Exes_8b6d34e15b5e3ca155a361c5e425d2a3_exe_2019-06-28_07_30.json

[*] MalFamily: "Malicious"

[*] MalScore: 10.0

[*] File Name: "Exes_8b6d34e15b5e3ca155a361c5e425d2a3.exe"
[*] File Size: 1024000
[*] File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
[*] SHA256: "7c960445b3740bcfc291a5a802f10df665173dd492d09368071c5e1b0ed03795"
[*] MD5: "8b6d34e15b5e3ca155a361c5e425d2a3"
[*] SHA1: "008de87ec8c36a397a0adf9fcc49bc50953719a6"
[*] SHA512: "f58e58ec508030760b0db85ccc4b7ea36860b7faf697b4148b2c0680e933b8c23aed7be27538b853db424a31139693d0c70f020f9ec7dd33e03d5715219bfded"
[*] CRC32: "B85486A3"
[*] SSDEEP: "12288:exVPGc+QB4qR8DDUONY5eN+ckK8i5ItHONSnmGfuAiaZ5JfUiSPef5hXJVzZGm:e7PmnDrYRcKhkNCbZ5JXSPSXJRY"

[*] Process Execution: [
    "Exes_8b6d34e15b5e3ca155a361c5e425d2a3.exe",
    "Exes_8b6d34e15b5e3ca155a361c5e425d2a3.exe",
    "schtasks.exe",
    "schtasks.exe",
    "reg.exe",
    "svchost.exe",
    "WMIADAP.exe",
    "taskeng.exe",
    "taskeng.exe",
    "client.exe",
    "taskeng.exe",
    "client.exe",
    "net.exe",
    "net1.exe",
    "svchost.exe",
    "WmiPrvSE.exe",
    "net.exe",
    "svchost.exe"
]

[*] Signatures Detected: [
    {
        "Description": "Attempts to connect to a dead IP:Port (2 unique times)",
        "Details": [
            {
                "IP": "23.4.43.27:80"
            },
            {
                "IP": "72.21.91.29:80"
            }
        ]
    },
    {
        "Description": "Creates RWX memory",
        "Details": []
    },
    {
        "Description": "Possible date expiration check, exits too soon after checking local time",
        "Details": [
            {
                "process": "schtasks.exe, PID 2532"
            }
        ]
    },
    {
        "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
        "Details": [
            {
                "ioc": "abms.epsilon"
            },
            {
                "ioc": "gmail.com"
            },
            {
                "ioc": "www.digicert.com1"
            },
            {
                "ioc": "http://www.symauth.com/cps0"
            },
            {
                "ioc": "http://www.symauth.com/rpa0"
            }
        ]
    },
    {
        "Description": "A process created a hidden window",
        "Details": [
            {
                "Process": "svchost.exe -> \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE"
            }
        ]
    },
    {
        "Description": "Drops a binary and executes it",
        "Details": [
            {
                "binary": "C:\\Program Files (x86)\\Client\\client.exe"
            }
        ]
    },
    {
        "Description": "Performs some HTTP requests",
        "Details": [
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
            },
            {
                "url": "http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl"
            },
            {
                "url": "http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl"
            },
            {
                "url": "http://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D"
            },
            {
                "url": "http://sv.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEFl%2BTkXLwRW7pkAmAuicv0U%3D"
            },
            {
                "url": "http://sv.symcb.com/sv.crl"
            }
        ]
    },
    {
        "Description": "The binary likely contains encrypted or compressed data.",
        "Details": [
            {
                "section": "name: .text, entropy: 7.75, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x000f7000, virtual_size: 0x000f6a94"
            }
        ]
    },
    {
        "Description": "Detects Avast Antivirus through the presence of a library",
        "Details": []
    },
    {
        "Description": "Executed a process and injected code into it, probably while unpacking",
        "Details": [
            {
                "Injection": "Exes_8b6d34e15b5e3ca155a361c5e425d2a3.exe(1880) -> Exes_8b6d34e15b5e3ca155a361c5e425d2a3.exe(1712)"
            }
        ]
    },
    {
        "Description": "Attempts to remove evidence of file being downloaded from the Internet",
        "Details": [
            {
                "file": "C:\\Program Files (x86)\\Client\\client.exe:Zone.Identifier"
            }
        ]
    },
    {
        "Description": "Sniffs keystrokes",
        "Details": [
            {
                "SetWindowsHookExW": "Process: Exes_8b6d34e15b5e3ca155a361c5e425d2a3.exe(1712)"
            }
        ]
    },
    {
        "Description": "Code injection with CreateRemoteThread in a remote process",
        "Details": [
            {
                "Injection": "Exes_8b6d34e15b5e3ca155a361c5e425d2a3.exe(1712) -> None(2540)"
            }
        ]
    },
    {
        "Description": "Tries to suspend Cuckoo threads to prevent logging of malicious activity",
        "Details": [
            {
                "Process": "net.exe (2800)"
            }
        ]
    },
    {
        "Description": "A process attempted to delay the analysis task by a long amount of time.",
        "Details": [
            {
                "Process": "Exes_8b6d34e15b5e3ca155a361c5e425d2a3.exe tried to sleep 24284 seconds, actually delayed analysis time by 0 seconds"
            },
            {
                "Process": "svchost.exe tried to sleep 324 seconds, actually delayed analysis time by 0 seconds"
            },
            {
                "Process": "taskeng.exe tried to sleep 360 seconds, actually delayed analysis time by 0 seconds"
            }
        ]
    },
    {
        "Description": "Tries to unhook or modify Windows functions monitored by Cuckoo",
        "Details": [
            {
                "unhook": "function_name: NtQuerySystemInformation, type: modification"
            }
        ]
    },
    {
        "Description": "Attempts to execute a Living Off The Land Binary command for post exeploitation",
        "Details": [
            {
                "MITRE T1078 - schtask": "(Tactic: Execution, Persistence, Privilege Escalation)"
            }
        ]
    },
    {
        "Description": "Installs itself for autorun at Windows startup",
        "Details": [
            {
                "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Client Monitor"
            },
            {
                "data": "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\shell"
            },
            {
                "data": "explorer.exe,\"C:\\Windows\\system32\\clientmonitor.exe\""
            },
            {
                "task": "schtasks /create /tn \"Client Monitor\" /tr \"'C:\\Program Files (x86)\\Client\\client.exe' /startup\" /sc MINUTE /f /rl highest"
            }
        ]
    },
    {
        "Description": "Creates a hidden or system file",
        "Details": [
            {
                "file": "C:\\Program Files (x86)\\Client\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Monitor\\"
            },
            {
                "file": "C:\\Program Files (x86)\\Client\\client.exe"
            },
            {
                "file": "C:\\Windows\\System32\\clientmonitor.exe"
            }
        ]
    },
    {
        "Description": "File has been identified by 54 Antiviruses on VirusTotal as malicious",
        "Details": [
            {
                "K7AntiVirus": "Trojan ( 005068ac1 )"
            },
            {
                "MicroWorld-eScan": "Trojan.Generic.20659386"
            },
            {
                "FireEye": "Generic.mg.8b6d34e15b5e3ca1"
            },
            {
                "McAfee": "Packed-KD!8B6D34E15B5E"
            },
            {
                "Cylance": "Unsafe"
            },
            {
                "Alibaba": "Trojan:MSIL/Agent.dab2eb4f"
            },
            {
                "K7GW": "Trojan ( 005068ac1 )"
            },
            {
                "Arcabit": "Trojan.Generic.D13B3CBA"
            },
            {
                "TrendMicro": "TROJ_GEN.R03FC0PDO19"
            },
            {
                "F-Prot": "W32/Msil.EEK"
            },
            {
                "Symantec": "Trojan.Gen.2"
            },
            {
                "APEX": "Malicious"
            },
            {
                "Paloalto": "generic.ml"
            },
            {
                "Kaspersky": "Trojan.MSIL.Agent.fpau"
            },
            {
                "BitDefender": "Trojan.Generic.20659386"
            },
            {
                "NANO-Antivirus": "Trojan.Win32.Mlw.elxxim"
            },
            {
                "ViRobot": "Trojan.Win32.Z.Agent.1024000.DS"
            },
            {
                "Avast": "Win32:Malware-gen"
            },
            {
                "Ad-Aware": "Trojan.Generic.20659386"
            },
            {
                "Emsisoft": "Trojan.Generic.20659386 (B)"
            },
            {
                "Comodo": "Malware@#2a6j39g6btql7"
            },
            {
                "F-Secure": "Heuristic.HEUR/AGEN.1001106"
            },
            {
                "DrWeb": "Trojan.PWS.Stealer.13025"
            },
            {
                "Zillya": "Trojan.Agent.Win32.758982"
            },
            {
                "Invincea": "heuristic"
            },
            {
                "McAfee-GW-Edition": "BehavesLike.Win32.Generic.fc"
            },
            {
                "Sophos": "Mal/Generic-S"
            },
            {
                "Ikarus": "Trojan.MSIL.Injector"
            },
            {
                "Cyren": "W32/Trojan.RHTD-8572"
            },
            {
                "Webroot": "W32.Malware.Gen"
            },
            {
                "Avira": "HEUR/AGEN.1001106"
            },
            {
                "Antiy-AVL": "Trojan/Win32.AGeneric"
            },
            {
                "Endgame": "malicious (high confidence)"
            },
            {
                "Microsoft": "Trojan:Win32/Dynamer!ac"
            },
            {
                "AegisLab": "Trojan.Win32.Generic.4!c"
            },
            {
                "ZoneAlarm": "Trojan.MSIL.Agent.fpau"
            },
            {
                "GData": "Trojan.Generic.20659386"
            },
            {
                "AhnLab-V3": "Win-Trojan/MSILKrypt02.Exp"
            },
            {
                "Acronis": "suspicious"
            },
            {
                "VBA32": "Trojan.MSIL.Agent"
            },
            {
                "ALYac": "Trojan.Generic.20659386"
            },
            {
                "MAX": "malware (ai score=99)"
            },
            {
                "ESET-NOD32": "a variant of MSIL/Injector.RME"
            },
            {
                "TrendMicro-HouseCall": "TROJ_GEN.R03FC0PDO19"
            },
            {
                "Tencent": "Msil.Trojan.Agent.Ecav"
            },
            {
                "Yandex": "Trojan.Injector!2g86pc3lqvA"
            },
            {
                "SentinelOne": "DFI - Malicious PE"
            },
            {
                "eGambit": "Generic.Malware"
            },
            {
                "Fortinet": "MSIL/GenKryptik.VIH!tr"
            },
            {
                "AVG": "Win32:Malware-gen"
            },
            {
                "Cybereason": "malicious.15b5e3"
            },
            {
                "Panda": "Trj/GdSda.A"
            },
            {
                "CrowdStrike": "win/malicious_confidence_100% (W)"
            },
            {
                "Qihoo-360": "Win32/Trojan.6af"
            }
        ]
    },
    {
        "Description": "Creates a copy of itself",
        "Details": [
            {
                "copy": "C:\\Program Files (x86)\\Client\\client.exe"
            },
            {
                "copy": "C:\\Windows\\System32\\clientmonitor.exe"
            }
        ]
    }
]

