API tools faq
paste
paladin316

Exes_c1b751d186679f8ad0cdd436886d39ba_exe.json

paladin316
Jun 19th, 2019
2,166
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 77.34 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_c1b751d186679f8ad0cdd436886d39ba.exe"
  7. [*] File Size: 399360
  8. [*] File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
  9. [*] SHA256: "2f17191b6d77e47ed1d70aeb9d2c6e9242edca423109478efd1b4f72ed6e476d"
  10. [*] MD5: "c1b751d186679f8ad0cdd436886d39ba"
  11. [*] SHA1: "50de8d4e72dd90d0f05868392fcf4169b9204f6d"
  12. [*] SHA512: "6f76d745e02c24b30ce98d3aa004f1cd0a26dbf6893092ec3f322fabd08ff9306ae2b1bc3fa61b5f281f23a35c19f276d308913f67a3479b50ed2429cccb2c3d"
  13. [*] CRC32: "D165B4BA"
  14. [*] SSDEEP: "6144:DNlbkID0ESOMOa0g3NRvTN2VmM9Z1xeo4WVnzQrv5aoa8w9lmM131hYlvX:DNlbRD06MhrTN2EM3eo4WVnkry95A"
  15.  
  16. [*] Process Execution: [
  17. "Exes_c1b751d186679f8ad0cdd436886d39ba.exe",
  18. "Exes_c1b751d186679f8ad0cdd436886d39ba.exe",
  19. "services.exe",
  20. "svchost.exe",
  21. "WmiPrvSE.exe",
  22. "svchost.exe",
  23. "lsass.exe",
  24. "taskhost.exe",
  25. "svchost.exe",
  26. "WerFault.exe"
  27. ]
  28.  
  29. [*] Signatures Detected: [
  30. {
  31. "Description": "At least one process apparently crashed during execution",
  32. "Details": []
  33. },
  34. {
  35. "Description": "Creates RWX memory",
  36. "Details": []
  37. },
  38. {
  39. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  40. "Details": [
  41. {
  42. "get_no_useragent": "HTTP traffic contains a GET request with no user-agent header"
  43. },
  44. {
  45. "suspicious_request": "http://checkip.amazonaws.com/"
  46. }
  47. ]
  48. },
  49. {
  50. "Description": "Performs some HTTP requests",
  51. "Details": [
  52. {
  53. "url": "http://checkip.amazonaws.com/"
  54. }
  55. ]
  56. },
  57. {
  58. "Description": "The binary likely contains encrypted or compressed data.",
  59. "Details": [
  60. {
  61. "section": "name: .text, entropy: 7.92, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00060e00, virtual_size: 0x00060de4"
  62. }
  63. ]
  64. },
  65. {
  66. "Description": "Executed a process and injected code into it, probably while unpacking",
  67. "Details": [
  68. {
  69. "Injection": "Exes_c1b751d186679f8ad0cdd436886d39ba.exe(2360) -> Exes_c1b751d186679f8ad0cdd436886d39ba.exe(2660)"
  70. }
  71. ]
  72. },
  73. {
  74. "Description": "Sniffs keystrokes",
  75. "Details": [
  76. {
  77. "SetWindowsHookExW": "Process: Exes_c1b751d186679f8ad0cdd436886d39ba.exe(2660)"
  78. }
  79. ]
  80. },
  81. {
  82. "Description": "Attempts to restart the guest VM",
  83. "Details": []
  84. },
  85. {
  86. "Description": "A process attempted to delay the analysis task by a long amount of time.",
  87. "Details": [
  88. {
  89. "Process": "WmiPrvSE.exe tried to sleep 721 seconds, actually delayed analysis time by 0 seconds"
  90. },
  91. {
  92. "Process": "Exes_c1b751d186679f8ad0cdd436886d39ba.exe tried to sleep 2355 seconds, actually delayed analysis time by 0 seconds"
  93. }
  94. ]
  95. },
  96. {
  97. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  98. "Details": [
  99. {
  100. "Spam": "services.exe (504) called API GetSystemTimeAsFileTime 9047017 times"
  101. }
  102. ]
  103. },
  104. {
  105. "Description": "Steals private information from local Internet browsers",
  106. "Details": [
  107. {
  108. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
  109. }
  110. ]
  111. },
  112. {
  113. "Description": "Retrieves Windows ProductID, probably to fingerprint the sandbox",
  114. "Details": []
  115. },
  116. {
  117. "Description": "File has been identified by 11 Antiviruses on VirusTotal as malicious",
  118. "Details": [
  119. {
  120. "FireEye": "Generic.mg.c1b751d186679f8a"
  121. },
  122. {
  123. "Cylance": "Unsafe"
  124. },
  125. {
  126. "APEX": "Malicious"
  127. },
  128. {
  129. "Invincea": "heuristic"
  130. },
  131. {
  132. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.fc"
  133. },
  134. {
  135. "Trapmine": "malicious.high.ml.score"
  136. },
  137. {
  138. "SentinelOne": "DFI - Malicious PE"
  139. },
  140. {
  141. "Acronis": "suspicious"
  142. },
  143. {
  144. "VBA32": "CIL.StupidCryptor.Heur"
  145. },
  146. {
  147. "Cybereason": "malicious.e72dd9"
  148. },
  149. {
  150. "CrowdStrike": "win/malicious_confidence_70% (D)"
  151. }
  152. ]
  153. },
  154. {
  155. "Description": "Checks the CPU name from registry, possibly for anti-virtualization",
  156. "Details": []
  157. },
  158. {
  159. "Description": "Harvests credentials from local FTP client softwares",
  160. "Details": [
  161. {
  162. "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\recentservers.xml"
  163. },
  164. {
  165. "file": "C:\\Users\\user\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\"
  166. },
  167. {
  168. "file": "C:\\Users\\user\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\*.xml"
  169. },
  170. {
  171. "file": "C:\\Users\\user\\AppData\\Roaming\\Ipswitch\\WS_FTP\\Sites\\ws_ftp.ini"
  172. },
  173. {
  174. "file": "C:\\cftp\\Ftplist.txt"
  175. },
  176. {
  177. "key": "HKEY_CURRENT_USER\\Software\\FTPWare\\COREFTP\\Sites"
  178. }
  179. ]
  180. },
  181. {
  182. "Description": "Harvests information related to installed mail clients",
  183. "Details": [
  184. {
  185. "file": "C:\\Users\\user\\AppData\\Roaming\\Thunderbird\\profiles.ini"
  186. },
  187. {
  188. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676"
  189. },
  190. {
  191. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  192. },
  193. {
  194. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Password"
  195. },
  196. {
  197. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\Email"
  198. },
  199. {
  200. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTP Password"
  201. },
  202. {
  203. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  204. },
  205. {
  206. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTP Password"
  207. },
  208. {
  209. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  210. },
  211. {
  212. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Password"
  213. },
  214. {
  215. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\Email"
  216. },
  217. {
  218. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Password"
  219. },
  220. {
  221. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Password"
  222. },
  223. {
  224. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
  225. },
  226. {
  227. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Password"
  228. },
  229. {
  230. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Password"
  231. },
  232. {
  233. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
  234. }
  235. ]
  236. },
  237. {
  238. "Description": "Collects information to fingerprint the system",
  239. "Details": []
  240. }
  241. ]
  242.  
  243. [*] Started Service: [
  244. "VaultSvc",
  245. "WerSvc"
  246. ]
  247.  
  248. [*] Executed Commands: [
  249. "\"C:\\Users\\user\\AppData\\Local\\Temp\\Exes_c1b751d186679f8ad0cdd436886d39ba.exe\"",
  250. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding",
  251. "C:\\Windows\\system32\\lsass.exe",
  252. "taskhost.exe $(Arg0)",
  253. "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
  254. "C:\\Windows\\system32\\WerFault.exe -u -p 3064 -s 288"
  255. ]
  256.  
  257. [*] Mutexes: [
  258. "Global\\CLR_CASOFF_MUTEX",
  259. "Local\\_!MSFTHISTORY!_",
  260. "Local\\c:!users!user!appdata!local!microsoft!windows!temporary internet files!content.ie5!",
  261. "Local\\c:!users!user!appdata!roaming!microsoft!windows!cookies!",
  262. "Local\\c:!users!user!appdata!local!microsoft!windows!history!history.ie5!",
  263. "Global\\.net clr networking",
  264. "Local\\WERReportingForProcess3064"
  265. ]
  266.  
  267. [*] Modified Files: [
  268. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
  269. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
  270. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat",
  271. "\\??\\PIPE\\samr",
  272. "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
  273. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
  274. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
  275. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
  276. "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
  277. "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
  278. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  279. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
  280. "\\??\\WMIDataDevice",
  281. "\\??\\PIPE\\wkssvc",
  282. "\\??\\PIPE\\srvsvc",
  283. "\\??\\PHYSICALDRIVE0",
  284. "\\??\\CDROM0",
  285. "\\??\\PIPE\\lsarpc",
  286. "C:\\Windows\\sysnative\\LogFiles\\Scm\\4963ad21-c4a5-42a5-b9bd-e441d57204fe",
  287. "C:\\Windows\\sysnative\\LogFiles\\Scm\\8025ccaa-ad7f-4905-97ea-947c2c48c87f"
  288. ]
  289.  
  290. [*] Deleted Files: [
  291. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2360.7338500",
  292. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2360.7338500",
  293. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2360.7338500"
  294. ]
  295.  
  296. [*] Modified Registry Keys: [
  297. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\Exes_c1b751d186679f8ad0cdd436886d39ba_RASAPI32",
  298. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Exes_c1b751d186679f8ad0cdd436886d39ba_RASAPI32\\EnableFileTracing",
  299. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Exes_c1b751d186679f8ad0cdd436886d39ba_RASAPI32\\EnableConsoleTracing",
  300. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Exes_c1b751d186679f8ad0cdd436886d39ba_RASAPI32\\FileTracingMask",
  301. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Exes_c1b751d186679f8ad0cdd436886d39ba_RASAPI32\\ConsoleTracingMask",
  302. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Exes_c1b751d186679f8ad0cdd436886d39ba_RASAPI32\\MaxFileSize",
  303. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Exes_c1b751d186679f8ad0cdd436886d39ba_RASAPI32\\FileDirectory",
  304. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  305. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
  306. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
  307. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
  308. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
  309. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
  310. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
  311. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider",
  312. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WerSvc\\Type"
  313. ]
  314.  
  315. [*] Deleted Registry Keys: []
  316.  
