetDynamicTimeZoneInformation
DynamicLoader: ADVAPI32.dll/RegQueryValueEx
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: KERNEL32.dll/GetFileMUIPath
DynamicLoader: KERNEL32.dll/LoadLibraryEx
DynamicLoader: KERNEL32.dll/LoadLibraryExW
DynamicLoader: KERNEL32.dll/FreeLibrary
DynamicLoader: KERNEL32.dll/FreeLibraryW
DynamicLoader: USER32.dll/LoadStringW
DynamicLoader: USER32.dll/GetLastInputInfo
DynamicLoader: KERNEL32.dll/FindNextFile
DynamicLoader: KERNEL32.dll/FindNextFileW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: KERNEL32.dll/CompareStringOrdinal
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: KERNEL32.dll/GetCurrentProcessW
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/OpenProcessTokenW
DynamicLoader: KERNEL32.dll/GetFileAttributesEx
DynamicLoader: KERNEL32.dll/GetFileAttributesExW
DynamicLoader: USER32.dll/GetSystemMetrics
DynamicLoader: KERNEL32.dll/AddDllDirectory
DynamicLoader: KERNEL32.dll/LoadLibraryEx
DynamicLoader: KERNEL32.dll/LoadLibraryExW
DynamicLoader: USER32.dll/GetClientRect
DynamicLoader: USER32.dll/GetWindowRect
DynamicLoader: USER32.dll/GetParent
DynamicLoader: ole32.dll/OleInitialize
DynamicLoader: ole32.dll/CoRegisterMessageFilter
DynamicLoader: USER32.dll/PeekMessage
DynamicLoader: USER32.dll/PeekMessageW
DynamicLoader: USER32.dll/WaitMessage
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: kernel32.dll/ResolveDelayLoadedAPI
DynamicLoader: VSSAPI.DLL/CreateWriter
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ADVAPI32.dll/LookupAccountNameW
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: samcli.dll/NetLocalGroupGetMembers
DynamicLoader: SAMLIB.dll/SamConnect
DynamicLoader: RPCRT4.dll/NdrClientCall2
DynamicLoader: RPCRT4.dll/RpcStringBindingComposeW
DynamicLoader: RPCRT4.dll/RpcBindingFromStringBindingW
DynamicLoader: RPCRT4.dll/RpcStringFreeW
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: SAMLIB.dll/SamOpenDomain
DynamicLoader: SAMLIB.dll/SamLookupNamesInDomain
DynamicLoader: SAMLIB.dll/SamOpenAlias
DynamicLoader: SAMLIB.dll/SamFreeMemory
DynamicLoader: SAMLIB.dll/SamCloseHandle
DynamicLoader: SAMLIB.dll/SamGetMembersInAlias
DynamicLoader: netutils.dll/NetApiBufferFree
DynamicLoader: ole32.dll/CoCreateGuid
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/StringFromCLSID
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyW
DynamicLoader: PROPSYS.dll/VariantToPropVariant
DynamicLoader: OLEAUT32.dll/
DynamicLoader: wbemcore.dll/Reinitialize
DynamicLoader: wbemsvc.dll/DllGetClassObject
DynamicLoader: wbemsvc.dll/DllCanUnloadNow
DynamicLoader: authZ.dll/AuthzInitializeContextFromToken
DynamicLoader: authZ.dll/AuthzInitializeObjectAccessAuditEvent2
DynamicLoader: authZ.dll/AuthzAccessCheck
DynamicLoader: authZ.dll/AuthzFreeAuditEvent
DynamicLoader: authZ.dll/AuthzFreeContext
DynamicLoader: authZ.dll/AuthzInitializeResourceManager
DynamicLoader: authZ.dll/AuthzFreeResourceManager
DynamicLoader: RPCRT4.dll/NdrClientCall2
DynamicLoader: RPCRT4.dll/RpcBindingCreateW
DynamicLoader: RPCRT4.dll/RpcBindingBind
DynamicLoader: RPCRT4.dll/I_RpcMapWin32Status
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventUnregister
DynamicLoader: ADVAPI32.dll/EventWrite
DynamicLoader: ADVAPI32.dll/EventActivityIdControl
DynamicLoader: ADVAPI32.dll/EventWriteTransfer
DynamicLoader: ADVAPI32.dll/EventEnabled
DynamicLoader: kernel32.dll/RegCloseKey
DynamicLoader: kernel32.dll/RegSetValueExW
DynamicLoader: kernel32.dll/RegOpenKeyExW
DynamicLoader: kernel32.dll/RegQueryValueExW
DynamicLoader: kernel32.dll/RegCloseKey
DynamicLoader: wmisvc.dll/IsImproperShutdownDetected
DynamicLoader: Wevtapi.dll/EvtRender
DynamicLoader: Wevtapi.dll/EvtNext
DynamicLoader: Wevtapi.dll/EvtClose
DynamicLoader: Wevtapi.dll/EvtQuery
DynamicLoader: Wevtapi.dll/EvtCreateRenderContext
DynamicLoader: RPCRT4.dll/RpcStringBindingComposeW
DynamicLoader: RPCRT4.dll/RpcBindingFromStringBindingW
DynamicLoader: RPCRT4.dll/RpcBindingSetAuthInfoExW
DynamicLoader: RPCRT4.dll/RpcBindingSetOption
DynamicLoader: RPCRT4.dll/RpcStringFreeW
DynamicLoader: RPCRT4.dll/NdrClientCall2
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: kernel32.dll/ResolveDelayLoadedAPI
DynamicLoader: ole32.dll/CoCreateFreeThreadedMarshaler
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CreateStreamOnHGlobal
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: KERNELBASE.dll/InitializeAcl
DynamicLoader: KERNELBASE.dll/AddAce
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: kernel32.dll/OpenProcessToken
DynamicLoader: KERNELBASE.dll/GetTokenInformation
DynamicLoader: KERNELBASE.dll/DuplicateTokenEx
DynamicLoader: KERNELBASE.dll/AdjustTokenPrivileges
DynamicLoader: KERNELBASE.dll/AllocateAndInitializeSid
DynamicLoader: KERNELBASE.dll/CheckTokenMembership
DynamicLoader: kernel32.dll/SetThreadToken
DynamicLoader: ole32.dll/CLSIDFromString
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: authZ.dll/AuthzInitializeContextFromToken
DynamicLoader: authZ.dll/AuthzInitializeResourceManager
DynamicLoader: authZ.dll/AuthzInitializeContextFromSid
DynamicLoader: authZ.dll/AuthzInitializeContextFromToken
DynamicLoader: authZ.dll/AuthzAccessCheck
DynamicLoader: authZ.dll/AuthzFreeContext
DynamicLoader: authZ.dll/AuthzFreeResourceManager
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetCallContext
DynamicLoader: ole32.dll/StringFromGUID2
DynamicLoader: ole32.dll/CoImpersonateClient
DynamicLoader: ole32.dll/CoRevertToSelf
DynamicLoader: ole32.dll/CoSwitchCallContext
DynamicLoader: ole32.dll/CoCreateGuid
DynamicLoader: kernel32.dll/ResolveDelayLoadedAPI
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: SspiCli.dll/LogonUserExExW
DynamicLoader: wbemcore.dll/Reinitialize
DynamicLoader: wbemcore.dll/Reinitialize
DynamicLoader: wbemcore.dll/Reinitialize
DynamicLoader: OLEAUT32.dll/
DynamicLoader: wbemcore.dll/Reinitialize
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CoUninitialize
A process created a hidden window
Process: payment.exe -> schtasks.exe
CAPE extracted potentially suspicious content
payment.exe: Injected Shellcode/Data
payment.exe: Unpacked Shellcode
payment.exe: Unpacked Shellcode
payment.exe: Unpacked Shellcode
payment.exe: Unpacked Shellcode
payment.exe: Unpacked Shellcode
payment.exe: Unpacked Shellcode
payment.exe: Unpacked Shellcode
payment.exe: Unpacked Shellcode
payment.exe: Unpacked Shellcode
payment.exe: AgentTeslaV2 Payload: 32-bit executable
payment.exe: AgentTeslaV2
payment.exe: Unpacked Shellcode
payment.exe: Unpacked Shellcode
payment.exe: Injected Shellcode/Data
payment.exe: Unpacked Shellcode
payment.exe: Unpacked Shellcode
Queries or connects to DNS-Over-HTTPS/DNS-Over-TLS domain or IP address
ip: 1.1.1.1
The binary likely contains encrypted or compressed data.
section: name: .text, entropy: 7.82, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x0006cc00, virtual_size: 0x0006ca34
Authenticode signature is invalid
authenticode error: No signature found. SignTool Error File not valid C\Users\Rebecca\AppData\Local\Temp\payment.exe
Uses Windows utilities for basic functionality
command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SPjfKyKDmOO" /XML "C:\Users\Rebecca\AppData\Local\Temp\tmp3B3.tmp"
command: schtasks.exe /Create /TN "Updates\SPjfKyKDmOO" /XML "C:\Users\Rebecca\AppData\Local\Temp\tmp3B3.tmp"
Behavioural detection: Injection (Process Hollowing)
Injection: payment.exe(5092) -> payment.exe(3020)
Executed a process and injected code into it, probably while unpacking
Injection: payment.exe(5092) -> payment.exe(3020)
Behavioural detection: Injection (inter-process)
Behavioural detection: Injection with CreateRemoteThread in a remote process
Attempts to repeatedly call a single API many times in order to delay analysis time
Spam: payment.exe (3020) called API NtYieldExecution 14270 times
Spam: services.exe (460) called API GetSystemTimeAsFileTime 10492216 times
Steals private information from local Internet browsers
file: C:\Users\Rebecca\AppData\Local\Google\Chrome\User Data\Default\Login Data
file: C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\profiles.ini
file: C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\48wgv2fv.default\key4.db
CAPE detected the AgentTeslaV2 malware family
File has been identified by 21 Antiviruses on VirusTotal as malicious
FireEye: Generic.mg.435dee0b278745f1
McAfee: GenericRXKR-WW!435DEE0B2787
Cylance: Unsafe
Sangfor: Malware
Cybereason: malicious.66fafa
ESET-NOD32: a variant of MSIL/Kryptik.WPI
APEX: Malicious
Kaspersky: UDS:DangerousObject.Multi.Generic
Endgame: malicious (high confidence)
Invincea: heuristic
Trapmine: malicious.moderate.ml.score
Ikarus: Win32.Outbreak
Webroot: W32.Malware.Gen
ZoneAlarm: UDS:DangerousObject.Multi.Generic
Microsoft: Trojan:Win32/Wacatac.C!ml
Cynet: Malicious (score: 100)
Yandex: Trojan.AvsArher.bTJEKx
SentinelOne: DFI - Malicious PE
eGambit: Unsafe.AI_Score_94%
CrowdStrike: win/malicious_confidence_100% (W)
Qihoo-360: HEUR/QVM03.0.3D1B.Malware.Gen
Creates a copy of itself
copy: C:\Users\Rebecca\AppData\Roaming\SPjfKyKDmOO.exe
Harvests information related to installed mail clients
file: C:\Users\Rebecca\AppData\Roaming\Thunderbird\profiles.ini
key: HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
key: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
key: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Screenshots


Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
Y 1.1.1.1 [VT] Australia

DNS

No domains contacted.