[*] Started Service: []

[*] Executed Commands: [
    "\"C:\\Users\\user\\AppData\\Local\\Temp\\Exes_8b6d34e15b5e3ca155a361c5e425d2a3.exe\"",
    "schtasks /create /tn \"Client Monitor\" /tr \"'C:\\Program Files (x86)\\Client\\client.exe' /startup\" /sc MINUTE /f /rl highest",
    "REG ADD \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" /v \"Client Monitor\" /d \"cmd /c \"\"\"start \"\"\"Client Monitor\"\"\" \"\"\"C:\\Program Files (x86)\\Client\\client.exe\"\"\"\" /f /reg:64",
    "\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE wmiadap.exe /F /T /R",
    "taskeng.exe {A26A4551-CE27-4734-B3B5-4A6AC6CCFA5D} S-1-5-18:NT AUTHORITY\\System:Service:",
    "taskeng.exe {7D634482-E765-4A78-A521-5F1A16E7266C} S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:[1]",
    "taskeng.exe {279AB446-CEDA-418D-8012-17782CB44D54} S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:[1]",
    "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding",
    "\"C:\\Program Files\\Common Files\\Microsoft Shared\\Office15\\OLicenseHeartbeat.exe\"",
    "\"C:\\Program Files (x86)\\Client\\client.exe\" /startup",
    "\"C:\\Program Files (x86)\\Client\\client.exe\""
]

[*] Mutexes: [
    "Global\\CLR_CASOFF_MUTEX",
    "\\xd0\\xb9\\xd0\\x9b\\xd1\\x8f\\xd1\\x8d\\xd0\\xae\\xd0\\xac\\xd0\\x98",
    "Global\\ user1f769cd394f2c2dfe9902eb6447d138b55c39a59",
    "Global\\.net clr networking",
    "1f769cd394f2c2dfe9902eb6447d138b55c39a59",
    "Global\\ADAP_WMI_ENTRY",
    "Global\\RefreshRA_Mutex",
    "Global\\RefreshRA_Mutex_Lib",
    "Global\\RefreshRA_Mutex_Flag",
    "FireFX2800",
    "FireFX2128",
    "FireFX1684"
]