  317. [*] DNS Communications: [
  318. {
  319. "type": "A",
  320. "request": "checkip.amazonaws.com",
  321. "answers": [
  322. {
  323. "data": "52.206.161.133",
  324. "type": "A"
  325. },
  326. {
  327. "data": "52.200.125.74",
  328. "type": "A"
  329. },
  330. {
  331. "data": "checkip.check-ip.aws.a2z.com",
  332. "type": "CNAME"
  333. },
  334. {
  335. "data": "52.6.79.229",
  336. "type": "A"
  337. },
  338. {
  339. "data": "checkip.us-east-1.prod.check-ip.aws.a2z.com",
  340. "type": "CNAME"
  341. },
  342. {
  343. "data": "34.233.102.38",
  344. "type": "A"
  345. },
  346. {
  347. "data": "52.202.139.131",
  348. "type": "A"
  349. },
  350. {
  351. "data": "18.211.215.84",
  352. "type": "A"
  353. }
  354. ]
  355. }
  356. ]
  357.  
  358. [*] Domains: [
  359. {
  360. "ip": "52.6.79.229",
  361. "domain": "checkip.amazonaws.com"
  362. }
  363. ]
  364.  
  365. [*] Network Communication - ICMP: []
  366.  
  367. [*] Network Communication - HTTP: [
  368. {
  369. "count": 1,
  370. "body": "",
  371. "uri": "http://checkip.amazonaws.com/",
  372. "user-agent": "",
  373. "method": "GET",
  374. "host": "checkip.amazonaws.com",
  375. "version": "1.1",
  376. "path": "/",
  377. "data": "GET / HTTP/1.1\r\nHost: checkip.amazonaws.com\r\nConnection: Keep-Alive\r\n\r\n",
  378. "port": 80
  379. }
  380. ]
  381.  
  382. [*] Network Communication - SMTP: []
  383.  
  384. [*] Network Communication - Hosts: []
  385.  
  386. [*] Network Communication - IRC: []
  387.  
  388. [*] Static Analysis: {
  389. "dotnet": {
  390. "customattrs": null,
  391. "assemblyinfo": {
  392. "version": "10.10.9.14",
  393. "name": "1LJcbCK5MBNAI1a32BqtJFLT2kw7VFS"
  394. },
  395. "assemblyrefs": [
  396. {
  397. "version": "2.0.0.0",
  398. "name": "mscorlib"
  399. },
  400. {
  401. "version": "2.0.0.0",
  402. "name": "System.Drawing"
  403. },
  404. {
  405. "version": "2.0.0.0",
  406. "name": "System"
  407. },
  408. {
  409. "version": "2.0.0.0",
  410. "name": "System.Windows.Forms"
  411. },
  412. {
  413. "version": "8.0.0.0",
  414. "name": "Microsoft.VisualBasic"
  415. }
  416. ],
  417. "typerefs": [
  418. {
  419. "typename": "Microsoft.VisualBasic.CallType",
  420. "assembly": "Microsoft.VisualBasic"
  421. },
  422. {
  423. "typename": "Microsoft.VisualBasic.Interaction",
  424. "assembly": "Microsoft.VisualBasic"
  425. },
  426. {
  427. "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
  428. "assembly": "System"
  429. },
  430. {
  431. "typename": "System.ComponentModel.BrowsableAttribute",
  432. "assembly": "System"
  433. },
  434. {
  435. "typename": "System.ComponentModel.CategoryAttribute",
  436. "assembly": "System"
  437. },
  438. {
  439. "typename": "System.ComponentModel.DefaultEventAttribute",
  440. "assembly": "System"
  441. },
  442. {
  443. "typename": "System.ComponentModel.DefaultValueAttribute",
  444. "assembly": "System"
  445. },
  446. {
  447. "typename": "System.ComponentModel.EditorBrowsableAttribute",
  448. "assembly": "System"
  449. },
  450. {
  451. "typename": "System.ComponentModel.EditorBrowsableState",
  452. "assembly": "System"
  453. },
  454. {
  455. "typename": "System.ComponentModel.IContainer",
  456. "assembly": "System"
  457. },
  458. {
  459. "typename": "System.ComponentModel.ISupportInitialize",
  460. "assembly": "System"
  461. },
  462. {
  463. "typename": "System.Configuration.ApplicationSettingsBase",
  464. "assembly": "System"
  465. },
  466. {
  467. "typename": "System.Configuration.SettingsBase",
  468. "assembly": "System"
  469. },
  470. {
  471. "typename": "System.Diagnostics.Process",
  472. "assembly": "System"
  473. },
  474. {
  475. "typename": "System.Drawing.Bitmap",
  476. "assembly": "System.Drawing"
  477. },
  478. {
  479. "typename": "System.Drawing.Brush",
  480. "assembly": "System.Drawing"
  481. },
  482. {
  483. "typename": "System.Drawing.Color",
  484. "assembly": "System.Drawing"
  485. },
  486. {
  487. "typename": "System.Drawing.Drawing2D.GraphicsPath",
  488. "assembly": "System.Drawing"
  489. },
  490. {
  491. "typename": "System.Drawing.Drawing2D.LinearGradientBrush",
  492. "assembly": "System.Drawing"
  493. },
  494. {
  495. "typename": "System.Drawing.Drawing2D.Matrix",
  496. "assembly": "System.Drawing"
  497. },
  498. {
  499. "typename": "System.Drawing.Drawing2D.PixelOffsetMode",
  500. "assembly": "System.Drawing"
  501. },
  502. {
  503. "typename": "System.Drawing.Drawing2D.SmoothingMode",
  504. "assembly": "System.Drawing"
  505. },
  506. {
  507. "typename": "System.Drawing.Drawing2D.WrapMode",
  508. "assembly": "System.Drawing"
  509. },
  510. {
  511. "typename": "System.Drawing.Font",
  512. "assembly": "System.Drawing"
  513. },
  514. {
  515. "typename": "System.Drawing.FontFamily",
  516. "assembly": "System.Drawing"
  517. },
  518. {
  519. "typename": "System.Drawing.FontStyle",
  520. "assembly": "System.Drawing"
  521. },
  522. {
  523. "typename": "System.Drawing.Graphics",
  524. "assembly": "System.Drawing"
  525. },
  526. {
  527. "typename": "System.Drawing.GraphicsUnit",
  528. "assembly": "System.Drawing"
  529. },
  530. {
  531. "typename": "System.Drawing.Icon",
  532. "assembly": "System.Drawing"
  533. },
  534. {
  535. "typename": "System.Drawing.Image",
  536. "assembly": "System.Drawing"
  537. },
  538. {
  539. "typename": "System.Drawing.Imaging.ColorMatrix",
  540. "assembly": "System.Drawing"
  541. },
  542. {
  543. "typename": "System.Drawing.Imaging.ImageAttributes",
  544. "assembly": "System.Drawing"
  545. },
  546. {
  547. "typename": "System.Drawing.Pen",
  548. "assembly": "System.Drawing"
  549. },
  550. {
  551. "typename": "System.Drawing.Point",
  552. "assembly": "System.Drawing"
  553. },
  554. {
  555. "typename": "System.Drawing.PointF",
  556. "assembly": "System.Drawing"
  557. },
  558. {
  559. "typename": "System.Drawing.Rectangle",
  560. "assembly": "System.Drawing"
  561. },
  562. {
  563. "typename": "System.Drawing.RectangleF",
  564. "assembly": "System.Drawing"
  565. },
  566. {
  567. "typename": "System.Drawing.Size",
  568. "assembly": "System.Drawing"
  569. },
  570. {
  571. "typename": "System.Drawing.SizeF",
  572. "assembly": "System.Drawing"
  573. },
  574. {
  575. "typename": "System.Drawing.SolidBrush",
  576. "assembly": "System.Drawing"
  577. },
  578. {
  579. "typename": "System.Drawing.SystemColors",
  580. "assembly": "System.Drawing"
  581. },
  582. {
  583. "typename": "System.Drawing.SystemIcons",
  584. "assembly": "System.Drawing"
  585. },
  586. {
  587. "typename": "System.Drawing.Text.TextRenderingHint",
  588. "assembly": "System.Drawing"
  589. },
  590. {
  591. "typename": "System.Windows.Forms.AnchorStyles",
  592. "assembly": "System.Windows.Forms"
  593. },
  594. {
  595. "typename": "System.Windows.Forms.AutoScaleMode",
  596. "assembly": "System.Windows.Forms"
  597. },
  598. {
  599. "typename": "System.Windows.Forms.Button",
  600. "assembly": "System.Windows.Forms"
  601. },
  602. {
  603. "typename": "System.Windows.Forms.ButtonBase",
  604. "assembly": "System.Windows.Forms"
  605. },
  606. {
  607. "typename": "System.Windows.Forms.ContainerControl",
  608. "assembly": "System.Windows.Forms"
  609. },
  610. {
  611. "typename": "System.Windows.Forms.Control",
  612. "assembly": "System.Windows.Forms"
  613. },
  614. {
  615. "typename": "System.Windows.Forms.Control/ControlCollection",
  616. "assembly": "System.Windows.Forms"
  617. },
  618. {
  619. "typename": "System.Windows.Forms.Cursor",
  620. "assembly": "System.Windows.Forms"
  621. },
  622. {
  623. "typename": "System.Windows.Forms.DialogResult",
  624. "assembly": "System.Windows.Forms"
  625. },
  626. {
  627. "typename": "System.Windows.Forms.Form",
  628. "assembly": "System.Windows.Forms"
  629. },
  630. {
  631. "typename": "System.Windows.Forms.FormBorderStyle",
  632. "assembly": "System.Windows.Forms"
  633. },
  634. {
  635. "typename": "System.Windows.Forms.FormStartPosition",
  636. "assembly": "System.Windows.Forms"
  637. },
  638. {
  639. "typename": "System.Windows.Forms.KeyPressEventArgs",
  640. "assembly": "System.Windows.Forms"
  641. },
  642. {
  643. "typename": "System.Windows.Forms.Keys",
  644. "assembly": "System.Windows.Forms"
  645. },
  646. {
  647. "typename": "System.Windows.Forms.Label",
  648. "assembly": "System.Windows.Forms"
  649. },
  650. {
  651. "typename": "System.Windows.Forms.LinkLabel",
  652. "assembly": "System.Windows.Forms"
  653. },
  654. {
  655. "typename": "System.Windows.Forms.LinkLabelLinkClickedEventArgs",
  656. "assembly": "System.Windows.Forms"
  657. },
  658. {
  659. "typename": "System.Windows.Forms.LinkLabelLinkClickedEventHandler",
  660. "assembly": "System.Windows.Forms"
  661. },
  662. {