Summary

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Rebecca\AppData\Local\Temp\payment.exe.config
C:\Users\Rebecca\AppData\Local\Temp\payment.exe
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-2.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSVCR120_CLR0400.dll
C:\Windows\System32\MSVCR120_CLR0400.dll
C:\Windows\System32\api-ms-win-core-quirks-l1-1-0.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll.aux
C:\Users
C:\Users\Rebecca
C:\Users\Rebecca\AppData
C:\Users\Rebecca\AppData\Local
C:\Users\Rebecca\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\SWuwjRQZOu\*
C:\Users\Rebecca\AppData\Local\Temp\payment.INI
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
C:\Windows\assembly\pubpol224.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\Microsoft.Net\assembly\GAC_32\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2f61c87db96dbe27deea0e525a665761\System.Configuration.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2f61c87db96dbe27deea0e525a665761\System.Configuration.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\SortDefault.nlp
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\a3abb36b9f9e867b09bb3a670b074c45\System.Xml.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\a3abb36b9f9e867b09bb3a670b074c45\System.Xml.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll
C:\Users\Rebecca\AppData\Local\Temp\payment.exe.Local\
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\GdiPlus.dll
C:\Users\Rebecca\AppData\Local\GDIPFONTCACHEV1.DAT
C:\Windows\Fonts\marlett.ttf
C:\Windows\Fonts\arial.ttf
C:\Windows\Fonts\ariali.ttf
C:\Windows\Fonts\arialbd.ttf
C:\Windows\Fonts\arialbi.ttf
C:\Windows\Fonts\batang.ttc
C:\Windows\Fonts\cour.ttf
C:\Windows\Fonts\couri.ttf
C:\Windows\Fonts\courbd.ttf
C:\Windows\Fonts\courbi.ttf
C:\Windows\Fonts\daunpenh.ttf
C:\Windows\Fonts\dokchamp.ttf
C:\Windows\Fonts\estre.ttf
C:\Windows\Fonts\euphemia.ttf
C:\Windows\Fonts\gautami.ttf
C:\Windows\Fonts\gautamib.ttf
C:\Windows\Fonts\Vani.ttf
C:\Windows\Fonts\Vanib.ttf
C:\Windows\Fonts\gulim.ttc
C:\Windows\Fonts\impact.ttf
C:\Windows\Fonts\iskpota.ttf
C:\Windows\Fonts\iskpotab.ttf
C:\Windows\Fonts\kalinga.ttf
C:\Windows\Fonts\kalingab.ttf
C:\Windows\Fonts\kartika.ttf
C:\Windows\Fonts\kartikab.ttf
C:\Windows\Fonts\KhmerUI.ttf
C:\Windows\Fonts\KhmerUIb.ttf
C:\Windows\Fonts\LaoUI.ttf
C:\Windows\Fonts\LaoUIb.ttf
C:\Windows\Fonts\latha.ttf
C:\Windows\Fonts\lathab.ttf
C:\Windows\Fonts\lucon.ttf
C:\Windows\Fonts\malgun.ttf
C:\Windows\Fonts\malgunbd.ttf
C:\Windows\Fonts\mangal.ttf
C:\Windows\Fonts\mangalb.ttf
C:\Windows\Fonts\meiryo.ttc
C:\Windows\Fonts\meiryob.ttc
C:\Windows\Fonts\himalaya.ttf
C:\Windows\Fonts\msjh.ttf
C:\Windows\Fonts\msjhbd.ttf
C:\Windows\Fonts\msyh.ttf
C:\Windows\Fonts\msyhbd.ttf
C:\Windows\Fonts\mingliu.ttc
C:\Windows\Fonts\mingliub.ttc
C:\Windows\Fonts\monbaiti.ttf
C:\Windows\Fonts\msgothic.ttc
C:\Windows\Fonts\msmincho.ttc
C:\Windows\Fonts\mvboli.ttf
C:\Windows\Fonts\ntailu.ttf
C:\Windows\Fonts\ntailub.ttf
C:\Windows\Fonts\nyala.ttf
C:\Windows\Fonts\phagspa.ttf
C:\Windows\Fonts\phagspab.ttf
C:\Windows\Fonts\plantc.ttf
C:\Windows\Fonts\raavi.ttf
C:\Windows\Fonts\raavib.ttf
C:\Windows\Fonts\segoesc.ttf
C:\Windows\Fonts\segoescb.ttf
C:\Windows\Fonts\segoeui.ttf
C:\Windows\Fonts\segoeuib.ttf
C:\Windows\Fonts\segoeuii.ttf
C:\Windows\Fonts\segoeuiz.ttf
C:\Windows\Fonts\seguisb.ttf
C:\Windows\Fonts\segoeuil.ttf
C:\Windows\Fonts\seguisym.ttf
C:\Windows\Fonts\shruti.ttf
C:\Windows\Fonts\shrutib.ttf
C:\Windows\Fonts\simsun.ttc
C:\Windows\Fonts\simsunb.ttf
C:\Windows\Fonts\sylfaen.ttf
C:\Windows\Fonts\taile.ttf
C:\Windows\Fonts\taileb.ttf
C:\Windows\Fonts\times.ttf
C:\Windows\Fonts\timesi.ttf
C:\Windows\Fonts\timesbd.ttf
C:\Windows\Fonts\timesbi.ttf
C:\Windows\Fonts\tunga.ttf
C:\Windows\Fonts\tungab.ttf
C:\Windows\Fonts\vrinda.ttf
C:\Windows\Fonts\vrindab.ttf
C:\Windows\Fonts\Shonar.ttf
C:\Windows\Fonts\Shonarb.ttf
C:\Windows\Fonts\msyi.ttf
C:\Windows\Fonts\tahoma.ttf
C:\Windows\Fonts\tahomabd.ttf
C:\Windows\Fonts\micross.ttf
C:\Windows\Fonts\angsa.ttf
C:\Windows\Fonts\angsai.ttf
C:\Windows\Fonts\angsab.ttf
C:\Windows\Fonts\angsaz.ttf
C:\Windows\Fonts\aparaj.ttf
C:\Windows\Fonts\aparajb.ttf
C:\Windows\Fonts\aparajbi.ttf
C:\Windows\Fonts\aparaji.ttf
C:\Windows\Fonts\cordia.ttf
C:\Windows\Fonts\cordiai.ttf
C:\Windows\Fonts\cordiab.ttf
C:\Windows\Fonts\cordiaz.ttf
C:\Windows\Fonts\ebrima.ttf
C:\Windows\Fonts\ebrimabd.ttf
C:\Windows\Fonts\gisha.ttf
C:\Windows\Fonts\gishabd.ttf
C:\Windows\Fonts\kokila.ttf
C:\Windows\Fonts\kokilab.ttf
C:\Windows\Fonts\kokilabi.ttf
C:\Windows\Fonts\kokilai.ttf
C:\Windows\Fonts\leelawad.ttf
C:\Windows\Fonts\leelawdb.ttf
C:\Windows\Fonts\msuighur.ttf
C:\Windows\Fonts\moolbor.ttf
C:\Windows\Fonts\symbol.ttf
C:\Windows\Fonts\utsaah.ttf
C:\Windows\Fonts\utsaahb.ttf
C:\Windows\Fonts\utsaahbi.ttf
C:\Windows\Fonts\utsaahi.ttf
C:\Windows\Fonts\vijaya.ttf
C:\Windows\Fonts\vijayab.ttf
C:\Windows\Fonts\wingding.ttf
C:\Windows\Fonts\modern.fon
C:\Windows\Fonts\roman.fon
C:\Windows\Fonts\script.fon
C:\Windows\Fonts\andlso.ttf
C:\Windows\Fonts\arabtype.ttf
C:\Windows\Fonts\simpo.ttf
C:\Windows\Fonts\simpbdo.ttf
C:\Windows\Fonts\simpfxo.ttf
C:\Windows\Fonts\majalla.ttf
C:\Windows\Fonts\majallab.ttf
C:\Windows\Fonts\trado.ttf
C:\Windows\Fonts\tradbdo.ttf
C:\Windows\Fonts\ahronbd.ttf
C:\Windows\Fonts\david.ttf
C:\Windows\Fonts\davidbd.ttf
C:\Windows\Fonts\frank.ttf
C:\Windows\Fonts\lvnm.ttf
C:\Windows\Fonts\lvnmbd.ttf
C:\Windows\Fonts\mriam.ttf
C:\Windows\Fonts\mriamc.ttf
C:\Windows\Fonts\nrkis.ttf
C:\Windows\Fonts\rod.ttf
C:\Windows\Fonts\simfang.ttf
C:\Windows\Fonts\simhei.ttf
C:\Windows\Fonts\simkai.ttf
C:\Windows\Fonts\angsau.ttf
C:\Windows\Fonts\angsaui.ttf
C:\Windows\Fonts\angsaub.ttf
C:\Windows\Fonts\angsauz.ttf
C:\Windows\Fonts\browa.ttf
C:\Windows\Fonts\browai.ttf
C:\Windows\Fonts\browab.ttf
C:\Windows\Fonts\browaz.ttf
C:\Windows\Fonts\browau.ttf
C:\Windows\Fonts\browaui.ttf
C:\Windows\Fonts\browaub.ttf
C:\Windows\Fonts\browauz.ttf
C:\Windows\Fonts\cordiau.ttf
C:\Windows\Fonts\cordiaub.ttf
C:\Windows\Fonts\cordiauz.ttf
C:\Windows\Fonts\cordiaui.ttf
C:\Windows\Fonts\upcdl.ttf
C:\Windows\Fonts\upcdi.ttf
C:\Windows\Fonts\upcdb.ttf
C:\Windows\Fonts\upcdbi.ttf
C:\Windows\Fonts\upcel.ttf
C:\Windows\Fonts\upcei.ttf
C:\Windows\Fonts\upceb.ttf
C:\Windows\Fonts\upcebi.ttf
C:\Windows\Fonts\upcfl.ttf
C:\Windows\Fonts\upcfi.ttf
C:\Windows\Fonts\upcfb.ttf
C:\Windows\Fonts\upcfbi.ttf
C:\Windows\Fonts\upcil.ttf
C:\Windows\Fonts\upcii.ttf
C:\Windows\Fonts\upcib.ttf
C:\Windows\Fonts\upcibi.ttf
C:\Windows\Fonts\upcjl.ttf
C:\Windows\Fonts\upcji.ttf
C:\Windows\Fonts\upcjb.ttf
C:\Windows\Fonts\upcjbi.ttf
C:\Windows\Fonts\upckl.ttf
C:\Windows\Fonts\upcki.ttf
C:\Windows\Fonts\upckb.ttf
C:\Windows\Fonts\upckbi.ttf
C:\Windows\Fonts\upcll.ttf
C:\Windows\Fonts\upcli.ttf
C:\Windows\Fonts\upclb.ttf
C:\Windows\Fonts\upclbi.ttf
C:\Windows\Fonts\kaiu.ttf
C:\Windows\Fonts\l_10646.ttf
C:\Windows\Fonts\ariblk.ttf
C:\Windows\Fonts\calibri.ttf
C:\Windows\Fonts\calibrii.ttf
C:\Windows\Fonts\calibrib.ttf
C:\Windows\Fonts\calibriz.ttf
C:\Windows\Fonts\comic.ttf
C:\Windows\Fonts\comicbd.ttf
C:\Windows\Fonts\framd.ttf
C:\Windows\Fonts\framdit.ttf
C:\Windows\Fonts\Gabriola.ttf
C:\Windows\Fonts\georgia.ttf
C:\Windows\Fonts\georgiai.ttf
C:\Windows\Fonts\georgiab.ttf
C:\Windows\Fonts\georgiaz.ttf
C:\Windows\Fonts\pala.ttf
C:\Windows\Fonts\palai.ttf
C:\Windows\Fonts\palab.ttf
C:\Windows\Fonts\palabi.ttf
C:\Windows\Fonts\segoepr.ttf
C:\Windows\Fonts\segoeprb.ttf
C:\Windows\Fonts\trebuc.ttf
C:\Windows\Fonts\trebucit.ttf
C:\Windows\Fonts\trebucbd.ttf
C:\Windows\Fonts\trebucbi.ttf
C:\Windows\Fonts\verdana.ttf
C:\Windows\Fonts\verdanai.ttf
C:\Windows\Fonts\verdanab.ttf
C:\Windows\Fonts\verdanaz.ttf
C:\Windows\Fonts\webdings.ttf
C:\Windows\Fonts\coure.fon
C:\Windows\Fonts\serife.fon
C:\Windows\Fonts\sserife.fon
C:\Windows\Fonts\smalle.fon
C:\Windows\Fonts\smallf.fon
C:\Windows\Fonts\calibrili.ttf
C:\Windows\Fonts\CALIBRILI.TTF
C:\Windows\Fonts\calibril.ttf
C:\Windows\Fonts\AGENCYB.TTF
C:\Windows\Fonts\AGENCYR.TTF
C:\Windows\Fonts\ALGER.TTF
C:\Windows\Fonts\ANTQUAB.TTF
C:\Windows\Fonts\ANTQUABI.TTF
C:\Windows\Fonts\ANTQUAI.TTF
C:\Windows\Fonts\ARIALN.TTF
C:\Windows\Fonts\ARIALNB.TTF
C:\Windows\Fonts\ARIALNBI.TTF
C:\Windows\Fonts\ARIALNI.TTF
C:\Windows\Fonts\ARLRDBD.TTF
C:\Windows\Fonts\BASKVILL.TTF
C:\Windows\Fonts\BAUHS93.TTF
C:\Windows\Fonts\BELL.TTF
C:\Windows\Fonts\BELLB.TTF
C:\Windows\Fonts\BELLI.TTF
C:\Windows\Fonts\BERNHC.TTF
C:\Windows\Fonts\BKANT.TTF
C:\Windows\Fonts\BOD_B.TTF
C:\Windows\Fonts\BOD_BI.TTF
C:\Windows\Fonts\BOD_BLAI.TTF
C:\Windows\Fonts\BOD_BLAR.TTF
C:\Windows\Fonts\BOD_CB.TTF
C:\Windows\Fonts\BOD_CBI.TTF
C:\Windows\Fonts\BOD_CI.TTF
C:\Windows\Fonts\BOD_CR.TTF
C:\Windows\Fonts\BOD_I.TTF
C:\Windows\Fonts\BOD_PSTC.TTF
C:\Windows\Fonts\BOD_R.TTF
C:\Windows\Fonts\BRADHITC.TTF
C:\Windows\Fonts\BRITANIC.TTF
C:\Windows\Fonts\BRLNSB.TTF
C:\Windows\Fonts\BRLNSDB.TTF
C:\Windows\Fonts\BRLNSR.TTF
C:\Windows\Fonts\BROADW.TTF
C:\Windows\Fonts\BRUSHSCI.TTF
C:\Windows\Fonts\CALIFB.TTF
C:\Windows\Fonts\CALIFI.TTF
C:\Windows\Fonts\CALIFR.TTF
C:\Windows\Fonts\CALIST.TTF
C:\Windows\Fonts\CALISTB.TTF
C:\Windows\Fonts\CALISTBI.TTF
C:\Windows\Fonts\CALISTI.TTF
C:\Windows\Fonts\CASTELAR.TTF
C:\Windows\Fonts\CENSCBK.TTF
C:\Windows\Fonts\CENTAUR.TTF
C:\Windows\Fonts\CHILLER.TTF
C:\Windows\Fonts\COLONNA.TTF
C:\Windows\Fonts\COOPBL.TTF
C:\Windows\Fonts\COPRGTB.TTF
C:\Windows\Fonts\COPRGTL.TTF
C:\Windows\Fonts\CURLZ___.TTF
C:\Windows\Fonts\DUBAI-BOLD.TTF
C:\Windows\Fonts\DUBAI-LIGHT.TTF
C:\Windows\Fonts\DUBAI-MEDIUM.TTF
C:\Windows\Fonts\DUBAI-REGULAR.TTF
C:\Windows\Fonts\ELEPHNT.TTF
C:\Windows\Fonts\ELEPHNTI.TTF
C:\Windows\Fonts\ENGR.TTF
C:\Windows\Fonts\ERASBD.TTF
C:\Windows\Fonts\ERASDEMI.TTF
C:\Windows\Fonts\ERASLGHT.TTF
C:\Windows\Fonts\ERASMD.TTF
C:\Windows\Fonts\FELIXTI.TTF
C:\Windows\Fonts\FORTE.TTF
C:\Windows\Fonts\FRABK.TTF
C:\Windows\Fonts\FRABKIT.TTF
C:\Windows\Fonts\FRADM.TTF
C:\Windows\Fonts\FRADMCN.TTF
C:\Windows\Fonts\FRADMIT.TTF
C:\Windows\Fonts\FRAHV.TTF
C:\Windows\Fonts\FRAHVIT.TTF
C:\Windows\Fonts\FRAMDCN.TTF
C:\Windows\Fonts\FREESCPT.TTF
C:\Windows\Fonts\FRSCRIPT.TTF
C:\Windows\Fonts\FTLTLT.TTF
C:\Windows\Fonts\GADUGI.TTF
C:\Windows\Fonts\GADUGIB.TTF
C:\Windows\Fonts\GIGI.TTF
C:\Windows\Fonts\GILBI___.TTF
C:\Windows\Fonts\GILB____.TTF
C:\Windows\Fonts\GILC____.TTF
C:\Windows\Fonts\GILI____.TTF
C:\Windows\Fonts\GILLUBCD.TTF
C:\Windows\Fonts\GILSANUB.TTF
C:\Windows\Fonts\GIL_____.TTF
C:\Windows\Fonts\GLECB.TTF
C:\Windows\Fonts\GLSNECB.TTF
C:\Windows\Fonts\GOTHIC.TTF
C:\Windows\Fonts\GOTHICB.TTF
C:\Windows\Fonts\GOTHICBI.TTF
C:\Windows\Fonts\GOTHICI.TTF
C:\Windows\Fonts\GOUDOS.TTF
C:\Windows\Fonts\GOUDOSB.TTF
C:\Windows\Fonts\GOUDOSI.TTF
C:\Windows\Fonts\GOUDYSTO.TTF
C:\Windows\Fonts\HARLOWSI.TTF
C:\Windows\Fonts\HARNGTON.TTF
C:\Windows\Fonts\HATTEN.TTF
C:\Windows\Fonts\HTOWERT.TTF
C:\Windows\Fonts\HTOWERTI.TTF
C:\Windows\Fonts\IMPRISHA.TTF
C:\Windows\Fonts\INFROMAN.TTF
C:\Windows\Fonts\ITCBLKAD.TTF
C:\Windows\Fonts\ITCEDSCR.TTF
C:\Windows\Fonts\ITCKRIST.TTF
C:\Windows\Fonts\JOKERMAN.TTF
C:\Windows\Fonts\JUICE___.TTF
C:\Windows\Fonts\KUNSTLER.TTF
C:\Windows\Fonts\LATINWD.TTF
C:\Windows\Fonts\LBRITE.TTF
C:\Windows\Fonts\LBRITED.TTF
C:\Windows\Fonts\LBRITEDI.TTF
C:\Windows\Fonts\LBRITEI.TTF
C:\Windows\Fonts\LCALLIG.TTF
C:\Windows\Fonts\LFAX.TTF
C:\Windows\Fonts\LFAXD.TTF
C:\Windows\Fonts\LFAXDI.TTF
C:\Windows\Fonts\LFAXI.TTF
C:\Windows\Fonts\LHANDW.TTF
C:\Windows\Fonts\LSANS.TTF
C:\Windows\Fonts\LSANSD.TTF
C:\Windows\Fonts\LSANSDI.TTF
C:\Windows\Fonts\LSANSI.TTF
C:\Windows\Fonts\LTYPE.TTF
C:\Windows\Fonts\LTYPEB.TTF
C:\Windows\Fonts\LTYPEBO.TTF
C:\Windows\Fonts\LTYPEO.TTF
C:\Windows\Fonts\MAGNETOB.TTF
C:\Windows\Fonts\MAIAN.TTF
C:\Windows\Fonts\MATURASC.TTF
C:\Windows\Fonts\MISTRAL.TTF
C:\Windows\Fonts\MOD20.TTF
C:\Windows\Fonts\MSUIGHUB.TTF
C:\Windows\Fonts\MTCORSVA.TTF
C:\Windows\Fonts\NIAGENG.TTF
C:\Windows\Fonts\NIAGSOL.TTF
C:\Windows\Fonts\NIRMALA.TTF
C:\Windows\Fonts\NIRMALAB.TTF
C:\Windows\Fonts\OCRAEXT.TTF
C:\Windows\Fonts\OLDENGL.TTF
C:\Windows\Fonts\ONYX.TTF
C:\Windows\Fonts\PALSCRI.TTF
C:\Windows\Fonts\PAPYRUS.TTF
C:\Windows\Fonts\PARCHM.TTF
C:\Windows\Fonts\PERBI___.TTF
C:\Windows\Fonts\PERB____.TTF
C:\Windows\Fonts\PERI____.TTF
C:\Windows\Fonts\PERTIBD.TTF
C:\Windows\Fonts\PERTILI.TTF
C:\Windows\Fonts\PER_____.TTF
C:\Windows\Fonts\PLAYBILL.TTF
C:\Windows\Fonts\POORICH.TTF
C:\Windows\Fonts\PRISTINA.TTF
C:\Windows\Fonts\RAGE.TTF
C:\Windows\Fonts\RAVIE.TTF
C:\Windows\Fonts\ROCCB___.TTF
C:\Windows\Fonts\ROCC____.TTF
C:\Windows\Fonts\ROCK.TTF
C:\Windows\Fonts\ROCKB.TTF
C:\Windows\Fonts\ROCKBI.TTF
C:\Windows\Fonts\ROCKEB.TTF
C:\Windows\Fonts\ROCKI.TTF
C:\Windows\Fonts\SCHLBKB.TTF
C:\Windows\Fonts\SCHLBKBI.TTF
C:\Windows\Fonts\SCHLBKI.TTF
C:\Windows\Fonts\SCRIPTBL.TTF
C:\Windows\Fonts\SEGOEUISL.TTF
C:\Windows\Fonts\SHOWG.TTF
C:\Windows\Fonts\SNAP____.TTF
C:\Windows\Fonts\STENCIL.TTF
C:\Windows\Fonts\TCBI____.TTF
C:\Windows\Fonts\TCB_____.TTF
C:\Windows\Fonts\TCCB____.TTF
C:\Windows\Fonts\TCCEB.TTF
C:\Windows\Fonts\TCCM____.TTF
C:\Windows\Fonts\TCMI____.TTF
C:\Windows\Fonts\TCM_____.TTF
C:\Windows\Fonts\TEMPSITC.TTF
C:\Windows\Fonts\VINERITC.TTF
C:\Windows\Fonts\VIVALDII.TTF
C:\Windows\Fonts\VLADIMIR.TTF
C:\Windows\Fonts\MSJH.TTC
C:\Windows\Fonts\MSJHBD.TTC
C:\Windows\Fonts\MSYH.TTC
C:\Windows\Fonts\MSYHBD.TTC
C:\Windows\Fonts\ARIALUNI.TTF
C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\EQUATION\MTEXTRA.TTF
C:\Windows\Fonts\OUTLOOK.TTF
C:\Windows\Fonts\CENTURY.TTF
C:\Windows\Fonts\cambria.ttc
C:\Windows\Fonts\Candara.ttf
C:\Windows\Fonts\consola.ttf
C:\Windows\Fonts\constan.ttf
C:\Windows\Fonts\corbel.ttf
C:\Windows\Fonts\WINGDNG2.TTF
C:\Windows\Fonts\WINGDNG3.TTF
C:\Windows\Fonts\GARA.TTF
C:\Windows\Fonts\BOOKOS.TTF
C:\Windows\Fonts\cambriab.ttf
C:\Windows\Fonts\cambriai.ttf
C:\Windows\Fonts\cambriaz.ttf
C:\Windows\Fonts\Candarab.ttf
C:\Windows\Fonts\Candarai.ttf
C:\Windows\Fonts\Candaraz.ttf
C:\Windows\Fonts\consolab.ttf
C:\Windows\Fonts\consolai.ttf
C:\Windows\Fonts\consolaz.ttf
C:\Windows\Fonts\constanb.ttf
C:\Windows\Fonts\constani.ttf
C:\Windows\Fonts\constanz.ttf
C:\Windows\Fonts\corbelb.ttf
C:\Windows\Fonts\corbeli.ttf
C:\Windows\Fonts\corbelz.ttf
C:\Windows\Fonts\BSSYM7.TTF
C:\Windows\Fonts\REFSAN.TTF
C:\Windows\Fonts\REFSPCL.TTF
C:\Windows\Fonts\GARABD.TTF
C:\Windows\Fonts\GARAIT.TTF
C:\Windows\Fonts\BOOKOSB.TTF
C:\Windows\Fonts\BOOKOSBI.TTF
C:\Windows\Fonts\BOOKOSI.TTF
C:\Windows\Microsoft.Net\assembly\GAC_32\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Xml.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.Linq.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\SWuwjRQZOu.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\SWuwjRQZOu.resources\SWuwjRQZOu.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\SWuwjRQZOu.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en-US\SWuwjRQZOu.resources\SWuwjRQZOu.resources.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
C:\Users\Rebecca\AppData\Local\Temp\en\SWuwjRQZOu.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en\SWuwjRQZOu.resources\SWuwjRQZOu.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en\SWuwjRQZOu.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en\SWuwjRQZOu.resources\SWuwjRQZOu.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en-US\Lazarus.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\Lazarus.resources\Lazarus.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\Lazarus.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en-US\Lazarus.resources\Lazarus.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en\Lazarus.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en\Lazarus.resources\Lazarus.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en\Lazarus.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en\Lazarus.resources\Lazarus.resources.exe
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll
C:\Users\Rebecca\AppData\Roaming\SPjfKyKDmOO.exe
C:\Users\Rebecca\AppData\Local\Temp\tmp3B3.tmp
\??\MountPointManager
\Device\KsecDD
C:\Windows\System32\Tasks
C:\Windows\System32\Tasks\*
C:\Windows\System32\Tasks\AutoKMS
C:\Windows\System32\Tasks\Updates\SPjfKyKDmOO
C:\Windows\System32\Tasks\Updates
C:\Windows\System32\Tasks\Updates\
C:\Windows\Temp\fwtsqmfile00.sqm
C:\Windows\assembly\NativeImages_v4.0.30319_32\NrwkrktcBnmf019d89a#\*
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll
C:\Windows\System32\wbem\wbemdisp.tlb
C:\Windows\System32\en-US\KERNELBASE.dll.mui
C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\CustomMarshalers\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\CustomMarshalers\dde965f45fc6933d4ad380bea5e0438d\CustomMarshalers.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\CustomMarshalers\dde965f45fc6933d4ad380bea5e0438d\CustomMarshalers.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll.config
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d3e15922b03ec29aed46615adda73f3d\System.Management.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d3e15922b03ec29aed46615adda73f3d\System.Management.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\wminet_utils.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll
C:\%insfolder%\%insname%
C:\Users\Rebecca\AppData\Local\liebao\User Data
C:\Users\Rebecca\AppData\Roaming\Opera Software\Opera Stable
C:\Users\Rebecca\AppData\Local\Elements Browser\User Data
C:\Users\Rebecca\AppData\Local\QIP Surf\User Data
C:\Users\Rebecca\AppData\Local\Kometa\User Data
C:\Users\Rebecca\AppData\Local\Torch\User Data
C:\Users\Rebecca\AppData\Local\360Chrome\Chrome\User Data
C:\Users\Rebecca\AppData\Local\Yandex\YandexBrowser\User Data
C:\Users\Rebecca\AppData\Local\Iridium\User Data
C:\Users\Rebecca\AppData\Local\Comodo\Dragon\User Data
C:\Users\Rebecca\AppData\Local\CentBrowser\User Data
C:\Users\Rebecca\AppData\Local\7Star\7Star\User Data
C:\Users\Rebecca\AppData\Local\Chromium\User Data
C:\Users\Rebecca\AppData\Local\Epic Privacy Browser\User Data
C:\Users\Rebecca\AppData\Local\Chedot\User Data
C:\Users\Rebecca\AppData\Local\BraveSoftware\Brave-Browser\User Data
C:\Users\Rebecca\AppData\Local\Vivaldi\User Data
C:\Users\Rebecca\AppData\Local\uCozMedia\Uran\User Data
C:\Users\Rebecca\AppData\Local\MapleStudio\ChromePlus\User Data
C:\Users\Rebecca\AppData\Local\CocCoc\Browser\User Data
C:\Users\Rebecca\AppData\Local\Amigo\User Data
C:\Users\Rebecca\AppData\Local\UCBrowser\*
C:\Users\Rebecca\AppData\Roaming\Flock\Browser\profiles.ini
C:\Storage\
C:\mail\
C:\Users\Rebecca\AppData\Local\VirtualStore\Program Files\Foxmail\mail\
C:\Users\Rebecca\AppData\Local\VirtualStore\Program Files (x86)\Foxmail\mail\
C:\Users\Rebecca\AppData\Roaming\Waterfox\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Claws-mail
C:\Users\Rebecca\AppData\Roaming\Claws-mail\clawsrc
C:\Users\Rebecca\AppData\Roaming\Comodo\IceDragon\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\48wgv2fv.default\logins.json
C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\48wgv2fv.default\key4.db
C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\48wgv2fv.default\signons.sqlite
C:\Users\Rebecca\AppData\Roaming\Moonchild Productions\Pale Moon\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Pocomail\accounts.ini
C:\Users\Rebecca\AppData\Local\Microsoft\Edge\User Data
C:\Users\Rebecca\AppData\Local\Temp\vaultcli.dll
C:\Windows\System32\tzres.dll
C:\Windows\System32\en-US\tzres.dll.mui
C:\Program Files\Common Files\Apple\Apple Application Support\plutil.exe
C:\Users\Rebecca\AppData\Roaming\Thunderbird\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Trillian\users\global\accounts.dat
C:\Users\Rebecca\AppData\Roaming\Mozilla\icecat\profiles.ini
C:\Users\Rebecca\AppData\Local\falkon\profiles\profiles.ini
C:\Users\Rebecca\AppData\Roaming\The Bat!
C:\Users\Rebecca\AppData\Roaming\K-Meleon\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Opera Mail\Opera Mail\wand.dat
C:\Users\Rebecca\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
C:\Users\Rebecca\AppData\Local\Tencent\QQBrowser\User Data
C:\Users\Rebecca\AppData\Local\Tencent\QQBrowser\User Data\Default\EncryptedStorage
C:\Users\Rebecca\AppData\Local\Google\Chrome\User Data\
C:\Users\Rebecca\AppData\Local\Google\Chrome\User Data\*
C:\Users\Rebecca\AppData\Local\Google\Chrome\User Data\Default\Login Data
C:\Users\Rebecca\AppData\Local\Google\Chrome\User Data\Login Data
C:\Users\Rebecca\AppData\Roaming\Postbox\profiles.ini
C:\Users\Rebecca\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Mozilla\SeaMonkey\profiles.ini
C:\Windows\System32\en-US\VssTrace.DLL.mui
\??\PIPE\samr
C:\DosDevices\pipe\
C:\Windows\System32\wbem\repository
C:\Windows\System32\wbem\Logs
C:\Windows\System32\wbem\AutoRecover
C:\Windows\System32\wbem\MOF
C:\Windows\System32\wbem\repository\INDEX.BTR
C:\Windows\System32\wbem\repository\WRITABLE.TST
C:\Windows\System32\wbem\repository\MAPPING1.MAP
C:\Windows\System32\wbem\repository\MAPPING2.MAP
C:\Windows\System32\wbem\repository\MAPPING3.MAP
C:\Windows\System32\wbem\repository\OBJECTS.DATA
\??\pipe\PIPE_EVENTROOT\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER
\??\pipe\PIPE_EVENTROOT\CIMV2PROVIDERSUBSYSTEM
C:\Windows\Temp
C:\Windows\System32\LogFiles\Scm\a1cfa52f-06f2-418d-addb-cd6456d66f43
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Rebecca\AppData\Local\Temp\payment.exe.config
C:\Users\Rebecca\AppData\Local\Temp\payment.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Windows\System32\MSVCR120_CLR0400.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
C:\Windows\assembly\pubpol224.dat
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2f61c87db96dbe27deea0e525a665761\System.Configuration.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2f61c87db96dbe27deea0e525a665761\System.Configuration.ni.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\SortDefault.nlp
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\a3abb36b9f9e867b09bb3a670b074c45\System.Xml.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\a3abb36b9f9e867b09bb3a670b074c45\System.Xml.ni.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\GdiPlus.dll
C:\Users\Rebecca\AppData\Local\GDIPFONTCACHEV1.DAT
C:\Windows\Fonts\marlett.ttf
C:\Windows\Fonts\arial.ttf
C:\Windows\Fonts\ariali.ttf
C:\Windows\Fonts\arialbd.ttf
C:\Windows\Fonts\arialbi.ttf
C:\Windows\Fonts\batang.ttc
C:\Windows\Fonts\cour.ttf
C:\Windows\Fonts\couri.ttf
C:\Windows\Fonts\courbd.ttf
C:\Windows\Fonts\courbi.ttf
C:\Windows\Fonts\daunpenh.ttf
C:\Windows\Fonts\dokchamp.ttf
C:\Windows\Fonts\estre.ttf
C:\Windows\Fonts\euphemia.ttf
C:\Windows\Fonts\gautami.ttf
C:\Windows\Fonts\gautamib.ttf
C:\Windows\Fonts\Vani.ttf
C:\Windows\Fonts\Vanib.ttf
C:\Windows\Fonts\gulim.ttc
C:\Windows\Fonts\impact.ttf
C:\Windows\Fonts\iskpota.ttf
C:\Windows\Fonts\iskpotab.ttf
C:\Windows\Fonts\kalinga.ttf
C:\Windows\Fonts\kalingab.ttf
C:\Windows\Fonts\kartika.ttf
C:\Windows\Fonts\kartikab.ttf
C:\Windows\Fonts\KhmerUI.ttf
C:\Windows\Fonts\KhmerUIb.ttf
C:\Windows\Fonts\LaoUI.ttf
C:\Windows\Fonts\LaoUIb.ttf
C:\Windows\Fonts\latha.ttf
C:\Windows\Fonts\lathab.ttf
C:\Windows\Fonts\lucon.ttf
C:\Windows\Fonts\malgun.ttf
C:\Windows\Fonts\malgunbd.ttf
C:\Windows\Fonts\mangal.ttf
C:\Windows\Fonts\mangalb.ttf
C:\Windows\Fonts\meiryo.ttc
C:\Windows\Fonts\meiryob.ttc
C:\Windows\Fonts\himalaya.ttf
C:\Windows\Fonts\msjh.ttf
C:\Windows\Fonts\msjhbd.ttf
C:\Windows\Fonts\msyh.ttf
C:\Windows\Fonts\msyhbd.ttf
C:\Windows\Fonts\mingliu.ttc
C:\Windows\Fonts\mingliub.ttc
C:\Windows\Fonts\monbaiti.ttf
C:\Windows\Fonts\msgothic.ttc
C:\Windows\Fonts\msmincho.ttc
C:\Windows\Fonts\mvboli.ttf
C:\Windows\Fonts\ntailu.ttf
C:\Windows\Fonts\ntailub.ttf
C:\Windows\Fonts\nyala.ttf
C:\Windows\Fonts\phagspa.ttf
C:\Windows\Fonts\phagspab.ttf
C:\Windows\Fonts\plantc.ttf
C:\Windows\Fonts\raavi.ttf
C:\Windows\Fonts\raavib.ttf
C:\Windows\Fonts\segoesc.ttf
C:\Windows\Fonts\segoescb.ttf
C:\Windows\Fonts\segoeui.ttf
C:\Windows\Fonts\segoeuib.ttf
C:\Windows\Fonts\segoeuii.ttf
C:\Windows\Fonts\segoeuiz.ttf
C:\Windows\Fonts\seguisb.ttf
C:\Windows\Fonts\segoeuil.ttf
C:\Windows\Fonts\seguisym.ttf
C:\Windows\Fonts\shruti.ttf
C:\Windows\Fonts\shrutib.ttf
C:\Windows\Fonts\simsun.ttc
C:\Windows\Fonts\simsunb.ttf
C:\Windows\Fonts\sylfaen.ttf
C:\Windows\Fonts\taile.ttf
C:\Windows\Fonts\taileb.ttf
C:\Windows\Fonts\times.ttf
C:\Windows\Fonts\timesi.ttf
C:\Windows\Fonts\timesbd.ttf
C:\Windows\Fonts\timesbi.ttf
C:\Windows\Fonts\tunga.ttf
C:\Windows\Fonts\tungab.ttf
C:\Windows\Fonts\vrinda.ttf
C:\Windows\Fonts\vrindab.ttf
C:\Windows\Fonts\Shonar.ttf
C:\Windows\Fonts\Shonarb.ttf
C:\Windows\Fonts\msyi.ttf
C:\Windows\Fonts\tahoma.ttf
C:\Windows\Fonts\tahomabd.ttf
C:\Windows\Fonts\micross.ttf
C:\Windows\Fonts\angsa.ttf
C:\Windows\Fonts\angsai.ttf
C:\Windows\Fonts\angsab.ttf
C:\Windows\Fonts\angsaz.ttf
C:\Windows\Fonts\aparaj.ttf
C:\Windows\Fonts\aparajb.ttf
C:\Windows\Fonts\aparajbi.ttf
C:\Windows\Fonts\aparaji.ttf
C:\Windows\Fonts\cordia.ttf
C:\Windows\Fonts\cordiai.ttf
C:\Windows\Fonts\cordiab.ttf
C:\Windows\Fonts\cordiaz.ttf
C:\Windows\Fonts\ebrima.ttf
C:\Windows\Fonts\ebrimabd.ttf
C:\Windows\Fonts\gisha.ttf
C:\Windows\Fonts\gishabd.ttf
C:\Windows\Fonts\kokila.ttf
C:\Windows\Fonts\kokilab.ttf
C:\Windows\Fonts\kokilabi.ttf
C:\Windows\Fonts\kokilai.ttf
C:\Windows\Fonts\leelawad.ttf
C:\Windows\Fonts\leelawdb.ttf
C:\Windows\Fonts\msuighur.ttf
C:\Windows\Fonts\moolbor.ttf
C:\Windows\Fonts\symbol.ttf
C:\Windows\Fonts\utsaah.ttf
C:\Windows\Fonts\utsaahb.ttf
C:\Windows\Fonts\utsaahbi.ttf
C:\Windows\Fonts\utsaahi.ttf
C:\Windows\Fonts\vijaya.ttf
C:\Windows\Fonts\vijayab.ttf
C:\Windows\Fonts\wingding.ttf
C:\Windows\Fonts\modern.fon
C:\Windows\Fonts\roman.fon
C:\Windows\Fonts\script.fon
C:\Windows\Fonts\andlso.ttf
C:\Windows\Fonts\arabtype.ttf
C:\Windows\Fonts\simpo.ttf
C:\Windows\Fonts\simpbdo.ttf
C:\Windows\Fonts\simpfxo.ttf
C:\Windows\Fonts\majalla.ttf
C:\Windows\Fonts\majallab.ttf
C:\Windows\Fonts\trado.ttf
C:\Windows\Fonts\tradbdo.ttf
C:\Windows\Fonts\ahronbd.ttf
C:\Windows\Fonts\david.ttf
C:\Windows\Fonts\davidbd.ttf
C:\Windows\Fonts\frank.ttf
C:\Windows\Fonts\lvnm.ttf
C:\Windows\Fonts\lvnmbd.ttf
C:\Windows\Fonts\mriam.ttf
C:\Windows\Fonts\mriamc.ttf
C:\Windows\Fonts\nrkis.ttf
C:\Windows\Fonts\rod.ttf
C:\Windows\Fonts\simfang.ttf
C:\Windows\Fonts\simhei.ttf
C:\Windows\Fonts\simkai.ttf
C:\Windows\Fonts\angsau.ttf
C:\Windows\Fonts\angsaui.ttf
C:\Windows\Fonts\angsaub.ttf
C:\Windows\Fonts\angsauz.ttf
C:\Windows\Fonts\browa.ttf
C:\Windows\Fonts\browai.ttf
C:\Windows\Fonts\browab.ttf
C:\Windows\Fonts\browaz.ttf
C:\Windows\Fonts\browau.ttf
C:\Windows\Fonts\browaui.ttf
C:\Windows\Fonts\browaub.ttf
C:\Windows\Fonts\browauz.ttf
C:\Windows\Fonts\cordiau.ttf
C:\Windows\Fonts\cordiaub.ttf
C:\Windows\Fonts\cordiauz.ttf
C:\Windows\Fonts\cordiaui.ttf
C:\Windows\Fonts\upcdl.ttf
C:\Windows\Fonts\upcdi.ttf
C:\Windows\Fonts\upcdb.ttf
C:\Windows\Fonts\upcdbi.ttf
C:\Windows\Fonts\upcel.ttf
C:\Windows\Fonts\upcei.ttf
C:\Windows\Fonts\upceb.ttf
C:\Windows\Fonts\upcebi.ttf
C:\Windows\Fonts\upcfl.ttf
C:\Windows\Fonts\upcfi.ttf
C:\Windows\Fonts\upcfb.ttf
C:\Windows\Fonts\upcfbi.ttf
C:\Windows\Fonts\upcil.ttf
C:\Windows\Fonts\upcii.ttf
C:\Windows\Fonts\upcib.ttf
C:\Windows\Fonts\upcibi.ttf
C:\Windows\Fonts\upcjl.ttf
C:\Windows\Fonts\upcji.ttf
C:\Windows\Fonts\upcjb.ttf
C:\Windows\Fonts\upcjbi.ttf
C:\Windows\Fonts\upckl.ttf
C:\Windows\Fonts\upcki.ttf
C:\Windows\Fonts\upckb.ttf
C:\Windows\Fonts\upckbi.ttf
C:\Windows\Fonts\upcll.ttf
C:\Windows\Fonts\upcli.ttf
C:\Windows\Fonts\upclb.ttf
C:\Windows\Fonts\upclbi.ttf
C:\Windows\Fonts\kaiu.ttf
C:\Windows\Fonts\l_10646.ttf
C:\Windows\Fonts\ariblk.ttf
C:\Windows\Fonts\calibri.ttf
C:\Windows\Fonts\calibrii.ttf
C:\Windows\Fonts\calibrib.ttf
C:\Windows\Fonts\calibriz.ttf
C:\Windows\Fonts\comic.ttf
C:\Windows\Fonts\comicbd.ttf
C:\Windows\Fonts\framd.ttf
C:\Windows\Fonts\framdit.ttf
C:\Windows\Fonts\Gabriola.ttf
C:\Windows\Fonts\georgia.ttf
C:\Windows\Fonts\georgiai.ttf
C:\Windows\Fonts\georgiab.ttf
C:\Windows\Fonts\georgiaz.ttf
C:\Windows\Fonts\pala.ttf
C:\Windows\Fonts\palai.ttf
C:\Windows\Fonts\palab.ttf
C:\Windows\Fonts\palabi.ttf
C:\Windows\Fonts\segoepr.ttf
C:\Windows\Fonts\segoeprb.ttf
C:\Windows\Fonts\trebuc.ttf
C:\Windows\Fonts\trebucit.ttf
C:\Windows\Fonts\trebucbd.ttf
C:\Windows\Fonts\trebucbi.ttf
C:\Windows\Fonts\verdana.ttf
C:\Windows\Fonts\verdanai.ttf
C:\Windows\Fonts\verdanab.ttf
C:\Windows\Fonts\verdanaz.ttf
C:\Windows\Fonts\webdings.ttf
C:\Windows\Fonts\coure.fon
C:\Windows\Fonts\serife.fon
C:\Windows\Fonts\sserife.fon
C:\Windows\Fonts\smalle.fon
C:\Windows\Fonts\smallf.fon
C:\Windows\Fonts\CALIBRILI.TTF
C:\Windows\Fonts\calibril.ttf
C:\Windows\Fonts\AGENCYB.TTF
C:\Windows\Fonts\AGENCYR.TTF
C:\Windows\Fonts\ALGER.TTF
C:\Windows\Fonts\ANTQUAB.TTF
C:\Windows\Fonts\ANTQUABI.TTF
C:\Windows\Fonts\ANTQUAI.TTF
C:\Windows\Fonts\ARIALN.TTF
C:\Windows\Fonts\ARIALNB.TTF
C:\Windows\Fonts\ARIALNBI.TTF
C:\Windows\Fonts\ARIALNI.TTF
C:\Windows\Fonts\ARLRDBD.TTF
C:\Windows\Fonts\BASKVILL.TTF
C:\Windows\Fonts\BAUHS93.TTF
C:\Windows\Fonts\BELL.TTF
C:\Windows\Fonts\BELLB.TTF
C:\Windows\Fonts\BELLI.TTF
C:\Windows\Fonts\BERNHC.TTF
C:\Windows\Fonts\BKANT.TTF
C:\Windows\Fonts\BOD_B.TTF
C:\Windows\Fonts\BOD_BI.TTF
C:\Windows\Fonts\BOD_BLAI.TTF
C:\Windows\Fonts\BOD_BLAR.TTF
C:\Windows\Fonts\BOD_CB.TTF
C:\Windows\Fonts\BOD_CBI.TTF
C:\Windows\Fonts\BOD_CI.TTF
C:\Windows\Fonts\BOD_CR.TTF
C:\Windows\Fonts\BOD_I.TTF
C:\Windows\Fonts\BOD_PSTC.TTF
C:\Windows\Fonts\BOD_R.TTF
C:\Windows\Fonts\BRADHITC.TTF
C:\Windows\Fonts\BRITANIC.TTF
C:\Windows\Fonts\BRLNSB.TTF
C:\Windows\Fonts\BRLNSDB.TTF
C:\Windows\Fonts\BRLNSR.TTF
C:\Windows\Fonts\BROADW.TTF
C:\Windows\Fonts\BRUSHSCI.TTF
C:\Windows\Fonts\CALIFB.TTF
C:\Windows\Fonts\CALIFI.TTF
C:\Windows\Fonts\CALIFR.TTF
C:\Windows\Fonts\CALIST.TTF
C:\Windows\Fonts\CALISTB.TTF
C:\Windows\Fonts\CALISTBI.TTF
C:\Windows\Fonts\CALISTI.TTF
C:\Windows\Fonts\CASTELAR.TTF
C:\Windows\Fonts\CENSCBK.TTF
C:\Windows\Fonts\CENTAUR.TTF
C:\Windows\Fonts\CHILLER.TTF
C:\Windows\Fonts\COLONNA.TTF
C:\Windows\Fonts\COOPBL.TTF
C:\Windows\Fonts\COPRGTB.TTF
C:\Windows\Fonts\COPRGTL.TTF
C:\Windows\Fonts\CURLZ___.TTF
C:\Windows\Fonts\DUBAI-BOLD.TTF
C:\Windows\Fonts\DUBAI-LIGHT.TTF
C:\Windows\Fonts\DUBAI-MEDIUM.TTF
C:\Windows\Fonts\DUBAI-REGULAR.TTF
C:\Windows\Fonts\ELEPHNT.TTF
C:\Windows\Fonts\ELEPHNTI.TTF
C:\Windows\Fonts\ENGR.TTF
C:\Windows\Fonts\ERASBD.TTF
C:\Windows\Fonts\ERASDEMI.TTF
C:\Windows\Fonts\ERASLGHT.TTF
C:\Windows\Fonts\ERASMD.TTF
C:\Windows\Fonts\FELIXTI.TTF
C:\Windows\Fonts\FORTE.TTF
C:\Windows\Fonts\FRABK.TTF
C:\Windows\Fonts\FRABKIT.TTF
C:\Windows\Fonts\FRADM.TTF
C:\Windows\Fonts\FRADMCN.TTF
C:\Windows\Fonts\FRADMIT.TTF
C:\Windows\Fonts\FRAHV.TTF
C:\Windows\Fonts\FRAHVIT.TTF
C:\Windows\Fonts\FRAMDCN.TTF
C:\Windows\Fonts\FREESCPT.TTF
C:\Windows\Fonts\FRSCRIPT.TTF
C:\Windows\Fonts\FTLTLT.TTF
C:\Windows\Fonts\GADUGI.TTF
C:\Windows\Fonts\GADUGIB.TTF
C:\Windows\Fonts\GIGI.TTF
C:\Windows\Fonts\GILBI___.TTF
C:\Windows\Fonts\GILB____.TTF
C:\Windows\Fonts\GILC____.TTF
C:\Windows\Fonts\GILI____.TTF
C:\Windows\Fonts\GILLUBCD.TTF
C:\Windows\Fonts\GILSANUB.TTF
C:\Windows\Fonts\GIL_____.TTF
C:\Windows\Fonts\GLECB.TTF
C:\Windows\Fonts\GLSNECB.TTF
C:\Windows\Fonts\GOTHIC.TTF
C:\Windows\Fonts\GOTHICB.TTF
C:\Windows\Fonts\GOTHICBI.TTF
C:\Windows\Fonts\GOTHICI.TTF
C:\Windows\Fonts\GOUDOS.TTF
C:\Windows\Fonts\GOUDOSB.TTF
C:\Windows\Fonts\GOUDOSI.TTF
C:\Windows\Fonts\GOUDYSTO.TTF
C:\Windows\Fonts\HARLOWSI.TTF
C:\Windows\Fonts\HARNGTON.TTF
C:\Windows\Fonts\HATTEN.TTF
C:\Windows\Fonts\HTOWERT.TTF
C:\Windows\Fonts\HTOWERTI.TTF
C:\Windows\Fonts\IMPRISHA.TTF
C:\Windows\Fonts\INFROMAN.TTF
C:\Windows\Fonts\ITCBLKAD.TTF
C:\Windows\Fonts\ITCEDSCR.TTF
C:\Windows\Fonts\ITCKRIST.TTF
C:\Windows\Fonts\JOKERMAN.TTF
C:\Windows\Fonts\JUICE___.TTF
C:\Windows\Fonts\KUNSTLER.TTF
C:\Windows\Fonts\LATINWD.TTF
C:\Windows\Fonts\LBRITE.TTF
C:\Windows\Fonts\LBRITED.TTF
C:\Windows\Fonts\LBRITEDI.TTF
C:\Windows\Fonts\LBRITEI.TTF
C:\Windows\Fonts\LCALLIG.TTF
C:\Windows\Fonts\LFAX.TTF
C:\Windows\Fonts\LFAXD.TTF
C:\Windows\Fonts\LFAXDI.TTF
C:\Windows\Fonts\LFAXI.TTF
C:\Windows\Fonts\LHANDW.TTF
C:\Windows\Fonts\LSANS.TTF
C:\Windows\Fonts\LSANSD.TTF
C:\Windows\Fonts\LSANSDI.TTF
C:\Windows\Fonts\LSANSI.TTF
C:\Windows\Fonts\LTYPE.TTF
C:\Windows\Fonts\LTYPEB.TTF
C:\Windows\Fonts\LTYPEBO.TTF
C:\Windows\Fonts\LTYPEO.TTF
C:\Windows\Fonts\MAGNETOB.TTF
C:\Windows\Fonts\MAIAN.TTF
C:\Windows\Fonts\MATURASC.TTF
C:\Windows\Fonts\MISTRAL.TTF
C:\Windows\Fonts\MOD20.TTF
C:\Windows\Fonts\MSUIGHUB.TTF
C:\Windows\Fonts\MTCORSVA.TTF
C:\Windows\Fonts\NIAGENG.TTF
C:\Windows\Fonts\NIAGSOL.TTF
C:\Windows\Fonts\NIRMALA.TTF
C:\Windows\Fonts\NIRMALAB.TTF
C:\Windows\Fonts\OCRAEXT.TTF
C:\Windows\Fonts\OLDENGL.TTF
C:\Windows\Fonts\ONYX.TTF
C:\Windows\Fonts\PALSCRI.TTF
C:\Windows\Fonts\PAPYRUS.TTF
C:\Windows\Fonts\PARCHM.TTF
C:\Windows\Fonts\PERBI___.TTF
C:\Windows\Fonts\PERB____.TTF
C:\Windows\Fonts\PERI____.TTF
C:\Windows\Fonts\PERTIBD.TTF
C:\Windows\Fonts\PERTILI.TTF
C:\Windows\Fonts\PER_____.TTF
C:\Windows\Fonts\PLAYBILL.TTF
C:\Windows\Fonts\POORICH.TTF
C:\Windows\Fonts\PRISTINA.TTF
C:\Windows\Fonts\RAGE.TTF
C:\Windows\Fonts\RAVIE.TTF
C:\Windows\Fonts\ROCCB___.TTF
C:\Windows\Fonts\ROCC____.TTF
C:\Windows\Fonts\ROCK.TTF
C:\Windows\Fonts\ROCKB.TTF
C:\Windows\Fonts\ROCKBI.TTF
C:\Windows\Fonts\ROCKEB.TTF
C:\Windows\Fonts\ROCKI.TTF
C:\Windows\Fonts\SCHLBKB.TTF
C:\Windows\Fonts\SCHLBKBI.TTF
C:\Windows\Fonts\SCHLBKI.TTF
C:\Windows\Fonts\SCRIPTBL.TTF
C:\Windows\Fonts\SEGOEUISL.TTF
C:\Windows\Fonts\SHOWG.TTF
C:\Windows\Fonts\SNAP____.TTF
C:\Windows\Fonts\STENCIL.TTF
C:\Windows\Fonts\TCBI____.TTF
C:\Windows\Fonts\TCB_____.TTF
C:\Windows\Fonts\TCCB____.TTF
C:\Windows\Fonts\TCCEB.TTF
C:\Windows\Fonts\TCCM____.TTF
C:\Windows\Fonts\TCMI____.TTF
C:\Windows\Fonts\TCM_____.TTF
C:\Windows\Fonts\TEMPSITC.TTF
C:\Windows\Fonts\VINERITC.TTF
C:\Windows\Fonts\VIVALDII.TTF
C:\Windows\Fonts\VLADIMIR.TTF
C:\Windows\Fonts\MSJH.TTC
C:\Windows\Fonts\MSJHBD.TTC
C:\Windows\Fonts\MSYH.TTC
C:\Windows\Fonts\MSYHBD.TTC
C:\Windows\Fonts\ARIALUNI.TTF
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\EQUATION\MTEXTRA.TTF
C:\Windows\Fonts\OUTLOOK.TTF
C:\Windows\Fonts\CENTURY.TTF
C:\Windows\Fonts\cambria.ttc
C:\Windows\Fonts\Candara.ttf
C:\Windows\Fonts\consola.ttf
C:\Windows\Fonts\constan.ttf
C:\Windows\Fonts\corbel.ttf
C:\Windows\Fonts\WINGDNG2.TTF
C:\Windows\Fonts\WINGDNG3.TTF
C:\Windows\Fonts\GARA.TTF
C:\Windows\Fonts\BOOKOS.TTF
C:\Windows\Fonts\cambriab.ttf
C:\Windows\Fonts\cambriai.ttf
C:\Windows\Fonts\cambriaz.ttf
C:\Windows\Fonts\Candarab.ttf
C:\Windows\Fonts\Candarai.ttf
C:\Windows\Fonts\Candaraz.ttf
C:\Windows\Fonts\consolab.ttf
C:\Windows\Fonts\consolai.ttf
C:\Windows\Fonts\consolaz.ttf
C:\Windows\Fonts\constanb.ttf
C:\Windows\Fonts\constani.ttf
C:\Windows\Fonts\constanz.ttf
C:\Windows\Fonts\corbelb.ttf
C:\Windows\Fonts\corbeli.ttf
C:\Windows\Fonts\corbelz.ttf
C:\Windows\Fonts\BSSYM7.TTF
C:\Windows\Fonts\REFSAN.TTF
C:\Windows\Fonts\REFSPCL.TTF
C:\Windows\Fonts\GARABD.TTF
C:\Windows\Fonts\GARAIT.TTF
C:\Windows\Fonts\BOOKOSB.TTF
C:\Windows\Fonts\BOOKOSBI.TTF
C:\Windows\Fonts\BOOKOSI.TTF
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
C:\Users\Rebecca\AppData\Local\Temp\tmp3B3.tmp
\Device\KsecDD
C:\Windows\Temp\fwtsqmfile00.sqm
C:\Windows\System32\wbem\wbemdisp.tlb
C:\Windows\System32\en-US\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v4.0.30319_32\CustomMarshalers\dde965f45fc6933d4ad380bea5e0438d\CustomMarshalers.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\CustomMarshalers\dde965f45fc6933d4ad380bea5e0438d\CustomMarshalers.ni.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll.config
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d3e15922b03ec29aed46615adda73f3d\System.Management.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d3e15922b03ec29aed46615adda73f3d\System.Management.ni.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\wminet_utils.dll
C:\Users\Rebecca\AppData\Roaming\Flock\Browser\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Waterfox\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Comodo\IceDragon\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\48wgv2fv.default\key4.db
C:\Users\Rebecca\AppData\Roaming\Moonchild Productions\Pale Moon\profiles.ini
C:\Windows\System32\tzres.dll
C:\Windows\System32\en-US\tzres.dll.mui
C:\Users\Rebecca\AppData\Roaming\Thunderbird\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Mozilla\icecat\profiles.ini
C:\Users\Rebecca\AppData\Local\falkon\profiles\profiles.ini
C:\Users\Rebecca\AppData\Roaming\K-Meleon\profiles.ini
C:\Users\Rebecca\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
C:\Users\Rebecca\AppData\Local\Google\Chrome\User Data\Default\Login Data
C:\Users\Rebecca\AppData\Roaming\Postbox\profiles.ini
C:\Users\Rebecca\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Mozilla\SeaMonkey\profiles.ini
C:\Windows\System32\en-US\VssTrace.DLL.mui
\??\PIPE\samr
C:\Windows\System32\wbem\repository\MAPPING1.MAP
C:\Windows\System32\wbem\repository\MAPPING2.MAP
C:\Windows\System32\wbem\repository\MAPPING3.MAP
C:\Windows\System32\wbem\repository\OBJECTS.DATA
C:\Windows\System32\wbem\repository\INDEX.BTR
\??\pipe\PIPE_EVENTROOT\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER
\??\pipe\PIPE_EVENTROOT\CIMV2PROVIDERSUBSYSTEM
C:\Windows\System32\LogFiles\Scm\a1cfa52f-06f2-418d-addb-cd6456d66f43
C:\Users\Rebecca\AppData\Local\GDIPFONTCACHEV1.DAT
C:\Users\Rebecca\AppData\Roaming\SPjfKyKDmOO.exe
C:\Users\Rebecca\AppData\Local\Temp\tmp3B3.tmp
C:\Windows\Temp\fwtsqmfile00.sqm
\??\PIPE\samr
C:\Windows\System32\wbem\repository\WRITABLE.TST
C:\Windows\System32\wbem\repository\MAPPING1.MAP
C:\Windows\System32\wbem\repository\MAPPING2.MAP
C:\Windows\System32\wbem\repository\MAPPING3.MAP
C:\Windows\System32\wbem\repository\OBJECTS.DATA
C:\Windows\System32\wbem\repository\INDEX.BTR
\??\pipe\PIPE_EVENTROOT\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER
\??\pipe\PIPE_EVENTROOT\CIMV2PROVIDERSUBSYSTEM
C:\Users\Rebecca\AppData\Local\Temp\tmp3B3.tmp
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Standards\v4.0.30319
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v4.0.30319\SKUs\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\SKUs\default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\payment.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseRetryAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseMillisecondsBetweenRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\NGen\Policy\v4.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\NGen\Policy\v4.0\OptimizeUsedBinaries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Servicing
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\00060101.00060101
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\FeatureSIMD
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AltJit
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index224
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AppContext
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Numerics__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Numerics__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Data.SqlXml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Data.SqlXml__b77a5c561934e089
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-479431668-4257340731-3059248302-1002
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name
\x71d0\x154EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
HKEY_CURRENT_USER\Software\Microsoft\GDIPlus
HKEY_CURRENT_USER\Software\Microsoft\GDIPlus\FontCachePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
HKEY_CURRENT_USER\EUDC\1252
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml.Linq__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml.Linq__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-479431668-4257340731-3059248302-1002\Installer\Assemblies\C:|Users|Rebecca|AppData|Local|Temp|payment.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Rebecca|AppData|Local|Temp|payment.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Rebecca|AppData|Local|Temp|payment.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-479431668-4257340731-3059248302-1002\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{4c2e3c01-5984-11ea-a9cb-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{4c2e3c01-5984-11ea-a9cb-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{4c2e3c01-5984-11ea-a9cb-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{210acb57-272f-11e9-8326-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{210acb57-272f-11e9-8326-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{210acb57-272f-11e9-8326-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{210acb58-272f-11e9-8326-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{210acb58-272f-11e9-8326-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{210acb58-272f-11e9-8326-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\AppID\payment.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\AppCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\DefaultAccessPermission
HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
DisableUserModeCallbackFilter
HKEY_CURRENT_USER\Software\Classes\AppID\schtasks.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoKMS
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoKMS\Id
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\SchedulingEngineKnob
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002\Control Panel\International
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002\Control Panel\International\LocaleName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updates\SPjfKyKDmOO
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\svchost.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\svchost.exe
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A4D0D3AA-EEB8-4AEF-8D61-0F10AFBF0D1A}\Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A4D0D3AA-EEB8-4AEF-8D61-0F10AFBF0D1A}\Hash
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updates\SPjfKyKDmOO\Id
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updates\SPjfKyKDmOO\Index
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A4D0D3AA-EEB8-4AEF-8D61-0F10AFBF0D1A}\Triggers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A4D0D3AA-EEB8-4AEF-8D61-0F10AFBF0D1A}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A4D0D3AA-EEB8-4AEF-8D61-0F10AFBF0D1A}\DynamicInfo
