Detections

Yara:

AgentTeslaV2

Auto Tasks

#17865: Unpacker

Analysis

Category Package Started Completed Duration Options Log
FILE exe 2020-06-30 15:44:09 2020-06-30 15:50:20 371 seconds Show Options Show Log
route = tor
2020-05-13 09:29:43,996 [root] INFO: Date set to: 20200630T15:29:16, timeout set to: 200
2020-06-30 15:29:16,062 [root] DEBUG: Starting analyzer from: C:\tmp558c2t_g
2020-06-30 15:29:16,062 [root] DEBUG: Storing results at: C:\hAijBASSFV
2020-06-30 15:29:16,062 [root] DEBUG: Pipe server name: \\.\PIPE\TbxJUD
2020-06-30 15:29:16,062 [root] DEBUG: Python path: C:\Users\Louise\AppData\Local\Programs\Python\Python38-32
2020-06-30 15:29:16,062 [root] DEBUG: No analysis package specified, trying to detect it automagically.
2020-06-30 15:29:16,062 [root] INFO: Automatically selected analysis package "exe"
2020-06-30 15:29:16,078 [root] DEBUG: Trying to import analysis package "exe"...
2020-06-30 15:29:16,453 [root] DEBUG: Imported analysis package "exe".
2020-06-30 15:29:16,453 [root] DEBUG: Trying to initialize analysis package "exe"...
2020-06-30 15:29:16,453 [root] DEBUG: Initialized analysis package "exe".
2020-06-30 15:29:17,109 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.browser"...
2020-06-30 15:29:17,140 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser".
2020-06-30 15:29:17,140 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.curtain"...
2020-06-30 15:29:17,171 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain".
2020-06-30 15:29:17,171 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.digisig"...
2020-06-30 15:29:17,234 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig".
2020-06-30 15:29:17,234 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.disguise"...
2020-06-30 15:29:17,234 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise".
2020-06-30 15:29:17,249 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.human"...
2020-06-30 15:29:17,265 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human".
2020-06-30 15:29:17,265 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.procmon"...
2020-06-30 15:29:17,296 [root] DEBUG: Imported auxiliary module "modules.auxiliary.procmon".
2020-06-30 15:29:17,296 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.screenshots"...
2020-06-30 15:29:17,359 [modules.auxiliary.screenshots] DEBUG: Importing 'time'
2020-06-30 15:29:17,359 [modules.auxiliary.screenshots] DEBUG: Importing 'StringIO'
2020-06-30 15:29:17,359 [modules.auxiliary.screenshots] DEBUG: Importing 'Thread'
2020-06-30 15:29:17,359 [modules.auxiliary.screenshots] DEBUG: Importing 'Auxiliary'
2020-06-30 15:29:17,359 [modules.auxiliary.screenshots] DEBUG: Importing 'NetlogFile'
2020-06-30 15:29:17,359 [modules.auxiliary.screenshots] DEBUG: Importing 'Screenshot'
2020-06-30 15:29:17,375 [lib.api.screenshot] DEBUG: Importing 'math'
2020-06-30 15:29:17,375 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2020-06-30 15:29:19,468 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2020-06-30 15:29:19,562 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2020-06-30 15:29:19,937 [modules.auxiliary.screenshots] DEBUG: Imports OK
2020-06-30 15:29:19,937 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots".
2020-06-30 15:29:19,937 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.sysmon"...
2020-06-30 15:29:19,953 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon".
2020-06-30 15:29:19,953 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.usage"...
2020-06-30 15:29:20,078 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage".
2020-06-30 15:29:20,078 [root] DEBUG: Trying to initialize auxiliary module "Browser"...
2020-06-30 15:29:20,078 [root] DEBUG: Initialized auxiliary module "Browser".
2020-06-30 15:29:20,078 [root] DEBUG: Trying to start auxiliary module "Browser"...
2020-06-30 15:29:20,078 [root] DEBUG: Started auxiliary module Browser
2020-06-30 15:29:20,093 [root] DEBUG: Trying to initialize auxiliary module "Curtain"...
2020-06-30 15:29:20,093 [root] DEBUG: Initialized auxiliary module "Curtain".
2020-06-30 15:29:20,093 [root] DEBUG: Trying to start auxiliary module "Curtain"...
2020-06-30 15:29:20,093 [root] DEBUG: Started auxiliary module Curtain
2020-06-30 15:29:20,093 [root] DEBUG: Trying to initialize auxiliary module "DigiSig"...
2020-06-30 15:29:20,093 [root] DEBUG: Initialized auxiliary module "DigiSig".
2020-06-30 15:29:20,093 [root] DEBUG: Trying to start auxiliary module "DigiSig"...
2020-06-30 15:29:20,093 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature.
2020-06-30 15:29:21,796 [modules.auxiliary.digisig] DEBUG: File is not signed.
2020-06-30 15:29:21,796 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2020-06-30 15:29:21,812 [root] DEBUG: Started auxiliary module DigiSig
2020-06-30 15:29:21,812 [root] DEBUG: Trying to initialize auxiliary module "Disguise"...
2020-06-30 15:29:21,812 [root] DEBUG: Initialized auxiliary module "Disguise".
2020-06-30 15:29:21,812 [root] DEBUG: Trying to start auxiliary module "Disguise"...
2020-06-30 15:29:21,828 [root] DEBUG: Started auxiliary module Disguise
2020-06-30 15:29:21,828 [root] DEBUG: Trying to initialize auxiliary module "Human"...
2020-06-30 15:29:21,828 [root] DEBUG: Initialized auxiliary module "Human".
2020-06-30 15:29:21,828 [root] DEBUG: Trying to start auxiliary module "Human"...
2020-06-30 15:29:21,843 [root] DEBUG: Started auxiliary module Human
2020-06-30 15:29:21,843 [root] DEBUG: Trying to initialize auxiliary module "Procmon"...
2020-06-30 15:29:21,843 [root] DEBUG: Initialized auxiliary module "Procmon".
2020-06-30 15:29:21,843 [root] DEBUG: Trying to start auxiliary module "Procmon"...
2020-06-30 15:29:21,875 [root] DEBUG: Started auxiliary module Procmon
2020-06-30 15:29:21,875 [root] DEBUG: Trying to initialize auxiliary module "Screenshots"...
2020-06-30 15:29:21,875 [root] DEBUG: Initialized auxiliary module "Screenshots".
2020-06-30 15:29:21,875 [root] DEBUG: Trying to start auxiliary module "Screenshots"...
2020-06-30 15:29:21,875 [root] DEBUG: Started auxiliary module Screenshots
2020-06-30 15:29:21,875 [root] DEBUG: Trying to initialize auxiliary module "Sysmon"...
2020-06-30 15:29:21,875 [root] DEBUG: Initialized auxiliary module "Sysmon".
2020-06-30 15:29:21,875 [root] DEBUG: Trying to start auxiliary module "Sysmon"...
2020-06-30 15:29:21,875 [root] DEBUG: Started auxiliary module Sysmon
2020-06-30 15:29:21,875 [root] DEBUG: Trying to initialize auxiliary module "Usage"...
2020-06-30 15:29:21,875 [root] DEBUG: Initialized auxiliary module "Usage".
2020-06-30 15:29:21,875 [root] DEBUG: Trying to start auxiliary module "Usage"...
2020-06-30 15:29:21,875 [root] DEBUG: Started auxiliary module Usage
2020-06-30 15:29:21,875 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL option
2020-06-30 15:29:21,890 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL_64 option
2020-06-30 15:29:21,890 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option
2020-06-30 15:29:21,890 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option
2020-06-30 15:29:21,953 [lib.api.process] INFO: Successfully executed process from path "C:\Users\Louise\AppData\Local\Temp\yy4Wxq30N6hFB.exe" with arguments "" with pid 2712
2020-06-30 15:29:21,953 [lib.api.process] INFO: Monitor config for process 2712: C:\tmp558c2t_g\dll\2712.ini
2020-06-30 15:29:21,968 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp558c2t_g\dll\nxPdrt.dll, loader C:\tmp558c2t_g\bin\aLMQePS.exe
2020-06-30 15:29:22,156 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TbxJUD.
2020-06-30 15:29:22,156 [root] DEBUG: Loader: Injecting process 2712 (thread 1872) with C:\tmp558c2t_g\dll\nxPdrt.dll.
2020-06-30 15:29:22,156 [root] DEBUG: Process image base: 0x00CC0000
2020-06-30 15:29:22,156 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 15:29:22,171 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 15:29:22,171 [root] DEBUG: Successfully injected DLL C:\tmp558c2t_g\dll\nxPdrt.dll.
2020-06-30 15:29:22,265 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2712
2020-06-30 15:29:24,343 [lib.api.process] INFO: Successfully resumed process with pid 2712
2020-06-30 15:29:26,562 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 15:29:26,625 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 15:29:26,687 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 2712 at 0x6f970000, image base 0xcc0000, stack from 0x3a6000-0x3b0000
2020-06-30 15:29:26,703 [root] DEBUG: Commandline: C:\Users\Louise\AppData\Local\Temp\"C:\Users\Louise\AppData\Local\Temp\yy4Wxq30N6hFB.exe".
2020-06-30 15:29:26,968 [root] INFO: Loaded monitor into process with pid 2712
2020-06-30 15:29:28,109 [root] DEBUG: set_caller_info: Adding region at 0x002B0000 to caller regions list (advapi32::RegQueryInfoKeyW).
2020-06-30 15:29:28,109 [root] DEBUG: set_caller_info: Adding region at 0x023E0000 to caller regions list (ntdll::RtlDispatchException).
2020-06-30 15:29:28,156 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x23e0000
2020-06-30 15:29:28,171 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x023E0000 size 0x400000.
2020-06-30 15:29:28,171 [root] DEBUG: DumpPEsInRange: Scanning range 0x23e0000 - 0x23e1000.
2020-06-30 15:29:28,171 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x23e0000-0x23e1000.
2020-06-30 15:29:28,265 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\hAijBASSFV\CAPE\2712_1864641980284911372020 (size 0xffe)
2020-06-30 15:29:28,265 [root] DEBUG: DumpRegion: Dumped stack region from 0x023E0000, size 0x1000.
2020-06-30 15:29:28,265 [root] DEBUG: set_caller_info: Failed to dumping calling PE image at 0x002B0000.
2020-06-30 15:29:28,265 [root] DEBUG: set_caller_info: Adding region at 0x00500000 to caller regions list (kernel32::FindFirstFileExW).
2020-06-30 15:29:28,375 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x57ffff
2020-06-30 15:29:28,375 [root] DEBUG: DumpMemory: Nothing to dump at 0x00500000!
2020-06-30 15:29:28,375 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00500000 size 0x80000.
2020-06-30 15:29:28,375 [root] DEBUG: DumpPEsInRange: Scanning range 0x500000 - 0x517000.
2020-06-30 15:29:28,375 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x500000-0x517000.
2020-06-30 15:29:28,625 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\hAijBASSFV\CAPE\2712_1344273128284911372020 (size 0x16ffa)
2020-06-30 15:29:28,625 [root] DEBUG: DumpRegion: Dumped stack region from 0x00500000, size 0x17000.
2020-06-30 15:29:28,640 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xe0 amd local view 0x732A0000 to global list.
2020-06-30 15:29:28,640 [root] DEBUG: DLL loaded at 0x732A0000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x7d000 bytes).
2020-06-30 15:29:28,640 [root] DEBUG: DLL unloaded from 0x75E80000.
2020-06-30 15:29:28,656 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xf0 amd local view 0x001C0000 to global list.
2020-06-30 15:29:28,671 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xec amd local view 0x001C0000 to global list.
2020-06-30 15:29:28,671 [root] DEBUG: DLL loaded at 0x734E0000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-30 15:29:28,687 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x72660000 for section view with handle 0xf0.
2020-06-30 15:29:28,687 [root] DEBUG: DLL loaded at 0x72660000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr (0x6ef000 bytes).
2020-06-30 15:29:28,687 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x73510000 for section view with handle 0xf0.
2020-06-30 15:29:28,703 [root] DEBUG: DLL loaded at 0x73510000: C:\Windows\system32\MSVCR120_CLR0400 (0xf5000 bytes).
2020-06-30 15:29:29,562 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 2712, handle 0x110.
2020-06-30 15:29:29,812 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x114 amd local view 0x00110000 to global list.
2020-06-30 15:29:29,812 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x118 amd local view 0x00160000 to global list.
2020-06-30 15:29:29,843 [root] INFO: Disabling sleep skipping.
2020-06-30 15:29:29,890 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 2712.
2020-06-30 15:29:30,296 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 2712.
2020-06-30 15:29:30,359 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1cc amd local view 0x06330000 to global list.
2020-06-30 15:29:30,421 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 2712.
2020-06-30 15:29:31,984 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x210 amd local view 0x6E5D0000 to global list.
2020-06-30 15:29:32,000 [root] DEBUG: DLL loaded at 0x6E5D0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni (0x1393000 bytes).
2020-06-30 15:29:33,218 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x21c amd local view 0x73070000 to global list.
2020-06-30 15:29:33,249 [root] DEBUG: DLL loaded at 0x73070000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit (0x80000 bytes).
2020-06-30 15:29:33,281 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x218 amd local view 0x75DE0000 to global list.
2020-06-30 15:29:33,281 [root] DEBUG: DLL loaded at 0x75DE0000: C:\Windows\syswow64\OLEAUT32 (0x91000 bytes).
2020-06-30 15:29:34,312 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x230 amd local view 0x70890000 to global list.
2020-06-30 15:29:34,343 [root] DEBUG: DLL loaded at 0x70890000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni (0xa10000 bytes).
2020-06-30 15:29:34,437 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x72ED0000 for section view with handle 0x230.
2020-06-30 15:29:34,453 [root] DEBUG: DLL loaded at 0x72ED0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni (0x194000 bytes).
2020-06-30 15:29:35,546 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x22c amd local view 0x6D8B0000 to global list.
2020-06-30 15:29:35,687 [root] DEBUG: DLL loaded at 0x6D8B0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni (0xd1d000 bytes).
2020-06-30 15:29:37,421 [root] DEBUG: set_caller_info: Adding region at 0x00220000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-06-30 15:29:37,437 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x22ffff
2020-06-30 15:29:37,437 [root] DEBUG: DumpMemory: Nothing to dump at 0x00220000!
2020-06-30 15:29:37,437 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00220000 size 0x10000.
2020-06-30 15:29:37,437 [root] DEBUG: DumpPEsInRange: Scanning range 0x220000 - 0x221000.
2020-06-30 15:29:37,437 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x220000-0x221000.
2020-06-30 15:29:37,468 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\hAijBASSFV\CAPE\2712_1514146955574911372020 (size 0x52d)
2020-06-30 15:29:37,468 [root] DEBUG: DumpRegion: Dumped stack region from 0x00220000, size 0x1000.
2020-06-30 15:29:37,562 [root] DEBUG: DLL loaded at 0x742C0000: C:\Windows\system32\uxtheme (0x80000 bytes).
2020-06-30 15:29:37,562 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x23c amd local view 0x70390000 to global list.
2020-06-30 15:29:37,812 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x244 amd local view 0x022E0000 to global list.
2020-06-30 15:29:37,890 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x002A0000 for section view with handle 0x244.
2020-06-30 15:29:48,046 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x248 amd local view 0x706F0000 to global list.
2020-06-30 15:29:48,046 [root] DEBUG: DLL loaded at 0x706F0000: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\gdiplus (0x192000 bytes).
2020-06-30 15:29:48,062 [root] DEBUG: set_caller_info: Adding region at 0x001C0000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-06-30 15:29:48,078 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x1cffff
2020-06-30 15:29:48,078 [root] DEBUG: DumpMemory: Nothing to dump at 0x001C0000!
2020-06-30 15:29:48,078 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x001C0000 size 0x10000.
2020-06-30 15:29:48,078 [root] DEBUG: DumpPEsInRange: Scanning range 0x1c0000 - 0x1c1000.
2020-06-30 15:29:48,093 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x1c0000-0x1c1000.
2020-06-30 15:29:48,125 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\hAijBASSFV\CAPE\2712_623169746315011372020 (size 0x14)
2020-06-30 15:29:48,125 [root] DEBUG: DumpRegion: Dumped stack region from 0x001C0000, size 0x1000.
2020-06-30 15:29:48,140 [root] DEBUG: DLL loaded at 0x72D90000: C:\Windows\system32\WindowsCodecs (0x131000 bytes).
2020-06-30 15:29:48,156 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x258 amd local view 0x00670000 to global list.
2020-06-30 15:29:48,156 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x00680000 for section view with handle 0x258.
2020-06-30 15:29:48,156 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x00690000 for section view with handle 0x258.
2020-06-30 15:29:48,703 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 2712.
2020-06-30 15:29:48,734 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 2712.
2020-06-30 15:29:48,906 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x27c amd local view 0x6D0D0000 to global list.
2020-06-30 15:29:48,937 [root] DEBUG: DLL loaded at 0x6D0D0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni (0x7e0000 bytes).
2020-06-30 15:29:49,000 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x278 amd local view 0x70510000 to global list.
2020-06-30 15:29:49,015 [root] DEBUG: DLL loaded at 0x70510000: C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni (0x1d1000 bytes).
2020-06-30 15:29:49,109 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x274 amd local view 0x72D70000 to global list.
2020-06-30 15:29:49,109 [root] DEBUG: DLL loaded at 0x72D70000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting (0x13000 bytes).
2020-06-30 15:29:49,140 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x06F70000 for section view with handle 0x274.
2020-06-30 15:29:49,249 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x270 amd local view 0x00970000 to global list.
2020-06-30 15:29:59,625 [root] DEBUG: DLL loaded at 0x750D0000: C:\Windows\syswow64\shell32 (0xc4c000 bytes).
2020-06-30 15:29:59,656 [root] INFO: Added new file to list with pid None and path C:\Users\Louise\AppData\Roaming\wlghamtwHhHNh.exe
2020-06-30 15:29:59,765 [root] INFO: Added new file to list with pid None and path C:\Users\Louise\AppData\Local\Temp\tmpFF2B.tmp
2020-06-30 15:29:59,859 [root] DEBUG: DLL loaded at 0x70410000: C:\Windows\system32\PROPSYS (0xf5000 bytes).
2020-06-30 15:29:59,875 [root] DEBUG: DLL loaded at 0x73950000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32 (0x19e000 bytes).
2020-06-30 15:29:59,875 [root] DEBUG: DLL loaded at 0x74C10000: C:\Windows\system32\apphelp (0x4c000 bytes).
2020-06-30 15:29:59,937 [root] DEBUG: DLL loaded at 0x761C0000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes).
2020-06-30 15:29:59,953 [root] DEBUG: DLL loaded at 0x6BB50000: C:\Windows\SysWOW64\ieframe (0xaba000 bytes).
2020-06-30 15:29:59,953 [root] DEBUG: DLL loaded at 0x76180000: C:\Windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes).
2020-06-30 15:29:59,953 [root] DEBUG: DLL loaded at 0x75D40000: C:\Windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0 (0x4000 bytes).
2020-06-30 15:29:59,953 [root] DEBUG: DLL loaded at 0x75FC0000: C:\Windows\syswow64\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes).
2020-06-30 15:29:59,953 [root] DEBUG: DLL loaded at 0x72D60000: C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0 (0x4000 bytes).
2020-06-30 15:29:59,953 [root] DEBUG: DLL loaded at 0x76250000: C:\Windows\syswow64\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes).
2020-06-30 15:29:59,968 [root] DEBUG: DLL loaded at 0x74CF0000: C:\Windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes).
2020-06-30 15:29:59,968 [root] DEBUG: DLL loaded at 0x75F30000: C:\Windows\syswow64\normaliz (0x3000 bytes).
2020-06-30 15:29:59,968 [root] DEBUG: DLL loaded at 0x76900000: C:\Windows\syswow64\iertutil (0x215000 bytes).
2020-06-30 15:30:00,000 [root] DEBUG: DLL loaded at 0x74D00000: C:\Windows\syswow64\SETUPAPI (0x19d000 bytes).
2020-06-30 15:30:00,000 [root] DEBUG: DLL loaded at 0x750A0000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes).
2020-06-30 15:30:00,000 [root] DEBUG: DLL loaded at 0x75D20000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes).
2020-06-30 15:30:00,015 [root] DEBUG: DLL unloaded from 0x750D0000.
2020-06-30 15:30:00,015 [root] DEBUG: DLL loaded at 0x73CD0000: C:\Windows\system32\ntmarta (0x21000 bytes).
2020-06-30 15:30:00,015 [root] DEBUG: DLL loaded at 0x75F60000: C:\Windows\syswow64\WLDAP32 (0x45000 bytes).
2020-06-30 15:30:00,031 [root] DEBUG: DLL loaded at 0x74380000: C:\Windows\system32\profapi (0xb000 bytes).
2020-06-30 15:30:00,046 [root] DEBUG: DLL loaded at 0x765C0000: C:\Windows\SysWOW64\urlmon (0x124000 bytes).
2020-06-30 15:30:00,046 [root] DEBUG: DLL loaded at 0x76260000: C:\Windows\syswow64\api-ms-win-downlevel-ole32-l1-1-0 (0x4000 bytes).
2020-06-30 15:30:00,093 [root] DEBUG: DLL loaded at 0x76300000: C:\Windows\syswow64\WININET (0x1c4000 bytes).
2020-06-30 15:30:00,109 [root] DEBUG: DLL loaded at 0x72D50000: C:\Windows\system32\Secur32 (0x8000 bytes).
2020-06-30 15:30:00,140 [root] INFO: Announced 32-bit process name: schtasks.exe pid: 4344
2020-06-30 15:30:00,140 [lib.api.process] INFO: Monitor config for process 4344: C:\tmp558c2t_g\dll\4344.ini
2020-06-30 15:30:00,140 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp558c2t_g\dll\nxPdrt.dll, loader C:\tmp558c2t_g\bin\aLMQePS.exe
2020-06-30 15:30:00,171 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TbxJUD.
2020-06-30 15:30:00,171 [root] DEBUG: Loader: Injecting process 4344 (thread 3660) with C:\tmp558c2t_g\dll\nxPdrt.dll.
2020-06-30 15:30:00,171 [root] DEBUG: Process image base: 0x00E20000
2020-06-30 15:30:00,187 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp558c2t_g\dll\nxPdrt.dll.
2020-06-30 15:30:00,187 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-30 15:30:00,187 [root] DEBUG: Successfully injected DLL C:\tmp558c2t_g\dll\nxPdrt.dll.
2020-06-30 15:30:00,203 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 4344
2020-06-30 15:30:00,249 [root] DEBUG: CreateProcessHandler: Injection info set for new process 4344, ImageBase: 0x00E20000
2020-06-30 15:30:00,249 [root] INFO: Announced 32-bit process name: schtasks.exe pid: 4344
2020-06-30 15:30:00,249 [lib.api.process] INFO: Monitor config for process 4344: C:\tmp558c2t_g\dll\4344.ini
2020-06-30 15:30:00,249 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp558c2t_g\dll\nxPdrt.dll, loader C:\tmp558c2t_g\bin\aLMQePS.exe
2020-06-30 15:30:00,265 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TbxJUD.
2020-06-30 15:30:00,281 [root] DEBUG: Loader: Injecting process 4344 (thread 3660) with C:\tmp558c2t_g\dll\nxPdrt.dll.
2020-06-30 15:30:00,281 [root] DEBUG: Process image base: 0x00E20000
2020-06-30 15:30:00,281 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp558c2t_g\dll\nxPdrt.dll.
2020-06-30 15:30:00,281 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-06-30 15:30:00,281 [root] DEBUG: Successfully injected DLL C:\tmp558c2t_g\dll\nxPdrt.dll.
2020-06-30 15:30:00,281 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 4344
2020-06-30 15:30:00,312 [root] DEBUG: DLL loaded at 0x74360000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-06-30 15:30:00,312 [root] DEBUG: DLL loaded at 0x74270000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-06-30 15:30:00,328 [root] DEBUG: DLL loaded at 0x73920000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-06-30 15:30:00,375 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 15:30:00,375 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 15:30:00,375 [root] INFO: Disabling sleep skipping.
2020-06-30 15:30:00,375 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-30 15:30:00,437 [root] INFO: Loaded monitor into process with pid 4344
2020-06-30 15:30:00,453 [root] DEBUG: DLL loaded at 0x734E0000: C:\Windows\SysWOW64\VERSION (0x9000 bytes).
2020-06-30 15:30:00,453 [root] DEBUG: DLL unloaded from 0x00E20000.
2020-06-30 15:30:00,468 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xd8 amd local view 0x037B0000 to global list.
2020-06-30 15:30:00,468 [root] DEBUG: ResumeThreadHandler: CurrentInjectionInfo 0x0 (Pid 4344).
2020-06-30 15:30:00,484 [root] INFO: Stopping Task Scheduler Service
2020-06-30 15:30:01,421 [root] INFO: Stopped Task Scheduler Service
2020-06-30 15:30:01,578 [root] INFO: Starting Task Scheduler Service
2020-06-30 15:30:01,718 [root] INFO: Started Task Scheduler Service
2020-06-30 15:30:01,718 [lib.api.process] INFO: Monitor config for process 840: C:\tmp558c2t_g\dll\840.ini
2020-06-30 15:30:01,750 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp558c2t_g\dll\onxtlvG.dll, loader C:\tmp558c2t_g\bin\KcmxYXEr.exe
2020-06-30 15:30:01,765 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TbxJUD.
2020-06-30 15:30:01,765 [root] DEBUG: Loader: Injecting process 840 (thread 0) with C:\tmp558c2t_g\dll\onxtlvG.dll.
2020-06-30 15:30:01,765 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 15:30:01,781 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2020-06-30 15:30:01,781 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 15:30:01,781 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 15:30:01,796 [root] INFO: Disabling sleep skipping.
2020-06-30 15:30:01,796 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 840 at 0x0000000070300000, image base 0x00000000FF500000, stack from 0x0000000001D56000-0x0000000001D60000
2020-06-30 15:30:01,796 [root] DEBUG: Commandline: C:\Windows\sysnative\svchost.exe -k netsvcs.
2020-06-30 15:30:01,859 [root] WARNING: b'Unable to place hook on LockResource'
2020-06-30 15:30:01,859 [root] WARNING: b'Unable to hook LockResource'
2020-06-30 15:30:01,906 [root] INFO: Loaded monitor into process with pid 840
2020-06-30 15:30:01,906 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-30 15:30:01,921 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-30 15:30:01,921 [root] DEBUG: Successfully injected DLL C:\tmp558c2t_g\dll\onxtlvG.dll.
2020-06-30 15:30:03,921 [root] DEBUG: DLL loaded at 0x761C0000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes).
2020-06-30 15:30:03,921 [root] DEBUG: DLL loaded at 0x73610000: C:\Windows\SysWOW64\taskschd (0x7d000 bytes).
2020-06-30 15:30:05,000 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 4344
2020-06-30 15:30:05,015 [root] DEBUG: GetHookCallerBase: thread 3660 (handle 0x0), return address 0x00E37569, allocation base 0x00E20000.
2020-06-30 15:30:05,015 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00E20000.
2020-06-30 15:30:05,015 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-30 15:30:05,015 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00E20000.
2020-06-30 15:30:05,015 [root] DEBUG: DumpProcess: Module entry point VA is 0x00017683.
2020-06-30 15:30:05,062 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x2b400.
2020-06-30 15:30:05,078 [root] DEBUG: DLL unloaded from 0x768A0000.
2020-06-30 15:30:05,171 [root] INFO: Process with pid 4344 has terminated
2020-06-30 15:30:05,296 [root] INFO: Announced 32-bit process name: yy4Wxq30N6hFB.exe pid: 3620
2020-06-30 15:30:05,296 [lib.api.process] INFO: Monitor config for process 3620: C:\tmp558c2t_g\dll\3620.ini
2020-06-30 15:30:05,343 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp558c2t_g\dll\nxPdrt.dll, loader C:\tmp558c2t_g\bin\aLMQePS.exe
2020-06-30 15:30:05,484 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TbxJUD.
2020-06-30 15:30:05,531 [root] DEBUG: Loader: Injecting process 3620 (thread 3624) with C:\tmp558c2t_g\dll\nxPdrt.dll.
2020-06-30 15:30:05,578 [root] DEBUG: Process image base: 0x00CC0000
2020-06-30 15:30:05,625 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 15:30:05,671 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 15:30:05,718 [root] DEBUG: Successfully injected DLL C:\tmp558c2t_g\dll\nxPdrt.dll.
2020-06-30 15:30:05,796 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3620
2020-06-30 15:30:05,875 [root] DEBUG: CreateProcessHandler: Injection info set for new process 3620, ImageBase: 0x00CC0000
2020-06-30 15:30:05,875 [root] INFO: Announced 32-bit process name: yy4Wxq30N6hFB.exe pid: 3620
2020-06-30 15:30:05,875 [lib.api.process] INFO: Monitor config for process 3620: C:\tmp558c2t_g\dll\3620.ini
2020-06-30 15:30:05,875 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp558c2t_g\dll\nxPdrt.dll, loader C:\tmp558c2t_g\bin\aLMQePS.exe
2020-06-30 15:30:05,890 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TbxJUD.
2020-06-30 15:30:05,890 [root] DEBUG: Loader: Injecting process 3620 (thread 3624) with C:\tmp558c2t_g\dll\nxPdrt.dll.
2020-06-30 15:30:05,890 [root] DEBUG: Process image base: 0x00CC0000
2020-06-30 15:30:05,890 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 15:30:05,890 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 15:30:05,906 [root] DEBUG: Successfully injected DLL C:\tmp558c2t_g\dll\nxPdrt.dll.
2020-06-30 15:30:05,906 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3620
2020-06-30 15:30:05,937 [root] DEBUG: WriteMemoryHandler: Executable binary injected into process 3620 (ImageBase 0x400000)
2020-06-30 15:30:06,000 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-30 15:30:06,046 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x0523AB20.
2020-06-30 15:30:06,109 [root] DEBUG: DumpPE: PE file in memory dumped successfully - dump size 0x44000.
2020-06-30 15:30:06,109 [root] DEBUG: WriteMemoryHandler: Dumped PE image from buffer at 0x523ab20, SizeOfImage 0x4a000.
2020-06-30 15:30:06,156 [root] INFO: Announced 32-bit process name: yy4Wxq30N6hFB.exe pid: 3620
2020-06-30 15:30:06,156 [lib.api.process] INFO: Monitor config for process 3620: C:\tmp558c2t_g\dll\3620.ini
2020-06-30 15:30:06,156 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp558c2t_g\dll\nxPdrt.dll, loader C:\tmp558c2t_g\bin\aLMQePS.exe
2020-06-30 15:30:06,296 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TbxJUD.
2020-06-30 15:30:06,343 [root] DEBUG: Loader: Injecting process 3620 (thread 0) with C:\tmp558c2t_g\dll\nxPdrt.dll.
2020-06-30 15:30:06,390 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 3624, handle 0xbc
2020-06-30 15:30:06,390 [root] DEBUG: Process image base: 0x00CC0000
2020-06-30 15:30:06,390 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 15:30:06,437 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 15:30:06,437 [root] DEBUG: Successfully injected DLL C:\tmp558c2t_g\dll\nxPdrt.dll.
2020-06-30 15:30:06,484 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3620
2020-06-30 15:30:06,531 [root] DEBUG: WriteMemoryHandler: injection of section of PE image which has already been dumped.
2020-06-30 15:30:06,531 [root] INFO: Announced 32-bit process name: yy4Wxq30N6hFB.exe pid: 3620
2020-06-30 15:30:06,531 [lib.api.process] INFO: Monitor config for process 3620: C:\tmp558c2t_g\dll\3620.ini
2020-06-30 15:30:06,531 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp558c2t_g\dll\nxPdrt.dll, loader C:\tmp558c2t_g\bin\aLMQePS.exe
2020-06-30 15:30:06,734 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TbxJUD.
2020-06-30 15:30:06,781 [root] DEBUG: Loader: Injecting process 3620 (thread 0) with C:\tmp558c2t_g\dll\nxPdrt.dll.
2020-06-30 15:30:06,828 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 3624, handle 0xbc
2020-06-30 15:30:06,875 [root] DEBUG: Process image base: 0x00CC0000
2020-06-30 15:30:06,921 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 15:30:06,921 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 15:30:06,968 [root] DEBUG: Successfully injected DLL C:\tmp558c2t_g\dll\nxPdrt.dll.
2020-06-30 15:30:07,046 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3620
2020-06-30 15:30:07,046 [root] DEBUG: WriteMemoryHandler: shellcode at 0x04647F30 (size 0x600) injected into process 3620.
2020-06-30 15:30:07,343 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\hAijBASSFV\CAPE\2712_96232452355211372020 (size 0x535)
2020-06-30 15:30:07,390 [root] DEBUG: WriteMemoryHandler: Dumped injected code/data from buffer.
2020-06-30 15:30:07,390 [root] INFO: Announced 32-bit process name: yy4Wxq30N6hFB.exe pid: 3620
2020-06-30 15:30:07,390 [lib.api.process] INFO: Monitor config for process 3620: C:\tmp558c2t_g\dll\3620.ini
2020-06-30 15:30:07,390 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp558c2t_g\dll\nxPdrt.dll, loader C:\tmp558c2t_g\bin\aLMQePS.exe
2020-06-30 15:30:07,531 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TbxJUD.
2020-06-30 15:30:07,531 [root] DEBUG: Loader: Injecting process 3620 (thread 0) with C:\tmp558c2t_g\dll\nxPdrt.dll.
2020-06-30 15:30:07,578 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 3624, handle 0xbc
2020-06-30 15:30:07,578 [root] DEBUG: Process image base: 0x00CC0000
2020-06-30 15:30:07,578 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 15:30:07,578 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 15:30:07,578 [root] DEBUG: Successfully injected DLL C:\tmp558c2t_g\dll\nxPdrt.dll.
2020-06-30 15:30:07,625 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3620
2020-06-30 15:30:07,625 [root] DEBUG: WriteMemoryHandler: shellcode at 0x0464853C (size 0x200) injected into process 3620.
2020-06-30 15:30:07,687 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\hAijBASSFV\CAPE\2712_309712725355211372020 (size 0x9)
2020-06-30 15:30:07,734 [root] DEBUG: WriteMemoryHandler: Dumped injected code/data from buffer.
2020-06-30 15:30:07,734 [root] INFO: Announced 32-bit process name: yy4Wxq30N6hFB.exe pid: 3620
2020-06-30 15:30:07,734 [lib.api.process] INFO: Monitor config for process 3620: C:\tmp558c2t_g\dll\3620.ini
2020-06-30 15:30:07,734 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp558c2t_g\dll\nxPdrt.dll, loader C:\tmp558c2t_g\bin\aLMQePS.exe
2020-06-30 15:30:07,843 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TbxJUD.
2020-06-30 15:30:07,843 [root] DEBUG: Loader: Injecting process 3620 (thread 0) with C:\tmp558c2t_g\dll\nxPdrt.dll.
2020-06-30 15:30:07,843 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 3624, handle 0xbc
2020-06-30 15:30:07,890 [root] DEBUG: Process image base: 0x00CC0000
2020-06-30 15:30:07,937 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 15:30:07,984 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 15:30:08,031 [root] DEBUG: Successfully injected DLL C:\tmp558c2t_g\dll\nxPdrt.dll.
2020-06-30 15:30:08,078 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3620
2020-06-30 15:30:08,140 [root] INFO: Announced 32-bit process name: yy4Wxq30N6hFB.exe pid: 3620
2020-06-30 15:30:08,140 [lib.api.process] INFO: Monitor config for process 3620: C:\tmp558c2t_g\dll\3620.ini
2020-06-30 15:30:08,140 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp558c2t_g\dll\nxPdrt.dll, loader C:\tmp558c2t_g\bin\aLMQePS.exe
2020-06-30 15:30:08,328 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TbxJUD.
2020-06-30 15:30:08,328 [root] DEBUG: Loader: Injecting process 3620 (thread 0) with C:\tmp558c2t_g\dll\nxPdrt.dll.
2020-06-30 15:30:08,328 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 3624, handle 0xbc
2020-06-30 15:30:08,328 [root] DEBUG: Process image base: 0x00400000
2020-06-30 15:30:08,375 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 15:30:08,375 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 15:30:08,421 [root] DEBUG: Successfully injected DLL C:\tmp558c2t_g\dll\nxPdrt.dll.
2020-06-30 15:30:08,468 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3620
2020-06-30 15:30:08,468 [root] DEBUG: SetThreadContextHandler: Hollow process entry point reset via NtSetContextThread to 0x000455BE (process 3620).
2020-06-30 15:30:08,515 [root] INFO: Announced 32-bit process name: yy4Wxq30N6hFB.exe pid: 3620
2020-06-30 15:30:08,515 [lib.api.process] INFO: Monitor config for process 3620: C:\tmp558c2t_g\dll\3620.ini
2020-06-30 15:30:08,515 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp558c2t_g\dll\nxPdrt.dll, loader C:\tmp558c2t_g\bin\aLMQePS.exe
2020-06-30 15:30:08,640 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TbxJUD.
2020-06-30 15:30:08,671 [root] DEBUG: Loader: Injecting process 3620 (thread 3624) with C:\tmp558c2t_g\dll\nxPdrt.dll.
2020-06-30 15:30:08,671 [root] DEBUG: Process image base: 0x00400000
2020-06-30 15:30:08,750 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-30 15:30:08,750 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-30 15:30:08,796 [root] DEBUG: Successfully injected DLL C:\tmp558c2t_g\dll\nxPdrt.dll.
2020-06-30 15:30:08,890 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3620
2020-06-30 15:30:08,890 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3620.
2020-06-30 15:30:08,937 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 2712.
2020-06-30 15:30:09,093 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 15:30:09,093 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 2712
2020-06-30 15:30:09,140 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 15:30:09,140 [root] DEBUG: GetHookCallerBase: thread 1872 (handle 0x0), return address 0x002221B9, allocation base 0x00220000.
2020-06-30 15:30:09,187 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00CC0000.
2020-06-30 15:30:09,296 [root] INFO: Disabling sleep skipping.
2020-06-30 15:30:09,296 [root] DEBUG: LooksLikeSectionBoundary: Exception occured reading around suspected boundary at 0x00CC2000
2020-06-30 15:30:09,296 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 3620 at 0x6f970000, image base 0x400000, stack from 0x306000-0x310000
2020-06-30 15:30:09,296 [root] DEBUG: DumpPE: Empty or inaccessible last section, file image seems incomplete (from 0x00D3D200 to 0x00D3D400).
2020-06-30 15:30:09,343 [root] DEBUG: Commandline: C:\Users\Louise\AppData\Local\Temp\"{path}".
2020-06-30 15:30:09,375 [root] INFO: Loaded monitor into process with pid 3620
2020-06-30 15:30:09,375 [root] DEBUG: set_caller_info: Adding region at 0x000D0000 to caller regions list (ntdll::LdrLoadDll).