[*] Modified Files: [
    "C:\\Program Files (x86)\\Client\\client.exe",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Guard\\1",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\7.52 AM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\8260",
    "C:\\Users\\user\\AppData\\Local\\Temp\\7837",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\8.21 AM",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab278E.tmp",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\DA3B6E45325D5FFF28CF6BAD6065C907_FBEAFB4EE7383EC8E0A3A2C1EC7FCEAC",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\DA3B6E45325D5FFF28CF6BAD6065C907_FBEAFB4EE7383EC8E0A3A2C1EC7FCEAC",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar278F.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\8.33 AM",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\782AC1F7D5B160B0F71F6F92B0912799",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6E47DC54834F661FE77B461D2DF73D9D",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\782AC1F7D5B160B0F71F6F92B0912799",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6E47DC54834F661FE77B461D2DF73D9D",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EA618097E393409AFA316F0F87E2C202_1958C8FC5F0E0F8549703D0A9B9309B5",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EA618097E393409AFA316F0F87E2C202_1958C8FC5F0E0F8549703D0A9B9309B5",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\ECF3006D44DA211141391220EE5049F4",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\ECF3006D44DA211141391220EE5049F4",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\8.45 AM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3897.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3898.tmp",
    "C:\\Windows\\System32\\clientmonitor.exe",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\9.12 AM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4079.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar407A.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\9.22 AM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4A6E.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4A6F.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\9.32 AM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5230.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5231.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\9.42 AM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5CF0.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5CF1.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\9.53 AM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab64C2.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar64C3.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\10.19 AM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6CB3.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6CB4.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\10.30 AM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7485.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7486.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\10.41 AM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7C48.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7C58.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\10.52 AM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab841A.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar841B.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\11.03 AM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab8BFB.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar8BFC.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\11.29 AM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab93CD.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar93CE.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\11.40 AM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9BBF.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9BC0.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\11.50 AM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabA3C0.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarA3D0.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\12.01 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabAB82.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarAB83.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\12.12 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabB354.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarB355.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\12.37 PM",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\12.47 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabBEFE.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarBEFF.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\12.58 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabC6D0.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarC6D1.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\1.09 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabCEB2.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarCEB3.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\1.21 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabD636.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarD637.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabD9F1.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarDA02.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\1.47 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabEF8E.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarEF8F.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\2.04 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabF7BE.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarF7CF.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\2.29 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2652",
    "C:\\Users\\user\\AppData\\Local\\Temp\\5309",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4EF.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4F0.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\2.43 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab18C7.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar18C8.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\2.54 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2C61.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2C62.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\3.21 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4912.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\3.33 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4913.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\4.03 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab56FF.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5700.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6970.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6971.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\4.19 PM",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\4.31 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7410.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7411.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab79DF.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar79E0.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7B19.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\4.59 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7B1A.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab808A.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar808B.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\5.12 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab976F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9770.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\5.24 PM",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\5.45 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabAA2E.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarAA2F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabBC12.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarBC13.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\6.05 PM",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\6.09 PM",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\6.27 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabD394.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarD395.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\6.53 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3BE.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3CF.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\7.03 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1CB7.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1CC7.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\7.36 PM",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\7.54 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab40AC.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar40AD.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab48CC.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar490B.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\8.14 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab659D.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar659E.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\8.26 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7186.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7187.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\8.49 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab837A.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar837B.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\9.00 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9FCE.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9FCF.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\9.26 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabACFF.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarAD00.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\9.39 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabC413.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarC414.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\10.12 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabCE65.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarCE66.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabE5B8.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\10.25 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarE5B9.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabF134.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarF135.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\10.51 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabD49.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarD4A.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\11.07 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab21EC.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\11.32 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar21ED.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\11.46 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab36FD.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar36FE.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-28-2019\\11.59 PM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4538.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-29-2019\\12.18 AM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4539.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-29-2019\\12.36 AM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5C9A.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5CBA.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-29-2019\\1.00 AM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6CD8.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6CD9.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab72F5.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Monitor\\Screenshots\\06-29-2019\\1.13 AM",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar72F6.tmp",
    "C:\\Windows\\sysnative\\Tasks\\Client Monitor",
    "C:\\Windows\\appcompat\\Programs\\RecentFileCache.bcf",
    "\\Device\\LanmanDatagramReceiver",
    "\\??\\PIPE\\srvsvc",
    "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
    "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk",
    "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MP Scheduled Scan",
    "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h",
    "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
    "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.ini",
    "\\??\\PIPE\\samr",
    "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
    "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
    "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
    "\\??\\WMIDataDevice"
]

[*] Deleted Files: [
    "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1880.30179531",
    "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1880.30179531",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1880.30179546",
    "C:\\Program Files (x86)\\Client\\client.exe:Zone.Identifier",
    "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab278E.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar278F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3897.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3898.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4079.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar407A.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4A6E.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4A6F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5230.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5231.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5CF0.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5CF1.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab64C2.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar64C3.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6CB3.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6CB4.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7485.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7486.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7C48.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7C58.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab841A.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar841B.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab8BFB.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar8BFC.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab93CD.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar93CE.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9BBF.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9BC0.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabA3C0.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarA3D0.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabAB82.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarAB83.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabB354.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarB355.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabBEFE.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarBEFF.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabC6D0.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarC6D1.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabCEB2.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarCEB3.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabD636.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarD637.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabD9F1.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarDA02.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabEF8E.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarEF8F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabF7BE.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarF7CF.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4EF.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4F0.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab18C7.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar18C8.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2C61.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2C62.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4912.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4913.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab56FF.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5700.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6970.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6971.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7410.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7411.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab79DF.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar79E0.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7B19.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7B1A.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab808A.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar808B.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab976F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9770.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabAA2E.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarAA2F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabBC12.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarBC13.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabD394.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarD395.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3BE.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3CF.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1CB7.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1CC7.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab40AC.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar40AD.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab48CC.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar490B.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab659D.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar659E.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7186.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7187.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab837A.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar837B.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9FCE.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9FCF.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabACFF.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarAD00.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabC413.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarC414.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabCE65.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarCE66.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabE5B8.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarE5B9.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabF134.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarF135.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabD49.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarD4A.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab21EC.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar21ED.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab36FD.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar36FE.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4538.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4539.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5C9A.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5CBA.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6CD8.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6CD9.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab72F5.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar72F6.tmp",
    "C:\\Windows\\Tasks\\Client Monitor.job",
    "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MpIdleTask",
    "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log",
    "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MP Scheduled Scan",
    "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
    "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h",
    "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2152.30450000",
    "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2152.30450000",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2152.30450015"
]

[*] Modified Registry Keys: [
    "HKEY_CURRENT_USER\\Software\\QqYXE61FQEZBQos7Y7HgAw==",
    "HKEY_CURRENT_USER\\Software\\aPCuZjSsI3pDIkDuoy5Llg==",
    "HKEY_CURRENT_USER\\Software\\PTH",
    "HKEY_CURRENT_USER\\Software\\MTX",
    "HKEY_CURRENT_USER\\Software\\PRC",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\shell",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Client Monitor\\Index",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{E8E03AA9-EB19-4AB1-8D4A-4369FFC664E6}\\Hash",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{E8E03AA9-EB19-4AB1-8D4A-4369FFC664E6}\\Triggers",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\PreviousServiceShutdown",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{D23BBC0A-1A78-4A02-AD90-C10384FEC795}\\Path",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{D23BBC0A-1A78-4A02-AD90-C10384FEC795}\\Hash",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Id",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Index",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{D23BBC0A-1A78-4A02-AD90-C10384FEC795}\\Triggers",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{D23BBC0A-1A78-4A02-AD90-C10384FEC795}\\DynamicInfo",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{ED0D73D7-BC97-46E2-AC55-FD6EB3F72C05}\\DynamicInfo",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{A26A4551-CE27-4734-B3B5-4A6AC6CCFA5D}",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{E8E03AA9-EB19-4AB1-8D4A-4369FFC664E6}\\DynamicInfo",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{7D634482-E765-4A78-A521-5F1A16E7266C}",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{279AB446-CEDA-418D-8012-17782CB44D54}",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Client Monitor",
    "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\IDE\\DiskVBOX_HARDDISK___________________________1.0_____\\5&33d1638a&0&0.0.0_0-{00000000-0000-0000-0000-000000000000}",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\advapi32.dll[MofResourceName]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\en-US\\advapi32.dll.mui[MofResourceName]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ACPI.sys[ACPIMOFResource]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ACPI.sys.mui[ACPIMOFResource]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ndis.sys[MofResourceName]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ndis.sys.mui[MofResourceName]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\mssmbios.sys[MofResource]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\mssmbios.sys.mui[MofResource]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\HDAudBus.sys[HDAudioMofName]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\HDAudBus.sys.mui[HDAudioMofName]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\intelppm.sys[PROCESSORWMI]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\intelppm.sys.mui[PROCESSORWMI]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\portcls.SYS[PortclsMof]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\en-US\\portcls.SYS.mui[PortclsMof]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sys[MonitorWMI]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{A26A4551-CE27-4734-B3B5-4A6AC6CCFA5D}\\data",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{7D634482-E765-4A78-A521-5F1A16E7266C}\\data",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{279AB446-CEDA-418D-8012-17782CB44D54}\\data"
]

[*] Deleted Registry Keys: [
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\SunJavaUpdateSched",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Client Monitor.job",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Client Monitor.job.fp",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sys[MonitorWMI]"
]

