{ "statistics": { "processing": [ { "name": "CAPE", "time": 6.721 }, { "name": "AnalysisInfo", "time": 0.015 }, { "name": "BehaviorAnalysis", "time": 0.97 }, { "name": "Debug", "time": 0.002 }, { "name": "NetworkAnalysis", "time": 1.059 }, { "name": "Suricata", "time": 8.082 }, { "name": "UrlAnalysis", "time": 0.0 }, { "name": "script_log_processing", "time": 0.0 }, { "name": "ProcessMemory", "time": 0.0 } ], "signatures": [ { "name": "packer_themida", "time": 0.0 }, { "name": "stealth_network", "time": 0.0 }, { "name": "disable_driver_via_blocklist", "time": 0.0 }, { "name": "disable_driver_via_hvcidisallowedimages", "time": 0.0 }, { "name": "disable_hypervisor_protected_code_integrity", "time": 0.0 }, { "name": "pendingfilerenameoperations_Operations", "time": 0.0 }, { "name": "anomalous_deletefile", "time": 0.0 }, { "name": "antiav_360_libs", "time": 0.0 }, { "name": "antiav_ahnlab_libs", "time": 0.0 }, { "name": "antiav_avast_libs", "time": 0.0 }, { "name": "antiav_bitdefender_libs", "time": 0.0 }, { "name": "antiav_bullguard_libs", "time": 0.0 }, { "name": "antiav_emsisoft_libs", "time": 0.0 }, { "name": "antiav_qurb_libs", "time": 0.0 }, { "name": "antiav_servicestop", "time": 0.0 }, { "name": "antiav_apioverride_libs", "time": 0.0 }, { "name": "antidebug_guardpages", "time": 0.0 }, { "name": "antidebug_ntcreatethreadex", "time": 0.0 }, { "name": "antiav_nthookengine_libs", "time": 0.0 }, { "name": "antidebug_outputdebugstring", "time": 0.0 }, { "name": "antidebug_setunhandledexceptionfilter", "time": 0.0 }, { "name": "antidebug_windows", "time": 0.0 }, { "name": "antisandbox_cuckoo", "time": 0.0 }, { "name": "antisandbox_cuckoocrash", "time": 0.0 }, { "name": "antisandbox_foregroundwindows", "time": 0.0 }, { "name": "mouse_movement_detect", "time": 0.0 }, { "name": "antisandbox_sboxie_libs", "time": 0.0 }, { "name": "antisandbox_sboxie_objects", "time": 0.0 }, { "name": "antisandbox_script_timer", "time": 0.0 }, { "name": "antisandbox_sleep", "time": 0.0 }, { "name": "antisandbox_sunbelt_libs", "time": 0.0 }, { "name": "antisandbox_unhook", "time": 0.0 }, { "name": "antivm_directory_objects", "time": 0.0 }, { "name": "antivm_display", "time": 0.0 }, { "name": "antivm_generic_disk", "time": 0.0 }, { "name": "antivm_generic_scsi", "time": 0.0 }, { "name": "antivm_generic_services", "time": 0.0 }, { "name": "antivm_generic_system", "time": 0.0 }, { "name": "antivm_checks_available_memory", "time": 0.0 }, { "name": "detect_virtualization_via_recent_files", "time": 0.0 }, { "name": "antivm_vbox_libs", "time": 0.0 }, { "name": "antivm_vbox_window", "time": 0.0 }, { "name": "antivm_vmware_events", "time": 0.0 }, { "name": "antivm_vmware_libs", "time": 0.0 }, { "name": "antivm_wmi", "time": 0.0 }, { "name": "api_spamming", "time": 0.0 }, { "name": "api_uuidfromstringa", "time": 0.0 }, { "name": "bcdedit_command", "time": 0.0 }, { "name": "bootkit", "time": 0.0 }, { "name": "direct_hdd_access", "time": 0.0 }, { "name": "physical_drive_access", "time": 0.0 }, { "name": "potential_overwrite_mbr", "time": 0.0 }, { "name": "read_file_raw_disk_access", "time": 0.0 }, { "name": "suspicious_iocontrol_codes", "time": 0.0 }, { "name": "browser_needed", "time": 0.0 }, { "name": "firefox_disables_process_tab", "time": 0.0 }, { "name": "regsvr32_squiblydoo_dll_load", "time": 0.0 }, { "name": "uac_bypass_cmstp", "time": 0.0 }, { "name": "uac_bypass_eventvwr", "time": 0.0 }, { "name": "uac_bypass_windows_Backup", "time": 0.0 }, { "name": "dotnet_code_compile", "time": 0.0 }, { "name": "queries_computer_name", "time": 0.0 }, { "name": "queries_user_name", "time": 0.0 }, { "name": "creates_largekey", "time": 0.0 }, { "name": "creates_nullvalue", "time": 0.0 }, { "name": "access_windows_passwords_vault", "time": 0.0 }, { "name": "dump_lsa_via_windows_error_reporting", "time": 0.0 }, { "name": "lsass_credential_dumping", "time": 0.0 }, { "name": "critical_process", "time": 0.0 }, { "name": "cryptopool_domains", "time": 0.0 }, { "name": "dead_connect", "time": 0.0 }, { "name": "dead_link", "time": 0.0 }, { "name": "decoy_document", "time": 0.0 }, { "name": "decoy_image", "time": 0.0 }, { "name": "deletes_consolehost_history", "time": 0.0 }, { "name": "deletes_shadow_copies", "time": 0.0 }, { "name": "deletes_system_state_backup", "time": 0.0 }, { "name": "dep_bypass", "time": 0.0 }, { "name": "dep_disable", "time": 0.0 }, { "name": "disables_mappeddrives_autodisconnect", "time": 0.0 }, { "name": "disables_spdy", "time": 0.0 }, { "name": "disables_wfp", "time": 0.0 }, { "name": "add_windows_defender_exclusions", "time": 0.0 }, { "name": "mountpoints_volume_discovery", "time": 0.0 }, { "name": "dll_load_uncommon_file_types", "time": 0.0 }, { "name": "document_script_exe_drop", "time": 0.0 }, { "name": "guloader_apis", "time": 0.0 }, { "name": "driver_load", "time": 0.0 }, { "name": "dynamic_function_loading", "time": 0.0 }, { "name": "encrypted_ioc", "time": 0.0 }, { "name": "exec_crash", "time": 0.0 }, { "name": "process_creation_suspicious_location", "time": 0.0 }, { "name": "exploit_getbasekerneladdress", "time": 0.0 }, { "name": "exploit_gethaldispatchtable", "time": 0.0 }, { "name": "exploit_heapspray", "time": 0.0 }, { "name": "koadic_apis", "time": 0.0 }, { "name": "koadic_network_activity", "time": 0.0 }, { "name": "downloads_from_filehosting", "time": 0.0 }, { "name": "generic_phish", "time": 0.0 }, { "name": "http_request", "time": 0.0 }, { "name": "infostealer_browser", "time": 0.0 }, { "name": "infostealer_browser_password", "time": 0.0 }, { "name": "infostealer_cookies", "time": 0.0 }, { "name": "cryptbot_network", "time": 0.0 }, { "name": "masslogger_artifacts", "time": 0.0 }, { "name": "masslogger_version", "time": 0.0 }, { "name": "purplewave_network_activity", "time": 0.0 }, { "name": "quilclipper_behavior", "time": 0.0 }, { "name": "raccoon_behavior", "time": 0.0 }, { "name": "captures_screenshot", "time": 0.0 }, { "name": "vidar_behavior", "time": 0.0 }, { "name": "injection_createremotethread", "time": 0.0 }, { "name": "creates_suspended_process", "time": 0.0 }, { "name": "injection_explorer", "time": 0.0 }, { "name": "injection_needextension", "time": 0.0 }, { "name": "injection_network_traffic", "time": 0.0 }, { "name": "injection_runpe", "time": 0.0 }, { "name": "injection_rwx", "time": 0.0 }, { "name": "injection_themeinitapihook", "time": 0.0 }, { "name": "resumethread_remote_process", "time": 0.0 }, { "name": "injection_write_exe_process", "time": 0.0 }, { "name": "injection_write_process", "time": 0.0 }, { "name": "internet_dropper", "time": 0.0 }, { "name": "escalate_privilege_via_named_pipe", "time": 0.0 }, { "name": "ipc_namedpipe", "time": 0.0 }, { "name": "js_phish", "time": 0.0 }, { "name": "js_suspicious_redirect", "time": 0.0 }, { "name": "loader_alien", "time": 0.0 }, { "name": "execute_binary_via_internet_explorer_exporter", "time": 0.0 }, { "name": "execute_binary_via_run_exe_helper_utility", "time": 0.0 }, { "name": "execute_ps_via_syncappvpublishingserver", "time": 0.0 }, { "name": "malicious_dynamic_function_loading", "time": 0.0 }, { "name": "encrypt_pcinfo", "time": 0.0 }, { "name": "encrypt_data_agenttesla_http", "time": 0.0 }, { "name": "encrypt_data_agentteslat2_http", "time": 0.0 }, { "name": "encrypt_data_nanocore", "time": 0.0 }, { "name": "reads_memory_remote_process", "time": 0.0 }, { "name": "mimics_filetime", "time": 0.0 }, { "name": "amsi_bypass_via_com_registry", "time": 0.0 }, { "name": "access_auto_logons_via_registry", "time": 0.0 }, { "name": "access_boot_key_via_registry", "time": 0.0 }, { "name": "create_suspicious_lnk_files", "time": 0.0 }, { "name": "credential_access_via_windows_credential_history", "time": 0.0 }, { "name": "dll_hijacking_via_microsoft_exchange", "time": 0.0 }, { "name": "dll_hijacking_via_waas_medic_svc_com_typelib", "time": 0.0 }, { "name": "execute_file_downloaded_via_openssh", "time": 0.0 }, { "name": "execute_safe_mode_from_suspicious_process", "time": 0.0 }, { "name": "execute_scripts_via_microsoft_management_console", "time": 0.0 }, { "name": "execute_suspicious_processes_via_windows_mssql_service", "time": 0.0 }, { "name": "execution_from_self_extracting_archive", "time": 0.0 }, { "name": "ip_address_discovery_via_trusted_program", "time": 0.0 }, { "name": "load_dll_via_control_panel", "time": 0.0 }, { "name": "network_connection_via_suspicious_process", "time": 0.0 }, { "name": "potential_location_discovery_via_unusual_process", "time": 0.0 }, { "name": "store_executable_registry", "time": 0.0 }, { "name": "Suspicious_Execution_Via_MicrosoftExchangeTransportAgent", "time": 0.0 }, { "name": "suspicious_java_execution_via_win_scripts", "time": 0.0 }, { "name": "Suspicious_Scheduled_Task_Creation_Via_Masqueraded_XML_File", "time": 0.0 }, { "name": "uses_restart_manager_for_suspicious_activities", "time": 0.0 }, { "name": "modify_desktop_wallpaper", "time": 0.0 }, { "name": "modify_zoneid_ads", "time": 0.0 }, { "name": "move_file_on_reboot", "time": 0.0 }, { "name": "multiple_useragents", "time": 0.0 }, { "name": "network_anomaly", "time": 0.0 }, { "name": "network_bind", "time": 0.0 }, { "name": "network_cnc_https_archive", "time": 0.0 }, { "name": "network_cnc_https_free_webhosting", "time": 0.0 }, { "name": "network_cnc_https_generic", "time": 0.0 }, { "name": "network_cnc_https_interactsh", "time": 0.0 }, { "name": "network_cnc_https_opensource", "time": 0.0 }, { "name": "network_cnc_https_pastesite", "time": 0.0 }, { "name": "network_cnc_https_payload", "time": 0.0 }, { "name": "network_cnc_https_serviceinterface", "time": 0.0 }, { "name": "network_cnc_https_socialmedia", "time": 0.0 }, { "name": "network_cnc_https_telegram", "time": 0.0 }, { "name": "network_cnc_https_tempstorage", "time": 0.0 }, { "name": "network_cnc_https_temp_urldns", "time": 0.0 }, { "name": "network_cnc_https_urlshortener", "time": 0.0 }, { "name": "network_cnc_https_useragent", "time": 0.0 }, { "name": "network_cnc_smtps_exfil", "time": 0.0 }, { "name": "network_cnc_smtps_generic", "time": 0.0 }, { "name": "network_dns_idn", "time": 0.0 }, { "name": "network_dns_suspicious_querytype", "time": 0.0 }, { "name": "network_dns_tunneling_request", "time": 0.0 }, { "name": "network_document_http", "time": 0.0 }, { "name": "explorer_http", "time": 0.0 }, { "name": "network_fake_useragent", "time": 0.0 }, { "name": "legitimate_domain_abuse", "time": 0.0 }, { "name": "suspicious_communication_trusted_site", "time": 0.0 }, { "name": "network_tor", "time": 0.0 }, { "name": "office_com_load", "time": 0.0 }, { "name": "office_dotnet_load", "time": 0.0 }, { "name": "office_mshtml_load", "time": 0.0 }, { "name": "office_vb_load", "time": 0.0 }, { "name": "office_wmi_load", "time": 0.0 }, { "name": "office_cve2017_11882", "time": 0.0 }, { "name": "office_cve2017_11882_network", "time": 0.0 }, { "name": "office_cve_2021_40444", "time": 0.0 }, { "name": "office_cve_2021_40444_m2", "time": 0.0 }, { "name": "office_flash_load", "time": 0.0 }, { "name": "office_postscript", "time": 0.0 }, { "name": "office_suspicious_processes", "time": 0.0 }, { "name": "office_write_exe", "time": 0.0 }, { "name": "persistence_via_autodial_dll_registry", "time": 0.0 }, { "name": "persistence_autorun", "time": 0.0 }, { "name": "persistence_autorun_tasks", "time": 0.0 }, { "name": "persistence_bootexecute", "time": 0.0 }, { "name": "persistence_registry_script", "time": 0.0 }, { "name": "powershell_network_connection", "time": 0.0 }, { "name": "powershell_download", "time": 0.0 }, { "name": "powershell_request", "time": 0.0 }, { "name": "createtoolhelp32snapshot_module_enumeration", "time": 0.0 }, { "name": "enumerates_running_processes", "time": 0.0 }, { "name": "process_interest", "time": 0.0 }, { "name": "process_needed", "time": 0.0 }, { "name": "mass_data_encryption", "time": 0.0 }, { "name": "ransomware_file_modifications", "time": 0.0 }, { "name": "ransomware_message", "time": 0.0 }, { "name": "nemty_network_activity", "time": 0.0 }, { "name": "nemty_note", "time": 0.0 }, { "name": "sodinokibi_behavior", "time": 0.0 }, { "name": "stop_ransomware_registry", "time": 0.0 }, { "name": "blackrat_apis", "time": 0.0 }, { "name": "blackrat_network_activity", "time": 0.0 }, { "name": "blackrat_registry_keys", "time": 0.0 }, { "name": "dcrat_behavior", "time": 0.0 }, { "name": "karagany_system_event_objects", "time": 0.0 }, { "name": "rat_luminosity", "time": 0.0 }, { "name": "rat_nanocore", "time": 0.0 }, { "name": "netwire_behavior", "time": 0.0 }, { "name": "obliquerat_network_activity", "time": 0.0 }, { "name": "orcusrat_behavior", "time": 0.0 }, { "name": "trochilusrat_apis", "time": 0.0 }, { "name": "reads_self", "time": 0.0 }, { "name": "recon_beacon", "time": 0.0 }, { "name": "recon_programs", "time": 0.0 }, { "name": "recon_systeminfo", "time": 0.0 }, { "name": "accesses_recyclebin", "time": 0.0 }, { "name": "remcos_shell_code_dynamic_wrapper_x", "time": 0.0 }, { "name": "script_created_process", "time": 0.0 }, { "name": "script_network_activity", "time": 0.0 }, { "name": "suspicious_js_script", "time": 0.0 }, { "name": "javascript_timer", "time": 0.0 }, { "name": "secure_login_phishing", "time": 0.0 }, { "name": "securityxploded_modules", "time": 0.0 }, { "name": "get_clipboard_data", "time": 0.0 }, { "name": "sets_autoconfig_url", "time": 0.0 }, { "name": "spoofs_procname", "time": 0.0 }, { "name": "stack_pivot", "time": 0.0 }, { "name": "stack_pivot_file_created", "time": 0.0 }, { "name": "stack_pivot_process_create", "time": 0.0 }, { "name": "set_clipboard_data", "time": 0.0 }, { "name": "stealth_childproc", "time": 0.0 }, { "name": "stealth_file", "time": 0.0 }, { "name": "stealth_timeout", "time": 0.0 }, { "name": "stealth_window", "time": 0.0 }, { "name": "queries_keyboard_layout", "time": 0.0 }, { "name": "queries_locale_api", "time": 0.0 }, { "name": "terminates_remote_process", "time": 0.0 }, { "name": "uiautomationcore_load", "time": 0.0 }, { "name": "user_enum", "time": 0.0 }, { "name": "mmc_dll_script_load", "time": 0.0 }, { "name": "mmc_dotnet_load", "time": 0.0 }, { "name": "virus", "time": 0.0 }, { "name": "neshta_files", "time": 0.0 }, { "name": "neshta_regkeys", "time": 0.0 }, { "name": "webmail_phish", "time": 0.0 }, { "name": "persists_dev_util", "time": 0.0 }, { "name": "spawns_dev_util", "time": 0.0 }, { "name": "alters_windows_utility", "time": 0.0 }, { "name": "overwrites_accessibility_utility", "time": 0.0 }, { "name": "Potential_Lateral_Movement_Via_SMBEXEC", "time": 0.0 }, { "name": "potential_WebShell_Via_ScreenConnectServer", "time": 0.0 }, { "name": "uses_Microsoft_HTML_Help_Executable", "time": 0.0 }, { "name": "wiper_zeroedbytes", "time": 0.0 }, { "name": "wmi_create_process", "time": 0.0 }, { "name": "wmi_script_process", "time": 0.0 }, { "name": "antianalysis_tls_section", "time": 0.0 }, { "name": "antivirus_clamav", "time": 0.0 }, { "name": "antivirus_virustotal", "time": 0.0 }, { "name": "bad_certs", "time": 0.0 }, { "name": "bad_ssl_certs", "time": 0.0 }, { "name": "banker_zeus_p2p", "time": 0.0 }, { "name": "banker_zeus_url", "time": 0.0 }, { "name": "binary_yara", "time": 0.0 }, { "name": "bot_athenahttp", "time": 0.0 }, { "name": "bot_dirtjumper", "time": 0.0 }, { "name": "bot_drive", "time": 0.0 }, { "name": "bot_drive2", "time": 0.0 }, { "name": "bot_madness", "time": 0.0 }, { "name": "phishing_kit_detected", "time": 0.0 }, { "name": "family_proxyback", "time": 0.0 }, { "name": "flare_capa_antianalysis", "time": 0.0 }, { "name": "flare_capa_collection", "time": 0.0 }, { "name": "flare_capa_communication", "time": 0.0 }, { "name": "flare_capa_compiler", "time": 0.0 }, { "name": "flare_capa_datamanipulation", "time": 0.0 }, { "name": "flare_capa_executable", "time": 0.0 }, { "name": "flare_capa_hostinteraction", "time": 0.0 }, { "name": "flare_capa_impact", "time": 0.0 }, { "name": "flare_capa_lib", "time": 0.0 }, { "name": "flare_capa_linking", "time": 0.0 }, { "name": "flare_capa_loadcode", "time": 0.0 }, { "name": "flare_capa_malwarefamily", "time": 0.0 }, { "name": "flare_capa_nursery", "time": 0.0 }, { "name": "flare_capa_persistence", "time": 0.0 }, { "name": "flare_capa_runtime", "time": 0.0 }, { "name": "flare_capa_targeting", "time": 0.0 }, { "name": "threatfox", "time": 0.0 }, { "name": "log4shell", "time": 0.0 }, { "name": "mimics_extension", "time": 0.0 }, { "name": "network_country_distribution", "time": 0.0 }, { "name": "network_cnc_http", "time": 0.005 }, { "name": "network_ip_exe", "time": 0.0 }, { "name": "network_dga", "time": 0.0 }, { "name": "network_dga_fraunhofer", "time": 0.0 }, { "name": "network_dyndns", "time": 0.004 }, { "name": "network_excessive_udp", "time": 0.0 }, { "name": "network_http", "time": 0.002 }, { "name": "network_icmp", "time": 0.0 }, { "name": "network_irc", "time": 0.0 }, { "name": "network_open_proxy", "time": 0.001 }, { "name": "network_questionable_http_path", "time": 0.0 }, { "name": "network_questionable_https_path", "time": 0.0 }, { "name": "network_smtp", "time": 0.0 }, { "name": "network_torgateway", "time": 0.002 }, { "name": "origin_langid", "time": 0.0 }, { "name": "origin_resource_langid", "time": 0.0 }, { "name": "overlay", "time": 0.0 }, { "name": "packer_unknown_pe_section_name", "time": 0.0 }, { "name": "packer_aspack", "time": 0.0 }, { "name": "packer_aspirecrypt", "time": 0.0 }, { "name": "packer_bedsprotector", "time": 0.0 }, { "name": "packer_confuser", "time": 0.0 }, { "name": "packer_enigma", "time": 0.0 }, { "name": "packer_entropy", "time": 0.0 }, { "name": "packer_mpress", "time": 0.0 }, { "name": "packer_nate", "time": 0.0 }, { "name": "packer_nspack", "time": 0.0 }, { "name": "packer_smartassembly", "time": 0.0 }, { "name": "packer_spices", "time": 0.0 }, { "name": "packer_themida", "time": 0.0 }, { "name": "packer_titan", "time": 0.0 }, { "name": "packer_upx", "time": 0.0 }, { "name": "packer_vmprotect", "time": 0.0 }, { "name": "packer_yoda", "time": 0.0 }, { "name": "pdf_annot_urls_checker", "time": 0.0 }, { "name": "polymorphic", "time": 0.0 }, { "name": "punch_plus_plus_pcres", "time": 0.0 }, { "name": "procmem_yara", "time": 0.0 }, { "name": "recon_checkip", "time": 0.0 }, { "name": "static_authenticode", "time": 0.0 }, { "name": "invalid_authenticode_signature", "time": 0.0 }, { "name": "static_dotnet_anomaly", "time": 0.0 }, { "name": "static_java", "time": 0.0 }, { "name": "static_pdf", "time": 0.0 }, { "name": "contains_pe_overlay", "time": 0.0 }, { "name": "static_pe_anomaly", "time": 0.0 }, { "name": "pe_compile_timestomping", "time": 0.0 }, { "name": "static_pe_pdbpath", "time": 0.0 }, { "name": "static_rat_config", "time": 0.0 }, { "name": "static_versioninfo_anomaly", "time": 0.0 }, { "name": "suricata_alert", "time": 0.0 }, { "name": "suspicious_html_body", "time": 0.0 }, { "name": "suspicious_html_name", "time": 0.0 }, { "name": "suspicious_html_title", "time": 0.0 }, { "name": "volatility_devicetree_1", "time": 0.0 }, { "name": "volatility_handles_1", "time": 0.0 }, { "name": "volatility_ldrmodules_1", "time": 0.0 }, { "name": "volatility_ldrmodules_2", "time": 0.0 }, { "name": "volatility_malfind_1", "time": 0.0 }, { "name": "volatility_malfind_2", "time": 0.0 }, { "name": "volatility_modscan_1", "time": 0.0 }, { "name": "volatility_svcscan_1", "time": 0.0 }, { "name": "volatility_svcscan_2", "time": 0.0 }, { "name": "volatility_svcscan_3", "time": 0.0 }, { "name": "whois_create", "time": 0.0 }, { "name": "accesses_mailslot", "time": 0.001 }, { "name": "accesses_netlogon_regkey", "time": 0.001 }, { "name": "accesses_public_folder", "time": 0.001 }, { "name": "accesses_sysvol", "time": 0.002 }, { "name": "writes_sysvol", "time": 0.0 }, { "name": "adds_admin_user", "time": 0.0 }, { "name": "adds_user", "time": 0.0 }, { "name": "overwrites_admin_password", "time": 0.0 }, { "name": "antianalysis_detectfile", "time": 0.022 }, { "name": "antianalysis_detectreg", "time": 0.069 }, { "name": "modify_attachment_manager", "time": 0.0 }, { "name": "antiav_detectfile", "time": 0.038 }, { "name": "antiav_detectreg", "time": 0.332 }, { "name": "antiav_srp", "time": 0.0 }, { "name": "antiav_whitespace", "time": 0.0 }, { "name": "antidebug_devices", "time": 0.007 }, { "name": "antiemu_windefend", "time": 0.002 }, { "name": "antiemu_wine_reg", "time": 0.0 }, { "name": "antisandbox_cuckoo_files", "time": 0.001 }, { "name": "antisandbox_fortinet_files", "time": 0.001 }, { "name": "antisandbox_joe_anubis_files", "time": 0.001 }, { "name": "antisandbox_sboxie_mutex", "time": 0.0 }, { "name": "antisandbox_sunbelt_files", "time": 0.001 }, { "name": "antisandbox_threattrack_files", "time": 0.002 }, { "name": "antivm_bochs_keys", "time": 0.006 }, { "name": "antivm_generic_bios", "time": 0.004 }, { "name": "antivm_generic_diskreg", "time": 0.014 }, { "name": "antivm_hyperv_keys", "time": 0.006 }, { "name": "antivm_parallels_keys", "time": 0.019 }, { "name": "antivm_recentdocs", "time": 0.0 }, { "name": "antivm_vbox_devices", "time": 0.003 }, { "name": "antivm_vbox_files", "time": 0.015 }, { "name": "antivm_vbox_keys", "time": 0.037 }, { "name": "antivm_vmware_devices", "time": 0.0 }, { "name": "antivm_vmware_files", "time": 0.005 }, { "name": "antivm_vmware_keys", "time": 0.025 }, { "name": "antivm_vmware_mutexes", "time": 0.0 }, { "name": "antivm_vpc_files", "time": 0.002 }, { "name": "antivm_vpc_keys", "time": 0.013 }, { "name": "antivm_vpc_mutex", "time": 0.0 }, { "name": "antivm_xen_keys", "time": 0.019 }, { "name": "asyncrat_mutex", "time": 0.0 }, { "name": "gulpix_behavior", "time": 0.0 }, { "name": "ketrican_regkeys", "time": 0.005 }, { "name": "okrum_mutexes", "time": 0.0 }, { "name": "banker_cridex", "time": 