Create a new version of paste:

[*] MalFamily: "Ispy"

[*] MalScore: 10.0

[*] File Name: "Exes_6603fd56959d2773b45ccba6a98cb873.exe"
[*] File Size: 566272
[*] File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
[*] SHA256: "188516b9056f5175f61c8ac1201649360354993af77cfa38c3988fca06f63808"
[*] MD5: "6603fd56959d2773b45ccba6a98cb873"
[*] SHA1: "d1e0f931f330a5bf6e2e2699dd79e2a1bbf5d0e0"
[*] SHA512: "6864910ccb224272d4c0088ecaa27572e0e6eb69a99417661a35b638968a2d7f5ca280bffbc1783d511c52cd4eb19009351224dcf644f5203e1c1fb1e7175db6"
[*] CRC32: "9D7D60F8"
[*] SSDEEP: "12288:aZWETxtYn0CtMjoUexjrTadcWBbfoz9N8SCcI7NUqIFzGRIF6nj1K20XdD/S8Ch7:aZWEfYnDMjjQjCdx5ojI"

[*] Process Execution: [
    "Exes_6603fd56959d2773b45ccba6a98cb873.exe",
    "vbc.exe",
    "vbc.exe",
    "vbc.exe",
    "services.exe",
    "svchost.exe",
    "WmiPrvSE.exe",
    "svchost.exe",
    "WMIADAP.exe",
    "taskhost.exe"
]

[*] Signatures Detected: [
    {
        "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
        "Details": [
            {
                "IP": "65.158.122.9:80"
            }
        ]
    },
    {
        "Description": "Creates RWX memory",
        "Details": []
    },
    {
        "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
        "Details": [
            {
                "ioc": "nc.110/"
            }
        ]
    },
    {
        "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
        "Details": [
            {
                "get_no_useragent": "HTTP traffic contains a GET request with no user-agent header"
            },
            {
                "suspicious_request": "http://bot.whatismyipaddress.com/"
            }
        ]
    },
    {
        "Description": "Performs some HTTP requests",
        "Details": [
            {
                "url": "http://bot.whatismyipaddress.com/"
            },
            {
                "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"
            }
        ]
    },
    {
        "Description": "The binary likely contains encrypted or compressed data.",
        "Details": [
            {
                "section": "name: .text, entropy: 6.84, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00089400, virtual_size: 0x00089304"
            }
        ]
    },
    {
        "Description": "Looks up the external IP address",
        "Details": [
            {
                "domain": "bot.whatismyipaddress.com"
            }
        ]
    },
    {
        "Description": "Executed a process and injected code into it, probably while unpacking",
        "Details": [
            {
                "Injection": "Exes_6603fd56959d2773b45ccba6a98cb873.exe(1848) -> vbc.exe(1796)"
            }
        ]
    },
    {
        "Description": "Sniffs keystrokes",
        "Details": [
            {
                "SetWindowsHookExA": "Process: Exes_6603fd56959d2773b45ccba6a98cb873.exe(1848)"
            }
        ]
    },
    {
        "Description": "A process attempted to delay the analysis task by a long amount of time.",
        "Details": [
            {
                "Process": "Exes_6603fd56959d2773b45ccba6a98cb873.exe tried to sleep 3997 seconds, actually delayed analysis time by 0 seconds"
            }
        ]
    },
    {
        "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
        "Details": [
            {
                "Spam": "services.exe (504) called API NtQuerySystemTime 358304 times"
            },
            {
                "Spam": "services.exe (504) called API GetSystemTimeAsFileTime 12503295 times"
            }
        ]
    },
    {
        "Description": "Steals private information from local Internet browsers",
        "Details": [
            {
                "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat"
            }
        ]
    },
    {
        "Description": "Exhibits behavior characteristic of iSpy Keylogger",
        "Details": [
            {
                "C2": "64.98.36.139"
            },
            {
                "C2": "smtp.lycos.com"
            }
        ]
    },
    {
        "Description": "File has been identified by 41 Antiviruses on VirusTotal as malicious",
        "Details": [
            {
                "MicroWorld-eScan": "Trojan.MSIL.Agent.DSB"
            },
            {
                "FireEye": "Generic.mg.6603fd56959d2773"
            },
            {
                "ALYac": "Trojan.MSIL.Agent.DSB"
            },
            {
                "Malwarebytes": "Spyware.HawkEyeKeyLogger"
            },
            {
                "K7GW": "Spyware ( 005045191 )"
            },
            {
                "K7AntiVirus": "Spyware ( 005045191 )"
            },
            {
                "Arcabit": "Trojan.MSIL.Agent.DSB"
            },
            {
                "Invincea": "heuristic"
            },
            {
                "Symantec": "ML.Attribute.HighConfidence"
            },
            {
                "APEX": "Malicious"
            },
            {
                "Kaspersky": "not-a-virus:HEUR:PSWTool.Win32.NetPass.gen"
            },
            {
                "BitDefender": "Trojan.MSIL.Agent.DSB"
            },
            {
                "Avast": "Win32:KeyloggerX-gen [Trj]"
            },
            {
                "Ad-Aware": "Trojan.MSIL.Agent.DSB"
            },
            {
                "Sophos": "Mal/Agent-ATH"
            },
            {
                "F-Secure": "Trojan.TR/Dropper.Gen"
            },
            {
                "DrWeb": "Trojan.Packed2.41525"
            },
            {
                "TrendMicro": "TrojanSpy.MSIL.HAWKEYE.SM"
            },
            {
                "McAfee-GW-Edition": "BehavesLike.Win32.Generic.hh"
            },
            {
                "Emsisoft": "Trojan.MSIL.Agent.DSB (B)"
            },
            {
                "Jiangmin": "PSWTool.NetPass.li"
            },
            {
                "Avira": "TR/Dropper.Gen"
            },
            {
                "MAX": "malware (ai score=83)"
            },
            {
                "Microsoft": "TrojanSpy:MSIL/Keylog.B"
            },
            {
                "Endgame": "malicious (high confidence)"
            },
            {
                "ZoneAlarm": "not-a-virus:HEUR:PSWTool.Win32.NetPass.gen"
            },
            {
                "GData": "Trojan.MSIL.Agent.DSB"
            },
            {
                "AhnLab-V3": "Spyware/Win32.Hawkeye.C2924992"
            },
            {
                "McAfee": "PUP-XGY-FF"
            },
            {
                "VBA32": "CIL.StupidCryptor.Heur"
            },
            {
                "Cylance": "Unsafe"
            },
            {
                "Zoner": "Trojan.Win32.74604"
            },
            {
                "ESET-NOD32": "a variant of MSIL/Spy.Agent.AUS"
            },
            {
                "TrendMicro-HouseCall": "TrojanSpy.MSIL.HAWKEYE.SM"
            },
            {
                "Rising": "Spyware.Agent!8.C6 (TFE:dGZlOg2uDcpKicjleQ)"
            },
            {
                "SentinelOne": "DFI - Malicious PE"
            },
            {
                "eGambit": "Unsafe.AI_Score_84%"
            },
            {
                "AVG": "Win32:KeyloggerX-gen [Trj]"
            },
            {
                "Cybereason": "malicious.6959d2"
            },
            {
                "CrowdStrike": "win/malicious_confidence_100% (W)"
            },
            {
                "Qihoo-360": "HEUR/QVM03.0.393B.Malware.Gen"
            }
        ]
    },
    {
        "Description": "Checks the CPU name from registry, possibly for anti-virtualization",
        "Details": []
    },
    {
        "Description": "Harvests information related to installed instant messenger clients",
        "Details": [
            {
                "key": "HKEY_CURRENT_USER\\Software\\Google\\Google Talk\\Accounts"
            }
        ]
    },
    {
        "Description": "Harvests information related to installed mail clients",
        "Details": [
            {
                "file": "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows Live Mail\\*.oeaccount"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows Live Mail\\*.*"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\0a0d020000000000c000000000000046"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9234ed9445f8fa418a542f350f18f326"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP User"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\cb23f8734d88734ca66c47c4527fd259"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP User"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8408552e6dae7d45a0ba01520b6221ff"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\240a97d961ed46428e29a3f1f1c23670"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\c02ebc5353d9cd11975200aa004ae40e"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP User"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8503020000000000c000000000000046"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\b22783abb139fe46b0aad551d64b60e7"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTP User"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP User"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 User"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 User"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8f92b60606058348930a96946cf329e1"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTP User"
            },
            {
                "key": "HKEY_CURRENT_USER\\Identities\\{0A258175-2D14-4D69-9955-E200F247250F}\\Software\\Microsoft\\Office\\Outlook\\OMI Account Manager\\Accounts"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Outlook\\OMI Account Manager\\Accounts"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Account Manager\\Accounts"
            },
            {
                "key": "HKEY_CURRENT_USER\\Identities\\{0A258175-2D14-4D69-9955-E200F247250F}\\Software\\Microsoft\\Internet Account Manager\\Accounts"
            }
        ]
    },
    {
        "Description": "Makes SMTP requests, possibly sending spam or exfiltrating data.",
        "Details": [
            {
                "SMTP": "64.98.36.139 (smtp.lycos.com)"
            }
        ]
    }
]