2020-06-30 15:30:09,390 [root] DEBUG: set_caller_info: Adding region at 0x022C0000 to caller regions list (kernel32::GetSystemTime).
2020-06-30 15:30:09,390 [root] DEBUG: DumpPE: Error: Cannot dump PE file from memory.
2020-06-30 15:30:09,437 [root] DEBUG: DumpImageInCurrentProcess: Failed to dump 'raw' PE image from 0x00CC0000, dumping memory region.
2020-06-30 15:30:09,437 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x22c0000
2020-06-30 15:30:09,515 [root] DEBUG: DLL unloaded from 0x74F00000.
2020-06-30 15:30:09,515 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x022C0000 size 0x400000.
2020-06-30 15:30:09,531 [root] DEBUG: DLL unloaded from 0x70410000.
2020-06-30 15:30:09,531 [root] DEBUG: DumpPEsInRange: Scanning range 0x22c0000 - 0x22c1000.
2020-06-30 15:30:09,546 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x22c0000-0x22c1000.
2020-06-30 15:30:09,546 [root] DEBUG: DLL unloaded from 0x768A0000.
2020-06-30 15:30:09,609 [root] DEBUG: DLL unloaded from 0x73CD0000.
2020-06-30 15:30:09,625 [root] DEBUG: DLL unloaded from 0x72660000.
2020-06-30 15:30:09,640 [root] DEBUG: DLL unloaded from 0x732A0000.
2020-06-30 15:30:09,640 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 2712
2020-06-30 15:30:09,656 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\hAijBASSFV\CAPE\3620_71880547695011372020 (size 0x597)
2020-06-30 15:30:09,656 [root] DEBUG: GetHookCallerBase: thread 1872 (handle 0x0), return address 0x002221B9, allocation base 0x00220000.
2020-06-30 15:30:09,656 [root] DEBUG: DumpRegion: Dumped stack region from 0x022C0000, size 0x1000.
2020-06-30 15:30:09,671 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00CC0000.
2020-06-30 15:30:09,703 [root] DEBUG: LooksLikeSectionBoundary: Exception occured reading around suspected boundary at 0x00CC2000
2020-06-30 15:30:09,703 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-30 15:30:09,703 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x00CC0000.
2020-06-30 15:30:09,703 [root] DEBUG: DumpRegion: Dumped stack region from 0x000D0000, size 0x1000.
2020-06-30 15:30:09,796 [root] DEBUG: DumpPE: Empty or inaccessible last section, file image seems incomplete (from 0x00D3D200 to 0x00D3D400).
2020-06-30 15:30:09,796 [root] DEBUG: DLL loaded at 0x038E0000: C:\tmp558c2t_g\dll\nxPdrt (0xd5000 bytes).
2020-06-30 15:30:09,812 [root] DEBUG: DLL unloaded from 0x734D0000.
2020-06-30 15:30:09,812 [root] DEBUG: DLL unloaded from 0x74F00000.
2020-06-30 15:30:09,906 [root] DEBUG: DumpPE: Error: Cannot dump PE file from memory.
2020-06-30 15:30:09,906 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\hAijBASSFV\CAPE\3620_116632598495011372020 (size 0x129)
2020-06-30 15:30:09,906 [root] DEBUG: DumpImageInCurrentProcess: Failed to dump 'raw' PE image from 0x00CC0000, dumping memory region.
2020-06-30 15:30:09,937 [root] DEBUG: DumpRegion: Dumped stack region from 0x000E0000, size 0x1000.
2020-06-30 15:30:09,953 [root] DEBUG: DLL loaded at 0x038E0000: C:\tmp558c2t_g\dll\nxPdrt (0xd5000 bytes).
2020-06-30 15:30:09,953 [root] DEBUG: DLL unloaded from 0x734D0000.
2020-06-30 15:30:10,015 [root] DEBUG: DLL unloaded from 0x74F00000.
2020-06-30 15:30:10,062 [root] DEBUG: DLL unloaded from 0x734D0000.
2020-06-30 15:30:10,062 [root] DEBUG: DLL unloaded from 0x74F00000.
2020-06-30 15:30:10,062 [root] DEBUG: DLL unloaded from 0x038E0000.
2020-06-30 15:30:10,062 [root] DEBUG: set_caller_info: Adding region at 0x000F0000 to caller regions list (ntdll::LdrLoadDll).
2020-06-30 15:30:10,171 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\hAijBASSFV\CAPE\3620_357061150105011372020 (size 0x129)
2020-06-30 15:30:10,187 [root] DEBUG: DumpRegion: Dumped stack region from 0x000F0000, size 0x1000.
2020-06-30 15:30:10,187 [root] DEBUG: DLL loaded at 0x038E0000: C:\tmp558c2t_g\dll\nxPdrt (0xd5000 bytes).
2020-06-30 15:30:10,187 [root] DEBUG: DLL unloaded from 0x734D0000.
2020-06-30 15:30:10,187 [root] DEBUG: DLL unloaded from 0x74F00000.
2020-06-30 15:30:10,187 [root] DEBUG: DLL unloaded from 0x734D0000.
2020-06-30 15:30:10,187 [root] DEBUG: DLL unloaded from 0x74F00000.
2020-06-30 15:30:10,234 [root] DEBUG: DLL unloaded from 0x038E0000.
2020-06-30 15:30:10,375 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\hAijBASSFV\CAPE\3620_1900793884105011372020 (size 0x129)
2020-06-30 15:30:10,375 [root] DEBUG: DumpRegion: Dumped stack region from 0x00100000, size 0x1000.
2020-06-30 15:30:10,390 [root] DEBUG: DLL loaded at 0x038E0000: C:\tmp558c2t_g\dll\nxPdrt (0xd5000 bytes).
2020-06-30 15:30:10,390 [root] DEBUG: DLL unloaded from 0x734D0000.
2020-06-30 15:30:10,390 [root] DEBUG: DLL unloaded from 0x74F00000.
2020-06-30 15:30:10,390 [root] DEBUG: DLL unloaded from 0x734D0000.
2020-06-30 15:30:10,390 [root] DEBUG: DLL unloaded from 0x74F00000.
2020-06-30 15:30:10,390 [root] DEBUG: DLL unloaded from 0x038E0000.
2020-06-30 15:30:10,406 [root] DEBUG: set_caller_info: Adding region at 0x00110000 to caller regions list (ntdll::LdrLoadDll).
2020-06-30 15:30:10,421 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\hAijBASSFV\CAPE\3620_448710218105011372020 (size 0x129)
2020-06-30 15:30:10,421 [root] DEBUG: DumpRegion: Dumped stack region from 0x00110000, size 0x1000.
2020-06-30 15:30:10,437 [root] DEBUG: DLL loaded at 0x038E0000: C:\tmp558c2t_g\dll\nxPdrt (0xd5000 bytes).
2020-06-30 15:30:10,437 [root] DEBUG: DLL unloaded from 0x734D0000.
2020-06-30 15:30:10,437 [root] DEBUG: DLL unloaded from 0x74F00000.
2020-06-30 15:30:10,515 [root] DEBUG: DLL unloaded from 0x734D0000.
2020-06-30 15:30:10,578 [root] DEBUG: DLL unloaded from 0x74F00000.
2020-06-30 15:30:10,578 [root] DEBUG: DLL unloaded from 0x038E0000.
2020-06-30 15:30:10,593 [root] DEBUG: set_caller_info: Adding region at 0x00120000 to caller regions list (ntdll::LdrLoadDll).
2020-06-30 15:30:10,921 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\hAijBASSFV\CAPE\3620_1129365019105011372020 (size 0x129)
2020-06-30 15:30:10,984 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\hAijBASSFV\CAPE\3620_351334826105011372020 (size 0x129)
2020-06-30 15:30:10,984 [root] DEBUG: DumpRegion: Dumped stack region from 0x00130000, size 0x1000.
2020-06-30 15:30:10,984 [root] DEBUG: DLL loaded at 0x038E0000: C:\tmp558c2t_g\dll\nxPdrt (0xd5000 bytes).
2020-06-30 15:30:11,000 [root] DEBUG: DLL unloaded from 0x734D0000.
2020-06-30 15:30:11,000 [root] DEBUG: DLL unloaded from 0x74F00000.
2020-06-30 15:30:11,000 [root] DEBUG: DLL unloaded from 0x734D0000.
2020-06-30 15:30:11,000 [root] DEBUG: DLL unloaded from 0x74F00000.
2020-06-30 15:30:11,000 [root] DEBUG: DLL unloaded from 0x038E0000.
2020-06-30 15:30:11,015 [root] DEBUG: set_caller_info: Adding region at 0x00210000 to caller regions list (advapi32::RegQueryInfoKeyW).
2020-06-30 15:30:11,015 [root] DEBUG: set_caller_info: Failed to dumping calling PE image at 0x00210000.
2020-06-30 15:30:11,015 [root] DEBUG: set_caller_info: Adding region at 0x00450000 to caller regions list (kernel32::FindFirstFileExW).
2020-06-30 15:30:11,031 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x5d7fff
2020-06-30 15:30:11,031 [root] DEBUG: DumpMemory: Nothing to dump at 0x00450000!
2020-06-30 15:30:11,031 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00450000 size 0x188000.
2020-06-30 15:30:11,109 [root] DEBUG: DumpPEsInRange: Scanning range 0x450000 - 0x459000.
2020-06-30 15:30:11,109 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x450000-0x459000.
2020-06-30 15:30:11,140 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\hAijBASSFV\CAPE\3620_479925740115011372020 (size 0x8ffa)
2020-06-30 15:30:11,171 [root] DEBUG: DumpRegion: Dumped stack region from 0x00450000, size 0x9000.
2020-06-30 15:30:11,171 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xdc amd local view 0x732A0000 to global list.
2020-06-30 15:30:11,171 [root] DEBUG: DLL loaded at 0x732A0000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x7d000 bytes).
2020-06-30 15:30:11,171 [root] DEBUG: DLL unloaded from 0x75E80000.
2020-06-30 15:30:11,203 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xec amd local view 0x00990000 to global list.
2020-06-30 15:30:11,203 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xe8 amd local view 0x00990000 to global list.
2020-06-30 15:30:11,218 [root] DEBUG: DLL loaded at 0x734E0000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-30 15:30:11,218 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x72660000 for section view with handle 0xec.
2020-06-30 15:30:11,218 [root] DEBUG: DLL loaded at 0x72660000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr (0x6ef000 bytes).
2020-06-30 15:30:11,234 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x73510000 for section view with handle 0xec.
2020-06-30 15:30:11,234 [root] DEBUG: DLL loaded at 0x73510000: C:\Windows\system32\MSVCR120_CLR0400 (0xf5000 bytes).
2020-06-30 15:30:11,249 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 3620, handle 0x10c.
2020-06-30 15:30:11,249 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x110 amd local view 0x001C0000 to global list.
2020-06-30 15:30:11,265 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x114 amd local view 0x001E0000 to global list.
2020-06-30 15:30:11,312 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1c8 amd local view 0x06380000 to global list.
2020-06-30 15:30:11,328 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3620.
2020-06-30 15:30:11,328 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1fc amd local view 0x6D230000 to global list.
2020-06-30 15:30:11,375 [root] DEBUG: DLL loaded at 0x6D230000: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni (0x1393000 bytes).
2020-06-30 15:30:11,468 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x200 amd local view 0x72FF0000 to global list.
2020-06-30 15:30:11,468 [root] DEBUG: DLL loaded at 0x72FF0000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit (0x80000 bytes).
2020-06-30 15:30:11,578 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x22c amd local view 0x72E50000 to global list.
2020-06-30 15:30:11,578 [root] DEBUG: DLL loaded at 0x72E50000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni (0x194000 bytes).
2020-06-30 15:30:11,593 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x70580000 for section view with handle 0x228.
2020-06-30 15:30:11,593 [root] DEBUG: DLL loaded at 0x70580000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni (0xd1d000 bytes).
2020-06-30 15:30:11,890 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x230 amd local view 0x730D0000 to global list.
2020-06-30 15:30:11,906 [root] DEBUG: DLL loaded at 0x730D0000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting (0x13000 bytes).
2020-06-30 15:30:11,906 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x06900000 for section view with handle 0x230.
2020-06-30 15:30:11,906 [root] DEBUG: DLL loaded at 0x750D0000: C:\Windows\syswow64\shell32 (0xc4c000 bytes).
2020-06-30 15:30:11,921 [root] DEBUG: DLL loaded at 0x74380000: C:\Windows\system32\profapi (0xb000 bytes).
2020-06-30 15:30:11,953 [root] DEBUG: set_caller_info: Adding region at 0x00310000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-06-30 15:30:11,953 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x31ffff
2020-06-30 15:30:11,953 [root] DEBUG: DumpMemory: Nothing to dump at 0x00310000!
2020-06-30 15:30:11,953 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00310000 size 0x10000.
2020-06-30 15:30:11,953 [root] DEBUG: DumpPEsInRange: Scanning range 0x310000 - 0x311000.
2020-06-30 15:30:11,953 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x310000-0x311000.
2020-06-30 15:30:11,984 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\hAijBASSFV\CAPE\3620_1966194059315011372020 (size 0x14)
2020-06-30 15:30:11,984 [root] DEBUG: DumpRegion: Dumped stack region from 0x00310000, size 0x1000.
2020-06-30 15:30:12,000 [root] DEBUG: DLL loaded at 0x74730000: C:\Windows\system32\bcrypt (0x17000 bytes).
2020-06-30 15:30:12,078 [root] DEBUG: set_caller_info: Adding region at 0x00320000 to caller regions list (ntdll::LdrGetProcedureAddress).
2020-06-30 15:30:12,078 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x32ffff
2020-06-30 15:30:12,078 [root] DEBUG: DumpMemory: Nothing to dump at 0x00320000!
2020-06-30 15:30:12,078 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00320000 size 0x10000.
2020-06-30 15:30:12,078 [root] DEBUG: DumpPEsInRange: Scanning range 0x320000 - 0x32b000.
2020-06-30 15:30:12,078 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x320000-0x32b000.
2020-06-30 15:30:12,125 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\hAijBASSFV\CAPE\3620_1447655494325011372020 (size 0xaf9f)
2020-06-30 15:30:12,125 [root] DEBUG: DumpRegion: Dumped stack region from 0x00320000, size 0xb000.
2020-06-30 15:30:12,218 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x278 amd local view 0x6E780000 to global list.
2020-06-30 15:30:12,218 [root] DEBUG: DLL loaded at 0x6E780000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni (0x7e0000 bytes).
2020-06-30 15:30:12,234 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x274 amd local view 0x6FDE0000 to global list.
2020-06-30 15:30:12,234 [root] DEBUG: DLL loaded at 0x6FDE0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni (0x1d1000 bytes).
2020-06-30 15:30:12,281 [root] DEBUG: set_caller_info: Adding region at 0x00600000 to caller regions list (ntdll::NtQueryPerformanceCounter).
2020-06-30 15:30:12,281 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x60ffff
2020-06-30 15:30:12,281 [root] DEBUG: DumpMemory: Nothing to dump at 0x00600000!
2020-06-30 15:30:12,281 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00600000 size 0x10000.
2020-06-30 15:30:12,312 [root] DEBUG: DumpPEsInRange: Scanning range 0x600000 - 0x601000.
2020-06-30 15:30:15,781 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF5080000 to caller regions list (ntdll::NtWaitForSingleObject).
2020-06-30 15:30:15,781 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF5080000 skipped.
2020-06-30 15:30:23,375 [root] DEBUG: DLL loaded at 0x74360000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-06-30 15:30:23,390 [root] DEBUG: DLL loaded at 0x74270000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-06-30 15:30:23,437 [root] DEBUG: DLL loaded at 0x73920000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-06-30 15:30:23,453 [root] DEBUG: DLL loaded at 0x761C0000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes).
2020-06-30 15:30:23,484 [root] DEBUG: DLL loaded at 0x73090000: C:\Windows\system32\wbem\wbemdisp (0x31000 bytes).
2020-06-30 15:30:23,531 [root] DEBUG: DLL loaded at 0x72DF0000: C:\Windows\system32\wbemcomn (0x5c000 bytes).
2020-06-30 15:30:23,546 [root] DEBUG: DLL loaded at 0x76B20000: C:\Windows\syswow64\WS2_32 (0x35000 bytes).
2020-06-30 15:30:23,546 [root] DEBUG: DLL loaded at 0x76170000: C:\Windows\syswow64\NSI (0x6000 bytes).
2020-06-30 15:30:23,578 [root] INFO: Stopping WMI Service
2020-06-30 15:30:23,609 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF01F0000 to caller regions list (msvcrt::memcpy).
2020-06-30 15:30:23,625 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF01F0000 skipped.
2020-06-30 15:30:23,671 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x404 amd local view 0x0000000006260000 to global list.
2020-06-30 15:30:23,718 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x8e4 amd local view 0x0000000000AB0000 to global list.
2020-06-30 15:30:23,953 [root] DEBUG: DLL unloaded from 0x000007FEF6720000.
2020-06-30 15:30:24,281 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF5A90000 to caller regions list (ntdll::NtCreateEvent).
2020-06-30 15:30:24,328 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF5A90000 skipped.
2020-06-30 15:30:24,328 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF44F0000 to caller regions list (msvcrt::memcpy).
2020-06-30 15:30:24,343 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF44F0000 skipped.
2020-06-30 15:30:24,343 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF5A20000 to caller regions list (msvcrt::memcpy).
2020-06-30 15:30:24,343 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF5A20000 skipped.
2020-06-30 15:30:24,359 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF6540000 to caller regions list (msvcrt::memcpy).
2020-06-30 15:30:24,375 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF6540000 skipped.
2020-06-30 15:30:26,593 [root] DEBUG: DLL unloaded from 0x000007FEF6470000.
2020-06-30 15:30:26,656 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF5C50000 to caller regions list (ntdll::NtClose).
2020-06-30 15:30:26,656 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF5C50000 skipped.
2020-06-30 15:30:26,750 [root] INFO: Added new file to list with pid None and path C:\Windows\Temp\fwtsqmfile01.sqm
2020-06-30 15:30:29,171 [root] DEBUG: DLL unloaded from 0x000007FEF6720000.
2020-06-30 15:30:29,218 [root] DEBUG: DLL unloaded from 0x000007FEF6700000.
2020-06-30 15:30:29,453 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF48A0000 to caller regions list (ntdll::LdrGetDllHandle).
2020-06-30 15:30:29,453 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF48A0000 skipped.
2020-06-30 15:30:29,468 [root] DEBUG: set_caller_info: Adding region at 0x000007FEEC5B0000 to caller regions list (msvcrt::memcpy).
2020-06-30 15:30:29,468 [root] DEBUG: set_caller_info: Calling region at 0x000007FEEC5B0000 skipped.
2020-06-30 15:30:29,515 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF47D0000 to caller regions list (ntdll::NtWaitForSingleObject).
2020-06-30 15:30:29,593 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF47D0000 skipped.
2020-06-30 15:30:29,656 [root] DEBUG: DLL unloaded from 0x000007FEF5A90000.
2020-06-30 15:30:29,687 [root] DEBUG: DLL unloaded from 0x000007FEF63C0000.
2020-06-30 15:30:29,703 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF63C0000 to caller regions list (ntdll::NtClose).
2020-06-30 15:30:29,703 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF63C0000 skipped.
2020-06-30 15:30:29,718 [root] DEBUG: DLL unloaded from 0x000007FEF57D0000.
2020-06-30 15:30:29,734 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF57D0000 to caller regions list (ntdll::NtClose).
2020-06-30 15:30:29,734 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF57D0000 skipped.
2020-06-30 15:30:29,750 [root] DEBUG: DLL unloaded from 0x000007FEFBFD0000.
2020-06-30 15:30:29,765 [root] DEBUG: DLL unloaded from 0x000007FEFBB10000.
2020-06-30 15:30:29,781 [root] DEBUG: DLL unloaded from 0x000007FEFBB20000.
2020-06-30 15:30:29,796 [root] DEBUG: DLL unloaded from 0x000007FEEC5B0000.
2020-06-30 15:30:29,812 [root] DEBUG: DLL unloaded from 0x000007FEF5A20000.
2020-06-30 15:30:29,812 [root] DEBUG: DLL unloaded from 0x000007FEF44F0000.
2020-06-30 15:30:29,828 [root] DEBUG: DLL unloaded from 0x000007FEF50F0000.
2020-06-30 15:30:29,843 [root] DEBUG: DLL unloaded from 0x000007FEF5C50000.
2020-06-30 15:30:29,859 [root] DEBUG: DLL unloaded from 0x000007FEF6720000.
2020-06-30 15:30:31,718 [root] INFO: Stopped WMI Service
2020-06-30 15:30:31,781 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xc04 amd local view 0x0000000002FC0000 to global list.
2020-06-30 15:30:31,843 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x740 amd local view 0x0000000000AB0000 to global list.
2020-06-30 15:30:31,859 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000AC0000 for section view with handle 0x740.
2020-06-30 15:30:31,875 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000AB0000 for section view with handle 0x740.
2020-06-30 15:30:31,875 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000AC0000 for section view with handle 0x740.
2020-06-30 15:30:31,875 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000AB0000 for section view with handle 0x740.
2020-06-30 15:30:32,000 [lib.api.process] INFO: Monitor config for process 588: C:\tmp558c2t_g\dll\588.ini
2020-06-30 15:30:32,015 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp558c2t_g\dll\onxtlvG.dll, loader C:\tmp558c2t_g\bin\KcmxYXEr.exe
2020-06-30 15:30:32,031 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TbxJUD.
2020-06-30 15:30:32,046 [root] DEBUG: Loader: Injecting process 588 (thread 0) with C:\tmp558c2t_g\dll\onxtlvG.dll.
2020-06-30 15:30:32,046 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 15:30:32,046 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2020-06-30 15:30:32,078 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 15:30:32,093 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 15:30:32,093 [root] INFO: Disabling sleep skipping.
2020-06-30 15:30:32,156 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 588 at 0x0000000070300000, image base 0x00000000FF500000, stack from 0x0000000001756000-0x0000000001760000
2020-06-30 15:30:32,156 [root] DEBUG: Commandline: C:\Windows\sysnative\svchost.exe -k DcomLaunch.
2020-06-30 15:30:32,187 [root] WARNING: b'Unable to place hook on LockResource'
2020-06-30 15:30:32,187 [root] WARNING: b'Unable to hook LockResource'
2020-06-30 15:30:32,203 [root] INFO: Loaded monitor into process with pid 588
2020-06-30 15:30:32,218 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-30 15:30:32,218 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-30 15:30:32,218 [root] DEBUG: Successfully injected DLL C:\tmp558c2t_g\dll\onxtlvG.dll.
2020-06-30 15:30:34,218 [root] INFO: Starting WMI Service
2020-06-30 15:30:34,375 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000E70000 for section view with handle 0x740.
2020-06-30 15:30:34,562 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000AB0000 for section view with handle 0x740.
2020-06-30 15:30:34,609 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 3168, handle 0x5ec.
2020-06-30 15:30:37,234 [root] INFO: Started WMI Service
2020-06-30 15:30:37,281 [lib.api.process] INFO: Monitor config for process 3168: C:\tmp558c2t_g\dll\3168.ini
2020-06-30 15:30:37,281 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp558c2t_g\dll\onxtlvG.dll, loader C:\tmp558c2t_g\bin\KcmxYXEr.exe
2020-06-30 15:30:37,328 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TbxJUD.
2020-06-30 15:30:37,328 [root] DEBUG: Loader: Injecting process 3168 (thread 0) with C:\tmp558c2t_g\dll\onxtlvG.dll.
2020-06-30 15:30:37,328 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 15:30:37,328 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2020-06-30 15:30:37,359 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 15:30:37,359 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 15:30:37,375 [root] INFO: Disabling sleep skipping.
2020-06-30 15:30:37,375 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 3168 at 0x0000000070300000, image base 0x00000000FF500000, stack from 0x00000000011F6000-0x0000000001200000
2020-06-30 15:30:37,375 [root] DEBUG: Commandline: C:\Windows\sysnative\svchost.exe -k netsvcs.
2020-06-30 15:30:37,421 [root] WARNING: b'Unable to place hook on LockResource'
2020-06-30 15:30:37,421 [root] WARNING: b'Unable to hook LockResource'
2020-06-30 15:30:37,421 [root] INFO: Loaded monitor into process with pid 3168
2020-06-30 15:30:37,468 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-30 15:30:37,468 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-30 15:30:37,468 [root] DEBUG: Successfully injected DLL C:\tmp558c2t_g\dll\onxtlvG.dll.
2020-06-30 15:30:39,500 [root] DEBUG: DLL loaded at 0x73080000: C:\Windows\system32\wbem\wbemprox (0xb000 bytes).
2020-06-30 15:30:39,500 [root] DEBUG: DLL loaded at 0x72D80000: C:\Windows\system32\wbemcomn2 (0x61000 bytes).
2020-06-30 15:30:39,515 [root] DEBUG: DLL loaded at 0x72D60000: C:\Windows\system32\wbem\wmiutils (0x1a000 bytes).
2020-06-30 15:30:39,625 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x2dc amd local view 0x071D0000 to global list.
2020-06-30 15:30:39,671 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x2e8 amd local view 0x70450000 to global list.
2020-06-30 15:30:39,671 [root] DEBUG: DLL loaded at 0x70450000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d3e15922b03ec29aed46615adda73f3d\System.Management.ni (0x123000 bytes).
2020-06-30 15:30:39,703 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3620.
2020-06-30 15:30:39,718 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3620.
2020-06-30 15:30:39,781 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x334 amd local view 0x70420000 to global list.
2020-06-30 15:30:39,796 [root] DEBUG: DLL loaded at 0x70420000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\wminet_utils (0x21000 bytes).
2020-06-30 15:30:39,968 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3620.
2020-06-30 15:30:43,421 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3620.
2020-06-30 15:30:48,859 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF6E90000 to caller regions list (kernel32::GetSystemTimeAsFileTime).
2020-06-30 15:30:48,859 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF6E90000 skipped.
2020-06-30 15:30:59,750 [root] DEBUG: DLL unloaded from 0x76C30000.
2020-06-30 15:31:02,265 [root] DEBUG: DLL loaded at 0x73070000: C:\Windows\system32\vaultcli (0xc000 bytes).
2020-06-30 15:31:02,296 [root] DEBUG: DLL unloaded from 0x764D0000.
2020-06-30 15:31:02,343 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000002FC0000 for section view with handle 0x740.
2020-06-30 15:31:02,484 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x7b0 amd local view 0x0000000000AB0000 to global list.
2020-06-30 15:31:02,500 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000AC0000 for section view with handle 0x7b0.
2020-06-30 15:31:02,515 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000AB0000 for section view with handle 0x7b0.
2020-06-30 15:31:02,546 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000AC0000 for section view with handle 0x7b0.
2020-06-30 15:31:02,578 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000AB0000 for section view with handle 0x7b0.
2020-06-30 15:31:02,687 [root] INFO: Announced starting service "b'VaultSvc'"
2020-06-30 15:31:02,687 [lib.api.process] INFO: Monitor config for process 472: C:\tmp558c2t_g\dll\472.ini
2020-06-30 15:31:02,750 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp558c2t_g\dll\onxtlvG.dll, loader C:\tmp558c2t_g\bin\KcmxYXEr.exe
2020-06-30 15:31:02,843 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TbxJUD.
2020-06-30 15:31:02,859 [root] DEBUG: Loader: Injecting process 472 (thread 0) with C:\tmp558c2t_g\dll\onxtlvG.dll.
2020-06-30 15:31:02,859 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 15:31:02,875 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2020-06-30 15:31:02,906 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 15:31:02,937 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 15:31:02,953 [root] INFO: Disabling sleep skipping.
2020-06-30 15:31:02,953 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 472 at 0x0000000070300000, image base 0x00000000FFF50000, stack from 0x00000000001E6000-0x00000000001F0000
2020-06-30 15:31:02,953 [root] DEBUG: Commandline: C:\Windows\sysnative\services.exe.
2020-06-30 15:31:03,078 [root] WARNING: b'Unable to place hook on LockResource'
2020-06-30 15:31:03,078 [root] WARNING: b'Unable to hook LockResource'
2020-06-30 15:31:03,156 [root] INFO: Loaded monitor into process with pid 472
2020-06-30 15:31:03,171 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-30 15:31:03,218 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-30 15:31:03,234 [root] DEBUG: Successfully injected DLL C:\tmp558c2t_g\dll\onxtlvG.dll.
2020-06-30 15:31:04,359 [root] INFO: Announced 64-bit process name: lsass.exe pid: 4952
2020-06-30 15:31:04,359 [lib.api.process] INFO: Monitor config for process 4952: C:\tmp558c2t_g\dll\4952.ini
2020-06-30 15:31:04,375 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp558c2t_g\dll\onxtlvG.dll, loader C:\tmp558c2t_g\bin\KcmxYXEr.exe
2020-06-30 15:31:04,421 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TbxJUD.
2020-06-30 15:31:04,421 [root] DEBUG: Loader: Injecting process 4952 (thread 656) with C:\tmp558c2t_g\dll\onxtlvG.dll.
2020-06-30 15:31:04,437 [root] DEBUG: Process image base: 0x00000000FFDB0000
2020-06-30 15:31:04,437 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp558c2t_g\dll\onxtlvG.dll.
2020-06-30 15:31:04,437 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-30 15:31:04,453 [root] DEBUG: Successfully injected DLL C:\tmp558c2t_g\dll\onxtlvG.dll.
2020-06-30 15:31:04,468 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 4952
2020-06-30 15:31:04,484 [root] DEBUG: CreateProcessHandler: using lpCommandLine: C:\Windows\system32\lsass.exe.
2020-06-30 15:31:04,484 [root] DEBUG: CreateProcessHandler: Injection info set for new process 4952, ImageBase: 0x00000000FFDB0000
2020-06-30 15:31:04,500 [root] INFO: Announced 64-bit process name: lsass.exe pid: 4952
2020-06-30 15:31:04,500 [lib.api.process] INFO: Monitor config for process 4952: C:\tmp558c2t_g\dll\4952.ini
2020-06-30 15:31:04,515 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp558c2t_g\dll\onxtlvG.dll, loader C:\tmp558c2t_g\bin\KcmxYXEr.exe
2020-06-30 15:31:04,531 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\TbxJUD.
2020-06-30 15:31:04,546 [root] DEBUG: Loader: Injecting process 4952 (thread 656) with C:\tmp558c2t_g\dll\onxtlvG.dll.
2020-06-30 15:31:04,546 [root] DEBUG: Process image base: 0x00000000FFDB0000
2020-06-30 15:31:04,546 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp558c2t_g\dll\onxtlvG.dll.
2020-06-30 15:31:04,578 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-06-30 15:31:04,625 [root] DEBUG: Successfully injected DLL C:\tmp558c2t_g\dll\onxtlvG.dll.
2020-06-30 15:31:04,687 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 4952
2020-06-30 15:31:04,718 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 4952.
2020-06-30 15:31:04,750 [root] INFO: Disabling sleep skipping.
2020-06-30 15:31:04,781 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-30 15:31:04,859 [root] DEBUG: DLL loaded at 0x000007FEFB520000: C:\Windows\system32\SAMLIB (0x1d000 bytes).
2020-06-30 15:31:04,890 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1bc amd local view 0x00000000010E0000 to global list.
2020-06-30 15:31:13,359 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3620.
2020-06-30 15:31:13,421 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x388 amd local view 0x00860000 to global list.
2020-06-30 15:31:13,437 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x37c amd local view 0x00860000 to global list.
2020-06-30 15:31:13,531 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x390 amd local view 0x00860000 to global list.
2020-06-30 15:31:13,890 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x38c amd local view 0x00860000 to global list.
2020-06-30 15:31:13,921 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3620.
2020-06-30 15:31:34,968 [root] INFO: Process with pid 4952 has terminated
2020-06-30 15:31:35,390 [root] DEBUG: DLL unloaded from 0x000007FEFD2B0000.
2020-06-30 15:31:35,828 [root] DEBUG: set_caller_info: Adding region at 0x00A80000 to caller regions list (kernel32::VirtualProtectEx).
2020-06-30 15:31:35,890 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0xa8ffff
2020-06-30 15:31:35,890 [root] DEBUG: DumpMemory: Nothing to dump at 0x00A80000!
2020-06-30 15:31:35,984 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00A80000 size 0x10000.
2020-06-30 15:31:36,031 [root] DEBUG: DumpPEsInRange: Scanning range 0xa80000 - 0xa83000.
2020-06-30 15:31:36,046 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0xa80000-0xa83000.
2020-06-30 15:31:36,218 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\hAijBASSFV\CAPE\3620_6444348444921372020 (size 0x2f63)
2020-06-30 15:31:36,249 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x3a0 amd local view 0x00860000 to global list.
2020-06-30 15:31:37,500 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x3a4 amd local view 0x04070000 to global list.
2020-06-30 15:31:45,484 [root] DEBUG: DLL unloaded from 0x000007FEF6700000.
2020-06-30 15:31:51,031 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x3a8 amd local view 0x70200000 to global list.
2020-06-30 15:31:51,046 [root] DEBUG: DLL loaded at 0x70200000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2f61c87db96dbe27deea0e525a665761\System.Configuration.ni (0xfc000 bytes).
2020-06-30 15:31:51,187 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6CAF0000 for section view with handle 0x3a8.
2020-06-30 15:31:51,249 [root] DEBUG: DLL loaded at 0x6CAF0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\a3abb36b9f9e867b09bb3a670b074c45\System.Xml.ni (0x73e000 bytes).
2020-06-30 15:31:51,609 [root] DEBUG: DLL loaded at 0x6FD50000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32 (0x84000 bytes).
2020-06-30 15:31:54,859 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3620.
2020-06-30 15:32:44,500 [root] INFO: Analysis timeout hit, terminating analysis.
2020-06-30 15:32:44,546 [lib.api.process] ERROR: Failed to open terminate event for pid 2712
2020-06-30 15:32:44,546 [root] INFO: Terminate event set for process 2712.
2020-06-30 15:32:44,546 [lib.api.process] INFO: Terminate event set for process 840
2020-06-30 15:32:44,562 [root] DEBUG: Terminate Event: Attempting to dump process 840
2020-06-30 15:32:44,609 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00000000FF500000.
2020-06-30 15:32:44,703 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-30 15:32:44,703 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00000000FF500000.
2020-06-30 15:32:44,796 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000246C.
2020-06-30 15:32:45,015 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x6800.
2020-06-30 15:32:45,109 [lib.api.process] INFO: Termination confirmed for process 840
2020-06-30 15:32:45,109 [root] INFO: Terminate event set for process 840.
2020-06-30 15:32:45,125 [root] DEBUG: Terminate Event: CAPE shutdown complete for process 840
2020-06-30 15:32:45,125 [lib.api.process] INFO: Terminate event set for process 3620
2020-06-30 15:32:45,125 [root] DEBUG: Terminate Event: Attempting to dump process 3620
2020-06-30 15:32:45,125 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00400000.
2020-06-30 15:32:45,140 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-30 15:32:45,296 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x44200.
2020-06-30 15:32:45,328 [root] DEBUG: Terminate Event: CAPE shutdown complete for process 3620
2020-06-30 15:32:45,375 [lib.api.process] INFO: Termination confirmed for process 3620
2020-06-30 15:32:45,375 [root] INFO: Terminate event set for process 3620.
2020-06-30 15:32:45,421 [lib.api.process] INFO: Terminate event set for process 588
2020-06-30 15:32:45,421 [root] DEBUG: Terminate Event: Attempting to dump process 588
2020-06-30 15:32:45,421 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00000000FF500000.
2020-06-30 15:32:45,515 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-30 15:32:45,515 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00000000FF500000.
2020-06-30 15:32:45,531 [lib.api.process] INFO: Termination confirmed for process 588
2020-06-30 15:32:45,531 [root] INFO: Terminate event set for process 588.
2020-06-30 15:32:45,578 [root] DEBUG: Terminate Event: Attempting to dump process 3168
2020-06-30 15:32:45,593 [lib.api.process] INFO: Terminate event set for process 3168
2020-06-30 15:32:50,656 [lib.api.process] INFO: Termination confirmed for process 3168
2020-06-30 15:32:50,656 [root] INFO: Terminate event set for process 3168.
2020-06-30 15:32:50,734 [root] DEBUG: Terminate Event: Attempting to dump process 472
2020-06-30 15:32:50,796 [lib.api.process] INFO: Terminate event set for process 472
2020-06-30 15:32:50,812 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00000000FFF50000.
2020-06-30 15:32:50,875 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-30 15:32:50,875 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00000000FFF50000.
2020-06-30 15:32:50,875 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000001331C.
2020-06-30 15:32:51,031 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x50000.
2020-06-30 15:32:51,031 [root] DEBUG: Terminate Event: CAPE shutdown complete for process 472
2020-06-30 15:32:51,046 [lib.api.process] INFO: Termination confirmed for process 472
2020-06-30 15:32:51,046 [root] INFO: Terminate event set for process 472.
2020-06-30 15:32:51,046 [root] INFO: Created shutdown mutex.
2020-06-30 15:32:52,062 [root] INFO: Shutting down package.
2020-06-30 15:32:52,109 [root] INFO: Stopping auxiliary modules.
2020-06-30 15:32:52,171 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x228 amd local view 0x0000000002FC0000 to global list.
2020-06-30 15:32:52,312 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xe70 amd local view 0x000000004A890000 to global list.
2020-06-30 15:32:52,390 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000AB0000 for section view with handle 0xe70.
2020-06-30 15:32:52,515 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000049F20000 for section view with handle 0xe70.
2020-06-30 15:32:52,531 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000AB0000 for section view with handle 0xe70.
2020-06-30 15:32:52,671 [lib.common.results] WARNING: File C:\hAijBASSFV\bin\procmon.xml doesn't exist anymore
2020-06-30 15:32:52,671 [root] INFO: Finishing auxiliary modules.
2020-06-30 15:32:52,671 [root] INFO: Shutting down pipe server and dumping dropped files.
2020-06-30 15:32:52,750 [root] WARNING: Folder at path "C:\hAijBASSFV\debugger" does not exist, skip.
2020-06-30 15:32:52,781 [root] WARNING: Monitor injection attempted but failed for process 4952.
2020-06-30 15:32:52,781 [root] INFO: Analysis completed.
2020-06-30 15:32:52,812 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000049F20000 for section view with handle 0xe70.