\xbd40\x354EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IpHlpSvc\EnableFileTracing
\xbd40\x354EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IpHlpSvc\FileTracingMask
\xbd40\x354EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IpHlpSvc\EnableConsoleTracing
\xbd40\x354EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IpHlpSvc\ConsoleTracingMask
\xbd40\x354EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IpHlpSvc\MaxFileSize
\xbd40\x354EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IpHlpSvc\FileDirectory
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iphlpsvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iphlpsvc\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iphlpsvc\Parameters\ServiceDllUnloadOnStop
HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\CIMOM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\LastServiceStart
HKEY_LOCAL_MACHINE\Software\Classes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0000000C-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0000000c-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0000000c-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\ESS
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\ESS\//./root/CIMV2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\ESS\//./root/CIMV2\SCM Event Provider
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\PreviousServiceShutdown
HKEY_LOCAL_MACHINE\system\Setup
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ProcessID
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\winmgmt
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winmgmt\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winmgmt\Parameters\ServiceDllUnloadOnStop
\x2210\x8fEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\A1BC803C
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_CURRENT_USER\Software\Classes\WinMgmts
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WINMGMTS\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WINMGMTS\CLSID\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Scripting
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Scripting\Default Namespace
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Hostname
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\System\DNSclient
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Domain
HKEY_CURRENT_USER\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocHandler
HKEY_CURRENT_USER\Software\Classes\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\win32\(Default)
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CMF\Config
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CMF\Config\SYSTEM
HKEY_CLASSES_ROOT\CLSID\{62E522DC-8CF3-40A8-8B2E-37D595651E40}\InprocServer32
HKEY_CLASSES_ROOT\CLSID\{62E522DC-8CF3-40A8-8B2E-37D595651E40}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\409
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\9
HKEY_CURRENT_USER\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocHandler
HKEY_CURRENT_USER\Software\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}\ProxyStubClsid32\(Default)
HKEY_CLASSES_ROOT\CLSID\{04B83D61-21AE-11D2-8B33-00600806D9B6}\InprocServer32
HKEY_CLASSES_ROOT\CLSID\{04B83D61-21AE-11D2-8B33-00600806D9B6}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.CustomMarshalers__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.CustomMarshalers__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.10.0.Microsoft.JScript__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.10.0.Microsoft.JScript__b03f5f7f11d50a3a
HKEY_CLASSES_ROOT\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32\(Default)
HKEY_CLASSES_ROOT\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\WMIDisableCOMSecurity
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\FinalizerActivityBypass
HKEY_LOCAL_MACHINE\Software\Microsoft\OleAut
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\EnableObjectValidation
HKEY_CURRENT_USER\Software\Aerofox\FoxmailPreview
HKEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1
HKEY_CURRENT_USER\Software\IncrediMail\Identities
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Central European Standard Time
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Central European Standard Time\TZI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Central European Standard Time\Dynamic DST
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Central European Standard Time\MUI_Display
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Central European Standard Time\MUI_Std
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Central European Standard Time\MUI_Dlt
HKEY_CURRENT_USER\Software\Qualcomm\Eudora\CommandLine
HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\ServiceParameters
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\RunAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\ActivateAtStorage
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\ROTFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\AppIDFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LaunchPermission
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\LegacyAuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\LegacyImpersonationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\RemoteServerName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\SRPTrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PreferredServerBitness
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LoadUserSettings
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Power\PowerRequestOverride
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Power\PowerRequestOverride
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Power\PowerRequestOverride\Driver
HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\Tracing\WMI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\SessionEnabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\AreaFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\Session
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\LogFile
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\MinimumBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\MaximumBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\MaximumFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\LogFileMode
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\FlushTimer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\AgeLimit
HKEY_LOCAL_MACHINE\SYSTEM\Setup
HKEY_LOCAL_MACHINE\SYSTEM\Setup\UpgradeInProgress
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Safeboot\Option
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Settings
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\ActiveWriterStateTimeout
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\(Default)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\WMI Writer
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\TornComponentsMax
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000100-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000100-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000100-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9555-4FB6-11D1-9971-00C04FBBB345}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9555-4FB6-11D1-9971-00C04FBBB345}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9555-4FB6-11D1-9971-00C04FBBB345}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9557-4FB6-11D1-9971-00C04FBBB345}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9557-4FB6-11D1-9971-00C04FBBB345}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9557-4FB6-11D1-9971-00C04FBBB345}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\IdentifierLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\QueryLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\PathLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbThrottlingEnabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighMaxLimitFactor
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbTaskMaxSleep
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold1Mult
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold2Mult
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold3Mult
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Unchecked Task Count
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Working Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Repository Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Build
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Logging Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\MOF Self-Install Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Default Repository Driver
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueCoreFsrepVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Repository Cache Spill Ratio
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\CheckPointValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SnapShotValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\CheckRepositoryOnNextStartup
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\NumWriteIdCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Class Cache Size
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Class Cache Item Age (ms)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\NextAutoRecoverFile
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Enable Provider Subsystem
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Client
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Client\{0096CAC7-A03A-47A2-9F4E-7A57014C4406}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{0096CAC7-A03A-47A2-9F4E-7A57014C4406}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{0096CAC7-A03A-47A2-9F4E-7A57014C4406}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{0096CAC7-A03A-47A2-9F4E-7A57014C4406}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{0096CAC7-A03A-47A2-9F4E-7A57014C4406}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{0096CAC7-A03A-47A2-9F4E-7A57014C4406}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{0096CAC7-A03A-47A2-9F4E-7A57014C4406}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{0096CAC7-A03A-47A2-9F4E-7A57014C4406}\ProcessIdentifier
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Client\{34175B06-4595-447A-82C4-8F30A3906562}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{34175B06-4595-447A-82C4-8F30A3906562}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{34175B06-4595-447A-82C4-8F30A3906562}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{34175B06-4595-447A-82C4-8F30A3906562}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{34175B06-4595-447A-82C4-8F30A3906562}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{34175B06-4595-447A-82C4-8F30A3906562}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{34175B06-4595-447A-82C4-8F30A3906562}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{34175B06-4595-447A-82C4-8F30A3906562}\ProcessIdentifier
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Client\{C1637785-412C-41B2-B0DD-0F34D54B2296}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C1637785-412C-41B2-B0DD-0F34D54B2296}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C1637785-412C-41B2-B0DD-0F34D54B2296}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C1637785-412C-41B2-B0DD-0F34D54B2296}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C1637785-412C-41B2-B0DD-0F34D54B2296}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C1637785-412C-41B2-B0DD-0F34D54B2296}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C1637785-412C-41B2-B0DD-0F34D54B2296}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C1637785-412C-41B2-B0DD-0F34D54B2296}\ProcessIdentifier
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Client\{C84FE829-9991-4EF4-BDFC-FC1B13F492BC}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C84FE829-9991-4EF4-BDFC-FC1B13F492BC}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C84FE829-9991-4EF4-BDFC-FC1B13F492BC}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C84FE829-9991-4EF4-BDFC-FC1B13F492BC}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C84FE829-9991-4EF4-BDFC-FC1B13F492BC}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C84FE829-9991-4EF4-BDFC-FC1B13F492BC}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C84FE829-9991-4EF4-BDFC-FC1B13F492BC}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C84FE829-9991-4EF4-BDFC-FC1B13F492BC}\ProcessIdentifier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\ProcessIdentifier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\EnableEvents
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssToBeInitialized
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Low Threshold On Events (B)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\High Threshold On Events (B)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Wait On Events (ms)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Merger Query Arbitration Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssNeedsLoading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\List of event-active namespaces
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\ESS\//./root/subscription
HKEY_LOCAL_MACHINE\software\microsoft\wbem\cimom
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SetupDate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Async Result Queue Size
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\CIMOM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\FinalizerBatchSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ClientCallbackTimeout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\FinalizerQueueThreshold
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Tasks
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\cimv2
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\cimv2
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}
HKEY_CLASSES_ROOT\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\Synchronization
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\(Default)
HKEY_CLASSES_ROOT\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\LocalServer32
HKEY_CLASSES_ROOT\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\AppId
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\minint
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}
HKEY_CLASSES_ROOT\CLSID\{d63a5850-8f16-11cf-9f47-00aa00bf345c}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\InprocServer32\Synchronization
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\InprocServer32\(Default)
HKEY_CLASSES_ROOT\CLSID\{d63a5850-8f16-11cf-9f47-00aa00bf345c}\LocalServer32
HKEY_CLASSES_ROOT\CLSID\{d63a5850-8f16-11cf-9f47-00aa00bf345c}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SecuredHostProviders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SecuredHostProviders\ROOT\CIMV2:__Win32Provider.Name="CIMWin32"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\Root
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\Root
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07435309-D440-41B7-83F3-EB82DB6C622F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07435309-D440-41B7-83F3-EB82DB6C622F}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07435309-D440-41B7-83F3-EB82DB6C622F}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F50A28CF-5C9C-4F7E-9D80-E25E16E18C59}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F50A28CF-5C9C-4F7E-9D80-E25E16E18C59}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F50A28CF-5C9C-4F7E-9D80-E25E16E18C59}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6B3FC272-BF37-4968-933A-6DF9222A2607}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6B3FC272-BF37-4968-933A-6DF9222A2607}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6B3FC272-BF37-4968-933A-6DF9222A2607}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0FC8C622-1728-4149-A57F-AD19D0970710}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0FC8C622-1728-4149-A57F-AD19D0970710}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0FC8C622-1728-4149-A57F-AD19D0970710}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FEC1B0AC-5808-4033-A915-C0185934581E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FEC1B0AC-5808-4033-A915-C0185934581E}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FEC1B0AC-5808-4033-A915-C0185934581E}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EB658B8A-7A64-4DDC-9B8D-A92610DB0206}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EB658B8A-7A64-4DDC-9B8D-A92610DB0206}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EB658B8A-7A64-4DDC-9B8D-A92610DB0206}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocHandler
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ImagePath
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_USERS\S-1-5-18
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_USERS\.DEFAULT\Environment
HKEY_USERS\.DEFAULT\Volatile Environment
HKEY_USERS\.DEFAULT\Volatile Environment\0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\RequiredPrivileges
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ObjectName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseRetryAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseMillisecondsBetweenRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\NGen\Policy\v4.0\OptimizeUsedBinaries
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\00060101.00060101
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\FeatureSIMD
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AltJit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index224
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name
\x71d0\x154EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_CURRENT_USER\Software\Microsoft\GDIPlus\FontCachePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{4c2e3c01-5984-11ea-a9cb-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{4c2e3c01-5984-11ea-a9cb-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{210acb57-272f-11e9-8326-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{210acb57-272f-11e9-8326-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{210acb58-272f-11e9-8326-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{210acb58-272f-11e9-8326-806e6f6e6963}\Generation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\DefaultAccessPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoKMS\Id
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\SchedulingEngineKnob
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002\Control Panel\International\LocaleName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A4D0D3AA-EEB8-4AEF-8D61-0F10AFBF0D1A}\Hash
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A4D0D3AA-EEB8-4AEF-8D61-0F10AFBF0D1A}\DynamicInfo
\xbd40\x354EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IpHlpSvc\EnableFileTracing
\xbd40\x354EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IpHlpSvc\FileTracingMask
\xbd40\x354EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IpHlpSvc\EnableConsoleTracing
\xbd40\x354EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IpHlpSvc\ConsoleTracingMask
\xbd40\x354EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IpHlpSvc\MaxFileSize
\xbd40\x354EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IpHlpSvc\FileDirectory
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iphlpsvc\Parameters\ServiceDllUnloadOnStop
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\LastServiceStart
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0000000c-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\MarshaledProxy
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winmgmt\Parameters\ServiceDllUnloadOnStop
\x2210\x8fEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\A1BC803C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WINMGMTS\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Scripting\Default Namespace
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Hostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Domain
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\win32\(Default)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CMF\Config\SYSTEM
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\WMIDisableCOMSecurity
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\FinalizerActivityBypass
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\EnableObjectValidation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Central European Standard Time\TZI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Central European Standard Time\MUI_Display
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Central European Standard Time\MUI_Std
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Central European Standard Time\MUI_Dlt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\ServiceParameters
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\RunAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\ActivateAtStorage