[*] Started Service: [
    "VaultSvc"
]

[*] Executed Commands: [
    "\"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe\" /stext \"C:\\Users\\user\\AppData\\Local\\Temp\\tmp3E5.tmp\"",
    "\"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe\" /stext \"C:\\Users\\user\\AppData\\Local\\Temp\\tmp14F8.tmp\"",
    "\"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe\" /stext \"C:\\Users\\user\\AppData\\Local\\Temp\\tmp9244.tmp\"",
    "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding",
    "C:\\Windows\\system32\\lsass.exe"
]

[*] Mutexes: [
    "Global\\CLR_CASOFF_MUTEX",
    "cb602334-1924-4a9b-947d-6d25adf8e1de",
    "Global\\.net clr networking",
    "Global\\ADAP_WMI_ENTRY",
    "Global\\RefreshRA_Mutex",
    "Global\\RefreshRA_Mutex_Lib",
    "Global\\RefreshRA_Mutex_Flag"
]

[*] Modified Files: [
    "C:\\Users\\user\\AppData\\Local\\Temp\\a2c1cb25-e2e0-b0c5-f1ad-c171d0015b54",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabFC66.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarFC67.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4C2E.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4C2F.tmp",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7294.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7295.tmp",
    "\\??\\PIPE\\samr",
    "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
    "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
    "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
    "\\??\\WMIDataDevice",
    "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data",
    "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data",
    "C:\\Users\\user\\AppData\\Local\\Temp\\tmp3E5.tmp",
    "C:\\Windows\\sysnative\\LogFiles\\Scm\\5869f1c1-01d7-41f7-84b7-715672259fa8",
    "C:\\Users\\user\\AppData\\Local\\Temp\\tmp14F8.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\tmp9244.tmp"
]

[*] Deleted Files: [
    "C:\\Users\\user\\AppData\\Local\\Temp\\tmp3E5.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\tmp14F8.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabFC66.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarFC67.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4C2E.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4C2F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7294.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7295.tmp"
]

[*] Modified Registry Keys: [
    "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\Exes_6603fd56959d2773b45ccba6a98cb873_RASAPI32",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Exes_6603fd56959d2773b45ccba6a98cb873_RASAPI32\\EnableFileTracing",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Exes_6603fd56959d2773b45ccba6a98cb873_RASAPI32\\EnableConsoleTracing",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Exes_6603fd56959d2773b45ccba6a98cb873_RASAPI32\\FileTracingMask",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Exes_6603fd56959d2773b45ccba6a98cb873_RASAPI32\\ConsoleTracingMask",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Exes_6603fd56959d2773b45ccba6a98cb873_RASAPI32\\MaxFileSize",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Exes_6603fd56959d2773b45ccba6a98cb873_RASAPI32\\FileDirectory",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
    "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\VaultSvc\\Type"
]

[*] Deleted Registry Keys: []

[*] DNS Communications: [
    {
        "type": "A",
        "request": "bot.whatismyipaddress.com",
        "answers": [
            {
                "data": "66.171.248.178",
                "type": "A"
            }
        ]
    },
    {
        "type": "A",
        "request": "smtp.lycos.com",
        "answers": [
            {
                "data": "64.98.36.139",
                "type": "A"
            },
            {
                "data": "mail.lycos.com.cust.b.hostedemail.com",
                "type": "CNAME"
            }
        ]
    }
]

[*] Domains: [
    {
        "ip": "64.98.36.139",
        "domain": "smtp.lycos.com"
    },
    {
        "ip": "66.171.248.178",
        "domain": "bot.whatismyipaddress.com"
    }
]

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: [
    {
        "count": 1,
        "body": "",
        "uri": "http://bot.whatismyipaddress.com/",
        "user-agent": "",
        "method": "GET",
        "host": "bot.whatismyipaddress.com",
        "version": "1.1",
        "path": "/",
        "data": "GET / HTTP/1.1\r\nHost: bot.whatismyipaddress.com\r\nConnection: Keep-Alive\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "www.download.windowsupdate.com",
        "version": "1.1",
        "path": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
        "data": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\nCache-Control: max-age = 86694\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Feb 2019 16:53:13 GMT\r\nIf-None-Match: \"80e22c19cfcad41:0\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: www.download.windowsupdate.com\r\n\r\n",
        "port": 80
    }
]

[*] Network Communication - SMTP: [
    {
        "raw": "EHLO Host\r\nSTARTTLS\r\n\\x16\\x03\\x01\\x00q\\x01\\x00\\x00m\\x03\\x01]\\x1a\\xa0\\x88D+\\xd9\\x14@\\x1b\\xd3\\x7f\\xf3\\xf7\\xac\\xce\\xec\\x98|\\xb1\\xb7yX\\x88\\xaf\\xa4Y\\xd9\\xceT\\\n\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00,\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0esmtp.lycos.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x16\\x03\\x01\\x00F\\x10\\x00\\x00BA\\x04aq\\xbdNj\\x02L+\\xc3\\x84\\x82{\\xab\\xee\\xef\\xff\\x14M\\xd5\\xf7f\\xa3\\xc6\\xd9\\xd2\\xfcBDST\\x11%\\x88\\xcfY\\x00\\x11\r\\xa0\\xf6\\xc7E8w1\\x13\\xe4R-\\xf7\\xe2\\xdd\\xfa\\xd5&\\x93\\xa1\\x92\\xbf\\x9a\\x9f\\x05\\xa8\\xc9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xee\\xb8\\xbb\\xde\\xb6J\\x90\\xae\\xe1+\\xebA\\x81\\x82\\x88\\xdf\\x86\\xda\\x8f\\xe9Ml\\xdb\\xab]\\xa4\\xedV\\xf0\\x1eIs\\x80XL2\\x8d\\x95L\\x80\\xdb\\x02\\xe4\\x1a!\\x0c\\xac\\xe2",
        "dst": "64.98.36.139"
    }
]

