[*] MalFamily: "Ispy"

[*] MalScore: 10.0

[*] File Name: "HawkEye_6603fd56959d2773b45ccba6a98cb873.exe"
[*] File Size: 566272
[*] File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
[*] SHA256: "188516b9056f5175f61c8ac1201649360354993af77cfa38c3988fca06f63808"
[*] MD5: "6603fd56959d2773b45ccba6a98cb873"
[*] SHA1: "d1e0f931f330a5bf6e2e2699dd79e2a1bbf5d0e0"
[*] SHA512: "6864910ccb224272d4c0088ecaa27572e0e6eb69a99417661a35b638968a2d7f5ca280bffbc1783d511c52cd4eb19009351224dcf644f5203e1c1fb1e7175db6"
[*] CRC32: "9D7D60F8"
[*] SSDEEP: "12288:aZWETxtYn0CtMjoUexjrTadcWBbfoz9N8SCcI7NUqIFzGRIF6nj1K20XdD/S8Ch7:aZWEfYnDMjjQjCdx5ojI"

[*] Process Execution: [
    "HawkEye_6603fd56959d2773b45ccba6a98cb873.exe"
]

[*] Signatures Detected: [
    {
        "Description": "Creates RWX memory",
        "Details": []
    },
    {
        "Description": "The binary likely contains encrypted or compressed data.",
        "Details": [
            {
                "section": "name: .text, entropy: 6.84, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00089400, virtual_size: 0x00089304"
            }
        ]
    },
    {
        "Description": "Exhibits behavior characteristic of iSpy Keylogger",
        "Details": []
    },
    {
        "Description": "File has been identified by 41 Antiviruses on VirusTotal as malicious",
        "Details": [
            {
                "MicroWorld-eScan": "Trojan.MSIL.Agent.DSB"
            },
            {
                "FireEye": "Generic.mg.6603fd56959d2773"
            },
            {
                "ALYac": "Trojan.MSIL.Agent.DSB"
            },
            {
                "Malwarebytes": "Spyware.HawkEyeKeyLogger"
            },
            {
                "K7GW": "Spyware ( 005045191 )"
            },
            {
                "K7AntiVirus": "Spyware ( 005045191 )"
            },
            {
                "Arcabit": "Trojan.MSIL.Agent.DSB"
            },
            {
                "Invincea": "heuristic"
            },
            {
                "Symantec": "ML.Attribute.HighConfidence"
            },
            {
                "APEX": "Malicious"
            },
            {
                "Kaspersky": "not-a-virus:HEUR:PSWTool.Win32.NetPass.gen"
            },
            {
                "BitDefender": "Trojan.MSIL.Agent.DSB"
            },
            {
                "Avast": "Win32:KeyloggerX-gen [Trj]"
            },
            {
                "Ad-Aware": "Trojan.MSIL.Agent.DSB"
            },
            {
                "Sophos": "Mal/Agent-ATH"
            },
            {
                "F-Secure": "Trojan.TR/Dropper.Gen"
            },
            {
                "DrWeb": "Trojan.Packed2.41525"
            },
            {
                "TrendMicro": "TrojanSpy.MSIL.HAWKEYE.SM"
            },
            {
                "McAfee-GW-Edition": "BehavesLike.Win32.Generic.hh"
            },
            {
                "Emsisoft": "Trojan.MSIL.Agent.DSB (B)"
            },
            {
                "Jiangmin": "PSWTool.NetPass.li"
            },
            {
                "Avira": "TR/Dropper.Gen"
            },
            {
                "MAX": "malware (ai score=83)"
            },
            {
                "Microsoft": "TrojanSpy:MSIL/Keylog.B"
            },
            {
                "Endgame": "malicious (high confidence)"
            },
            {
                "ZoneAlarm": "not-a-virus:HEUR:PSWTool.Win32.NetPass.gen"
            },
            {
                "GData": "Trojan.MSIL.Agent.DSB"
            },
            {
                "AhnLab-V3": "Spyware/Win32.Hawkeye.C2924992"
            },
            {
                "McAfee": "PUP-XGY-FF"
            },
            {
                "VBA32": "CIL.StupidCryptor.Heur"
            },
            {
                "Cylance": "Unsafe"
            },
            {
                "Zoner": "Trojan.Win32.74604"
            },
            {
                "ESET-NOD32": "a variant of MSIL/Spy.Agent.AUS"
            },
            {
                "TrendMicro-HouseCall": "TrojanSpy.MSIL.HAWKEYE.SM"
            },
            {
                "Rising": "Spyware.Agent!8.C6 (TFE:dGZlOg2uDcpKicjleQ)"
            },
            {
                "SentinelOne": "DFI - Malicious PE"
            },
            {
                "eGambit": "Unsafe.AI_Score_84%"
            },
            {
                "AVG": "Win32:KeyloggerX-gen [Trj]"
            },
            {
                "Cybereason": "malicious.6959d2"
            },
            {
                "CrowdStrike": "win/malicious_confidence_100% (W)"
            },
            {
                "Qihoo-360": "HEUR/QVM03.0.393B.Malware.Gen"
            }
        ]
    }
]