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\ROTFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\AppIDFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LaunchPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\LegacyAuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\LegacyImpersonationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\RemoteServerName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\SRPTrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PreferredServerBitness
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LoadUserSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\SessionEnabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\AreaFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\Session
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\LogFile
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\MinimumBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\MaximumBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\MaximumFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\LogFileMode
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\FlushTimer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\AgeLimit
HKEY_LOCAL_MACHINE\SYSTEM\Setup\UpgradeInProgress
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\ActiveWriterStateTimeout
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\(Default)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\TornComponentsMax
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000100-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9555-4FB6-11D1-9971-00C04FBBB345}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9557-4FB6-11D1-9971-00C04FBBB345}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\IdentifierLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\QueryLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\PathLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbThrottlingEnabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighMaxLimitFactor
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbTaskMaxSleep
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold1Mult
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold2Mult
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold3Mult
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Unchecked Task Count
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Working Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Repository Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Build
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Logging Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\MOF Self-Install Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Default Repository Driver
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueCoreFsrepVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Repository Cache Spill Ratio
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\CheckPointValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SnapShotValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\CheckRepositoryOnNextStartup
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\NumWriteIdCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Class Cache Size
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Class Cache Item Age (ms)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\NextAutoRecoverFile
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Enable Provider Subsystem
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{0096CAC7-A03A-47A2-9F4E-7A57014C4406}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{0096CAC7-A03A-47A2-9F4E-7A57014C4406}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{0096CAC7-A03A-47A2-9F4E-7A57014C4406}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{0096CAC7-A03A-47A2-9F4E-7A57014C4406}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{0096CAC7-A03A-47A2-9F4E-7A57014C4406}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{0096CAC7-A03A-47A2-9F4E-7A57014C4406}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{0096CAC7-A03A-47A2-9F4E-7A57014C4406}\ProcessIdentifier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{34175B06-4595-447A-82C4-8F30A3906562}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{34175B06-4595-447A-82C4-8F30A3906562}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{34175B06-4595-447A-82C4-8F30A3906562}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{34175B06-4595-447A-82C4-8F30A3906562}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{34175B06-4595-447A-82C4-8F30A3906562}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{34175B06-4595-447A-82C4-8F30A3906562}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{34175B06-4595-447A-82C4-8F30A3906562}\ProcessIdentifier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C1637785-412C-41B2-B0DD-0F34D54B2296}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C1637785-412C-41B2-B0DD-0F34D54B2296}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C1637785-412C-41B2-B0DD-0F34D54B2296}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C1637785-412C-41B2-B0DD-0F34D54B2296}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C1637785-412C-41B2-B0DD-0F34D54B2296}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C1637785-412C-41B2-B0DD-0F34D54B2296}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C1637785-412C-41B2-B0DD-0F34D54B2296}\ProcessIdentifier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C84FE829-9991-4EF4-BDFC-FC1B13F492BC}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C84FE829-9991-4EF4-BDFC-FC1B13F492BC}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C84FE829-9991-4EF4-BDFC-FC1B13F492BC}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C84FE829-9991-4EF4-BDFC-FC1B13F492BC}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C84FE829-9991-4EF4-BDFC-FC1B13F492BC}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C84FE829-9991-4EF4-BDFC-FC1B13F492BC}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{C84FE829-9991-4EF4-BDFC-FC1B13F492BC}\ProcessIdentifier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\EnableEvents
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssToBeInitialized
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Low Threshold On Events (B)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\High Threshold On Events (B)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Wait On Events (ms)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Merger Query Arbitration Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SetupDate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Async Result Queue Size
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\FinalizerBatchSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ClientCallbackTimeout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\FinalizerQueueThreshold
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Tasks
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\cimv2
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\cimv2
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\Synchronization
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\InprocServer32\Synchronization
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SecuredHostProviders\ROOT\CIMV2:__Win32Provider.Name="CIMWin32"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\Root
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\Root
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07435309-D440-41B7-83F3-EB82DB6C622F}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F50A28CF-5C9C-4F7E-9D80-E25E16E18C59}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6B3FC272-BF37-4968-933A-6DF9222A2607}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0FC8C622-1728-4149-A57F-AD19D0970710}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FEC1B0AC-5808-4033-A915-C0185934581E}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EB658B8A-7A64-4DDC-9B8D-A92610DB0206}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssNeedsLoading
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ImagePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\RequiredPrivileges
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Audiosrv\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ObjectName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A4D0D3AA-EEB8-4AEF-8D61-0F10AFBF0D1A}\Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A4D0D3AA-EEB8-4AEF-8D61-0F10AFBF0D1A}\Hash
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updates\SPjfKyKDmOO\Id
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updates\SPjfKyKDmOO\Index
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A4D0D3AA-EEB8-4AEF-8D61-0F10AFBF0D1A}\Triggers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A4D0D3AA-EEB8-4AEF-8D61-0F10AFBF0D1A}\DynamicInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\LastServiceStart
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\PreviousServiceShutdown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ProcessID
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\ProcessIdentifier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssNeedsLoading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\List of event-active namespaces
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\ESS\//./root/CIMV2\SCM Event Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\LastServiceStart
advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.SetDefaultDllDirectories
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
kernel32.dll.AcquireSRWLockExclusive
kernel32.dll.ReleaseSRWLockExclusive
advapi32.dll.EventRegister
advapi32.dll.EventSetInformation
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
clr.dll.SetRuntimeInfo
user32.dll.GetProcessWindowStation
user32.dll.GetUserObjectInformationW
clr.dll._CorExeMain
mscoree.dll.CreateConfigStream
mscoreei.dll.CreateConfigStream
kernel32.dll.GetNumaHighestNodeNumber
kernel32.dll.GetSystemWindowsDirectoryW
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddSIDToBoundaryDescriptor
kernel32.dll.CreateBoundaryDescriptorW
kernel32.dll.CreatePrivateNamespaceW
kernel32.dll.OpenPrivateNamespaceW
kernel32.dll.DeleteBoundaryDescriptor
kernel32.dll.WerRegisterRuntimeExceptionModule
kernel32.dll.RaiseException
mscoree.dll.#24
mscoreei.dll.#24
ntdll.dll.NtSetSystemInformation
kernel32.dll.AddDllDirectory
kernel32.dll.SortGetHandle
kernel32.dll.SortCloseHandle
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
clrjit.dll.sxsJitStartup
clrjit.dll.getJit
kernel32.dll.LocaleNameToLCID
kernel32.dll.LCIDToLocaleName
kernel32.dll.GetUserPreferredUILanguages
kernel32.dll.GetFullPathNameW
uxtheme.dll.IsAppThemed
kernel32.dll.CreateActCtxA
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
user32.dll.RegisterWindowMessageW
nlssorting.dll.SortGetHandle
nlssorting.dll.SortCloseHandle
kernel32.dll.CompareStringOrdinal
kernel32.dll.CloseHandle
kernel32.dll.GetCurrentProcess
ntdll.dll.NtQuerySystemInformation
kernel32.dll.GetFileAttributesExW
kernel32.dll.SetThreadErrorMode
kernel32.dll.CreateFileW
kernel32.dll.GetFileType
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
bcrypt.dll.BCryptGetFipsAlgorithmMode
cryptsp.dll.CryptGetDefaultProviderW
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptGenRandom
kernel32.dll.GetFileSize
kernel32.dll.ReadFile
user32.dll.GetSystemMetrics
kernel32.dll.GetModuleHandleW
kernel32.dll.GetProcAddress
kernel32.dll.WideCharToMultiByte
kernel32.dll.LoadLibraryExW
user32.dll.AdjustWindowRectEx
kernel32.dll.GetCurrentThread
kernel32.dll.DuplicateHandle
kernel32.dll.GetCurrentThreadId
kernel32.dll.GetCurrentActCtx
kernel32.dll.ActivateActCtx
user32.dll.DefWindowProcW
gdi32.dll.GetStockObject
user32.dll.RegisterClassW
user32.dll.CreateWindowExW
user32.dll.SetWindowLongW
user32.dll.GetWindowLongW
user32.dll.CallWindowProcW
user32.dll.GetClientRect
user32.dll.GetWindowRect
user32.dll.GetParent
kernel32.dll.DeactivateActCtx
gdiplus.dll.GdiplusStartup
kernel32.dll.IsProcessorFeaturePresent
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipCreateFontFamilyFromName
kernel32.dll.RegOpenKeyExW
kernel32.dll.RegQueryInfoKeyA
kernel32.dll.RegCloseKey
kernel32.dll.RegCreateKeyExW
kernel32.dll.RegQueryValueExW
kernel32.dll.RegEnumValueW
gdiplus.dll.GdipCreateFont
gdiplus.dll.GdipGetFontSize
kernel32.dll.GetSystemDefaultLCID
gdi32.dll.GetObjectW
user32.dll.GetDC
gdiplus.dll.GdipCreateFontFromLogfontW
kernel32.dll.RegQueryInfoKeyW
mscoree.dll.ND_RI2
mscoreei.dll.ND_RI2
mscoree.dll.ND_RU1
mscoreei.dll.ND_RU1
gdiplus.dll.GdipGetFontUnit
gdiplus.dll.GdipGetFontStyle
gdiplus.dll.GdipGetFamily
user32.dll.ReleaseDC
gdiplus.dll.GdipCreateFromHDC
gdiplus.dll.GdipGetDpiY
gdiplus.dll.GdipGetFontHeight
gdiplus.dll.GdipGetEmHeight
gdiplus.dll.GdipGetLineSpacing
gdiplus.dll.GdipDeleteGraphics
gdiplus.dll.GdipDeleteFont
user32.dll.GetUserObjectInformationA
kernel32.dll.SetConsoleCtrlHandler
user32.dll.GetClassInfoW
user32.dll.GetSysColor
gdi32.dll.CreateCompatibleDC
gdiplus.dll.GdipGetLogFontW
mscoree.dll.ND_WU1
mscoreei.dll.ND_WU1
gdi32.dll.CreateFontIndirectW
gdi32.dll.SelectObject
gdi32.dll.GetTextMetricsW
gdi32.dll.GetTextExtentPoint32W
gdi32.dll.DeleteDC
kernel32.dll.ResolveLocaleName
cryptsp.dll.CryptGetProvParam
cryptsp.dll.CryptImportKey
cryptsp.dll.CryptSetKeyParam
cryptsp.dll.CryptDecrypt
cryptsp.dll.CryptEncrypt
ole32.dll.CoCreateGuid
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipBitmapGetPixel
cryptsp.dll.CryptDestroyKey
cryptsp.dll.CryptReleaseContext
kernel32.dll.CopyFileW
kernel32.dll.LocalFree
kernel32.dll.LocalAlloc
advapi32.dll.LsaClose
advapi32.dll.LsaFreeMemory
advapi32.dll.LsaOpenPolicy
advapi32.dll.LsaLookupSids
kernel32.dll.GetTempPathW
kernel32.dll.GetTempFileNameW
kernel32.dll.WriteFile
shell32.dll.ShellExecuteEx
shell32.dll.ShellExecuteExW
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#332
comctl32.dll.#386
ole32.dll.CoWaitForMultipleHandles
sechost.dll.LookupAccountNameLocalW
advapi32.dll.LookupAccountSidW
sechost.dll.LookupAccountSidLocalW
ole32.dll.NdrOleInitializeExtension
ole32.dll.CoGetClassObject
ole32.dll.CoGetMarshalSizeMax
ole32.dll.CoMarshalInterface
ole32.dll.CoUnmarshalInterface
ole32.dll.StringFromIID
ole32.dll.CoGetPSClsid
ole32.dll.CoCreateInstance
ole32.dll.CoReleaseMarshalData
ole32.dll.DcomChannelSetHResult
rpcrtremote.dll.I_RpcExtInitializeExtensionPoint
kernel32.dll.DeleteFileW
kernel32.dll.CreateProcessW
kernel32.dll.GetThreadContext
kernel32.dll.ReadProcessMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.WriteProcessMemory
kernel32.dll.SetThreadContext
kernel32.dll.ResumeThread
user32.dll.SetClassLongW
user32.dll.PostMessageW
user32.dll.UnregisterClassW
user32.dll.IsWindow
user32.dll.DestroyWindow
advapi32.dll.EventUnregister
gdiplus.dll.GdipDisposeImage
gdi32.dll.DeleteObject
api-ms-win-downlevel-advapi32-l1-1-0.dll.UnregisterTraceGuids
advapi32.dll.UnregisterTraceGuids
comctl32.dll.#321
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.QueryActCtxW
sspicli.dll.GetUserNameExW
pcwum.dll.PerfDeleteInstance
pcwum.dll.PerfStopProvider
propsys.dll.PropVariantToVariant
ole32.dll.CoDisconnectObject
wbemcore.dll.Shutdown
ole32.dll.CoUninitialize
kernel32.dll.RegDeleteValueW
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
advapi32.dll.AdjustTokenPrivileges
cryptsp.dll.CryptCreateHash
ole32.dll.CreateBindCtx
ole32.dll.CoGetObjectContext
ole32.dll.MkParseDisplayName
kernel32.dll.GetThreadPreferredUILanguages
kernel32.dll.SetThreadPreferredUILanguages
kernel32.dll.GetSystemDefaultLocaleName
fastprox.dll.DllGetClassObject
fastprox.dll.DllCanUnloadNow
ole32.dll.BindMoniker
sxs.dll.SxsOleAut32RedirectTypeLibrary
advapi32.dll.RegOpenKeyW
advapi32.dll.RegEnumKeyW
advapi32.dll.RegQueryValueW
sxs.dll.SxsOleAut32MapConfiguredClsidToReferenceClsid
sxs.dll.SxsLookupClrGuid
oleaut32.dll.#9
oleaut32.dll.#4
mscoreei.dll._CorDllMain
mscoree.dll.GetTokenForVTableEntry
mscoree.dll.SetTargetForVTableEntry
mscoree.dll.GetTargetForVTableEntry
mscoreei.dll.GetTokenForVTableEntry
mscoreei.dll.SetTargetForVTableEntry
mscoreei.dll.GetTargetForVTableEntry
kernel32.dll.GetLastError
kernel32.dll.CreateEventW
kernel32.dll.SetEvent
ole32.dll.IIDFromString
kernel32.dll.LoadLibraryA
wminet_utils.dll.ResetSecurity
wminet_utils.dll.SetSecurity
wminet_utils.dll.BlessIWbemServices
wminet_utils.dll.BlessIWbemServicesObject
wminet_utils.dll.GetPropertyHandle
wminet_utils.dll.WritePropertyValue
wminet_utils.dll.Clone
wminet_utils.dll.VerifyClientKey
wminet_utils.dll.GetQualifierSet
wminet_utils.dll.Get
wminet_utils.dll.Put
wminet_utils.dll.Delete
wminet_utils.dll.GetNames
wminet_utils.dll.BeginEnumeration
wminet_utils.dll.Next
wminet_utils.dll.EndEnumeration
wminet_utils.dll.GetPropertyQualifierSet
wminet_utils.dll.GetObjectText
wminet_utils.dll.SpawnDerivedClass
wminet_utils.dll.SpawnInstance
wminet_utils.dll.CompareTo
wminet_utils.dll.GetPropertyOrigin
wminet_utils.dll.InheritsFrom
wminet_utils.dll.GetMethod
wminet_utils.dll.PutMethod
wminet_utils.dll.DeleteMethod
wminet_utils.dll.BeginMethodEnumeration
wminet_utils.dll.NextMethod
wminet_utils.dll.EndMethodEnumeration
wminet_utils.dll.GetMethodQualifierSet
wminet_utils.dll.GetMethodOrigin
wminet_utils.dll.QualifierSet_Get
wminet_utils.dll.QualifierSet_Put
wminet_utils.dll.QualifierSet_Delete
wminet_utils.dll.QualifierSet_GetNames
wminet_utils.dll.QualifierSet_BeginEnumeration
wminet_utils.dll.QualifierSet_Next
wminet_utils.dll.QualifierSet_EndEnumeration
wminet_utils.dll.GetCurrentApartmentType
wminet_utils.dll.GetDemultiplexedStub
wminet_utils.dll.CreateInstanceEnumWmi
wminet_utils.dll.CreateClassEnumWmi
wminet_utils.dll.ExecQueryWmi
wminet_utils.dll.ExecNotificationQueryWmi
wminet_utils.dll.PutInstanceWmi
wminet_utils.dll.PutClassWmi
wminet_utils.dll.CloneEnumWbemClassObject
wminet_utils.dll.ConnectServerWmi
wminet_utils.dll.GetErrorInfo
wminet_utils.dll.Initialize
oleaut32.dll.SysStringLen
kernel32.dll.RtlZeroMemory
oleaut32.dll.#500
oleaut32.dll.#149
cryptsp.dll.CryptHashData
cryptsp.dll.CryptGetHashParam
cryptsp.dll.CryptDestroyHash
kernel32.dll.GetEnvironmentVariableW
advapi32.dll.GetUserNameW
kernel32.dll.GetComputerNameW
ntdll.dll.NtQueryInformationThread
kernel32.dll.CreateWaitableTimerExW
kernel32.dll.SetWaitableTimerEx
oleaut32.dll.#200
cryptsp.dll.CryptAcquireContextA
cryptsp.dll.CryptExportKey
kernel32.dll.FindFirstFileW
kernel32.dll.FindClose
oleaut32.dll.#204
oleaut32.dll.#203
kernel32.dll.GetACP
kernel32.dll.UnmapViewOfFile
vaultcli.dll.VaultEnumerateVaults
kernel32.dll.GetSystemTimeAsFileTime
kernel32.dll.GetDynamicTimeZoneInformation
kernel32.dll.GetFileMUIPath
kernel32.dll.FreeLibrary
user32.dll.LoadStringW
user32.dll.GetLastInputInfo
kernel32.dll.FindNextFileW
oleaut32.dll.#179
ole32.dll.OleInitialize
ole32.dll.CoRegisterMessageFilter
user32.dll.PeekMessageW
user32.dll.WaitMessage
vssapi.dll.CreateWriter
oleaut32.dll.#6
oleaut32.dll.#2
advapi32.dll.LookupAccountNameW
samcli.dll.NetLocalGroupGetMembers
samlib.dll.SamConnect
rpcrt4.dll.NdrClientCall2
rpcrt4.dll.RpcStringBindingComposeW
rpcrt4.dll.RpcBindingFromStringBindingW
rpcrt4.dll.RpcStringFreeW
rpcrt4.dll.RpcBindingFree
samlib.dll.SamOpenDomain
samlib.dll.SamLookupNamesInDomain
samlib.dll.SamOpenAlias
samlib.dll.SamFreeMemory
samlib.dll.SamCloseHandle
samlib.dll.SamGetMembersInAlias
netutils.dll.NetApiBufferFree
ole32.dll.StringFromCLSID
oleaut32.dll.#7
propsys.dll.VariantToPropVariant
wbemcore.dll.Reinitialize
wbemsvc.dll.DllGetClassObject
wbemsvc.dll.DllCanUnloadNow
authz.dll.AuthzInitializeContextFromToken
authz.dll.AuthzInitializeObjectAccessAuditEvent2
authz.dll.AuthzAccessCheck
authz.dll.AuthzFreeAuditEvent
authz.dll.AuthzFreeContext
authz.dll.AuthzInitializeResourceManager
authz.dll.AuthzFreeResourceManager
rpcrt4.dll.RpcBindingCreateW
rpcrt4.dll.RpcBindingBind
rpcrt4.dll.I_RpcMapWin32Status
advapi32.dll.EventWrite
advapi32.dll.EventActivityIdControl
advapi32.dll.EventWriteTransfer
advapi32.dll.EventEnabled
kernel32.dll.RegSetValueExW
wmisvc.dll.IsImproperShutdownDetected
wevtapi.dll.EvtRender
wevtapi.dll.EvtNext
wevtapi.dll.EvtClose
wevtapi.dll.EvtQuery
wevtapi.dll.EvtCreateRenderContext
rpcrt4.dll.RpcBindingSetAuthInfoExW
rpcrt4.dll.RpcBindingSetOption
ole32.dll.CoCreateFreeThreadedMarshaler
ole32.dll.CreateStreamOnHGlobal
kernelbase.dll.InitializeAcl
kernelbase.dll.AddAce
kernel32.dll.OpenProcessToken
kernelbase.dll.GetTokenInformation
kernelbase.dll.DuplicateTokenEx
kernelbase.dll.AdjustTokenPrivileges
kernelbase.dll.AllocateAndInitializeSid
kernelbase.dll.CheckTokenMembership
kernel32.dll.SetThreadToken
ole32.dll.CLSIDFromString
authz.dll.AuthzInitializeContextFromSid
ole32.dll.CoGetCallContext
ole32.dll.StringFromGUID2
ole32.dll.CoImpersonateClient
ole32.dll.CoRevertToSelf
ole32.dll.CoSwitchCallContext
sspicli.dll.LogonUserExExW
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SPjfKyKDmOO" /XML "C:\Users\Rebecca\AppData\Local\Temp\tmp3B3.tmp"
schtasks.exe /Create /TN "Updates\SPjfKyKDmOO" /XML "C:\Users\Rebecca\AppData\Local\Temp\tmp3B3.tmp"
"{path}"
C:\Users\Rebecca\AppData\Local\Temp\payment.exe "{path}"
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\system32\lsass.exe
VaultSvc