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {
    "dotnet": {
        "customattrs": null,
        "assemblyinfo": {
            "version": "9.0.0.4",
            "name": "Reborn Stub"
        },
        "assemblyrefs": [
            {
                "version": "2.0.0.0",
                "name": "mscorlib"
            },
            {
                "version": "8.0.0.0",
                "name": "Microsoft.VisualBasic"
            },
            {
                "version": "2.0.0.0",
                "name": "System"
            },
            {
                "version": "2.0.0.0",
                "name": "System.Windows.Forms"
            },
            {
                "version": "2.0.0.0",
                "name": "System.Drawing"
            },
            {
                "version": "2.0.0.0",
                "name": "System.Management"
            },
            {
                "version": "2.0.0.0",
                "name": "System.Xml"
            },
            {
                "version": "0.0.0.0",
                "name": "GpJmmfYBHDiNqFjcVKSNxCwyuuWmA"
            }
        ],
        "typerefs": [
            {
                "typename": "Microsoft.VisualBasic.ApplicationServices.ConsoleApplicationBase",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.ApplicationServices.User",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompareMethod",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.Conversions",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.Operators",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.ProjectData",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.StandardModuleAttribute",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.Utils",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.Devices.Computer",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.HideModuleNameAttribute",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.MyGroupCollectionAttribute",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.Strings",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
                "assembly": "System"
            },
            {
                "typename": "System.Collections.Specialized.NameValueCollection",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.Component",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.Design.HelpKeywordAttribute",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.EditorBrowsableAttribute",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.EditorBrowsableState",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.Win32Exception",
                "assembly": "System"
            },
            {
                "typename": "System.Configuration.ApplicationSettingsBase",
                "assembly": "System"
            },
            {
                "typename": "System.Configuration.SettingsBase",
                "assembly": "System"
            },
            {
                "typename": "System.Diagnostics.Process",
                "assembly": "System"
            },
            {
                "typename": "System.Diagnostics.ProcessModule",
                "assembly": "System"
            },
            {
                "typename": "System.Diagnostics.ProcessStartInfo",
                "assembly": "System"
            },
            {
                "typename": "System.Diagnostics.ProcessThread",
                "assembly": "System"
            },
            {
                "typename": "System.Diagnostics.ProcessThreadCollection",
                "assembly": "System"
            },
            {
                "typename": "System.Diagnostics.ProcessWindowStyle",
                "assembly": "System"
            },
            {
                "typename": "System.Net.Dns",
                "assembly": "System"
            },
            {
                "typename": "System.Net.FtpWebRequest",
                "assembly": "System"
            },
            {
                "typename": "System.Net.FtpWebResponse",
                "assembly": "System"
            },
            {
                "typename": "System.Net.HttpWebRequest",
                "assembly": "System"
            },
            {
                "typename": "System.Net.ICredentials",
                "assembly": "System"
            },
            {
                "typename": "System.Net.ICredentialsByHost",
                "assembly": "System"
            },
            {
                "typename": "System.Net.IPAddress",
                "assembly": "System"
            },
            {
                "typename": "System.Net.IPHostEntry",
                "assembly": "System"
            },
            {
                "typename": "System.Net.Mail.MailAddress",
                "assembly": "System"
            },
            {
                "typename": "System.Net.Mail.MailAddressCollection",
                "assembly": "System"
            },
            {
                "typename": "System.Net.Mail.MailMessage",
                "assembly": "System"
            },
            {
                "typename": "System.Net.Mail.SmtpClient",
                "assembly": "System"
            },
            {
                "typename": "System.Net.NetworkCredential",
                "assembly": "System"
            },
            {
                "typename": "System.Net.NetworkInformation.NetworkInterface",
                "assembly": "System"
            },
            {
                "typename": "System.Net.NetworkInformation.NetworkInterfaceType",
                "assembly": "System"
            },
            {
                "typename": "System.Net.NetworkInformation.OperationalStatus",
                "assembly": "System"
            },
            {
                "typename": "System.Net.Sockets.AddressFamily",
                "assembly": "System"
            },
            {
                "typename": "System.Net.WebClient",
                "assembly": "System"
            },
            {
                "typename": "System.Net.WebException",
                "assembly": "System"
            },
            {
                "typename": "System.Net.WebRequest",
                "assembly": "System"
            },
            {
                "typename": "System.Net.WebResponse",
                "assembly": "System"
            },
            {
                "typename": "System.Text.RegularExpressions.Capture",
                "assembly": "System"
            },
            {
                "typename": "System.Text.RegularExpressions.Group",
                "assembly": "System"
            },
            {
                "typename": "System.Text.RegularExpressions.GroupCollection",
                "assembly": "System"
            },
            {
                "typename": "System.Text.RegularExpressions.Match",
                "assembly": "System"
            },
            {
                "typename": "System.Text.RegularExpressions.Regex",
                "assembly": "System"
            },
            {
                "typename": "System.Drawing.Bitmap",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.CopyPixelOperation",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Graphics",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Image",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Imaging.ImageFormat",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Imaging.PixelFormat",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Rectangle",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Size",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Management.ManagementBaseObject",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.ManagementDateTimeConverter",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.ManagementObject",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.ManagementObjectCollection",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.ManagementObjectCollection/ManagementObjectEnumerator",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.ManagementObjectSearcher",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.PropertyData",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.PropertyDataCollection",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Windows.Forms.Application",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Clipboard",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Control",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.CreateParams",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.DialogResult",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Form",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.IDataObject",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Keys",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Message",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.MessageBox",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.MessageBoxButtons",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.MessageBoxIcon",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.NativeWindow",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Screen",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.SystemInformation",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Xml.XmlReader",
                "assembly": "System.Xml"
            },
            {
                "typename": "Microsoft.Win32.Registry",
                "assembly": "mscorlib"
            },
            {
                "typename": "Microsoft.Win32.RegistryKey",
                "assembly": "mscorlib"
            },
            {
                "typename": "Microsoft.Win32.RegistryValueKind",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Activator",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.AppDomain",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Array",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.AsyncCallback",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Attribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.BitConverter",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Buffer",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Byte",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Char",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Collections.Generic.Dictionary`2",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Collections.Generic.List`1",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Collections.Generic.List`1/Enumerator",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Collections.Hashtable",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Console",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Convert",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.DateTime",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Delegate",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.DebuggableAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.DebuggableAttribute/DebuggingModes",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.Debugger",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.DebuggerHiddenAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.DebuggerNonUserCodeAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Enum",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Environment",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Environment/SpecialFolder",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.EventArgs",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Exception",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.FlagsAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.GC",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Globalization.CultureInfo",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Guid",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IAsyncResult",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IDisposable",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IFormatProvider",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.Directory",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.DirectoryInfo",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.File",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.FileAttributes",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.MemoryStream",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.Path",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.Stream",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.StreamReader",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.StreamWriter",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Int32",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Int64",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IntPtr",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.InvalidOperationException",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Math",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.MidpointRounding",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.MulticastDelegate",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Object",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ParamArrayAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Random",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.Assembly",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyCompanyAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyCopyrightAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyDescriptionAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyFileVersionAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyProductAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyTitleAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyTrademarkAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.DefaultMemberAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.MethodBase",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.MethodInfo",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.TargetInvocationException",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ResolveEventArgs",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ResolveEventHandler",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Resources.ResourceManager",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.AccessedThroughPropertyAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.SuppressIldasmAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.GCHandle",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.GCHandleType",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.GuidAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.Marshal",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.Serialization.Formatters.Binary.BinaryFormatter",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.Serialization.SerializationBinder",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.RuntimeFieldHandle",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.RuntimeTypeHandle",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.STAThreadAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.AccessControlType",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.AceFlags",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.AceQualifier",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.CommonAce",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.DirectorySecurity",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.GenericAce",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.GenericSecurityDescriptor",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.InheritanceFlags",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.ObjectSecurity",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.PropagationFlags",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.RawAcl",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.RawSecurityDescriptor",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.RegistryAccessRule",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.RegistryRights",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.RegistrySecurity",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.CipherMode",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.CryptoStream",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.CryptoStreamMode",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.DESCryptoServiceProvider",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.HashAlgorithm",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.ICryptoTransform",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.MD5",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.MD5CryptoServiceProvider",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.PaddingMode",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.Rfc2898DeriveBytes",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.RijndaelManaged",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.SymmetricAlgorithm",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.IdentityReference",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.NTAccount",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.SecurityIdentifier",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.WellKnownSidType",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.WindowsBuiltInRole",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.WindowsIdentity",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.WindowsPrincipal",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.SuppressUnmanagedCodeSecurityAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.String",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.StringSplitOptions",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Text.ASCIIEncoding",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Text.Encoding",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Text.StringBuilder",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Text.UTF8Encoding",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ThreadStaticAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.ApartmentState",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.Interlocked",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.Monitor",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.Mutex",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.ParameterizedThreadStart",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.Thread",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.ThreadStart",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.TimeSpan",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Type",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.UInt32",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ValueType",
                "assembly": "mscorlib"
            }
        ]
    },
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "_CorExeMain",
                        "address": "0x402000"
                    }
                ],
                "dll": "mscoree.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x00093c1c",
        "overlay": null,
        "imagebase": "0x00400000",
        "reported_checksum": "0x00000000",
        "icon_hash": null,
        "entrypoint": "0x0048b2fe",
        "timestamp": "2019-01-22 15:01:45",
        "osversion": "4.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00002000",
                "size_of_data": "0x00089400",
                "entropy": "6.84",
                "raw_address": "0x00000200",
                "virtual_size": "0x00089304",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x0008c000",
                "size_of_data": "0x00000c00",
                "entropy": "6.62",
                "raw_address": "0x00089600",
                "virtual_size": "0x00000b0c",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".reloc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x0008e000",
                "size_of_data": "0x00000200",
                "entropy": "0.08",
                "raw_address": "0x0008a200",
                "virtual_size": "0x0000000c",
                "characteristics_raw": "0x42000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x0008b2a8",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x00000053"
            },
            {
                "virtual_address": "0x0008c000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x00000b0c"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x0008e000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x0000000c"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00002000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000008"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00002008",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000048"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 1,
        "versioninfo": []
    }
}