[*] DNS Communications: [
    {
        "type": "A",
        "request": "akika321.ddns.net",
        "answers": [
            {
                "data": "0.0.0.0",
                "type": "A"
            }
        ]
    },
    {
        "type": "A",
        "request": "crl3.digicert.com",
        "answers": [
            {
                "data": "cs9.wac.phicdn.net",
                "type": "CNAME"
            },
            {
                "data": "72.21.91.29",
                "type": "A"
            }
        ]
    },
    {
        "type": "A",
        "request": "crl4.digicert.com",
        "answers": [
            {
                "data": "cs9.wac.phicdn.net",
                "type": "CNAME"
            },
            {
                "data": "72.21.91.29",
                "type": "A"
            }
        ]
    },
    {
        "type": "A",
        "request": "s2.symcb.com",
        "answers": [
            {
                "data": "23.4.43.27",
                "type": "A"
            },
            {
                "data": "ocsp-ds.ws.symantec.com.edgekey.net",
                "type": "CNAME"
            },
            {
                "data": "e8218.dscb1.akamaiedge.net",
                "type": "CNAME"
            }
        ]
    },
    {
        "type": "A",
        "request": "sv.symcd.com",
        "answers": [
            {
                "data": "23.4.43.27",
                "type": "A"
            },
            {
                "data": "ocsp-ds.ws.symantec.com.edgekey.net",
                "type": "CNAME"
            },
            {
                "data": "e8218.dscb1.akamaiedge.net",
                "type": "CNAME"
            }
        ]
    },
    {
        "type": "A",
        "request": "sv.symcb.com",
        "answers": [
            {
                "data": "crl-symcprod.digicert.com",
                "type": "CNAME"
            },
            {
                "data": "cs9.wac.phicdn.net",
                "type": "CNAME"
            },
            {
                "data": "72.21.91.29",
                "type": "A"
            }
        ]
    }
]

[*] Domains: [
    {
        "ip": "72.21.91.29",
        "domain": "crl3.digicert.com"
    },
    {
        "ip": "23.4.43.27",
        "domain": "sv.symcd.com"
    },
    {
        "ip": "72.21.91.29",
        "domain": "crl4.digicert.com"
    },
    {
        "ip": "0.0.0.0",
        "domain": "akika321.ddns.net"
    },
    {
        "ip": "72.21.91.29",
        "domain": "sv.symcb.com"
    },
    {
        "ip": "23.4.43.27",
        "domain": "s2.symcb.com"
    }
]

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: [
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 150849\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 10:50:30 GMT\r\nIf-None-Match: \"5ced1276-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 168744\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 15:00:08 GMT\r\nIf-None-Match: \"5ced4cf8-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "crl4.digicert.com",
        "version": "1.1",
        "path": "/EVCodeSigningSHA2-g1.crl",
        "data": "GET /EVCodeSigningSHA2-g1.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl4.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "crl3.digicert.com",
        "version": "1.1",
        "path": "/EVCodeSigningSHA2-g1.crl",
        "data": "GET /EVCodeSigningSHA2-g1.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl3.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "s2.symcb.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: s2.symcb.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://sv.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEFl%2BTkXLwRW7pkAmAuicv0U%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "sv.symcd.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEFl%2BTkXLwRW7pkAmAuicv0U%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEFl%2BTkXLwRW7pkAmAuicv0U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: sv.symcd.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://sv.symcb.com/sv.crl",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "sv.symcb.com",
        "version": "1.1",
        "path": "/sv.crl",
        "data": "GET /sv.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: sv.symcb.com\r\n\r\n",
        "port": 80
    }
]

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {
    "dotnet": {
        "customattrs": null,
        "assemblyinfo": {
            "version": "1.0.0.0",
            "name": "Documents0"
        },
        "assemblyrefs": [
            {
                "version": "2.0.0.0",
                "name": "mscorlib"
            },
            {
                "version": "8.0.0.0",
                "name": "Microsoft.VisualBasic"
            },
            {
                "version": "2.0.0.0",
                "name": "System"
            },
            {
                "version": "2.0.0.0",
                "name": "System.Drawing"
            }
        ],
        "typerefs": [
            {
                "typename": "Microsoft.VisualBasic.ApplicationServices.ApplicationBase",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.ApplicationServices.User",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.Conversions",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.NewLateBinding",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.Operators",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.ProjectData",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.StandardModuleAttribute",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.Devices.Computer",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.HideModuleNameAttribute",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.MyGroupCollectionAttribute",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.VBMath",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.Design.HelpKeywordAttribute",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.EditorBrowsableAttribute",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.EditorBrowsableState",
                "assembly": "System"
            },
            {
                "typename": "System.Drawing.Bitmap",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Color",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Graphics",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Image",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Activator",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Array",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Boolean",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Byte",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Collections.Generic.List`1",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.DebuggerHiddenAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Enum",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Exception",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.FlagsAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Int32",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Math",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Object",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.Assembly",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyCompanyAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyCopyrightAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyDescriptionAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyFileVersionAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyProductAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyTitleAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyTrademarkAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.MethodInfo",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Resources.ResourceManager",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.LayoutKind",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.StructLayoutAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.RuntimeTypeHandle",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.STAThreadAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.CipherMode",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.HashAlgorithm",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.ICryptoTransform",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.MD5CryptoServiceProvider",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.RC2CryptoServiceProvider",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.SymmetricAlgorithm",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.String",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Text.Encoding",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Text.StringBuilder",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ThreadStaticAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Type",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ValueType",
                "assembly": "mscorlib"
            }
        ]
    },
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "_CorExeMain",
                        "address": "0x402000"
                    }
                ],
                "dll": "mscoree.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x000fe7ad",
        "overlay": null,
        "imagebase": "0x00400000",
        "reported_checksum": "0x00000000",
        "icon_hash": null,
        "entrypoint": "0x004f8a8e",
        "timestamp": "2017-02-24 22:18:03",
        "osversion": "4.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00002000",
                "size_of_data": "0x000f7000",
                "entropy": "7.75",
                "raw_address": "0x00001000",
                "virtual_size": "0x000f6a94",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x000fa000",
                "size_of_data": "0x00001000",
                "entropy": "0.70",
                "raw_address": "0x000f8000",
                "virtual_size": "0x000002b0",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".reloc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x000fc000",
                "size_of_data": "0x00001000",
                "entropy": "0.02",
                "raw_address": "0x000f9000",
                "virtual_size": "0x0000000c",
                "characteristics_raw": "0x42000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x000f8a34",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x00000057"
            },
            {
                "virtual_address": "0x000fa000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x000002b0"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x000fc000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x0000000c"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00002000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000008"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00002008",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000048"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 1,
        "versioninfo": []
    }
}