  663. "typename": "System.Windows.Forms.MessageBox",
  664. "assembly": "System.Windows.Forms"
  665. },
  666. {
  667. "typename": "System.Windows.Forms.MouseEventArgs",
  668. "assembly": "System.Windows.Forms"
  669. },
  670. {
  671. "typename": "System.Windows.Forms.PaintEventArgs",
  672. "assembly": "System.Windows.Forms"
  673. },
  674. {
  675. "typename": "System.Windows.Forms.PictureBox",
  676. "assembly": "System.Windows.Forms"
  677. },
  678. {
  679. "typename": "System.Windows.Forms.PictureBoxSizeMode",
  680. "assembly": "System.Windows.Forms"
  681. },
  682. {
  683. "typename": "System.Windows.Forms.UserControl",
  684. "assembly": "System.Windows.Forms"
  685. },
  686. {
  687. "typename": "System.Array",
  688. "assembly": "mscorlib"
  689. },
  690. {
  691. "typename": "System.Buffer",
  692. "assembly": "mscorlib"
  693. },
  694. {
  695. "typename": "System.Byte",
  696. "assembly": "mscorlib"
  697. },
  698. {
  699. "typename": "System.Collections.Generic.IEnumerable`1",
  700. "assembly": "mscorlib"
  701. },
  702. {
  703. "typename": "System.Collections.Generic.List`1",
  704. "assembly": "mscorlib"
  705. },
  706. {
  707. "typename": "System.Convert",
  708. "assembly": "mscorlib"
  709. },
  710. {
  711. "typename": "System.Diagnostics.DebuggableAttribute",
  712. "assembly": "mscorlib"
  713. },
  714. {
  715. "typename": "System.Diagnostics.DebuggableAttribute/DebuggingModes",
  716. "assembly": "mscorlib"
  717. },
  718. {
  719. "typename": "System.Diagnostics.DebuggerNonUserCodeAttribute",
  720. "assembly": "mscorlib"
  721. },
  722. {
  723. "typename": "System.Enum",
  724. "assembly": "mscorlib"
  725. },
  726. {
  727. "typename": "System.EventArgs",
  728. "assembly": "mscorlib"
  729. },
  730. {
  731. "typename": "System.EventHandler",
  732. "assembly": "mscorlib"
  733. },
  734. {
  735. "typename": "System.Globalization.CultureInfo",
  736. "assembly": "mscorlib"
  737. },
  738. {
  739. "typename": "System.IDisposable",
  740. "assembly": "mscorlib"
  741. },
  742. {
  743. "typename": "System.Math",
  744. "assembly": "mscorlib"
  745. },
  746. {
  747. "typename": "System.Object",
  748. "assembly": "mscorlib"
  749. },
  750. {
  751. "typename": "System.Reflection.Assembly",
  752. "assembly": "mscorlib"
  753. },
  754. {
  755. "typename": "System.Reflection.AssemblyCompanyAttribute",
  756. "assembly": "mscorlib"
  757. },
  758. {
  759. "typename": "System.Reflection.AssemblyConfigurationAttribute",
  760. "assembly": "mscorlib"
  761. },
  762. {
  763. "typename": "System.Reflection.AssemblyCopyrightAttribute",
  764. "assembly": "mscorlib"
  765. },
  766. {
  767. "typename": "System.Reflection.AssemblyDescriptionAttribute",
  768. "assembly": "mscorlib"
  769. },
  770. {
  771. "typename": "System.Reflection.AssemblyFileVersionAttribute",
  772. "assembly": "mscorlib"
  773. },
  774. {
  775. "typename": "System.Reflection.AssemblyProductAttribute",
  776. "assembly": "mscorlib"
  777. },
  778. {
  779. "typename": "System.Reflection.AssemblyTitleAttribute",
  780. "assembly": "mscorlib"
  781. },
  782. {
  783. "typename": "System.Reflection.AssemblyTrademarkAttribute",
  784. "assembly": "mscorlib"
  785. },
  786. {
  787. "typename": "System.Resources.ResourceManager",
  788. "assembly": "mscorlib"
  789. },
  790. {
  791. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  792. "assembly": "mscorlib"
  793. },
  794. {
  795. "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
  796. "assembly": "mscorlib"
  797. },
  798. {
  799. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  800. "assembly": "mscorlib"
  801. },
  802. {
  803. "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
  804. "assembly": "mscorlib"
  805. },
  806. {
  807. "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
  808. "assembly": "mscorlib"
  809. },
  810. {
  811. "typename": "System.Runtime.InteropServices.GuidAttribute",
  812. "assembly": "mscorlib"
  813. },
  814. {
  815. "typename": "System.RuntimeFieldHandle",
  816. "assembly": "mscorlib"
  817. },
  818. {
  819. "typename": "System.RuntimeTypeHandle",
  820. "assembly": "mscorlib"
  821. },
  822. {
  823. "typename": "System.Single",
  824. "assembly": "mscorlib"
  825. },
  826. {
  827. "typename": "System.String",
  828. "assembly": "mscorlib"
  829. },
  830. {
  831. "typename": "System.Text.Encoding",
  832. "assembly": "mscorlib"
  833. },
  834. {
  835. "typename": "System.Type",
  836. "assembly": "mscorlib"
  837. },
  838. {
  839. "typename": "System.ValueType",
  840. "assembly": "mscorlib"
  841. }
  842. ]
  843. },
  844. "pe": {
  845. "peid_signatures": null,
  846. "imports": [
  847. {
  848. "imports": [
  849. {
  850. "name": "_CorExeMain",
  851. "address": "0x402000"
  852. }
  853. ],
  854. "dll": "mscoree.dll"
  855. }
  856. ],
  857. "digital_signers": null,
  858. "exported_dll_name": null,
  859. "actual_checksum": "0x0006cb04",
  860. "overlay": null,
  861. "imagebase": "0x00400000",
  862. "reported_checksum": "0x00000000",
  863. "icon_hash": null,
  864. "entrypoint": "0x00462dde",
  865. "timestamp": "2019-06-18 09:24:18",
  866. "osversion": "4.0",
  867. "sections": [
  868. {
  869. "name": ".text",
  870. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  871. "virtual_address": "0x00002000",
  872. "size_of_data": "0x00060e00",
  873. "entropy": "7.92",
  874. "raw_address": "0x00000200",
  875. "virtual_size": "0x00060de4",
  876. "characteristics_raw": "0x60000020"
  877. },
  878. {
  879. "name": ".rsrc",
  880. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  881. "virtual_address": "0x00064000",
  882. "size_of_data": "0x00000600",
  883. "entropy": "4.12",
  884. "raw_address": "0x00061000",
  885. "virtual_size": "0x000005b6",
  886. "characteristics_raw": "0x40000040"
  887. },
  888. {
  889. "name": ".reloc",
  890. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  891. "virtual_address": "0x00066000",
  892. "size_of_data": "0x00000200",
  893. "entropy": "0.10",
  894. "raw_address": "0x00061600",
  895. "virtual_size": "0x0000000c",
  896. "characteristics_raw": "0x42000040"
  897. }
  898. ],
  899. "resources": [],
  900. "dirents": [
  901. {
  902. "virtual_address": "0x00000000",
  903. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  904. "size": "0x00000000"
  905. },
  906. {
  907. "virtual_address": "0x00062d8c",
  908. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  909. "size": "0x0000004f"
  910. },
  911. {
  912. "virtual_address": "0x00064000",
  913. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  914. "size": "0x000005b6"
  915. },
  916. {
  917. "virtual_address": "0x00000000",
  918. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  919. "size": "0x00000000"
  920. },
  921. {
  922. "virtual_address": "0x00000000",
  923. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  924. "size": "0x00000000"
  925. },
  926. {
  927. "virtual_address": "0x00066000",
  928. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  929. "size": "0x0000000c"
  930. },
  931. {
  932. "virtual_address": "0x00000000",
  933. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  934. "size": "0x00000000"
  935. },
  936. {
  937. "virtual_address": "0x00000000",
  938. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  939. "size": "0x00000000"
  940. },
  941. {
  942. "virtual_address": "0x00000000",
  943. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  944. "size": "0x00000000"
  945. },
  946. {
  947. "virtual_address": "0x00000000",
  948. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  949. "size": "0x00000000"
  950. },
  951. {
  952. "virtual_address": "0x00000000",
  953. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  954. "size": "0x00000000"
  955. },
  956. {
  957. "virtual_address": "0x00000000",
  958. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  959. "size": "0x00000000"
  960. },
  961. {
  962. "virtual_address": "0x00002000",
  963. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  964. "size": "0x00000008"
  965. },
  966. {
  967. "virtual_address": "0x00000000",
  968. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  969. "size": "0x00000000"
  970. },
  971. {
  972. "virtual_address": "0x00002008",
  973. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  974. "size": "0x00000048"
  975. },
  976. {
  977. "virtual_address": "0x00000000",
  978. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  979. "size": "0x00000000"
  980. }
  981. ],
  982. "exports": [],
  983. "guest_signers": {},
  984. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  985. "icon_fuzzy": null,
  986. "icon": null,
  987. "pdbpath": null,
  988. "imported_dll_count": 1,
  989. "versioninfo": []
  990. }
  991. }
  992.  