[*] Resolved APIs: [
    "advapi32.dll.RegOpenKeyExW",
    "advapi32.dll.RegQueryInfoKeyW",
    "advapi32.dll.RegEnumKeyExW",
    "advapi32.dll.RegEnumValueW",
    "advapi32.dll.RegCloseKey",
    "advapi32.dll.RegQueryValueExW",
    "kernel32.dll.QueryActCtxW",
    "shlwapi.dll.UrlIsW",
    "kernel32.dll.FlsAlloc",
    "kernel32.dll.FlsGetValue",
    "kernel32.dll.FlsSetValue",
    "kernel32.dll.FlsFree",
    "kernel32.dll.InitializeCriticalSectionAndSpinCount",
    "kernel32.dll.IsProcessorFeaturePresent",
    "msvcrt.dll._set_error_mode",
    "msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z",
    "kernel32.dll.FindActCtxSectionStringW",
    "kernel32.dll.GetSystemWindowsDirectoryW",
    "mscoree.dll.GetProcessExecutableHeap",
    "mscorwks.dll._CorExeMain",
    "mscorwks.dll.GetCLRFunction",
    "advapi32.dll.RegisterTraceGuidsW",
    "advapi32.dll.UnregisterTraceGuids",
    "advapi32.dll.GetTraceLoggerHandle",
    "advapi32.dll.GetTraceEnableLevel",
    "advapi32.dll.GetTraceEnableFlags",
    "advapi32.dll.TraceEvent",
    "mscoree.dll.IEE",
    "mscorwks.dll.IEE",
    "mscoree.dll.GetStartupFlags",
    "mscoree.dll.GetHostConfigurationFile",
    "mscoree.dll.GetCORSystemDirectory",
    "ntdll.dll.RtlUnwind",
    "kernel32.dll.IsWow64Process",
    "advapi32.dll.AllocateAndInitializeSid",
    "advapi32.dll.OpenProcessToken",
    "advapi32.dll.GetTokenInformation",
    "advapi32.dll.InitializeAcl",
    "advapi32.dll.AddAccessAllowedAce",
    "advapi32.dll.FreeSid",
    "kernel32.dll.SetThreadStackGuarantee",
    "kernel32.dll.AddVectoredContinueHandler",
    "kernel32.dll.RemoveVectoredContinueHandler",
    "advapi32.dll.ConvertSidToStringSidW",
    "shell32.dll.SHGetFolderPathW",
    "kernel32.dll.FlushProcessWriteBuffers",
    "kernel32.dll.GetWriteWatch",
    "kernel32.dll.ResetWriteWatch",
    "kernel32.dll.CreateMemoryResourceNotification",
    "kernel32.dll.QueryMemoryResourceNotification",
    "ole32.dll.CoInitializeEx",
    "cryptbase.dll.SystemFunction036",
    "uxtheme.dll.ThemeInitApiHook",
    "user32.dll.IsProcessDPIAware",
    "ole32.dll.CoGetContextToken",
    "kernel32.dll.GetFullPathNameW",
    "kernel32.dll.GetVersionExW",
    "advapi32.dll.CryptAcquireContextA",
    "advapi32.dll.CryptReleaseContext",
    "advapi32.dll.CryptCreateHash",
    "advapi32.dll.CryptDestroyHash",
    "advapi32.dll.CryptHashData",
    "advapi32.dll.CryptGetHashParam",
    "advapi32.dll.CryptImportKey",
    "advapi32.dll.CryptExportKey",
    "advapi32.dll.CryptGenKey",
    "advapi32.dll.CryptGetKeyParam",
    "advapi32.dll.CryptDestroyKey",
    "advapi32.dll.CryptVerifySignatureA",
    "advapi32.dll.CryptSignHashA",
    "advapi32.dll.CryptGetProvParam",
    "advapi32.dll.CryptGetUserKey",
    "advapi32.dll.CryptEnumProvidersA",
    "mscoree.dll.GetMetaDataInternalInterface",
    "mscorwks.dll.GetMetaDataInternalInterface",
    "mscorjit.dll.getJit",
    "kernel32.dll.GlobalMemoryStatusEx",
    "kernel32.dll.GetEnvironmentVariableW",
    "kernel32.dll.SwitchToThread",
    "kernel32.dll.LoadLibraryW",
    "kernel32.dll.EnumResourceTypesW",
    "kernel32.dll.EnumResourceNamesW",
    "kernel32.dll.lstrlen",
    "kernel32.dll.lstrlenW",
    "kernel32.dll.GetModuleFileNameW",
    "kernel32.dll.RtlMoveMemory",
    "kernel32.dll.FindResourceW",
    "kernel32.dll.SizeofResource",
    "kernel32.dll.LoadResource",
    "kernel32.dll.LockResource",
    "kernel32.dll.GetUserDefaultUILanguage",
    "kernel32.dll.FreeLibrary",
    "cryptsp.dll.CryptAcquireContextW",
    "cryptsp.dll.CryptCreateHash",
    "bcrypt.dll.BCryptGetFipsAlgorithmMode",
    "cryptsp.dll.CryptGenRandom",
    "cryptsp.dll.CryptHashData",
    "cryptsp.dll.CryptGetHashParam",
    "cryptsp.dll.CryptDestroyHash",
    "kernel32.dll.ReleaseMutex",
    "kernel32.dll.CreateMutexW",
    "kernel32.dll.CloseHandle",
    "kernel32.dll.GetTempPathW",
    "kernel32.dll.GetComputerNameW",
    "kernel32.dll.CreateEventW",
    "kernel32.dll.SetEvent",
    "ole32.dll.CoWaitForMultipleHandles",
    "sechost.dll.LookupAccountNameLocalW",
    "ole32.dll.IIDFromString",
    "ole32.dll.CoGetClassObject",
    "advapi32.dll.LookupAccountSidW",
    "sechost.dll.LookupAccountSidLocalW",
    "ole32.dll.CoCreateFreeThreadedMarshaler",
    "ole32.dll.CoGetObjectContext",
    "ole32.dll.NdrOleInitializeExtension",
    "ole32.dll.CoGetMarshalSizeMax",
    "ole32.dll.CoMarshalInterface",
    "ole32.dll.CoUnmarshalInterface",
    "ole32.dll.StringFromIID",
    "ole32.dll.CoGetPSClsid",
    "ole32.dll.CoTaskMemAlloc",
    "ole32.dll.CoTaskMemFree",
    "ole32.dll.CoCreateInstance",
    "ole32.dll.CoReleaseMarshalData",
    "ole32.dll.DcomChannelSetHResult",
    "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
    "oleaut32.dll.#2",
    "oleaut32.dll.#6",
    "kernel32.dll.LoadLibraryA",
    "kernel32.dll.GetProcAddress",
    "wminet_utils.dll.ResetSecurity",
    "wminet_utils.dll.SetSecurity",
    "wminet_utils.dll.BlessIWbemServices",
    "wminet_utils.dll.BlessIWbemServicesObject",
    "wminet_utils.dll.GetPropertyHandle",
    "wminet_utils.dll.WritePropertyValue",