[*] Resolved APIs: [
    "advapi32.dll.RegOpenKeyExW",
    "advapi32.dll.RegQueryInfoKeyW",
    "advapi32.dll.RegEnumKeyExW",
    "advapi32.dll.RegEnumValueW",
    "advapi32.dll.RegCloseKey",
    "advapi32.dll.RegQueryValueExW",
    "kernel32.dll.QueryActCtxW",
    "shlwapi.dll.UrlIsW",
    "kernel32.dll.FlsAlloc",
    "kernel32.dll.FlsGetValue",
    "kernel32.dll.FlsSetValue",
    "kernel32.dll.FlsFree",
    "kernel32.dll.InitializeCriticalSectionAndSpinCount",
    "kernel32.dll.IsProcessorFeaturePresent",
    "msvcrt.dll._set_error_mode",
    "msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z",
    "kernel32.dll.FindActCtxSectionStringW",
    "kernel32.dll.GetSystemWindowsDirectoryW",
    "mscoree.dll.GetProcessExecutableHeap",
    "mscorwks.dll._CorExeMain",
    "mscorwks.dll.GetCLRFunction",
    "advapi32.dll.RegisterTraceGuidsW",
    "advapi32.dll.UnregisterTraceGuids",
    "advapi32.dll.GetTraceLoggerHandle",
    "advapi32.dll.GetTraceEnableLevel",
    "advapi32.dll.GetTraceEnableFlags",
    "advapi32.dll.TraceEvent",
    "mscoree.dll.IEE",
    "mscorwks.dll.IEE",
    "mscoree.dll.GetStartupFlags",
    "mscoree.dll.GetHostConfigurationFile",
    "mscoree.dll.GetCORSystemDirectory",
    "ntdll.dll.RtlUnwind",
    "kernel32.dll.IsWow64Process",
    "advapi32.dll.AllocateAndInitializeSid",
    "advapi32.dll.OpenProcessToken",
    "advapi32.dll.GetTokenInformation",
    "advapi32.dll.InitializeAcl",
    "advapi32.dll.AddAccessAllowedAce",
    "advapi32.dll.FreeSid",
    "kernel32.dll.SetThreadStackGuarantee",
    "kernel32.dll.AddVectoredContinueHandler",
    "kernel32.dll.RemoveVectoredContinueHandler",
    "advapi32.dll.ConvertSidToStringSidW",
    "shell32.dll.SHGetFolderPathW",
    "kernel32.dll.FlushProcessWriteBuffers",
    "kernel32.dll.GetWriteWatch",
    "kernel32.dll.ResetWriteWatch",
    "kernel32.dll.CreateMemoryResourceNotification",
    "kernel32.dll.QueryMemoryResourceNotification",
    "ole32.dll.CoInitializeEx",
    "cryptbase.dll.SystemFunction036",
    "uxtheme.dll.ThemeInitApiHook",
    "user32.dll.IsProcessDPIAware",
    "ole32.dll.CoGetContextToken",
    "kernel32.dll.GetVersionExW",
    "kernel32.dll.GetFullPathNameW",
    "advapi32.dll.CryptAcquireContextA",
    "advapi32.dll.CryptReleaseContext",
    "advapi32.dll.CryptCreateHash",
    "advapi32.dll.CryptDestroyHash",
    "advapi32.dll.CryptHashData",
    "advapi32.dll.CryptGetHashParam",
    "advapi32.dll.CryptImportKey",
    "advapi32.dll.CryptExportKey",
    "advapi32.dll.CryptGenKey",
    "advapi32.dll.CryptGetKeyParam",
    "advapi32.dll.CryptDestroyKey",
    "advapi32.dll.CryptVerifySignatureA",
    "advapi32.dll.CryptSignHashA",
    "advapi32.dll.CryptGetProvParam",
    "advapi32.dll.CryptGetUserKey",
    "advapi32.dll.CryptEnumProvidersA",
    "mscoree.dll.GetMetaDataInternalInterface",
    "mscorwks.dll.GetMetaDataInternalInterface",
    "mscorjit.dll.getJit",
    "kernel32.dll.GetUserDefaultUILanguage",
    "kernel32.dll.SetErrorMode",
    "kernel32.dll.GetFileAttributesExW",
    "culture.dll.ConvertLangIdToCultureName",
    "kernel32.dll.lstrlen",
    "kernel32.dll.lstrlenW",
    "mscoree.dll.ND_RI4",
    "kernel32.dll.GlobalMemoryStatusEx",
    "bcrypt.dll.BCryptGetFipsAlgorithmMode",
    "cryptsp.dll.CryptAcquireContextW",
    "cryptsp.dll.CryptGetProvParam",
    "cryptsp.dll.CryptCreateHash",
    "cryptsp.dll.CryptHashData",
    "cryptsp.dll.CryptGetHashParam",
    "cryptsp.dll.CryptDestroyHash",
    "cryptsp.dll.CryptGenRandom",
    "cryptsp.dll.CryptImportKey",
    "cryptsp.dll.CryptSetKeyParam",
    "cryptsp.dll.CryptDecrypt",
    "cryptsp.dll.CryptEncrypt",
    "cryptsp.dll.CryptDestroyKey",
    "cryptsp.dll.CryptReleaseContext",
    "kernel32.dll.OpenMutexW",
    "kernel32.dll.CloseHandle",
    "kernel32.dll.ReleaseMutex",
    "kernel32.dll.CreateMutexW",
    "kernel32.dll.GetModuleHandleW",
    "kernel32.dll.GetTempPathW",
    "kernel32.dll.FindFirstFileW",
    "kernel32.dll.FindClose",
    "kernel32.dll.FindNextFileW",
    "kernel32.dll.GetCurrentProcessId",
    "advapi32.dll.LookupPrivilegeValueW",
    "kernel32.dll.GetCurrentProcess",
    "advapi32.dll.AdjustTokenPrivileges",
    "kernel32.dll.OpenProcess",
    "psapi.dll.EnumProcessModules",
    "psapi.dll.GetModuleInformation",
    "psapi.dll.GetModuleBaseNameW",
    "psapi.dll.GetModuleFileNameExW",
    "kernel32.dll.LoadLibraryA",
    "kernel32.dll.GetProcAddress",
    "kernel32.dll.CreateProcessA",
    "kernel32.dll.ReadProcessMemory",
    "kernel32.dll.WriteProcessMemory",
    "kernel32.dll.GetThreadContext",
    "ntdll.dll.NtSetContextThread",
    "ntdll.dll.NtUnmapViewOfSection",
    "kernel32.dll.VirtualAllocEx",
    "ntdll.dll.NtResumeThread",
    "ole32.dll.CoWaitForMultipleHandles",
    "sechost.dll.LookupAccountNameLocalW",
    "advapi32.dll.LookupAccountSidW",
    "sechost.dll.LookupAccountSidLocalW",
    "ole32.dll.NdrOleInitializeExtension",
    "ole32.dll.CoGetClassObject",
    "ole32.dll.CoGetMarshalSizeMax",
    "ole32.dll.CoMarshalInterface",
    "ole32.dll.CoUnmarshalInterface",
    "ole32.dll.StringFromIID",
    "ole32.dll.CoGetPSClsid",
    "ole32.dll.CoTaskMemAlloc",
    "ole32.dll.CoTaskMemFree",
    "ole32.dll.CoCreateInstance",
    "ole32.dll.CoReleaseMarshalData",
    "ole32.dll.DcomChannelSetHResult",
    "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
    "kernel32.dll.CreateActCtxW",
    "kernel32.dll.AddRefActCtx",
    "kernel32.dll.ReleaseActCtx",
    "kernel32.dll.ActivateActCtx",
    "kernel32.dll.DeactivateActCtx",
    "kernel32.dll.GetCurrentActCtx",
    "shfolder.dll.SHGetFolderPathW",
    "advapi32.dll.RegSetValueExW",
    "kernel32.dll.LocalFree",
    "kernel32.dll.LocalAlloc",
    "advapi32.dll.DuplicateTokenEx",
    "advapi32.dll.CheckTokenMembership",
    "kernel32.dll.CreateDirectoryW",
    "advapi32.dll.SetNamedSecurityInfoW",
    "ntmarta.dll.GetMartaExtensionInterface",
    "kernel32.dll.CopyFileW",
    "kernel32.dll.DeleteFileW",
    "advapi32.dll.GetUserNameW",
    "kernel32.dll.SwitchToThread",
    "kernel32.dll.GetEnvironmentVariableW",
    "advapi32.dll.LsaClose",
    "advapi32.dll.LsaFreeMemory",
    "kernel32.dll.GetACP",
    "ole32.dll.CoUninitialize",
    "advapi32.dll.LsaOpenPolicy",
    "user32.dll.SetWindowsHookExW",
    "advapi32.dll.LsaLookupNames2",
    "kernel32.dll.UnmapViewOfFile",
    "mscoree.dll.ND_RU1",
    "user32.dll.GetSystemMetrics",
    "user32.dll.GetLastInputInfo",
    "kernel32.dll.CreateFileW",
    "kernel32.dll.CreateIoCompletionPort",
    "kernel32.dll.PostQueuedCompletionStatus",
    "ntdll.dll.NtQueryInformationThread",
    "ntdll.dll.NtQuerySystemInformation",
    "ntdll.dll.NtGetCurrentProcessorNumber",
    "kernel32.dll.GetFileType",
    "kernel32.dll.GetFileSize",
    "kernel32.dll.ReadFile",
    "kernel32.dll.GetStartupInfoW",
    "kernel32.dll.CreateProcessW",
    "advapi32.dll.GetKernelObjectSecurity",
    "advapi32.dll.CreateWellKnownSid",