0.002 }, { "name": "geodo_banking_trojan", "time": 0.011 }, { "name": "banker_spyeye_mutexes", "time": 0.0 }, { "name": "banker_zeus_mutex", "time": 0.001 }, { "name": "bitcoin_opencl", "time": 0.001 }, { "name": "enumerates_physical_drives", "time": 0.001 }, { "name": "bot_russkill", "time": 0.0 }, { "name": "browser_addon", "time": 0.001 }, { "name": "chromium_browser_extension_directory", "time": 0.0 }, { "name": "browser_helper_object", "time": 0.0 }, { "name": "browser_security", "time": 0.004 }, { "name": "browser_startpage", "time": 0.0 }, { "name": "ie_disables_process_tab", "time": 0.0 }, { "name": "odbcconf_bypass", "time": 0.0 }, { "name": "squiblydoo_bypass", "time": 0.0 }, { "name": "squiblytwo_bypass", "time": 0.0 }, { "name": "bypass_chromium_protection", "time": 0.0 }, { "name": "bypass_firewall", "time": 0.006 }, { "name": "checks_uac_status", "time": 0.002 }, { "name": "uac_bypass_cmstpcom", "time": 0.0 }, { "name": "uac_bypass_delegateexecute_sdclt", "time": 0.0 }, { "name": "uac_bypass_fodhelper", "time": 0.0 }, { "name": "cape_extracted_content", "time": 0.0 }, { "name": "carberp_mutex", "time": 0.0 }, { "name": "clears_logs", "time": 0.001 }, { "name": "cmdline_obfuscation", "time": 0.0 }, { "name": "cmdline_switches", "time": 0.0 }, { "name": "cmdline_terminate", "time": 0.0 }, { "name": "cmdline_forfiles_wildcard", "time": 0.0 }, { "name": "cmdline_http_link", "time": 0.0 }, { "name": "cmdline_long_string", "time": 0.0 }, { "name": "cmdline_reversed_http_link", "time": 0.0 }, { "name": "long_commandline", "time": 0.0 }, { "name": "powershell_renamed_commandline", "time": 0.0 }, { "name": "copies_self", "time": 0.0 }, { "name": "credwiz_credentialaccess", "time": 0.0 }, { "name": "enables_wdigest", "time": 0.0 }, { "name": "vaultcmd_credentialaccess", "time": 0.0 }, { "name": "file_credential_store_access", "time": 0.002 }, { "name": "file_credential_store_write", "time": 0.0 }, { "name": "kerberos_credential_access_via_rubeus", "time": 0.0 }, { "name": "registry_credential_dumping", "time": 0.0 }, { "name": "registry_credential_store_access", "time": 0.002 }, { "name": "registry_lsa_secrets_access", "time": 0.001 }, { "name": "comsvcs_credentialdump", "time": 0.0 }, { "name": "cryptomining_stratum_command", "time": 0.0 }, { "name": "cypherit_mutexes", "time": 0.0 }, { "name": "darkcomet_regkeys", "time": 0.004 }, { "name": "datop_loader", "time": 0.0 }, { "name": "deepfreeze_mutex", "time": 0.0 }, { "name": "deletes_executed_files", "time": 0.0 }, { "name": "disables_app_launch", "time": 0.001 }, { "name": "disables_auto_app_termination", "time": 0.0 }, { "name": "disables_appv_virtualization", "time": 0.0 }, { "name": "disables_backups", "time": 0.002 }, { "name": "disables_browser_warn", "time": 0.003 }, { "name": "disables_context_menus", "time": 0.0 }, { "name": "disables_cpl_disable", "time": 0.0 }, { "name": "disables_crashdumps", "time": 0.0 }, { "name": "disables_event_logging", "time": 0.0 }, { "name": "disables_folder_options", "time": 0.0 }, { "name": "disables_notificationcenter", "time": 0.0 }, { "name": "disables_power_options", "time": 0.001 }, { "name": "disables_restore_default_state", "time": 0.0 }, { "name": "disables_run_command", "time": 0.0 }, { "name": "disables_smartscreen", "time": 0.001 }, { "name": "disables_startmenu_search", "time": 0.001 }, { "name": "disables_system_restore", "time": 0.001 }, { "name": "disables_uac", "time": 0.0 }, { "name": "disables_wer", "time": 0.0 }, { "name": "disables_windows_defender", "time": 0.001 }, { "name": "disables_windows_defender_logging", "time": 0.001 }, { "name": "removes_windows_defender_contextmenu", "time": 0.001 }, { "name": "removes_windows_defender_updates", "time": 0.0 }, { "name": "windows_defender_powershell", "time": 0.0 }, { "name": "disables_windows_file_protection", "time": 0.0 }, { "name": "disables_windowsupdate", "time": 0.0 }, { "name": "disables_winfirewall", "time": 0.0 }, { "name": "discover_registry_mount_points", "time": 0.001 }, { "name": "adfind_domain_enumeration", "time": 0.0 }, { "name": "domain_enumeration_commands", "time": 0.0 }, { "name": "andromut_mutexes", "time": 0.0 }, { "name": "downloader_cabby", "time": 0.0 }, { "name": "phorpiex_mutexes", "time": 0.0 }, { "name": "protonbot_mutexes", "time": 0.0 }, { "name": "driver_filtermanager", "time": 0.001 }, { "name": "dropper", "time": 0.0 }, { "name": "dll_archive_execution", "time": 0.0 }, { "name": "lnk_archive_execution", "time": 0.0 }, { "name": "script_archive_execution", "time": 0.0 }, { "name": "excel4_macro_urls", "time": 0.0 }, { "name": "escalate_privilege_via_ntlm_relay", "time": 0.0 }, { "name": "spooler_access", "time": 0.0 }, { "name": "spooler_svc_start", "time": 0.0 }, { "name": "mapped_drives_uac", "time": 0.0 }, { "name": "hides_recycle_bin_icon", "time": 0.0 }, { "name": "apocalypse_stealer_file_behavior", "time": 0.0 }, { "name": "arkei_files", "time": 0.001 }, { "name": "azorult_mutexes", "time": 0.001 }, { "name": "infostealer_bitcoin", "time": 0.024 }, { "name": "cryptbot_files", "time": 0.001 }, { "name": "echelon_files", "time": 0.001 }, { "name": "infostealer_ftp", "time": 0.128 }, { "name": "infostealer_im", "time": 0.072 }, { "name": "infostealer_mail", "time": 0.028 }, { "name": "masslogger_files", "time": 0.0 }, { "name": "poullight_files", "time": 0.01 }, { "name": "purplewave_mutexes", "time": 0.0 }, { "name": "quilclipper_mutexes", "time": 0.0 }, { "name": "qulab_files", "time": 0.008 }, { "name": "qulab_mutexes", "time": 0.0 }, { "name": "asyncrat_mutex", "time": 0.0 }, { "name": "Evade_Execution_Via_ASPNet_Compiler", "time": 0.0 }, { "name": "Evade_Execute_Via_DeviceCredentialDeployment", "time": 0.0 }, { "name": "Evade_Execution_Via_Filter_Manager_Control", "time": 0.0 }, { "name": "Evade_Execution_Via_Intel_GFXDownloadWrapper", "time": 0.0 }, { "name": "execute_binary_via_appvlp", "time": 0.0 }, { "name": "execute_binary_via_pcalua", "time": 0.0 }, { "name": "Execute_Binary_Via_OpenSSH", "time": 0.0 }, { "name": "execute_binary_via_pcalua", "time": 0.0 }, { "name": "Execute_Binary_Via_PesterPSModule", "time": 0.0 }, { "name": "Execute_Binary_Via_ScriptRunner", "time": 0.0 }, { "name": "execute_binary_via_ttdinject", "time": 0.0 }, { "name": "Execute_Binary_Via_VisualStudioLiveShare", "time": 0.0 }, { "name": "Execute_Msiexec_Via_Explorer", "time": 0.0 }, { "name": "execute_remote_msi", "time": 0.0 }, { "name": "execute_suspicious_powershell_via_runscripthelper", "time": 0.0 }, { "name": "execute_suspicious_powershell_via_sqlps", "time": 0.0 }, { "name": "Indirect_Command_Execution_Via_ConsoleWindowHost", "time": 0.0 }, { "name": "Perform_Malicious_Activities_Via_Headless_Browser", "time": 0.0 }, { "name": "Register_DLL_Via_CertOC", "time": 0.0 }, { "name": "Register_DLL_Via_MSIEXEC", "time": 0.0 }, { "name": "Register_DLL_Via_Odbcconf", "time": 0.0 }, { "name": "Scriptlet_Proxy_Execution_Via_Pubprn", "time": 0.0 }, { "name": "ie_martian_children", "time": 0.0 }, { "name": "office_martian_children", "time": 0.0 }, { "name": "mimics_icon", "time": 0.0 }, { "name": "masquerade_process_name", "time": 0.036 }, { "name": "mimikatz_modules", "time": 0.0 }, { "name": "ms_office_cmd_rce", "time": 0.0 }, { "name": "mount_copy_to_webdav_share", "time": 0.0 }, { "name": "potential_protocol_tunneling_via_legit_utilities", "time": 0.0 }, { "name": "potential_protocol_tunneling_via_qemu", "time": 0.0 }, { "name": "suspicious_execution_via_dotnet_remoting", "time": 0.0 }, { "name": "modify_certs", "time": 0.0 }, { "name": "dotnet_clr_usagelog_regkeys", "time": 0.0 }, { "name": "modify_hostfile", "time": 0.0 }, { "name": "modify_oem_information", "time": 0.0 }, { "name": "modify_security_center_warnings", "time": 0.001 }, { "name": "modify_uac_prompt", "time": 0.001 }, { "name": "network_dns_blockchain", "time": 0.0 }, { "name": "network_dns_opennic", "time": 0.001 }, { "name": "network_dns_paste_site", "time": 0.001 }, { "name": "network_dns_reverse_proxy", "time": 0.0 }, { "name": "network_dns_temp_file_storage", "time": 0.001 }, { "name": "network_dns_temp_urldns", "time": 0.0 }, { "name": "network_dns_url_shortener", "time": 0.01 }, { "name": "network_dns_doh_tls", "time": 0.001 }, { "name": "suspicious_tld", "time": 0.008 }, { "name": "network_tor_service", "time": 0.001 }, { "name": "office_code_page", "time": 0.0 }, { "name": "office_addinloading", "time": 0.0 }, { "name": "office_perfkey", "time": 0.0 }, { "name": "office_macro", "time": 0.0 }, { "name": "changes_trust_center_settings", "time": 0.0 }, { "name": "disables_vba_trust_access", "time": 0.0 }, { "name": "office_macro_autoexecution", "time": 0.0 }, { "name": "office_macro_ioc", "time": 0.0 }, { "name": "office_macro_malicious_prediction", "time": 0.0 }, { "name": "office_macro_suspicious", "time": 0.0 }, { "name": "rtf_aslr_bypass", "time": 0.0 }, { "name": "rtf_anomaly_characterset", "time": 0.0 }, { "name": "rtf_anomaly_version", "time": 0.0 }, { "name": "rtf_embedded_content", "time": 0.0 }, { "name": "rtf_embedded_office_file", "time": 0.0 }, { "name": "rtf_exploit_static", "time": 0.0 }, { "name": "office_security", "time": 0.001 }, { "name": "accesses_office_username", "time": 0.001 }, { "name": "office_anomalous_feature", "time": 0.0 }, { "name": "office_dde_command", "time": 0.0 }, { "name": "packer_armadillo_mutex", "time": 0.0 }, { "name": "packer_armadillo_regkey", "time": 0.001 }, { "name": "persistence_ads", "time": 0.0 }, { "name": "persistence_safeboot", "time": 0.0 }, { "name": "persistence_ifeo", "time": 0.0 }, { "name": "persistence_silent_process_exit", "time": 0.0 }, { "name": "persistence_rdp_registry", "time": 0.0 }, { "name": "persistence_rdp_shadowing", "time": 0.0 }, { "name": "persistence_service", "time": 0.0 }, { "name": "persistence_shim_database", "time": 0.001 }, { "name": "powerpool_mutexes", "time": 0.0 }, { "name": "powershell_scriptblock_logging", "time": 0.0 }, { "name": "powershell_command_suspicious", "time": 0.0 }, { "name": "powershell_history_save_mod", "time": 0.0 }, { "name": "powershell_renamed", "time": 0.0 }, { "name": "powershell_reversed", "time": 0.0 }, { "name": "powershell_variable_obfuscation", "time": 0.0 }, { "name": "prevents_safeboot", "time": 0.0 }, { "name": "cmdline_process_discovery", "time": 0.0 }, { "name": "cryptomix_mutexes", "time": 0.0 }, { "name": "dharma_mutexes", "time": 0.0 }, { "name": "ransomware_extensions_generic", "time": 0.0 }, { "name": "ransomware_extensions_known", "time": 0.009 }, { "name": "ransomware_files", "time": 0.014 }, { "name": "fonix_mutexes", "time": 0.0 }, { "name": "gandcrab_mutexes", "time": 0.0 }, { "name": "germanwiper_mutexes", "time": 0.0 }, { "name": "medusalocker_mutexes", "time": 0.0 }, { "name": "medusalocker_regkeys", "time": 0.002 }, { "name": "nemty_mutexes", "time": 0.0 }, { "name": "nemty_regkeys", "time": 0.001 }, { "name": "pysa_mutexes", "time": 0.0 }, { "name": "ransomware_radamant", "time": 0.001 }, { "name": "ransomware_recyclebin", "time": 0.0 }, { "name": "revil_mutexes", "time": 0.001 }, { "name": "ransomware_revil_regkey", "time": 0.0 }, { "name": "satan_mutexes", "time": 0.001 }, { "name": "snake_ransom_mutexes", "time": 0.0 }, { "name": "stop_ransom_mutexes", "time": 0.0 }, { "name": "stop_ransomware_cmd", "time": 0.0 }, { "name": "ransomware_stopdjvu", "time": 0.0 }, { "name": "rat_beebus_mutexes", "time": 0.0 }, { "name": "blacknet_mutexes", "time": 0.0 }, { "name": "blackrat_mutexes", "time": 0.0 }, { "name": "crat_mutexes", "time": 0.001 }, { "name": "dcrat_files", "time": 0.001 }, { "name": "dcrat_mutexes", "time": 0.0 }, { "name": "rat_fynloski_mutexes", "time": 0.0 }, { "name": "limerat_mutexes", "time": 0.0 }, { "name": "limerat_regkeys", "time": 0.005 }, { "name": "lodarat_file_behavior", "time": 0.0 }, { "name": "modirat_behavior", "time": 0.001 }, { "name": "njrat_regkeys", "time": 0.0 }, { "name": "obliquerat_files", "time": 0.002 }, { "name": "obliquerat_mutexes", "time": 0.0 }, { "name": "parallax_mutexes", "time": 0.0 }, { "name": "rat_pcclient", "time": 0.003 }, { "name": "rat_plugx_mutexes", "time": 0.0 }, { "name": "rat_poisonivy_mutexes", "time": 0.0 }, { "name": "rat_quasar_mutexes", "time": 0.0 }, { "name": "ratsnif_mutexes", "time": 0.0 }, { "name": "rat_spynet", "time": 0.001 }, { "name": "venomrat_mutexes", "time": 0.0 }, { "name": "warzonerat_files", "time": 0.001 }, { "name": "warzonerat_regkeys", "time": 0.002 }, { "name": "xpertrat_files", "time": 0.0 }, { "name": "xpertrat_mutexes", "time": 0.0 }, { "name": "rat_xtreme_mutexes", "time": 0.0 }, { "name": "reads_password_database", "time": 0.002 }, { "name": "recon_fingerprint", "time": 0.005 }, { "name": "remcos_files", "time": 0.001 }, { "name": "remcos_mutexes", "time": 0.0 }, { "name": "remcos_regkeys", "time": 0.003 }, { "name": "rdptcp_key", "time": 0.0 }, { "name": "uses_rdp_clip", "time": 0.0 }, { "name": "uses_remote_desktop_session", "time": 0.0 }, { "name": "removes_networking_icon", "time": 0.0 }, { "name": "removes_pinned_programs", "time": 0.0 }, { "name": "removes_security_maintenance_icon", "time": 0.0 }, { "name": "removes_startmenu_defaults", "time": 0.001 }, { "name": "removes_username_startmenu", "time": 0.0 }, { "name": "spicyhotpot_behavior", "time": 0.0 }, { "name": "sniffer_winpcap", "time": 0.002 }, { "name": "spreading_autoruninf", "time": 0.001 }, { "name": "stealth_hidden_extension", "time": 0.0 }, { "name": "stealth_hiddenreg", "time": 0.001 }, { "name": "stealth_hide_notifications", "time": 0.001 }, { "name": "stealth_webhistory", "time": 0.0 }, { "name": "sysinternals_psexec", "time": 0.0 }, { "name": "sysinternals_tools", "time": 0.0 }, { "name": "language_check_registry", "time": 0.001 }, { "name": "tampers_etw", "time": 0.001 }, { "name": "lsa_tampering", "time": 0.0 }, { "name": "tampers_powershell_logging", "time": 0.0 }, { "name": "targeted_flame", "time": 0.002 }, { "name": "territorial_disputes_sigs", "time": 0.113 }, { "name": "trickbot_mutex", "time": 0.0 }, { "name": "fleercivet_mutex", "time": 0.0 }, { "name": "lokibot_mutexes", "time": 0.001 }, { "name": "ursnif_behavior", "time": 0.001 }, { "name": "uses_adfind", "time": 0.0 }, { "name": "uses_ms_protocol", "time": 0.0 }, { "name": "neshta_mutexes", "time": 0.0 }, { "name": "renamer_mutexes", "time": 0.0 }, { "name": "owa_web_shell_files", "time": 0.0 }, { "name": "web_shell_files", "time": 0.0 }, { "name": "web_shell_processes", "time": 0.0 }, { "name": "dotnet_csc_build", "time": 0.0 }, { "name": "mavinject_lolbin", "time": 0.0 }, { "name": "multiple_explorer_instances", "time": 0.0 }, { "name": "script_tool_executed", "time": 0.0 }, { "name": "suspicious_certutil_use", "time": 0.0 }, { "name": "suspicious_command_tools", "time": 0.002 }, { "name": "suspicious_mpcmdrun_use", "time": 0.0 }, { "name": "suspicious_ping_use", "time": 0.0 }, { "name": "uses_powershell_copyitem", "time": 0.0 }, { "name": "uses_windows_utilities", "time": 0.002 }, { "name": "uses_windows_utilities_appcmd", "time": 0.0 }, { "name": "uses_windows_utilities_csvde_ldifde", "time": 0.0 }, { "name": "uses_windows_utilities_cipher", "time": 0.0 }, { "name": "uses_windows_utilities_clickonce", "time": 0.0 }, { "name": "uses_windows_utilities_curl", "time": 0.0 }, { "name": "uses_windows_utilities_dsquery", "time": 0.0 }, { "name": "uses_windows_utilities_esentutl", "time": 0.0 }, { "name": "uses_windows_utilities_finger", "time": 0.0 }, { "name": "uses_windows_utilities_mode", "time": 0.0 }, { "name": "uses_windows_utilities_ntdsutil", "time": 0.0 }, { "name": "uses_windows_utilities_nltest", "time": 0.0 }, { "name": "uses_windows_utilities_setx", "time": 0.0 }, { "name": "uses_windows_utilities_xcopy", "time": 0.0 }, { "name": "wmic_command_suspicious", "time": 0.0 }, { "name": "scrcons_wmi_script_consumer", "time": 0.0 }, { "name": "allaple_mutexes", "time": 0.0 } ], "reporting": [ { "name": "BinGraph", "time": 0.0 } ] }, "target": { "category": "file", "file": { "name": "NanoCore.exe", "path": "/opt/CAPEv2/storage/binaries/ec359f50ca15395f273899c0ff7c0cd87ab5c2e23fdcfc6c72fedc0097161d4b", "guest_paths": "", "size": 1442816, "crc32": "F92B088C", "md5": "1728acc244115cbafd3b810277d2e321", "sha1": "be64732f46c8a26a5bbf9d7f69c7f031b2c5180b", "sha256": "ec359f50ca15395f273899c0ff7c0cd87ab5c2e23fdcfc6c72fedc0097161d4b", "sha512": "8c59fdd29181f28e5698de78adf63934632e644a87088400f1b7ab1653622e4bc3a4145094601211a2db4bcbd04ea5f1ac44129907fbb727fe24a1f3652c7034", "rh_hash": null, "ssdeep": "24576:d7dOT1b7eAJzjSTUd+21nm3kEvpqZ0vSxmfexX6shz07DTl/uz:d7dqVw2+2KkS4PmGX6og7", "type": "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows", "yara": [ { "name": "COD3NYM_SUSP_OBF_NET_Reactor_Indicators_Jan24", "meta": { "description": "Detects indicators of .NET Reactors managed obfuscation. Reactor is a commercial obfuscation solution, pirated versions are often abused by threat actors.", "author": "Jonathan Peters", "id": "8dc07bbd-cbeb-5214-a27a-555a0d396197", "date": "2024-01-09", "modified": "2024-01-12", "reference": "https://www.eziriz.com/dotnet_reactor.htm", "source_url": "https://github.com/cod3nym/detection-rules//blob/86a04c4594cb48895192aad4af164f21f568c136/yara/dotnet/obf_net_reactor.yar#L18-L34", "license_url": "https://github.com/cod3nym/detection-rules//blob/86a04c4594cb48895192aad4af164f21f568c136/LICENSE.md", "hash": "be842a9de19cfbf42ea5a94e3143d58390a1abd1e72ebfec5deeb8107dddf038", "logic_hash": "40a03eb487e2c02a032c4bfb51580dbb764e0a49ceee5ae92c54a5ee3ede9696", "score": 65, "quality": 80, "tags": "FILE" }, "strings": [ "3{\u00001\u00001\u00001\u00001\u00001\u0000-\u00002\u00002\u00002\u00002\u00002\u0000-\u00005\u00000\u00000\u00000\u00001\u0000-\u00000\u00000\u00000\u00000\u00000\u0000}\u0000", "3{\u00001\u00001\u00001\u00001\u00001\u0000-\u00002\u00002\u00002\u00002\u00002\u0000-\u00004\u00000\u00000\u00000\u00001\u0000-\u00000\u00000\u00000\u00000\u00001\u0000}\u0000", "3{\u00001\u00001\u00001\u00001\u00001\u0000-\u00002\u00002\u00002\u00002\u00002\u0000-\u00004\u00000\u00000\u00000\u00001\u0000-\u00000\u00000\u00000\u00000\u00002\u0000}\u0000", "{F4B45B4B-739C-406C-A9CF-5A589EA4A5AC}", "{6F53801E-7E6B-4CF6-ADA6-069C03F41663}" ], "addresses": { "": 371702 } }, { "name": "DITEKSHEN_MALWARE_Win_Nanocore", "meta": { "description": "Detects NanoCore", "author": "ditekSHen", "id": "931b98f6-df2b-538b-bc49-ecbbd24334da", "date": "2020-11-06", "modified": "2024-11-01", "reference": "https://github.com/ditekshen/detection", "source_url": "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7654-L7681", "license_url": "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt", "logic_hash": "6336260e0af2b4b51338ee066f41b7c58aa134a6c03ca110db7e088edf2b65a7", "score": 75, "quality": 75, "tags": "FILE" }, "strings": [ "NanoCore.ClientPlugin", "NanoCore.ClientPluginHost", "IClientApp", "IClientData", "IClientNetwork", "IClientAppHost", "IClientDataHost", "IClientLoggingHost", "IClientNetworkHost", "IClientUIHost", "ClientPlugin", "EndPoint", "IPAddress", "IPEndPoint" ], "addresses": { "x2": 487245, "x3": 487294, "i1": 487234, "i2": 487404, "i3": 487335, "i4": 487320, "i5": 487369, "i6": 487350, "i7": 487385, "i8": 487280, "s1": 487267, "s2": 475545, "s3": 409254, "s4": 409264 } }, { "name": "Windows_Trojan_Nanocore_d8c4e3c5", "meta": { "author": "Elastic Security", "id": "d8c4e3c5-8bcc-43d2-9104-fa3774282da5", "fingerprint": "e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4", "creation_date": "2021-06-13", "last_modified": "2021-08-23", "threat_name": "Windows.Trojan.Nanocore", "reference_sample": "b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd", "severity": 100, "arch_context": "x86, arm64", "scan_context": "file, memory", "license": "Elastic License v2", "os": "windows" }, "strings": [ "NanoCore.ClientPluginHost", "NanoCore.ClientPlugin", "get_BuilderSettings", "PluginCommand", "IClientAppHost", "GetBlockHash", "IClientLoggingHost" ], "addresses": { "a1": 487294, "a2": 487245, "b1": 401250, "b3": 371616, "b4": 487320, "b5": 513946, "b9": 487350 } }, { "name": "IsPE32", "meta": {}, "strings": [], "addresses": {} }, { "name": "IsNET_EXE", "meta": {}, "strings": [], "addresses": {} }, { "name": "IsWindowsGUI", "meta": {}, "strings": [], "addresses": {} }, { "name": "IsPacked", "meta": { "description": "Entropy Check" }, "strings": [], "addresses": {} }, { "name": "Microsoft_Visual_Studio_NET", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "a": 1422542 } }, { "name": "Microsoft_Visual_C_v70_Basic_NET_additional", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "a": 1422542 } }, { "name": "Microsoft_Visual_C_Basic_NET", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "b": 1422542 } }, { "name": "Microsoft_Visual_Studio_NET_additional", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "a": 1422542 } }, { "name": "Microsoft_Visual_C_v70_Basic_NET", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "b": 1422542 } }, { "name": "NET_executable_", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "a": 1422542 } }, { "name": "NET_executable", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "b": 1422542 } } ], "cape_yara": [], "clamav": [], "tlsh": "T1C765BE01A6B2CF2AD3D86A3981ABC22C4B51D973F323B75B1F2E74642C5223B4D417D6", "sha3_384": "1d00cceb26b3a28d6e18293142b7959c281cbfd500ff0475884d72dcef42f75f307f14fb8e2ba2377877f390b924b7b9", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "pe": { "guest_signers": { "aux_sha1": null, "aux_timestamp": null, "aux_valid": false, "aux_error": true, "aux_error_desc": "No signature