[*] Started Service: []

[*] Executed Commands: []

[*] Mutexes: [
    "Global\\CLR_CASOFF_MUTEX"
]

[*] Modified Files: []

[*] Deleted Files: []

[*] Modified Registry Keys: []

[*] Deleted Registry Keys: []

[*] DNS Communications: []

[*] Domains: []

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: []

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {
    "dotnet": {
        "customattrs": null,
        "assemblyinfo": {
            "version": "9.0.0.4",
            "name": "Reborn Stub"
        },
        "assemblyrefs": [
            {
                "version": "2.0.0.0",
                "name": "mscorlib"
            },
            {
                "version": "8.0.0.0",
                "name": "Microsoft.VisualBasic"
            },
            {
                "version": "2.0.0.0",
                "name": "System"
            },
            {
                "version": "2.0.0.0",
                "name": "System.Windows.Forms"
            },
            {
                "version": "2.0.0.0",
                "name": "System.Drawing"
            },
            {
                "version": "2.0.0.0",
                "name": "System.Management"
            },
            {
                "version": "2.0.0.0",
                "name": "System.Xml"
            },
            {
                "version": "0.0.0.0",
                "name": "GpJmmfYBHDiNqFjcVKSNxCwyuuWmA"
            }
        ],
        "typerefs": [
            {
                "typename": "Microsoft.VisualBasic.ApplicationServices.ConsoleApplicationBase",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.ApplicationServices.User",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompareMethod",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.Conversions",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.Operators",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.ProjectData",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.StandardModuleAttribute",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.Utils",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.Devices.Computer",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.HideModuleNameAttribute",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.MyGroupCollectionAttribute",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.Strings",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
                "assembly": "System"
            },
            {
                "typename": "System.Collections.Specialized.NameValueCollection",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.Component",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.Design.HelpKeywordAttribute",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.EditorBrowsableAttribute",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.EditorBrowsableState",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.Win32Exception",
                "assembly": "System"
            },
            {
                "typename": "System.Configuration.ApplicationSettingsBase",
                "assembly": "System"
            },
            {
                "typename": "System.Configuration.SettingsBase",
                "assembly": "System"
            },
            {
                "typename": "System.Diagnostics.Process",
                "assembly": "System"
            },
            {
                "typename": "System.Diagnostics.ProcessModule",
                "assembly": "System"
            },
            {
                "typename": "System.Diagnostics.ProcessStartInfo",
                "assembly": "System"
            },
            {
                "typename": "System.Diagnostics.ProcessThread",
                "assembly": "System"
            },
            {
                "typename": "System.Diagnostics.ProcessThreadCollection",
                "assembly": "System"
            },
            {
                "typename": "System.Diagnostics.ProcessWindowStyle",
                "assembly": "System"
            },
            {
                "typename": "System.Net.Dns",
                "assembly": "System"
            },
            {
                "typename": "System.Net.FtpWebRequest",
                "assembly": "System"
            },
            {
                "typename": "System.Net.FtpWebResponse",
                "assembly": "System"
            },
            {
                "typename": "System.Net.HttpWebRequest",
                "assembly": "System"
            },
            {
                "typename": "System.Net.ICredentials",
                "assembly": "System"
            },
            {
                "typename": "System.Net.ICredentialsByHost",
                "assembly": "System"
            },
            {
                "typename": "System.Net.IPAddress",
                "assembly": "System"
            },
            {
                "typename": "System.Net.IPHostEntry",
                "assembly": "System"
            },
            {
                "typename": "System.Net.Mail.MailAddress",
                "assembly": "System"
            },
            {
                "typename": "System.Net.Mail.MailAddressCollection",
                "assembly": "System"
            },
            {
                "typename": "System.Net.Mail.MailMessage",
                "assembly": "System"
            },
            {
                "typename": "System.Net.Mail.SmtpClient",
                "assembly": "System"
            },
            {
                "typename": "System.Net.NetworkCredential",
                "assembly": "System"
            },
            {
                "typename": "System.Net.NetworkInformation.NetworkInterface",
                "assembly": "System"
            },
            {
                "typename": "System.Net.NetworkInformation.NetworkInterfaceType",
                "assembly": "System"
            },
            {
                "typename": "System.Net.NetworkInformation.OperationalStatus",
                "assembly": "System"
            },
            {
                "typename": "System.Net.Sockets.AddressFamily",
                "assembly": "System"
            },
            {
                "typename": "System.Net.WebClient",
                "assembly": "System"
            },
            {
                "typename": "System.Net.WebException",
                "assembly": "System"
            },
            {
                "typename": "System.Net.WebRequest",
                "assembly": "System"
            },
            {
                "typename": "System.Net.WebResponse",
                "assembly": "System"
            },
            {
                "typename": "System.Text.RegularExpressions.Capture",
                "assembly": "System"
            },
            {
                "typename": "System.Text.RegularExpressions.Group",
                "assembly": "System"
            },
            {
                "typename": "System.Text.RegularExpressions.GroupCollection",