Machine

Name Label Manager Started On Shutdown On
win7x64_3 win7x64_7 KVM 2020-06-30 15:44:10 2020-06-30 15:50:20

File Details

File Name yy4Wxq30N6hFB
File Size 513024 bytes
File Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
PE timestamp 2020-06-30 09:15:31
MD5 0485f54184da61a8f5dd490c21928b21
SHA1 c860935690c8a9fb08413c36f5f27e06255dd686
SHA256 5daf575c05c6ce4dbd7262850d5031810445a93f11ee3e29357c8eed4c9271e9
SHA512 2112abe8d2a2dd0a747dcb2d957f58f355cabd249ff79ae9ebed6a0ae9d952cbcac4979663703d2d428b76c628fbf01a28f39d9839ac2f034a90b044d256de57
CRC32 D5EB4B06
Ssdeep 12288:By+cPoGdbUXVznb3RoI5kIFwQ1FAVeF737VqKZ:0+cPoGdoFH3u4kG7FTA
Download Download ZIP Resubmit sample

Signatures

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction - unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Hit: PID 3620 trigged the Yara rule 'AgentTeslaV2'
Hit: PID 2712 trigged the Yara rule 'AgentTeslaV2'
Creates RWX memory
Guard pages use detected - possible anti-debugging.
A process attempted to delay the analysis task.
Process: yy4Wxq30N6hFB.exe tried to sleep 597.03 seconds, actually delayed analysis time by 0.0 seconds
Dynamic (imported) function loading detected
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: MSCOREE.DLL/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/_CorExeMain_RetAddr
DynamicLoader: mscoreei.dll/_CorExeMain
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: VERSION.dll/GetFileVersionInfoW
DynamicLoader: VERSION.dll/VerQueryValueW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: clr.dll/SetRuntimeInfo
DynamicLoader: USER32.dll/GetProcessWindowStation
DynamicLoader: USER32.dll/GetUserObjectInformationW
DynamicLoader: clr.dll/_CorExeMain
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: MSCOREE.DLL/CreateConfigStream
DynamicLoader: mscoreei.dll/CreateConfigStream_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream
DynamicLoader: KERNEL32.dll/GetNumaHighestNodeNumber
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/GetSystemWindowsDirectoryW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/AddSIDToBoundaryDescriptor
DynamicLoader: KERNEL32.dll/CreateBoundaryDescriptorW
DynamicLoader: KERNEL32.dll/CreatePrivateNamespaceW
DynamicLoader: KERNEL32.dll/OpenPrivateNamespaceW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/DeleteBoundaryDescriptor
DynamicLoader: KERNEL32.dll/WerRegisterRuntimeExceptionModule
DynamicLoader: KERNEL32.dll/RaiseException
DynamicLoader: MSCOREE.DLL/
DynamicLoader: mscoreei.dll/
DynamicLoader: KERNELBASE.dll/SetSystemFileCacheSize
DynamicLoader: ntdll.dll/NtSetSystemInformation
DynamicLoader: KERNELBASE.dll/PrivIsDllSynchronizationHeld
DynamicLoader: KERNEL32.dll/AddDllDirectory
DynamicLoader: KERNEL32.dll/SortGetHandle
DynamicLoader: KERNEL32.dll/SortCloseHandle
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: ole32.dll/CoGetContextToken
DynamicLoader: clrjit.dll/sxsJitStartup
DynamicLoader: clrjit.dll/jitStartup
DynamicLoader: clrjit.dll/getJit
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/LocaleNameToLCID
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/LCIDToLocaleName
DynamicLoader: KERNEL32.dll/GetUserPreferredUILanguages
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegOpenKeyEx
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: KERNEL32.dll/GetFullPathName
DynamicLoader: KERNEL32.dll/GetFullPathNameW
DynamicLoader: uxtheme.dll/IsAppThemed
DynamicLoader: uxtheme.dll/IsAppThemedW
DynamicLoader: KERNEL32.dll/CreateActCtx
DynamicLoader: KERNEL32.dll/CreateActCtxA
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: USER32.dll/RegisterWindowMessage
DynamicLoader: USER32.dll/RegisterWindowMessageW
DynamicLoader: ole32.dll/CoCreateGuid
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: MSCOREE.DLL/GetProcessExecutableHeap
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap_RetAddr
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap
DynamicLoader: KERNEL32.dll/CompareStringOrdinal
DynamicLoader: KERNEL32.dll/SetThreadErrorMode
DynamicLoader: KERNEL32.dll/GetFileAttributesEx
DynamicLoader: KERNEL32.dll/GetFileAttributesExW
DynamicLoader: KERNEL32.dll/ResolveLocaleName
DynamicLoader: gdiplus.dll/GdiplusStartup
DynamicLoader: KERNEL32.dll/IsProcessorFeaturePresent
DynamicLoader: USER32.dll/GetWindowInfo
DynamicLoader: USER32.dll/GetAncestor
DynamicLoader: USER32.dll/GetMonitorInfoA
DynamicLoader: USER32.dll/EnumDisplayMonitors
DynamicLoader: USER32.dll/EnumDisplayDevicesA
DynamicLoader: GDI32.dll/ExtTextOutW
DynamicLoader: GDI32.dll/GdiIsMetaPrintDC
DynamicLoader: gdiplus.dll/GdipLoadImageFromStream
DynamicLoader: WindowsCodecs.dll/DllGetClassObject
DynamicLoader: gdiplus.dll/GdipImageForceValidation
DynamicLoader: gdiplus.dll/GdipGetImageType
DynamicLoader: gdiplus.dll/GdipGetImageRawFormat
DynamicLoader: gdiplus.dll/GdipGetImageWidth
DynamicLoader: gdiplus.dll/GdipGetImageHeight
DynamicLoader: gdiplus.dll/GdipBitmapGetPixel
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: nlssorting.dll/SortGetHandle
DynamicLoader: nlssorting.dll/SortCloseHandle
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: shell32.dll/SHGetFolderPath
DynamicLoader: shell32.dll/SHGetFolderPathW
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: KERNEL32.dll/CopyFile
DynamicLoader: KERNEL32.dll/CopyFileW
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: KERNEL32.dll/GetCurrentProcessW
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/OpenProcessTokenW
DynamicLoader: KERNEL32.dll/LocalFree
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/GetTokenInformationW
DynamicLoader: KERNEL32.dll/LocalAlloc
DynamicLoader: KERNEL32.dll/LocalAllocW
DynamicLoader: ADVAPI32.dll/LsaClose
DynamicLoader: ADVAPI32.dll/LsaFreeMemory
DynamicLoader: ADVAPI32.dll/LsaOpenPolicy
DynamicLoader: ADVAPI32.dll/LsaLookupSids
DynamicLoader: KERNEL32.dll/GetTempPath
DynamicLoader: KERNEL32.dll/GetTempPathW
DynamicLoader: KERNEL32.dll/GetTempFileName
DynamicLoader: KERNEL32.dll/GetTempFileNameW
DynamicLoader: KERNEL32.dll/CreateFile
DynamicLoader: KERNEL32.dll/CreateFileW
DynamicLoader: KERNEL32.dll/GetFileType
DynamicLoader: KERNEL32.dll/WriteFile
DynamicLoader: KERNEL32.dll/LocalAlloc
DynamicLoader: shell32.dll/ShellExecuteEx
DynamicLoader: shell32.dll/ShellExecuteExW
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: KERNEL32.dll/DuplicateHandle
DynamicLoader: ole32.dll/CoWaitForMultipleHandles
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: ole32.dll/NdrOleInitializeExtension
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: KERNEL32.dll/DeleteFile
DynamicLoader: KERNEL32.dll/DeleteFileW
DynamicLoader: KERNEL32.dll/CreateProcess
DynamicLoader: KERNEL32.dll/CreateProcessW
DynamicLoader: KERNEL32.dll/GetThreadContext
DynamicLoader: KERNEL32.dll/ReadProcessMemory
DynamicLoader: KERNEL32.dll/VirtualAllocEx
DynamicLoader: KERNEL32.dll/WriteProcessMemory
DynamicLoader: KERNEL32.dll/SetThreadContext
DynamicLoader: KERNEL32.dll/ResumeThread
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValue
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValueW
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/OpenProcessTokenW
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivileges
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivilegesW
DynamicLoader: ntdll.dll/NtQuerySystemInformation
DynamicLoader: ntdll.dll/NtQuerySystemInformationW
DynamicLoader: ADVAPI32.dll/EventUnregister
DynamicLoader: gdiplus.dll/GdipDisposeImage
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/UnregisterTraceGuids
DynamicLoader: ADVAPI32.dll/UnregisterTraceGuids
DynamicLoader: comctl32.dll/
DynamicLoader: KERNEL32.dll/CreateActCtxW
DynamicLoader: KERNEL32.dll/AddRefActCtx
DynamicLoader: KERNEL32.dll/ReleaseActCtx
DynamicLoader: KERNEL32.dll/ActivateActCtx
DynamicLoader: KERNEL32.dll/DeactivateActCtx
DynamicLoader: KERNEL32.dll/GetCurrentActCtx
DynamicLoader: KERNEL32.dll/QueryActCtxW
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/EventUnregister
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: VERSION.dll/GetFileVersionInfoW
DynamicLoader: VERSION.dll/VerQueryValueW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: SspiCli.dll/GetUserNameExW
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: pcwum.dll/PerfDeleteInstance
DynamicLoader: pcwum.dll/PerfStopProvider
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: ADVAPI32.dll/RegisterEventSourceW
DynamicLoader: ADVAPI32.dll/ReportEventW
DynamicLoader: ADVAPI32.dll/DeregisterEventSource
DynamicLoader: ole32.dll/CoDisconnectObject
DynamicLoader: wbemcore.dll/Shutdown
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: ole32.dll/CoDisconnectObject
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: kernel32.dll/RegDeleteValueW
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: MSCOREE.DLL/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/_CorExeMain_RetAddr
DynamicLoader: mscoreei.dll/_CorExeMain
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: VERSION.dll/GetFileVersionInfoW
DynamicLoader: VERSION.dll/VerQueryValueW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: clr.dll/SetRuntimeInfo
DynamicLoader: USER32.dll/GetProcessWindowStation
DynamicLoader: USER32.dll/GetUserObjectInformationW
DynamicLoader: clr.dll/_CorExeMain
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: MSCOREE.DLL/CreateConfigStream
DynamicLoader: mscoreei.dll/CreateConfigStream_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream
DynamicLoader: KERNEL32.dll/GetNumaHighestNodeNumber
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/GetSystemWindowsDirectoryW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/AddSIDToBoundaryDescriptor
DynamicLoader: KERNEL32.dll/CreateBoundaryDescriptorW
DynamicLoader: KERNEL32.dll/CreatePrivateNamespaceW
DynamicLoader: KERNEL32.dll/OpenPrivateNamespaceW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/DeleteBoundaryDescriptor
DynamicLoader: KERNEL32.dll/WerRegisterRuntimeExceptionModule
DynamicLoader: KERNEL32.dll/RaiseException
DynamicLoader: MSCOREE.DLL/
DynamicLoader: mscoreei.dll/
DynamicLoader: KERNELBASE.dll/SetSystemFileCacheSize
DynamicLoader: ntdll.dll/NtSetSystemInformation
DynamicLoader: KERNELBASE.dll/PrivIsDllSynchronizationHeld
DynamicLoader: KERNEL32.dll/AddDllDirectory
DynamicLoader: KERNEL32.dll/SortGetHandle
DynamicLoader: KERNEL32.dll/SortCloseHandle
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: ole32.dll/CoGetContextToken
DynamicLoader: clrjit.dll/sxsJitStartup
DynamicLoader: clrjit.dll/jitStartup
DynamicLoader: clrjit.dll/getJit
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/LocaleNameToLCID
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/LCIDToLocaleName
DynamicLoader: KERNEL32.dll/GetUserPreferredUILanguages
DynamicLoader: nlssorting.dll/SortGetHandle
DynamicLoader: nlssorting.dll/SortCloseHandle
DynamicLoader: ADVAPI32.dll/ConvertSidToStringSidW
DynamicLoader: shell32.dll/SHGetFolderPathW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegOpenKeyEx
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: KERNEL32.dll/GetFullPathName
DynamicLoader: KERNEL32.dll/GetFullPathNameW
DynamicLoader: KERNEL32.dll/SetThreadErrorMode
DynamicLoader: KERNEL32.dll/GetFileAttributesEx
DynamicLoader: KERNEL32.dll/GetFileAttributesExW
DynamicLoader: MSCOREE.DLL/GetProcessExecutableHeap
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap_RetAddr
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap
DynamicLoader: bcrypt.dll/BCryptGetFipsAlgorithmMode
DynamicLoader: KERNEL32.dll/GetModuleHandle
DynamicLoader: KERNEL32.dll/GetModuleHandleW
DynamicLoader: KERNEL32.dll/GetProcAddress
DynamicLoader: KERNEL32.dll/WideCharToMultiByte
DynamicLoader: USER32.dll/DefWindowProcW
DynamicLoader: GDI32.dll/GetStockObject
DynamicLoader: USER32.dll/RegisterClass
DynamicLoader: USER32.dll/RegisterClassW
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: USER32.dll/CreateWindowEx
DynamicLoader: USER32.dll/CreateWindowExW
DynamicLoader: USER32.dll/SetWindowLong
DynamicLoader: USER32.dll/SetWindowLongW
DynamicLoader: USER32.dll/GetWindowLong
DynamicLoader: USER32.dll/GetWindowLongW
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: KERNEL32.dll/GetCurrentThread
DynamicLoader: KERNEL32.dll/DuplicateHandle
DynamicLoader: KERNEL32.dll/GetCurrentThreadId
DynamicLoader: ADVAPI32.dll/RegQueryValueEx
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: USER32.dll/SetWindowLong
DynamicLoader: USER32.dll/SetWindowLongW
DynamicLoader: USER32.dll/CallWindowProc
DynamicLoader: USER32.dll/CallWindowProcW
DynamicLoader: USER32.dll/RegisterWindowMessage
DynamicLoader: USER32.dll/RegisterWindowMessageW
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetCurrentProcessId
DynamicLoader: KERNEL32.dll/GetCurrentProcessIdW
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValue
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValueW
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/OpenProcessTokenW
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivileges
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivilegesW
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: ntdll.dll/NtQuerySystemInformation
DynamicLoader: ntdll.dll/NtQuerySystemInformationW
DynamicLoader: CRYPTSP.dll/CryptGetDefaultProviderW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptCreateHash
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoGetObjectContext
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: ole32.dll/NdrOleInitializeExtension
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: ole32.dll/MkParseDisplayName
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/CreateEvent
DynamicLoader: KERNEL32.dll/CreateEventW
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: KERNEL32.dll/SetEvent
DynamicLoader: ole32.dll/CoWaitForMultipleHandles
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: ole32.dll/IIDFromString
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: KERNEL32.dll/LoadLibrary
DynamicLoader: KERNEL32.dll/LoadLibraryA
DynamicLoader: KERNEL32.dll/GetProcAddress
DynamicLoader: wminet_utils.dll/ResetSecurity
DynamicLoader: wminet_utils.dll/SetSecurity
DynamicLoader: wminet_utils.dll/BlessIWbemServices
DynamicLoader: wminet_utils.dll/BlessIWbemServicesObject
DynamicLoader: wminet_utils.dll/GetPropertyHandle
DynamicLoader: wminet_utils.dll/WritePropertyValue
DynamicLoader: wminet_utils.dll/Clone
DynamicLoader: wminet_utils.dll/VerifyClientKey
DynamicLoader: wminet_utils.dll/GetQualifierSet
DynamicLoader: wminet_utils.dll/Get
DynamicLoader: wminet_utils.dll/Put
DynamicLoader: wminet_utils.dll/Delete
DynamicLoader: wminet_utils.dll/GetNames
DynamicLoader: wminet_utils.dll/BeginEnumeration
DynamicLoader: wminet_utils.dll/Next
DynamicLoader: wminet_utils.dll/EndEnumeration
DynamicLoader: wminet_utils.dll/GetPropertyQualifierSet
DynamicLoader: wminet_utils.dll/Clone
DynamicLoader: wminet_utils.dll/GetObjectText
DynamicLoader: wminet_utils.dll/SpawnDerivedClass
DynamicLoader: wminet_utils.dll/SpawnInstance
DynamicLoader: wminet_utils.dll/CompareTo
DynamicLoader: wminet_utils.dll/GetPropertyOrigin
DynamicLoader: wminet_utils.dll/InheritsFrom
DynamicLoader: wminet_utils.dll/GetMethod
DynamicLoader: wminet_utils.dll/PutMethod
DynamicLoader: wminet_utils.dll/DeleteMethod
DynamicLoader: wminet_utils.dll/BeginMethodEnumeration
DynamicLoader: wminet_utils.dll/NextMethod
DynamicLoader: wminet_utils.dll/EndMethodEnumeration
DynamicLoader: wminet_utils.dll/GetMethodQualifierSet
DynamicLoader: wminet_utils.dll/GetMethodOrigin
DynamicLoader: wminet_utils.dll/QualifierSet_Get
DynamicLoader: wminet_utils.dll/QualifierSet_Put
DynamicLoader: wminet_utils.dll/QualifierSet_Delete
DynamicLoader: wminet_utils.dll/QualifierSet_GetNames
DynamicLoader: wminet_utils.dll/QualifierSet_BeginEnumeration
DynamicLoader: wminet_utils.dll/QualifierSet_Next
DynamicLoader: wminet_utils.dll/QualifierSet_EndEnumeration
DynamicLoader: wminet_utils.dll/GetCurrentApartmentType
DynamicLoader: wminet_utils.dll/GetDemultiplexedStub
DynamicLoader: wminet_utils.dll/CreateInstanceEnumWmi
DynamicLoader: wminet_utils.dll/CreateClassEnumWmi
DynamicLoader: wminet_utils.dll/ExecQueryWmi
DynamicLoader: wminet_utils.dll/ExecNotificationQueryWmi
DynamicLoader: wminet_utils.dll/PutInstanceWmi
DynamicLoader: wminet_utils.dll/PutClassWmi
DynamicLoader: wminet_utils.dll/CloneEnumWbemClassObject
DynamicLoader: wminet_utils.dll/ConnectServerWmi
DynamicLoader: wminet_utils.dll/GetErrorInfo
DynamicLoader: wminet_utils.dll/Initialize
DynamicLoader: OLEAUT32.dll/SysStringLen
DynamicLoader: KERNEL32.dll/RtlZeroMemory
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: OLEAUT32.dll/
DynamicLoader: CRYPTSP.dll/CryptHashData
DynamicLoader: CRYPTSP.dll/CryptGetHashParam
DynamicLoader: CRYPTSP.dll/CryptDestroyHash
DynamicLoader: KERNEL32.dll/GetEnvironmentVariable
DynamicLoader: KERNEL32.dll/GetEnvironmentVariableW
DynamicLoader: ADVAPI32.dll/GetUserName
DynamicLoader: ADVAPI32.dll/GetUserNameW
DynamicLoader: KERNEL32.dll/GetComputerName
DynamicLoader: KERNEL32.dll/GetComputerNameW
DynamicLoader: ntdll.dll/NtQueryInformationThread
DynamicLoader: ntdll.dll/NtQuerySystemInformation
DynamicLoader: KERNEL32.dll/CreateWaitableTimerExW
DynamicLoader: KERNEL32.dll/SetWaitableTimerEx
DynamicLoader: shell32.dll/SHGetFolderPath
DynamicLoader: shell32.dll/SHGetFolderPathW
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: CRYPTSP.dll/CryptAcquireContextA
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: CRYPTSP.dll/CryptImportKey
DynamicLoader: CRYPTSP.dll/CryptExportKey
DynamicLoader: CRYPTSP.dll/CryptDestroyKey
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: KERNEL32.dll/CreateFile
DynamicLoader: KERNEL32.dll/CreateFileW
DynamicLoader: KERNEL32.dll/FindFirstFile
DynamicLoader: KERNEL32.dll/FindFirstFileW
DynamicLoader: KERNEL32.dll/FindClose
DynamicLoader: vaultcli.dll/VaultEnumerateVaults
DynamicLoader: KERNEL32.dll/GetSystemTimeAsFileTime
DynamicLoader: ntdll.dll/NtQuerySystemInformation
DynamicLoader: KERNEL32.dll/GetDynamicTimeZoneInformation
DynamicLoader: ADVAPI32.dll/RegQueryValueEx
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: KERNEL32.dll/GetFileMUIPath
DynamicLoader: KERNEL32.dll/LoadLibraryEx
DynamicLoader: KERNEL32.dll/LoadLibraryExW
DynamicLoader: KERNEL32.dll/FreeLibrary
DynamicLoader: KERNEL32.dll/FreeLibraryW
DynamicLoader: USER32.dll/LoadStringW
DynamicLoader: USER32.dll/GetLastInputInfo
DynamicLoader: KERNEL32.dll/FindNextFile
DynamicLoader: KERNEL32.dll/FindNextFileW
DynamicLoader: KERNEL32.dll/GetFileType
DynamicLoader: KERNEL32.dll/GetFileSize
DynamicLoader: KERNEL32.dll/ReadFile
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: KERNEL32.dll/GetACP
DynamicLoader: KERNEL32.dll/UnmapViewOfFile
DynamicLoader: USER32.dll/SetWindowsHookEx
DynamicLoader: USER32.dll/SetWindowsHookExW
DynamicLoader: KERNEL32.dll/CompareStringOrdinal
DynamicLoader: KERNEL32.dll/GetNativeSystemInfo
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: KERNEL32.dll/GetCurrentProcessW
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/OpenProcessTokenW
DynamicLoader: KERNEL32.dll/GetFileAttributesEx
DynamicLoader: KERNEL32.dll/GetFileAttributesExW
DynamicLoader: USER32.dll/GetSystemMetrics
DynamicLoader: KERNEL32.dll/AddDllDirectory
DynamicLoader: KERNEL32.dll/LoadLibraryEx
DynamicLoader: KERNEL32.dll/LoadLibraryExW
DynamicLoader: USER32.dll/GetClientRect
DynamicLoader: USER32.dll/GetWindowRect
DynamicLoader: USER32.dll/GetParent
DynamicLoader: ole32.dll/OleInitialize
DynamicLoader: ole32.dll/CoRegisterMessageFilter
DynamicLoader: USER32.dll/PeekMessage
DynamicLoader: USER32.dll/PeekMessageW
DynamicLoader: USER32.dll/WaitMessage
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: kernel32.dll/ResolveDelayLoadedAPI
DynamicLoader: VSSAPI.DLL/CreateWriter
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ADVAPI32.dll/LookupAccountNameW
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: samcli.dll/NetLocalGroupGetMembers
DynamicLoader: SAMLIB.dll/SamConnect
DynamicLoader: RPCRT4.dll/NdrClientCall3
DynamicLoader: RPCRT4.dll/RpcStringBindingComposeW
DynamicLoader: RPCRT4.dll/RpcBindingFromStringBindingW
DynamicLoader: RPCRT4.dll/RpcStringFreeW
DynamicLoader: RPCRT4.dll/I_RpcMapWin32Status
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: ole32.dll/CoTaskMemRealloc
DynamicLoader: ADVAPI32.dll/RegisterEventSourceW
DynamicLoader: ADVAPI32.dll/ReportEventW
DynamicLoader: ADVAPI32.dll/DeregisterEventSource
DynamicLoader: ole32.dll/CoCreateGuid
DynamicLoader: ole32.dll/CoCreateInstance
A process created a hidden window
Process: yy4Wxq30N6hFB.exe -> schtasks.exe
CAPE extracted potentially suspicious content
yy4Wxq30N6hFB.exe: Unpacked Shellcode
yy4Wxq30N6hFB.exe: Unpacked Shellcode
yy4Wxq30N6hFB.exe: Unpacked Shellcode
yy4Wxq30N6hFB.exe: Unpacked Shellcode
yy4Wxq30N6hFB.exe: Unpacked Shellcode
yy4Wxq30N6hFB.exe: Unpacked Shellcode
yy4Wxq30N6hFB.exe: Unpacked Shellcode
yy4Wxq30N6hFB.exe: Unpacked Shellcode
yy4Wxq30N6hFB.exe: Unpacked Shellcode
yy4Wxq30N6hFB.exe: AgentTeslaV2 Payload: 32-bit executable
yy4Wxq30N6hFB.exe: AgentTeslaV2
yy4Wxq30N6hFB.exe: Unpacked Shellcode
yy4Wxq30N6hFB.exe: Unpacked Shellcode
yy4Wxq30N6hFB.exe: Unpacked Shellcode
yy4Wxq30N6hFB.exe: Injected Shellcode/Data
yy4Wxq30N6hFB.exe: Unpacked Shellcode
yy4Wxq30N6hFB.exe: Injected Shellcode/Data
yy4Wxq30N6hFB.exe: Unpacked Shellcode
The binary likely contains encrypted or compressed data.
section: name: .text, entropy: 7.91, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00061e00, virtual_size: 0x00061cf0
Authenticode signature is invalid
authenticode error: No signature found. SignTool Error File not valid C\Users\Louise\AppData\Local\Temp\yy4Wxq30N6hFB
Uses Windows utilities for basic functionality
command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wlghamtwHhHNh" /XML "C:\Users\Louise\AppData\Local\Temp\tmpFF2B.tmp"
command: schtasks.exe /Create /TN "Updates\wlghamtwHhHNh" /XML "C:\Users\Louise\AppData\Local\Temp\tmpFF2B.tmp"
Behavioural detection: Injection (Process Hollowing)
Injection: yy4Wxq30N6hFB.exe(2712) -> yy4Wxq30N6hFB.exe(3620)
Executed a process and injected code into it, probably while unpacking
Injection: yy4Wxq30N6hFB.exe(2712) -> yy4Wxq30N6hFB.exe(3620)
Sniffs keystrokes
SetWindowsHookExW: Process: yy4Wxq30N6hFB.exe(3620)
Behavioural detection: Injection (inter-process)
Behavioural detection: Injection with CreateRemoteThread in a remote process
Attempts to repeatedly call a single API many times in order to delay analysis time
Spam: services.exe (472) called API GetSystemTimeAsFileTime 397446 times
Steals private information from local Internet browsers
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\profiles.ini
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db
file: C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Default\Login Data
CAPE detected the AgentTeslaV2 malware family
File has been identified by 20 Antiviruses on VirusTotal as malicious
FireEye: Generic.mg.0485f54184da61a8
McAfee: Artemis!0485F54184DA
Sangfor: Malware
APEX: Malicious
Kaspersky: HEUR:Backdoor.MSIL.Androm.gen
Paloalto: generic.ml
Endgame: malicious (high confidence)
F-Secure: Trojan.TR/AD.AgentTesla.mewpo
DrWeb: Trojan.Siggen9.56430
Cyren: W32/MSIL_Troj.WM.gen!Eldorado
Avira: TR/AD.AgentTesla.mewpo
Fortinet: MSIL/GenKryptik.ENGV!tr
Microsoft: Trojan:Win32/Wacatac.C!ml
ZoneAlarm: HEUR:Backdoor.MSIL.Androm.gen
Malwarebytes: Trojan.MalPack.ADC
ESET-NOD32: a variant of MSIL/Kryptik.WPS
Rising: Backdoor.Androm!8.113 (CLOUD)
MaxSecure: Trojan.Malware.300983.susgen
CrowdStrike: win/malicious_confidence_60% (W)
Qihoo-360: Generic/Backdoor.9cf
Creates a copy of itself
copy: C:\Users\Louise\AppData\Roaming\wlghamtwHhHNh.exe
Harvests information related to installed mail clients
file: C:\Users\Louise\AppData\Roaming\Thunderbird\profiles.ini
key: HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
key: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
key: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Created network traffic indicative of malicious activity
signature: ET JA3 Hash - Possible Malware - Various Eitest

Screenshots


Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
Y 52.114.7.36 [VT] Hong Kong
Y 13.107.42.23 [VT] United States

DNS

No domains contacted.