    "wminet_utils.dll.Clone",
    "wminet_utils.dll.VerifyClientKey",
    "wminet_utils.dll.GetQualifierSet",
    "wminet_utils.dll.Get",
    "wminet_utils.dll.Put",
    "wminet_utils.dll.Delete",
    "wminet_utils.dll.GetNames",
    "wminet_utils.dll.BeginEnumeration",
    "wminet_utils.dll.Next",
    "wminet_utils.dll.EndEnumeration",
    "wminet_utils.dll.GetPropertyQualifierSet",
    "wminet_utils.dll.GetObjectText",
    "wminet_utils.dll.SpawnDerivedClass",
    "wminet_utils.dll.SpawnInstance",
    "wminet_utils.dll.CompareTo",
    "wminet_utils.dll.GetPropertyOrigin",
    "wminet_utils.dll.InheritsFrom",
    "wminet_utils.dll.GetMethod",
    "wminet_utils.dll.PutMethod",
    "wminet_utils.dll.DeleteMethod",
    "wminet_utils.dll.BeginMethodEnumeration",
    "wminet_utils.dll.NextMethod",
    "wminet_utils.dll.EndMethodEnumeration",
    "wminet_utils.dll.GetMethodQualifierSet",
    "wminet_utils.dll.GetMethodOrigin",
    "wminet_utils.dll.QualifierSet_Get",
    "wminet_utils.dll.QualifierSet_Put",
    "wminet_utils.dll.QualifierSet_Delete",
    "wminet_utils.dll.QualifierSet_GetNames",
    "wminet_utils.dll.QualifierSet_BeginEnumeration",
    "wminet_utils.dll.QualifierSet_Next",
    "wminet_utils.dll.QualifierSet_EndEnumeration",
    "wminet_utils.dll.GetCurrentApartmentType",
    "wminet_utils.dll.GetDemultiplexedStub",
    "wminet_utils.dll.CreateInstanceEnumWmi",
    "wminet_utils.dll.CreateClassEnumWmi",
    "wminet_utils.dll.ExecQueryWmi",
    "wminet_utils.dll.ExecNotificationQueryWmi",
    "wminet_utils.dll.PutInstanceWmi",
    "wminet_utils.dll.PutClassWmi",
    "wminet_utils.dll.CloneEnumWbemClassObject",
    "wminet_utils.dll.ConnectServerWmi",
    "kernel32.dll.GetThreadPreferredUILanguages",
    "kernel32.dll.SetThreadPreferredUILanguages",
    "kernel32.dll.LocaleNameToLCID",
    "kernel32.dll.GetLocaleInfoEx",
    "kernel32.dll.LCIDToLocaleName",
    "kernel32.dll.GetSystemDefaultLocaleName",
    "ole32.dll.CoUninitialize",
    "oleaut32.dll.#500",
    "oleaut32.dll.SysStringLen",
    "kernel32.dll.RtlZeroMemory",
    "oleaut32.dll.#283",
    "oleaut32.dll.#284",
    "oleaut32.dll.#9",
    "oleaut32.dll.#7",
    "oleaut32.dll.GetErrorInfo",
    "oleaut32.dll.#149",
    "kernel32.dll.SetErrorMode",
    "kernel32.dll.GetFileAttributesExW",
    "kernel32.dll.CreateFileW",
    "kernel32.dll.GetFileType",
    "kernel32.dll.WriteFile",
    "kernel32.dll.GetModuleHandleW",
    "user32.dll.DefWindowProcW",
    "gdi32.dll.GetStockObject",
    "user32.dll.RegisterClassW",
    "user32.dll.CreateWindowExW",
    "user32.dll.SetWindowLongW",
    "user32.dll.GetWindowLongW",
    "kernel32.dll.GetCurrentProcess",
    "kernel32.dll.GetCurrentThread",
    "kernel32.dll.DuplicateHandle",
    "kernel32.dll.GetCurrentThreadId",
    "user32.dll.CallWindowProcW",
    "user32.dll.RegisterWindowMessageW",
    "dwmapi.dll.DwmIsCompositionEnabled",
    "culture.dll.ConvertLangIdToCultureName",
    "kernel32.dll.GetTempFileNameW",
    "shfolder.dll.SHGetFolderPathW",
    "kernel32.dll.CreateProcessW",
    "kernel32.dll.GetThreadContext",
    "kernel32.dll.ReadProcessMemory",
    "ntdll.dll.NtUnmapViewOfSection",
    "kernel32.dll.VirtualAllocEx",
    "kernel32.dll.WriteProcessMemory",
    "kernel32.dll.SetThreadContext",
    "kernel32.dll.ResumeThread",
    "kernel32.dll.ReadFile",
    "kernel32.dll.DeleteFileW",
    "user32.dll.SetWindowsHookExA",
    "user32.dll.SetClipboardViewer",
    "user32.dll.GetForegroundWindow",
    "user32.dll.GetWindowTextW",
    "user32.dll.GetWindowThreadProcessId",
    "advapi32.dll.LookupPrivilegeValueW",
    "advapi32.dll.AdjustTokenPrivileges",
    "psapi.dll.EnumProcesses",
    "user32.dll.GetMessageTime",
    "ole32.dll.OleInitialize",
    "ole32.dll.OleGetClipboard",
    "kernel32.dll.GlobalLock",
    "kernel32.dll.GlobalUnlock",
    "kernel32.dll.GlobalFree",
    "user32.dll.SendMessageA",
    "user32.dll.GetSystemMetrics",
    "user32.dll.GetClientRect",
    "user32.dll.GetWindowRect",
    "user32.dll.GetParent",
    "ole32.dll.CoRegisterMessageFilter",
    "user32.dll.PeekMessageW",
    "user32.dll.WaitMessage",
    "kernel32.dll.LocalFree",
    "iphlpapi.dll.GetNetworkParams",
    "dnsapi.dll.DnsQueryConfig",
    "iphlpapi.dll.GetAdaptersAddresses",
    "iphlpapi.dll.GetIpInterfaceEntry",
    "iphlpapi.dll.GetBestInterfaceEx",
    "kernel32.dll.LocalAlloc",
    "ws2_32.dll.WSAStartup",
    "ws2_32.dll.WSASocketW",
    "ws2_32.dll.setsockopt",
    "ws2_32.dll.WSAEventSelect",
    "ws2_32.dll.ioctlsocket",
    "ws2_32.dll.closesocket",
    "kernel32.dll.GetFileSize",
    "mscoree.dll.ND_RI2",
    "kernel32.dll.GetCurrentProcessId",
    "advapi32.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
    "kernel32.dll.CreateFileMappingW",
    "kernel32.dll.MapViewOfFile",
    "kernel32.dll.UnmapViewOfFile",
    "kernel32.dll.VirtualQuery",
    "advapi32.dll.CreateWellKnownSid",
    "kernel32.dll.WaitForSingleObject",
    "kernel32.dll.OpenMutexW",
    "kernel32.dll.OpenProcess",
    "kernel32.dll.GetProcessTimes",
    "ws2_32.dll.inet_addr",
    "iphlpapi.dll.GetAdaptersInfo",