                "assembly": "System"
            },
            {
                "typename": "System.Text.RegularExpressions.Match",
                "assembly": "System"
            },
            {
                "typename": "System.Text.RegularExpressions.Regex",
                "assembly": "System"
            },
            {
                "typename": "System.Drawing.Bitmap",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.CopyPixelOperation",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Graphics",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Image",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Imaging.ImageFormat",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Imaging.PixelFormat",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Rectangle",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Size",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Management.ManagementBaseObject",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.ManagementDateTimeConverter",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.ManagementObject",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.ManagementObjectCollection",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.ManagementObjectCollection/ManagementObjectEnumerator",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.ManagementObjectSearcher",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.PropertyData",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.PropertyDataCollection",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Windows.Forms.Application",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Clipboard",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Control",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.CreateParams",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.DialogResult",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Form",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.IDataObject",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Keys",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Message",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.MessageBox",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.MessageBoxButtons",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.MessageBoxIcon",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.NativeWindow",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Screen",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.SystemInformation",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Xml.XmlReader",
                "assembly": "System.Xml"
            },
            {
                "typename": "Microsoft.Win32.Registry",
                "assembly": "mscorlib"
            },
            {
                "typename": "Microsoft.Win32.RegistryKey",
                "assembly": "mscorlib"
            },
            {
                "typename": "Microsoft.Win32.RegistryValueKind",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Activator",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.AppDomain",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Array",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.AsyncCallback",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Attribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.BitConverter",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Buffer",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Byte",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Char",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Collections.Generic.Dictionary`2",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Collections.Generic.List`1",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Collections.Generic.List`1/Enumerator",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Collections.Hashtable",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Console",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Convert",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.DateTime",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Delegate",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.DebuggableAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.DebuggableAttribute/DebuggingModes",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.Debugger",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.DebuggerHiddenAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.DebuggerNonUserCodeAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Enum",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Environment",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Environment/SpecialFolder",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.EventArgs",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Exception",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.FlagsAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.GC",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Globalization.CultureInfo",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Guid",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IAsyncResult",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IDisposable",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IFormatProvider",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.Directory",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.DirectoryInfo",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.File",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.FileAttributes",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.MemoryStream",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.Path",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.Stream",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.StreamReader",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.StreamWriter",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Int32",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Int64",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IntPtr",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.InvalidOperationException",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Math",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.MidpointRounding",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.MulticastDelegate",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Object",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ParamArrayAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Random",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.Assembly",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyCompanyAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyCopyrightAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyDescriptionAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyFileVersionAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyProductAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyTitleAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyTrademarkAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.DefaultMemberAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.MethodBase",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.MethodInfo",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.TargetInvocationException",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ResolveEventArgs",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ResolveEventHandler",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Resources.ResourceManager",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.AccessedThroughPropertyAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.SuppressIldasmAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.GCHandle",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.GCHandleType",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.GuidAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.Marshal",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.Serialization.Formatters.Binary.BinaryFormatter",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.Serialization.SerializationBinder",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.RuntimeFieldHandle",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.RuntimeTypeHandle",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.STAThreadAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.AccessControlType",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.AceFlags",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.AceQualifier",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.CommonAce",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.DirectorySecurity",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.GenericAce",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.GenericSecurityDescriptor",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.InheritanceFlags",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.ObjectSecurity",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.PropagationFlags",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.RawAcl",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.RawSecurityDescriptor",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.RegistryAccessRule",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.RegistryRights",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.RegistrySecurity",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.CipherMode",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.CryptoStream",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.CryptoStreamMode",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.DESCryptoServiceProvider",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.HashAlgorithm",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.ICryptoTransform",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.MD5",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.MD5CryptoServiceProvider",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.PaddingMode",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.Rfc2898DeriveBytes",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.RijndaelManaged",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.SymmetricAlgorithm",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.IdentityReference",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.NTAccount",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.SecurityIdentifier",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.WellKnownSidType",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.WindowsBuiltInRole",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.WindowsIdentity",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.WindowsPrincipal",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.SuppressUnmanagedCodeSecurityAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.String",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.StringSplitOptions",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Text.ASCIIEncoding",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Text.Encoding",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Text.StringBuilder",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Text.UTF8Encoding",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ThreadStaticAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.ApartmentState",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.Interlocked",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.Monitor",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.Mutex",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.ParameterizedThreadStart",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.Thread",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.ThreadStart",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.TimeSpan",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Type",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.UInt32",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ValueType",
                "assembly": "mscorlib"
            }
        ]
    },
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "_CorExeMain",
                        "address": "0x402000"
                    }
                ],
                "dll": "mscoree.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x00093c1c",
        "overlay": null,
        "imagebase": "0x00400000",
        "reported_checksum": "0x00000000",
        "icon_hash": null,
        "entrypoint": "0x0048b2fe",
        "timestamp": "2019-01-22 15:01:45",
        "osversion": "4.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00002000",
                "size_of_data": "0x00089400",
                "entropy": "6.84",
                "raw_address": "0x00000200",
                "virtual_size": "0x00089304",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x0008c000",
                "size_of_data": "0x00000c00",
                "entropy": "6.62",
                "raw_address": "0x00089600",
                "virtual_size": "0x00000b0c",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".reloc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x0008e000",
                "size_of_data": "0x00000200",
                "entropy": "0.08",
                "raw_address": "0x0008a200",
                "virtual_size": "0x0000000c",
                "characteristics_raw": "0x42000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x0008b2a8",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x00000053"
            },
            {
                "virtual_address": "0x0008c000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x00000b0c"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x0008e000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x0000000c"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00002000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000008"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00002008",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000048"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 1,
        "versioninfo": []
    }
}