  993. [*] Resolved APIs: [
  994. "advapi32.dll.RegOpenKeyExW",
  995. "advapi32.dll.RegQueryInfoKeyW",
  996. "advapi32.dll.RegEnumKeyExW",
  997. "advapi32.dll.RegEnumValueW",
  998. "advapi32.dll.RegCloseKey",
  999. "advapi32.dll.RegQueryValueExW",
  1000. "kernel32.dll.QueryActCtxW",
  1001. "shlwapi.dll.UrlIsW",
  1002. "kernel32.dll.FlsAlloc",
  1003. "kernel32.dll.FlsGetValue",
  1004. "kernel32.dll.FlsSetValue",
  1005. "kernel32.dll.FlsFree",
  1006. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  1007. "kernel32.dll.IsProcessorFeaturePresent",
  1008. "msvcrt.dll._set_error_mode",
  1009. "msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z",
  1010. "kernel32.dll.FindActCtxSectionStringW",
  1011. "kernel32.dll.GetSystemWindowsDirectoryW",
  1012. "mscoree.dll.GetProcessExecutableHeap",
  1013. "mscorwks.dll._CorExeMain",
  1014. "mscorwks.dll.GetCLRFunction",
  1015. "advapi32.dll.RegisterTraceGuidsW",
  1016. "advapi32.dll.UnregisterTraceGuids",
  1017. "advapi32.dll.GetTraceLoggerHandle",
  1018. "advapi32.dll.GetTraceEnableLevel",
  1019. "advapi32.dll.GetTraceEnableFlags",
  1020. "advapi32.dll.TraceEvent",
  1021. "mscoree.dll.IEE",
  1022. "mscorwks.dll.IEE",
  1023. "mscoree.dll.GetStartupFlags",
  1024. "mscoree.dll.GetHostConfigurationFile",
  1025. "mscoree.dll.GetCORSystemDirectory",
  1026. "ntdll.dll.RtlUnwind",
  1027. "kernel32.dll.IsWow64Process",
  1028. "advapi32.dll.AllocateAndInitializeSid",
  1029. "advapi32.dll.OpenProcessToken",
  1030. "advapi32.dll.GetTokenInformation",
  1031. "advapi32.dll.InitializeAcl",
  1032. "advapi32.dll.AddAccessAllowedAce",
  1033. "advapi32.dll.FreeSid",
  1034. "kernel32.dll.SetThreadStackGuarantee",
  1035. "kernel32.dll.AddVectoredContinueHandler",
  1036. "kernel32.dll.RemoveVectoredContinueHandler",
  1037. "advapi32.dll.ConvertSidToStringSidW",
  1038. "shell32.dll.SHGetFolderPathW",
  1039. "kernel32.dll.FlushProcessWriteBuffers",
  1040. "kernel32.dll.GetWriteWatch",
  1041. "kernel32.dll.ResetWriteWatch",
  1042. "kernel32.dll.CreateMemoryResourceNotification",
  1043. "kernel32.dll.QueryMemoryResourceNotification",
  1044. "ole32.dll.CoInitializeEx",
  1045. "cryptbase.dll.SystemFunction036",
  1046. "ole32.dll.CoGetContextToken",
  1047. "kernel32.dll.GetFullPathNameW",
  1048. "kernel32.dll.GetVersionExW",
  1049. "advapi32.dll.CryptAcquireContextA",
  1050. "advapi32.dll.CryptReleaseContext",
  1051. "advapi32.dll.CryptCreateHash",
  1052. "advapi32.dll.CryptDestroyHash",
  1053. "advapi32.dll.CryptHashData",
  1054. "advapi32.dll.CryptGetHashParam",
  1055. "advapi32.dll.CryptImportKey",
  1056. "advapi32.dll.CryptExportKey",
  1057. "advapi32.dll.CryptGenKey",
  1058. "advapi32.dll.CryptGetKeyParam",
  1059. "advapi32.dll.CryptDestroyKey",
  1060. "advapi32.dll.CryptVerifySignatureA",
  1061. "advapi32.dll.CryptSignHashA",
  1062. "advapi32.dll.CryptGetProvParam",
  1063. "advapi32.dll.CryptGetUserKey",
  1064. "advapi32.dll.CryptEnumProvidersA",
  1065. "mscoree.dll.GetMetaDataInternalInterface",
  1066. "mscorwks.dll.GetMetaDataInternalInterface",
  1067. "mscorjit.dll.getJit",
  1068. "kernel32.dll.GetACP",
  1069. "kernel32.dll.GetUserDefaultUILanguage",
  1070. "kernel32.dll.UnmapViewOfFile",
  1071. "kernel32.dll.CloseHandle",
  1072. "kernel32.dll.SetErrorMode",
  1073. "kernel32.dll.GetFileAttributesExW",
  1074. "culture.dll.ConvertLangIdToCultureName",
  1075. "kernel32.dll.GetCurrentProcessId",
  1076. "kernel32.dll.FindAtomW",
  1077. "kernel32.dll.AddAtomW",
  1078. "mscoree.dll.LoadLibraryShim",
  1079. "gdiplus.dll.GdiplusStartup",
  1080. "user32.dll.GetWindowInfo",
  1081. "user32.dll.GetAncestor",
  1082. "user32.dll.GetMonitorInfoA",
  1083. "user32.dll.EnumDisplayMonitors",
  1084. "user32.dll.EnumDisplayDevicesA",
  1085. "gdi32.dll.ExtTextOutW",
  1086. "gdi32.dll.GdiIsMetaPrintDC",
  1087. "gdiplus.dll.GdipLoadImageFromStream",
  1088. "windowscodecs.dll.DllGetClassObject",
  1089. "kernel32.dll.WerRegisterMemoryBlock",
  1090. "gdiplus.dll.GdipImageForceValidation",
  1091. "gdiplus.dll.GdipGetImageType",
  1092. "gdiplus.dll.GdipGetImageRawFormat",
  1093. "gdiplus.dll.GdipGetImageWidth",
  1094. "gdiplus.dll.GdipGetImageHeight",
  1095. "gdiplus.dll.GdipBitmapGetPixel",
  1096. "gdiplus.dll.GdipDisposeImage",
  1097. "kernel32.dll.GlobalMemoryStatusEx",
  1098. "kernel32.dll.SwitchToThread",
  1099. "advapi32.dll.LookupPrivilegeValueW",
  1100. "kernel32.dll.GetCurrentProcess",
  1101. "advapi32.dll.AdjustTokenPrivileges",
  1102. "kernel32.dll.OpenProcess",
  1103. "kernel32.dll.GetExitCodeProcess",
  1104. "advapi32.dll.GetKernelObjectSecurity",
  1105. "advapi32.dll.CreateWellKnownSid",
  1106. "advapi32.dll.SetKernelObjectSecurity",
  1107. "kernel32.dll.IsDebuggerPresent",
  1108. "kernel32.dll.lstrlen",
  1109. "kernel32.dll.lstrlenW",
  1110. "kernel32.dll.CreateProcessW",
  1111. "kernel32.dll.GetThreadContext",
  1112. "kernel32.dll.ReadProcessMemory",
  1113. "kernel32.dll.VirtualAllocEx",
  1114. "kernel32.dll.WriteProcessMemory",
  1115. "kernel32.dll.SetThreadContext",
  1116. "kernel32.dll.ResumeThread",
  1117. "psapi.dll.EnumProcesses",
  1118. "kernel32.dll.DeleteAtom",
  1119. "ole32.dll.CoUninitialize",
  1120. "kernel32.dll.CreateActCtxW",
  1121. "kernel32.dll.AddRefActCtx",
  1122. "kernel32.dll.ReleaseActCtx",
  1123. "kernel32.dll.ActivateActCtx",
  1124. "kernel32.dll.DeactivateActCtx",
  1125. "kernel32.dll.GetCurrentActCtx",
  1126. "uxtheme.dll.ThemeInitApiHook",
  1127. "user32.dll.IsProcessDPIAware",
  1128. "kernel32.dll.VirtualProtect",
  1129. "kernel32.dll.GetEnvironmentVariableW",
  1130. "bcrypt.dll.BCryptGetFipsAlgorithmMode",
  1131. "cryptsp.dll.CryptAcquireContextW",
  1132. "cryptsp.dll.CryptCreateHash",
  1133. "ole32.dll.CreateBindCtx",
  1134. "ole32.dll.CoGetObjectContext",
  1135. "sechost.dll.LookupAccountNameLocalW",
  1136. "advapi32.dll.LookupAccountSidW",
  1137. "sechost.dll.LookupAccountSidLocalW",
  1138. "cryptsp.dll.CryptGenRandom",
  1139. "ole32.dll.NdrOleInitializeExtension",
  1140. "ole32.dll.CoGetClassObject",
  1141. "ole32.dll.CoGetMarshalSizeMax",
  1142. "ole32.dll.CoMarshalInterface",
  1143. "ole32.dll.CoUnmarshalInterface",
  1144. "ole32.dll.StringFromIID",
  1145. "ole32.dll.CoGetPSClsid",
  1146. "ole32.dll.CoTaskMemAlloc",
  1147. "ole32.dll.CoTaskMemFree",
  1148. "ole32.dll.CoCreateInstance",
  1149. "ole32.dll.CoReleaseMarshalData",
  1150. "ole32.dll.DcomChannelSetHResult",
  1151. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  1152. "ole32.dll.MkParseDisplayName",
  1153. "oleaut32.dll.#2",
  1154. "oleaut32.dll.#6",
  1155. "kernel32.dll.GetThreadPreferredUILanguages",
  1156. "kernel32.dll.SetThreadPreferredUILanguages",
  1157. "kernel32.dll.LocaleNameToLCID",
  1158. "kernel32.dll.GetLocaleInfoEx",
  1159. "kernel32.dll.LCIDToLocaleName",
  1160. "kernel32.dll.GetSystemDefaultLocaleName",
  1161. "ole32.dll.BindMoniker",
  1162. "sxs.dll.SxsOleAut32RedirectTypeLibrary",
  1163. "advapi32.dll.RegOpenKeyW",
  1164. "advapi32.dll.RegEnumKeyW",
  1165. "advapi32.dll.RegQueryValueW",
  1166. "sxs.dll.SxsOleAut32MapConfiguredClsidToReferenceClsid",
  1167. "sxs.dll.SxsLookupClrGuid",
  1168. "oleaut32.dll.#9",
  1169. "oleaut32.dll.#4",
  1170. "oleaut32.dll.#283",
  1171. "oleaut32.dll.#284",
  1172. "mscoree.dll.GetTokenForVTableEntry",
  1173. "mscoree.dll.SetTargetForVTableEntry",
  1174. "mscoree.dll.GetTargetForVTableEntry",
  1175. "kernel32.dll.GetLastError",
  1176. "kernel32.dll.LocalAlloc",
  1177. "oleaut32.dll.VariantInit",
  1178. "oleaut32.dll.VariantClear",
  1179. "oleaut32.dll.#7",
  1180. "kernel32.dll.CreateEventW",
  1181. "kernel32.dll.SetEvent",
  1182. "ole32.dll.CoWaitForMultipleHandles",
  1183. "ole32.dll.IIDFromString",
  1184. "kernel32.dll.LoadLibraryA",
  1185. "kernel32.dll.GetProcAddress",
  1186. "wminet_utils.dll.ResetSecurity",
  1187. "wminet_utils.dll.SetSecurity",
  1188. "wminet_utils.dll.BlessIWbemServices",
  1189. "wminet_utils.dll.BlessIWbemServicesObject",
  1190. "wminet_utils.dll.GetPropertyHandle",
  1191. "wminet_utils.dll.WritePropertyValue",
  1192. "wminet_utils.dll.Clone",
  1193. "wminet_utils.dll.VerifyClientKey",
  1194. "wminet_utils.dll.GetQualifierSet",
  1195. "wminet_utils.dll.Get",
  1196. "wminet_utils.dll.Put",
  1197. "wminet_utils.dll.Delete",
  1198. "wminet_utils.dll.GetNames",
  1199. "wminet_utils.dll.BeginEnumeration",
  1200. "wminet_utils.dll.Next",
  1201. "wminet_utils.dll.EndEnumeration",
  1202. "wminet_utils.dll.GetPropertyQualifierSet",
  1203. "wminet_utils.dll.GetObjectText",
  1204. "wminet_utils.dll.SpawnDerivedClass",
  1205. "wminet_utils.dll.SpawnInstance",
  1206. "wminet_utils.dll.CompareTo",