Summary

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Louise\AppData\Local\Temp\yy4Wxq30N6hFB.exe.config
C:\Users\Louise\AppData\Local\Temp\yy4Wxq30N6hFB.exe
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-2.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSVCR120_CLR0400.dll
C:\Windows\System32\MSVCR120_CLR0400.dll
C:\Windows\System32\api-ms-win-core-quirks-l1-1-0.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll.aux
C:\Users
C:\Users\Louise
C:\Users\Louise\AppData
C:\Users\Louise\AppData\Local
C:\Users\Louise\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\yBcC\*
C:\Users\Louise\AppData\Local\Temp\yy4Wxq30N6hFB.INI
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
C:\Windows\assembly\pubpol214.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\Microsoft.Net\assembly\GAC_32\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll
C:\Users\Louise\AppData\Local\Temp\en-US\yBcC.resources.dll
C:\Users\Louise\AppData\Local\Temp\en-US\yBcC.resources\yBcC.resources.dll
C:\Users\Louise\AppData\Local\Temp\en-US\yBcC.resources.exe
C:\Users\Louise\AppData\Local\Temp\en-US\yBcC.resources\yBcC.resources.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
C:\Users\Louise\AppData\Local\Temp\en\yBcC.resources.dll
C:\Users\Louise\AppData\Local\Temp\en\yBcC.resources\yBcC.resources.dll
C:\Users\Louise\AppData\Local\Temp\en\yBcC.resources.exe
C:\Users\Louise\AppData\Local\Temp\en\yBcC.resources\yBcC.resources.exe
C:\Users\Louise\AppData\Local\Temp\yy4Wxq30N6hFB.exe.Local\
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\GdiPlus.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Xml.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.Linq.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\SortDefault.nlp
C:\Users\Louise\AppData\Local\Temp\en-US\Lazarus.resources.dll
C:\Users\Louise\AppData\Local\Temp\en-US\Lazarus.resources\Lazarus.resources.dll
C:\Users\Louise\AppData\Local\Temp\en-US\Lazarus.resources.exe
C:\Users\Louise\AppData\Local\Temp\en-US\Lazarus.resources\Lazarus.resources.exe
C:\Users\Louise\AppData\Local\Temp\en\Lazarus.resources.dll
C:\Users\Louise\AppData\Local\Temp\en\Lazarus.resources\Lazarus.resources.dll
C:\Users\Louise\AppData\Local\Temp\en\Lazarus.resources.exe
C:\Users\Louise\AppData\Local\Temp\en\Lazarus.resources\Lazarus.resources.exe
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll
C:\Users\Louise\AppData\Roaming\wlghamtwHhHNh.exe
C:\Users\Louise\AppData\Local\Temp\tmpFF2B.tmp
\??\MountPointManager
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll
\Device\KsecDD
C:\Windows\sysnative\Tasks
C:\Windows\sysnative\Tasks\*
C:\Windows\sysnative\Tasks\AutoKMS
C:\Windows\sysnative\Tasks\Updates\wlghamtwHhHNh
C:\Windows\sysnative\Tasks\Updates
C:\Windows\sysnative\Tasks\Updates\
C:\Windows\SysWOW64\net.exe
C:\Windows
C:\Windows\SysWOW64
C:\Windows\AppPatch\sysmain.sdb
C:\Windows\SysWOW64\
C:\Windows\SysWOW64\*.*
C:\Windows\SysWOW64\ui\SwDRM.dll
C:\Windows\SysWOW64\net1.exe
C:\Windows\Temp\fwtsqmfile00.sqm
C:\Windows\Temp\fwtsqmfile01.sqm
C:\Windows\SysWOW64\sc.exe
C:\Windows\SysWOW64\en-US\sc.exe.mui
\Device\LanmanDatagramReceiver
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\en-US\cmd.exe.mui
C:\Windows\assembly\NativeImages_v4.0.30319_32\czBWwSQAJrrcaac5546#\*
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll
C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui
C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d3e15922b03ec29aed46615adda73f3d\System.Management.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d3e15922b03ec29aed46615adda73f3d\System.Management.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\wminet_utils.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll
C:\%insfolder%\%insname%
C:\Users\Louise\AppData\Local\Epic Privacy Browser\User Data
C:\Users\Louise\AppData\Local\Torch\User Data
C:\Users\Louise\AppData\Local\BraveSoftware\Brave-Browser\User Data
C:\Users\Louise\AppData\Local\uCozMedia\Uran\User Data
C:\Users\Louise\AppData\Local\Chromium\User Data
C:\Users\Louise\AppData\Roaming\Opera Software\Opera Stable
C:\Users\Louise\AppData\Local\liebao\User Data
C:\Users\Louise\AppData\Local\Amigo\User Data
C:\Users\Louise\AppData\Local\Comodo\Dragon\User Data
C:\Users\Louise\AppData\Local\CocCoc\Browser\User Data
C:\Users\Louise\AppData\Local\Sputnik\Sputnik\User Data
C:\Users\Louise\AppData\Local\QIP Surf\User Data
C:\Users\Louise\AppData\Local\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
C:\Users\Louise\AppData\Local\Vivaldi\User Data
C:\Users\Louise\AppData\Local\7Star\7Star\User Data
C:\Users\Louise\AppData\Local\Iridium\User Data
C:\Users\Louise\AppData\Local\360Chrome\Chrome\User Data
C:\Users\Louise\AppData\Local\Kometa\User Data
C:\Users\Louise\AppData\Local\CentBrowser\User Data
C:\Users\Louise\AppData\Local\Chedot\User Data
C:\Users\Louise\AppData\Local\Elements Browser\User Data
C:\Users\Louise\AppData\Local\CatalinaGroup\Citrio\User Data
C:\Users\Louise\AppData\Local\Coowon\Coowon\User Data
C:\Users\Louise\AppData\Local\Orbitum\User Data
C:\Users\Louise\AppData\Local\MapleStudio\ChromePlus\User Data
C:\Users\Louise\AppData\Local\Yandex\YandexBrowser\User Data
C:\Users\Louise\AppData\Roaming\K-Meleon\profiles.ini
C:\Users\Louise\AppData\Local\UCBrowser\*
C:\Users\Louise\AppData\Roaming\Trillian\users\global\accounts.dat
C:\Users\Louise\AppData\Roaming\The Bat!
C:\Users\Louise\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
C:\Users\Louise\AppData\Local\Microsoft\Edge\User Data
C:\Users\Louise\AppData\Local\Temp\vaultcli.dll
C:\Windows\System32\tzres.dll
C:\Windows\System32\en-US\tzres.dll.mui
C:\Users\Louise\AppData\Roaming\Comodo\IceDragon\profiles.ini
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\plutil.exe
C:\Users\Louise\AppData\Roaming\Moonchild Productions\Pale Moon\profiles.ini
C:\Users\Louise\AppData\Local\Temp\Folder.lst
C:\Users\Louise\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
C:\Users\Louise\AppData\Local\Tencent\QQBrowser\User Data
C:\Users\Louise\AppData\Local\Tencent\QQBrowser\User Data\Default\EncryptedStorage
C:\Users\Louise\AppData\Roaming\Postbox\profiles.ini
C:\Users\Louise\AppData\Roaming\Waterfox\profiles.ini
C:\Users\Louise\AppData\Local\Google\Chrome\User Data\
C:\Users\Louise\AppData\Local\Google\Chrome\User Data\*
C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Login Data
C:\Storage\
C:\mail\
C:\Users\Louise\AppData\Local\VirtualStore\Program Files\Foxmail\mail\
C:\Users\Louise\AppData\Local\VirtualStore\Program Files (x86)\Foxmail\mail\
C:\Users\Louise\AppData\Roaming\Pocomail\accounts.ini
C:\Users\Louise\AppData\Roaming\Flock\Browser\profiles.ini
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\profiles.ini
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\logins.json
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\signons.sqlite
C:\Users\Louise\AppData\Roaming\Mozilla\SeaMonkey\profiles.ini
C:\Users\Louise\AppData\Roaming\Thunderbird\profiles.ini
C:\Users\Louise\AppData\Roaming\Opera Mail\Opera Mail\wand.dat
C:\Users\Louise\AppData\Roaming\Mozilla\icecat\profiles.ini
C:\Users\Louise\AppData\Roaming\Claws-mail
C:\Users\Louise\AppData\Roaming\Claws-mail\clawsrc
C:\Users\Louise\AppData\Local\falkon\profiles\profiles.ini
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2f61c87db96dbe27deea0e525a665761\System.Configuration.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2f61c87db96dbe27deea0e525a665761\System.Configuration.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\a3abb36b9f9e867b09bb3a670b074c45\System.Xml.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\a3abb36b9f9e867b09bb3a670b074c45\System.Xml.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
\??\PIPE\samr
C:\DosDevices\pipe\
C:\Windows\sysnative\en-US\KERNELBASE.dll.mui
C:\Windows\Temp
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Louise\AppData\Local\Temp\yy4Wxq30N6hFB.exe.config
C:\Users\Louise\AppData\Local\Temp\yy4Wxq30N6hFB.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Windows\System32\MSVCR120_CLR0400.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6715dc4d04e35f16d482900c355325e9\mscorlib.ni.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
C:\Windows\assembly\pubpol214.dat
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\43822396682b0ffc3cfb66137ddab95f\System.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c462a934e0586ac5e46c8b93e461384\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\aece3d371c0714e60f9509d2a3137395\System.Windows.Forms.ni.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\GdiPlus.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c8a2021e940773064c655a6ea6ee8cb2\System.Core.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\6090b158fd3d10686b422a455e188125\Microsoft.VisualBasic.ni.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\SortDefault.nlp
C:\Users\Louise\AppData\Local\Temp\tmpFF2B.tmp
\Device\KsecDD
C:\Windows\SysWOW64\net.exe
C:\Windows\AppPatch\sysmain.sdb
C:\Windows\SysWOW64\
C:\Windows\SysWOW64\net1.exe
C:\Windows\Temp\fwtsqmfile01.sqm
C:\Windows\SysWOW64\sc.exe
C:\Windows\SysWOW64\en-US\sc.exe.mui
\Device\LanmanDatagramReceiver
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\en-US\cmd.exe.mui
C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d3e15922b03ec29aed46615adda73f3d\System.Management.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d3e15922b03ec29aed46615adda73f3d\System.Management.ni.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\wminet_utils.dll
C:\Users\Louise\AppData\Roaming\K-Meleon\profiles.ini
C:\Users\Louise\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
C:\Windows\System32\tzres.dll
C:\Windows\System32\en-US\tzres.dll.mui
C:\Users\Louise\AppData\Roaming\Comodo\IceDragon\profiles.ini
C:\Users\Louise\AppData\Roaming\Moonchild Productions\Pale Moon\profiles.ini
C:\Users\Louise\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
C:\Users\Louise\AppData\Roaming\Postbox\profiles.ini
C:\Users\Louise\AppData\Roaming\Waterfox\profiles.ini
C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Default\Login Data
C:\Users\Louise\AppData\Roaming\Flock\Browser\profiles.ini
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\profiles.ini
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db
C:\Users\Louise\AppData\Roaming\Mozilla\SeaMonkey\profiles.ini
C:\Users\Louise\AppData\Roaming\Thunderbird\profiles.ini
C:\Users\Louise\AppData\Roaming\Mozilla\icecat\profiles.ini
C:\Users\Louise\AppData\Local\falkon\profiles\profiles.ini
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2f61c87db96dbe27deea0e525a665761\System.Configuration.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2f61c87db96dbe27deea0e525a665761\System.Configuration.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\a3abb36b9f9e867b09bb3a670b074c45\System.Xml.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\a3abb36b9f9e867b09bb3a670b074c45\System.Xml.ni.dll
\??\PIPE\samr
C:\Windows\sysnative\en-US\KERNELBASE.dll.mui
C:\Users\Louise\AppData\Roaming\wlghamtwHhHNh.exe
C:\Users\Louise\AppData\Local\Temp\tmpFF2B.tmp
C:\Windows\Temp\fwtsqmfile01.sqm
\Device\LanmanDatagramReceiver
\??\PIPE\samr
C:\Users\Louise\AppData\Local\Temp\tmpFF2B.tmp
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v4.0.30319
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v4.0.30319\SKUs\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319\SKUs\default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yy4Wxq30N6hFB.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseRetryAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseMillisecondsBetweenRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\NGen\Policy\v4.0
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\NGen\Policy\v4.0\OptimizeUsedBinaries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Servicing
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\00060101.00060101
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\FeatureSIMD
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AltJit
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index214
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AppContext
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1339698970-4093829097-1161395185-1000\Installer\Assemblies\C:|Users|Louise|AppData|Local|Temp|yy4Wxq30N6hFB.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Louise|AppData|Local|Temp|yy4Wxq30N6hFB.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Louise|AppData|Local|Temp|yy4Wxq30N6hFB.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1339698970-4093829097-1161395185-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Numerics__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Numerics__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml.Linq__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml.Linq__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{9a0b8d7d-300f-11ea-b342-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{9a0b8d7d-300f-11ea-b342-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{9a0b8d7d-300f-11ea-b342-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a657-2730-11e9-8620-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a657-2730-11e9-8620-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a657-2730-11e9-8620-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a658-2730-11e9-8620-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a658-2730-11e9-8620-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a658-2730-11e9-8620-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\AppID\yy4Wxq30N6hFB.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\AppCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
DisableUserModeCallbackFilter
HKEY_CURRENT_USER\Software\Classes\AppID\schtasks.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoKMS
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoKMS\Id
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\SchedulingEngineKnob
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Control Panel\International
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Control Panel\International\LocaleName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updates\wlghamtwHhHNh
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\svchost.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\svchost.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4D89B3D7-8F35-4480-8B53-1287CD6304ED}\Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4D89B3D7-8F35-4480-8B53-1287CD6304ED}\Hash
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updates\wlghamtwHhHNh\Id
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updates\wlghamtwHhHNh\Index
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4D89B3D7-8F35-4480-8B53-1287CD6304ED}\Triggers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4D89B3D7-8F35-4480-8B53-1287CD6304ED}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4D89B3D7-8F35-4480-8B53-1287CD6304ED}\DynamicInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\RepositoryRestoreInProgress
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\net.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\net1.exe
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iphlpsvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iphlpsvc\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iphlpsvc\Parameters\ServiceDllUnloadOnStop
HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\CIMOM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\LastServiceStart
HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\ESS
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\ESS\//./root/CIMV2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\ESS\//./root/CIMV2\SCM Event Provider
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\PreviousServiceShutdown
HKEY_LOCAL_MACHINE\system\Setup
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ProcessID
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\winmgmt
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winmgmt\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winmgmt\Parameters\ServiceDllUnloadOnStop
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\sc.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\cmd.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1339698970-4093829097-1161395185-1000
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name
\x7e60\x26bEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\D4383481
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_CURRENT_USER\Software\Classes\WinMgmts
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WINMGMTS\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WINMGMTS\CLSID\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Scripting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\WBEM\Scripting\Default Namespace
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Hostname
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\System\DNSclient
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Domain
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.10.0.Microsoft.JScript__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.10.0.Microsoft.JScript__b03f5f7f11d50a3a
HKEY_CLASSES_ROOT\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32\(Default)
HKEY_CLASSES_ROOT\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319\WMIDisableCOMSecurity
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Canada Central Standard Time
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Canada Central Standard Time\TZI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Canada Central Standard Time\Dynamic DST
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Canada Central Standard Time\MUI_Display
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Canada Central Standard Time\MUI_Std
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Canada Central Standard Time\MUI_Dlt
HKEY_CURRENT_USER\Software\IncrediMail\Identities
HKEY_CURRENT_USER\Software\RimArts\B2\Settings
HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
HKEY_CURRENT_USER\Software\Aerofox\FoxmailPreview
HKEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1
HKEY_CURRENT_USER\Software\Qualcomm\Eudora\CommandLine
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Data.SqlXml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Data.SqlXml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\ServiceParameters
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\RunAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\ActivateAtStorage
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\ROTFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\AppIDFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LaunchPermission
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\LegacyAuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\LegacyImpersonationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\RemoteServerName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\SRPTrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PreferredServerBitness
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LoadUserSettings
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Power\PowerRequestOverride
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Power\PowerRequestOverride
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Power\PowerRequestOverride\Driver
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\Setup
HKEY_LOCAL_MACHINE\SYSTEM\Setup\UpgradeInProgress
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Safeboot\Option
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Settings
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\ActiveWriterStateTimeout
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\(Default)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\WMI Writer
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\TornComponentsMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssNeedsLoading
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\WOW64
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_USERS\S-1-5-18
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_USERS\.DEFAULT\Environment
HKEY_USERS\.DEFAULT\Volatile Environment
HKEY_USERS\.DEFAULT\Volatile Environment\0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\RequiredPrivileges
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseRetryAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseMillisecondsBetweenRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\NGen\Policy\v4.0\OptimizeUsedBinaries
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\00060101.00060101
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\FeatureSIMD
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AltJit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index214
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{9a0b8d7d-300f-11ea-b342-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{9a0b8d7d-300f-11ea-b342-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a657-2730-11e9-8620-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a657-2730-11e9-8620-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a658-2730-11e9-8620-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a658-2730-11e9-8620-806e6f6e6963}\Generation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoKMS\Id
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\SchedulingEngineKnob
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Control Panel\International\LocaleName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4D89B3D7-8F35-4480-8B53-1287CD6304ED}\Hash
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4D89B3D7-8F35-4480-8B53-1287CD6304ED}\DynamicInfo
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iphlpsvc\Parameters\ServiceDllUnloadOnStop
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\LastServiceStart
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\MarshaledProxy
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winmgmt\Parameters\ServiceDllUnloadOnStop
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name
\x7e60\x26bEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\D4383481
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WINMGMTS\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\WBEM\Scripting\Default Namespace
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Hostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Domain
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319\WMIDisableCOMSecurity
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Canada Central Standard Time\TZI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Canada Central Standard Time\MUI_Display
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Canada Central Standard Time\MUI_Std
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Canada Central Standard Time\MUI_Dlt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\ServiceParameters
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\RunAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\ActivateAtStorage
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\ROTFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\AppIDFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LaunchPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\LegacyAuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\LegacyImpersonationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\RemoteServerName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\SRPTrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PreferredServerBitness
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LoadUserSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\Setup\UpgradeInProgress
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\ActiveWriterStateTimeout
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\(Default)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\TornComponentsMax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssNeedsLoading
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\WOW64
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\RequiredPrivileges
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4D89B3D7-8F35-4480-8B53-1287CD6304ED}\Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4D89B3D7-8F35-4480-8B53-1287CD6304ED}\Hash
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updates\wlghamtwHhHNh\Id
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updates\wlghamtwHhHNh\Index
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4D89B3D7-8F35-4480-8B53-1287CD6304ED}\Triggers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4D89B3D7-8F35-4480-8B53-1287CD6304ED}\DynamicInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\LastServiceStart
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\PreviousServiceShutdown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ProcessID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\LastServiceStart
advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.SetDefaultDllDirectories
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
kernel32.dll.AcquireSRWLockExclusive
kernel32.dll.ReleaseSRWLockExclusive
advapi32.dll.EventRegister
advapi32.dll.EventSetInformation
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
clr.dll.SetRuntimeInfo
user32.dll.GetProcessWindowStation
user32.dll.GetUserObjectInformationW
clr.dll._CorExeMain
mscoree.dll.CreateConfigStream
mscoreei.dll.CreateConfigStream
kernel32.dll.GetNumaHighestNodeNumber
kernel32.dll.GetSystemWindowsDirectoryW
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddSIDToBoundaryDescriptor
kernel32.dll.CreateBoundaryDescriptorW
kernel32.dll.CreatePrivateNamespaceW
kernel32.dll.OpenPrivateNamespaceW
kernel32.dll.DeleteBoundaryDescriptor
kernel32.dll.WerRegisterRuntimeExceptionModule
kernel32.dll.RaiseException
mscoree.dll.#24
mscoreei.dll.#24
ntdll.dll.NtSetSystemInformation
kernel32.dll.AddDllDirectory
kernel32.dll.SortGetHandle
kernel32.dll.SortCloseHandle
kernel32.dll.GetNativeSystemInfo
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
clrjit.dll.sxsJitStartup
clrjit.dll.getJit
kernel32.dll.LocaleNameToLCID
kernel32.dll.LCIDToLocaleName
kernel32.dll.GetUserPreferredUILanguages
kernel32.dll.GetFullPathNameW
uxtheme.dll.IsAppThemed
kernel32.dll.CreateActCtxA
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
user32.dll.RegisterWindowMessageW
ole32.dll.CoCreateGuid
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
kernel32.dll.CompareStringOrdinal
kernel32.dll.SetThreadErrorMode
kernel32.dll.GetFileAttributesExW
kernel32.dll.ResolveLocaleName
gdiplus.dll.GdiplusStartup
kernel32.dll.IsProcessorFeaturePresent
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipBitmapGetPixel
nlssorting.dll.SortGetHandle
nlssorting.dll.SortCloseHandle
shell32.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
kernel32.dll.CloseHandle
kernel32.dll.GetCurrentProcess
kernel32.dll.LocalFree
kernel32.dll.LocalAlloc
advapi32.dll.LsaClose
advapi32.dll.LsaFreeMemory
advapi32.dll.LsaOpenPolicy
advapi32.dll.LsaLookupSids
kernel32.dll.GetTempPathW
kernel32.dll.GetTempFileNameW
kernel32.dll.CreateFileW
kernel32.dll.GetFileType
kernel32.dll.WriteFile
shell32.dll.ShellExecuteEx
shell32.dll.ShellExecuteExW
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#332
comctl32.dll.#386
kernel32.dll.DuplicateHandle
ole32.dll.CoWaitForMultipleHandles
sechost.dll.LookupAccountNameLocalW
advapi32.dll.LookupAccountSidW
sechost.dll.LookupAccountSidLocalW
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptGenRandom
ole32.dll.NdrOleInitializeExtension
ole32.dll.CoGetClassObject
ole32.dll.CoGetMarshalSizeMax
ole32.dll.CoMarshalInterface
ole32.dll.CoUnmarshalInterface
ole32.dll.StringFromIID
ole32.dll.CoGetPSClsid
ole32.dll.CoCreateInstance
ole32.dll.CoReleaseMarshalData
ole32.dll.DcomChannelSetHResult
rpcrtremote.dll.I_RpcExtInitializeExtensionPoint
kernel32.dll.DeleteFileW
kernel32.dll.CreateProcessW
kernel32.dll.GetThreadContext
kernel32.dll.ReadProcessMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.WriteProcessMemory
kernel32.dll.SetThreadContext
kernel32.dll.ResumeThread
advapi32.dll.LookupPrivilegeValueW
advapi32.dll.AdjustTokenPrivileges
ntdll.dll.NtQuerySystemInformation
advapi32.dll.EventUnregister
gdiplus.dll.GdipDisposeImage
api-ms-win-downlevel-advapi32-l1-1-0.dll.UnregisterTraceGuids
advapi32.dll.UnregisterTraceGuids
comctl32.dll.#321
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
kernel32.dll.QueryActCtxW
cryptsp.dll.CryptReleaseContext
sspicli.dll.GetUserNameExW
pcwum.dll.PerfDeleteInstance
pcwum.dll.PerfStopProvider
sechost.dll.ConvertSidToStringSidW
advapi32.dll.RegisterEventSourceW
advapi32.dll.ReportEventW
advapi32.dll.DeregisterEventSource
ole32.dll.CoDisconnectObject
wbemcore.dll.Shutdown
ole32.dll.CoUninitialize
kernel32.dll.RegDeleteValueW
advapi32.dll.ConvertSidToStringSidW
bcrypt.dll.BCryptGetFipsAlgorithmMode
kernel32.dll.GetModuleHandleW
kernel32.dll.GetProcAddress
kernel32.dll.WideCharToMultiByte
user32.dll.DefWindowProcW
gdi32.dll.GetStockObject
user32.dll.RegisterClassW
user32.dll.CreateWindowExW
user32.dll.SetWindowLongW
user32.dll.GetWindowLongW
kernel32.dll.GetCurrentThread
kernel32.dll.GetCurrentThreadId
user32.dll.CallWindowProcW
kernel32.dll.GetCurrentProcessId
cryptsp.dll.CryptGetDefaultProviderW
cryptsp.dll.CryptCreateHash
ole32.dll.CreateBindCtx
ole32.dll.CoGetObjectContext
ole32.dll.MkParseDisplayName
oleaut32.dll.#200
oleaut32.dll.#2
oleaut32.dll.#7
oleaut32.dll.#6
kernel32.dll.CreateEventW
kernel32.dll.SetEvent
ole32.dll.IIDFromString
kernel32.dll.LoadLibraryA
wminet_utils.dll.ResetSecurity
wminet_utils.dll.SetSecurity
wminet_utils.dll.BlessIWbemServices
wminet_utils.dll.BlessIWbemServicesObject
wminet_utils.dll.GetPropertyHandle
wminet_utils.dll.WritePropertyValue
wminet_utils.dll.Clone
wminet_utils.dll.VerifyClientKey
wminet_utils.dll.GetQualifierSet
wminet_utils.dll.Get
wminet_utils.dll.Put
wminet_utils.dll.Delete
wminet_utils.dll.GetNames
wminet_utils.dll.BeginEnumeration
wminet_utils.dll.Next
wminet_utils.dll.EndEnumeration
wminet_utils.dll.GetPropertyQualifierSet
wminet_utils.dll.GetObjectText
wminet_utils.dll.SpawnDerivedClass
wminet_utils.dll.SpawnInstance
wminet_utils.dll.CompareTo
wminet_utils.dll.GetPropertyOrigin
wminet_utils.dll.InheritsFrom
wminet_utils.dll.GetMethod
wminet_utils.dll.PutMethod
wminet_utils.dll.DeleteMethod
wminet_utils.dll.BeginMethodEnumeration
wminet_utils.dll.NextMethod
wminet_utils.dll.EndMethodEnumeration
wminet_utils.dll.GetMethodQualifierSet
wminet_utils.dll.GetMethodOrigin
wminet_utils.dll.QualifierSet_Get
wminet_utils.dll.QualifierSet_Put
wminet_utils.dll.QualifierSet_Delete
wminet_utils.dll.QualifierSet_GetNames
wminet_utils.dll.QualifierSet_BeginEnumeration
wminet_utils.dll.QualifierSet_Next
wminet_utils.dll.QualifierSet_EndEnumeration
wminet_utils.dll.GetCurrentApartmentType
wminet_utils.dll.GetDemultiplexedStub
wminet_utils.dll.CreateInstanceEnumWmi
wminet_utils.dll.CreateClassEnumWmi
wminet_utils.dll.ExecQueryWmi
wminet_utils.dll.ExecNotificationQueryWmi
wminet_utils.dll.PutInstanceWmi
wminet_utils.dll.PutClassWmi
wminet_utils.dll.CloneEnumWbemClassObject
wminet_utils.dll.ConnectServerWmi
wminet_utils.dll.GetErrorInfo
wminet_utils.dll.Initialize
oleaut32.dll.SysStringLen
kernel32.dll.RtlZeroMemory
oleaut32.dll.#500
cryptsp.dll.CryptHashData
cryptsp.dll.CryptGetHashParam
cryptsp.dll.CryptDestroyHash
kernel32.dll.GetEnvironmentVariableW
advapi32.dll.GetUserNameW
kernel32.dll.GetComputerNameW
ntdll.dll.NtQueryInformationThread
kernel32.dll.CreateWaitableTimerExW
kernel32.dll.SetWaitableTimerEx
cryptsp.dll.CryptAcquireContextA
cryptsp.dll.CryptImportKey
cryptsp.dll.CryptExportKey
cryptsp.dll.CryptDestroyKey
kernel32.dll.FindFirstFileW
kernel32.dll.FindClose
vaultcli.dll.VaultEnumerateVaults
kernel32.dll.GetSystemTimeAsFileTime
kernel32.dll.GetDynamicTimeZoneInformation
kernel32.dll.GetFileMUIPath
kernel32.dll.LoadLibraryExW
kernel32.dll.FreeLibrary
user32.dll.LoadStringW
user32.dll.GetLastInputInfo
kernel32.dll.FindNextFileW
kernel32.dll.GetFileSize
kernel32.dll.ReadFile
oleaut32.dll.#204
oleaut32.dll.#203
oleaut32.dll.#179
kernel32.dll.GetACP
kernel32.dll.UnmapViewOfFile
user32.dll.SetWindowsHookExW
user32.dll.GetSystemMetrics
user32.dll.GetClientRect
user32.dll.GetWindowRect
user32.dll.GetParent
ole32.dll.OleInitialize
ole32.dll.CoRegisterMessageFilter
user32.dll.PeekMessageW
user32.dll.WaitMessage
vssapi.dll.CreateWriter
advapi32.dll.LookupAccountNameW
samcli.dll.NetLocalGroupGetMembers
samlib.dll.SamConnect
rpcrt4.dll.NdrClientCall3
rpcrt4.dll.RpcStringBindingComposeW
rpcrt4.dll.RpcBindingFromStringBindingW
rpcrt4.dll.RpcStringFreeW
rpcrt4.dll.I_RpcMapWin32Status
ole32.dll.CoTaskMemRealloc
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wlghamtwHhHNh" /XML "C:\Users\Louise\AppData\Local\Temp\tmpFF2B.tmp"
schtasks.exe /Create /TN "Updates\wlghamtwHhHNh" /XML "C:\Users\Louise\AppData\Local\Temp\tmpFF2B.tmp"
"{path}"
C:\Users\Louise\AppData\Local\Temp\yy4Wxq30N6hFB.exe "{path}"
C:\Windows\system32\lsass.exe
VaultSvc

PE Information

Image Base Entry Point Reported Checksum Actual Checksum Minimum OS Version Compile Time Import Hash Icon Icon Exact Hash Icon Similarity Hash
0x00400000 0x00463cea 0x00000000 0x0008468b 4.0 2020-06-30 09:15:31 f34d5f2d4577ed6d9ceec516c1f5a744 a82980e426d9f5df67eae847b1a278ca 5cfea8f1729ef7fde13a51b01c74f6ec

Sections

Name RAW Address Virtual Address Virtual Size Size of Raw Data Characteristics Entropy
.text 0x00000200 0x00002000 0x00061cf0 0x00061e00 IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 7.91
.rsrc 0x00062000 0x00064000 0x0001b1e4 0x0001b200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 5.09
.reloc 0x0007d200 0x00080000 0x0000000c 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 0.10

Resources

Name Offset Size Language Sub-language Entropy File type
RT_ICON 0x0007e7c4 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL 5.20 None
RT_ICON 0x0007e7c4 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL 5.20 None
RT_ICON 0x0007e7c4 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL 5.20 None
RT_ICON 0x0007e7c4 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL 5.20 None
RT_ICON 0x0007e7c4 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL 5.20 None
RT_ICON 0x0007e7c4 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL 5.20 None
RT_GROUP_ICON 0x0007ec88 0x00000030 LANG_NEUTRAL SUBLANG_NEUTRAL 2.46 None
RT_GROUP_ICON 0x0007ec88 0x00000030 LANG_NEUTRAL SUBLANG_NEUTRAL 2.46 None
RT_VERSION 0x0007ecb8 0x0000033e LANG_NEUTRAL SUBLANG_NEUTRAL 3.36 None
RT_MANIFEST 0x0007eff8 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL 5.00 None

Imports


Assembly Information

Name yBcC
Version 1.98.4.0

Assembly References

Name Version
mscorlib 4.0.0.0
System.Windows.Forms 4.0.0.0
System 4.0.0.0
System.Drawing 4.0.0.0
System.Xml 4.0.0.0
System.Data 4.0.0.0

Custom Attributes

Type Name Value
Assembly [mscorlib]System.Reflection.AssemblyTitleAttribute Winform Sandb
Assembly [mscorlib]System.Reflection.AssemblyProductAttribute Winform Sandb
Assembly [mscorlib]System.Reflection.AssemblyCopyrightAttribute Copyright \xa9 2017 - 20
Assembly [mscorlib]System.Runtime.InteropServices.GuidAttribute D7AFF0CC-F635-4140-A9B4-0FEA7D211F
Assembly [mscorlib]System.Reflection.AssemblyFileVersionAttribute 1.98.4