PE Information

Image Base Entry Point Reported Checksum Actual Checksum Minimum OS Version Compile Time Import Hash
0x00400000 0x0046ea2e 0x00000000 0x00076c46 4.0 2020-06-29 18:48:46 f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name RAW Address Virtual Address Virtual Size Size of Raw Data Characteristics Entropy
.text 0x00000200 0x00002000 0x0006ca34 0x0006cc00 IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 7.82
.reloc 0x0006ce00 0x00070000 0x0000000c 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 0.10
.rsrc 0x0006d000 0x00072000 0x000005e0 0x00000600 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 4.37

Resources

Name Offset Size Language Sub-language Entropy File type
RT_VERSION 0x000720a0 0x0000038c LANG_NEUTRAL SUBLANG_NEUTRAL 3.50 None
RT_MANIFEST 0x0007242c 0x000001b4 LANG_NEUTRAL SUBLANG_NEUTRAL 4.94 None

Imports


Assembly Information

Name SWuwjRQZOu
Version 3.5.7.9

Assembly References

Name Version
mscorlib 4.0.0.0
System.Windows.Forms 4.0.0.0
System 4.0.0.0
System.Drawing 4.0.0.0
Microsoft.VisualBasic 10.0.0.0

Custom Attributes

Type Name Value
Assembly [mscorlib]System.Reflection.AssemblyCompanyAttribute Vlan Networ
Assembly [mscorlib]System.Reflection.AssemblyTrademarkAttribute Copyright VLAN 20
Assembly [mscorlib]System.Reflection.AssemblyDescriptionAttribute VLAN Networ
Assembly [mscorlib]System.Reflection.AssemblyCopyrightAttribute 1999-20
Assembly [mscorlib]System.Runtime.InteropServices.GuidAttribute 31a86da4-cd83-4e82-a67d-179040b369
Assembly [mscorlib]System.Reflection.AssemblyFileVersionAttribute 2.4.5
Assembly [mscorlib]System.Reflection.AssemblyTitleAttribute VLC Media Play
Assembly [mscorlib]System.Reflection.AssemblyProductAttribute VLC Media Play

Type References

Assembly Type Name
Microsoft.VisualBasic Microsoft.VisualBasic.CallType
Microsoft.VisualBasic Microsoft.VisualBasic.Interaction
mscorlib System.AppDomain
mscorlib System.ArgumentOutOfRangeException
mscorlib System.Array
mscorlib System.Attribute
mscorlib System.Boolean
mscorlib System.Buffer
mscorlib System.Byte
mscorlib System.Char
System System.CodeDom.Compiler.GeneratedCodeAttribute
mscorlib System.Collections.Generic.IEnumerable`1
mscorlib System.Collections.Generic.List`1
System System.ComponentModel.CancelEventArgs
System System.ComponentModel.CancelEventHandler
System System.ComponentModel.Container
System System.ComponentModel.IContainer
System System.ComponentModel.ISupportInitialize
mscorlib System.DateTime
mscorlib System.Delegate
mscorlib System.Diagnostics.DebuggerBrowsableAttribute
mscorlib System.Diagnostics.DebuggerBrowsableState
mscorlib System.Diagnostics.DebuggerHiddenAttribute
mscorlib System.Diagnostics.DebuggerNonUserCodeAttribute
mscorlib System.Diagnostics.StackFrame
mscorlib System.Diagnostics.StackTrace
mscorlib System.Double
System.Drawing System.Drawing.Bitmap
System.Drawing System.Drawing.Color
System.Drawing System.Drawing.Font
System.Drawing System.Drawing.FontStyle
System.Drawing System.Drawing.GraphicsUnit
System.Drawing System.Drawing.Point
System.Drawing System.Drawing.Size
System.Drawing System.Drawing.SizeF
mscorlib System.Enum
mscorlib System.EventArgs
mscorlib System.EventHandler
mscorlib System.EventHandler`1
mscorlib System.Exception
mscorlib System.Globalization.CultureInfo
mscorlib System.IDisposable
mscorlib System.IO.EndOfStreamException
mscorlib System.IO.Stream
mscorlib System.Int16
mscorlib System.Int32
mscorlib System.Int64
mscorlib System.IntPtr
mscorlib System.NotImplementedException
mscorlib System.NotSupportedException
mscorlib System.Object
mscorlib System.Reflection.Assembly
mscorlib System.Reflection.AssemblyCompanyAttribute
mscorlib System.Reflection.AssemblyConfigurationAttribute
mscorlib System.Reflection.AssemblyCopyrightAttribute
mscorlib System.Reflection.AssemblyDescriptionAttribute
mscorlib System.Reflection.AssemblyFileVersionAttribute
mscorlib System.Reflection.AssemblyName
mscorlib System.Reflection.AssemblyProductAttribute
mscorlib System.Reflection.AssemblyTitleAttribute
mscorlib System.Reflection.AssemblyTrademarkAttribute
mscorlib System.Reflection.MemberInfo
mscorlib System.Reflection.MethodBase
mscorlib System.Resources.ResourceManager
mscorlib System.Runtime.CompilerServices.CompilationRelaxationsAttribute
mscorlib System.Runtime.CompilerServices.RuntimeCompatibilityAttribute
mscorlib System.Runtime.CompilerServices.SuppressIldasmAttribute
mscorlib System.Runtime.InteropServices.ComVisibleAttribute
mscorlib System.Runtime.InteropServices.GuidAttribute
mscorlib System.Runtime.Versioning.TargetFrameworkAttribute
mscorlib System.RuntimeMethodHandle
mscorlib System.RuntimeTypeHandle
mscorlib System.STAThreadAttribute
mscorlib System.Single
mscorlib System.String
mscorlib System.Text.Encoding
mscorlib System.Text.StringBuilder
mscorlib System.Threading.Interlocked
mscorlib System.Threading.Monitor
mscorlib System.Threading.Thread
mscorlib System.TimeSpan
mscorlib System.Type
mscorlib System.UInt16
mscorlib System.UInt32
mscorlib System.UInt64
mscorlib System.ValueType
mscorlib System.Void
System.Windows.Forms System.Windows.Forms.Application
System.Windows.Forms System.Windows.Forms.AutoScaleMode
System.Windows.Forms System.Windows.Forms.Button
System.Windows.Forms System.Windows.Forms.ButtonBase
System.Windows.Forms System.Windows.Forms.ComboBox
System.Windows.Forms System.Windows.Forms.ComboBox/ObjectCollection
System.Windows.Forms System.Windows.Forms.ContainerControl
System.Windows.Forms System.Windows.Forms.Control
System.Windows.Forms System.Windows.Forms.Control/ControlCollection
System.Windows.Forms System.Windows.Forms.DataGridView
System.Windows.Forms System.Windows.Forms.DataGridViewCell
System.Windows.Forms System.Windows.Forms.DataGridViewCellCollection
System.Windows.Forms System.Windows.Forms.DataGridViewCellEventArgs
System.Windows.Forms System.Windows.Forms.DataGridViewCellEventHandler
System.Windows.Forms System.Windows.Forms.DataGridViewColumnHeadersHeightSizeMode
System.Windows.Forms System.Windows.Forms.DataGridViewRow
System.Windows.Forms System.Windows.Forms.DataGridViewRowCollection
System.Windows.Forms System.Windows.Forms.DateTimePicker
System.Windows.Forms System.Windows.Forms.ErrorProvider
System.Windows.Forms System.Windows.Forms.Form
System.Windows.Forms System.Windows.Forms.FormClosedEventArgs
System.Windows.Forms System.Windows.Forms.FormClosedEventHandler
System.Windows.Forms System.Windows.Forms.FormClosingEventArgs
System.Windows.Forms System.Windows.Forms.FormClosingEventHandler
System.Windows.Forms System.Windows.Forms.Label
System.Windows.Forms System.Windows.Forms.ListControl
System.Windows.Forms System.Windows.Forms.Padding
System.Windows.Forms System.Windows.Forms.TextBox
System.Windows.Forms System.Windows.Forms.TextBoxBase