  1207. "wminet_utils.dll.GetPropertyOrigin",
  1208. "wminet_utils.dll.InheritsFrom",
  1209. "wminet_utils.dll.GetMethod",
  1210. "wminet_utils.dll.PutMethod",
  1211. "wminet_utils.dll.DeleteMethod",
  1212. "wminet_utils.dll.BeginMethodEnumeration",
  1213. "wminet_utils.dll.NextMethod",
  1214. "wminet_utils.dll.EndMethodEnumeration",
  1215. "wminet_utils.dll.GetMethodQualifierSet",
  1216. "wminet_utils.dll.GetMethodOrigin",
  1217. "wminet_utils.dll.QualifierSet_Get",
  1218. "wminet_utils.dll.QualifierSet_Put",
  1219. "wminet_utils.dll.QualifierSet_Delete",
  1220. "wminet_utils.dll.QualifierSet_GetNames",
  1221. "wminet_utils.dll.QualifierSet_BeginEnumeration",
  1222. "wminet_utils.dll.QualifierSet_Next",
  1223. "wminet_utils.dll.QualifierSet_EndEnumeration",
  1224. "wminet_utils.dll.GetCurrentApartmentType",
  1225. "wminet_utils.dll.GetDemultiplexedStub",
  1226. "wminet_utils.dll.CreateInstanceEnumWmi",
  1227. "wminet_utils.dll.CreateClassEnumWmi",
  1228. "wminet_utils.dll.ExecQueryWmi",
  1229. "wminet_utils.dll.ExecNotificationQueryWmi",
  1230. "wminet_utils.dll.PutInstanceWmi",
  1231. "wminet_utils.dll.PutClassWmi",
  1232. "wminet_utils.dll.CloneEnumWbemClassObject",
  1233. "wminet_utils.dll.ConnectServerWmi",
  1234. "oleaut32.dll.#500",
  1235. "oleaut32.dll.SysStringLen",
  1236. "kernel32.dll.RtlZeroMemory",
  1237. "kernel32.dll.RegOpenKeyExW",
  1238. "advapi32.dll.GetUserNameW",
  1239. "kernel32.dll.GetComputerNameW",
  1240. "kernel32.dll.GetModuleHandleW",
  1241. "user32.dll.DefWindowProcW",
  1242. "gdi32.dll.GetStockObject",
  1243. "user32.dll.RegisterClassW",
  1244. "user32.dll.CreateWindowExW",
  1245. "user32.dll.SetWindowLongW",
  1246. "user32.dll.GetWindowLongW",
  1247. "kernel32.dll.GetCurrentThread",
  1248. "kernel32.dll.DuplicateHandle",
  1249. "kernel32.dll.GetCurrentThreadId",
  1250. "user32.dll.CallWindowProcW",
  1251. "user32.dll.RegisterWindowMessageW",
  1252. "dwmapi.dll.DwmIsCompositionEnabled",
  1253. "ntdll.dll.NtQuerySystemInformation",
  1254. "kernel32.dll.CreateIoCompletionPort",
  1255. "kernel32.dll.PostQueuedCompletionStatus",
  1256. "ntdll.dll.NtQueryInformationThread",
  1257. "ntdll.dll.NtGetCurrentProcessorNumber",
  1258. "shfolder.dll.SHGetFolderPathW",
  1259. "kernel32.dll.FindFirstFileW",
  1260. "kernel32.dll.FindClose",
  1261. "kernel32.dll.FindNextFileW",
  1262. "kernel32.dll.CreateFileW",
  1263. "kernel32.dll.GetFileType",
  1264. "kernel32.dll.GetFileSize",
  1265. "kernel32.dll.ReadFile",
  1266. "oleaut32.dll.#204",
  1267. "oleaut32.dll.#203",
  1268. "mlang.dll.#112",
  1269. "wininet.dll.FindFirstUrlCacheEntryA",
  1270. "kernel32.dll.SetFileInformationByHandle",
  1271. "urlmon.dll.CreateUri",
  1272. "kernel32.dll.InitializeSRWLock",
  1273. "kernel32.dll.AcquireSRWLockExclusive",
  1274. "kernel32.dll.AcquireSRWLockShared",
  1275. "kernel32.dll.ReleaseSRWLockExclusive",
  1276. "kernel32.dll.ReleaseSRWLockShared",
  1277. "wininet.dll.FindNextUrlCacheEntryA",
  1278. "urlmon.dll.CreateIUriBuilder",
  1279. "urlmon.dll.IntlPercentEncodeNormalize",
  1280. "wininet.dll.FindCloseUrlCache",
  1281. "cryptsp.dll.CryptAcquireContextA",
  1282. "cryptsp.dll.CryptHashData",
  1283. "cryptsp.dll.CryptGetHashParam",
  1284. "cryptsp.dll.CryptDestroyHash",
  1285. "cryptsp.dll.CryptReleaseContext",
  1286. "vaultcli.dll.VaultEnumerateVaults",
  1287. "kernel32.dll.GetSystemTimeAsFileTime",
  1288. "user32.dll.GetLastInputInfo",
  1289. "ole32.dll.CLSIDFromProgIDEx",
  1290. "oleaut32.dll.#201",
  1291. "user32.dll.SetWindowsHookExW",
  1292. "user32.dll.SetClipboardViewer",
  1293. "ole32.dll.OleInitialize",
  1294. "ole32.dll.OleGetClipboard",
  1295. "kernel32.dll.GlobalLock",
  1296. "kernel32.dll.GlobalUnlock",
  1297. "kernel32.dll.GlobalFree",
  1298. "user32.dll.SendMessageW",
  1299. "user32.dll.GetSystemMetrics",
  1300. "user32.dll.GetClientRect",
  1301. "user32.dll.GetWindowRect",
  1302. "user32.dll.GetParent",
  1303. "ole32.dll.CoRegisterMessageFilter",
  1304. "user32.dll.PeekMessageW",
  1305. "user32.dll.WaitMessage",
  1306. "mscoree.dll.ND_RI2",
  1307. "rasapi32.dll.RasEnumConnectionsW",
  1308. "rtutils.dll.TraceRegisterExA",
  1309. "rtutils.dll.TracePrintfExA",
  1310. "sechost.dll.OpenSCManagerW",
  1311. "sechost.dll.OpenServiceW",
  1312. "sechost.dll.QueryServiceStatus",
  1313. "sechost.dll.CloseServiceHandle",
  1314. "ws2_32.dll.WSAStartup",
  1315. "ws2_32.dll.WSASocketW",
  1316. "ws2_32.dll.setsockopt",
  1317. "ws2_32.dll.WSAEventSelect",
  1318. "ws2_32.dll.ioctlsocket",
  1319. "ws2_32.dll.closesocket",
  1320. "advapi32.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  1321. "kernel32.dll.LocalFree",
  1322. "kernel32.dll.CreateFileMappingW",
  1323. "kernel32.dll.MapViewOfFile",
  1324. "kernel32.dll.VirtualQuery",
  1325. "kernel32.dll.ReleaseMutex",
  1326. "kernel32.dll.CreateMutexW",
  1327. "kernel32.dll.WaitForSingleObject",
  1328. "kernel32.dll.OpenMutexW",
  1329. "kernel32.dll.GetProcessTimes",
  1330. "ws2_32.dll.WSAIoctl",
  1331. "kernel32.dll.FormatMessageW",
  1332. "rasapi32.dll.RasConnectionNotificationW",
  1333. "advapi32.dll.RegOpenCurrentUser",
  1334. "advapi32.dll.RegNotifyChangeKeyValue",
  1335. "sechost.dll.NotifyServiceStatusChangeA",
  1336. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  1337. "kernel32.dll.ResetEvent",
  1338. "iphlpapi.dll.GetNetworkParams",
  1339. "dnsapi.dll.DnsQueryConfig",
  1340. "iphlpapi.dll.GetAdaptersAddresses",
  1341. "iphlpapi.dll.GetIpInterfaceEntry",
  1342. "iphlpapi.dll.GetBestInterfaceEx",
  1343. "ws2_32.dll.inet_addr",
  1344. "ws2_32.dll.getaddrinfo",
  1345. "ws2_32.dll.freeaddrinfo",
  1346. "ws2_32.dll.WSAConnect",
  1347. "ws2_32.dll.send",
  1348. "ws2_32.dll.recv",
  1349. "kernel32.dll.GetTempPathW",
  1350. "vssapi.dll.CreateWriter",
  1351. "advapi32.dll.LookupAccountNameW",
  1352. "samcli.dll.NetLocalGroupGetMembers",
  1353. "samlib.dll.SamConnect",
  1354. "rpcrt4.dll.NdrClientCall3",
  1355. "rpcrt4.dll.RpcStringBindingComposeW",
  1356. "rpcrt4.dll.RpcBindingFromStringBindingW",
  1357. "rpcrt4.dll.RpcStringFreeW",
  1358. "rpcrt4.dll.RpcBindingFree",
  1359. "samlib.dll.SamOpenDomain",
  1360. "samlib.dll.SamLookupNamesInDomain",
  1361. "samlib.dll.SamOpenAlias",
  1362. "samlib.dll.SamFreeMemory",
  1363. "samlib.dll.SamCloseHandle",
  1364. "samlib.dll.SamGetMembersInAlias",
  1365. "netutils.dll.NetApiBufferFree",
  1366. "samlib.dll.SamEnumerateDomainsInSamServer",
  1367. "samlib.dll.SamLookupDomainInSamServer",
  1368. "ole32.dll.CoCreateGuid",
  1369. "ole32.dll.StringFromCLSID",
  1370. "propsys.dll.VariantToPropVariant",
  1371. "wbemcore.dll.Reinitialize",
  1372. "wbemsvc.dll.DllGetClassObject",
  1373. "wbemsvc.dll.DllCanUnloadNow",
  1374. "authz.dll.AuthzInitializeContextFromToken",
  1375. "authz.dll.AuthzInitializeObjectAccessAuditEvent2",
  1376. "authz.dll.AuthzAccessCheck",
  1377. "authz.dll.AuthzFreeAuditEvent",
  1378. "authz.dll.AuthzFreeContext",
  1379. "authz.dll.AuthzInitializeResourceManager",
  1380. "authz.dll.AuthzFreeResourceManager",
  1381. "rpcrt4.dll.RpcBindingCreateW",
  1382. "rpcrt4.dll.RpcBindingBind",
  1383. "rpcrt4.dll.I_RpcMapWin32Status",
  1384. "advapi32.dll.EventRegister",
  1385. "advapi32.dll.EventUnregister",
  1386. "advapi32.dll.EventWrite",
  1387. "kernel32.dll.RegCloseKey",
  1388. "kernel32.dll.RegSetValueExW",
  1389. "kernel32.dll.RegQueryValueExW",
  1390. "wmisvc.dll.IsImproperShutdownDetected",
  1391. "wevtapi.dll.EvtRender",
  1392. "wevtapi.dll.EvtNext",
  1393. "wevtapi.dll.EvtClose",
  1394. "wevtapi.dll.EvtQuery",
  1395. "wevtapi.dll.EvtCreateRenderContext",
  1396. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  1397. "rpcrt4.dll.RpcBindingSetOption",
  1398. "ole32.dll.CoCreateFreeThreadedMarshaler",
  1399. "ole32.dll.CreateStreamOnHGlobal",
  1400. "advapi32.dll.RegCreateKeyExW",
  1401. "advapi32.dll.RegSetValueExW",
  1402. "kernelbase.dll.InitializeAcl",
  1403. "kernelbase.dll.AddAce",
  1404. "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  1405. "kernel32.dll.IsThreadAFiber",
  1406. "kernel32.dll.OpenProcessToken",
  1407. "kernelbase.dll.GetTokenInformation",
  1408. "kernelbase.dll.DuplicateTokenEx",
  1409. "kernelbase.dll.AdjustTokenPrivileges",
  1410. "kernelbase.dll.AllocateAndInitializeSid",
  1411. "kernelbase.dll.CheckTokenMembership",
  1412. "kernel32.dll.SetThreadToken",
  1413. "ole32.dll.CLSIDFromString",
  1414. "oleaut32.dll.#285",
  1415. "oleaut32.dll.#12",
  1416. "oleaut32.dll.#286",
  1417. "oleaut32.dll.#17",
  1418. "oleaut32.dll.#20",
  1419. "oleaut32.dll.#19",
  1420. "oleaut32.dll.#25",
  1421. "authz.dll.AuthzInitializeContextFromSid",
  1422. "ole32.dll.CoRevertToSelf",