    "iphlpapi.dll.GetIfEntry",
    "iphlpapi.dll.GetPerAdapterInfo",
    "advapi32.dll.GetUserNameW",
    "kernel32.dll.GetACP",
    "rasapi32.dll.RasEnumConnectionsW",
    "rtutils.dll.TraceRegisterExA",
    "rtutils.dll.TracePrintfExA",
    "sechost.dll.OpenSCManagerW",
    "sechost.dll.OpenServiceW",
    "sechost.dll.QueryServiceStatus",
    "sechost.dll.CloseServiceHandle",
    "ws2_32.dll.WSAIoctl",
    "kernel32.dll.FormatMessageW",
    "rasapi32.dll.RasConnectionNotificationW",
    "advapi32.dll.RegOpenCurrentUser",
    "advapi32.dll.RegNotifyChangeKeyValue",
    "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
    "sechost.dll.NotifyServiceStatusChangeA",
    "kernel32.dll.ResetEvent",
    "ws2_32.dll.getaddrinfo",
    "ws2_32.dll.freeaddrinfo",
    "ws2_32.dll.WSAConnect",
    "ws2_32.dll.send",
    "ws2_32.dll.recv",
    "ws2_32.dll.shutdown",
    "kernel32.dll.CreateIoCompletionPort",
    "kernel32.dll.PostQueuedCompletionStatus",
    "ntdll.dll.NtQueryInformationThread",
    "ntdll.dll.NtQuerySystemInformation",
    "ntdll.dll.NtGetCurrentProcessorNumber",
    "kernel32.dll.CreateSemaphoreA",
    "security.dll.EnumerateSecurityPackagesW",
    "security.dll.FreeContextBuffer",
    "cryptsp.dll.SystemFunction035",
    "mscoree.dll.ND_RI4",
    "security.dll.FreeCredentialsHandle",
    "security.dll.AcquireCredentialsHandleW",
    "schannel.dll.SpUserModeInitialize",
    "advapi32.dll.RegCreateKeyExW",
    "security.dll.DeleteSecurityContext",
    "security.dll.InitializeSecurityContextW",
    "secur32.dll.FreeContextBuffer",
    "ncrypt.dll.SslOpenProvider",
    "ncrypt.dll.GetSChannelInterface",
    "bcryptprimitives.dll.GetHashInterface",
    "ncrypt.dll.SslIncrementProviderReferenceCount",
    "ncrypt.dll.SslImportKey",
    "bcryptprimitives.dll.GetCipherInterface",
    "security.dll.QueryContextAttributesW",
    "ncrypt.dll.SslLookupCipherSuiteInfo",
    "crypt32.dll.CertFreeCertificateContext",
    "crypt32.dll.CertDuplicateCertificateContext",
    "crypt32.dll.CertGetCertificateContextProperty",
    "crypt32.dll.CertCloseStore",
    "crypt32.dll.CertDuplicateStore",
    "crypt32.dll.CertEnumCertificatesInStore",
    "crypt32.dll.CertFreeCertificateChain",
    "crypt32.dll.CertOpenStore",
    "crypt32.dll.CertAddCertificateLinkToStore",
    "crypt32.dll.CertGetCertificateChain",
    "userenv.dll.GetUserProfileDirectoryW",
    "sechost.dll.ConvertSidToStringSidW",
    "sechost.dll.ConvertStringSidToSidW",
    "userenv.dll.RegisterGPNotification",
    "gpapi.dll.RegisterGPNotificationInternal",
    "sechost.dll.QueryServiceConfigW",
    "user32.dll.LoadStringW",
    "ncrypt.dll.BCryptOpenAlgorithmProvider",
    "ncrypt.dll.BCryptGetProperty",
    "ncrypt.dll.BCryptCreateHash",
    "ncrypt.dll.BCryptHashData",
    "ncrypt.dll.BCryptFinishHash",
    "ncrypt.dll.BCryptDestroyHash",
    "cryptsp.dll.CryptAcquireContextA",
    "cryptsp.dll.CryptVerifySignatureA",
    "cryptsp.dll.CryptDestroyKey",
    "cryptnet.dll.CryptRetrieveObjectByUrlW",
    "setupapi.dll.SetupIterateCabinetW",
    "kernel32.dll.RegOpenKeyExW",
    "kernel32.dll.RegCloseKey",
    "cabinet.dll.#20",
    "ncrypt.dll.SslDecrementProviderReferenceCount",
    "cabinet.dll.#22",
    "ncrypt.dll.SslFreeObject",
    "devrtl.dll.DevRtlGetThreadLogToken",
    "cabinet.dll.#23",
    "cryptsp.dll.CryptSetHashParam",
    "sechost.dll.QueryServiceConfigA",
    "rpcrt4.dll.RpcStringBindingComposeA",
    "rpcrt4.dll.RpcBindingFromStringBindingA",
    "rpcrt4.dll.RpcEpResolveBinding",
    "rpcrt4.dll.RpcBindingSetAuthInfoExW",
    "rpcrt4.dll.RpcStringFreeA",
    "rpcrt4.dll.NdrClientCall2",
    "rpcrt4.dll.RpcBindingFree",
    "cryptnet.dll.I_CryptNetGetConnectivity",
    "sensapi.dll.IsNetworkAlive",
    "rpcrt4.dll.RpcBindingFromStringBindingW",
    "winhttp.dll.WinHttpOpen",
    "winhttp.dll.WinHttpSetTimeouts",
    "winhttp.dll.WinHttpSetOption",
    "winhttp.dll.WinHttpCrackUrl",
    "shlwapi.dll.StrCmpNW",
    "winhttp.dll.WinHttpConnect",
    "winhttp.dll.WinHttpOpenRequest",
    "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
    "winhttp.dll.WinHttpTimeFromSystemTime",
    "winhttp.dll.WinHttpSendRequest",
    "ws2_32.dll.GetAddrInfoW",
    "ws2_32.dll.#2",
    "ws2_32.dll.#21",
    "ws2_32.dll.#9",
    "ws2_32.dll.FreeAddrInfoW",
    "ws2_32.dll.#6",
    "ws2_32.dll.#5",
    "ws2_32.dll.WSARecv",
    "ws2_32.dll.WSASend",
    "winhttp.dll.WinHttpReceiveResponse",
    "winhttp.dll.WinHttpQueryHeaders",
    "shlwapi.dll.StrStrIW",
    "winhttp.dll.WinHttpQueryDataAvailable",
    "winhttp.dll.WinHttpReadData",
    "winhttp.dll.WinHttpCloseHandle",
    "cryptnet.dll.I_CryptNetSetUrlCacheFlushInfo",
    "cryptnet.dll.I_CryptNetSetUrlCachePreFetchInfo",
    "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
    "ncrypt.dll.BCryptImportKeyPair",
    "ncrypt.dll.BCryptVerifySignature",
    "ncrypt.dll.BCryptDestroyKey",
    "crypt32.dll.CertDuplicateCertificateChain",
    "mscoree.dll.ND_RU1",
    "crypt32.dll.CertVerifyCertificateChainPolicy",
    "kernel32.dll.SetLastError",
    "vssapi.dll.CreateWriter",