    "advapi32.dll.SetKernelObjectSecurity",
    "mscoree.dll.ND_RI2",
    "ws2_32.dll.WSAStartup",
    "kernel32.dll.ReadDirectoryChangesW",
    "ws2_32.dll.WSASocketW",
    "ws2_32.dll.setsockopt",
    "ws2_32.dll.WSAEventSelect",
    "ws2_32.dll.ioctlsocket",
    "ws2_32.dll.closesocket",
    "kernel32.dll.GetComputerNameW",
    "advapi32.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
    "user32.dll.WaitForInputIdle",
    "kernel32.dll.CreateFileMappingW",
    "kernel32.dll.MapViewOfFile",
    "kernel32.dll.VirtualQuery",
    "kernel32.dll.SetThreadExecutionState",
    "kernel32.dll.WaitForSingleObject",
    "kernel32.dll.GetProcessTimes",
    "user32.dll.SendMessageW",
    "ws2_32.dll.getaddrinfo",
    "ws2_32.dll.freeaddrinfo",
    "kernel32.dll.CreateEventW",
    "kernel32.dll.GetSystemTimeAsFileTime",
    "user32.dll.GetDC",
    "user32.dll.EnumDisplayMonitors",
    "user32.dll.GetMonitorInfoW",
    "gdi32.dll.GetDeviceCaps",
    "user32.dll.ReleaseDC",
    "user32.dll.GetProcessWindowStation",
    "user32.dll.GetUserObjectInformationA",
    "kernel32.dll.SetConsoleCtrlHandler",
    "user32.dll.GetClassInfoW",
    "user32.dll.RegisterClassW",
    "user32.dll.CreateWindowExW",
    "user32.dll.DefWindowProcW",
    "kernel32.dll.SetEvent",
    "user32.dll.MsgWaitForMultipleObjectsEx",
    "kernel32.dll.FindAtomW",
    "kernel32.dll.AddAtomW",
    "mscoree.dll.LoadLibraryShim",
    "gdiplus.dll.GdiplusStartup",
    "user32.dll.GetWindowInfo",
    "user32.dll.GetAncestor",
    "user32.dll.GetMonitorInfoA",
    "user32.dll.EnumDisplayDevicesA",
    "gdi32.dll.ExtTextOutW",
    "gdi32.dll.GdiIsMetaPrintDC",
    "gdiplus.dll.GdipCreateBitmapFromScan0",
    "gdiplus.dll.GdipGetImagePixelFormat",
    "gdiplus.dll.GdipGetImageGraphicsContext",
    "kernel32.dll.FormatMessageW",
    "gdi32.dll.GetCurrentObject",
    "gdiplus.dll.GdipGetDC",
    "gdi32.dll.BitBlt",
    "gdiplus.dll.GdipReleaseDC",
    "mscoree.dll.ND_WI4",
    "gdiplus.dll.GdipGetImageEncodersSize",
    "gdiplus.dll.GdipGetImageEncoders",
    "kernel32.dll.RtlMoveMemory",
    "gdiplus.dll.GdipSaveImageToStream",
    "windowscodecs.dll.DllGetClassObject",
    "kernel32.dll.WerRegisterMemoryBlock",
    "oleaut32.dll.#8",
    "oleaut32.dll.#9",
    "oleaut32.dll.#10",
    "kernel32.dll.WriteFile",
    "psapi.dll.EnumProcesses",
    "kernel32.dll.GetModuleHandleA",
    "kernel32.dll.CreateActCtxA",
    "kernel32.dll.GetProcessId",
    "kernel32.dll.VirtualFree",
    "kernel32.dll.VirtualAlloc",
    "kernel32.dll.Sleep",
    "kernel32.dll.GetLastError",
    "kernel32.dll.CreateMutexA",
    "kernel32.dll.CreateThread",
    "kernel32.dll.HeapReAlloc",
    "kernel32.dll.SetThreadContext",
    "kernel32.dll.HeapAlloc",
    "kernel32.dll.HeapFree",
    "kernel32.dll.Thread32First",
    "kernel32.dll.HeapCreate",
    "kernel32.dll.Thread32Next",
    "kernel32.dll.FlushInstructionCache",
    "kernel32.dll.OpenThread",
    "kernel32.dll.VirtualProtect",
    "kernel32.dll.CreateToolhelp32Snapshot",
    "kernel32.dll.GetCurrentThreadId",
    "kernel32.dll.SuspendThread",
    "kernel32.dll.ResumeThread",
    "kernel32.dll.GetCommandLineA",
    "kernel32.dll.IsDebuggerPresent",
    "kernel32.dll.WideCharToMultiByte",
    "kernel32.dll.SetLastError",
    "kernel32.dll.ExitProcess",
    "kernel32.dll.GetModuleHandleExW",
    "kernel32.dll.MultiByteToWideChar",
    "kernel32.dll.GetProcessHeap",
    "kernel32.dll.GetStdHandle",
    "kernel32.dll.DeleteCriticalSection",
    "kernel32.dll.GetModuleFileNameA",
    "kernel32.dll.QueryPerformanceCounter",
    "kernel32.dll.GetEnvironmentStringsW",
    "kernel32.dll.FreeEnvironmentStringsW",
    "kernel32.dll.UnhandledExceptionFilter",
    "kernel32.dll.SetUnhandledExceptionFilter",
    "kernel32.dll.TerminateProcess",
    "kernel32.dll.TlsAlloc",
    "kernel32.dll.TlsGetValue",
    "kernel32.dll.TlsSetValue",
    "kernel32.dll.TlsFree",
    "kernel32.dll.GetStringTypeW",
    "kernel32.dll.IsValidCodePage",
    "kernel32.dll.GetOEMCP",
    "kernel32.dll.GetCPInfo",
    "kernel32.dll.EnterCriticalSection",
    "kernel32.dll.LeaveCriticalSection",
    "kernel32.dll.GetModuleFileNameW",
    "kernel32.dll.LoadLibraryExW",
    "kernel32.dll.RtlUnwind",
    "kernel32.dll.LCMapStringW",
    "kernel32.dll.OutputDebugStringW",
    "kernel32.dll.HeapSize",
    "kernel32.dll.FlushFileBuffers",
    "kernel32.dll.GetConsoleCP",
    "kernel32.dll.GetConsoleMode",
    "kernel32.dll.SetStdHandle",
    "kernel32.dll.SetFilePointerEx",
    "kernel32.dll.WriteConsoleW",
    "kernel32.dll.VirtualProtectEx",
    "kernel32.dll.CreateRemoteThread",
    "user32.dll.EnumWindows",
    "user32.dll.GetWindowThreadProcessId",
    "user32.dll.FindWindowW",
    "user32.dll.IsWindowVisible",
    "kernel32.dll.MoveFileExA",
    "kernel32.dll.MoveFileW",
    "gdiplus.dll.GdipDeleteGraphics",
    "gdiplus.dll.GdipDisposeImage",
    "kernel32.dll.lstrcpy",
    "kernel32.dll.lstrcpyW",
    "wintrust.dll.WinVerifyTrust",
    "imagehlp.dll.ImageEnumerateCertificates",
    "wintrust.dll.WintrustCertificateTrust",
    "wintrust.dll.SoftpubAuthenticode",
    "wintrust.dll.SoftpubInitialize",
    "wintrust.dll.SoftpubLoadMessage",
    "wintrust.dll.SoftpubLoadSignature",
    "wintrust.dll.SoftpubCheckCert",
    "wintrust.dll.SoftpubCleanup",
    "cryptsp.dll.CryptAcquireContextA",
    "wintrust.dll.CryptSIPPutSignedDataMsg",
    "wintrust.dll.CryptSIPGetSignedDataMsg",
    "imagehlp.dll.ImageGetCertificateData",
    "user32.dll.LoadStringW",
    "ncrypt.dll.BCryptOpenAlgorithmProvider",
    "bcryptprimitives.dll.GetHashInterface",
    "ncrypt.dll.BCryptGetProperty",
    "ncrypt.dll.BCryptCreateHash",
    "ncrypt.dll.BCryptHashData",
    "wintrust.dll.CryptSIPVerifyIndirectData",
    "bcrypt.dll.BCryptOpenAlgorithmProvider",
    "bcrypt.dll.BCryptGetProperty",
    "bcrypt.dll.BCryptCreateHash",
    "bcrypt.dll.BCryptHashData",
    "bcrypt.dll.BCryptFinishHash",
    "bcrypt.dll.BCryptDestroyHash",
    "bcrypt.dll.BCryptCloseAlgorithmProvider",
    "ncrypt.dll.BCryptDestroyHash",
    "crypt32.dll.CryptVerifyTimeStampSignature",
    "ncrypt.dll.BCryptFinishHash",
    "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
    "ncrypt.dll.BCryptImportKeyPair",
    "ncrypt.dll.BCryptVerifySignature",
    "ncrypt.dll.BCryptDestroyKey",
    "userenv.dll.GetUserProfileDirectoryW",
    "sechost.dll.ConvertSidToStringSidW",
    "sechost.dll.ConvertStringSidToSidW",
    "userenv.dll.RegisterGPNotification",
    "gpapi.dll.RegisterGPNotificationInternal",
    "sechost.dll.OpenSCManagerW",
    "sechost.dll.OpenServiceW",
    "sechost.dll.CloseServiceHandle",
    "sechost.dll.QueryServiceConfigW",
    "cryptsp.dll.CryptVerifySignatureA",
    "cryptnet.dll.CertDllVerifyRevocation",
    "profapi.dll.#104",
    "sensapi.dll.IsNetworkAlive",
    "rpcrt4.dll.RpcBindingFromStringBindingW",
    "rpcrt4.dll.RpcBindingSetAuthInfoExW",