[*] Resolved APIs: [
    "advapi32.dll.RegOpenKeyExW",
    "advapi32.dll.RegQueryInfoKeyW",
    "advapi32.dll.RegEnumKeyExW",
    "advapi32.dll.RegEnumValueW",
    "advapi32.dll.RegCloseKey",
    "advapi32.dll.RegQueryValueExW",
    "kernel32.dll.QueryActCtxW",
    "shlwapi.dll.UrlIsW",
    "kernel32.dll.FlsAlloc",
    "kernel32.dll.FlsGetValue",
    "kernel32.dll.FlsSetValue",
    "kernel32.dll.FlsFree",
    "kernel32.dll.InitializeCriticalSectionAndSpinCount",
    "kernel32.dll.IsProcessorFeaturePresent",
    "msvcrt.dll._set_error_mode",
    "msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z",
    "kernel32.dll.FindActCtxSectionStringW",
    "kernel32.dll.GetSystemWindowsDirectoryW",
    "mscoree.dll.GetProcessExecutableHeap",
    "mscorwks.dll._CorExeMain",
    "mscorwks.dll.GetCLRFunction",
    "advapi32.dll.RegisterTraceGuidsW",
    "advapi32.dll.UnregisterTraceGuids",
    "advapi32.dll.GetTraceLoggerHandle",
    "advapi32.dll.GetTraceEnableLevel",
    "advapi32.dll.GetTraceEnableFlags",
    "advapi32.dll.TraceEvent",
    "mscoree.dll.IEE",
    "mscorwks.dll.IEE",
    "mscoree.dll.GetStartupFlags",
    "mscoree.dll.GetHostConfigurationFile",
    "mscoree.dll.GetCORSystemDirectory",
    "ntdll.dll.RtlUnwind",
    "kernel32.dll.IsWow64Process",
    "advapi32.dll.AllocateAndInitializeSid",
    "advapi32.dll.OpenProcessToken",
    "advapi32.dll.GetTokenInformation",
    "advapi32.dll.InitializeAcl",
    "advapi32.dll.AddAccessAllowedAce",
    "advapi32.dll.FreeSid",
    "kernel32.dll.SetThreadStackGuarantee",
    "kernel32.dll.AddVectoredContinueHandler",
    "kernel32.dll.RemoveVectoredContinueHandler",
    "advapi32.dll.ConvertSidToStringSidW",
    "shell32.dll.SHGetFolderPathW",
    "kernel32.dll.FlushProcessWriteBuffers",
    "kernel32.dll.GetWriteWatch",
    "kernel32.dll.ResetWriteWatch",
    "kernel32.dll.CreateMemoryResourceNotification",
    "kernel32.dll.QueryMemoryResourceNotification",
    "ole32.dll.CoInitializeEx",
    "cryptbase.dll.SystemFunction036",
    "uxtheme.dll.ThemeInitApiHook",
    "user32.dll.IsProcessDPIAware",
    "ole32.dll.CoGetContextToken",
    "kernel32.dll.GetFullPathNameW",
    "kernel32.dll.GetVersionExW",
    "advapi32.dll.CryptAcquireContextA",
    "advapi32.dll.CryptReleaseContext",
    "advapi32.dll.CryptCreateHash",
    "advapi32.dll.CryptDestroyHash",
    "advapi32.dll.CryptHashData",
    "advapi32.dll.CryptGetHashParam",
    "advapi32.dll.CryptImportKey",
    "advapi32.dll.CryptExportKey",
    "advapi32.dll.CryptGenKey",
    "advapi32.dll.CryptGetKeyParam",
    "advapi32.dll.CryptDestroyKey",
    "advapi32.dll.CryptVerifySignatureA",
    "advapi32.dll.CryptSignHashA",
    "advapi32.dll.CryptGetProvParam",
    "advapi32.dll.CryptGetUserKey",
    "advapi32.dll.CryptEnumProvidersA",
    "mscoree.dll.GetMetaDataInternalInterface",
    "mscorwks.dll.GetMetaDataInternalInterface",
    "mscorjit.dll.getJit",
    "kernel32.dll.GlobalMemoryStatusEx",
    "kernel32.dll.GetEnvironmentVariableW",
    "kernel32.dll.SwitchToThread",
    "kernel32.dll.LoadLibraryW",
    "kernel32.dll.EnumResourceTypesW",
    "kernel32.dll.EnumResourceNamesW",
    "kernel32.dll.lstrlen",
    "kernel32.dll.lstrlenW",
    "kernel32.dll.GetModuleFileNameW",
    "kernel32.dll.RtlMoveMemory",
    "kernel32.dll.FindResourceW",
    "kernel32.dll.SizeofResource",
    "kernel32.dll.LoadResource",
    "kernel32.dll.LockResource",
    "kernel32.dll.GetUserDefaultUILanguage",
    "kernel32.dll.FreeLibrary",
    "cryptsp.dll.CryptAcquireContextW",
    "cryptsp.dll.CryptCreateHash",
    "bcrypt.dll.BCryptGetFipsAlgorithmMode",
    "cryptsp.dll.CryptGenRandom",
    "cryptsp.dll.CryptHashData",
    "cryptsp.dll.CryptGetHashParam",
    "cryptsp.dll.CryptDestroyHash"
]