!This program cannot be run in DOS mode.
.text
`.reloc
B.rsrc
,% xL<
afeffefefe
Yfeffeefefa
afefeffefefea
Yfefefeffe
afeffefefea
Xffefefeeffe
5AMi
r;0X
Xfeffeefefhah
affeeffefehah
Xffefeeffea
Xfefeffefefe_-
d"0X
a }1uO
Yffeeffefea
^`jz
fefefeffefeYa*
ffefeefeffeY
fefefeffeXa*
fefeffefefeY
ffefeefeffea
ffeeffefe(
Rffefeeffefea(
ffeeffefe
ffefeeffe
7ffeeffefefe
fefeffeef
affefeeffe
9feffefefeef
fefefeffefe
feffefefefe
7feffeeffefe
fefeffefeef
afefeffefefe
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
!This program cannot be run in DOS mode.
.text
`.rsrc
@.reloc
')a [
afef
Ya8,'
affX8
Yee Y
Yf Ed
aef t
X +EQ X
c HC
&Yf @v7
cfef ;p3
afe 6
cf #r
c mq(
% 0Jg
af (-
cf [E
2i Y
2y(Yf
0'&X
fef hom
af [m
[` &(
af R5
J\#Xe
Xe eR"
a G9X
z%Y =
Xfe fT
f 7/|
p'|B
aef \d
6$afe
ce {`
(f z;
6f(X
|!e D
A ?1\
$Xf g
X TP-
# Xe `
Yf {TZ
Yf ?D
Xf -fz
efe 0&|
p!a X
4$X 2
Xe RH
'r[
Yefe ;
^NQ>
af p5n
Yfe @
1Eef F
.7&af @
a ptA
efe n
af 7u
Xf N^2
f iDu
Xfff
I-D $
afe
b 4XG
UkP7f
Xe ZV)
af el
X nH|
ef v`
aee zh#
Yf j7
afe H
Xefef
Ye b}r
Yf 0m
OB$X
c o|r
PK/!Y
,'X +
0*!*f
aee 3V
*e 3x
ae 4Wr
X eZY
Yf >>
Yee B
cefe
ae ge
Yefef W%
Yfeo.
Xfeee
b$ao.
Ye o~
Yeeo.
!Yfeo.
Xf '<<&Y
`cT4fe EC
_P(f svP(X
X G:n
aef 3
R!Xe
a ^m,
cfa8s
'XfeX8"
o)X D
cfY8{
Xfef
'Yf Z
Y h|w'Y _!3
(aY8q
a aRy
fe ,X'
Yefe
bfeXE
cef j?c
Xef 4Q!
Xfe e+M
Yf {M
Xe )`2
"X Z`&
+!af
() fKT
Yf* `CR
-s$X* \
af* F
Y* p_
&`)Y
cf* m
xH;> E$
f JIT
f +D$
)#Y(;
YjX})
bjX})
#'B.S
v4.0.30319
#Strings
#GUID
#Blob
Ldc_I4_0
Ldloc_0
Stloc_0
Ldarg_0
Ldc_I4_M1
Ldloc_1
Stloc_1
ReadInt32
Ldloc_2
Stloc_2
Ldloc_3
Stloc_3
Int64
Ldc_I4
Conv_I4
Ldc_I4_5
ReadUInt16
get_UTF8
<Module>
get_B
CSCSCVDWDD
XAXCASD
WDFEGGEGEGGE
SASASFWF
get_G
IMMMM
System.IO
InverseQ
get_R
Ldloc_S
Stloc_S
Brfalse_S
Bne_Un_S
Beq_S
Blt_S
set_IV
XAXAXAX
GetData
FromArgb
mscorlib
Microsoft.VisualBasic
Thread
DefineMethod
GetMethod
OpCode
CryptoStreamMode
Image
EndInvoke
BeginInvoke
IDisposable
Hashtable
RuntimeTypeHandle
GetTypeFromHandle
DefineDynamicModule
StartGame
set_Name
GetName
CallByName
AssemblyName
DefineType
CreateType
ValueType
CallType
SetReturnType
GetType
Dispose
Parse
Reverse
MulticastDelegate
Write
GuidAttribute
DebuggableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
SuppressIldasmAttribute
AssemblyFileVersionAttribute
ObfuscationAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
DefaultMemberAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
ReadByte
value
System.Threading
Encoding
System.Runtime.Versioning
FromBase64String
ReadString
GetString
System.Drawing
BTLug
BinarySearch
ComputeHash
VerifyHash
CandyCrush
get_Width
ZTNKlfXiqxii
Newobj
AsyncCallback
callback
DeclareLocal
DefineLabel
MarkLabel
GetPixel
CandyCrush.dll
GetManifestResourceStream
get_BaseStream
CryptoStream
MemoryStream
get_Item
System
SymmetricAlgorithm
HashAlgorithm
ICryptoTransform
ReadBoolean
AppDomain
get_CurrentDomain
Interaction
System.Reflection
set_Position
InvalidOperationException
StringComparison
MethodInfo
ConstructorInfo
Bitmap
Sleep
InvokeMember
BinaryReader
SHA1CryptoServiceProvider
RSACryptoServiceProvider
DESCryptoServiceProvider
MethodBuilder
ModuleBuilder
TypeBuilder
LocalBuilder
ParameterBuilder
AssemblyBuilder
Binder
Buffer
ResourceManager
ParameterModifier
DefineParameter
Color
GetILGenerator
.ctor
.cctor
GetConstructor
CreateDecryptor
Ldstr
System.Diagnostics
System.Runtime.InteropServices
System.Runtime.CompilerServices
System.Resources
OpCodes
DebuggingModes
MethodAttributes
TypeAttributes
ParameterAttributes
BindingFlags
System.Collections
RSAParameters
SetParameters
ImportParameters
AssemblyBuilderAccess
Modulus
Concat
GetObject
object
get_Height
Split
System.Reflection.Emit
IAsyncResult
result
Environment
Exponent
get_Count
Insert
Convert
Callvirt
ArrayList
System.Text
index
ToArray
ToCharArray
Juicy
set_Key
GetPublicKey
System.Security.Cryptography
DefineDynamicAssembly
GetExecutingAssembly
GetEntryAssembly
BlockCopy
op_Inequality
Feature
dead codeT
Exclude
StripAfterObfuscation
WrapNonExceptionThrows
CandyCrush
Copyright
2020
$df37b3a7-1a87-4c1c-93b1-eadfc7aa7ec3
1.0.0.0
.NETFramework,Version=v4.0
FrameworkDisplayName
.NET Framework 4
_CorDllMain
mscoree.dll
QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
IDATx^
.sw0N6
V<#dG(
X)FQsp
eOJ<K
{wO u].
*a3~>
xO5nX
#;y&J]
Ght|)
$oq[&
71FN4
C60dn5
cknU]#
r47,+
bnb8v
u9U+o
0TE }n-'c
]SB\=1.
2`n$5
MY1a8a
ZO3NgK
AwGqX
{2`p0g$
eV%Gq4)
w]hiu
`uz\*
u4>-m
<P})hQ8dW
*h\e8M4
vLKRq
U>[wDw
h"E%M
}2,R1
v;|\v
(Uy3}
|vx4a
{F!<H
'xTl}mu
)'Fm5vz
+EO\6
#6%{`Qa
_cBzNB'
tKbWF0ae
-En>(<
_(h{@
4nSO3;N?Ew
j55Z6
OGc~w
qciU'L
kys`7
Dv<5w
"me!q[
1wy07
8)cvb
?}&*SO
L^fGf
NC"h1
S.d|/
!Cqq\H
D^ ~Y
VW[=I`
bPwvo
/td#J=>
s(u.S
]D]m<
{L4~p]c?
Kfaj/
9L1Qg
~IP]m
l-}6z
a1o<c
VB&hf
P;Qd4
P_[}]
'%c)6
wJKzQ
){IcE3\F]
fvanm$
Qv8:Ii
Y|Ece
;H~\G
.C41m7
l~.;C$L
G|[{T#
4.H}s
p7x,1
{GPtn3
d~4(PAw
GVR;r
)-A3!f
Aks>3
YYFl#
cs8i.'
s`h}m#
q >2A&#
k(OZGm
tp$)!
RSe<~|a
_VjJC
k/H;q;
E2u?:>
W{DJg
.]imz
Uj4w*/
$6sOM
si2c+C
f_Cd^
JOn,oI
$UUaT
Q;Wq8
[]F`w
K#)X{
)gl.
aKsY"
Qr?r5
|~=pa
r>;Gp
wSk<=
alP(hI
cg^ N
e;#x;
MY]68
k ?Nu
%hfsI]
4n+9J
:QIcf
5i5IO
CzqG7
T;r&[
tl<AI
sDm<_
,p%SfO
E3iwl5
az])n]%
!d(j}
eMIWkJ
uRXqt
#|x|w
U22V>
]gIs-d
$6o.a
~Jk%n"
l!hQZ
dGUqx
1+NBW
,x_qS
jo*S`
x*M"O
KWc.{&
P0v0[
56{7gE
aR4bd
~HN]e
/RACi
1+oFu
e#6Y}
:) B-
FLz.1
${c~0
&5R5&
1`Tpc9
{Q?Wz.:
d0/W|
\G;o'
X.qCR
r&d3:
>]IEO6K
|{0IN
Qsqpg
|,"ji
=ITBG
<A3cM
8mzL~
m|Kj8
wl.+b
<3A2i.cO}
R>V}%c
djj6;
!0}SL
o*^e!
YAqq{
%(XUrp
%z$.,`i
Qs8EiH
&h<3X|7
S3:8$
6z~Gy
5wz&R
?ggL`
('tfT
n5-|-
1C\:_
k&QBm
]h+hF
9* 9]
kgO`]
q-#K[
=FYl*
3|^8rAo)
i 7X|
CEWJkkp)
g?V<_)
VH-Cr;7
tWG6
|?=czQ
&3`?_
'2}sk<?f
{= *A
1iQF~
{7X"5
suOLr
B!{4fqTk
9:A|>
-vXFc
/wfsN
{(1I:
sCk'!
|w?+,
\"5[[
a|q3G
M:TnE
S|~mJ
tn|""
S.mF}S
N4`v~4m
~]Jqy
ObiSW
QklOs
Of<<<
$Qy8=
$~H{^
/9gD}
wbBv)
9[5p
*hq)FU
GX|{6
Sc]P~oFkq
I)3/l
ew__s
p?&hq
-O(ZX
Ik}YP5
uaHrw
^qmD}G0
a:o3.v
Z1/q0f[}8
og`U3
Enr#^}
-hdqT
me^h,
CHOkn
H;a.$k
#orMl
9b,gF
(hq,J
hqv$Y
T,p a
\9-.B%s.
$<[$w
Xy9`p
5/?fSh+6]
-(QRi
Bi~SF
ZuFdM
G;A3N
Ant/v
t}6s7
R<V<`
f('ka!h
;M&|&pb
3G+"(z
RB2+yr
j-M3za
g,MO:
IGUPK0
K\3_K
j(]q2
vgWn?X
7q6/<ql
q'WA3
P["h5
Hx:q+f
]/hz2
y8u3!<
`32t=)
r,%';s
hY_h&E
AH7%pbz1
";l7{
[<Hyvkf
ZIjZKA
1~cGUZ
k=X$i
Q)]es
d1|l&
ObSL;v
j*T;f>
@|^J<
F\%sc
GqbN>S
&}N+:
PbEHUZ{
R)q0K,
pv\bU
gz1%m
-0oMt
Iy^O*
xv4K"
`W+RV
=x;w%r
1zBG"T
.&|R*/d
q][fDY
tL<YfY
*>FP'
23GUqg
B|oQl
M){:I
kF{Zb
hLmC3F]W2
7a5^_:w
a&=_4JUZ
Vs~M#W
FL&Fp3
8m+w#
nWghz;
~aAir
<_axCL
:[3GQTv
x]+bb
IUZ+Q
p#v-u
uewx7
VJviY
'TO>&x
E2&> ow3
'eR:'-/P
^, `v>7<'
PgLtv
4cbG";
Ysg Q
r3)U?
L0qC;I
P.+\!R
q%;uz
bo`;T
[2"r5
#7Q|b
duK7.E
6eVJ'
}#86X
\u>HUZ
@#}ylo
"\NEg)
?V'sJ6
R(TQ!
ocEB,
3EB|K
)er[L08
h<r>!B
x)aK7
u>Uf2E
oOfY%Qv
Vagx5+
FM3WS>
[1!p96
\pl!K
l^5G9
1g..=C
!,M_L
=?"F[aw
1M5cDR
Fj^t?Z
=o~(V
?}yZe
q"fjNc
BhhI$Y?
0adu=>
-Atr9
|f6R%
mT+Jp
XZ#SaH
6mq,S
ULoy+
)WoOk
=O6aU
GTxFJ
Kve-l
Vr~C{FQ
uOf^Wa
o:]0$
ctk#/
X"Gvld
{4K&o
1v6'{
lfJiQ
]$wu3q
Yah}{
\;Fuq%sB
@LD&1
:u.V7m
5mtqm}
^2z|3
^Y)av
\m,Ee
0jlZQ
4.S,&.
@vE0_~WK
DfJTp
i4;FC
\b{-DTc
gz#/go
bPC?tD
,}o?%d
l_s~N
0fZ|3?
a9-#"
I6}+Ui
z_ZkgK
pr=KJ
;S%*-
p~W$P{Y
OJwi=X
)BP%~
n+)ByR
'd\9o
,xEBB(
So(T;
h2G\~q&g)j)
_1{w<
t&8]H&
l>W7^e
IMO/>
}l*Ui
6#;c0m
tb7.f
QQh?W
jzSn&
&W~|W
wXg|l_
u!!|:
~K:I!Qi
z=O#-y/
)=Sx%
C2<0s.
<{:{+
4K%4PRh
&)CdHEi
qJTf{e2
Z,6jR
qN<QZ
OMYR|
6&)R~
FIPt9M]
DWs7A:
Tr'5e
F}rsV
i^nCf
{)bd\
$/f$Z
;/a|[l
SsNqo
o#QL,g
U_kT>DR/
ivQ$-YF
l9\RK
yC]~e
_X4yK
lZ&h\
6gxjt
!hQ:~
MY=(EH
h|Rn+
'$t+M
:p}j&
[y'h8S
CQSM$
ZFS4A
<VZ2(
FD}bf
M*fJy
4pjy,
q'x?s
ORZ`elK
dw\O^e
*(kHc
M_ZM~Ll
?dMXctVO
mnH L
A$4v$u
+]UWP~
^#=y;
,1(=
Y22f'sWE
qh>vbk
;/Ot#
1$~wf
kAkED/
B7b/T
EoZ9h2
x[AsU30
wIO:GP
^{BXI<M
qbATkN}[-h
?~}$*
MY'x79
"j'V3
/'oe!
wGx_\
F7~wo
`X_7V(
!hV!mZ|
m>N49
7gOr$
"T~+cy
l[4M>
-}c^q
PAj7'
O:3N2
c:7O/D
y4~_D
dst,^
giEQ#i
\~wkc\L
qwH-n
>NUNe
H3mOJ'
YZ2Z\
|6GvC
]LV>I~
oK>by
3\0p+C
(h|BI*C
($6h)
}JISg
>S#|F>
hn}ueF
y~&xq
e_\i_
]r_$o;
>ug9h
m%+/dp5
v!w]w
`K;tC{
b6c{\
MavY[
QKzW)
;;Ds|
/pA7FF3
1~OE3[2:
4v^5Cm
+qbi 6
5V69Xl*
%s31_:
':R&=K$
2C6.E
Esg2K
BY^_U
B~~/*'
m8F]KK
G7b&m[
{MHSw
0*)"|
&h\P~
"xT%7
_gkIrr/f
3X=n(
(XSBT
,ASeU\Y*%
"zmsQ/\)
4>6x&
s=q+r
?d){K
Wi#hq
]Dw3kX
?J~7n
c{j:K
OKTs:
"Ra)#J
jy}m6
ie#y'
AjOeaw
!~-qfFY
nsbX.cg*
P;6Nul
YN<;3
f|"@lh
6+gi)
<!zq.
8y},?.#6v
^If<W
L0[Xt
gGF6?M
>9+]Z
IyzWv
^8\=(
*cluQ
LNzWp
D\t/`
D:NAWHYE
n[_pv
db|Gz~
]:}V'
_I[-Rw
}T&=!>x
5}Zc2
0~\/Fw
q~,~_
;"7"S
CVYNZP
7=,h[
MX*h<N
|m'#C<K
o[\/.f
{-#_Up
84l9&/
F-)w{AJZ$
*i\A3_*U
`SC,G9
IDAT|
#>Y31S
_Js&/
S_|uo
`(hZms},
CSI.o
U,} !L
Z4#2x
h3yh!o
XFkE'E
T!dFG
MbNqo
Y%j8=
&Bn\c
jGZ]2
i(h|4
|@9K+z
bsVaU[
5]x8z7
6vjX]
]JY<j
=73Xf
w4dtq
Syn"g
L3AWl
23!]}"
nt$JHp
2E'E+
MC]z>
g#m8xv
|L<?r04
Sts&%
71Q^F
.&&_lF
G+WsE+Q
>eB`xk
zG1yc.
.RsBW
O"#gG
bc/'T
KFb;,
{_6n2C
nsfyo
>c;qs
}7J9KK
?fc>}/
-MtxU
YVo6$H
QL^M&
"'Qc0
w}:nOJI
#84RN
jz}^E
kJ)Q3
n;C2-08$a
/KNzI
TPXKq
z]EyI0
ms ap*G
9.hF&5bD
;P.hr9
1An'O
u`LD$+
=o%Nd
5+aILk
-M']cf
o%;xp
"AKg!=
w_=pr
n)^~sx
wglF+
fLhTBL
j3t$B
L3JD}7
C<0v+h:
)g^P\
Nlm"g
fWz)fi
W?grbD03
\y"hQ
8-j(O
QC:n:
M3nYl
;b0=Z
}K%[q
'w'Lgh^gZj
-cwR9
_VKFIo\l
s(z-Aw
P|4=p-X
W1gwA
j-Xr5
_l(?s
44!_1Kki$E
KH}U>
o|sv.
#H.HP
AyK\6+<
.*Ulv
x|^Fay
0cv\n
%X1KKF
5a #O
w 4P<
gwfXr_
%SPC-
\1MdqH(
sKXnuV
+2"RJv
iMA`{
:q'M+7r
p~)vm
I1Ng+
d([&4
b37,?sL
f/WvRhW;
ItJ|C
FcP9'=
jZ.=C
+_#5ivU
cjg}!
7'Tgb
t+7 Z
7x,hq
[N6Lg
Q=N9D
tI#ZD
\ZO9(
xz:Qk
=.h<P
tdXP{
t'op-
4n4`V
.d{$)
D;ZMbS
pgq<yj
F_tO]
o)'gC-
nSs}$
> ;^`
kO[S7
,hFsM=
7v?;D|
i+>o{!TC
2=}3k
iq0#u
eia+B
,E|3g
jC8uV
tdg:\1
:se'E
R5nqk
K*1_d
V$L#4
$G=BS'
jwN,2
&?$;/
8A-ztSLii
&qMm"
ZvWNi)
WvRt7
)}'`4
bEm1g6
n,RlG
l;JRt
dmF4'
g[%,9w
9s`<mo-
I5&\8
tDO{7
So^"s
)wi)hf9
w+h1)
x/A3F>
`-hq=fc
!y|(O
>UY?H
IBn<b
%d^~Ot
`*_Wc
*g+;)
.zL7Y
3m_}#n
y%+[(<O
NBq*!
NHO2!
SZ'I^x
A/1<;
*$5x_6
7ZShbNX
g^KZ>
&AbLc
;jtkj
^G\&oZ?
)-}$>q
fZTutE6h(
Q>`0[E
56tZf
~uzoJ
}Hw4n
;p-/R
K>~V]
#jTrL
h#m"4
ZR-oJ
eX^?F
$aK5g
9\=&n
ZTl^MX
yRJ6(
|ErK-
Niu~C
W{&pVPF
TVi35
C<sLe
.cBIC
=z^SC
/nPNi
.l6gC
([T__
MgKno^
J?2u/Q
!h\kx
5vqV<
qPI3n
x+Sem|
r#}S<y
i-'p]8a
<$"x/
G4rmM
Ui!amlY
N'Wbe
}/>k&c
E%ix)
f>O&~Q
v}=rBt
_+q~'
iS$h|
;h=za
'^#X^NM|0_J
Y'x2X
P&Y-ar
-UZkOB:
D9E4W
sf,kO
^IfZ e
oQ=t>m
$lc2aZ)TH
1~z.w
4Reau
l*:UL
asZ6)
C)A^R
Br?j`
""p5}
GfC\Q
Wn^]h
do!1;2$k
^$aK2
GF,UeB
\{G{QXx
C"n(j
fb:S>\f^
BORRq
?=^TlA
'_%=^
\4xtT
GF|XK
TWFPi~
&UP3(F
sT/<*%
>ZJXG7
77L>u
}g^h3
u#a{w
x<Z;G
8P_4c
:"w^]}
Unf'*
nG=Pa
aOHz$
u.6)$
s}&h5^
'mwsc
qoY5j[J
([C1s
CI&wG
H2)Qrd
&Dd|j>{
(;ue<
'^w'17}
$Q3n4
ZkOBK
q]qy9
*N&$=
_&h&j
KH^/H
fd:b?
P.-'8{-#BW
nKTh&t
Vf=dg
hV[!I
KE|/S9
}[{Ap-
vcxbw6
X,gOT!
={]?a
vgcf
e\&X3
iF)\(z
mMdhhv
s^g2![g
p_#\/
hQeH>[
Rg\?Z
SO&):)
"%lJkO
DD/_Em
5?#R-+
a<+EJ
u5\3.$B
vbr72
V;uoR
]KQ[4X
ioE_h
3%]l(9
!%p8.
h>XOt
jL4)dO
Mt$i:
H4O-%]
]"sl\C
"v{-Rx=
D!"}B?
sF?x7^
_vcdN<g
z(ULi}}
K|T+ T;
BBTK3
cGCh%wG
Ez\hEK
2ACk0
fSx,h<M
nd\n"6
2u/O6
4# n$'
2z7O[
56^">9$?
GlF:n/
ZTLi%
eVZKV
m'xw+
g=Y6H
L*PFWu!
__)3&
'ymQ#
F?oFVJ9
%aiP+&
=t &o
"HPLi
rBXrt
W1z.hQ
nW1\j
FkD|s
LO#4d
DE'@X
,`Ab=v
g'`Yc
_B}u&F
9ybqGW2
6A&ZL>mJk
2mc[n
~ekA3G
ZLD|g
)6HC6
R&9-b
j.NM#
v9BUb{
:+hqY
9w[J;
!2z/If
l-zw^
b|;5'@
nEERG
+=1>1
{i2uq*
J/3Rz
M7cf?
12]J7
{3W^[\
aGh]j
taKB!o
wJK1E
Duj$cu
g"-*+p
N>*hQ
INBbX
2VV})n
$w^Mi
M-scgp
edAKLD
y$N)E
T<OD5s
Gn+WsEP
C?v7hxS
Mj!i-G
\?tj<
t4/yQ
/eS(#
M!znW
{>7'<
\'siu
q1!=/
V:9X%
K7KK^
VnG'!E6
6E.6T
dD91)
T"h|9
MgttS
m*&V#
#kGK<
5>rS<
sDQQHIE
zo=}n'
NYb,h<
FwcDp
$f=8o
ytb,o
?E.we
gP3]Z
zVT69
qi}^*
g(}-h
d"Bf1
4_%aM
iE"G_F
KlnFpk]$
9CulK/
Wzp.s
V`=h"
%_2Zg
TEhF&1
ej'3:
qS<<g
9CqO;F
JIP1a
6s6pa
2sBvqs
]-Vq;a
L,Y]t0
e7y/h1;
kzU2Z,
2eI[J]t
yMLb.
\Z]}L
I}Xv3
}r$S^H
vMvS`
:t//"e
Yf:hWe
C4kv4
qo+aiL{Z
UYA6}
e9$GT
Ie^&7
X:KKz/t*
j|?ZT
qT;lJ
;{2:b$m
Hi\RN
1sy)siu
!N|+K'dm
dT^Hxv
e.-A3
9W9)hq
&E5>B
px:AG
v("vF
rw6Cz
b-.w?b
xQv6{w
o6G.b
xpmUE{s
#2nlB
#0n|N
0|gEq
9$R!hQ
WN%i1K
V`c?7
e|l6`
EsfF;
S6/:
cu72s
I}F<k
TdtaR
"6=&c
o/Br'
p6:q~
1YSNBn3
Hu<|B
lt7of]
MO'O2Z
4.OZg
b(h1j
G`]/vlJ$x
c*si-
Dqrd[|
wLC.-
74'}s*S
th^JDIwt
3X4sO
Bi~7Z
ZCrmKY
8rUCt
%Fi-}j7
TY/si-
wryj7
]SB)OQ
eshA4Q
SCRY3
9=y1NO
;IQ,e
%hf5j
)aJE{2
KXW,h
\\9.h\
ra~lg
5)>,;
{sm}x
Ai-y&
9YSX56
Ml;?A
=K&5#
XO?DW
sbu'$'
+[+y0
F=ESU
B9E"F|"
a~{%c
6T`@i-
f`9;w
]u9M>F
0y[_A
d&|[e
,{BW~
+\bQ}
~E\g-'ix
AL=Jw
g[V}n
>K'{J]ZQDv
/J9()
^?#P^
N_Myw
^"-NF;
[i9Z&
BV92l
v;&>.
3mn&p
IP%}`'fo
O+1,>
c%(_9
q4v,T
zZ4o.6
<l.~g#(0
mL2-G
(u,GuA
Il4-!
qbY.W
=wWa<!
tu$a?
Zta\x3>
n%G&*
'o9>4
SZV5]y
g7Q{<
A*W;^
}x,=t
54=\LN
;'VZa
8d/eV
r*^U^|
,z+vi
eVOn%
BQo-h<\
6#$f\4n
& l9c
%wz->
^?N7[
#|n9)
\&e8b
;%49{
{vaq;
SY h7
&PmXL
iBMw-
v^(^%
rJ&rAW
%m%jUC
qjK R
|JkD0
S(h|s
l]tO{po[*g
NEuDt
!G:lf
09#^d
cCS]Ak
a7(Nl
.k\d|
.ZU-ey
jg^Os>
eeN?:
E\osj
aXa+4
)-o/r
>bQZD
6DwV"5
t|!:g
/~<LlA
B57fs7g
+vi9*=
zx [B
x5o!/:
O!hlr#a
rFgv(
w:fwg
#]PBYV
]mGMp
b/I$`L
mOKI%
:7HI,`
[/Q9e
x^=Jr
;/rCH
KNYWp
IDAT^H
DsC/~
P0o4q
J#}P'\"T0
Pe+yQ
YTe+t
V1f}-Y!
!lA!-
**Y7?T
xo{%hq
`tf"Ym
_>Y^$m
3)t%Z
o-C5?
j+c>O"`Z
/3~M1*S
6>?~b\
eVw(3(
^9MEh.
bUz(;
qnjG>
V6U6?
uhH%8}
(h|`0
.~):#2
O|~j1fH!
R[</O
<IR}Dh
Sg3OA
Vw [y1e
/ddl6j
2z+L_
.4Kz`
An9w"
/Tca[t
}?poS&
k3hrZF
kO6i?W
*VS5x+
v.>7=
MP*RbH
q.y}.R3D
/Z~Sh
$wl<v
w~[Y0,
'C36)
AQ3V9
2QJoBb
B{>kiS
d}kh]
+ <v;
R^!J?^"
CHfLc
8MhLCZW
+h\/r
)Hr6`
'2u)[D|{
yrvu:
z'+Jg
htv%M/
nNG>K
boktj
lJ9(3
eA\l5
H0[7P
Qw~75~
WM-9p8
Qs>k&
=>?X_
y%67AC
g9a>W
?Y+X;
-wvM
3q=RO
k gEsc
"yd&W
3b"]v
to(=)&O
5kmh>
kW(UJ
[^4n)h
.y1A3O
l\67.
aw$/Z
49Lyv+
r pA=
_Du(#
O7*UZ
I$=i1
l~5D*
0]%vd
\|'{33
k(wN='mx
8wflv
UD{m"
GN7nD
nKx7o&flat]
w9E?s
qkp-[t
g3)*kF~
?dMKe
7[3&S
TMmMq
j`?vm
5~t;z
$y~5_
A\}UL
va:>n
w7fzB}
yRce_
v;ObQT_F
W|&6a
(7y/6N
=X5|&A
lX%7B
GpD>j5
fKT0o<
$Ml(gc
|xxC>
osf+:)
_/SzR
t|#ZGMS
?X$nA
{`{+M|n
`EZ{f
7gmM,
T4+<p:2
P,YCF`
Z+)U]>
HZnKT
>=`[Z8Gv?
^,\(>
Pg.zzb
CcD>3
W:bms
VojGpQU
\gV/b
<Df h
Mrq_^f
Z?jpy_Ht
q978<Y
P8lMF
x5'C7R
6#FEN
:*5~p
NGBh,
-vWNG
K=':]K"t]
mIO8F
4~((Hyv
AyJ+&Ku98p*vi
X`b\B
^'9h)#a
d9'\uD|U(5(
t_n*&
f C#Z
#8'>?*=
K=]Wj
fXA=B
m.k(U
L\F~c
!hQq6
Kl0>&
xPT;/
!~ av
Pz>\9K
N1yVollJi[b
c<yw~
W3lu:
bR%hJs:
G~&Gb
~'*2W
LL'}f
2cC{[
kek1_
yutD|
V*=):
}kj9f '
F+>,9B
=[*H%
AwMWf
<&'poh#
Rns54
v>6LH
3W9rb
Z\J]ccA3W
skq5Yv
VcV)4
uc_Q\
s\x?B
nCrHF
a.k4Wr|i(
|.'eE
B[4#{Q
jM,N]V
76]@T$X
/gyOO
8[,gI\
YDc,w
3=?.e
KT;G]
^$y}36
NXd5e%O9
A}Q16
_dzu\
$7[CHHg
'x;?`W
s%}6coH
,#fy.>sU
$RP#a
xrbg)
;u#h[)
TMq'P
3fMqH
_<QLGpi
k=;\OR2Q
{M>9c
YX&-GC;
hb4>*TZ)
0F*EI
;Dj> H
^Ch#h
B+r8$w0S-%Fl
o#w~(
G(hFq
{&({Q!k
@Mf*M
4%h1G
7}"9f
Ef'hr
aK?b>
SBirs
r-#b[r*r
,7bG1
{n*TZy
A\Q7!
u:Rqv
[YT;W
?g:m~t`U
fv7Y>
nxobR
]OP9N
cMuE3
~A%T$
Yrk9g
tUzG"
goT<[
d5Qat
oo0u/}9x
6$"V-
C)=R$h1
idNv+)
-C0v2b
1H?\c
fW"Wg
HNYf"ut
__hi}'
Pim.9
MIw/:
&hKo8
wkh/>
eU3f.
(>v<D
U~vq]k2c
&\o{au
P~)TZYd
"NlBr
*3jbX5c?1
FS}q;
Ef0[Oz
\tzKU
eMNK\?
4c&(:)
?**F0/h
Qby>
E>y5Y
NJtLk
eeDo
;8[)q9B
%L>FI
GQ+hq
9f5}t
o:l[G
3y5;'APw!
EuA3n8
>8W,@3X
Sc4w{S;
S]y}a8&
^v6PaU
@FM*_
uS8]g
-T6}Dcg9
VT;')
m5/1w
Ui-wE
qy'IJ
,Sv7-b
PT{O.
~{"X^
wmX:<
g;qNc,Jw
Ek,o<
4`Hdk,
u=e)-9
n./JU
#kgNg
"&)TZ9
(H,LM
?3Xcs
l(Gt#yg-
P#6>u
KEt4f
_|]OQ
&s|&q
X)TDqDt
~40~Im
?qcg4
P&`h[X
S'?[lZ$
o%x|He
ZZ}6e
WN]y/
J;;><
e83i_
KTCGL
Hb[e8u
u/A3Y(
dIQx>
'M"nR
@Sz8%
=aM_Y
Nh[le
*-ObecP/
"`s>g
|')TD
KOG>H
-v5e<
}y(os
ZtU8l
J+mj&q
,S.4-"7
=f/+9
:\"\o.
$.?]M
Ja] S
=7!9w]q
2s17*-
*h:E-
giM1f]D[
WTk~ux
{Vo&:
gz*TZ
:(TD%
6c-h\
Q64,"
17;1C
'pnl=2
u9-~!'
;$s#g+
ID(\Z
H#l*n
ES)mN
,M oU
toFEn%
D1KkAx_
l5|CG
kA_Z.
R$l)Y$
N[kz,
:3E}]
o5?~L
Z*5MlP
"UF9w
Chr{8
Z4/g\
LjzY,
!WM0{
w/"T1KK
[FRr=
-\L>J
_JCWA
I$nqeR
/ogWsp
E)|2c
;g3gx
#1H~w
7*E}[
qF'~5
-m85{4
.h(fi
@Z<qD#\
bI\'G
^Kl3Ob"
\Ew4Q
nO3Ys
8eD9{
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
,T<YX
.<Pj%
<eG>r
5'3~H
ffN29c
GTy.]
|Bj3H
Cy54.
yhq!R
QB'nq
v4.0.30319
#Strings
#GUID
#Blob
SWuwjRQZOu
SWuwjRQZOu.exe
mscorlib
System.Windows.Forms
System
System.Drawing
Microsoft.VisualBasic
.resources
.resources
.resources
.resources
.resources
.resources
BeheerApp.Properties.Resources.resources
.resources
.resources
.resources
.resources
.resources
CallType
Interaction
AppDomain
ArgumentOutOfRangeException
Array
Attribute
Boolean
Buffer
GeneratedCodeAttribute
System.CodeDom.Compiler
IEnumerable`1
System.Collections.Generic
List`1
CancelEventArgs
System.ComponentModel
CancelEventHandler
Container
IContainer
ISupportInitialize
DateTime
Delegate
DebuggerBrowsableAttribute
System.Diagnostics
DebuggerBrowsableState
DebuggerHiddenAttribute
DebuggerNonUserCodeAttribute
StackFrame
StackTrace
Double
Bitmap
Color
FontStyle
GraphicsUnit
Point
SizeF
EventArgs
EventHandler
EventHandler`1
Exception
CultureInfo
System.Globalization
IDisposable
EndOfStreamException
System.IO
Stream
Int16
Int32
Int64
IntPtr
NotImplementedException
NotSupportedException
Object
Assembly
System.Reflection
AssemblyCompanyAttribute
AssemblyConfigurationAttribute
AssemblyCopyrightAttribute
AssemblyDescriptionAttribute
AssemblyFileVersionAttribute
AssemblyName
AssemblyProductAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
MemberInfo
MethodBase
ResourceManager
System.Resources
CompilationRelaxationsAttribute
System.Runtime.CompilerServices
RuntimeCompatibilityAttribute
SuppressIldasmAttribute
ComVisibleAttribute
System.Runtime.InteropServices
GuidAttribute
TargetFrameworkAttribute
System.Runtime.Versioning
RuntimeMethodHandle
RuntimeTypeHandle
STAThreadAttribute
Single
String
Encoding
System.Text
StringBuilder
Interlocked
System.Threading
Monitor
Thread
TimeSpan
UInt16
UInt32
UInt64
ValueType
Application
AutoScaleMode
Button
ButtonBase
ComboBox
ObjectCollection
ContainerControl
Control
ControlCollection
DataGridView
DataGridViewCell
DataGridViewCellCollection
DataGridViewCellEventArgs
DataGridViewCellEventHandler
DataGridViewColumnHeadersHeightSizeMode
DataGridViewRow
DataGridViewRowCollection
DateTimePicker
ErrorProvider
FormClosedEventArgs
FormClosedEventHandler
FormClosingEventArgs
FormClosingEventHandler
Label
ListControl
Padding
TextBox
TextBoxBase
<Module>
.ctor
Dispose
ToString
.cctor
value__
get_CurrentThread
get_ManagedThreadId
add_FormClosed
Focus
SuspendLayout
set_Font
set_Location
set_Margin
set_Name
set_Size
set_TabIndex
set_Text
set_UseVisualStyleBackColor
add_Click
set_AutoScaleDimensions
set_AutoScaleMode
set_ClientSize
get_Controls
add_Load
ResumeLayout
get_Text
Parse
Empty
SetError
get_Value
get_Date
op_LessThan
get_Now
Clear
BeginInit
add_TextChanged
add_Validating
set_AutoSize
add_ValueChanged
set_ContainerControl
EndInit
PerformLayout
Concat
GetTypeFromHandle
get_Assembly
GetObject
set_Enabled
get_RowIndex
get_Rows
get_Item
get_Cells
set_Value
set_ColumnHeadersHeightSizeMode
set_ReadOnly
add_CellClick
add_CellContentClick
get_RowTemplate
set_Height
EnableVisualStyles
SetCompatibleTextRenderingDefault
GetDomain
Replace
CallByName
set_Visible
get_SelectedItem
get_Items
set_SelectedIndex
op_Inequality
set_Cancel
set_FormattingEnabled
add_SelectedIndexChanged
get_Black
set_ForeColor
Close
add_Validated
GetFrame
GetMethod
get_DeclaringType
Enter
GetExecutingAssembly
GetCallingAssembly
Append
GetManifestResourceStream
set_Position
get_Unicode
GetString
Intern
GetName
get_FullName
GetPublicKeyToken
ReadByte
BlockCopy
Combine
CompareExchange
Remove
Invoke
get_Day
get_Month
AddRange
get_Name
GetBytes
get_Count
set_Item
get_MetadataToken
AddDays
op_LessThanOrEqual
add_FormClosing
op_Subtraction
3System.Resources.Tools.StronglyTypedResourceBuilder
16.0.0.0
Vlan Networks
1999-2020
.NETFramework,Version=v4.0
FrameworkDisplayName
.NET Framework 4
Copyright VLAN 2020
VLAN Networks
VLC Media Player
$31a86da4-cd83-4e82-a67d-179040b36997
2.4.5.7
WrapNonExceptionThrows
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="utf-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" name="MyApplication.app" /><trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"><security><requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"><requestedExecutionLevel level="asInvoker" uiAccess="false" /></requestedPrivileges></security></trustInfo></assembly>PADDINGXXPADDINGPADDINGXXPADDING
CandyCrush4
pUJcDDgYzaXahXvhZpUnYzjqiNy
TSO1UWUGf18XLUIiOZwfBkg4RBtlWEa4LE5jSip2RRWyd2Z5Tl1qPYpvDHkARC6sa15sbE5hbWU7QnBfSW5lF3VhbGl0eTtnZXRfTGVuZ3RoO0dldFR5cGVGcm9tSGFuZGxlO2dldF9OYW1lO0luZGV4T2Y7UmVhZFN0cmluZztBZGQ7Z2V0X1Bvc2l0aW9uO2dldF9DdXJyZW50RG9tYWluO1NldERhdGE7MTM2MDM7QXNzZW1ibHlTZXJ2ZXI7U2ltcGxlQXNzZW1ibHlFeHBsb3JlcjtiYWJlbHZtO3Ntb2tldGVzdA==
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
CandyCrush
FileVersion
1.0.0.0
InternalName
CandyCrush.dll
LegalCopyright
Copyright
2020
LegalTrademarks
OriginalFilename
CandyCrush.dll
ProductName
CandyCrush
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0
$%l%T
! " #"$ +*,*-*.*/*0*1*2*
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
VLAN Networks
CompanyName
Vlan Networks
FileDescription
VLC Media Player
FileVersion
2.4.5.7
InternalName
SWuwjRQZOu.exe
LegalCopyright
1999-2020
LegalTrademarks
Copyright VLAN 2020
OriginalFilename
SWuwjRQZOu.exe
ProductName
VLC Media Player
ProductVersion
2.4.5.7
Assembly Version
3.5.7.9