  1423. "advapi32.dll.LogonUserExExW",
  1424. "sspicli.dll.LogonUserExExW",
  1425. "ole32.dll.CoGetCallContext",
  1426. "ole32.dll.CoImpersonateClient",
  1427. "advapi32.dll.OpenThreadToken",
  1428. "ole32.dll.CoSwitchCallContext",
  1429. "oleaut32.dll.#8",
  1430. "oleaut32.dll.#287",
  1431. "oleaut32.dll.#288",
  1432. "oleaut32.dll.#289",
  1433. "kernel32.dll.SortGetHandle",
  1434. "kernel32.dll.SortCloseHandle",
  1435. "ntmarta.dll.GetMartaExtensionInterface",
  1436. "fastprox.dll.DllGetClassObject",
  1437. "fastprox.dll.DllCanUnloadNow",
  1438. "oleaut32.dll.#290",
  1439. "wmi.dll.WmiQueryAllDataW",
  1440. "wmi.dll.WmiQuerySingleInstanceW",
  1441. "wmi.dll.WmiSetSingleItemW",
  1442. "wmi.dll.WmiSetSingleInstanceW",
  1443. "wmi.dll.WmiExecuteMethodW",
  1444. "wmi.dll.WmiNotificationRegistrationW",
  1445. "wmi.dll.WmiMofEnumerateResourcesW",
  1446. "wmi.dll.WmiFileHandleToInstanceNameW",
  1447. "wmi.dll.WmiDevInstToInstanceNameW",
  1448. "wmi.dll.WmiQueryGuidInformation",
  1449. "wmi.dll.WmiOpenBlock",
  1450. "wmi.dll.WmiCloseBlock",
  1451. "wmi.dll.WmiFreeBuffer",
  1452. "wmi.dll.WmiEnumerateGuids",
  1453. "winbrand.dll.BrandingLoadString",
  1454. "security.dll.InitSecurityInterfaceW",
  1455. "cryptsp.dll.SystemFunction035",
  1456. "schannel.dll.SpUserModeInitialize",
  1457. "ntdll.dll.RtlInitUnicodeString",
  1458. "ntdll.dll.RtlFreeUnicodeString",
  1459. "ntdll.dll.NtSetSystemEnvironmentValue",
  1460. "ntdll.dll.NtQuerySystemEnvironmentValue",
  1461. "ntdll.dll.NtCreateFile",
  1462. "ntdll.dll.NtQueryDirectoryObject",
  1463. "ntdll.dll.NtQueryObject",
  1464. "ntdll.dll.NtOpenDirectoryObject",
  1465. "ntdll.dll.NtQueryInformationProcess",
  1466. "ntdll.dll.NtQueryInformationToken",
  1467. "ntdll.dll.NtOpenFile",
  1468. "ntdll.dll.NtClose",
  1469. "ntdll.dll.NtFsControlFile",
  1470. "ntdll.dll.NtQueryVolumeInformationFile",
  1471. "netapi32.dll.NetGroupEnum",
  1472. "netapi32.dll.NetGroupGetInfo",
  1473. "netapi32.dll.NetGroupSetInfo",
  1474. "netapi32.dll.NetLocalGroupGetInfo",
  1475. "netapi32.dll.NetLocalGroupSetInfo",
  1476. "netapi32.dll.NetGroupGetUsers",
  1477. "netapi32.dll.NetLocalGroupGetMembers",
  1478. "netapi32.dll.NetLocalGroupEnum",
  1479. "netapi32.dll.NetShareEnum",
  1480. "netapi32.dll.NetShareGetInfo",
  1481. "netapi32.dll.NetShareAdd",
  1482. "netapi32.dll.NetShareEnumSticky",
  1483. "netapi32.dll.NetShareSetInfo",
  1484. "netapi32.dll.NetShareDel",
  1485. "netapi32.dll.NetShareDelSticky",
  1486. "netapi32.dll.NetShareCheck",
  1487. "netapi32.dll.NetUserEnum",
  1488. "netapi32.dll.NetUserGetInfo",
  1489. "netapi32.dll.NetUserSetInfo",
  1490. "netapi32.dll.NetApiBufferFree",
  1491. "netapi32.dll.NetQueryDisplayInformation",
  1492. "netapi32.dll.NetServerSetInfo",
  1493. "netapi32.dll.NetServerGetInfo",
  1494. "netapi32.dll.NetGetDCName",
  1495. "netapi32.dll.NetWkstaGetInfo",
  1496. "netapi32.dll.NetGetAnyDCName",
  1497. "netapi32.dll.NetServerEnum",
  1498. "netapi32.dll.NetUserModalsGet",
  1499. "netapi32.dll.NetScheduleJobAdd",
  1500. "netapi32.dll.NetScheduleJobDel",
  1501. "netapi32.dll.NetScheduleJobEnum",
  1502. "netapi32.dll.NetScheduleJobGetInfo",
  1503. "netapi32.dll.NetUseGetInfo",
  1504. "netapi32.dll.NetEnumerateTrustedDomains",
  1505. "netapi32.dll.DsGetDcNameW",
  1506. "netapi32.dll.DsRoleGetPrimaryDomainInformation",
  1507. "netapi32.dll.DsRoleFreeMemory",
  1508. "netapi32.dll.NetRenameMachineInDomain",
  1509. "netapi32.dll.NetJoinDomain",
  1510. "netapi32.dll.NetUnjoinDomain",
  1511. "wkscli.dll.NetWkstaGetInfo",
  1512. "cscapi.dll.CscNetApiGetInterface",
  1513. "kernel32.dll.GetDiskFreeSpaceExW",
  1514. "kernel32.dll.GetVolumePathNameW",
  1515. "kernel32.dll.CreateToolhelp32Snapshot",
  1516. "kernel32.dll.Thread32First",
  1517. "kernel32.dll.Thread32Next",
  1518. "kernel32.dll.Process32First",
  1519. "kernel32.dll.Process32Next",
  1520. "kernel32.dll.Module32First",
  1521. "kernel32.dll.Module32Next",
  1522. "kernel32.dll.Heap32ListFirst",
  1523. "kernel32.dll.GetSystemDefaultUILanguage",
  1524. "oleaut32.dll.#15",
  1525. "oleaut32.dll.#26",
  1526. "oleaut32.dll.#150",
  1527. "wtsapi32.dll.WTSEnumerateSessionsW",
  1528. "winsta.dll.WinStationEnumerateW",
  1529. "rpcrt4.dll.I_RpcExceptionFilter",
  1530. "winsta.dll.WinStationFreeMemory",
  1531. "wtsapi32.dll.WTSQuerySessionInformationW",
  1532. "winsta.dll.WinStationQueryInformationW",
  1533. "wtsapi32.dll.WTSFreeMemory",
  1534. "devobj.dll.DevObjCreateDeviceInfoList",
  1535. "devobj.dll.DevObjGetClassDevs",
  1536. "devobj.dll.DevObjEnumDeviceInfo",
  1537. "devobj.dll.DevObjDestroyDeviceInfoList",
  1538. "powrprof.dll.PowerDeterminePlatformRole",
  1539. "oleaut32.dll.#40",
  1540. "advapi32.dll.InitiateSystemShutdownExW",
  1541. "wersvc.dll.ServiceMain",
  1542. "wersvc.dll.SvchostPushServiceGlobals",
  1543. "advapi32.dll.RegGetValueW",
  1544. "faultrep.dll.WerpInitiateCrashReporting",
  1545. "wer.dll.WerpCreateMachineStore",
  1546. "shell32.dll.SHGetFolderPathEx",
  1547. "ole32.dll.StringFromGUID2",
  1548. "profapi.dll.#104",
  1549. "userenv.dll.CreateEnvironmentBlock",
  1550. "sechost.dll.ConvertSidToStringSidW",
  1551. "sspicli.dll.GetUserNameExW",
  1552. "userenv.dll.DestroyEnvironmentBlock",
  1553. "imm32.dll.ImmDisableIME",
  1554. "psapi.dll.GetModuleFileNameExW",
  1555. "version.dll.GetFileVersionInfoSizeW",
  1556. "version.dll.GetFileVersionInfoW",
  1557. "version.dll.VerQueryValueW",
  1558. "wer.dll.WerpCreateIntegratorReportId",
  1559. "wer.dll.WerReportCreate",
  1560. "wer.dll.WerpSetIntegratorReportId",
  1561. "wer.dll.WerReportSetParameter",
  1562. "dbgeng.dll.DebugCreate",
  1563. "ntdll.dll.CsrGetProcessId",
  1564. "ntdll.dll.DbgBreakPoint",
  1565. "ntdll.dll.DbgPrint",
  1566. "ntdll.dll.DbgPrompt",
  1567. "ntdll.dll.DbgUiConvertStateChangeStructure",
  1568. "ntdll.dll.DbgUiGetThreadDebugObject",
  1569. "ntdll.dll.DbgUiIssueRemoteBreakin",
  1570. "ntdll.dll.DbgUiSetThreadDebugObject",
  1571. "ntdll.dll.NtAllocateVirtualMemory",
  1572. "ntdll.dll.NtCreateDebugObject",
  1573. "ntdll.dll.NtDebugActiveProcess",
  1574. "ntdll.dll.NtDebugContinue",
  1575. "ntdll.dll.NtFreeVirtualMemory",
  1576. "ntdll.dll.NtOpenProcess",
  1577. "ntdll.dll.NtOpenThread",
  1578. "ntdll.dll.NtQueryMutant",
  1579. "ntdll.dll.NtRemoveProcessDebug",
  1580. "ntdll.dll.NtResumeThread",
  1581. "ntdll.dll.NtSetInformationDebugObject",
  1582. "ntdll.dll.NtSetInformationProcess",
  1583. "ntdll.dll.NtSystemDebugControl",
  1584. "ntdll.dll.NtWaitForDebugEvent",
  1585. "ntdll.dll.RtlAnsiStringToUnicodeString",
  1586. "ntdll.dll.RtlCreateProcessParameters",
  1587. "ntdll.dll.RtlCreateUserProcess",
  1588. "ntdll.dll.RtlDestroyProcessParameters",
  1589. "ntdll.dll.RtlDosPathNameToNtPathName_U",
  1590. "ntdll.dll.RtlFindMessage",
  1591. "ntdll.dll.RtlFreeHeap",
  1592. "ntdll.dll.RtlGetFunctionTableListHead",
  1593. "ntdll.dll.RtlGetUnloadEventTrace",
  1594. "ntdll.dll.RtlGetUnloadEventTraceEx",
  1595. "ntdll.dll.RtlInitAnsiString",
  1596. "ntdll.dll.RtlTryEnterCriticalSection",
  1597. "ntdll.dll.RtlUnicodeStringToAnsiString",
  1598. "ntdll.dll.NtOpenProcessToken",
  1599. "ntdll.dll.NtOpenThreadToken",
  1600. "kernel32.dll.CloseProfileUserMapping",
  1601. "kernel32.dll.DebugActiveProcessStop",
  1602. "kernel32.dll.DebugBreak",
  1603. "kernel32.dll.DebugBreakProcess",
  1604. "kernel32.dll.DebugSetProcessKillOnExit",
  1605. "kernel32.dll.Module32FirstW",
  1606. "kernel32.dll.Module32NextW",
  1607. "kernel32.dll.OpenThread",
  1608. "kernel32.dll.Process32FirstW",
  1609. "kernel32.dll.Process32NextW",
  1610. "kernel32.dll.ProcessIdToSessionId",
  1611. "kernel32.dll.SetProcessShutdownParameters",
  1612. "kernel32.dll.GetTimeZoneInformation",
  1613. "kernel32.dll.Wow64GetThreadSelectorEntry",
  1614. "advapi32.dll.CloseServiceHandle",
  1615. "advapi32.dll.ControlService",
  1616. "advapi32.dll.CreateServiceA",
  1617. "advapi32.dll.CreateServiceW",
  1618. "advapi32.dll.DeleteService",
  1619. "advapi32.dll.EnumServicesStatusExA",
  1620. "advapi32.dll.EnumServicesStatusExW",
  1621. "advapi32.dll.GetEventLogInformation",
  1622. "advapi32.dll.OpenSCManagerA",
  1623. "advapi32.dll.OpenSCManagerW",
  1624. "advapi32.dll.OpenServiceA",
  1625. "advapi32.dll.OpenServiceW",
  1626. "advapi32.dll.StartServiceA",
  1627. "advapi32.dll.StartServiceW",
  1628. "advapi32.dll.GetSidSubAuthority",
  1629. "advapi32.dll.GetSidSubAuthorityCount",
  1630. "version.dll.GetFileVersionInfoSizeExW",
  1631. "version.dll.GetFileVersionInfoExW",
  1632. "dbghelp.dll.WinDbgExtensionDllInit",
  1633. "dbghelp.dll.ExtensionApiVersion"
  1634. ]
  1635.  