[*] Static Analysis: {
    "dotnet": {
        "customattrs": null,
        "assemblyinfo": {
            "version": "9.0.0.4",
            "name": "Reborn Stub"
        },
        "assemblyrefs": [
            {
                "version": "2.0.0.0",
                "name": "mscorlib"
            },
            {
                "version": "8.0.0.0",
                "name": "Microsoft.VisualBasic"
            },
            {
                "version": "2.0.0.0",
                "name": "System"
            },
            {
                "version": "2.0.0.0",
                "name": "System.Windows.Forms"
            },
            {
                "version": "2.0.0.0",
                "name": "System.Drawing"
            },
            {
                "version": "2.0.0.0",
                "name": "System.Management"
            },
            {
                "version": "2.0.0.0",
                "name": "System.Xml"
            },
            {
                "version": "0.0.0.0",
                "name": "GpJmmfYBHDiNqFjcVKSNxCwyuuWmA"
            }
        ],
        "typerefs": [
            {
                "typename": "Microsoft.VisualBasic.ApplicationServices.ConsoleApplicationBase",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.ApplicationServices.User",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompareMethod",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.Conversions",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.Operators",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.ProjectData",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.StandardModuleAttribute",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.CompilerServices.Utils",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.Devices.Computer",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.HideModuleNameAttribute",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.MyGroupCollectionAttribute",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.Strings",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
                "assembly": "System"
            },
            {
                "typename": "System.Collections.Specialized.NameValueCollection",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.Component",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.Design.HelpKeywordAttribute",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.EditorBrowsableAttribute",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.EditorBrowsableState",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.Win32Exception",
                "assembly": "System"
            },
            {
                "typename": "System.Configuration.ApplicationSettingsBase",
                "assembly": "System"
            },
            {
                "typename": "System.Configuration.SettingsBase",
                "assembly": "System"
            },
            {
                "typename": "System.Diagnostics.Process",
                "assembly": "System"
            },
            {
                "typename": "System.Diagnostics.ProcessModule",
                "assembly": "System"
            },
            {
                "typename": "System.Diagnostics.ProcessStartInfo",
                "assembly": "System"
            },
            {
                "typename": "System.Diagnostics.ProcessThread",
                "assembly": "System"
            },
            {
                "typename": "System.Diagnostics.ProcessThreadCollection",
                "assembly": "System"
            },
            {
                "typename": "System.Diagnostics.ProcessWindowStyle",
                "assembly": "System"
            },
            {
                "typename": "System.Net.Dns",
                "assembly": "System"
            },
            {
                "typename": "System.Net.FtpWebRequest",
                "assembly": "System"
            },
            {
                "typename": "System.Net.FtpWebResponse",
                "assembly": "System"
            },
            {
                "typename": "System.Net.HttpWebRequest",
                "assembly": "System"
            },
            {
                "typename": "System.Net.ICredentials",
                "assembly": "System"
            },
            {
                "typename": "System.Net.ICredentialsByHost",
                "assembly": "System"
            },
            {
                "typename": "System.Net.IPAddress",
                "assembly": "System"
            },
            {
                "typename": "System.Net.IPHostEntry",
                "assembly": "System"
            },
            {
                "typename": "System.Net.Mail.MailAddress",
                "assembly": "System"
            },
            {
                "typename": "System.Net.Mail.MailAddressCollection",
                "assembly": "System"
            },
            {
                "typename": "System.Net.Mail.MailMessage",
                "assembly": "System"
            },
            {
                "typename": "System.Net.Mail.SmtpClient",
                "assembly": "System"
            },
            {
                "typename": "System.Net.NetworkCredential",
                "assembly": "System"
            },
            {
                "typename": "System.Net.NetworkInformation.NetworkInterface",
                "assembly": "System"
            },
            {
                "typename": "System.Net.NetworkInformation.NetworkInterfaceType",
                "assembly": "System"
            },
            {
                "typename": "System.Net.NetworkInformation.OperationalStatus",
                "assembly": "System"
            },
            {
                "typename": "System.Net.Sockets.AddressFamily",
                "assembly": "System"
            },
            {
                "typename": "System.Net.WebClient",
                "assembly": "System"
            },
            {
                "typename": "System.Net.WebException",
                "assembly": "System"
            },
            {
                "typename": "System.Net.WebRequest",
                "assembly": "System"
            },
            {
                "typename": "System.Net.WebResponse",
                "assembly": "System"
            },
            {
                "typename": "System.Text.RegularExpressions.Capture",
                "assembly": "System"
            },
            {
                "typename": "System.Text.RegularExpressions.Group",
                "assembly": "System"
            },
            {
                "typename": "System.Text.RegularExpressions.GroupCollection",
                "assembly": "System"
            },
            {
                "typename": "System.Text.RegularExpressions.Match",
                "assembly": "System"
            },
            {
                "typename": "System.Text.RegularExpressions.Regex",