Type References

Assembly Type Name
mscorlib System.Runtime.CompilerServices.CompilationRelaxationsAttribute
mscorlib System.Runtime.CompilerServices.RuntimeCompatibilityAttribute
mscorlib System.Diagnostics.DebuggableAttribute
mscorlib System.Diagnostics.DebuggableAttribute/DebuggingModes
mscorlib System.Reflection.AssemblyTitleAttribute
mscorlib System.Reflection.AssemblyDescriptionAttribute
mscorlib System.Reflection.AssemblyConfigurationAttribute
mscorlib System.Reflection.AssemblyCompanyAttribute
mscorlib System.Reflection.AssemblyProductAttribute
mscorlib System.Reflection.AssemblyCopyrightAttribute
mscorlib System.Reflection.AssemblyTrademarkAttribute
mscorlib System.Runtime.InteropServices.ComVisibleAttribute
mscorlib System.Runtime.InteropServices.GuidAttribute
mscorlib System.Reflection.AssemblyFileVersionAttribute
mscorlib System.Runtime.Versioning.TargetFrameworkAttribute
System.Windows.Forms System.Windows.Forms.Form
mscorlib System.Collections.Generic.List`1
System System.ComponentModel.IContainer
System.Windows.Forms System.Windows.Forms.ComboBox
System.Windows.Forms System.Windows.Forms.Label
System.Windows.Forms System.Windows.Forms.Button
System.Windows.Forms System.Windows.Forms.ListBox
mscorlib System.Object
mscorlib System.EventArgs
mscorlib System.Decimal
mscorlib System.Enum
mscorlib System.Runtime.CompilerServices.CompilerGeneratedAttribute
mscorlib System.Diagnostics.DebuggerBrowsableState
mscorlib System.Diagnostics.DebuggerBrowsableAttribute
mscorlib System.Collections.Generic.List`1/Enumerator
mscorlib System.Reflection.Assembly
mscorlib System.Type
mscorlib System.Reflection.MethodInfo
mscorlib System.STAThreadAttribute
System System.CodeDom.Compiler.GeneratedCodeAttribute
mscorlib System.Diagnostics.DebuggerNonUserCodeAttribute
mscorlib System.Resources.ResourceManager
mscorlib System.Globalization.CultureInfo
System.Drawing System.Drawing.Bitmap
System System.ComponentModel.EditorBrowsableState
System System.ComponentModel.EditorBrowsableAttribute
System System.Configuration.ApplicationSettingsBase
System.Windows.Forms System.Windows.Forms.DataGridView
System.Windows.Forms System.Windows.Forms.DataGridViewTextBoxColumn
System.Windows.Forms System.Windows.Forms.DataGridViewCellEventArgs
System System.ComponentModel.INotifyPropertyChanged
System System.ComponentModel.PropertyChangedEventHandler
mscorlib System.Collections.Generic.IList`1
mscorlib System.Collections.Generic.ICollection`1
mscorlib System.Collections.Generic.IEnumerable`1
mscorlib System.Collections.IEnumerable
mscorlib System.Guid
System System.ComponentModel.BindingList`1
System System.ComponentModel.ListSortDirection
System System.ComponentModel.PropertyDescriptor
mscorlib System.IComparable
System.Windows.Forms System.Windows.Forms.GroupBox
System.Windows.Forms System.Windows.Forms.TextBox
mscorlib System.Exception
System.Windows.Forms System.Windows.Forms.DataGridViewRow
System.Windows.Forms System.Windows.Forms.DataGridViewCellStyle
System.Xml System.Xml.Serialization.XmlSerializer
System.Data System.Data.DataSet
System.Data System.Data.DataTable
System.Windows.Forms System.Windows.Forms.BindingSource
System.Windows.Forms System.Windows.Forms.ListBox/ObjectCollection
System.Windows.Forms System.Windows.Forms.Control
System.Windows.Forms System.Windows.Forms.ListControl
mscorlib System.IDisposable
System.Windows.Forms System.Windows.Forms.AutoCompleteMode
System.Windows.Forms System.Windows.Forms.AutoCompleteSource
System.Drawing System.Drawing.Point
System.Drawing System.Drawing.Size
mscorlib System.EventHandler
System.Windows.Forms System.Windows.Forms.ButtonBase
System.Drawing System.Drawing.SizeF
System.Windows.Forms System.Windows.Forms.ContainerControl
System.Windows.Forms System.Windows.Forms.AutoScaleMode
System.Windows.Forms System.Windows.Forms.Control/ControlCollection
mscorlib System.Convert
mscorlib System.AppDomain
mscorlib System.Reflection.MethodBase
System System.ComponentModel.Container
System.Windows.Forms System.Windows.Forms.Application
mscorlib System.RuntimeTypeHandle
System System.Configuration.SettingsBase
System.Windows.Forms System.Windows.Forms.ControlBindingsCollection
System.Windows.Forms System.Windows.Forms.Binding
System.Windows.Forms System.Windows.Forms.DataGridViewCellEventHandler
System System.ComponentModel.ISupportInitialize
System.Windows.Forms System.Windows.Forms.DataGridViewColumnHeadersHeightSizeMode
System.Windows.Forms System.Windows.Forms.DataGridViewColumnCollection
System.Windows.Forms System.Windows.Forms.DataGridViewColumn
System.Windows.Forms System.Windows.Forms.DataGridViewBand
System.Windows.Forms System.Windows.Forms.DataGridViewAutoSizeColumnMode
System.Drawing System.Drawing.Font
System.Drawing System.Drawing.FontStyle
System.Drawing System.Drawing.GraphicsUnit
mscorlib System.Delegate
mscorlib System.Threading.Interlocked
System System.ComponentModel.PropertyChangedEventArgs
mscorlib System.Collections.ObjectModel.Collection`1
System.Windows.Forms System.Windows.Forms.DataGridViewRowCollection
mscorlib System.Math
mscorlib System.String
mscorlib System.Comparison`1
System System.ComponentModel.ListChangedEventArgs
System System.ComponentModel.ListChangedType
mscorlib System.StringComparison
System.Windows.Forms System.Windows.Forms.MessageBox
System.Windows.Forms System.Windows.Forms.DialogResult
System.Data System.Data.DataRowCollection
System.Data System.Data.DataRow
System.Windows.Forms System.Windows.Forms.BorderStyle
System.Windows.Forms System.Windows.Forms.TextBoxBase
System.Windows.Forms System.Windows.Forms.ScrollBars
System.Drawing System.Drawing.Color
System.Windows.Forms System.Windows.Forms.DataGridViewTriState
System.Windows.Forms System.Windows.Forms.DataGridViewSelectedRowCollection
System.Windows.Forms System.Windows.Forms.DataGridViewCellCollection
System.Windows.Forms System.Windows.Forms.DataGridViewCell
System.Windows.Forms System.Windows.Forms.DataGridViewAutoSizeColumnsMode
System.Windows.Forms System.Windows.Forms.DataGridViewAutoSizeRowsMode
System.Windows.Forms System.Windows.Forms.DataGridViewContentAlignment
System.Drawing System.Drawing.SystemColors
System.Windows.Forms System.Windows.Forms.DataGridViewEditMode
System.Windows.Forms System.Windows.Forms.DataGridViewRowHeadersWidthSizeMode
System.Windows.Forms System.Windows.Forms.DataGridViewSelectionMode
System.Windows.Forms System.Windows.Forms.FormStartPosition
System.Windows.Forms System.Windows.Forms.FormBorderStyle
System.Windows.Forms System.Windows.Forms.FormClosingEventHandler
System.Data System.Data.XmlReadMode
System.Data System.Data.DataTableCollection
System.Windows.Forms System.Windows.Forms.DockStyle