Full Results

Engine Signature Engine Signature Engine Signature
Bkav Clean MicroWorld-eScan Clean FireEye Generic.mg.435dee0b278745f1
CAT-QuickHeal Clean McAfee GenericRXKR-WW!435DEE0B2787 Cylance Unsafe
Zillya Clean SUPERAntiSpyware Clean Sangfor Malware
K7AntiVirus Clean Alibaba Clean K7GW Clean
Cybereason malicious.66fafa TrendMicro Clean BitDefenderTheta Clean
F-Prot Clean Symantec Clean ESET-NOD32 a variant of MSIL/Kryptik.WPI
Baidu Clean APEX Malicious Avast Clean
ClamAV Clean Kaspersky UDS:DangerousObject.Multi.Generic BitDefender Clean
NANO-Antivirus Clean Paloalto Clean ViRobot Clean
Rising Clean Endgame malicious (high confidence) TACHYON Clean
Sophos Clean Comodo Clean F-Secure Clean
DrWeb Clean VIPRE Clean Invincea heuristic
Trapmine malicious.moderate.ml.score CMC Clean Emsisoft Clean
Ikarus Win32.Outbreak Cyren Clean Jiangmin Clean
Webroot W32.Malware.Gen Avira Clean Fortinet Clean
Antiy-AVL Clean Kingsoft Clean Arcabit Clean
AegisLab Clean AhnLab-V3 Clean ZoneAlarm UDS:DangerousObject.Multi.Generic
Avast-Mobile Clean Microsoft Trojan:Win32/Wacatac.C!ml Cynet Malicious (score: 100)
TotalDefense Clean Acronis Clean VBA32 Clean
ALYac Clean MAX Clean Ad-Aware Clean
Malwarebytes Clean Zoner Clean TrendMicro-HouseCall Clean
Tencent Clean Yandex Trojan.AvsArher.bTJEKx SentinelOne DFI - Malicious PE
eGambit Unsafe.AI_Score_94% GData Clean AVG Clean
Panda Clean CrowdStrike win/malicious_confidence_100% (W) Qihoo-360 HEUR/QVM03.0.3D1B.Malware.Gen
Sorry! No behavior.

Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
Y 1.1.1.1 [VT] Australia

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.1.5 54724 1.1.1.1 53
192.168.1.5 137 192.168.1.255 137
192.168.1.5 54312 8.8.8.8 53

DNS

No domains contacted.

HTTP Requests

No HTTP requests performed.

SMTP traffic

No SMTP traffic performed.

IRC traffic

No IRC requests performed.

ICMP traffic

No ICMP traffic performed.

CIF Results

No CIF Results

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Suricata HTTP

No Suricata HTTP

Sorry! No dropped Suricata Extracted files.

JA3

Source Source Port Destination Destination Port JA3 Hash JA3 Description
192.168.1.5 49178 13.107.42.23 443 3b483d0b34894548b602e8d18cdc24c5 unknown
Sorry! No dropped files.
Sorry! No CAPE files.
Process Name schtasks.exe
PID 6108
Dump Size 177152 bytes
Module Path C:\Windows\System32\schtasks.exe
Type PE image: 32-bit executable
PE timestamp 2010-11-20 09:20:03
MD5 173e92038857e89c7a1576820db05762
SHA1 00b30e6a291de47758604c88943f69affc49b317
SHA256 245ae550b63cd87369e8072d0b722fb0dc6304ff3568b7a758f5818919031ac1
CRC32 9292AEFD
Ssdeep 3072:Rc/ccXKiK9bJQQ1EQChbNAFrycAQkJD9tUyI/PIGBGAjCx:RIccXK5R16KOzQktURGA2
Dump Filename 245ae550b63cd87369e8072d0b722fb0dc6304ff3568b7a758f5818919031ac1
Download Download Zip
Defense Evasion Credential Access Collection Privilege Escalation Execution Persistence
  • T1116 - Code Signing
    • Signature - invalid_authenticode_signature
  • T1055 - Process Injection
    • Signature - InjectionInterProcess
  • T1045 - Software Packing
    • Signature - packer_entropy
  • T1003 - Credential Dumping
    • Signature - infostealer_browser
  • T1081 - Credentials in Files
    • Signature - infostealer_browser
  • T1005 - Data from Local System
    • Signature - infostealer_browser
  • T1055 - Process Injection
    • Signature - InjectionInterProcess
  • T1053 - Scheduled Task
    • Signature - uses_windows_utilities_to_create_scheduled_task
  • T1053 - Scheduled Task
    • Signature - uses_windows_utilities_to_create_scheduled_task
  • T1053 - Scheduled Task
    • Signature - uses_windows_utilities_to_create_scheduled_task

    Processing ( 8.354000000000001 seconds )

    • 6.12 BehaviorAnalysis
    • 0.845 Static
    • 0.548 CAPE
    • 0.26 static_dotnet
    • 0.247 VirusTotal
    • 0.082 NetworkAnalysis
    • 0.07 Dropped
    • 0.051 TargetInfo
    • 0.04 AnalysisInfo
    • 0.03 Deduplicate
    • 0.029 ProcDump
    • 0.016 Strings
    • 0.008 peid
    • 0.005 Debug
    • 0.003 Suricata

    Signatures ( 5.010999999999992 seconds )

    • 0.601 antiav_detectreg
    • 0.241 infostealer_ftp
    • 0.211 mimics_filetime
    • 0.201 territorial_disputes_sigs
    • 0.162 decoy_document
    • 0.162 stealth_timeout
    • 0.14 api_spamming
    • 0.138 infostealer_im
    • 0.131 NewtWire Behavior
    • 0.131 masquerade_process_name
    • 0.128 antivm_generic_disk
    • 0.124 antiav_detectfile
    • 0.121 antianalysis_detectreg
    • 0.109 reads_self
    • 0.101 virus
    • 0.098 Doppelganging
    • 0.097 stealth_file
    • 0.091 guloader_apis
    • 0.087 bootkit
    • 0.082 Locky_behavior
    • 0.079 infostealer_bitcoin
    • 0.071 antianalysis_detectfile
    • 0.07 injection_createremotethread
    • 0.069 antivm_vbox_keys
    • 0.06 InjectionCreateRemoteThread
    • 0.06 hancitor_behavior
    • 0.058 infostealer_mail
    • 0.051 antivm_vbox_files
    • 0.045 InjectionInterProcess
    • 0.045 antivm_vmware_keys
    • 0.039 injection_runpe
    • 0.034 InjectionProcessHollowing
    • 0.034 antivm_parallels_keys
    • 0.033 antivm_xen_keys
    • 0.029 Vidar Behavior
    • 0.029 neshta_files
    • 0.029 qulab_files
    • 0.028 InjectionSetWindowLong
    • 0.028 predatorthethief_files
    • 0.027 infostealer_browser
    • 0.026 ransomware_files
    • 0.025 exploit_heapspray
    • 0.025 geodo_banking_trojan
    • 0.024 antidebug_guardpages
    • 0.023 antivm_generic_diskreg
    • 0.022 PlugX
    • 0.022 antivm_vpc_keys
    • 0.021 exec_crash
    • 0.021 kovter_behavior
    • 0.021 antidbg_devices
    • 0.02 hawkeye_behavior
    • 0.02 stack_pivot
    • 0.019 dynamic_function_loading
    • 0.019 injection_explorer
    • 0.018 antivm_generic_scsi
    • 0.018 antivm_vmware_files
    • 0.017 antiemu_wine_func
    • 0.017 infostealer_browser_password
    • 0.016 betabot_behavior
    • 0.016 malicious_dynamic_function_loading
    • 0.015 kibex_behavior
    • 0.015 network_tor
    • 0.015 ransomware_extensions
    • 0.014 TransactedHollowing
    • 0.014 shifu_behavior
    • 0.013 Unpacker
    • 0.013 h1n1_behavior
    • 0.013 rat_luminosity
    • 0.011 stack_pivot_file_created
    • 0.011 antivm_xen_keys
    • 0.011 antivm_hyperv_keys
    • 0.011 antivm_vbox_devices
    • 0.011 bypass_firewall
    • 0.011 masslogger_files
    • 0.009 antivm_generic_services
    • 0.009 kazybot_behavior
    • 0.009 persistence_autorun
    • 0.009 OrcusRAT Behavior
    • 0.009 codelux_behavior
    • 0.008 antivm_vbox_libs
    • 0.008 recon_programs
    • 0.008 ketrican_regkeys
    • 0.008 limerat_regkeys
    • 0.008 rat_pcclient
    • 0.007 antiav_avast_libs
    • 0.007 antidbg_windows
    • 0.007 exploit_getbasekerneladdress
    • 0.007 exploit_gethaldispatchtable
    • 0.007 blackrat_registry_keys
    • 0.007 vawtrak_behavior
    • 0.007 darkcomet_regkeys
    • 0.007 recon_fingerprint
    • 0.006 antivm_generic_bios
    • 0.006 antivm_generic_system
    • 0.006 obliquerat_files
    • 0.006 sniffer_winpcap
    • 0.005 antisandbox_sunbelt_libs
    • 0.005 dyre_behavior
    • 0.005 antisandbox_threattrack_files
    • 0.005 antivm_vpc_files
    • 0.005 browser_security
    • 0.005 disables_browser_warn
    • 0.005 remcos_regkeys
    • 0.005 targeted_flame
    • 0.004 antiav_bitdefender_libs
    • 0.004 antiav_emsisoft_libs
    • 0.004 antiav_apioverride_libs
    • 0.004 antiav_nthookengine_libs
    • 0.004 antisandbox_sboxie_libs
    • 0.004 encrypted_ioc
    • 0.004 ipc_namedpipe
    • 0.004 office_com_load
    • 0.004 antisandbox_fortinet_files
    • 0.004 banker_cridex
    • 0.004 network_tor_service
    • 0.004 medusalocker_regkeys
    • 0.004 dcrat_files
    • 0.004 warzonerat_files
    • 0.004 warzonerat_regkeys
    • 0.004 remcos_files
    • 0.003 antiav_bullgaurd_libs
    • 0.003 antiav_qurb_libs
    • 0.003 uac_bypass_eventvwr
    • 0.003 office_flash_load
    • 0.003 antisandbox_cuckoo_files
    • 0.003 antisandbox_joe_anubis_files
    • 0.003 antisandbox_sunbelt_files
    • 0.003 modify_proxy
    • 0.002 antisandbox_sleep
    • 0.002 antivm_vmware_libs
    • 0.002 office_vb_load
    • 0.002 office_wmi_load
    • 0.002 sets_autoconfig_url
    • 0.002 tinba_behavior
    • 0.002 bitcoin_opencl
    • 0.002 browser_addon
    • 0.002 arkei_files
    • 0.002 office_perfkey
    • 0.002 packer_armadillo_regkey
    • 0.002 nemty_regkeys
    • 0.002 revil_mutexes
    • 0.002 modirat_bheavior
    • 0.002 spreading_autoruninf
    • 0.001 EvilGrab
    • 0.001 regsvr32_squiblydoo_dll_load
    • 0.001 cerber_behavior
    • 0.001 dridex_behavior
    • 0.001 Raccoon Behavior
    • 0.001 office_dotnet_load
    • 0.001 persistence_autorun_tasks
    • 0.001 ransomware_message
    • 0.001 rat_nanocore
    • 0.001 antivm_generic_cpu
    • 0.001 banker_zeus_mutex
    • 0.001 bot_drive
    • 0.001 disables_smartscreen
    • 0.001 disables_system_restore
    • 0.001 disables_windows_defender
    • 0.001 removes_windows_defender_contextmenu
    • 0.001 azorult_mutexes
    • 0.001 modify_security_center_warnings
    • 0.001 modify_uac_prompt
    • 0.001 office_security
    • 0.001 persistence_shim_database
    • 0.001 ransomware_radamant
    • 0.001 stealth_hiddenreg
    • 0.001 stealth_hide_notifications
    • 0.001 tampers_etw
    • 0.001 lokibot_mutexes

    Reporting ( 32.575 seconds )

    • 19.203 BinGraph
    • 13.208 JsonDump
    • 0.109 SubmitCAPE
    • 0.051 MITRE_TTPS
    • 0.004 PCAP2CERT