  1636. [*] Static Analysis: {
  1637. "dotnet": {
  1638. "customattrs": null,
  1639. "assemblyinfo": {
  1640. "version": "10.10.9.14",
  1641. "name": "1LJcbCK5MBNAI1a32BqtJFLT2kw7VFS"
  1642. },
  1643. "assemblyrefs": [
  1644. {
  1645. "version": "2.0.0.0",
  1646. "name": "mscorlib"
  1647. },
  1648. {
  1649. "version": "2.0.0.0",
  1650. "name": "System.Drawing"
  1651. },
  1652. {
  1653. "version": "2.0.0.0",
  1654. "name": "System"
  1655. },
  1656. {
  1657. "version": "2.0.0.0",
  1658. "name": "System.Windows.Forms"
  1659. },
  1660. {
  1661. "version": "8.0.0.0",
  1662. "name": "Microsoft.VisualBasic"
  1663. }
  1664. ],
  1665. "typerefs": [
  1666. {
  1667. "typename": "Microsoft.VisualBasic.CallType",
  1668. "assembly": "Microsoft.VisualBasic"
  1669. },
  1670. {
  1671. "typename": "Microsoft.VisualBasic.Interaction",
  1672. "assembly": "Microsoft.VisualBasic"
  1673. },
  1674. {
  1675. "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
  1676. "assembly": "System"
  1677. },
  1678. {
  1679. "typename": "System.ComponentModel.BrowsableAttribute",
  1680. "assembly": "System"
  1681. },
  1682. {
  1683. "typename": "System.ComponentModel.CategoryAttribute",
  1684. "assembly": "System"
  1685. },
  1686. {
  1687. "typename": "System.ComponentModel.DefaultEventAttribute",
  1688. "assembly": "System"
  1689. },
  1690. {
  1691. "typename": "System.ComponentModel.DefaultValueAttribute",
  1692. "assembly": "System"
  1693. },
  1694. {
  1695. "typename": "System.ComponentModel.EditorBrowsableAttribute",
  1696. "assembly": "System"
  1697. },
  1698. {
  1699. "typename": "System.ComponentModel.EditorBrowsableState",
  1700. "assembly": "System"
  1701. },
  1702. {
  1703. "typename": "System.ComponentModel.IContainer",
  1704. "assembly": "System"
  1705. },
  1706. {
  1707. "typename": "System.ComponentModel.ISupportInitialize",
  1708. "assembly": "System"
  1709. },
  1710. {
  1711. "typename": "System.Configuration.ApplicationSettingsBase",
  1712. "assembly": "System"
  1713. },
  1714. {
  1715. "typename": "System.Configuration.SettingsBase",
  1716. "assembly": "System"
  1717. },
  1718. {
  1719. "typename": "System.Diagnostics.Process",
  1720. "assembly": "System"
  1721. },
  1722. {
  1723. "typename": "System.Drawing.Bitmap",
  1724. "assembly": "System.Drawing"
  1725. },
  1726. {
  1727. "typename": "System.Drawing.Brush",
  1728. "assembly": "System.Drawing"
  1729. },
  1730. {
  1731. "typename": "System.Drawing.Color",
  1732. "assembly": "System.Drawing"
  1733. },
  1734. {
  1735. "typename": "System.Drawing.Drawing2D.GraphicsPath",
  1736. "assembly": "System.Drawing"
  1737. },
  1738. {
  1739. "typename": "System.Drawing.Drawing2D.LinearGradientBrush",
  1740. "assembly": "System.Drawing"
  1741. },
  1742. {
  1743. "typename": "System.Drawing.Drawing2D.Matrix",
  1744. "assembly": "System.Drawing"
  1745. },
  1746. {
  1747. "typename": "System.Drawing.Drawing2D.PixelOffsetMode",
  1748. "assembly": "System.Drawing"
  1749. },
  1750. {
  1751. "typename": "System.Drawing.Drawing2D.SmoothingMode",
  1752. "assembly": "System.Drawing"
  1753. },
  1754. {
  1755. "typename": "System.Drawing.Drawing2D.WrapMode",
  1756. "assembly": "System.Drawing"
  1757. },
  1758. {
  1759. "typename": "System.Drawing.Font",
  1760. "assembly": "System.Drawing"
  1761. },
  1762. {
  1763. "typename": "System.Drawing.FontFamily",
  1764. "assembly": "System.Drawing"
  1765. },
  1766. {
  1767. "typename": "System.Drawing.FontStyle",
  1768. "assembly": "System.Drawing"
  1769. },
  1770. {
  1771. "typename": "System.Drawing.Graphics",
  1772. "assembly": "System.Drawing"
  1773. },
  1774. {
  1775. "typename": "System.Drawing.GraphicsUnit",
  1776. "assembly": "System.Drawing"
  1777. },
  1778. {
  1779. "typename": "System.Drawing.Icon",
  1780. "assembly": "System.Drawing"
  1781. },
  1782. {
  1783. "typename": "System.Drawing.Image",
  1784. "assembly": "System.Drawing"
  1785. },
  1786. {
  1787. "typename": "System.Drawing.Imaging.ColorMatrix",
  1788. "assembly": "System.Drawing"
  1789. },
  1790. {
  1791. "typename": "System.Drawing.Imaging.ImageAttributes",
  1792. "assembly": "System.Drawing"
  1793. },
  1794. {
  1795. "typename": "System.Drawing.Pen",
  1796. "assembly": "System.Drawing"
  1797. },
  1798. {
  1799. "typename": "System.Drawing.Point",
  1800. "assembly": "System.Drawing"
  1801. },
  1802. {
  1803. "typename": "System.Drawing.PointF",
  1804. "assembly": "System.Drawing"
  1805. },
  1806. {
  1807. "typename": "System.Drawing.Rectangle",
  1808. "assembly": "System.Drawing"
  1809. },
  1810. {
  1811. "typename": "System.Drawing.RectangleF",
  1812. "assembly": "System.Drawing"
  1813. },
  1814. {
  1815. "typename": "System.Drawing.Size",
  1816. "assembly": "System.Drawing"
  1817. },
  1818. {
  1819. "typename": "System.Drawing.SizeF",
  1820. "assembly": "System.Drawing"
  1821. },
  1822. {
  1823. "typename": "System.Drawing.SolidBrush",
  1824. "assembly": "System.Drawing"
  1825. },
  1826. {
  1827. "typename": "System.Drawing.SystemColors",
  1828. "assembly": "System.Drawing"
  1829. },
  1830. {
  1831. "typename": "System.Drawing.SystemIcons",
  1832. "assembly": "System.Drawing"
  1833. },
  1834. {
  1835. "typename": "System.Drawing.Text.TextRenderingHint",
  1836. "assembly": "System.Drawing"
  1837. },
  1838. {
  1839. "typename": "System.Windows.Forms.AnchorStyles",
  1840. "assembly": "System.Windows.Forms"
  1841. },
  1842. {
  1843. "typename": "System.Windows.Forms.AutoScaleMode",
  1844. "assembly": "System.Windows.Forms"
  1845. },
  1846. {
  1847. "typename": "System.Windows.Forms.Button",
  1848. "assembly": "System.Windows.Forms"
  1849. },
  1850. {
  1851. "typename": "System.Windows.Forms.ButtonBase",
  1852. "assembly": "System.Windows.Forms"
  1853. },
  1854. {
  1855. "typename": "System.Windows.Forms.ContainerControl",
  1856. "assembly": "System.Windows.Forms"
  1857. },
  1858. {
  1859. "typename": "System.Windows.Forms.Control",
  1860. "assembly": "System.Windows.Forms"
  1861. },
  1862. {
  1863. "typename": "System.Windows.Forms.Control/ControlCollection",
  1864. "assembly": "System.Windows.Forms"
  1865. },
  1866. {
  1867. "typename": "System.Windows.Forms.Cursor",
  1868. "assembly": "System.Windows.Forms"
  1869. },
  1870. {
  1871. "typename": "System.Windows.Forms.DialogResult",
  1872. "assembly": "System.Windows.Forms"
  1873. },
  1874. {
  1875. "typename": "System.Windows.Forms.Form",
  1876. "assembly": "System.Windows.Forms"
  1877. },
  1878. {
  1879. "typename": "System.Windows.Forms.FormBorderStyle",
  1880. "assembly": "System.Windows.Forms"
  1881. },
  1882. {
  1883. "typename": "System.Windows.Forms.FormStartPosition",
  1884. "assembly": "System.Windows.Forms"
  1885. },
  1886. {
  1887. "typename": "System.Windows.Forms.KeyPressEventArgs",
  1888. "assembly": "System.Windows.Forms"
  1889. },
  1890. {
  1891. "typename": "System.Windows.Forms.Keys",
  1892. "assembly": "System.Windows.Forms"
  1893. },
  1894. {
  1895. "typename": "System.Windows.Forms.Label",
  1896. "assembly": "System.Windows.Forms"
  1897. },
  1898. {
  1899. "typename": "System.Windows.Forms.LinkLabel",
  1900. "assembly": "System.Windows.Forms"
  1901. },
  1902. {
  1903. "typename": "System.Windows.Forms.LinkLabelLinkClickedEventArgs",
  1904. "assembly": "System.Windows.Forms"
  1905. },
  1906. {
  1907. "typename": "System.Windows.Forms.LinkLabelLinkClickedEventHandler",
  1908. "assembly": "System.Windows.Forms"
  1909. },
  1910. {
  1911. "typename": "System.Windows.Forms.MessageBox",
  1912. "assembly": "System.Windows.Forms"
  1913. },
  1914. {
  1915. "typename": "System.Windows.Forms.MouseEventArgs",
  1916. "assembly": "System.Windows.Forms"
  1917. },
  1918. {
  1919. "typename": "System.Windows.Forms.PaintEventArgs",
  1920. "assembly": "System.Windows.Forms"
  1921. },
  1922. {
  1923. "typename": "System.Windows.Forms.PictureBox",
  1924. "assembly": "System.Windows.Forms"
  1925. },
  1926. {
  1927. "typename": "System.Windows.Forms.PictureBoxSizeMode",
  1928. "assembly": "System.Windows.Forms"
  1929. },
  1930. {
  1931. "typename": "System.Windows.Forms.UserControl",
  1932. "assembly": "System.Windows.Forms"
  1933. },
  1934. {
  1935. "typename": "System.Array",
  1936. "assembly": "mscorlib"
  1937. },