found.", "aux_signers": [] }, "digital_signers": [], "imagebase": "0x00400000", "entrypoint": "0x0015d0ce", "ep_bytes": "ff250020400000000000000000000000", "peid_signatures": null, "reported_checksum": "0x00000000", "actual_checksum": "0x00169eed", "osversion": "4.0", "machine_type": "IMAGE_FILE_MACHINE_I386", "pdbpath": null, "imports": { "mscoree": { "dll": "mscoree.dll", "imports": [ { "address": "0x402000", "name": "_CorExeMain" } ] } }, "exported_dll_name": null, "exports": [], "dirents": [ { "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "virtual_address": "0x0015d080", "size": "0x0000004b" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "virtual_address": "0x00160000", "size": "0x000049d8" }, { "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "virtual_address": "0x00166000", "size": "0x0000000c" }, { "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_TLS", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IAT", "virtual_address": "0x00002000", "size": "0x00000008" }, { "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "virtual_address": "0x00002008", "size": "0x00000048" } ], "sections": [ { "name": ".text", "raw_address": "0x00000400", "virtual_address": "0x00002000", "virtual_size": "0x0015b0d4", "size_of_data": "0x0015b200", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "7.47" }, { "name": ".sdata", "raw_address": "0x0015b600", "virtual_address": "0x0015e000", "virtual_size": "0x000001e8", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "6.61" }, { "name": ".rsrc", "raw_address": "0x0015b800", "virtual_address": "0x00160000", "virtual_size": "0x000049d8", "size_of_data": "0x00004a00", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "5.50" }, { "name": ".reloc", "raw_address": "0x00160200", "virtual_address": "0x00166000", "virtual_size": "0x0000000c", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x42000040", "entropy": "0.10" } ], "overlay": null, "resources": [ { "name": "RT_ICON", "offset": "0x00160190", "size": "0x000025a8", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "5.05" }, { "name": "RT_ICON", "offset": "0x00162738", "size": "0x000010a8", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "5.14" }, { "name": "RT_ICON", "offset": "0x001637e0", "size": "0x00000468", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "5.26" }, { "name": "RT_GROUP_ICON", "offset": "0x00163c48", "size": "0x00000030", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "2.49" }, { "name": "RT_VERSION", "offset": "0x00163c78", "size": "0x0000025c", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.24" }, { "name": "RT_MANIFEST", "offset": "0x00163ed4", "size": "0x00000b01", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "5.03" } ], "versioninfo": [ { "name": "Translation", "value": "0x0000 0x04b0" }, { "name": "FileDescription", "value": "NanoCore" }, { "name": "FileVersion", "value": "1.2.2.0" }, { "name": "InternalName", "value": "NanoCore.exe" }, { "name": "LegalCopyright", "value": " " }, { "name": "OriginalFilename", "value": "NanoCore.exe" }, { "name": "ProductVersion", "value": "1.2.2.0" }, { "name": "Assembly Version", "value": "1.2.2.0" } ], "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "timestamp": "2015-07-01 07:55:53", "icon": "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAITklEQVR4nOVZa2wU1xX+7h2v7fUD1l5s4wfGNjQGFYwa1EaoAaWojbAipCotbRVI1bRVQKmSqmqJMIqhDQZSIqUPpU1+lLQlESGlDVHViOZPSEGCJm5CIDiQ2jz8Xtvs+rFr72Pm3tMfM7M7M/v0g6hVj3XsuzPnzjnfud859+4Y+B8Xdiceyu9r53XNd399Ud3aRwBgovfD3w31XDol3zkgF9rXggOo/vbL93jqW55zL121QSKPAQAnlWaGPz7jv9H5w7ETO68spL8FA1D50NHaxTXNB0vqWh4mxc1T2XAxI6f6Lx8d7+/a5//TLt9C+J03gIL7O4prV33hsdLaNXt50RIP5eBQTI/6Q4NdB/u6zr+gvf2zyHz8zwtAzSMntpY33v2sy1PfnAicAaCsYwZCLHCzy3/j/d2+YztOzzWGOQGo3PGHdeX1a591VzV/RUKZq28AgAKB0PDHp8d7L+8ee/X7XbOdPysA7tZnvLWrN/y0pHr1o5Rfkj9bZxkDiYViwaErvx269l5H+PQef87zcrLatNdV17x+V3nj+nZeVFGRjedzFQZAhHy+yb5L+/qudh7FucNZ225mAJvaWHXT2i2eZWuOFHob18g7FbkzKEaI3r7x4cTg1R8PX798BmcPp/WcFoD3Gy+uXtL0ucPuipVbJXOlbIt3WriMyZnR7lO3b15qC5zc1Z3KJgkAv6+9tKHl3qdKa9Y8Tvkl7jsfZnZhsWB4auCjX/Z2XTggzzwdtt2zWW7ay+6654E33dWfbSX6lPiSozDGEPF1Hf/kyBe3W6/bqFG17DNNRZUr7ycpAaL/KiUp4V6y4ptVO37fZI05z/ohv7A4HzxP0ZOffTP61MeKS8kvKC5IC0AXCZCVWZRxXFNKKMiz2/uChLDGkuyrSwiFLvM6AWDwBaVhm90XGNmupgZAhCSrdEISHZsFVlTkgYhgrtzZ7hj2n2GAUmgz37NhGs0VXA/foMb+N4bQGW0AuCsHf5TUdZLbI5nZIQAy61hKCSlFXIUQuHeFC18uuwFSZ2z2UkoIoUFoumpCgCKTUAcvgrRIdr8pGosDABmZlIZmH+sLYc7TVQgNP2hthHe8ExSbttgTJMFmSwyQ6gzUkSsgLZLdr4MeDgAsgTTX7mA8lByBuV1A29dWQ+09r6+EsbK24EmvAzAOqGFoo9cALZreH7JSKGGYs5IzeMQ/tyxfhAc/XwW1vxOkho1HJwNgYAA4SI1Au90NiFhaX1koZIKQOSuZWZXJ2dWEhp2tzahfDGiD7wNCdQAlMMYAi5IWhea/roNw+oNM6i9JABK8y1WRlkZEBEgVe7etgyKjkGoE0rZiOinICULEoAV6QTbAumakkN4F50IhuxYUuG3gmirz8dCmBsPeDhIAGDj0+ksoiRjE5AAg1dwpxGZNIYr3dGv2X33rIjhX4r1eCIHtG5ehxluavEKMGTFz2yowxgChQk75AKEaFEreyFLvAzmrTFHEhH/eCOH0uzfBAIMyBE2NosiVoQsZhQxm+cs4SKqQoTFACiA7hWbD/Qw1wTie/3sP/MEEh0H6RmbtVCYlbHUADjDjmnFPSg1i2g+SwiR6mhUg89fs1A5AAmAISxcOvnYRCs9L4n2iUcBOmTTKGANIQIYnQCKWpQbi1MixjSYFp5/dAYaPfBreuHBL7yypOpdtH7Bqoqht90gae0RaCgHxs0dinTOOUwWm85oBTMHRfwzCNxF1lI+zBpyqrwxz3ouDSUchWB5u/mQZJ+ZY5yYeHaV8HH79KhjPc4A1uxBAhtq5wAButFQzaANYZgrN5SzkzGo8a3o36Q4AJ8/3gXOeogtZArbMAWMpNzm9YyXE9n2AbBQxScXSj4nw1gdDKFOCRqb0YIYDM5Yl1/N07MIYQAIuTnE7ABgISADcwnULoHgdmNe4xSYFAD02o4gtsDKNT/V6IfwTkOEJo5Nwi1oyxwtw7F9hy/WEDUvJc2fwidqwim091GhYAwkZb4/WVpl2DPDyRvCisrRtMLkAEwExZ9DxIoZRHxYaEYlYNKKlBTDS19MTGR86qS+EvctkGgMM3LMcKCwzNiCz8CxnG2Yqt2xaCZ7HFalAMzDOEZ0afW104FaPNWbnzgz+pX3u+lXrnywqr/0J8fySRKHlIgQxOQiKhcBMiphHBRtlnDRLfHbSkDEORupUcKz/4ED3pV/h7KFoRgCmlG/7TUPZ0qaOQk/1twTN4h06EWRwGBSbSQouc/BMP5Va7iscajToP+4fur5v4vUn+lK5SwsAALCxjVU3rt5Y4q15zlVasV6KXP9HR5DBEZAWBhxBJTKcGhwxDkXJgzodeDcUGH7C98p338vkKTMAUza18bqVLd8pqajvQJ67On5kgtHzU40ByOnbgBZJDhjc2KS4sSL6Pc4VkBbpnRrre2r41ifHce6Zeb5ed0jhlkOemhVr9xYsqnxMsrzi7DMINDMO0qIZ6cQYB4OYDk+O/WLw+pUj2ttPB3ONaVYATPFue+Euz9KGnxcurvqqJkR2EJEp4xSZyLaZeUVREA0F/jwxOrAn8JfHr882ljkBMKVyx0utnsrlh5XCReukpAz7NoGiIUBqcQAKV6BFQx8EA8M/Gjn+6Nm5xjAvAACgbN6XX7ey5Xtuz9IDxF3e5C99hhBA6gwYSTCpjoTGR9qH+3r+KN/piKWekJvMG4Apngd/XeGtXdFeUFK+S5NI+aJTYaSGAwPPB3y9HVN/3R1YCL8LBsCUpdtfWlPirTniKvZsEUIyAFA4l7HpwJtTY/1Pjp3YeW0h/S04AABQNu/nFXWNWz1VDQ+TJDE52vuK79a//4Zzh2azrf9/yH8AIWsDxKzjZSMAAAAASUVORK5CYII=", "icon_hash": "9c277b84ad2feebee2cd22adbff22291", "icon_fuzzy": "59f4472af565251bed0c3b75f443cba7", "icon_dhash": "70f0aaa8e8aaf870", "imported_dll_count": 1 }, "data": null, "strings": [ "DR6WhqGPQoexL72YWJKb", "cmDqUGjq5k", "MWCrFXifOa", "M1oGTqAKvFXLQDONE9u", "YIPVJ2<%", "PDglnKvVuQpicZn8kln", "L5PAjVxMJ1", "ReadInt16", "StringCollection", "_Lambda$__2", "AuA50kr1QI", "[>Hc*", "cq1PW361kHdT7wB5ntm", "VsRcLnjUqTRgB5vwH8V", "ihHLeEMYGE0yyZ0bE3q", "aMiJiix3yamEn2BtkP7", "LH5SSrGxNdDa29HUEW9e", "5- !E", "$WMM%0Q", "B6enGQIy4VbYERUgp6Y", ";4uTcC", "EndPoint", "(cLfo7", "tJehBRT99V1Z0fjrV6n", "RPUgfeGLekN5jaxDjVgB", "MuLQmCeohu", "f0NdCLOHLDuqgOs0g26", "q8HDDYnRvo", "\\2 [\\", "lr1v2yGyHDyIw6avD82K", "vTbgF", ".xEvE", "TextRenderingHint", "+B-SW:", "SZltwq4xkGvtOXZkh6D", "T=&~VW", "uJJecYv90h", "azO{j)", "SZ91NRf45i", "r90yFdAvYxUv0LutPHb", "_Lambda$__67", "RK5umIGnuptmfvCNeAN1", "mLFB2mfbDQ", "nxxjAZsao3", "set_KeepAlive", "IYLZ3FDDVxM58pIuRbx", "LVNOhEATYorYmX7b3Ek", "pFhwM3GM45mvP5VqwuMV", "*+%RVM1", "aWlYtI10QfYyBsIixlc", "EnableListener", "\"@7JW", "MEA87jpSNxiQt1Z7Uhe", "USqw7nsoCg", "GPeAfdGXs1dO4SQXsT2P", "jNiVlfvWAYw5cE4EalS", "R~xES", "ListView", "S|IpA", "xhBFJIJNWhlhyL19eMR", "RLc?c<", "X8olfXOAmZG5rsZcc4", "mB$r\"/", "FRChp", "Ba?%\\", "VvJ30y", "!?VnS", "set_SelectedItem", "ntO4AhGUpFdVT7ydUNC", "image_0", "eV/}n", "U9kqLUaOII", "ygALQpzIx4iKsXMvHNr", "TgduJAGYJtMkuPwosUuo", "\"U#\\#m#", "wxwmgU9GGTbTNU7JQUG", "V!!u:V\\5vZ", "Q0DFTO", "x3tf9ezgXDEXwLxBdH2", "cNncwOZuWfUgBjYXA1", "ThPoJY84pjH7ycvp1XB", "r7K8rlmNjwVrwu2wfGf", "SeVuh6hGkeQDQ5uEv3C", "z{8Kl", "%_y5xo", "ukBraWy2IgGN65JLKXu", "+_HTZDL", "cABJf36dY2", "[KM|-", "+zzkq", "W|wJ;~d", "Oktjw0wMOA", "sSpY7B1QM7", "ISOnpT7m2u", "EekNmSRD1PMA9bN27X", "SUZeaw36Fp", "ujQp4jG4tHArKKUATOvV", " x&3H", "FileStream", "set_AcceptSocket", "4,aM.", "qwd2o5GGESUub5WQdxAD", "fwNePtGKab23xqLoMY3Y", "qmLa0yBj7SejYokxcee", "JLGkSsuK6swoGDw7Zjx", "GDelegate21", "RvBQkUgKyH", " ", "*lyX['", "1@w9o", "set_Filter", "L}):%H", "get_ControlDarkDark", "wkOhRmaVTULaSoWXUfA", "0*MBK", "kVMfXUQ3ahtxWyP2iP8", "wmdy4706cQmPOFejryu", "ip0xHhGhD3EwAiVo23g6", "xhbD1bH2C4", "m3dLBaVRPjF4nBSKL9F", "B1ZdldrOvkkB1dmSWmt", "set_ActiveLinkColor", "Y$*+LX ", "GetObject", "9Rccn", "isSx1PG45sRZyHjkHNPQ", "&:'X'", "c7cjRCGfYUIsqGvFqZ5e", "kKwtr3OR6micL7B88Xn", "iOBd>", "Y3#B=2", "set_MaximizeBox", "rpxRuiG8x2PQ1Y5a6bPB", "m0E60HYnIX", "fqVk}E", "S3edJWOlMd", "Ov2A6Bold9", "DeflateStream", "Pp5oBFTqPQHyYDvA6FR", "ToChar", "plCFo9eQVcKC278Hr5o", "[^QWZ", "NewGuid", "VlIOYk4G1E", "VRrfx>~", "eTI1E1x6vS", "arACTTGIYgXj4BBAeJwt", "DjJGIcGYAkUx1ZdScsnP", "Default", "Lh6yzuOasu", " ", "NeuUZMmMyVNxaHbObZR", "~4}`_u", "QE3qGT5MYSeTDbjWLKf", "_Lambda$__71", "xuN6dspLAu", "ObjectDisposedException", "O8YMSvi6JEDZmj0pltQ", "background", "token", "ydXDMqDJ7IaltXCPo2S", "W@yK_", "NtJ5bnO4IM", "LoadFile", "kVdDhF16uNUnFlMfbFg", "ycauHtGMBftp9rx79vGQ", ">/9 t", "xEp2HbGYP9oosHAC6SJ5", "ToolTip1", "pUbb9VNdtJ9p2LamJtq", "S0#5RQ", "5g", "BitCount", "WNKvvT8p9g", "yfh27RtveEHJGTbL5T", "@rfeG", "G0EZp6zGXLTTbMeLO6x", "K;uS>/ ", "method_27", "jneLNBQTNsCor76HxXg", "YjmmW9JFCmqgxOffjml", "MrlsV30fDRM9qZdpIW7", "\"W~8e", "GwFA4Tq", "Fkx79FGNtW2A1r8wN0vI", "IButtonControl", "Q8rQhmGb2oPh8wGxYKqP", "KsPlp", "PYM9k3oxqXDbTp9cVwa", "NanoCore.ServerPlugin", "s;,i]k", "rTxU3", ",^-m`", "W3rXkmGr8ssCOYPtwHZA", "method_6", "WYrBx0x5icjb5b4Js0", "GetUnderlyingType", "k0T9LfGZjivfgkOn5w9G", "JQ1RL2Zxj3JNfL7XJvB", "k0iJPnH6QS", "s9dhvhRmo6", "Vm4\"1", "BXxEPsLH6CyT4KYweP2", "u4QHj}{zK", "lv9OEfXt0D", "FjvAlXVIOV", "NR*3F", "QPb5BkT4Uj", "LegalCopyright", "TrrpmpGM9bBX8fRvRei3", "U7MT^", "csteASGwAZmUTLK934oI", "eP5aUfGn4SADQQKsZBOq", "ToInteger", "WindowsFormsApplicationBase", "cFQp7", "CompilerGeneratedAttribute", "ObjectHandle", "Vgx5ZtFf4h", "EndUpdateResource", "xX5LICGxIGjbkyHD5Cvg", "Ya}+b", "Me2gNWIcoVdKDelDVsv", "EVEz+}[^", ",k)GG", "e86J1330t0", "MbXlS3uZAh9pkPVHkFS", "get_RowStyles", "g1J8aVzXqQurxx8xLhE", "l11muKYMr9CsWbOTsGT", "p38NDUO71O", "r-Mdy", "_J.8ha", "X79oMrjv8d", "rpY7u2u7wYyw7MaBDgp", "LingerOption", "c8loz3oxmD", "hVQYYkGwjQOKbhgeWmLN", "fuvX8RYr7lZ0dulLyGZ", "D2fHDioKdhAHs03qFMF", "TTW_B[", "BDDtW6cCZqR0e2NPokD", "qnldwIg0BT", "otns\"", "Hy3Dd4TsO9793ayig5P", "7P\\8n", "lyIlyaxS7yTLNbsKuc3", " $T^-", "#Strings", "BeginUpdate", "vw\\F9", "cz3{4", "qdXW>&", "AX9y78evnj", "linkLabel_1", "cGDf1RM8CbOsQAi1qOX", "GDelegate22", "Wwwqi3PYU8WPWkJZB5", "!