    "rpcrt4.dll.NdrClientCall2",
    "winhttp.dll.WinHttpOpen",
    "winhttp.dll.WinHttpSetTimeouts",
    "winhttp.dll.WinHttpSetOption",
    "winhttp.dll.WinHttpCrackUrl",
    "shlwapi.dll.StrCmpNW",
    "winhttp.dll.WinHttpConnect",
    "winhttp.dll.WinHttpOpenRequest",
    "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
    "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
    "winhttp.dll.WinHttpTimeFromSystemTime",
    "winhttp.dll.WinHttpSendRequest",
    "ws2_32.dll.GetAddrInfoW",
    "ws2_32.dll.#2",
    "ws2_32.dll.#21",
    "ws2_32.dll.#9",
    "ws2_32.dll.WSAIoctl",
    "ws2_32.dll.FreeAddrInfoW",
    "oleaut32.dll.#500",
    "ws2_32.dll.#6",
    "ws2_32.dll.#5",
    "ws2_32.dll.WSARecv",
    "ws2_32.dll.WSASend",
    "winhttp.dll.WinHttpReceiveResponse",
    "winhttp.dll.WinHttpQueryHeaders",
    "shlwapi.dll.StrStrIW",
    "winhttp.dll.WinHttpQueryDataAvailable",
    "winhttp.dll.WinHttpReadData",
    "winhttp.dll.WinHttpCloseHandle",
    "rpcrt4.dll.RpcBindingFree",
    "cryptnet.dll.I_CryptNetGetConnectivity",
    "cryptnet.dll.CryptRetrieveObjectByUrlW",
    "setupapi.dll.SetupIterateCabinetW",
    "kernel32.dll.RegOpenKeyExW",
    "kernel32.dll.RegCloseKey",
    "cabinet.dll.#20",
    "cabinet.dll.#22",
    "devrtl.dll.DevRtlGetThreadLogToken",
    "cabinet.dll.#23",
    "cryptsp.dll.CryptSetHashParam",
    "sechost.dll.QueryServiceConfigA",
    "sechost.dll.QueryServiceStatus",
    "rpcrt4.dll.RpcStringBindingComposeA",
    "rpcrt4.dll.RpcBindingFromStringBindingA",
    "rpcrt4.dll.RpcEpResolveBinding",
    "rpcrt4.dll.RpcStringFreeA",
    "advapi32.dll.SaferiSearchMatchingHashRules",
    "advapi32.dll.RegDeleteValueW",
    "kernel32.dll.SetFileAttributesW",
    "kernel32.dll.GetExitCodeThread",
    "kernel32.dll.VirtualFreeEx",
    "ws2_32.dll.#22",
    "ws2_32.dll.#3",
    "ws2_32.dll.#116",
    "version.dll.GetFileVersionInfoSizeW",
    "version.dll.GetFileVersionInfoW",
    "version.dll.VerQueryValueW",
    "kernel32.dll.SortGetHandle",
    "kernel32.dll.SortCloseHandle",
    "sspicli.dll.GetUserNameExW",
    "xmllite.dll.CreateXmlWriter",
    "xmllite.dll.CreateXmlWriterOutputWithEncodingName",
    "rasapi32.dll.RasEnumConnectionsW",
    "rasapi32.dll.RasConnectionNotificationW",
    "advapi32.dll.WmiMofEnumerateResourcesW",
    "advapi32.dll.WmiFreeBuffer",
    "advapi32.dll.WmiCloseBlock",
    "propsys.dll.PropVariantToVariant",
    "ole32.dll.CoDisconnectObject",
    "wbemcore.dll.Shutdown",
    "advapi32.dll.RegDeleteKeyExW",
    "kernel32.dll.RegDeleteValueW",
    "advapi32.dll.EventUnregister",
    "kernel32.dll.GetThreadPreferredUILanguages",
    "kernel32.dll.SetThreadPreferredUILanguages",
    "kernel32.dll.LocaleNameToLCID",
    "kernel32.dll.GetLocaleInfoEx",
    "kernel32.dll.LCIDToLocaleName",
    "kernel32.dll.GetSystemDefaultLocaleName",
    "fastprox.dll.DllGetClassObject",
    "fastprox.dll.DllCanUnloadNow",
    "oleaut32.dll.#283",
    "oleaut32.dll.#284",
    "kernel32.dll.InitializeCriticalSectionEx",
    "kernel32.dll.CreateEventExW",
    "kernel32.dll.CreateSemaphoreExW",
    "kernel32.dll.CreateThreadpoolTimer",
    "kernel32.dll.SetThreadpoolTimer",
    "kernel32.dll.WaitForThreadpoolTimerCallbacks",
    "kernel32.dll.CloseThreadpoolTimer",
    "kernel32.dll.CreateThreadpoolWait",
    "kernel32.dll.SetThreadpoolWait",
    "kernel32.dll.CloseThreadpoolWait",
    "kernel32.dll.FreeLibraryWhenCallbackReturns",
    "kernel32.dll.GetCurrentProcessorNumber",
    "kernel32.dll.GetLogicalProcessorInformation",
    "kernel32.dll.CreateSymbolicLinkW",
    "kernel32.dll.EnumSystemLocalesEx",
    "kernel32.dll.CompareStringEx",
    "kernel32.dll.GetDateFormatEx",
    "kernel32.dll.GetTimeFormatEx",
    "kernel32.dll.GetUserDefaultLocaleName",
    "kernel32.dll.IsValidLocaleName",
    "kernel32.dll.LCMapStringEx",
    "kernel32.dll.GetTickCount64",
    "rpcrt4.dll.I_RpcSNCHOption",
    "vssapi.dll.CreateWriter",
    "oleaut32.dll.#6",
    "oleaut32.dll.#2",
    "advapi32.dll.LookupAccountNameW",
    "samcli.dll.NetLocalGroupGetMembers",
    "samlib.dll.SamConnect",
    "rpcrt4.dll.NdrClientCall3",
    "rpcrt4.dll.RpcStringBindingComposeW",
    "rpcrt4.dll.RpcStringFreeW",
    "samlib.dll.SamOpenDomain",
    "samlib.dll.SamLookupNamesInDomain",
    "samlib.dll.SamOpenAlias",
    "samlib.dll.SamFreeMemory",
    "samlib.dll.SamCloseHandle",
    "samlib.dll.SamGetMembersInAlias",
    "netutils.dll.NetApiBufferFree",
    "ole32.dll.CoCreateGuid",
    "ole32.dll.StringFromCLSID",
    "oleaut32.dll.#4",
    "oleaut32.dll.#7",
    "propsys.dll.VariantToPropVariant",
    "wbemcore.dll.Reinitialize",
    "wbemsvc.dll.DllGetClassObject",
    "wbemsvc.dll.DllCanUnloadNow",
    "authz.dll.AuthzInitializeContextFromToken",
    "authz.dll.AuthzInitializeObjectAccessAuditEvent2",
    "authz.dll.AuthzAccessCheck",
    "authz.dll.AuthzFreeAuditEvent",
    "authz.dll.AuthzFreeContext",
    "authz.dll.AuthzInitializeResourceManager",
    "authz.dll.AuthzFreeResourceManager",
    "rpcrt4.dll.RpcBindingCreateW",
    "rpcrt4.dll.RpcBindingBind",
    "rpcrt4.dll.I_RpcMapWin32Status",
    "advapi32.dll.EventRegister",
    "advapi32.dll.EventWrite",
    "kernel32.dll.RegSetValueExW",
    "kernel32.dll.RegQueryValueExW",
    "wmisvc.dll.IsImproperShutdownDetected",
    "wevtapi.dll.EvtRender",
    "wevtapi.dll.EvtNext",
    "wevtapi.dll.EvtClose",
    "wevtapi.dll.EvtQuery",
    "wevtapi.dll.EvtCreateRenderContext",
    "rpcrt4.dll.RpcBindingSetOption",
    "ole32.dll.CoCreateFreeThreadedMarshaler",
    "ole32.dll.CreateStreamOnHGlobal",
    "advapi32.dll.RegCreateKeyExW",
    "kernelbase.dll.InitializeAcl",
    "kernelbase.dll.AddAce",
    "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
    "kernel32.dll.IsThreadAFiber",
    "kernel32.dll.OpenProcessToken",
    "kernelbase.dll.GetTokenInformation",
    "kernelbase.dll.DuplicateTokenEx",
    "kernelbase.dll.AdjustTokenPrivileges",
    "kernelbase.dll.AllocateAndInitializeSid",
    "kernelbase.dll.CheckTokenMembership",
    "oleaut32.dll.#285",
    "advapi32.dll.RegOpenKeyW",
    "kernel32.dll.SetThreadToken",
    "ole32.dll.CLSIDFromString",
    "oleaut32.dll.#17",
    "oleaut32.dll.#20",
    "oleaut32.dll.#19",
    "oleaut32.dll.#25",
    "oleaut32.dll.#286",
    "authz.dll.AuthzInitializeContextFromSid",
    "ole32.dll.CoGetCallContext",
    "ole32.dll.CoImpersonateClient",
    "advapi32.dll.OpenThreadToken",
    "ole32.dll.CoRevertToSelf",
    "ole32.dll.CoSwitchCallContext",
    "advapi32.dll.CryptAcquireContextW",
    "shlwapi.dll.PathIsDirectoryW",
    "advapi32.dll.RegNotifyChangeKeyValue",
    "ole32.dll.CLSIDFromOle1Class",
    "clbcatq.dll.GetCatalogObject",
    "clbcatq.dll.GetCatalogObject2",
    "tschannel.dll.DllGetClassObject",
    "tschannel.dll.DllCanUnloadNow",
    "shlwapi.dll.PathIsPrefixW",
    "xmllite.dll.CreateXmlReader",
    "dwmapi.dll.DwmIsCompositionEnabled"
]