!This program cannot be run in DOS mode.
.text
`.rsrc
@.reloc
*BSJB
v4.0.30319
#Strings
#GUID
#Blob
IEnumerable`1
ICollection`1
Comparison`1
IList`1
SortableBindingList`1
label1
Form1
dataGridView1
groupBox1
label2
button3
Class3
get_unify4
<Module>
SizeF
labelTM
textBoxTM
get_KwhaALVDvicYqVXkHfjR
SDSDSDS
CVVVVVVVVV
value__
System.Data
SaveData
mscorlib
System.Collections.Generic
get_Id
add_Load
OrderForm_Load
buttonAdd
OnListChanged
add_SelectedIndexChanged
lstOrder_SelectedIndexChanged
cbMenus_SelectedIndexChanged
add_PropertyChanged
remove_PropertyChanged
INotifyPropertyChanged
Interlocked
set_Enabled
set_FormattingEnabled
_isSorted
Synchronized
PopulateDataGrid
SelectedGroupDataGrid
GroupsDataGrid
NewGuid
<Id>k__BackingField
<Price>k__BackingField
<ProductsTable>k__BackingField
<Title>k__BackingField
<Name>k__BackingField
<GroupName>k__BackingField
<ProductName>k__BackingField
<MenuType>k__BackingField
<TradeMark>k__BackingField
<Description>k__BackingField
<PhoneNumber>k__BackingField
<SkuNumber>k__BackingField
<Supplier>k__BackingField
<ProductDetails>k__BackingField
<OrderItems>k__BackingField
<MenuItems>k__BackingField
<StorageUnit>k__BackingField
<Category>k__BackingField
DataGridViewBand
buttonAmend
SBind
GetMethod
get_Price
set_Price
get_TotalPrice
RefreshTotalPrice
lblTotalPrice
labelPrice
textBoxPrice
defaultInstance
set_DataSource
set_AutoCompleteSource
BindingSource
source
XmlReadMode
set_AutoScaleMode
set_AutoCompleteMode
set_RowHeadersWidthSizeMode
DataGridViewRowHeadersWidthSizeMode
set_AutoSizeMode
set_ColumnHeadersHeightSizeMode
DataGridViewColumnHeadersHeightSizeMode
DataGridViewAutoSizeColumnMode
set_SelectionMode
DataGridViewSelectionMode
set_WrapMode
set_AutoSizeColumnsMode
DataGridViewAutoSizeColumnsMode
set_AutoSizeRowsMode
DataGridViewAutoSizeRowsMode
set_EditMode
DataGridViewEditMode
AddRange
CompareExchange
get_WhiteSmoke
Invoke
DataTable
get_ProductsTable
set_ProductsTable
IComparable
IEnumerable
IDisposable
dtable
set_RowHeadersVisible
RuntimeTypeHandle
GetTypeFromHandle
numberOfPeople
get_Title
set_Title
DockStyle
get_DefaultCellStyle
set_DefaultCellStyle
set_ColumnHeadersDefaultCellStyle
DataGridViewCellStyle
set_BorderStyle
set_FormBorderStyle
FontStyle
get_Name
set_Name
PersonName
get_GroupName
set_GroupName
groupName
labelPrName
textBoxPrName
get_ProductName
set_ProductName
set_DataPropertyName
Combine
set_Multiline
Phone
ListChangedType
GetType
get_MenuType
set_MenuType
Compare
get_IsSortedCore
get_SupportsSortingCore
get_SortDirectionCore
GroupCore
RemoveSortCore
ApplySortCore
get_SortPropertyCore
get_Culture
set_Culture
resourceCulture
MethodBase
ButtonBase
ApplicationSettingsBase
TextBoxBase
Close
Dispose
Delegate
DebuggerBrowsableState
EditorBrowsableState
DataGridViewTriState
Delete
get_White
STAThreadAttribute
CompilerGeneratedAttribute
GuidAttribute
GeneratedCodeAttribute
DebuggerNonUserCodeAttribute
DebuggableAttribute
DebuggerBrowsableAttribute
EditorBrowsableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
labelCatalogue
get_Value
GetValue
value
buttonSave
Remove
yBcC.exe
set_Size
set_MinimumSize
set_MaximumSize
set_AutoSize
set_ClientSize
myserialize
ISupportInitialize
IndexOf
get_Tag
set_Tag
System.Threading
Binding
System.Runtime.Versioning
FromBase64String
ToString
GetString
MainForm_Closing
add_FormClosing
disposing
Operating
System.Drawing
ShowDialog
set_MaxLength
buttonAdd_Click
add_Click
buttonAmend_Click
buttonDelete_Click
buttonSave_Click
buttonCancel_Click
btnClearMenus_Click
buttonEdit_Click
buttonExit_Click
btnAddMenu_Click
btnRemoveMenu_Click
buttonShow_Click
set_Dock
get_TradeMark
set_TradeMark
ToDecimal
Label
buttonCancel
System.Collections.ObjectModel
System.ComponentModel
WinformsSandbox.ComponentModel
IGroupsViewModel
get_GroupsViewModel
set_GroupsViewModel
_groupsViewModel
DataGridViewCell
System.Xml
ReadXml
WriteXml
GetFromXml
get_Control
ContainerControl
ListControl
Program
get_Item
AddItem
get_SelectedItem
get_DataBoundItem
RemoveItem
MenuItem
menuItem
System
EditDeleteAddForm
MainForm
OrderForm
AddEditForm
ShowForm
labelStoreUn
textBoxStoreUn
resourceMan
Vegetarian
AppDomain
get_CurrentDomain
DataGridViewColumn
DataGridViewTextBoxColumn
Application
set_Location
System.Configuration
System.Globalization
System.Xml.Serialization
System.Reflection
DataTableCollection
DataGridViewCellCollection
ControlCollection
DataGridViewColumnCollection
ControlBindingsCollection
ObjectCollection
DataRowCollection
DataGridViewSelectedRowCollection
DataGridViewRowCollection
ListSortDirection
_sortDirection
direction
set_StartPosition
FormStartPosition
Exception
get_Description
set_Description
StringComparison
OnComparison
IPerson
Button
CompareTo
MethodInfo
CultureInfo
get_Gainsboro
Bitmap
set_TabStop
IGroup
GetRandomGroup
Clear
set_ValueMember
get_PhoneNumber
set_PhoneNumber
get_SkuNumber
set_SkuNumber
sender
PhoneOrder
_currentOrder
lstOrder
get_ResourceManager
ProductsManager
get_Supplier
set_Supplier
labelSupplier
textBoxSupplier
PropertyChangedEventHandler
FormClosingEventHandler
DataGridViewCellEventHandler
System.CodeDom.Compiler
IContainer
add_RowEnter
GroupsDataGrid_RowEnter
remove_RowEnter
get_Silver
XmlSerializer
set_GridColor
set_BackgroundColor
set_ForeColor
set_SelectionForeColor
set_BackColor
set_UseVisualStyleBackColor
set_SelectionBackColor
GetEnumerator
.ctor
.cctor
PropertyDescriptor
System.Diagnostics
WinformsSandbox.Models.Interfaces
WinformsSandbox.ViewModels.Interfaces
System.Runtime.InteropServices
System.Runtime.CompilerServices
System.Resources
ProductsManager.EditDeleteAddForm.resources
ProductsManager.MainForm.resources
Restaurant.OrderForm.resources
ProductsManager.AddEditForm.resources
ProductsManager.ShowForm.resources
WinformsSandbox.Properties.Resources.resources
WinformsSandbox.Views.GroupsView.resources
DebuggingModes
AcceptChanges
WinformsSandbox.Properties
get_Tables
EnableVisualStyles
WinformsSandbox.Models.Classes
WinformsSandbox.ViewModels.Classes
get_DataBindings
Settings
ListChangedEventArgs
PropertyChangedEventArgs
DataGridViewCellEventArgs
Equals
get_ProductDetails
set_ProductDetails
labelProductDetails
textBoxProductDetails
get_Cells
get_Controls
get_Items
get_OrderItems
set_OrderItems
get_MenuItems
set_MenuItems
System.Windows.Forms
Contains
get_Columns
set_AutoGenerateColumns
set_AutoScaleDimensions
System.Collections
groupBoxButtons
IGroups
get_Groups
set_Groups
_groups
set_ScrollBars
SystemColors
labelProducts
components
cbMenus
InitializeAvailableMenus
_availableMenus
btnClearMenus
WinformsSandbox.Views
get_Rows
set_AllowUserToAddRows
get_SelectedRows
set_AllowUserToDeleteRows
set_AllowUserToResizeRows
Concat
Format
GetObject
set_MultiSelect
Product
ProductDirDataSet
get_Highlight
buttonEdit
EndInit
BeginInit
get_StorageUnit
set_StorageUnit
GraphicsUnit
buttonExit
get_Default
SetCompatibleTextRenderingDefault
DialogResult
Restaurant
set_Alignment
DataGridViewContentAlignment
InitializeComponent
get_Current
Point
set_Font
get_Count
get_RowCount
Convert
RandomPersonSourceList
get_SelectedGroupBindingList
set_SelectedGroupBindingList
_selectedGroupBindingList
get_GroupsBindingList
set_GroupsBindingList
_groupsBindingList
SuspendLayout
ResumeLayout
PerformLayout
MoveNext
get_Text
set_Text
get_ControlText
set_HeaderText
get_HighlightText
get_WindowText
labelSku
textBoxSku
btnAddMenu
btnRemoveMenu
DataGridView
GroupsView
DataRow
DataGridViewRow
get_Window
buttonShow
get_Index
set_TabIndex
get_SelectedIndex
get_RowIndex
rowIndex
index
MessageBox
set_MaximizeBox
ComboBox
GroupBox
ListBox
TextBox
WinformsSandbox
get_Assembly
set_ReadOnly
RestaurantLibrary
get_Category
set_Category
labelCategory
textBoxCategory
op_Inequality
_sortProperty
WrapNonExceptionThrows
Winform Sandbox
Copyright
2017 - 2020
$D7AFF0CC-F635-4140-A9B4-0FEA7D211F60
1.98.4.0
.NETFramework,Version=v4.0
FrameworkDisplayName
.NET Framework 4
3System.Resources.Tools.StronglyTypedResourceBuilder
16.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
16.1.0.0
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
IDATx^
!IB"*
Uk947
a$AEw)
/6e|&(
|Sv$U
JqR&1
?Ql"a
.T]<DD
;JleL
MFBv1K
y>y{?3
drZ4$j
\3eH_W
Xs)E8
A{`0!^
Yvp(R!
_cee:
e}xsg$
?]D3*
-X|z9Rab
c%yGj
896Yz8|
gku2'
di[?T
eI1wmE
oW.z}n
!].%k
li+\I9
^LUnA
9{0knJ
\E2MM
-6p'l
5L(-Vg
]QlkN
Rj~Wb
6c>39
- f/r
@')16
YJ^Y1
;/f}m
I`_Q3
ne1dH
@1ZBQq_
x`=z;
m<s<D
&gz*j(
h~3aBJ4
41LO!
EvI7v)
l1kZN`
C$T<n
.U#3v
}r_<j
][q^:
M%1mF
N (l)
;ERX)f7_
&e'Bh
2/.UnAs
9qqekl,mx
EuI`N
mJG`i]DJ
<D885
}+JE(-
#5{o!
O.%Zw
cM??n]r
2jGCbZ
kK|!
/!3OcE
&"NgJ
]R92}
{+7Z
vOs!'
Vk"7.
!Zoxda
rZ/oLh3
Y;a^|
C}1tI
&uN&e
zs<]J
S+Y>a=
r+z#;o
rVQ9-
OC,)kp
U8J>p ~9
>bpU,?
2CSMX
.sT]1x
U$9ep
=c*0T
avL(P
.To-eF-d"
LN}#x
O-B?s
d\'mn
7rT{;
NbN!}K\
}B<by
'_R.`
feWv5jE
=y8Kjx
70gYR
!IMoa/
$68{c
'S6n?3
E=MQy
37"G<de
uN8!)
P5EqJ
KxR%#
e#4F~'0
Jm72D
udOz3
\_Qo}
}O1\?
vC*$Y
^`UT)R
nnNUT
mZOzS
0zAmw
L zMsN
VZ.kOP
L{2Q}
)g7G
VSoc}
Jryl# [Q
VSVE7%
>'cQX
(>H4)
b;fz6
snryT6
=+_r{
!';06.
!]C=i
yd DZ8
2q]3L5
fd8oA
cz~+*
[S!?n
7%1:z
^5sne
(_26u
0aaf#Y;
XVsE4
42<M&(
Ww8tN
F`?n&
yN3Hm
`W/8w
-=9rV
)X^!V
%]Grp
$>.Ac
?x:=;
Ra3~.
hR#;EY
N3uK*Q
'|m4eVE#=n
i0Q~q
H>yIp"[
q22s%
(;>'{
{gxP\
BEp&!
/3}Wq
f*fl-h2
rX` a
33QPr
i'{zIQ-
;<EUX
*6e\_
'.2fLW
PfCL<
-2<7p
F5vaN
3i&3/T
*)_KVb
KG|z>
5E&t9t
^ODzq
Z%_"N/d
@_diC
G(n!(
$#'@1ck
JoAal
eF+Pn
s(uCc
nZ1tp/SDE
hb"/g
%`^\D
V5tY#
YW*Yh
4j"S^6#`x:
]IP2&4
'{(X.
>BS<i
d=2?<d
M-P.5
4^mD?
aK.~q
<n)i[
0T}Oa
=.\k$F
Sd>(%
q)D*Ga
mlFB}&v7
^_pxh
m&>&y
^}&0.
s^,If
{M wY
<38]P2W)
Y|mhK
7STshS";
a8gJql
;=p3z
!r|Oas
$C'p=
+1tx9
_O<>=a
/zN=K
1yH&M
O5xd9a
k9<y8-5
o&veP
;*1RFgY3
2u-b6
X5k)J9
VO`YM+
EiZtt
csUbb
!mr>Cw
n#Cm>
o|3Q%-
s#<c&[
QYmIB
/FOo5
_G:x
H~RL`a
WKn-y
)PRB]
rw,$~
W7$`:
mZJ%4
APr[P
Mjf-d
a?:m.sf
z7";Z
0u`K*?z
c#op?
!|7#6
R69JV
B|NP069
86s5U
lj{!Z{
JAZ#*i5t
W7!z-^
5gFE,
RA)-gx"
ltz6'i
dvbz(
l,Www!
kX?`8
^Ljz/
7x,/n:
;{c0c=
?EB]Y{>6
vAt(2
z7OPc
~L)Uf
c_c$-s
a +SJ
I1#)&V
_N8px
7A9}a
hzy235
0vM&{
wdnjo
39p4}
{bYg0
m<v=u
S$S1V-
Gnwy.M
{"eMD
_"2/_4
EE03%
2nH4i
b>%LB
a}[au
b9?w*
?}Z$1
i8y4w
5bT'_Di%@c
s)'Cu0
N~WH8,
v]wO]\
zG]5Hp
y;fc3
`g4M~
jG(W5
$L8DY
G`T1kv
T=x<0z&
W#9`z
;2R<?
9T-^k
|(5kW
$)gKiiw
+*fn]v
h.H`:Q
DFy|&J
&dfyR
cn|Z2
p2;~U
Nl5`w
IDATR
7ku-x
!2kH~V
,*%[=
{}F0$
K_kvY
'cBYq
[?v4vf
[CxNR
Mne}A>
e~$%7
8Onw3<
LFoDs
.zV8*
/PHgS^
`@C#bwu
poXS|Kf
^.dG|
:(HPW
~U7ck?
{I>ZO
5Fl;e
u7,7!t
3&c??
{)_mE
>"Go w
3U-TkL
*a+'g
pay(iu
p2Oij
P^\wc
<Goq6q
"Fz>c
~1`y>
{Poe3b'
bLyV>
r}n4q
;'O8r
IWR'?`
l0\[IfA)
Wa%|k1
$BdF0
WKby%
$J{l!L
+y!YC
,dQF}
Hz;?|
t5'GT
$h6F-
kLiSK
?;7p7
h2\`b
5FE90
o0y!G
=/]f'
|u!2u
?vEJ$KB
-oMS]
}@+]]
dNbW^Fg
4}"eR
qkm#d-
H6}jC
ivLBx
y*Df\
N7cs:<
E4}XC
>-H`;i
*g`?*
7kX/[B
A2N:.
37BS:S
xQC4rF
dy5cgH
?~Qe7
er5|b2D
sE;8)*
d=&De
'2SW-#Kq
8)>ww
,UD0sb
t.R%?
@bYs!2q
sr%)X
31MubKv
vj:_$J
Mo;#
\dB^l
+9Bq7-
s2%M6`
`fb-}
zX6Tp
3Y H`
p2;XI
k*C2L
L~ht!
\q3u;O
pu$qP
c5SO<'*
$V3_5R
#HRIH
VFBd|
Ke|0mL
7<Pwc
%zIHwx
iBGS3
HB91,
0uh4q
^w,48M5
hCIMg
1?5lE
k|'"`9n
V<WlcT
q|R9U*?
B-"=OR/
{M^WGa
lykzG7EU
V0yk1
\\SeX
k:BU+
>f8DM
P4S,E,
oG{s,
&X6}nHxMY
j9Rs}
"UlOI
?Q~dL
N8Gz`
rl13n
W:25I
oInA+
g|)V]VS
r"c:N&
hQS%X
2vM%K
yJ08
y.O?h
sb9Vcjx
%Fx8i
.^Neb
=[x~C
";MZU
]qPtl
%lUu&~
ABa1e
do*cfq
KcO]'
b*:\E
iS[h!1>K9
[v)Fz+K{
+gPN8
r-4*-p
6b-Zz
wE{ya^
H75SXI
z,5jA
J:?l?rd
C~Sx(
XMzS3
i]<f&
c8xl>
])oCc(
.fMS[h
eZK9%
qUs+3
>G[21l
;f~j:
*Sp2M"
GpGjCN1
K}Hx*ghN=
#cST Z
~,)<BA
}/;F|
r>6C;
R43Bp
4>[*fl
*Fz_y
RJ*"1
4W+%{X
KKX.8
OnW3=
]yt:kI
R?oRno
8B5*s4
DFn$:v1My
JlX/Q
"]85P1
Ky;d1
W"^HX
~&?EEe(=
h!Iwm
I&GBOc
ulm2I
9EF"R
v?{..
lki{S
i5}TZR
pi9'G
Dw"po
O!2^i
i/_fJ
xo;DVE
0/:;p
Y.UCMT
>?zFA
-AdB.|
7P'ClA
$"8T(
erVG'a
=/O4g
BP -5
rcHf/,-/
=mHYxJ
03x1=&
\=~s2
y.rFn
}Mhq~>
fMEZ
9yr+Z;
0J$r^
DvCpRe
nJG|%%
hB-megI
x^8?&
c^S0m
::ejs
WpM9)
Cw~bu)
_0ub#"
Q^@w7M
n{(Nx
'nK48Q
TvJZRY
,ln,W
&wp$-
S>-oMA]K
fS*/$
Wqw`06
"EG#(
z?'^[
M9uGL
kBPk.
)i_lS
09-rH
Z02x:F
NnU|_
Qd`Nn
O|v:rP
EIw*6l
vn/Xm;
*oJOqx
:NWMlu
:2-,P
e&F<U
x}S=r
%8vyE
:|w4aL
7}EE#
med\&
_NeYJ
Nvb^=n
W0zq*
n uGW
u~OQM
2/l{<!
Xr.-'fW
2V7R>x
`+_Gm
U{/6:
x&O[h1V3
g=/UwC
.w+M8
'3*]]
1i}Yg
8U3]?
J8!D&
o}&N8
zSVSS
fP`aL
^ki6P9
wOv`\
!mwsFfTs
+[G:s$
bgCn|6A
b<6^.
*.``a
Zf?hA
xK!(:c
ZZGJ,
V:d``
4t8!y
3VvB|
}evhN
P!~w)6j
K~_+U
+t1}B
NMdsys
4_v6MG
r4&t&f
+F-nq
sewC;"d
@k~<{
MEC8&
7}#qo
1 xh.
_B7Bg?
r6|qf]
o~>6!yu
9x,iBd
+&X,`
rVNwI
ElM{^
?c]e)
%\nO!*
x6<Id
7J!\9
<knH9
o]T-T
e8^~EA
XJjY.sG
YvxLS
<Z DF
oBcXy1
j<%S'
V"=*WMl5
q0g_o
N%n\g
XJ}$$w]
6dN|"
vL?,3
@mP_6_
z[Rm,
|SM*N
7!*_9z
|OeVT
{A_!2%H
,s[1ln
y$Hg2
HHoaJ
fxL{f
@}K%[
M$s8MN#}
M6NP=
H'FuK
ZaWJc[
er(h,
O~;JD
e?e3n
7qwu7
KfH^^
EE[3U
VL;FAO
m%eT'
>;.1fl
Uc10ue
N<c~#
\!*z5
TND,b]mk~
Dw>ID
jbk|D
(3;)Ji&
9zO0S
4 Xy=
uk&;M
$3}{s6
d62_#
0H]%~
MFf#[
hEqe|5
xAv{9
pyWL8
V6mv
]A~ss!
L$dz-
S}{8&
(6N$^
$<{,H
(Rn#/sJM
]Bd,1K
3nMNOuN
<`D~bK\
oZbjx
:wCkt
W9Iv}
\S$]E
FnT$+
8zh|a
T6h2[
$?"`]-
V4iZO
Bdgev
ek^n~
oYs4^
Q,Ozpc
:AUH_
GX%]&
T=K1c
LfcmLn
i4~)^
tmk~-
]Xxp5
!;r4N
T[Ts_b
I|mbH
H(nrl
>Czw(
k$dY\cdr
\!/='#s
q(n:y
AH%Cj
}r6'z
OV=l
_0j_)&
f^O[J
WO&,`
#OFa<
B4g|\
xg)*A
dM2f?
|Ne],C
'5A~bK#
Yfa^n
1fvR'a
?etY*
6/L&b
zc+D~
v>#X2
3cR5I
Bd|1T-
J&|Mo^
&giObz
%c.|e
3qBdZ&F
y3f4a[-
,{t-o
C&ymA
0'g*N
s}HKA
+QCXv
In;!2
dEvCy
Xj'`f
yo62x
-G`zY8
~.fk*
l_3'p?
xv?A2E
pyx+L
$#OM!
EBd*r
s$LHx
r''~G
K(2W'!
f6RCw
#(PRE
y,D&W.2
St7X=X
dtNem
>Bdk=
d|6$R(
%DF~,T
{_,3:b
tOfq|Xc
sWR/K
)+W&/)
nOy)*
.;y3y
yJsd8
p2SJw
-TqQ%
jR+wp
gM]('
p2ix%W
u3I;k
n&_o%N
+eN9\W
1$)YSe
5*J!2
Z!2_0|
7s[g0
d"i-u
e8F.a
40'YK1
dnS[,3*
uI%T<
GwR'w"t
3QqR&b
aUnNK
+NlUUw
AGDFR
$+#du
)Aa<i
S]^q'F
nrl,Fc
"}sf)oS
Y$?bX
qvG8{
:.W'uT
dqak>
vi]Z#
2mH0r
Zo1`k
[d55c
/K.ibrk5
t2"M(
~ZtXWI
FObs]
XVu|D
7cAb)N
zRaTJ
a&V+d4
mzPwf
)thEH
'.bLd)
v,w':C
V9c+7;
- cXRK
AatoV
4s*Io
6*{s[=9
MditW:
3i\*1
H}4Vg
]M=Ea
_X`a.
, k a
!$6)b
[KbD)
-fScd
j(Gwmg
_EkfK
`I=}?
=I-V,7l
\n0r<
kq,Wg
A!_Wx
VMQn\
nSNku
*e5;W
&3mi)/:
&?<R1
*fl-X
kZ$rs
XK~rS
i6f!I
sR2>|b
m*'Ku<E
h{L^_
4zFVr%
`[}OV
WGf>}H
\si^y
`uc,I
Ue)#"U
zRM(Ia
KR~D?
+MhrX
E,F:Q
'x-'W
C_I[6>wW
=l.Z9
pW&mP
c,Ct]8
4.2A:.
{O)3[
q8Wl"
%gu+:
Ik;1)
/|jZK
8t'M%p
n$_gz
=Bi|5
-5YzF
h/"&u&-
Cot$"l
q"U,78
9B1[$r_
O5X>L
J; K~
S\*A3
%pb&C
=m^hpg
* sKB
XPYFE
w[b^jp
u|sjO
G3`d=CC
EtRk1
whofm
w/%=[
XK49X
(jB+XZ#
4sNj_
z^+"+
)Tv4ns
4Q/2)
Y?s:N&C
a1.|l
[p!it
t5Kw9qju
^}J^7
3RKV!)
T61gB
uc{f7^
5#P?bF
[O`h3
Oy7b_
T>rSN
~8<2d
yw1:;
fs%^o
^LJbJ
c/\3|
=+$#/
DhD-s
$ S*I
>Pf7T
ix5QG
C-s%v
X{zs]
A\mW6
|H`be
crzvF
S83c0
<+Ro(
4%5*Y2-
G0_iO
rVWO%d
{knqf
}t&1O
:ocuE>k
&IHl<
)(m<{.
{xlsD
h3t?1sj
%Q{+(
!6.X\\
F1r]AP
V/ "p>
;j'Ws
;#'1`
f|!,>
Jal1M
VzI.0
gH0rc
9~Ov&]
lr7E_$a
cT(FS
;1CzF)
Fz_+j`PB9
~:cS6"
Kh'|~
zSY0C
v/AKp\
bPtKb
koX4x)
xj$R?k%
Biwf'
i|W/es
z;]~|
MwydQ
{^'<~
t\F~b
JzZ^!
IGy5~!
,TJ?Ax
Bo~h]
c7.k=
q7>WM
xT/Bw
_"#b/=*
cF,s+
Se+Y$T
EdwNb
aVT7Q
#H42gk
dD>qE
H`bJS~
l8{s>5
lX)/>
wUc^7Dpn
skX!Y
'W+_\ee
HF%*[
F>,"O3
~x4Nk
&|'9;'
PBfK8
Xk~VX?
+N8J?03
bMJn'
;zo- <p
4FEz`
|*Tf=
\kS+bD
g1cq2f
eHv;0
"K5".
BSLzW+
-1nZ$8
(N4%Y
)D+gl
TV7A$
-N[qN
syY|yh
<CT)"
31n)'}
>*'kb
K"mp6W
hgLG<k#
(w~=mFJ
;l|1Sy
15i<q
E(-g$
#|$u<
{{e2Z
UL#M,
zHI[=Vp2
#FW>`
ra!wU62
|t=UWW(
Z?_p2!D
&_?KV
h.JZQ
P{4eW
_p2Vz
"4*)7
UoGZi=
XW>ey
=va4xt
5fw7c
.[\sy<T
yEgfl
mzm%[
bAr'JSV
su)gGNE
+2kDw
4v9jz;
;1QGo2~
Mdb%/e]q
^:c79