\"7q\\", "an4BXcTglU", "InvalidateTabIcons", ".rsrc", "Q7ENtKSZS", "xTUoismw43", "mrDSUYGwK4WkWHs7ZClc", "CZRDOBgigh", "$;OU9", "@,_'S", "NK0iYEpNPV", "rNwQ90iuBewNMq4vJBh", "ToBinary", "p<5iD", "DlZkNIpjfsvgWGPh7GC", "gdelegate21_1", "sCKHUutcOhG65sYMQoh", "wdTi9c0nSd", "rbXivdXMNX", "aKwyqg0xc4YXiSKLkwI", "mMW16yMwU4rUVyvDciO", "$CM|\"9'", ".ox*=", "p7 _QW0p!2!GO", "TabState", "a77jfAnw0vvUr7LL6JI", "dTwSQ0K3GdFESjr3w1F", "NotificationAction", "ghehy3D0mq2fCSdXbEJ", "Fqybo5di9LbkkE1hAQW", "wi6Zk0GLfPF8LeKgFEw2", "UInt32", "IuchRNYsAr", "LNvgKDGkwFpCiStjpYjC", "ZjJ4<", "get_CloseReason", "set_SplitterDistance", "kO9sAT4npqArqxBXH55", "Y6oYxNrf2I", "(51dk", "BwS6P0oc8j", "lwapkgGnSyg0fX04mIAO", "IU96HFSTMh", "kvp42FXwwoF2OrsEGDX", "Pp3JoqGx7SIQwfItdkEV", "System.Xml", "^ zsw", "COaxIYGyw03BbtiHHa0g", "T6KfrYa3kt", "mouseEventArgs_0", "LviltSGIC4BeBAdTHq5M", " Kq-:", "get_Tag", ";G')V", "VHVDXCm9JhTcqfvChUI", "dUiYILZl4a", "M><%A(", "_Lambda$__36", "eb;V5", "Ns!Jm", "e", "le3cBWGINKavADP7sLhb", "aEd37jHCGfxtIFvSSL", "Ga1a5FBZwCnHnSbhI4F", "CQ1[E", "_cgJ/", "LbgQE0x1ES", "6g`&P", "s8FSJVlKbX", "DAQKG0RfiMKGyWrMfBE", "NOuCquJ7CWZNDoSSqbT", "kDQ:1", "p2e28HHAZs2SqL5W5sf", "y02CSmGKKUnSAaK9xcxR", "CafHyw", "YLlejulGlJ8vs863evH", "$$method0x6000020-1", "diW9UJGKrRaBgcQVq6HH", "jWIxtLqsR4mDHc1Q0AE", "vKqxytz2ClOEKUta8wd", "16Rn]", "Na28yOFhiaecCULul9t", "6<6>1Qj", "Ud;6,", "hJhiDDVp5", "Cr7pB95zcwbiW4jGQJT", "p9\\<#", "RLyGS5vZrCGOq82xe7e", "M[Y}(", "\\mP Ms", "E7EPcmqbiGYfS5DexXk", "H9e4a1GyQDuO9Kt7Gct1", "O}*z+Q5", "XswvmhhXWE", "fVR^is", "pDpyd5kgF1EUWDJHaGC", "RXbQu", "JCimO2rfu7WnMLLUKj0", "HZYZ3OGniIOIf07xA9TH", "lO{G?", "sCx02xD3sWZkhEl0lrt", "hVcvKMG86vrZZf4Ct8uK", "Aqg1xLZ4C7", "eq54~", "qEEruFSdl1", "h&n&#", "G_;qXl", "N1U6TT9uEe", "N-7C5", "FenqntglDG", "oifBwhGXFr", "dtJh538pAv", "x=h[#", "QPsEEmu62YDmYeDvjiS", "p1sSBfJXIN", "X509Chain", "DA3PNfmp68wkrtlesQU", "DebuggerNonUserCodeAttribute", "Dq2lmEwAaq", "ValidateBlock", "kmcVQIc2ISkWO7a0opl", "8%-;k", "ycJy9WD5719RgcRHrOx", "e25HHdGVYwRqaD17YaHu", "k|H3~9*", "GtfekYnKOBVZcO27TUB", "nRLsQiiqWi78KdqGvEn", "aMzg`K`", "yKaNXawXrSFXbcs32R8", "adTqV5Ri8H", "yA'/I", "set_Checked", "Yey03crxAP", "CreateDecryptor", "euKxpdfCu7x1SZ6cj66", "LPCNt8GRFZJ7DNhloy79", "IAu0wncNtc", "Rm1srKuB7SeUt1CppD2", "pjJIcZGAhgleR2t77mTE", "B-_7E,A", "lLh7mT3yNy5W4e5Zilo", "ReadDouble", "Y,|Z\\<", "3Z-;h", "UL6C3Drkrgl1BM8A3Ck", "JPEL4ntImdPoq0Oa2K0", "ke4GixJlfuSkyeHaxCY", "UpJXOHGYqH05pUtFr8yJ", "Y/8?T", "N*G4_", "get_NewLine", "aHnLxhGI93rX8sW4iWdB", "9H-XG", ";)*Y\\", "cpRNmN1ZGIf4Iwg4k4I", "4lX~0", "^l( g", "yOBWXrGBoOdlD7ZIwU6", "get_InvokeRequired", "vnrke", "1Yx~.F ", "AssemblyFileVersionAttribute", "UVKjR8eh6k", "oraivFGhbdbn0p3I2u3j", "GetBlockHash", "nA/`i", "c9abEAGfEeSAhBylCHqZ", "Li2JPvmZpo8jWeS1fug", "EV1LwUaziY8awahJUUk", "GCgV8MGRjwugUkAFVg8Z", "Emt2-k", "m1cM0BSDlDHoYAxh0k7", "zIR6KPy6Qr9AQytSqv6", "Ctf1kmj3OXhykQGGBtD", "tkpRsx01TJ", "X4NBBEOkWGsFaW1tmIk", "JfxUPoOUKaG8l7JEslC", ",4S}Fo", "Focus", "IBuildEventArgs", "fJxcjKGmSCV5nHNKc2Z4", "iJsAVDGefyuDEtaLeaLh", "CQVglCkGsYti86fQCsk", "WdZrMxf4N2JwZ86sCBB", "PoXwndo3ep", "b,iX4", "vMEdH0QuRj", "]vcP.x{", "iNuUBMiM9j5TMFbIuIE", "d0RYgQWQ6N", "\\n<-VM", "EnableToolStripMenuItem", "NsJ'1", "dPANP7GK8r8DOOMZACam", "X/ong", "aCb2jBG8JPZnm7moZ2V9", "R4VssEnWufgauY7WITI", "OiN5RCT4EUnR1FQHIKE", "E2jyNcMkJB", "sq9cILGIQ1uXx8xUMHQF", "EAbr@", "uEkDihn6DEBZocSf2j5", "get_Modules", "zUyqCuGEZtYLednNPkTQ", "E34vgZN3n9", ">i^;'", "x6dC6kI9LISYluiClji", "AppendLine", "RemoteCertificateValidationCallback", "QC4S4lWpdDCyd7sMe0H", "fsZnCETKK7", "pFMUeBGY4WQc5Q0A8tKN", "zeVrUtF3SreQmHknddN", "4[|Fw", "t2cGreVmtBfpHKxZuqV", "obUfhKPRRju8hOSQUU1", "tQX.x", "I5vlv3JgeNdBM5mhlJ", "e07CSEd7le", "WoOgayGmmP2Zp87dJV34", "&L2o~", "wRn6Aw6VkD", "vLLpGZf0yXA3i1ohhYY", "hpOybwqNnAAxX94TVcu", "MXeroQ5kdRsfK8mESQf", "MessageBox", "2Ru\"8u5", "System.Drawing", "ytHReokCTbIxiDWbOUr", "auFldpEg9cEvqMD0JU", "fEAcNaGGADcgSVuaIbrx", "ContextGetCheckStateDelegate", "method_40", "T2dcucZBVjQ49JHq82S", "BXFfdgpdkh", "TfE1FeN2eR38c7qEO0x", "WTfwd8KEED", "dHfgTixcBstqABttNQu", "JtpRHcNUniTVau4tth", "l2eh8xPwV", "nsqwXn3LIc", "AUXdk6xwbe", "hwv|\"", "OoPDKiGPC9QLT1lT7igD", "StringComparison", "EOY3etIZvnHlHZCdDBo", "iserverUI_0", "npUwH1AVMJO6vvQoRfm", "jHlBAQGRQGCDey7hvnEc", "BUOJYhGgFKMjtMJRQ9PU", "IX3RBcUiyc", "S1xJTAGGQd8CYduqO8c5", "BxPTCHGrUCd8KbkEErQC", "gWbkUhEHiXGhgSMnHV", "lC7Ons6qIaYm71hq5pg", "'4", "tGEoMUxDfKKjgnMWX3m", "lFhMS9GKSK4exN7SZZ8c", "j^3C[", "hBYEy9GLNjpY4loIeWkY", "d}WGy", "SYUJGdGbE5CnFdvl3EQb", "Ceiling", "W0mh6fuqIsMKjYKOjDp", "cyDVBXvdCESgxX79bVU", "YHDouTPxeiNdIsu1kRG", "OnCreateMainForm", "+|&^W", "FileTransferRemoved", "vwOVXGgfhJDjoc827P1", "mfSV1UTYXvQOPKctiIZ", "H6fBJ4N6PROeEaZE4hl", "vx908YGn0od9uncF3ukx", "ptaierDo4H", "Bi4ey2qp3X", "method_46", "]j};BLi\"", "P9*kw", "CsW3b7Gy66H09A7dsJmK", "zFS2e", "b,i:|o]|", "f8HlYktEE9", "fq=)3 ", "get_Images", "QlxfG6GYge1UAcHh4Hhq", "rBsYk2G3fZOOYwNf9sQX", "fX.1G", "Q3XnHyWp6A", "][!dz", "aZbERRG4CSClpcwgdhv", "VcxBnye78Mu4BagcWLw", "EUEpqeXzBYrc3soGPA5", "guid_0", "VqK8FYiK63YkS4fQlHR", "Mu%pk", "OrvCdx", "sNVA2anygoLjw271BCJ", "k3qo3l7R0txg3rxPmZC", "uQBA^", "LihL9IGVU2AmRXcwoBb", "cRdrAQ4sYG", "UwRorlGwZL6uaZNgjtqX", "hiBraTZls2", "coi1nPgvvn", "aK3O8BwPy0VyALG5Ncm", "ebW_J", "float_3", "i99ScIlrtxO0IiQI9uc", "GKeAe", "tPHIV8ihXCU6SpwFGPF", "lZF3ThA2ECit61u7Gio", "duration", "jtXNrWN8hROCvpyCBk7", "@/2CT", "Bronze", "hCPTchVVYY", "LrnIKIGfieypGE9r8U39", "BdxkDlb0SHovmcZUPxL", "HZdBj6G4HOCh7Kk2QWcr", "hgujwlqVgndM0byfwMj", "{|MVq", "\\CQJq", "toolStripMenuItem_0", "yJmect", "QPMQP", "9[I*C", "WsF6BG5A44", "ui9dosXNoM", "set_StateChangedCallback", "txA65mB1kt", "SetWindowTheme", "QWtgSgGgyoJ9JVKvcXqd", "isVI02Gh1fuxwhAEa25N", "H1qd6EGrK5tLwcrlkbds", "JEginir4An", "[@ig:", "DeleteToolStripMenuItem", "iWYiWeGLF2Yv0ivMxesl", "*}^En3R", "]tpFT", "=WD`!", "rjggSVRrvelMVebQlN7", "set_StartPosition", "qnQNHumwVMAvwIqCgLa", "set_Name", "PointToClient", "Sd5BfbG8T18IKyUK3y8s", "?r9g$", "|wFnm=w", "?`$U@<", "FromFile", "get_Black", "aphC7nkV5M", "yjBta1GfGRpx5GEC91ck", "xR5I1CGwr5oC3b3SYQ7T", "1UV@M", "[fFAi>", "SaveFileDialog", "<;p&h,j", "method_31", "gxUWTlTxWkQQl4vLQD2", "lY2kCgnj6MdTD8b9Gyo", "j38YsCG625Rg30nrHxR", "Li5PnZkFDbo2aKbHwL1", "WcFYGBlzx5EhnHUUudZ", "qs1jHJYqV9", "tv3Uy9bnv6CiqCdCwUt", "KxPxoLGw64mEXasMaYEe", "BBJU6HcdtUdHcrRoSFt", "njqyRU66Z", "Pv8AHHwyBm", "gK@EN", "xKHO2FGMUHgTN623oJGY", "j!&`z", "jrkRM", "#b2Jq", "du5hw8MvKH", "VVkqPTGZPkSyetX9Hb0P", "~^IV,", "C9uQlrEeoOkcH60gHLb", "e5gxExIE22kWeE7mV2T", "n5hJVJ4LM7tBrwL2XlF", "ExecuteReader", "axSGexnnGNksGi5EQPH", "4r:d<", "iPGMYpTvJQ7DQ2eTTwZ", "_Lambda$__51", "gYiZSNprJYbjGGHUNkJ", "fLrobT7YrD", "PBJWXvEdmksTFtHC7yO", "qK6wqaGK4VNfXnDM1XLM", "zr0POLSWTw4GkaibYRo", "ReadLine", "_Lambda$__83", "SQp0Iv6T34QbOBNx6hU", "t:A(%Q", "oBu8cKGN6pCUSCimPquH", "U97tIWrPVHDb0FvdHKh", "fgIFIiDqRehcHM6jGue", "set_Locked", "ecXWP2llIMHULFr1kw4", "RxSPxZTHPerJ5WquYbR", "tgcqxpXOXC", "|zqTb", "!Poc,", "w8LV5LGwOJ88xX5dRnHC", "StreamWriter", "IWLwesSOyT", "I4hGFWs8mfswtf9fAiW", "jf4qYsSmu3", ">?]+*", "_IgqElc,", "aAsfRFtd33", "A46HqUGXx49ZaFonnp81", "ueJRS7YYh8qBEpq2Je0", "qnQV43G8O9TY6UnCgiib", "OyPdtxGAnR5AjMAaDDth", "IGACap5o96iNI9uQpfp", "uhjCV5qYSyxpIxIaFNq", "kjXTivoBeh", "AWg/`S", "PIFwbWGGpTWIs4hm0KJl", "hEuY4JcTZlRDE9vq6Qj", "P ]fYsJ", "%2d,UC6", "K8Vhys2Ftx", "KQloEKve2o95FenAUBp", "3Sp?m", "nypXGQ7z0CiWRJB6D9g", "J6k8xixh3fiE6YHLyQx", "\"&PvU", "AssemblyDescriptionAttribute", "NextResult", "remove_Selected", "rKJk4GM4C9GGSIJWW2t", "BPtRLpGyzpkCGuxjAosn", "ListViewEx1", "h^UG\"", "Bn*(l", "CdQgjuQjr4XPEepDP8D", "c2oAXcOLtD", "*>NW@", "_NPWH", "G3xTOo0AiqnMLI86tw3", "G2ZiwdGlyYmtYX7Y3vCU", "HoAEs9Zvh", "dfvnvKmLYgd6GMVYn4o", "N';Xe", "P5fSHT0JYXLgmspkEiB", "uFhjPoAenGB20fWv7Xt", "get_DropDown", "VgrIHuGenMEG4UsUBFDa", "Getr5D", "Bk!l,", "iw7nhG7rmd", "aYgomtugdTHWLEgUaiL", "g8yCQyfkrIYs7t0A2HT", "GTOSsReFxSoMVq1WlcQ", "K)s4C", "VxRdx2wE2c", "aCqq4hGSMZ", "PX8xhvjq14", "KryP6GnDgsF82OL9Dqn", "D5thndIa03wpOLwMSAB", "IRuNIVaXGl", "add_ItemSelectionChanged", "kP7yaVKexNpf7mq04PM", "gaa7XH5SNPKF1BlhfBD", "Broadcast", "MnEhf9GA9F1iAPrOcFhv", "V9SBBxGGcEd2WZH3IqpG", "tUO6luYRbG", "~J{1'", "HOMSISfZ00iHTkbi1xA", "Location", "DG5d4VhBR7XkFFPkjlY", "Panel", "get_Attributes", "uXQinNtgkkCFtPur2bV", "Ynmr7OGP7r3sIPPXDhJ1", "Utngq", "dkc0NuXryY", "(SYMf", "Rl44iVhg4cpvI4rL4xi", "XpuVFAGCKDQW6DShJQav", "Ol5C4vZnxZGFJ3DwAu5", "xs5:*", "zss2agGlfcg3ECrTkj9r", "SoundPlayer", "J:xeGt", "SalThqltye", "!(\";u", "H4Y1W3x5CiMrVuB4yR2", "mRceNGE6AawrCmGdiTp", "VVF}/", "u6ZjFvG3IKqnfs9qmssU", "jJXrLUcnqx", "NIuS2xU6h7iOcchgN4d", "MyGroupCollectionAttribute", "xrAeDXRx7gTamqKdklm", "hYLn2RDirF73hyddVKU", "q3Zw2dbKtv", "vb3DNAGCAUD9VII184ek", "t:uGB", "GClass4", "CjAqPMWHvXHhdMXCr5C", "ParamArrayAttribute", "z/6/G", "zdoAtlQHhO", "remove_Deselected", "compress", "hOPo5OGrg5RsjkOyk9Jp", " ", "Nh9aMB49qhfQhRo55SY", "otfVbefCyh8Ckp7P18", "zsu4MlEh3CZP2WPjsj4", "yA7On2FRGyBZwWQPkT9", "ToString", "aBUrgcGR4amoiSX0F0nE", "vJ0mWJGlTL5s1FSZDkUQ", "XxsgQQroLdFX5QUVURP", "set_TextRenderingHint", "oHLCXfsQQHmCR8EFn1d", "(oKI!", "AjyAUqQpRT", "PXmdHAiy7De0HI39OjE", "int_14", "&i8hu", "eL4QR33dLZ", "NgrRNUSTLpw2V2ex5Qv", "IQk6N", "jXtrigPQPe", "F v*8", "iconDirEntry_0", ":K?)9i", "0vV^9", "ao5XvDV3y6mqimSj7jQ", "MxPIUYKYbJJNaHdo1M4", "set_CheckState", "I0fA|", "T8VO4UJkdrb9YEncrLY", "SByte", "`8EE-", "crTktd0zkX582kx6Tdv", "t6bmGbEDwqv2Iua7YuO", "whoh63xN0A7kE7Vaum6", "GClass8", "eH4Oz0OZg1", "RlkBOu53OKyHN3lktLA", "D8Am7OGCcNjsU6Z6wMuX", "0w,:3", "5#eOZc", "pvd9^f", "REneEgTs3PCggaAIccu", "jo8CQAF9THrXB8qcBiW", "uCnEW7q7TvBLN4AxsAV", "QHnosT3RYU", "vlBehyG4my9kDYmuE3fi", "set_UseMachineKeyStore", "j\"u]\\", "IVnrqsCCgG", "l6bFNFgmJdqdqHtLq9E", "n3LU7", "rWNT2yGQv8t2a8VmWVa", "GDelegate17", "SlaSmfUZ1OIUDH5Pt86", "WkEqIZmxD8", "avZa2QUyHYng08kuKZu", "ClientStateChanged", "Vi6ZGmGh2MH2wfEAaIH7", "UXCJX4L015", "pbJKDs2yCEWK3ZEabIT", "get_Exception", "zVMrxPbsAf", "ifXeYJch9Y3jWifSW6C", "u1oBy13Ku2", "he5FxjIPyIsBin6dLMx", "aNfO54j5an", "Fp7hdo4hPFM59t3eSVS", "Y8UTU5GxTjcEs7nMEF3l", "Yp6L9QGNYtBWZVpOUPra", "SplitContainer3", "get_ProductVersion", "oqAO5", "p2HqBawTHB", "NFXjQnk3Dl", "m2Gwy8H0RV", "yB0dtLtIusjtZauQ0j", "ZI[{8(S", "h6AyXqGKyuYTqru7L91L", "amA4G3jYKGOVu1kWwG4", "Zj0=d", "i4cihuqYC9", "SetLength", "jIU6kwGnyDr96SWR3ZTA", "VtDb9FOIGR", "nETQnKrckl", "J+kh4u", "set_CookieContainer", "?${b5", "P8CW6nGrfEXyWaCLufT5", "MuOQTcGravXccXYjB615", "bDkN3r", "label_22", "add_LinkClicked", "IClientDataHost", "QOXMP3GxnUF0YmMCiExN", "Qmv',B;", "Single", "GNm6o9kFjp", "aApP6vZ7bnSimHI8PZa", "Gid5BTGLj4lcrGVsB3Tk", "get_Name", "RMZNeILiV8", "+]YQF", "ToolStripDropDownItem", "P7in2eNcMqE83vO39l", "rX5*#", "fvVBVIMQPi", "XfNdfCh2S9PnVLyYVqX", "Mc*KQ`", "Ko7j1BDuRB", "set_FullRowSelect", "a9glyHX1tgpNygRqhKK", "GetResourceString", "Dc^P_", "LRmuQbGAz8P8bZVQTjqc", "WDA3dwGEQkQX3kekcdXU", "kYFhjwGnok7XdaSJVErD", "Button1", ";o\"b_?