[*] Static Analysis: {
    "dotnet": {
        "customattrs": null,
        "assemblyinfo": {
            "version": "1.0.0.0",
            "name": "Documents0"
        },
        "assemblyrefs": [
            {
                "version": "2.0.0.0",
                "name": "mscorlib"
            },
            {
                "version": "8.0.0.0",
                "name": "Microsoft.VisualBasic"
            },
            {
                "version": "2.0.0.0",
                "name": "System"
            },
            {
                "version": "2.0.0.0",
                "name": "System.Drawing"
            }
        ],
        "typerefs": [
            {
                "typename": "Microsoft.VisualBasic.ApplicationServices.ApplicationBase",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.ApplicationServices.User",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.Conversions",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.NewLateBinding",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.Operators",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.ProjectData",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.StandardModuleAttribute",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.Devices.Computer",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.HideModuleNameAttribute",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.MyGroupCollectionAttribute",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.VBMath",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.Design.HelpKeywordAttribute",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.EditorBrowsableAttribute",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.EditorBrowsableState",
                "assembly": "System"
            },
            {
                "typename": "System.Drawing.Bitmap",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Color",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Graphics",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Image",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Activator",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Array",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Boolean",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Byte",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Collections.Generic.List`1",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.DebuggerHiddenAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Enum",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Exception",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.FlagsAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Int32",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Math",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Object",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.Assembly",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyCompanyAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyCopyrightAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyDescriptionAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyFileVersionAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyProductAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyTitleAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyTrademarkAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.MethodInfo",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Resources.ResourceManager",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.LayoutKind",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.StructLayoutAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.RuntimeTypeHandle",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.STAThreadAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.CipherMode",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.HashAlgorithm",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.ICryptoTransform",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.MD5CryptoServiceProvider",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.RC2CryptoServiceProvider",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.SymmetricAlgorithm",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.String",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Text.Encoding",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Text.StringBuilder",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ThreadStaticAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Type",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ValueType",
                "assembly": "mscorlib"
            }
        ]
    },
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "_CorExeMain",
                        "address": "0x402000"
                    }
                ],
                "dll": "mscoree.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x000fe7ad",
        "overlay": null,
        "imagebase": "0x00400000",
        "reported_checksum": "0x00000000",
        "icon_hash": null,
        "entrypoint": "0x004f8a8e",
        "timestamp": "2017-02-24 22:18:03",
        "osversion": "4.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00002000",
                "size_of_data": "0x000f7000",
                "entropy": "7.75",
                "raw_address": "0x00001000",
                "virtual_size": "0x000f6a94",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x000fa000",
                "size_of_data": "0x00001000",
                "entropy": "0.70",
                "raw_address": "0x000f8000",
                "virtual_size": "0x000002b0",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".reloc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x000fc000",
                "size_of_data": "0x00001000",
                "entropy": "0.02",
                "raw_address": "0x000f9000",
                "virtual_size": "0x0000000c",
                "characteristics_raw": "0x42000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x000f8a34",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x00000057"
            },
            {
                "virtual_address": "0x000fa000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x000002b0"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x000fc000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x0000000c"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00002000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000008"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00002008",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000048"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 1,
        "versioninfo": []
    }
}