                "assembly": "System"
            },
            {
                "typename": "System.Drawing.Bitmap",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.CopyPixelOperation",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Graphics",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Image",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Imaging.ImageFormat",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Imaging.PixelFormat",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Rectangle",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Size",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Management.ManagementBaseObject",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.ManagementDateTimeConverter",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.ManagementObject",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.ManagementObjectCollection",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.ManagementObjectCollection/ManagementObjectEnumerator",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.ManagementObjectSearcher",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.PropertyData",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Management.PropertyDataCollection",
                "assembly": "System.Management"
            },
            {
                "typename": "System.Windows.Forms.Application",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Clipboard",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Control",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.CreateParams",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.DialogResult",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Form",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.IDataObject",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Keys",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Message",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.MessageBox",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.MessageBoxButtons",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.MessageBoxIcon",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.NativeWindow",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Screen",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.SystemInformation",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Xml.XmlReader",
                "assembly": "System.Xml"
            },
            {
                "typename": "Microsoft.Win32.Registry",
                "assembly": "mscorlib"
            },
            {
                "typename": "Microsoft.Win32.RegistryKey",
                "assembly": "mscorlib"
            },
            {
                "typename": "Microsoft.Win32.RegistryValueKind",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Activator",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.AppDomain",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Array",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.AsyncCallback",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Attribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.BitConverter",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Buffer",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Byte",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Char",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Collections.Generic.Dictionary`2",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Collections.Generic.List`1",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Collections.Generic.List`1/Enumerator",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Collections.Hashtable",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Console",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Convert",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.DateTime",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Delegate",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.DebuggableAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.DebuggableAttribute/DebuggingModes",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.Debugger",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.DebuggerHiddenAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.DebuggerNonUserCodeAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Enum",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Environment",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Environment/SpecialFolder",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.EventArgs",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Exception",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.FlagsAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.GC",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Globalization.CultureInfo",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Guid",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IAsyncResult",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IDisposable",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IFormatProvider",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.Directory",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.DirectoryInfo",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.File",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.FileAttributes",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.MemoryStream",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.Path",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.Stream",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.StreamReader",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IO.StreamWriter",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Int32",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Int64",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IntPtr",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.InvalidOperationException",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Math",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.MidpointRounding",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.MulticastDelegate",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Object",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ParamArrayAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Random",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.Assembly",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyCompanyAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyCopyrightAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyDescriptionAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyFileVersionAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyProductAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyTitleAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyTrademarkAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.DefaultMemberAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.MethodBase",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