    "advapi32.dll.LookupAccountNameW",
    "samcli.dll.NetLocalGroupGetMembers",
    "samlib.dll.SamConnect",
    "rpcrt4.dll.NdrClientCall3",
    "rpcrt4.dll.RpcStringBindingComposeW",
    "rpcrt4.dll.RpcStringFreeW",
    "samlib.dll.SamOpenDomain",
    "samlib.dll.SamLookupNamesInDomain",
    "samlib.dll.SamOpenAlias",
    "samlib.dll.SamFreeMemory",
    "samlib.dll.SamCloseHandle",
    "samlib.dll.SamGetMembersInAlias",
    "netutils.dll.NetApiBufferFree",
    "samlib.dll.SamEnumerateDomainsInSamServer",
    "samlib.dll.SamLookupDomainInSamServer",
    "ole32.dll.CoCreateGuid",
    "ole32.dll.StringFromCLSID",
    "oleaut32.dll.#4",
    "propsys.dll.VariantToPropVariant",
    "wbemcore.dll.Reinitialize",
    "wbemsvc.dll.DllGetClassObject",
    "wbemsvc.dll.DllCanUnloadNow",
    "authz.dll.AuthzInitializeContextFromToken",
    "authz.dll.AuthzInitializeObjectAccessAuditEvent2",
    "authz.dll.AuthzAccessCheck",
    "authz.dll.AuthzFreeAuditEvent",
    "authz.dll.AuthzFreeContext",
    "authz.dll.AuthzInitializeResourceManager",
    "authz.dll.AuthzFreeResourceManager",
    "rpcrt4.dll.RpcBindingCreateW",
    "rpcrt4.dll.RpcBindingBind",
    "rpcrt4.dll.I_RpcMapWin32Status",
    "advapi32.dll.EventRegister",
    "advapi32.dll.EventUnregister",
    "advapi32.dll.EventWrite",
    "kernel32.dll.RegSetValueExW",
    "kernel32.dll.RegQueryValueExW",
    "wmisvc.dll.IsImproperShutdownDetected",
    "wevtapi.dll.EvtRender",
    "wevtapi.dll.EvtNext",
    "wevtapi.dll.EvtClose",
    "wevtapi.dll.EvtQuery",
    "wevtapi.dll.EvtCreateRenderContext",
    "rpcrt4.dll.RpcBindingSetOption",
    "ole32.dll.CreateStreamOnHGlobal",
    "advapi32.dll.RegSetValueExW",
    "cryptsp.dll.CryptReleaseContext",
    "kernelbase.dll.InitializeAcl",
    "kernelbase.dll.AddAce",
    "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
    "kernel32.dll.IsThreadAFiber",
    "kernel32.dll.OpenProcessToken",
    "kernelbase.dll.GetTokenInformation",
    "kernelbase.dll.DuplicateTokenEx",
    "kernelbase.dll.AdjustTokenPrivileges",
    "kernelbase.dll.AllocateAndInitializeSid",
    "kernelbase.dll.CheckTokenMembership",
    "kernel32.dll.SetThreadToken",
    "oleaut32.dll.#285",
    "advapi32.dll.RegOpenKeyW",
    "oleaut32.dll.#12",
    "oleaut32.dll.#286",
    "ole32.dll.CLSIDFromString",
    "oleaut32.dll.#17",
    "oleaut32.dll.#20",
    "oleaut32.dll.#19",
    "oleaut32.dll.#25",
    "ole32.dll.CoRevertToSelf",
    "advapi32.dll.LogonUserExExW",
    "sspicli.dll.LogonUserExExW",
    "authz.dll.AuthzInitializeContextFromSid",
    "ole32.dll.CoGetCallContext",
    "ole32.dll.CoImpersonateClient",
    "advapi32.dll.OpenThreadToken",
    "oleaut32.dll.#8",
    "ole32.dll.CoSwitchCallContext",
    "oleaut32.dll.#287",
    "oleaut32.dll.#288",
    "oleaut32.dll.#289",
    "kernel32.dll.SortGetHandle",
    "kernel32.dll.SortCloseHandle",
    "ntmarta.dll.GetMartaExtensionInterface",
    "fastprox.dll.DllGetClassObject",
    "fastprox.dll.DllCanUnloadNow",
    "oleaut32.dll.#290",
    "wmi.dll.WmiQueryAllDataW",
    "wmi.dll.WmiQuerySingleInstanceW",
    "wmi.dll.WmiSetSingleItemW",
    "wmi.dll.WmiSetSingleInstanceW",
    "wmi.dll.WmiExecuteMethodW",
    "wmi.dll.WmiNotificationRegistrationW",
    "wmi.dll.WmiMofEnumerateResourcesW",
    "wmi.dll.WmiFileHandleToInstanceNameW",
    "wmi.dll.WmiDevInstToInstanceNameW",
    "wmi.dll.WmiQueryGuidInformation",
    "wmi.dll.WmiOpenBlock",
    "wmi.dll.WmiCloseBlock",
    "wmi.dll.WmiFreeBuffer",
    "wmi.dll.WmiEnumerateGuids",
    "iphlpapi.dll.GetIpForwardTable2",
    "iphlpapi.dll.ConvertLengthToIpv4Mask",
    "iphlpapi.dll.FreeMibTable",
    "advapi32.dll.RegEnumKeyW",
    "iphlpapi.dll.GetAdapterIndex",
    "oleaut32.dll.#15",
    "oleaut32.dll.#26",
    "oleaut32.dll.#16",
    "dnsapi.dll.DnsQueryConfigAllocEx",
    "iphlpapi.dll.GetCurrentThreadCompartmentId",
    "dnsapi.dll.DnsFreeConfigStructure",
    "dnsapi.dll.DnsQueryConfigDword",
    "comctl32.dll.InitCommonControlsEx",
    "shell32.dll.SHGetSpecialFolderPathW",
    "advapi32.dll.CredReadA",
    "advapi32.dll.CredFree",
    "advapi32.dll.CredDeleteA",
    "advapi32.dll.CredEnumerateA",
    "advapi32.dll.CredEnumerateW",
    "pstorec.dll.PStoreCreateInstance",
    "vaultcli.dll.VaultOpenVault",
    "vaultcli.dll.VaultCloseVault",
    "vaultcli.dll.VaultEnumerateItems",
    "vaultcli.dll.VaultFree",
    "vaultcli.dll.VaultGetInformation",
    "vaultcli.dll.VaultGetItem",
    "psapi.dll.GetModuleBaseNameW",
    "psapi.dll.EnumProcessModules",
    "psapi.dll.GetModuleFileNameExW",
    "psapi.dll.GetModuleInformation",
    "kernel32.dll.QueryFullProcessImageNameW",
    "shell32.dll.SHGetSpecialFolderPathA",
    "crypt32.dll.CryptUnprotectData",
    "rpcrt4.dll.UuidFromStringW",
    "radarrs.dll.WdiDiagnosticModuleMain",
    "radarrs.dll.WdiHandleInstance",
    "radarrs.dll.WdiGetDiagnosticModuleInterfaceVersion",
    "version.dll.GetFileVersionInfoSizeW",
    "version.dll.GetFileVersionInfoW",
    "version.dll.VerQueryValueW",
    "advapi32.dll.RegGetValueW",
    "advapi32.dll.DuplicateToken",
    "advapi32.dll.CheckTokenMembership"
]