  1938. {
  1939. "typename": "System.Buffer",
  1940. "assembly": "mscorlib"
  1941. },
  1942. {
  1943. "typename": "System.Byte",
  1944. "assembly": "mscorlib"
  1945. },
  1946. {
  1947. "typename": "System.Collections.Generic.IEnumerable`1",
  1948. "assembly": "mscorlib"
  1949. },
  1950. {
  1951. "typename": "System.Collections.Generic.List`1",
  1952. "assembly": "mscorlib"
  1953. },
  1954. {
  1955. "typename": "System.Convert",
  1956. "assembly": "mscorlib"
  1957. },
  1958. {
  1959. "typename": "System.Diagnostics.DebuggableAttribute",
  1960. "assembly": "mscorlib"
  1961. },
  1962. {
  1963. "typename": "System.Diagnostics.DebuggableAttribute/DebuggingModes",
  1964. "assembly": "mscorlib"
  1965. },
  1966. {
  1967. "typename": "System.Diagnostics.DebuggerNonUserCodeAttribute",
  1968. "assembly": "mscorlib"
  1969. },
  1970. {
  1971. "typename": "System.Enum",
  1972. "assembly": "mscorlib"
  1973. },
  1974. {
  1975. "typename": "System.EventArgs",
  1976. "assembly": "mscorlib"
  1977. },
  1978. {
  1979. "typename": "System.EventHandler",
  1980. "assembly": "mscorlib"
  1981. },
  1982. {
  1983. "typename": "System.Globalization.CultureInfo",
  1984. "assembly": "mscorlib"
  1985. },
  1986. {
  1987. "typename": "System.IDisposable",
  1988. "assembly": "mscorlib"
  1989. },
  1990. {
  1991. "typename": "System.Math",
  1992. "assembly": "mscorlib"
  1993. },
  1994. {
  1995. "typename": "System.Object",
  1996. "assembly": "mscorlib"
  1997. },
  1998. {
  1999. "typename": "System.Reflection.Assembly",
  2000. "assembly": "mscorlib"
  2001. },
  2002. {
  2003. "typename": "System.Reflection.AssemblyCompanyAttribute",
  2004. "assembly": "mscorlib"
  2005. },
  2006. {
  2007. "typename": "System.Reflection.AssemblyConfigurationAttribute",
  2008. "assembly": "mscorlib"
  2009. },
  2010. {
  2011. "typename": "System.Reflection.AssemblyCopyrightAttribute",
  2012. "assembly": "mscorlib"
  2013. },
  2014. {
  2015. "typename": "System.Reflection.AssemblyDescriptionAttribute",
  2016. "assembly": "mscorlib"
  2017. },
  2018. {
  2019. "typename": "System.Reflection.AssemblyFileVersionAttribute",
  2020. "assembly": "mscorlib"
  2021. },
  2022. {
  2023. "typename": "System.Reflection.AssemblyProductAttribute",
  2024. "assembly": "mscorlib"
  2025. },
  2026. {
  2027. "typename": "System.Reflection.AssemblyTitleAttribute",
  2028. "assembly": "mscorlib"
  2029. },
  2030. {
  2031. "typename": "System.Reflection.AssemblyTrademarkAttribute",
  2032. "assembly": "mscorlib"
  2033. },
  2034. {
  2035. "typename": "System.Resources.ResourceManager",
  2036. "assembly": "mscorlib"
  2037. },
  2038. {
  2039. "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
  2040. "assembly": "mscorlib"
  2041. },
  2042. {
  2043. "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
  2044. "assembly": "mscorlib"
  2045. },
  2046. {
  2047. "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
  2048. "assembly": "mscorlib"
  2049. },
  2050. {
  2051. "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
  2052. "assembly": "mscorlib"
  2053. },
  2054. {
  2055. "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
  2056. "assembly": "mscorlib"
  2057. },
  2058. {
  2059. "typename": "System.Runtime.InteropServices.GuidAttribute",
  2060. "assembly": "mscorlib"
  2061. },
  2062. {
  2063. "typename": "System.RuntimeFieldHandle",
  2064. "assembly": "mscorlib"
  2065. },
  2066. {
  2067. "typename": "System.RuntimeTypeHandle",
  2068. "assembly": "mscorlib"
  2069. },
  2070. {
  2071. "typename": "System.Single",
  2072. "assembly": "mscorlib"
  2073. },
  2074. {
  2075. "typename": "System.String",
  2076. "assembly": "mscorlib"
  2077. },
  2078. {
  2079. "typename": "System.Text.Encoding",
  2080. "assembly": "mscorlib"
  2081. },
  2082. {
  2083. "typename": "System.Type",
  2084. "assembly": "mscorlib"
  2085. },
  2086. {
  2087. "typename": "System.ValueType",
  2088. "assembly": "mscorlib"
  2089. }
  2090. ]
  2091. },
  2092. "pe": {
  2093. "peid_signatures": null,
  2094. "imports": [
  2095. {
  2096. "imports": [
  2097. {
  2098. "name": "_CorExeMain",
  2099. "address": "0x402000"
  2100. }
  2101. ],
  2102. "dll": "mscoree.dll"
  2103. }
  2104. ],
  2105. "digital_signers": null,
  2106. "exported_dll_name": null,
  2107. "actual_checksum": "0x0006cb04",
  2108. "overlay": null,
  2109. "imagebase": "0x00400000",
  2110. "reported_checksum": "0x00000000",
  2111. "icon_hash": null,
  2112. "entrypoint": "0x00462dde",
  2113. "timestamp": "2019-06-18 09:24:18",
  2114. "osversion": "4.0",
  2115. "sections": [
  2116. {
  2117. "name": ".text",
  2118. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  2119. "virtual_address": "0x00002000",
  2120. "size_of_data": "0x00060e00",
  2121. "entropy": "7.92",
  2122. "raw_address": "0x00000200",
  2123. "virtual_size": "0x00060de4",
  2124. "characteristics_raw": "0x60000020"
  2125. },
  2126. {
  2127. "name": ".rsrc",
  2128. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2129. "virtual_address": "0x00064000",
  2130. "size_of_data": "0x00000600",
  2131. "entropy": "4.12",
  2132. "raw_address": "0x00061000",
  2133. "virtual_size": "0x000005b6",
  2134. "characteristics_raw": "0x40000040"
  2135. },
  2136. {
  2137. "name": ".reloc",
  2138. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  2139. "virtual_address": "0x00066000",
  2140. "size_of_data": "0x00000200",
  2141. "entropy": "0.10",
  2142. "raw_address": "0x00061600",
  2143. "virtual_size": "0x0000000c",
  2144. "characteristics_raw": "0x42000040"
  2145. }
  2146. ],
  2147. "resources": [],
  2148. "dirents": [
  2149. {
  2150. "virtual_address": "0x00000000",
  2151. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  2152. "size": "0x00000000"
  2153. },
  2154. {
  2155. "virtual_address": "0x00062d8c",
  2156. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  2157. "size": "0x0000004f"
  2158. },
  2159. {
  2160. "virtual_address": "0x00064000",
  2161. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  2162. "size": "0x000005b6"
  2163. },
  2164. {
  2165. "virtual_address": "0x00000000",
  2166. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  2167. "size": "0x00000000"
  2168. },
  2169. {
  2170. "virtual_address": "0x00000000",
  2171. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  2172. "size": "0x00000000"
  2173. },
  2174. {
  2175. "virtual_address": "0x00066000",
  2176. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  2177. "size": "0x0000000c"
  2178. },
  2179. {
  2180. "virtual_address": "0x00000000",
  2181. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  2182. "size": "0x00000000"
  2183. },
  2184. {
  2185. "virtual_address": "0x00000000",
  2186. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  2187. "size": "0x00000000"
  2188. },
  2189. {
  2190. "virtual_address": "0x00000000",
  2191. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  2192. "size": "0x00000000"
  2193. },
  2194. {
  2195. "virtual_address": "0x00000000",
  2196. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  2197. "size": "0x00000000"
  2198. },
  2199. {
  2200. "virtual_address": "0x00000000",
  2201. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  2202. "size": "0x00000000"
  2203. },
  2204. {
  2205. "virtual_address": "0x00000000",
  2206. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  2207. "size": "0x00000000"
  2208. },
  2209. {
  2210. "virtual_address": "0x00002000",
  2211. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  2212. "size": "0x00000008"
  2213. },
  2214. {
  2215. "virtual_address": "0x00000000",
  2216. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  2217. "size": "0x00000000"
  2218. },
  2219. {
  2220. "virtual_address": "0x00002008",
  2221. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  2222. "size": "0x00000048"
  2223. },
  2224. {
  2225. "virtual_address": "0x00000000",
  2226. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  2227. "size": "0x00000000"
  2228. }
  2229. ],
  2230. "exports": [],
  2231. "guest_signers": {},
  2232. "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
  2233. "icon_fuzzy": null,
  2234. "icon": null,
  2235. "pdbpath": null,
  2236. "imported_dll_count": 1,
  2237. "versioninfo": []
  2238. }
  2239. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!