g;f+.6OH
u5UL>U
|_$<+6
<'Ad^,
5Ck.?
z.%ywc
$4g>;
TF}$$
HvpLpb
>n%p|*
wY^ '=
N!!d9
(VM6`R
U:#O|'#2
Q1#~E
Fv};f
GTC1)M
CrV-U
?RYPEb
!s6?h
RknJB
Jn;ec
Hs&fz
V+Ikn
CiAOz
4]^rJ
u,_/g
TVF]DvZ
pWem2[Z=
VoG^y.
gs(;0
u4dO%a
Rd$a+
G}Y6
n~ uPC
bCh{g
K6$liL
lWlDaq
&>f|[m:Wh3qc7
btj>0
/-#6WI~
2?t~G`
q);=[
[Xw9e
.1Co S*
k{HzmC
x~F*8
uF+}4
nbrs7
x#]>t~
)xW?gS
7|u;`
dXr&6
Sy!%]%|y
Tv%/5
='6Ki
&^u&_.~
<~J^p
''k3?h5}
@Up%Kk
xW].T
_yHjlX!D&r
VnMa|
F^Brv5^3w
k&3T#
_#T)Hj
}EFG}
SwbI,
9k!2E\Hy
'`?-\
*>f=f~X
DTw'&):ca
!.%Xq
sV]mI
:2A9Y]5T)T
$xoG6
MF|)ML
QE{o7
cy0+E|
f6ZD\
wzY1*{5
bV-~O
GkP^y
\ot~ob
RJjiq5
M3Q$6
JUa49
yd"!~
sy_+~
|t=,n
H%#.>
T]5B+]
fB\+j7
H}7P.
wfns)
m'V171
Y$&i-
NY/K>
1o_3tgC
WZ~"xW%v
uOCW_
5#n^(
|&H|T7"
?"3<F
!!y.Y
9?C+6
*I6JS
--^;3
z{U-T
{+;:[
wr(U{6
BNq#{
'v!IxG
,%o98e
]k9d2
CffvTm
x9MPT
(5;`yy
_rkiOz;
ugUmJzx
bk~26k
&0q4O
U/"X#
AAFGC
zqeSh
I9?>h
!};epn
Sm]q<
-$lQ=
dk.DC1
#k)[v
+dt0D
<N$JQ
'g&^Q
fop 2|
&*d<v
91k'O'}
=K#Go
t%fBd
"2b8q
^u)XS
4czl)
})Z~Nl
[cxvr#
|D7E
'2m%%
kje5$\
/ F61
>@fA3*5
p7:,p
!2r!2C
\}RKnGa
mN0SfDvBw$
pN'EA
u1zyA8
_!7dS
Ym=z5-
Q,6wc
t`{q)
es]Tdz
yMc>m
sgz1V
"v|K^6
/W3~7?
U-T1;f
$Gv{p
%^TH'r#
XO"'l
,$.l39v2
YR(kH
+j,^
t\$E8F
JL3zb7.
X!m%W
5z$fN
=Alyt
:Y_(%
;<|6
Ss</zsug
2c=,7y
?MLLI
1aTi7
5-X_cG
;wT)TC
eV0hk]
M}8yy6
B\=mV
a~m*y
9iewqyR
cwR|~
La&$-
a&WRNc
8|h5W
i1QBd
d?veV
d}E"~}
z=ou5
CL\Yy
Jd<t)T6!/
M;Zm:N
lF{$fG
h!2^X
fzZ?lf+X
vbfG]l
f-C%2<
JG~_A
1nN45
^I&^5
^CX'_N
T9.;;
a{1Yw
X^eBI
U]I=>
z*o9q_
xG;OC&65
@2;Y0y
?Q)RJ
eIt2K
#o<c^
c:O^?d
)nRHj
[3|iv
xh]@YN{F
<t>[.
Kx~?f
5Kcqvo
]rr,y
Nr6>%;
q=n:q
M"1+rHS
C{L.7
HBzgr`
BiL\a6z&]
zR=|8N
LnTN`
8NaXe]
Jb:Y0,
zD$zqK
E!6ue
4e|ZC
N*'LBq
Kce+-
moqFb
/g.}b
]T)T^
"kI^d$
bne'p
t}9SO
U3E)
tc&\*
Nkx{X
5'V!Y
\}K6w,!
#l9Yb
w6#G/
?}Y~:
^cVr$
2gj/n
NSr5.
LB92I
&-NaPi&!
ijw#P~
1[KN\
QXaDh
m1xf&
ivv*#
F>ds`)
NUcM!2_
nVBFH
$/MNw
`pA+>
XrI%2
g.a>f
:3ej)
l"oB/
X_AJz
RR%!2
I^,r|
@<}|u8+
p?kjc
./tB'}<.
E%)l;
BVh9#+
&^4=I
EiaAdxK
MK<xqi
r2vllSFN
_e$6y
+j*+p
7#/r<
[(Vn$#
j.-{
T`#p;W
}%lR]
oPs&]S
dy7:k
IATIZ
|3\@&C=c
v"gw&
Deq*)
?p)YO
w.>r#@8
?#_T1C
paP<WLw
0j}{vJ
2l<o8'
&AJU[
]}pez!
%GM,X
MyM0A
UNM^'
95=I-
zTkbm
}p$nCe\
Z~-F:
}(U6S
BDp*c
< xIS
,OURO
:[1*a*:u
d9_/K8p
3,IS7S
D4f*Da
'pGi
"G)_ov
3fr;Q
tTAf*
L?$R4
1c_a5
Q4r<IY=}
\*#6|)
NmKQP
CikpW
<g97W
qv^FQ{)
[=s"{
7t3_4v
-Uuly
6Twl9
mr)>v_Y
H)'l*
4c(5#
bf'McR
2%he?F~
C.I8YQ
hHla.a.[
d"|.P
9WdoW0
( yr+^4
e5v=Z
.1Zw1
" x<?t
].-z?&D
'(k:pK
eaWYD
eKRO%07
Z+X4)
53YZU
:F=ck{DGJ
3"Zkb
z1#Ro
wG'"S
ok)W"
AFU)7.
Nn!A6
cgq[7
d2y`nG
D<4{p
93n!4sB
n$3|d
p5i-,~
%?p)X
/ePa%
|edHL
m9{Kc
ax5VpVc
z}!h4
%zT,q
I-J;olR
wB]E/-
n$ad'
h}!~l
aS-zf
<1cZOk
-i+Mg
U:IDATa%]W%
Dpe[w
yMTgO
N`Uu#N]
OI}*J
hON$FP
x"3z1j
UwO5c
`b6Q_&Q
qg82u
pl]:E
HMR A'U
-qc}Y! S/q
g:G'/"l
@VM;.%nF
.)K31
{v_YT
*_Q?'
R'Sup
X=c+U,
vDM+g
lDH/s
[$xM4
qFg-1
ULGv~
fKzcp
ht4}
,?-%Dw
[qk en
FJfui
sMfcc
;R& g
qDD>A
tK"C2
M{W5du.
FX6`P
bb'c:
@Xos$cO
;|,3o
zUg\r
:rtzP_
v;b~*
4EFZ/m
%?S}IU
jx6QU
JZ(-Z
R,e[q
PMjB[1
g)u:!D*
g]&S\aMYa8
gaVO>
B':3g
Z8>kC
HPp=7
f&bNZ
ls8o]
3aZ|
0&e=#
0 r(Z
am8QgMP
G;PX6
Qk>:+
^O`QE,
Xto4C
hnF`s
k4Q}%
tKF_!
JkKdh
2Z>AL|
l8F^Ws4o
::lXG
*oy.(
ZD/Q2
O~|>+
%2>w I
[PQdM
Beck>E{
W>aRq
H;E7-
;h2Bq$e
[CLf9
5MGlb
V:$-k
e,){!8
Ij??:
z]\Kj
:DN[x(
nL%#,
NG]PV
'CsO5{lo
X5>lE
n&e.%
K}M"3
Wc51e
<Q!J5
o2Ezs
1u9>;
ESz2u
;,Vbv
0y*gJu
0TPy[
>twLe
k!2:E?
"90f.
yWMy3E
<*phb
|qRi#
6R_cA
CFb'?n
,m^)F
X%8 [I
1VpOYp#
@TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDACi6+l4AAAAAAAAAAOAAAiELAQgAABAAAAAGAAAAAAAAji8AAAAgAAAAQAAAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAAAAAgAAAAAAAAMAQIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAEQvAABKAAAAAEAAAJADAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAlA8AAAAgAAAAEAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAJADAAAAQAAAAAQAAAASAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAFgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAB0LwAAAAAAAEgAAAACAAUANCQAABALAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMwBQDRAAAAAQAAER8J/g/gOI0AAAAAOI0AAACOaR8Q2hfaF9aNEwAAATiAAAAAOIEAAAAfEDiAAAAAFjiAAAAAjmk4fwAAAAA4gwAAADiEAAAAjmkX2lQGGlgWVBssAysmAAcGGlhKjxMAAAEMCAhHAgYaWEofEF2RYdJSAAYaWAYaWEoX1lQGHlgGGlhKBkr+Ahb+AVIGHlhGLcUHDSsACSoKOG3///8COG3///8LOHr///8COHn///8HOHr///8HOHr///8oDwAACjh3////Bjh3////Bzh2////AAAAEzAGAFsBAAACAAARHxP+D+A4EwEAAAA4EwEAADgYAQAAOBkBAAA4GgEAADgbAQAAF9pUOB0BAAAaWBZUOLQAAAAAOBQBAAAeWDgTAQAAbxAAAAoX2lQGHwxYFlQrbwACBhpYSgYfDFhKbxEAAAoMFyyvBh8QWAgWFhYWKBIAAAooEwAAClIGHxBYRiwzAAcHbxQAAAoZjRMAAAElFhICKBUAAAqcJRcSAigWAAAKnCUYEgIoFwAACpxvGAAACgAAAAYfDFgGHwxYShfWVAYfEVgGHwxYSgYeWEr+Ahb+AVIGHxFYRjp0////AAYaWAYaWEoX1lQGHxJYBhpYSgZK/gIW/gFSBh8SWEY6Mv///wfQEwAAASgZAAAKbxoAAAp0AQAAGw0rAAkqCjjn/v//cxsAAAo44/7//ws44v7//wY44f7//wI44P7//28cAAAKONv+//8GON3+//8GOOb+//8COOf+//8AEzACAEwAAAADAAARACsecgEAAHArGisfKyQrKSsqKysrLHQDAAABKywrAAcqAyvfKB0AAAor3ygeAAAKK9pzHwAACivVCivUBivTAivSbyAAAAorzQsr0RMwAgBoAAAABAAAEQAg6IAAACsxABwsLCsyKzMrNCs5Kz4rQxYt7itBK0ILFi0UBygGAAAGDAgoBwAABiYWKCEAAAoAKigiAAAKK8gCK8sDK8ooAwAABivFKAIAAAYrwCgBAAAGK7sKK7oGK7woBQAABiu3EzAHADQAAAAFAAARACsaci0AAHAYF40BAAABJRYrEaIrESsWKwArFSooIwAACivfAivsKCQAAAor6Aor5wYr6BMwBAAjAAAABQAAEQArEHI3AABwGBQrCisPKwArDioCK+0oJAAACivvCivuBivvABMwBwA9AAAABQAAERUsJQAeLCEXLB4dLB0rHnJNAABwGBiNAQAAASUWFowkAAABoisKKw8rACsOKgIr3ygkAAAKK+8KK+4GK+8AAAAiAiglAAAKACoAAAAeAigmAAAKKkJTSkIBAAEAAAAAAAwAAAB2NC4wLjMwMzE5AAAAAAUAbAAAAKADAAAjfgAADAQAAKQEAAAjU3RyaW5ncwAAAACwCAAAXAAAACNVUwAMCQAAEAAAACNHVUlEAAAAHAkAAPQBAAAjQmxvYgAAAAAAAAACAAABRxUCCAkAAAAAEAAAAAAAAAEAAAAkAAAAAwAAAAkAAAAJAAAAJgAAAA8AAAAFAAAAAQAAAAEAAAADAAAAAAABAAEAAAAAAAYAPABDAAYAdgBDAAoAoACRAAYA+AAYAQYAOAEYAQYAVgFqARsAfQEAAAYAjAGjAQYAtQGjAQYA0gGjAQYA8QGjAQYACgKjAQYAIwKjAQYAPgKjAQYAWQJtAgYAjAJtAgYAmgKjAQYAtwLQAgYA6gJDAAYA7wJDAAYAAANDAAoABgORAAoAIAORAAYAPQNHAwYAggNHAwYAjgNDAAYApQNDAAYAyQNDAAYA1wOjAQYA8QMBBAYAHARDAAYALQQ0BAYASwRDAA4AfQRnBA4AlARnBAYAnQRDAAAAAAAfAAAAAAABAAEAAQAQACgAEgAFAAEAAQABAQAASgBdAAkAAQAJAFAgAAAAAJEAgAAKAAEAMCEAAAAAkQCLABoAAgCYIgAAAACWAKkAIQADAPAiAAAAAJYAtwAoAAUAZCMAAAAAkQDPAC4ABwCkIwAAAACRAN4ANAAIANQjAAAAAJEA6gA0AAkAICQAAAAAhhjyADkACgAsJAAAAAAGGPIAPQAKAAAAAQCIAAAAAQCnAAAAAQCxAAAAAgC0AAAAAQDBAAAAAgDMAAAAAQDcAAAAAQDnAAAAAQDvACEA8gBCACkA8gA5ADEA8gBvAEEA8gA9AEkA8gA9AFEA8gA9AFkA8gA9AGEA8gA9AGkA8gA9AHEA8gA9AHkA8gCuAIEA8gA9AIkA8gA9AJEA8gA9AKEA9gJbAbEADANxARkAFwN1AbkAJgN8AbkALwOFAcEAWgNxAbkAZAONAbkAagONAbkAcAONAcEAdgORAdEAkwOYAcEAtwOfAcEA8gA5ALEAvwNxAeEA0AO0AekA4AO6AfEA8gC/AfEAEgTGAfkAKATSAQEBRQTSAQkBVQTeAREBiQTkAQkA8gA5ABEA8gA5AC4ACwBHAC4AEwBQAC4AGwB1AC4AIwB+AC4AKwCQAC4AMwCQAC4AOwCQAC4AQwB+AC4ASwCWAC4AUwCQAC4AWwCQAC4AYwCzAC4AawDdAC4AcwDqAC4ASgAyAWYBqQHLAdcB7wGmAQAAAAABAAAAAAAAAAAAAAAAABIAAAAEAAAAAAAAAAAAAAABADMAAAAAAAQAAAAAAAAAAAAAABEAkQAAAAAACgAAAAAAAAAAAAAAEQBnBAAAAAAAQU1EX0lzb3RvcGVzLmRsbABBTURfSXNvdG9wZXMAPE1vZHVsZT4AUHJvY2Vzc29ycwBtc2NvcmxpYgBPYmplY3QAU3lzdGVtAFBvd2VyZWRCeUF0dHJpYnV0ZQBTbWFydEFzc2VtYmx5LkF0dHJpYnV0ZXMAQXR0cmlidXRlAFhBWENBU0QAYzUASU1NTU0AU3lzdGVtLkRyYXdpbmcAQml0bWFwAEIAWEFYQVhBWABtbQB4eABTdGFydEdhbWUAQ1NDU0NWRFdERABFUQBXREZFR0dFR0VHR0UAYwBTQVNBU0ZXRgBCSABWUlZWAEtKAC5jdG9yAENvbXBpbGF0aW9uUmVsYXhhdGlvbnNBdHRyaWJ1dGUAU3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcwBSdW50aW1lQ29tcGF0aWJpbGl0eUF0dHJpYnV0ZQBEZWJ1Z2dhYmxlQXR0cmlidXRlAFN5c3RlbS5EaWFnbm9zdGljcwBEZWJ1Z2dpbmdNb2RlcwBBc3NlbWJseVRpdGxlQXR0cmlidXRlAFN5c3RlbS5SZWZsZWN0aW9uAEFzc2VtYmx5RGVzY3JpcHRpb25BdHRyaWJ1dGUAQXNzZW1ibHlDb25maWd1cmF0aW9uQXR0cmlidXRlAEFzc2VtYmx5Q29tcGFueUF0dHJpYnV0ZQBBc3NlbWJseVByb2R1Y3RBdHRyaWJ1dGUAQXNzZW1ibHlDb3B5cmlnaHRBdHRyaWJ1dGUAQXNzZW1ibHlUcmFkZW1hcmtBdHRyaWJ1dGUAQ29tVmlzaWJsZUF0dHJpYnV0ZQBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMAR3VpZEF0dHJpYnV0ZQBBc3NlbWJseUZpbGVWZXJzaW9uQXR0cmlidXRlAFRhcmdldEZyYW1ld29ya0F0dHJpYnV0ZQBTeXN0ZW0uUnVudGltZS5WZXJzaW9uaW5nAEJ5dGUAQnVmZmVyAEJsb2NrQ29weQBBcnJheQBJbWFnZQBnZXRfSGVpZ2h0AEdldFBpeGVsAENvbG9yAEZyb21BcmdiAG9wX0luZXF1YWxpdHkAQXJyYXlMaXN0AFN5c3RlbS5Db2xsZWN0aW9ucwBnZXRfQ291bnQAZ2V0X1IAZ2V0X0cAZ2V0X0IASW5zZXJ0UmFuZ2UASUNvbGxlY3Rpb24AVHlwZQBHZXRUeXBlRnJvbUhhbmRsZQBSdW50aW1lVHlwZUhhbmRsZQBUb0FycmF5AGdldF9XaWR0aABTdHJpbmcAQ29uY2F0AEFzc2VtYmx5AEdldEVudHJ5QXNzZW1ibHkAUmVzb3VyY2VNYW5hZ2VyAFN5c3RlbS5SZXNvdXJjZXMAR2V0T2JqZWN0AEVudmlyb25tZW50AEV4aXQAVGhyZWFkAFN5c3RlbS5UaHJlYWRpbmcAU2xlZXAAQXBwRG9tYWluAGdldF9DdXJyZW50RG9tYWluAE1pY3Jvc29mdC5WaXN1YWxCYXNpYwBJbnRlcmFjdGlvbgBDYWxsQnlOYW1lAENhbGxUeXBlAEludDMyAAAAKy4AUAByAG8AcABlAHIAdABpAGUAcwAuAFIAZQBzAG8AdQByAGMAZQBzAAAJTABvAGEAZAAAFUUAbgB0AHIAeQBQAG8AaQBuAHQAAA1JAG4AdgBvAGsAZQAAAE6N49+kRK9GiPDpaI83z98ACLd6XFYZNOCJBgABHQUdBQiwP19/EdUKOgYAAR0FEg0GAAISDQ4OBQACAQ4OBQABHB0FBAABHBwDIAABBCABAQ4EIAEBCAgBAAgAAAAAAB4BAAEAVAIWV3JhcE5vbkV4Y2VwdGlvblRocm93cwEFIAEBER0IAQAHAQAAAAARAQAMQU1EX0lzb3RvcGVzAAAFAQAAAAAXAQASQ29weXJpZ2h0IMKpICAyMDIwAAAEIAEBAikBACRiNmM0YzIyOS0wODhiLTQzYTYtYTIwMi1kZjY1OGFlNDg4ZGIAAAwBAAcxLjAuMC4wAABHAQAaLk5FVEZyYW1ld29yayxWZXJzaW9uPXY0LjABAFQOFEZyYW1ld29ya0Rpc3BsYXlOYW1lEC5ORVQgRnJhbWV3b3JrIDQoAQAjUG93ZXJlZCBieSBTbWFydEFzc2VtYmx5IDcuMy4wLjMyOTYAAAoABQESVQgSVQgICgcEDwEdBRAFHQUDIAAIBiACEV0ICAgABBFdCAgICAcAAgIRXRFdAyAABQYgAgEIEmUGAAESaRFtBiABElUSaQIdBQoHBA8BEmERXR0FBQACDg4OBAAAEnUGIAIBDhJ1BCABHA4GBwISeRINBAABAQgGBwMdBRwcBQAAEoCFCgAEHBwOEYCNHRwDBwEcAGwvAAAAAAAAAAAAAIIvAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB0LwAAAAAAAAAAX0NvckRsbE1haW4AbXNjb3JlZS5kbGwA/yUAIEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABABAAAAAYAACAAAAAAAAAAAAAAAAAAAABAAEAAAAwAACAAAAAAAAAAAAAAAAAAAABAAAAAABIAAAAVEAAADwDAAAAAAAAPAM0AAAAVgBTAF8AVgBFAFIAUwBJAE8ATgBfAEkATgBGAE8AAAAAAL0E7/4AAAEAAAABAAAAAAAAAAEAAAAAAD8AAAAAAAAABAAAAAIAAAAAAAAAAAAAAAAAAABEAAAAAQBWAGEAcgBGAGkAbABlAEkAbgBmAG8AAAAAACQABAAAAFQAcgBhAG4AcwBsAGEAdABpAG8AbgAAAAAAAACwBJwCAAABAFMAdAByAGkAbgBnAEYAaQBsAGUASQBuAGYAbwAAAHgCAAABADAAMAAwADAAMAA0AGIAMAAAABoAAQABAEMAbwBtAG0AZQBuAHQAcwAAAAAAAAAiAAEAAQBDAG8AbQBwAGEAbgB5AE4AYQBtAGUAAAAAAAAAAABCAA0AAQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAAAAQQBNAEQAXwBJAHMAbwB0AG8AcABlAHMAAAAAADAACAABAEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAAMQAuADAALgAwAC4AMAAAAEIAEQABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAAQQBNAEQAXwBJAHMAbwB0AG8AcABlAHMALgBkAGwAbAAAAAAASAASAAEATABlAGcAYQBsAEMAbwBwAHkAcgBpAGcAaAB0AAAAQwBvAHAAeQByAGkAZwBoAHQAIACpACAAIAAyADAAMgAwAAAAKgABAAEATABlAGcAYQBsAFQAcgBhAGQAZQBtAGEAcgBrAHMAAAAAAAAAAABKABEAAQBPAHIAaQBnAGkAbgBhAGwARgBpAGwAZQBuAGEAbQBlAAAAQQBNAEQAXwBJAHMAbwB0AG8AcABlAHMALgBkAGwAbAAAAAAAOgANAAEAUAByAG8AZAB1AGMAdABOAGEAbQBlAAAAAABBAE0ARABfAEkAcwBvAHQAbwBwAGUAcwAAAAAANAAIAAEAUAByAG8AZAB1AGMAdABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAADgACAABAEEAcwBzAGUAbQBiAGwAeQAgAFYAZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAMAAAAkD8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
C:\Users\Administrator\Desktop\Client\Temp\keeyepqYOB\src\obj\Debug\yBcC.pdb
_CorExeMain
mscoree.dll
IDATx
l9IaL
|I+'j
1c2Q!
@cca1
P;cf$
3q)_}W7
vv`++
3[p~G
ZZ"io
J%H)m
>`ys.
H}[u*r
sqoo/
z=k6
gUkNo
(o=q+r
o)-_A
AH1Sf
;Qe5^q
o9tnA
uew.vt>ly
,@Pn5
gEJ%({r
y}[i\
AH1Q:
u~#e+
AH1Q8
@kkkI
Q|s4N
{_X'P
EPF W
\.#P.#O
o_neq
o}Y_:
AH1Q:
(((~(((~(((~(((~(((~(((~(((~(((~(((~(((~(((~(((~(((~(((~(((~(((~(((~(((~(((}(((}(((}(((}(((}(((}(((}(((}(((}(((}))){))){))){))){))){))){))){))){))){***y***y***y***y***y***y***y***y***y***y***y***y***y***y***y***y***y***x---p000j
\\\8wwwXwwwXwwwXwwwXwwwXwwwXwwwXwwwXvvvXvvvXvvvXvvvXvvvXvvvXtttXtttXtttXtttXtttXtttXtttXtttXtttXtttXtttXtttXtttXtttXtttXtttXsssXsssXsssXsssXsssXsssXsssXsssXsssXsssXBBB
Q P P P P N N N N!!!M!!!L!!!L!!!L!!!L!!!L!!!L!!!L!!!L!!!L"""K"""K"""K"""K###I###I###I###I###H$$$G$$$G$$$G$$$G$$$G$$$G$$$G$$$G&&&C!!!)
www,www,www,www,vvv,vvv,vvv,ttt,ttt,ttt,ttt,ttt,ttt,ttt,ttt,sss,sss,sss,sss,sss,BBB
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>PAPADDINGXXPADDINGPADDINGXXPAD
U-5=EMU]dk
Fries
These are some fries
ner Pizza
Turkish Pizza
This is a turkish pizza
Vega Burger
This is a vegetarian hamburger
Double Cheeseburger
This is a double cheeseburger
Grilled Salmon
This is a grilled salmon
cbMenus
label1
Menu:
btnAddMenu
lstOrder
btnClearMenus
Clear
btnRemoveMenu
Remove
label2
Totalprice:
lblTotalPrice
OrderForm
KwhaALVDvicYqVXkHfjR
AMD_Isotopes.Processors
StartGame
WinformsSandbox
Form1
Group of Groups!
WinformsSandbox.Properties.Resources
unify4
DataSource
GroupsBindingList
SelectedGroupBindingList
SelectedGroupDataGrid
PersonName
GroupsDataGrid
GroupName
Group Name
Roboto
GroupsView
Groups
{Random Group:
Leonor Halberg
Emil Hardin
Fredda Tardif
Regenia Kearley
Antonietta Batie
Rikki Melnyk
Claire Younger
Mindy Smale
Fredricka Vining
Maribeth Corum
Dagmar Paulson
Ariane Rexroat
Kristyn Drakeford
Susan Debose
Marisol Felter
Lenore Costner
Mitch Tremblay
Madie Penn
Eduardo Gloster
Ardella Bongiorno
Gertude Sherburne
Basilia Leger
Brianna Fleener
Kristian Langlois
Billi Torgerson
Tawnya Berenbaum
Ma Fritze
Lilly Ketchum
Lourie Snook
Brice Spece
Zenia Wilke
Leland Mccaslin
Sanjuanita Slemp
Elwanda Nasser
Melody Cockerham
Roseann Mcgillis
Jesse Sheffield
Lavona Dolloff
Raisa Holst
Regan Schoenberg
Gearldine Pettry
Ilene Mahr
Mitchell Rethman
Britney Riddell
Signe Shuman
Valery Solie
Sherril Portwood
Moshe Lirette
Renata Rael
Jefferey Brendel
Vallie Eidt
Nadia Wine
Neomi Mole
Jannette Gambrell
Tomika Graeber
Ricki Purdom
Martine Tetrault
Dorotha Dashiell
Shaunda Demko
Nereida Chisum
Joy Besaw
Bernardine Winebrenner
Omega Segawa
Patrina Morones
Buddy Sowell
Mahalia Landrum
Fleta Luft
Helen Le
Darlene Borton
Lai Lamont
Winona Lapan
Annie Romero
Samantha Crone
Tamela Weatherwax
Denyse Bosket
Margurite Estabrook
Sebastian Hassell
Joshua Brittingham
Clay Hudspeth
Loriann Burditt
Keshia Poplawski
Karissa Paugh
Annamarie Drees
Tifany Johnosn
Essie Critchfield
Eleanore Bradeen
Deidre Chauez
Santo Limbaugh
Fermina Spinelli
Deonna Higby
Ute Fouts
Joesph Speno
Timothy Fritz
Irene Houze
Brock Lambright
Buffy Claybrooks
Jarod Hofstetter
Holley Mousseau
Bettye Soderberg
Tammera Strebel
Editing
Please, put price in correct format!
Please, fill in all fields!!!
groupBoxButtons
Microsoft Sans Serif
buttonCancel
Cancel
buttonSave
Adding Products:
textBoxSku
labelSku
SKU Number
labelCategory
Category
textBoxCategory
labelTM
Trade Mark
textBoxTM
labelPrName
Product Name
textBoxPrName
labelSupplier
Supplier
textBoxSupplier
labelPrice
Price, UAH
textBoxPrice
labelStoreUn
Storage Unite
textBoxStoreUn
labelProductDetails
Product Details
textBoxProductDetails
AddEditForm
Adding product
Product Editing:
dataGridView1
buttonAdd
Add Product
buttonEdit
Edit Product
button3
Delete Product
groupBox1
buttonExit
EditDeleteAddForm
Products Amending
buttonShow
Show products
buttonAmend
Amend Products
Arial Narrow
labelProducts
Products
labelCatalogue
Catalogue
MainForm
ProductsDirectory.xml
SKU Number =
, Category =
, Trade Mark =
,Product Name =
, Product Details =
, Supplier =
Price = {0}, Storage Unit = {1}
ShowForm
Show Products
KwhaALVDvicYqVXkHfjR
unify4
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
Winform Sandbox
FileVersion
1.98.4.0
InternalName
yBcC.exe
LegalCopyright
Copyright
2017 - 2020
LegalTrademarks
OriginalFilename
yBcC.exe
ProductName
Winform Sandbox
ProductVersion
1.98.4.0
Assembly Version
1.98.4.0