[*] Static Analysis: {
    "dotnet": {
        "customattrs": null,
        "assemblyinfo": {
            "version": "9.0.0.4",
            "name": "Reborn Stub"
        },
        "assemblyrefs": [
            {
                "version": "2.0.0.0",
                "name": "mscorlib"
            },
            {
                "version": "8.0.0.0",
                "name": "Microsoft.VisualBasic"
            },
            {
                "version": "2.0.0.0",
                "name": "System"
            },
            {
                "version": "2.0.0.0",
                "name": "System.Windows.Forms"
            },
            {
                "version": "2.0.0.0",
                "name": "System.Drawing"
            },
            {
                "version": "2.0.0.0",
                "name": "System.Management"
            },
            {
                "version": "2.0.0.0",
                "name": "System.Xml"
            },
            {
                "version": "0.0.0.0",
                "name": "GpJmmfYBHDiNqFjcVKSNxCwyuuWmA"
            }
        ],
        "typerefs": [
            {
                "typename": "Microsoft.VisualBasic.ApplicationServices.ConsoleApplicationBase",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.ApplicationServices.User",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompareMethod",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.Conversions",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.Operators",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.ProjectData",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.StandardModuleAttribute",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.Utils",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.Devices.Computer",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.HideModuleNameAttribute",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.MyGroupCollectionAttribute",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.Strings",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
                "assembly": "System"
            },
            {
                "typename": "System.Collections.Specialized.NameValueCollection",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.Component",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.Design.HelpKeywordAttribute",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.EditorBrowsableAttribute",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.EditorBrowsableState",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.Win32Exception",
                "assembly": "System"
            },
            {
                "typename": "System.Configuration.ApplicationSettingsBase",
                "assembly": "System"
            },
            {
                "typename": "System.Configuration.SettingsBase",
                "assembly": "System"
            },
            {
                "typename": "System.Diagnostics.Process",
                "assembly": "System"
            },
            {
                "typename": "System.Diagnostics.ProcessModule",
                "assembly": "System"
            },
            {
                "typename": "System.Diagnostics.ProcessStartInfo",
                "assembly": "System"
            },
            {
                "typename": "System.Diagnostics.ProcessThread",
                "assembly": "System"
            },
            {
                "typename": "System.Diagnostics.ProcessThreadCollection",
                "assembly": "System"
            },
            {
                "typename": "System.Diagnostics.ProcessWindowStyle",
                "assembly": "System"
            },
            {
                "typename": "System.Net.Dns",
                "assembly": "System"
            },
            {
                "typename": "System.Net.FtpWebRequest",
                "assembly": "System"
            },
            {
                "typename": "System.Net.FtpWebResponse",
                "assembly": "System"
            },
            {
                "typename": "System.Net.HttpWebRequest",
                "assembly": "System"
            },
            {
                "typename": "System.Net.ICredentials",
                "assembly": "System"
            },
            {
                "typename": "System.Net.ICredentialsByHost",
                "assembly": "System"
            },
            {
                "typename": "System.Net.IPAddress",
                "assembly": "System"
            },
            {
                "typename": "System.Net.IPHostEntry",
                "assembly": "System"
            },
            {
                "typename": "System.Net.Mail.MailAddress",
                "assembly": "System"
            },
            {
                "typename": "System.Net.Mail.MailAddressCollection",
                "assembly": "System"
            },
            {
                "typename": "System.Net.Mail.MailMessage",
                "assembly": "System"
            },
            {
                "typename": "System.Net.Mail.SmtpClient",
                "assembly": "System"
            },
            {
                "typename": "System.Net.NetworkCredential",
                "assembly": "System"
            },
            {
                "typename": "System.Net.NetworkInformation.NetworkInterface",
                "assembly": "System"
            },
            {
                "typename": "System.Net.NetworkInformation.NetworkInterfaceType",
                "assembly": "System"
            },
            {
                "typename": "System.Net.NetworkInformation.OperationalStatus",
                "assembly": "System"
            },
            {
                "typename": "System.Net.Sockets.AddressFamily",
                "assembly": "System"
            },
            {
                "typename": "System.Net.WebClient",
                "assembly": "System"
            },
            {
                "typename": "System.Net.WebException",
                "assembly": "System"
            },
            {
                "typename": "System.Net.WebRequest",
                "assembly": "System"
            },
            {
                "typename": "System.Net.WebResponse",
                "assembly": "System"
            },
            {
                "typename": "System.Text.RegularExpressions.Capture",
                "assembly": "System"
            },
            {
                "typename": "System.Text.RegularExpressions.Group",
                "assembly": "System"
            },
            {
                "typename": "System.Text.RegularExpressions.GroupCollection",
                "assembly": "System"
            },
            {
                "typename": "System.Text.RegularExpressions.Match",
                "assembly": "System"
            },
            {
                "typename": "System.Text.RegularExpressions.Regex",
                "assembly": "System"
            },
            {
                "typename": "System.Drawing.Bitmap",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.CopyPixelOperation",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Graphics",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Image",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Imaging.ImageFormat",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Imaging.PixelFormat",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Rectangle",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Size",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Management.ManagementBaseObject",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.ManagementDateTimeConverter",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.ManagementObject",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.ManagementObjectCollection",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.ManagementObjectCollection/ManagementObjectEnumerator",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.ManagementObjectSearcher",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.PropertyData",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.PropertyDataCollection",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Windows.Forms.Application",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Clipboard",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Control",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.CreateParams",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.DialogResult",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Form",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.IDataObject",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Keys",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Message",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.MessageBox",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.MessageBoxButtons",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.MessageBoxIcon",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.NativeWindow",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Screen",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.SystemInformation",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Xml.XmlReader",
                "assembly": "System.Xml"
            },
            {
                "typename": "Microsoft.Win32.Registry",
                "assembly": "mscorlib"
            },
            {
                "typename": "Microsoft.Win32.RegistryKey",
                "assembly": "mscorlib"
            },
            {
                "typename": "Microsoft.Win32.RegistryValueKind",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Activator",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.AppDomain",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Array",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.AsyncCallback",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Attribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.BitConverter",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Buffer",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Byte",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Char",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Collections.Generic.Dictionary`2",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Collections.Generic.List`1",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Collections.Generic.List`1/Enumerator",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Collections.Hashtable",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Console",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Convert",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.DateTime",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Delegate",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.DebuggableAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.DebuggableAttribute/DebuggingModes",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.Debugger",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.DebuggerHiddenAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.DebuggerNonUserCodeAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Enum",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Environment",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Environment/SpecialFolder",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.EventArgs",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Exception",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.FlagsAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.GC",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Globalization.CultureInfo",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Guid",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IAsyncResult",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IDisposable",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IFormatProvider",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.Directory",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.DirectoryInfo",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.File",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.FileAttributes",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.MemoryStream",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.Path",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.Stream",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.StreamReader",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.StreamWriter",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Int32",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Int64",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IntPtr",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.InvalidOperationException",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Math",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.MidpointRounding",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.MulticastDelegate",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Object",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ParamArrayAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Random",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.Assembly",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyCompanyAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyCopyrightAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyDescriptionAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyFileVersionAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyProductAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyTitleAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyTrademarkAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.DefaultMemberAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.MethodBase",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.MethodInfo",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.TargetInvocationException",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ResolveEventArgs",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ResolveEventHandler",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Resources.ResourceManager",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.AccessedThroughPropertyAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.SuppressIldasmAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.GCHandle",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.GCHandleType",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.GuidAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.Marshal",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.Serialization.Formatters.Binary.BinaryFormatter",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.Serialization.SerializationBinder",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.RuntimeFieldHandle",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.RuntimeTypeHandle",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.STAThreadAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.AccessControlType",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.AceFlags",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.AceQualifier",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.CommonAce",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.DirectorySecurity",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.GenericAce",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.GenericSecurityDescriptor",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.InheritanceFlags",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.ObjectSecurity",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.PropagationFlags",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.RawAcl",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.RawSecurityDescriptor",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.RegistryAccessRule",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.RegistryRights",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.RegistrySecurity",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.CipherMode",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.CryptoStream",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.CryptoStreamMode",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.DESCryptoServiceProvider",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.HashAlgorithm",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.ICryptoTransform",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.MD5",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.MD5CryptoServiceProvider",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.PaddingMode",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.Rfc2898DeriveBytes",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.RijndaelManaged",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.SymmetricAlgorithm",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.IdentityReference",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.NTAccount",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.SecurityIdentifier",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.WellKnownSidType",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.WindowsBuiltInRole",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.WindowsIdentity",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.WindowsPrincipal",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.SuppressUnmanagedCodeSecurityAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.String",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.StringSplitOptions",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Text.ASCIIEncoding",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Text.Encoding",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Text.StringBuilder",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Text.UTF8Encoding",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ThreadStaticAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.ApartmentState",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.Interlocked",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.Monitor",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.Mutex",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.ParameterizedThreadStart",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.Thread",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.ThreadStart",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.TimeSpan",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Type",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.UInt32",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ValueType",
                "assembly": "mscorlib"
            }
        ]
    },
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "_CorExeMain",
                        "address": "0x402000"
                    }
                ],
                "dll": "mscoree.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x00093c1c",
        "overlay": null,
        "imagebase": "0x00400000",
        "reported_checksum": "0x00000000",
        "icon_hash": null,
        "entrypoint": "0x0048b2fe",
        "timestamp": "2019-01-22 15:01:45",
        "osversion": "4.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00002000",
                "size_of_data": "0x00089400",
                "entropy": "6.84",
                "raw_address": "0x00000200",
                "virtual_size": "0x00089304",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x0008c000",
                "size_of_data": "0x00000c00",
                "entropy": "6.62",
                "raw_address": "0x00089600",
                "virtual_size": "0x00000b0c",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".reloc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x0008e000",
                "size_of_data": "0x00000200",
                "entropy": "0.08",
                "raw_address": "0x0008a200",
                "virtual_size": "0x0000000c",
                "characteristics_raw": "0x42000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x0008b2a8",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x00000053"
            },
            {
                "virtual_address": "0x0008c000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x00000b0c"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x0008e000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x0000000c"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00002000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000008"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00002008",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000048"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 1,
        "versioninfo": []
    }
}