.MethodInfo",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.TargetInvocationException",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ResolveEventArgs",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ResolveEventHandler",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Resources.ResourceManager",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.AccessedThroughPropertyAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.SuppressIldasmAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.GCHandle",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.GCHandleType",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.GuidAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.Marshal",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.Serialization.Formatters.Binary.BinaryFormatter",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.Serialization.SerializationBinder",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.RuntimeFieldHandle",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.RuntimeTypeHandle",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.STAThreadAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.AccessControlType",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.AceFlags",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.AceQualifier",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.CommonAce",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.DirectorySecurity",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.GenericAce",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.GenericSecurityDescriptor",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.InheritanceFlags",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.ObjectSecurity",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.PropagationFlags",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.RawAcl",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.RawSecurityDescriptor",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.RegistryAccessRule",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.RegistryRights",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.AccessControl.RegistrySecurity",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.CipherMode",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.CryptoStream",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.CryptoStreamMode",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.DESCryptoServiceProvider",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.HashAlgorithm",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.ICryptoTransform",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.MD5",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.MD5CryptoServiceProvider",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.PaddingMode",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.Rfc2898DeriveBytes",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.RijndaelManaged",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Cryptography.SymmetricAlgorithm",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.IdentityReference",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.NTAccount",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.SecurityIdentifier",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.WellKnownSidType",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.WindowsBuiltInRole",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.WindowsIdentity",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.Principal.WindowsPrincipal",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Security.SuppressUnmanagedCodeSecurityAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.String",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.StringSplitOptions",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Text.ASCIIEncoding",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Text.Encoding",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Text.StringBuilder",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Text.UTF8Encoding",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ThreadStaticAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.ApartmentState",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.Interlocked",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.Monitor",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.Mutex",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.ParameterizedThreadStart",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.Thread",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Threading.ThreadStart",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.TimeSpan",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Type",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.UInt32",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ValueType",
                "assembly": "mscorlib"
            }
        ]
    },
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "_CorExeMain",
                        "address": "0x402000"
                    }
                ],
                "dll": "mscoree.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x00093c1c",
        "overlay": null,
        "imagebase": "0x00400000",
        "reported_checksum": "0x00000000",
        "icon_hash": null,
        "entrypoint": "0x0048b2fe",
        "timestamp": "2019-01-22 15:01:45",
        "osversion": "4.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00002000",
                "size_of_data": "0x00089400",
                "entropy": "6.84",
                "raw_address": "0x00000200",
                "virtual_size": "0x00089304",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x0008c000",
                "size_of_data": "0x00000c00",
                "entropy": "6.62",
                "raw_address": "0x00089600",
                "virtual_size": "0x00000b0c",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".reloc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x0008e000",
                "size_of_data": "0x00000200",
                "entropy": "0.08",
                "raw_address": "0x0008a200",
                "virtual_size": "0x0000000c",
                "characteristics_raw": "0x42000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x0008b2a8",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x00000053"
            },
            {
                "virtual_address": "0x0008c000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x00000b0c"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x0008e000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x0000000c"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00002000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000008"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00002008",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000048"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 1,
        "versioninfo": []
    }
}