Full Results

Engine Signature Engine Signature Engine Signature
Bkav Clean MicroWorld-eScan Clean VBA32 Clean
FireEye Generic.mg.0485f54184da61a8 CAT-QuickHeal Clean McAfee Artemis!0485F54184DA
Cylance Clean Zillya Clean SUPERAntiSpyware Clean
Sangfor Malware K7AntiVirus Clean Alibaba Clean
K7GW Clean Cybereason Clean Arcabit Clean
TrendMicro Clean Baidu Clean F-Prot Clean
Symantec Clean TotalDefense Clean APEX Malicious
Avast Clean ClamAV Clean Kaspersky HEUR:Backdoor.MSIL.Androm.gen
BitDefender Clean NANO-Antivirus Clean Paloalto generic.ml
AegisLab Clean Tencent Clean Endgame malicious (high confidence)
TACHYON Clean Emsisoft Clean Comodo Clean
F-Secure Trojan.TR/AD.AgentTesla.mewpo DrWeb Trojan.Siggen9.56430 VIPRE Clean
Invincea Clean Trapmine Clean CMC Clean
Sophos Clean SentinelOne Clean Cyren W32/MSIL_Troj.WM.gen!Eldorado
Jiangmin Clean Webroot Clean Avira TR/AD.AgentTesla.mewpo
Fortinet MSIL/GenKryptik.ENGV!tr Antiy-AVL Clean Kingsoft Clean
Microsoft Trojan:Win32/Wacatac.C!ml ViRobot Clean ZoneAlarm HEUR:Backdoor.MSIL.Androm.gen
Avast-Mobile Clean Cynet Clean AhnLab-V3 Clean
Acronis Clean BitDefenderTheta Clean ALYac Clean
MAX Clean Ad-Aware Clean Malwarebytes Trojan.MalPack.ADC
Zoner Clean ESET-NOD32 a variant of MSIL/Kryptik.WPS TrendMicro-HouseCall Clean
Rising Backdoor.Androm!8.113 (CLOUD) Yandex Clean Ikarus Clean
eGambit Clean GData Clean MaxSecure Trojan.Malware.300983.susgen
AVG Clean Panda Clean CrowdStrike win/malicious_confidence_60% (W)
Qihoo-360 Generic/Backdoor.9cf
Sorry! No behavior.

Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
Y 52.114.7.36 [VT] Hong Kong
Y 13.107.42.23 [VT] United States

TCP

Source Source Port Destination Destination Port
192.168.1.8 49173 13.107.42.23 443
192.168.1.8 49175 13.107.42.23 443
192.168.1.8 52890 52.114.7.36 47364
192.168.1.8 65445 52.114.7.36 51116
192.168.1.8 57632 52.114.7.36 51989
192.168.1.8 49186 52.114.7.36 443
192.168.1.8 49188 93.184.220.29 80

UDP

Source Source Port Destination Destination Port
192.168.1.8 137 192.168.1.255 137
192.168.1.8 49744 8.8.8.8 53
192.168.1.8 51064 8.8.8.8 53
192.168.1.8 55051 8.8.8.8 53
192.168.1.8 63225 8.8.8.8 53
192.168.1.8 63471 8.8.8.8 53
192.168.1.8 65129 8.8.8.8 53

DNS

No domains contacted.

HTTP Requests

No HTTP requests performed.

SMTP traffic

No SMTP traffic performed.

IRC traffic

No IRC requests performed.

ICMP traffic

No ICMP traffic performed.

CIF Results

No CIF Results

Suricata Alerts

Timestamp Source IP Source Port Destination IP Destination Port Protocol GID SID REV Signature Category Severity
2020-06-30 15:46:46.478 192.168.1.8 [VT] 49172 13.107.42.23 [VT] 443 TCP 1 2028395 2 ET JA3 Hash - Possible Malware - Various Eitest Unknown Traffic 3
2020-06-30 15:46:46.631 192.168.1.8 [VT] 49173 13.107.42.23 [VT] 443 TCP 1 2028395 2 ET JA3 Hash - Possible Malware - Various Eitest Unknown Traffic 3
2020-06-30 15:46:46.640 192.168.1.8 [VT] 49174 13.107.42.23 [VT] 443 TCP 1 2028395 2 ET JA3 Hash - Possible Malware - Various Eitest Unknown Traffic 3
2020-06-30 15:46:46.723 192.168.1.8 [VT] 49175 13.107.42.23 [VT] 443 TCP 1 2028395 2 ET JA3 Hash - Possible Malware - Various Eitest Unknown Traffic 3
2020-06-30 15:46:46.735 192.168.1.8 [VT] 49176 13.107.42.23 [VT] 443 TCP 1 2028395 2 ET JA3 Hash - Possible Malware - Various Eitest Unknown Traffic 3

Suricata TLS

Timestamp Source IP Source Port Destination IP Destination Port Subject Issuer Fingerprint Version
2020-06-30 15:46:46.601 192.168.1.8 [VT] 49172 13.107.42.23 [VT] 443 CN=edge.skype.com 5c:3b:53:ee:b8:65:a3:2a:66:d4:04:36:67:98:af:88:8d:96:5d:74 TLS 1.2
2020-06-30 15:46:46.640 192.168.1.8 [VT] 49173 13.107.42.23 [VT] 443 CN=edge.skype.com 5c:3b:53:ee:b8:65:a3:2a:66:d4:04:36:67:98:af:88:8d:96:5d:74 TLS 1.2
2020-06-30 15:46:46.673 192.168.1.8 [VT] 49174 13.107.42.23 [VT] 443 CN=edge.skype.com 5c:3b:53:ee:b8:65:a3:2a:66:d4:04:36:67:98:af:88:8d:96:5d:74 TLS 1.2
2020-06-30 15:46:46.735 192.168.1.8 [VT] 49175 13.107.42.23 [VT] 443 CN=edge.skype.com 5c:3b:53:ee:b8:65:a3:2a:66:d4:04:36:67:98:af:88:8d:96:5d:74 TLS 1.2
2020-06-30 15:46:46.735 192.168.1.8 [VT] 49176 13.107.42.23 [VT] 443 CN=edge.skype.com 5c:3b:53:ee:b8:65:a3:2a:66:d4:04:36:67:98:af:88:8d:96:5d:74 TLS 1.2
2020-06-30 15:47:20.540 192.168.1.8 [VT] 49186 52.114.7.36 [VT] 443 CN=*.events.data.microsoft.com 1a:c2:39:ff:84:fe:1a:c9:81:f5:45:9a:d0:a0:f2:66:d1:8c:38:c9 TLS 1.2

Suricata HTTP

Timestamp Source IP Source Port Destination IP Destination Port Method Status Hostname URI Content Type User Agent Referrer Length
2020-06-30 15:47:22.017 192.168.1.8 [VT] 49187 67.26.139.254 [VT] 80 200 ctldl.windowsupdate.com [VT] /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0d23747eb5b0cb5e application/vnd.ms-cab-compressed Microsoft-CryptoAPI/6.1 None 6894
2020-06-30 15:47:22.588 192.168.1.8 [VT] 49188 93.184.220.29 [VT] 80 200 ocsp.digicert.com [VT] /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D application/ocsp-response Microsoft-CryptoAPI/6.1 None 1507
Sorry! No dropped Suricata Extracted files.

JA3

Source Source Port Destination Destination Port JA3 Hash JA3 Description
192.168.1.8 49172 13.107.42.23 443 1074895078955b2db60423ed2bf8ac23 unknown
192.168.1.8 49173 13.107.42.23 443 1074895078955b2db60423ed2bf8ac23 unknown
192.168.1.8 49174 13.107.42.23 443 1074895078955b2db60423ed2bf8ac23 unknown
192.168.1.8 49175 13.107.42.23 443 1074895078955b2db60423ed2bf8ac23 unknown
192.168.1.8 49176 13.107.42.23 443 1074895078955b2db60423ed2bf8ac23 unknown
192.168.1.8 49186 52.114.7.36 443 d124ae14809abde3528a479fe01a12bd unknown
Sorry! No dropped files.
Sorry! No CAPE files.
Process Name services.exe
PID 472
Dump Size 327680 bytes
Module Path C:\Windows\sysnative\services.exe
Type PE image: 64-bit executable
PE timestamp 2015-04-13 02:02:59
MD5 f0fce4be5b130f67ff88a96e6a75dd89
SHA1 30c9b6d94dae90da76bfa2659c2cc639bc5cecea
SHA256 47795728e238ee66d47b53b26c6c9834a4309955135204ddb3460eca9dd5b7a9
CRC32 5156D295
Ssdeep 6144:HX+dGqMuImU4Zkt8kjM7vFLFb/2JBH4EtLcN8ZE21uqw3LITm:HX+dGluImU4s8m/zMJI
Dump Filename 47795728e238ee66d47b53b26c6c9834a4309955135204ddb3460eca9dd5b7a9
Download Download Zip
Process Name schtasks.exe
PID 4344
Dump Size 177152 bytes
Module Path C:\Windows\SysWOW64\schtasks.exe
Type PE image: 32-bit executable
PE timestamp 2010-11-20 09:20:03
MD5 4f04ea3589eed5bbaa56752919e3534b
SHA1 0fb463f8b9d831aa903fc763e8d57d9b1753f924
SHA256 702f5630d0e62bd5d1c53e36a7c68d190697fdfcfc1f78ee22a420ab77944e16
CRC32 6BBCCCF6
Ssdeep 3072:RgHck/SyK9zpw4/d8Y6h7FA1be9c4YMJDz5lkKw/XYTGBGA2Cx:R0ck/Sh51KqmbYO5lkyMGAN
Dump Filename 702f5630d0e62bd5d1c53e36a7c68d190697fdfcfc1f78ee22a420ab77944e16
Download Download Zip
Process Name svchost.exe
PID 840
Dump Size 26624 bytes
Module Path C:\Windows\sysnative\svchost.exe
Type PE image: 64-bit executable
PE timestamp 2009-07-13 23:31:13
MD5 dee7243396ae983fa433b691b35d9616
SHA1 aa92db2341234f0491352179c41a7a71a2a6e86e
SHA256 4a7be92f7d0fe49df1f968b9d29e17af6e970492e5a505cd1a35d2f007912e2e
CRC32 6FCDA8DE
Ssdeep 384:zvvWkXZVq+1t5TYGaVeAYMq1n+Rfk4ue//wCEyrlWVSsEsj45RCOvojtPKW9C5bW:bWkX7q+f5TYvVeZMmn+0C4xZEbvKtPK
Dump Filename 4a7be92f7d0fe49df1f968b9d29e17af6e970492e5a505cd1a35d2f007912e2e
Download Download Zip
Process Name yy4Wxq30N6hFB.exe
PID 3620
Dump Size 279040 bytes
Module Path C:\Users\Louise\AppData\Local\Temp\yy4Wxq30N6hFB.exe
Type PE image: 32-bit executable
PE timestamp 2020-06-30 09:10:27
MD5 fd284836a0acb4fee8dd901901aa46c0
SHA1 5f98ef123be66e4af8900161ace9a532183c65aa
SHA256 6ccd905de870bd16a06883bdfa69c01720109c3912ec4c4ab912050f26cd3fd2
CRC32 78FAFECC
Ssdeep 6144:KDnd2T42hrDBz8mKq9tp4n/bDrr99UecLMvr521:2nTwF1tpmzDr5cQv
CAPE Yara
  • AgentTeslaV2 Payload - Author: ditekshen
Dump Filename 6ccd905de870bd16a06883bdfa69c01720109c3912ec4c4ab912050f26cd3fd2
Download Download Zip
Defense Evasion Credential Access Collection Privilege Escalation Execution Persistence
  • T1116 - Code Signing
    • Signature - invalid_authenticode_signature
  • T1055 - Process Injection
    • Signature - InjectionInterProcess
  • T1045 - Software Packing
    • Signature - packer_entropy
  • T1003 - Credential Dumping
    • Signature - infostealer_browser
  • T1081 - Credentials in Files
    • Signature - infostealer_browser
  • T1005 - Data from Local System
    • Signature - infostealer_browser
  • T1055 - Process Injection
    • Signature - InjectionInterProcess
  • T1053 - Scheduled Task
    • Signature - uses_windows_utilities_to_create_scheduled_task
  • T1053 - Scheduled Task
    • Signature - uses_windows_utilities_to_create_scheduled_task
  • T1053 - Scheduled Task
    • Signature - uses_windows_utilities_to_create_scheduled_task

    Processing ( 26.442999999999994 seconds )

    • 17.99 BehaviorAnalysis
    • 5.506 Suricata
    • 1.112 Static
    • 0.497 CAPE
    • 0.323 NetworkAnalysis
    • 0.247 static_dotnet
    • 0.241 VirusTotal
    • 0.168 ProcDump
    • 0.128 Dropped
    • 0.068 TargetInfo
    • 0.067 Deduplicate
    • 0.052 AnalysisInfo
    • 0.016 Debug
    • 0.016 Strings
    • 0.012 peid

    Signatures ( 2.4039999999999955 seconds )

    • 0.326 antiav_detectreg
    • 0.141 infostealer_ftp
    • 0.138 territorial_disputes_sigs
    • 0.105 masquerade_process_name
    • 0.081 Locky_behavior
    • 0.073 infostealer_im
    • 0.067 antianalysis_detectreg
    • 0.064 stealth_timeout
    • 0.063 antiav_detectfile
    • 0.06 decoy_document
    • 0.057 NewtWire Behavior
    • 0.055 api_spamming
    • 0.038 infostealer_bitcoin
    • 0.037 antivm_vbox_keys
    • 0.033 antianalysis_detectfile
    • 0.033 infostealer_mail
    • 0.032 antivm_generic_disk
    • 0.031 mimics_filetime
    • 0.028 Doppelganging
    • 0.027 virus
    • 0.026 guloader_apis
    • 0.025 injection_createremotethread
    • 0.025 reads_self
    • 0.025 antivm_vbox_files
    • 0.024 InjectionCreateRemoteThread
    • 0.024 stealth_file
    • 0.024 antivm_vmware_keys
    • 0.023 bootkit
    • 0.023 ransomware_extensions
    • 0.02 ransomware_files
    • 0.019 exec_crash
    • 0.018 dynamic_function_loading
    • 0.018 hancitor_behavior
    • 0.018 qulab_files
    • 0.017 antivm_parallels_keys
    • 0.017 antivm_xen_keys
    • 0.016 antiemu_wine_func
    • 0.016 malicious_dynamic_function_loading
    • 0.014 antidebug_guardpages
    • 0.014 infostealer_browser_password
    • 0.014 geodo_banking_trojan
    • 0.014 predatorthethief_files
    • 0.013 Unpacker
    • 0.013 exploit_heapspray
    • 0.013 kovter_behavior
    • 0.012 antivm_vpc_keys
    • 0.011 InjectionInterProcess
    • 0.011 antivm_generic_diskreg
    • 0.011 antivm_vmware_files
    • 0.01 infostealer_browser
    • 0.01 antidbg_devices
    • 0.009 antivm_generic_scsi
    • 0.009 betabot_behavior
    • 0.009 kibex_behavior
    • 0.009 persistence_autorun
    • 0.008 exploit_getbasekerneladdress
    • 0.007 antiav_avast_libs
    • 0.007 antivm_generic_services
    • 0.007 antivm_vbox_libs
    • 0.007 network_tor
    • 0.007 stack_pivot
    • 0.006 antidbg_windows
    • 0.006 dyre_behavior
    • 0.006 exploit_gethaldispatchtable
    • 0.006 hawkeye_behavior
    • 0.006 injection_runpe
    • 0.006 shifu_behavior
    • 0.006 masslogger_files
    • 0.005 InjectionProcessHollowing
    • 0.005 antiav_bitdefender_libs
    • 0.005 antisandbox_sunbelt_libs
    • 0.005 OrcusRAT Behavior
    • 0.005 vawtrak_behavior
    • 0.005 antivm_xen_keys
    • 0.005 antivm_hyperv_keys
    • 0.005 antivm_vbox_devices
    • 0.005 ketrican_regkeys
    • 0.005 browser_security
    • 0.005 bypass_firewall
    • 0.005 network_tor_service
    • 0.005 rat_pcclient
    • 0.005 recon_fingerprint
    • 0.004 antiav_bullgaurd_libs
    • 0.004 antiav_emsisoft_libs
    • 0.004 antiav_qurb_libs
    • 0.004 antiav_apioverride_libs
    • 0.004 antiav_nthookengine_libs
    • 0.004 antisandbox_sboxie_libs
    • 0.004 encrypted_ioc
    • 0.004 Vidar Behavior
    • 0.004 kazybot_behavior
    • 0.004 office_com_load
    • 0.004 blackrat_registry_keys
    • 0.004 neshta_files
    • 0.004 codelux_behavior
    • 0.004 darkcomet_regkeys
    • 0.004 disables_browser_warn
    • 0.004 packer_armadillo_regkey
    • 0.004 obliquerat_files
    • 0.004 remcos_regkeys
    • 0.003 InjectionSetWindowLong
    • 0.003 Raccoon Behavior
    • 0.003 recon_programs
    • 0.003 tinba_behavior
    • 0.003 modify_uac_prompt
    • 0.003 office_perfkey
    • 0.003 office_security
    • 0.003 persistence_ads
    • 0.003 limerat_regkeys
    • 0.003 warzonerat_regkeys
    • 0.003 sniffer_winpcap
    • 0.003 targeted_flame
    • 0.002 TransactedHollowing
    • 0.002 h1n1_behavior
    • 0.002 injection_explorer
    • 0.002 office_vb_load
    • 0.002 office_wmi_load
    • 0.002 rat_luminosity
    • 0.002 rat_nanocore
    • 0.002 sets_autoconfig_url
    • 0.002 antisandbox_fortinet_files
    • 0.002 antisandbox_threattrack_files
    • 0.002 antivm_generic_bios
    • 0.002 antivm_generic_system
    • 0.002 antivm_vpc_files
    • 0.002 banker_cridex
    • 0.002 modify_proxy
    • 0.002 azorult_mutexes
    • 0.002 dcrat_files
    • 0.002 warzonerat_files
    • 0.002 remcos_files
    • 0.002 tampers_etw
    • 0.001 PlugX
    • 0.001 antisandbox_sleep
    • 0.001 antivm_vmware_libs
    • 0.001 regsvr32_squiblydoo_dll_load
    • 0.001 uac_bypass_eventvwr
    • 0.001 cerber_behavior
    • 0.001 ipc_namedpipe
    • 0.001 office_dotnet_load
    • 0.001 persistence_autorun_tasks
    • 0.001 ransomware_message
    • 0.001 stack_pivot_file_created
    • 0.001 antisandbox_cuckoo_files
    • 0.001 antisandbox_joe_anubis_files
    • 0.001 antisandbox_sunbelt_files
    • 0.001 banker_zeus_mutex
    • 0.001 bitcoin_opencl
    • 0.001 bot_drive
    • 0.001 bot_drive2
    • 0.001 browser_addon
    • 0.001 clears_logs
    • 0.001 disables_smartscreen
    • 0.001 disables_system_restore
    • 0.001 disables_windows_defender
    • 0.001 removes_windows_defender_contextmenu
    • 0.001 arkei_files
    • 0.001 modify_security_center_warnings
    • 0.001 network_dns_doh_tls
    • 0.001 packer_enigma
    • 0.001 persistence_ifeo
    • 0.001 persistence_shim_database
    • 0.001 medusalocker_regkeys
    • 0.001 revil_mutexes
    • 0.001 modirat_bheavior
    • 0.001 rat_spynet
    • 0.001 spreading_autoruninf
    • 0.001 stealth_hiddenreg
    • 0.001 stealth_hide_notifications
    • 0.001 lokibot_mutexes

    Reporting ( 33.258 seconds )

    • 26.382 BinGraph
    • 6.667 JsonDump
    • 0.127 SubmitCAPE
    • 0.082 MITRE_TTPS