=o", "tERUXMGRzZrMy5KPYvhC", "SvXvvpGfqXSbeyUQhpdy", "Iy8xAVALbkLUxljl5Cx", "YikdWrGP2CarxxKsFbpV", "torIQfGMvrQMNsGfNUey", "oYhJFEKxHssV6fjUKyl", "get_SelectedIndices", "VM6TTkaG4p", "IServerBuildHost", "CipatlgDBZ3neQRCucO", "unVyGeYglo", "aTni2jwoWr", "fdUh5SGl749uBkWwDeMs", "OMiwJ3", "W4mYl3MgC7", "-XXwz", "KeyEventArgs", "UwWu6", ",|RHU", "ColumnHeaderCollection", "CheckBox2", "xO5JUlbW6V", "RectangleF", "~W]S2", "aIW2ECK6sPQl3cw0RE6", "iHz+[", "VjGZnSRRyVlP4v2iOd", "Tg6yG4mGSNJ31ftvCa", "PnENKbPuXF3n5bF7o6n", "tmISrv2niQaH3XaErAd", "dHd6Txav2iZ0Tmll51", "nYho725M9M", "NDDsu1GZtlabGKrat1h", "v}OYt", "sIt14DQQWNIiI841Lry", "uS4tVFGMKZh5DPQX3OOv", "'pau]g", "zlcotGYnvK1HcZ7iUlQ", "F h(8", "U5p2VHGU7y3Yomp5Qtr", "dnKcdA", "+7j[<4*", "VKCTICjdpq", "g]Fl<", " T Q", "OfHUSJwBwurFamKiR3v", "set_ScrollBars", ";}_@u", "TCyv4dGymuJOY2FvwJtO", "oPelfmtuxelmqLkfU6a", "suxZ4qGedImBP60ZAoT0", "IX5VZlK1qLLjN9UvF13", "t.FU+", "qyxK0UyxRitIacdPfk1", "@.6GsS", "YwOK7", "get_Chars", "NuXTxdAnuK", "I0Fs3gRgU2vwd6DA98e", "UO7TkL4R108vn03Qv44", ">_)v\"", "pJwRlqGZM3DnKHc3PHqs", "4B|Sw", "ucAoDoRWa5RI8chk3wY", "cow5GAFlvYFwGZ3X8Gw", "*E!lZ", "System.Data.SQLite", "dIneJGrtU6", "WFCPvmGm7WEcmV53Gvmh", "No4f8SwxghPEEZE55U8", "MenuBorder", "jFz86", "N8}{7", "nELOoLNiPo", "yJodsv6P7o", "lDsRfTctZpbsoZU5Fxp", "eVmXy", "OH98fXKh61hhxwxvf9V", "qJTxg0H7xbet2unTX8h", "lV3j62VSXp", "&ChS!", "ehWGb3TQmW8EPPbr5y4", "y4iggt2absOQJhhG7ap", "NcB6AFGwfr46rsWpbZBr", "SjX(M", " ", "Empty", "%qAoZ", "IgxGZJfdx5VqXiWvmNY", "acgIEezK7OQcgRSrhkD", "sO3=k", "HGiNxB7ZBp", "jA@f)", " ", "(WA^w", "GClass15", "GPeUxMz8YAdFy4FVRNN", "qhcRFnGh3mJrhsxnWpWg", "0T(E=", "EFQLx4v92BVXrRSZKhK", "Cpe57qQDFfo5l9TmoEa", "nZ9ZoO123RlwRsd5eKb", "\\6>r[", "PmqTsDsxXr", "&--QK", ")MlXN", "yAtWeT2VKwCFfoYCEC0", "GEnum0", "rqrIuYGPUFpEXvyl6yws", "paFM83G3a9TrpceCB48q", "TabPage3", "ueoBI", "&ScNqk", "qgqgvIevxHjMo4rfi90", "45fj9", "}~zP1^", "hPpoWBGbB37qIuhWDYFI", "zXiTEPX8hk", "Ww4WijMw6aBL45AUvs", "Am7VAAIjglITTs0Y4As", "Xk91Ls7AFvHWWaX6oyv", "9wwwh", "IxpNXaMhG5qpQEwEDum", "iserverBuild_0", "mKCW(", "LkmZOpGljSItpdYyOY3d", "8i;=}lyS", "FNKUlhXU17bVteWCXjb", "TkgySkfmOLsufHAo0LC", "LKiM27GAj2WYUyNZBdeZ", "{5&51", "VnIsorZvRIT1HxEPHQj", "rqcMJYHlRc9L35ShIrC", "BlWfwFTeZj", "nBIWuYd4b", "XJNvcedJ91", "FJcn9wGLow55A6oUM924", "fx,", "aCheF0MUyoBK7mTlsDO", "nFJn2FXCuj", "zkvAobGeRW8Sb4f5QeBh", "SetupPhase", "EjCW4GG3nIISPYNJn5PV", ".n C}i[", "SaEN2b4UwR", "_Lambda$__19", "5~js}l", "gqDjIoy3y4S8VYLvjEb", "T3VxWo8ScWsFKxrNcXU", "PQoVYxvFcyhFMYTeGwM", "LWo75", "IContainer", "JS6emoxtlVMQSUKXx9l", "ServerInvokeDelegate", "Hdn78YGfDO7mM7baLuoj", "_Lambda$__45", "FI6NZrMp3K0Gy3dOuxH", "tabPage_6", "pS0JL5GhsyNV2d8G0PnP", "();B=", "NlBZ%", "xD8baMSjrrJYiIPr7u4", "SetClip", "ContextEntry", "PLTFAyVIkHRpd6lxdoI", "FjZaBMzTAumONNw0SvN", "Reverse", "vxn6R3GX12FdyBlPq3nM", "ygTVJEiL901mMYRn1h", "JQb2rmGbQerotOegN3lj", "Lf4hpyYU4fXpV96v1US", "p7|;v", "0c\\g/", "StartFileTransfer", "XGYyaJa9oLg6Av1jvOZ", "tPrxyE2Trv7T2tFgXoI", "VdCT3KHsPJ", "FCyi3aGeaDDLJcrfLoW7", "PWzY'|g", "set_Icon", "LT1sgKKbvTdPQOqV3yZ", "VjhDBWZGSdTevT421ep", "enZbDAYzUlGHgZHDHHW", "PybX8gKcQ0H74pmeAXQ", "DSACryptoServiceProvider", "l7HYSEGR0OQIjj3Lk4VL", "gvHyBnexqoE5F8w4N3S", "bool_8", "oUZT$", "X06h12TdK5", "s7QbiKYfn3jnNq5QLH2", "AJGrtFV4lC", "pJMp:D", "jcsi0Unbya", "uq10rY", "#_{mUM", "Neyw4mCN7u", "MX8BuJrEWI", "uhEHQaW7gZSCqNrhVyS", "J'*$P", "mJdFx5GA5hj0XU9WLvi2", "hkKI5lNrbNNxtQ2j09d", "LKAGwdYj8PFjTmvmum8", "U3yLwsGmDZXPcFSZHNqJ", "uuDhqvGl6v3RWiWOjG8y", "kZrUjLGN5yuhnhWWPyNO", "YjqSBHHLA1nuqCsy7tm", "THfSBczRRUkbSBhAZI", "omQnmtP4jI", "rfhB8E3hu8575wxrLda", "oiubKQGXqo1P58W7Ddp", "amN3fWBy5qlkueYZcu", "jUeYtsPrD3gw8rERlIc", "56\"v|", "ynIYwRaPDI", "BoBhmiyIfq", "e|yO ", "IServerUIHost", "Uk$*A", "set_ShowImageMargin", "BGBTphOLCe", "ShowToastNotification", "set_DisplayIndex", "aw2MdyyI0MeBB9hM3kN", "GyusI0EgCirKQ8JRKNF", "NiuN5yGZNJEr0jis6hJu", "TQrl6BMqXg", "KXoWilGMRZkXwXQ7Au8c", "cZQXq", "WQUPypT4snmvnOCqfca", "?kvIfxZ", "syAQHuWi5C", "h$eTfB", "+zcB}", "RKGBaqOpGx", "qWd3NMWwcdoYnPRxIc3", "TMTT98M0nTWFCIuUxtl", "7_n} ", "method_39", "|R*/L8", "{hx[W%", "=s&p;", "ListenerRemoved", "qRonEpQTQM", "@&e8(3VU", "get_Assembly", "LtTfem3G7V", "Ia4uUYnp1qKm9UfBDV2", "Tr%]m", "CloseFigure", "EYlPIcVKvlbN4NFxT6O", "DESCryptoServiceProvider", "h3wp6", "Mu!U@", "MemoryStream", "OREEVcjj2wdKQZLDDv7", "svFh8sG4fdTrOF0uGOA6", "Ljs;}<", "BwhWNCkzBAtcotdZHd8", "jXmoW8GwB7TSkrk6arUj", "VySgCrGgW2PgynSg0Tdb", "pdLjRx", "pCN6U08Q5f", "(ToyB", "MOlQfC62tFx36nVUtUe", "ContainerControl", "x5QX37dJw8p81IeOk9b", "TN5bdl2BpcxJHh9c7rO", "U4eW6g5vaEQwi3V8leA", "|7'\\(", "g+.c&", "lv_GROUP_0", "toErfJqqnU", "mONPGFGxrtFTw0PqGfVY", "Kmv5fLw5f0", "yRniIQwg7u8CuTVpevn", "MWt90j4zhv2wMTxNcXe", "H94|r;\"", "LxOQOmIfW2", "5vVxkp", "nbOtTfGhS9RnNcPrC6Pq", "jwdiNGG86Q", "15W/hZ ", "k8\"XL", "GClass30", "@tW;kv", "GClass6", "JOBJ3yGEo1088NENpxiR", "tFvplDGlosG5okrmQ0ir", "value", "GetManifestResourceStream", "rhHn6qPNPt", "Eo81WQv0Mc", "axj0nv0vHDKpnv2rNJ1", "adMJOfGn8ZGnaMs4938b", "Misyg57GJosjNtkedD1", "Waqil0GmNFxjlypfvTkI", "wkE1ocGCxWdXnSX4aF6e", "gcontrol7_1", "object_1", "Gptw7FGZ0KeWcoCeMcOB", "+FEz[@", "MSElWPuqXx", "\"o[{3", "method_1", "A6UhHIPYZiCdkLy6WZC", "xfkFT5gBCriIs8thCX5", "kxrukqBrlICdReVMd2A", "E6wTCQEq3wvqwBvcHwp", "3q>=Iy", "om5CiKGlM8VEYiDuh82L", "DownloadData", "get_Value", "t`@6r", "gG95Z2X8u1qJlY8h3rO", "G\"KQ%?", "cornerStyle_1", "(FXY'D", "Ly3NHiGZ5KTWJYSNBmHW", "v3N52sEfTGqokUsPtc9", ".cctor", "TB8RbMNiWd", "uri_0", "mQvFvSGxV3ERH0KaJcYT", "uQdRR5ryp8V4rQCXX9Q", "nAY0QSGLgRhYLJkfFZ3D", "lLq9D", "qHoSE25yya", "_Lambda$__24", "$P\\?O~", "j\\-|i5", "g:V=a", "ResetClip", "Sjab7NHjLK", "p9rA6vGLdTB6Mlqi60SA", "VHtbYvRk5D13ZlM7va", "GTd@{", "wHKm6uUSW75hwB8eMjN", "get_ParentForm", "U!]iYd", "?)|JdF)<", "VcuWNQGjxf1vjnfVFpY", "x\\RUR", "X,{Ty", "mpRd0OwfJEK1FepuMQL", "St86pJkYpQ", "vYOColG22Ax5APJNn7K", "4dCd=", "System.Collections", "U5ZZNIGxPjaCpNlvHubP", "pd7POgKmui", "hCjliuFnSa", "StringFormat", "epJyggiEEj", "ts++hr", "SmTdu8M1FKsqIk48lM6", "kMcydVgsGk", "jMke3ZpOTS", "eCu,*", "QbhXktb430jxmq2rtuI", "nLSNIgGEOBIFBpWpda5j", "zYhxaj5k4B", "lRXRHMW28pKDxsLO1NT", "kPIdgrZyG7k9FsFkc8W", "~j:|,0M", "Ja7>w%j", "set_UseCompatibleStateImageBehavior", "p%0mT", "radioButton_2", "UqWAcVtdyB6vdCIpiYB", "TaS2jv0Ed2EBCn4GMKg", "8DBm]", "get_Red", "Uhb9q5GMpltMaFPp5Z7S", "bool_0", ")Fqd}", "dRbkYkGZiIl7yE3DnmMa", "wTrNmCXbIhng7aPmNSX", "!Ll=~f", "L8pgso213FyuZITY45Q", "zwvUuHGP3Td6cDhHtOO0", "short_0", ";s~We", "c+Kg]S", "d1FMm9q2qaBvo6njc3h", "Kw7DhJUwmR", "-^#)YxAm", "G~>4z", "gIcj}LI*", "vWmMwtGAcqA6ZNjFQsI", "OmsPFvnc9XSsAAJDPD0", "A6b50NuMgCP16QxIfUw", "wjd6ZVG8ISSmLfilcUFZ", "(T >L", "tyDSy3GKNolhGppVPXwp", "KLhJu7b3m6", "sa!%o", "aPX'~CY", "p$.Y/)h", "*VtQr", ").#rIl", "jwdY2E1XaahOubK8dDR", "OiPbN0GwT8beqBH8g7M9", "V9sbrEJmmYaDXKc9W49", "dateTime_0", "IAsyncResult", "AB1aAU8evTvEI2TbpbV", "4(X,yC", "8*;w@", "Pbqv<", "-USgiC", "n32Y0OEKEl", "GDelegate19", "NpNM0:", "GStruct1", "method_7", "eMX1mEh6LVrNBOH4QhU", "GControl8", "remove_ItemClicked", "GetDetails", "U/^9J", "GJ9bMKGbrX60AvySX6gP", "POBKRmGkn6sVe59UugWT", "gPNC&", "cU8Btd5pCr", "GuidAttribute", "QTJ5jtfB4v0cj1H7NVH", "a8Py6PS9KV", "IS8hQT1wTZYjFw6PjB9", "FVrfSKhMJ2foxIYAl29", "EtqWoYGmie4y3Zpp3CgW", "AssemblyTrademarkAttribute", "vL6g8UGIpfKVYdwtn0j", "TmbDdGGyLvK5o8Z7md2S", "JaaoDbGePrCTGrCbhtVk", "gWblt44HWmfsT3vS9AF", "GetRuntimeDirectory", "f1D6u58MtpZ1keEgbcy", "a\\5lH", "ExceptionForm", "ViL\\G", "PiEiCPGlpfrhGdn9e4lt", "{Rg$,ox", "uj9RArcaX5pfFExWlXd", "JF@3)", "L'(9?", "Xj21vQYhPidDGyq9JsH", "Z/XY\"\"`", "WvCO3wSr5VmHyEpyD6b", ";C4S=", "System.Drawing.Imaging", "T03ALnBbmy", "FwmQ4sG479bBofKohvDW", "YFoQ5QGZZLeGdtKWepex", "C4Tvn9BmND", "b70&U", "w1s1XMUamWhTL6PGV6a", "P7GcUu19Qwt2SxvCNOU", "GetDirectoryName", "Rkis>", ">` 7u", "a3rtAaUXCYrJojcYi4F", "xAEqu040NF", "8t/{[", "nKNxRyn5vbXpJvRabnI", "xuj1oKSCoMR3sF1wDn", "DUc4JhG3ApxwAjbOZpTB", "SendAsync", "set_NewValue", "SocketOptionName", "11.0.0.0", "uH8r1cv2YgaV1g17FUJ", "QhN0Wo4cKZ", "E)SB$", "mgjsnviQXEbDkEeKi1M", "JjdC2iUZsl", "StartupNextInstanceEventHandler", "jIkqZoRD69rDHK4rfQ6", "EfvtU0GZHwCwKlJwSKVU", "DA0P5HPnN1EhnlwutbF", "FormClosingEventArgs", "IQO2o5TyYo7TcKiAt51", "qanCvQgkZlyBGJUe4bF", "bB(+M", "lMB5hg7LWo", "set_InitialDirectory", "gdelegate20_1", "GClass27", "qG!yX)S", "cOfyfCtGgP6Ya2nMAQv", "35fW9", "set_AutoFlush", "{ KI^3A", "Bf7dkv37bKNsd8ia6QB", "vHXvdnfiCc", "+8~qnf", "Exception", "iserverApp_0", "mkN4KCGblr2V8IndVWMT", "PGNrANuWwaQefC0cQIT", "}aD$'", "XKnvf44rDmYQbPL3f66", "GetFields", "rOhllB3xe1gIbVkLLJZ", "BFWegwiNWDor0EwLxXD", "nlmerKDE7Z", ".=aC-*7", "H#{\\WNv", "x7uyntKGX8", "qM1SXVGL3cPv4pygtC7f", "=q#&2", "2u@^<(", "LRXY58QkbQbEsTvgMY7", "my2louLY9BstUduSPL8", "E51IvIGGPfECB8Fdx4vJ", "f2trYCGKDymGhh9yXv3H", "SkfemukT1Ayn8WHVGPU", "GncQyCmdKy", "a09ZlGGfSD0Yw9yco6C5", "oNZ]ZJ", "GZ=_UZ", "set_Position", "tZ7ekcXcPw", "D33XamGynNXckmtVji5M", "pPVsg", "uymiadrYDvsXPDGjOlv", "a66EYBTCFXXELTht3lu", "QVnDxnGIO2sgwtvOqjKU", "NiBcBcM6F631ZRYoYmR", "|Vh{)", "eXGqfVIAyR", "hIqWrcbNxAInq6PKs8G", "2'i4m", "gsGIemdtPmu6SgdiPHp", ";:c~s", "dxhb5ptVSf", "vhrLkN8dqvh6nfoUg1K", "FileTransferRow", "s0j3vHspq", "-w/~G", "+=\\FDx|", "dC1USDHQnSfU5t3CyZp", "dateTime_2", "set_MaxLength", "set_RemoteEndPoint", "u}lO9", "KAg5MHaEJyx4FMJ23xE", "Ydp2KoGPwflhbekW4t4", "JDFZ6QeyVigHg1F75Ae", "dNY2JHnVM0ftSRnPuKa", "doEgnfKFtivKnH3N9f6", "x6ADieGCJCngEpEH8wiS", "uu7r4CG3eJHRjEFMOlfN", "K~E<(", "T7{I4", "JseulmhlFlhnGFTpDpK", "p9DE3", "Rr8SkitQWm", "lHZQV9Jffr", "K9nj2s", "o7cvdcp9qL5G0yuTuN7", "G2j70nuiwdmR6nZnkbV", "BinCnEGIuiYTQTpjXsdu", "uLLgkfGXfYRK3dTDGK36", "~})OD", "fmY7Ewg0wv74ItlNnti", "SizeF", "p4UCEfBIpZ", "YXCcxINZkDrrPEbmmWI", "GFaPVOGLMHFlQ0b4feDC", "hsfqiQGSlZIIqBNX8eD", "Q\\De8", "Label12", "eGYCYnGCO5oLBDD6dl1A", "kUDkf5PTYUsiI6lhVHC", "iMm5G27lNstR0aHbgbp", "AutoSaveSettings", "eHDam0GAcLDV9o2Ikqhy", "ImageCollection", "NwshqLZzlyBvN32KVGv", "EfNXawjeHbMPcqdJRoA", "Juz`6", "TransformFinalBlock", "NhgIfeOausrSFFeCQ78", "_Lambda$__62", "q3bINcNwNLjUlxLv1RJ", "cAhqyJIIOx", "YJgwZki1CL", "Zn-ASs=", "F0gezWV46R", "Y5P7TpDKBq9F5dyyJOb", "_Lambda$__46", "set_ServerCertificateValidationCallback", "nGdQl1orc7FlfCh2cx9", "get_UtcNow", "_A2W}", "]Dq&z", "pF8Qr03rEJT1EBD4cRg", "9>m@&V", "vcfUVbEyiRqhMjMaRRd", "g6LM2ZfvWil8NTNqfh1", "NnVYQ7IMK0Y1PC731aq", "UbRLwBIsvlVfQgxIhs5", "Equals", "SuppressFinalize", ")v:RQ", "GDelegate2", "aZ7eLMGNa6IlK7NbugqT", "CheckBox3", "2~P(S", "&k)#M", "a6Y1MdGb4iegRak45ohE", "gcMDPLGPYuKQJGGOPPEL", "NanoCore.ServerPluginHost.IServerNetworkHost.get_Listeners", "r6{t\\", "UhotijGybKsbQjf2kgd4", "algYrF6bXi", "_Lambda$__8", "GetSystemVersion", "*o>W)", ",x[9aac", "add_Closing", "|6`[=8", "Csfl9AaOti", "get_ModuleMemorySize", "W8l|w", "0d-!mkL", "V;vnmV", "iserverNetwork_0", "exxSwcAnEd", "pSEmbgNLfWlxE3LkImV", "s", "aTjvq3GhhPvwV5JUvo8n", "xncrZuwpgN", "pImkdaJOkJ6bynhnjIy", "q[S\"Xm6", "sdZn3OrVSvyvDrjaypi", "xXwDhMG4N0xMiksKBj52", "NEDhZUGhJOqWGf6S0Ckb", "G9MdXXq4", "GV53FUSTNZ2S99bb99i", "53X}sEE", "-C1v_@'", "*ItaT+", "umGdWe36JY", "TabPage4", "?w+j<", "wx2n8vuItZ", "3l<*R", "HMwVWn1RxTa9JH3ZAUQ", "LvYAEv5Fmn", "!0it\"", "ToolStripItemCollection", "iY5wWf2DA9qLLp4EVMJ", "gJ\"0d", "Je!UL", "sJHip4N3sTvbwo7bbV7", "tJ5lm4abFRjiSiXFGi2", "GVS7KoGewqfTHelcMmcZ", "IO?c %", "|,b|;", "ReadOnlyCollectionBase", "GCFn8EH3VE5GwYX3DJ2", "get_PortNumber", "6pl6V", "PaddingMode", "FSBNRs01UXgxc7mSUZq", "n6FnWC7Hvw9qt7sdBXO", "QXCnRA8XjjuqiIrwAok", "S9lIoCGwnC2SFwfyW0Dj", "oDYo'", "_0/)g", "V8MrmrBUqv", "%YN;|", "tU62lXWMi", "`YI?)", "LwKR6fR6GW", "dZOxRSGgdnBAI800nYC6", "\"BrD9$", "nNqBI", "meCel0CF3E", "*K%\",p", "UccxqmjT8", "params", "I5SqXQWMdRpjebOLV1Y", "jxqQRSDlOK8UBcEmiJG", "2mqd`", "VgV;*", "set_AutoSize", "LH7l6DpTiKd5PNFPw1A", "[W;xZ,N", "Snhm}", "HMPB3JdbKJ", "r0MbLl3Dlu", "Okqe6opyYu", "U[ui8", "j@4]R", "nojTKkCaUt", "@\"A\\AoA", "ku8Lm", "LgY2eCykiSqmxn2w3F4", "iFaGij1yVmgRLDuGg9G", "Lr16W1wvOKScaycMA4X", "SaBSYlf6GfZ8xCUM27h", "RemoveRange", "ToShortDateString", "aj5UpkqXkiFC26l8WeB", "Ne0WKBGK3kUeETLbENDG", "Z9r(f6", "W8lHe", "b]9U8t", "frc3V5GbtmmP5jiEsRfQ", "op_LessThan", " 9I\\7", "W-_d;", "xEWVpInZA15OQ4SEl5p", "Microsoft.Win32", "kWtNeQGbea4OqagEoFBZ", "eUkoYeR7Orw58XhMrQZ", "set_BackColor", "ql3HPBHSrZTnuFEKiv3", "v26qtHOKW0", "g6spLuGYjldwZl51YCwU", "+qb0B}'", "=A}mKv", "qYnX5TIQhEJTqNgAZ9K", "!S[Wck", "rJk0vbOVhYhWIEXPQm2", "=L :kCE", "ACuHF0(>h", "FindFileTransfer", "ydZ;~", "Nv3uWDEzFbpEWSf8IZ5", "defaultInstance", "Mw4elgsoRamoXk0ft9y", "a36bTEL4jg", "mKQ4lxGYZxmfdfSnswAK", "Gt1yyYxRrvkLhpllmEy", "Qluq5oQvHX", "xnCx7nGRvgTmjcAApB3j", "dDisq5GeWwRjALOA2tVQ", "qhpNj82wN8", "x!LWo", "pAu4MITkcoID9sGOxaF", "a6HIe4GxUniXcoO0CA6j", "iQ1XOov6y9cARWi7kQ8", "ToUShort", "CryptoStream", "NPs.b", "zCDjDDPfc0", "hpUr5MGhe8xyac2nrE9", "FileAccess", "WdhDr4GruPMc8oImi9Se", "E5FDkXrR4q", "DatabaseExists", "PluginViewer", "FKykGbGCSaslFfMcXjIV", "QcUdwfouuGPKf1HkdQA", "D97XDgEQ0R01flJ7mbR", "YQHpx5GyFMKFddCZpEmu", "oiBOpaPOC34J7pRooJo", "wlIWL2UqxkuhGvW3J8X", "{[9[I?Z", "[g)S<", "SimpleNavigator1", "QVKlsO6PVT", "get_LinkText", "gJQtRKGLq2WCiUqUOKTi", "jKXCkHR0n8", "u7wNL1GGUKQSKnMYKaKu", "e~wIU", "ItemCheckedEventArgs", "wd0H27GRWR387ijqCP6U", "zhZ3xpfnLCFQFYQP21I", "T\\`zD", "$\"*p\"", "aHmYULOxP3wlrJZA5rN", "adQHt47nZqjHrE1kste", "]L`%%k", "ieA7oLOpCE76Qsfuqij", "get_BaseStream", "VUW@%", "B9dxahhTiFZMRoUPyeV", "JeEyrSiMy7", "MpFxusuJVV", "GeneratedCodeAttribute", "KL8C9NGXKQWYu7R3UOyM", "#!hYa", "H217N5GhLH8T7VFLk3NQ", "PbQvoJl0he9cmCk9YRW", "PWSdbbGllpA7VyrGZM4V", "%{`Vdv", "28#VeI", "B_r;[", "yWxCDJVgkwIcMyRAMvr", "cp3xWGOaRg", "deXkGQGRxNxxQID8T1vL", "k0a8Fdrt3rRfe0orhhE", "Xbw0vMGCfxnwAo5X6YAc", "DGcqOy2WUU8KD41C4FQ", "OpZegZOel2", "op_Subtraction", "O0Fk2XI1DKI0Kll3yCN", "TuyLbv2qPY6QOTLRjGS", "]%7 x", "Q7WUGtG4JfuRCOekARAL", ";MT#n", "zorE2FGeTmDbpdXSrYRY", "dictionary_1", "jsC}3[y", "H44qjuFSXK", "&BBa&J", "a3h3qWGRVpr5KoumHxRV", "M7hlzQZcSr", "]~\"w\"", "xKQvhYQWSj", "DJaWrxOoMF93yX3VKFE", "Rlg0Ei2rho7OZbWHtRQ", "Y4O936GYRQLIW8tAJ98Y", "9>GR", "uWc7aDGyCVTw3p379CnT", ",6/OG!", "gclass22_0", "Al!-G", "uA/89s", "BYsBWTGxQGkm50ySZCy3", "WDxg4PDthd8KUEbQ5U8", "S8VoosxfT8", "h#c6\"", "WNAijPH5BA", "HNkJ5kGwCbaPSiJYbONx", "lj5QBmNxXI", "dvAwH5TfmV", "Dn+[L", "d_m,Q", "X1VppxGIfGq75ImUpJ6l", "|&aE3S", "DragEventArgs", "WOeQa80pgq", "LH2nQt2fV1", "7vWT0&", "PeoidcX1wX", "BxM4+87", "y( v:?", "rYVMTjGRr2ntwodKxXr0", "mvaoreGR7dgkvKhvWYgD", "[CN\\l~%", "OtE0bkv71a70ORqmTu1", "tEWxkpkulRbeE6W4TrA", "4XcyQ", "lI7dLab3ST", "]Ml ,cx", "H[p]s\\", "M3R0iqhNXPsVkcuvWyj", "dinqvE6VbNnwVidbgIM", "zFCPkyk6RW", "BJ8mhmFeYj1cZ2wYxjI", "V92n,+h7.;", "set_PixelOffsetMode", "8sLYx64V", "QahO87LvRZGTH8KPJI", "Qq5-q", "Operators", "FromStream", "JZ3", "3BR3;", "XQAZJdPo1yGqwKVEQr0", "ToolStripItem", "wJ0O4OzL2V1ysNqL4Da", "\"gcsB", "Pj1wrDaRhe", "kw143TxQl98SQOUmBbF", "VA9jfGLdv2Jgvp9sET7", "nNvvXZI07t", "UPdI9QGguZ1okvQclGhw", "IDisposable", "oO1eo0ZhYQm5QxjSjB", "VBPTsePIoEHML9uqpsx", "sbkYa3GRfwk0MxU4u6aD", "SB97fEGZGxm8PWDBM6Sv", "sjKtjXG8uHQmXAZdvftC", ">zN3.ae\\2'", "-u7yk(a.", "DuCRtk2cptLRmrUiuu4", "QIfKBRGIHc4kyGX6IL7D", "NNIcpgmrALO96nxivdN", "WriteLine", "rp1frDOQOKVtqTN09F8", "qiym2PGIUvkjamdIhchR", "H0xsiYXYlFmtl7uJfN", "WpAskmgMGLwNq8e8Hlq", "IVk+z-", "SlQi4T4hDd", "nyNvF5UFCL", "SHamQPlSQLJae1dehd8", "Hxbl8EkASG", "Han1Q3AWbI", "EwkNwaOdrK", "WilUgspG21eP2cVtYy7", "J0anjXRoJc", "gclass15_0", "C=ab2", "HeHZEMUbxpp0gema1Cr", "CALQYZhMbX", "Fg8JpvxQQW", "tT9A0wBwNT", "Q05wXQ3aFStFsMFvWHf", "method_14", " ", "]\\6 j9|", "mx3nl5SAT3", ">gIWb", "QwUs0Yp2ANruWydpwyy", "aQ|xr", "whvaMhEBQ71cTHLn2ve", "hjLsMIBSvwfMBxAt0q3", "V)GE >O", "UInt16", ".EL*R", "MCo9kIl7iFmUhaZRrd8", "get_Status", "Ejq8 ", "Kvq6CcGEtQLxJdxloFVx", "ContextMenuStrip", "jAOqakrhOgGSSQRZuh6", "JoiTRxnoSm", "FormWindowState", "e2WQuEgpCktGxyqpsxP", "sPU5oW3EO2", "QX6FVvboSMJCXnkKXo", "RkjhHjGepLMgu5BkYef", "Yxko9", "~wm{J", "LV_GROUP", "Dm1Ektb2mo6EGTgqxl3", "HjHY8cvqP8", "h*o$D", "ItemCheckEventArgs", "JReV7UGRcqiteG7TGVXs", "z5PStoTfsuZbPvnUowF", "SWGFeBwI7qPgn1TGX7Y", "uuFlj9QSuKDRGKFGQXB", "hpmVpSShoqGtRQnW62x", "U3IiE2QiTpg13ceBV1Y", "ProcessModuleCollection", "M4PRWAGEEm7xNviLTCuA", "add_ItemDrag", "r^K\"8G", "sALRPfPOoQ", "rNxAm1PgXh", "nF9g(", "Le>8h", "Tk0ZhiDvqv8plxp8agj", "rJ9yYZGXk6h4ew690QAD", "$$method0x600002a-1", "O7s2RcVXC3XqrB6C6wa", "pIRvmJGNfx5QTO384jEo", "ht9;", "KXbmGKWcZJVMXtlUMc3", "\"x#Dy", "lAtfocGmdtLpy4a5hpAP", "wu,b|#", "kgI7qSIJbyUCRIPywOS", "SyQB\"", "ContainsKey", "T6|", "get_NewDisplayIndex", "wML9H7rDNsKEGoThgsu", "XTlPDTH1ZGxu01jqC3J", "cdBMBpvsh8KGQTN5dkR", "']aZ[B-", "asqH2qGGSk90PMfMkl3M", "_Lambda$__25", "( > O", "pbnKgx9bqq1MsI9vgZ7", "AMapC", "Transmission", "YOqJhhUSC2", "eljqSAGYiQLISFcOtsLC", "CGtlCUkNKVFwyd8U2eh", "JOj6h=*", "'8o\\jx^", "IndexOfKey", "iZqQVHGP1HhTp6I5HYFb", "dS6j3cG8WIexXOPsRaob", "aecZfSLAAvfsZAdgrFC", "nFliOV6uD3IS5p9mljG", "svH7QVxFRhgppaBJmQE", "cTPyZhG4aH193W8oJu7C", "qH3JMp8G8XMAlAmseCH", "CIEjiGhhRYvMhkRKyYX", "NanoCore.ServerPluginHost.IServerNetworkHost.EnableListener", "QaX9XhMEEbwNYX1BoBd", "JIpjfMGVtPNll2ghZDRU", "JpNlvufrjuKGEbdcOBU", "rgNg1x45hOMR82TLIrj", "MMJubEGE4Z8L5e4mYXOH", "Dnf0X7lok6", "d+<0E", "aDFoJeypph97vbTMmJt", "sc21hWRL8ac3MGYc04J", "WaNcJNSYuI46GQUHACp", "Qusl0IbEbN", "trMfJvF03DHIMpMCDEu", "UP30H2GRpEkV0iLjUE7l", "BTOrG03fMV", "kaA_E", "T(\\1|", "MTBBnD4d2A", "AssemblyProductAttribute", "hP1dMp40aV", "get_Length", "LYvxzE5PHd", "yxMCyFGLWInoQovUZ67V", "ugEEJubutK9EUew9dl", "h}PYWo.", "kL6s5eAFjgKtMHQKeXE", "N9fr9Cv0fO", "pyx6BwGK2FaJ2BO86P1r", "D7xBRBGZtY5ASkDuTbJN", "get_Panel2", "M*J:l", "YW1gMDdcv9Go6AQ24ux", "@d*c=4p", "FileInfo", "add_StartupNextInstance", "EhpJPKGVI5fNJ3XnaQce", "\"g\\:~y", "p9tAhQGKnyRwhG9MyCAr", "h\\2<\"g", "gclass8_1", "mLZOrcl5MWPsSdvYxWL", "O71JvOGVXu26faIBNKhD", "yJG4G1GxehkqpiFcAadI", "ConstructorInfo", "EWPYHSoPCdP26hw7s18", "IEDfnW6E4obF6QIKInL", "iB=u9", "Change", "XP^{5", "\"iPkx6?", "_Lambda$__34", "w6bNioNKuHQWtYJk54e", "kmFvWHP8e4", "Pla8cWGPl8vSJDrSffyd", "kEM=c", "ColumnHeader12", "DAfUgt6IFcauQmaExMa", "MessageBoxButtons", "TFKVqj0ndGkvJMeWDHq", "XFhYWJGEr4JUZq5RX4sY", "W6wH4dinuxP9keXVfSG", "Vq5WOTGMDuaQUDCTIrYr", "RRDQWxGklImtwVHSXZHv", "LBIEG7G4S4EyW3vlKAEy", "lGMni7ayZKuDWfYj76N", "vGKM1TpeAZWWPaP4HUM", "Qo9ipGWrtX", "eal1jVGgTtXj2GtYEUKm", "oNMqnLw02heOiReDS8c", "SBfoUiGCKu", "jI%):", "CornerChanged", ":'9", "S4dvIkG4F9L7VHK1rF1h", "H8qAqZtwjfE2ktNhYk7", "nthvCBqDX2", "'>O=`a", "yeZsthFm6TR1ByQsKc3", "Chg4nTGpEmPLPcsB0Un", "'w4)h", "TryParse", "XxQcjf", "Height", "address", "P\\%\\m", "VwrRAxvNCNV1n4cqaNL", "ex7Nd46tyT", "eCLQHPW1t4afOgkJdSh", "Microsoft.VisualBasic.ApplicationServices", "qk1PaKOpFB", "tc0vA03Ixs", "E3eeUCxJE3", "IRKCXfO4u6ZA2b03NkG", "xMvYh9ySbM6pcymPpCj", ")Bc, ", "5_BHX", ".A4T|d", "GghBwMHr9tSA5qrYhNJ", "yY{e]", "kOrSH`", "puwf,", "QonDnYwqjPD3nCG8t6T", "4Cu\\J", "KthqaxRi1gD3xAJyrZ1", "_Lambda$__12", "Lfmbv5Zrx39uDnn6lTY", "add_ResourceResolve", "UUvn30aMvqxtd0CYrF9", "BWkf$", "PwS5y0GKPxZ1LQvUY4aJ", "BPa2HB", "in7P5EGHow2N6038Ic2", "fvYlhJ6R8T", "NJP5D0evh6", "sO/Ud", "rJVsd0TVR7DRx1Bu4Q", "h ^z>", "Random", "kllaTVKzOhJCqtkgDVT", "BytesPerSecond", "{iwT8j", "htYXbuSx0rgOMGvdMA1", "SdWkN0G812hnEGKnKA4D", "JXjHdEfY84A6LIVGT9a", "message", "sUaSF9GgsWS5jFiyPqrI", "&Y5O'qE", "panel_1", "JAqfT47kN7FLbkYuQdr", "`e?LH;W", "NumericUpDown3", "ODhnDLGsiGJ0anjhqhY", "hOlii", "_Lambda$__56", "rH2RQVHC4J", "VdIpXIaR896Uv8FF89", "K6hsVtGeSQ2dmbW31aKL", "Xo6HMScYOVCY62iG5sZ", "XM4Mu6GycCm9MNBom5bU", "System.Text", "U8Sw6qGyPpdB8o72A6bo", "U", "GetFileName", "u4nVbiGyY7oKXbD3A7Gt", "set_UserControl", "rWZjDFskkVNkBPKuOAx", "g)FkC", "CbdYg6Q9XoGTRVpA0D7", "iEpQ3lNCbw3OSDBCWWr", "M_T>Q", "method_21", "MB8wc4Efdj", "n75KdFGZpRZcnBeXQHPI", "mwaQJlFjkb", "PUyyPCNYR8", "^f<%`(", "mCNdF7GLlucTZ8A9uYiG", "M[uulu", "XhQPXQbGjRZt7tuJQSQ", "TKLrSiFW5a", "h4r%D", "GhIRSbZZpU", "i1ZwBCGxyhQGsRrKiQcG", "_nfWp", "YXxjEe8lgvqXIFXiVvT", "add_Completed", "GItpy4GX0mT1Wshm04aH", "Xm@BI0", "i2AYZZsH87", "WhTvi5yesrqkPcQKejp", "hfK5N6GeqyqRv0FjR5JB", "n3kr5eGh8ayYqcB7g7rP", "&Aa)5", "(&I^4", "KcAjsN4esx", "controlEventArgs_0", "V-enT", "AssemblyBuilderSettingsControl", "Rv7qG2RndhQZ0uycu3O", "YCpEqmGACiB5m1N5JKll", "SBUl%", "LGo7ZATHP1p76B6h7PX", "TabPageCollection", "ueajtAwLq6", "E7Y01V7iJyO2TtaRZIm", "J\"s](8J", "FvXomuAN5yVn0U0mMlq", "mqFsGcfON6jDtNZjhnO", "VqqZonGfwQ9dDMMJistX", "gXrH8ptq9oAh55h7117", "hKavJ8GNl8ZvIy98Popb", "GQC-[", "pUQX17FaRbrekadgqTl", "Lfx0q5NkQA", "eXYFV3", "tcnH07kU64HVUP63xbp", "DPrugGGmXr8kMdYx7Ddf", "MemberInfo", "P[D%}", ":G:Htc", "QejTFSi5we", "J8HSj7xH6n8hgDrw4UV", "NBJWSdGEG3Q8e6RmpXWl", "JW6DlZ5ISddurB6fnRW", "CwsyZhGI88K1iDglLBSR", "HwmnB3", "lGnxCAM4pl", "Okm6?T67", "ltI38nhCMkex9xeNT4m", "ProductVersion", "MXdo75iCTuegxUeXJer", "DNCq9AwDP1872lgB7CY", "IwZQt200hJ", "G3mrPxPFE950vwAJ2Yw", "DebuggerDisplayAttribute", "dElPT3GgAA", "KCGiwhEkpBQ1O7GUgrK", "D0ehTeGNeObRPwmNvAv1", "'^l55", "5M\"=v", "gTP3kSGmKgxHJ9vp5ufN", "E5HKXRVvblfoKZ1ywUH", "SxsJHkHqxX", "rfl3Y2clJZmFEEuVcS6", "D1AxXWj0quXYaihKKu", "R5D55ohPy5tFWLAwU4H", "L:RIXw", "ColumnHeader", "Socket", "z:?%:", "ColorBlend", "Uf1h4pqAj7QO0k3HmLE", "LogViewerForm", "remFtr8zpl1BU8sjCiu", "StartupNextInstanceEventArgs", "4%f VR", "z$g @", "JBZd9CQIXl", "AR4XtqqxAPFUxhmjyvZ", "du1oct0uRJ4drVpEDZ3", "HdRvUEGbcinRKBwUFjFQ", "AyRPOofAuvbgrv8epXt", "xxbgsjGnnnr371lxmnTi", "T06HJDGXSllIhWTKFjr4", "45(~\"%HF", "U6OB06", "IXLmdajTG6uoFwIQlvy", "c", "lmJJnwlnqSkNr0S4xc", "Split", "IPl4pWSX8lt5vmikIR1", "%@|i#", "UWD6eKb3ZsQ9kbEuyDc", "dg0iIngW4X", "HYsMHLr7dsdeyEExKbS", "cdcQXs9mGp", "rs048pgQ3Do4GgfJZSp", "nV|1<", "iHa5mEf3pSAgF2O90LE", "Oo02<3", "*AEq6", "XxFAdgKIoduhGOR0lA", "contextMenuStrip_1", "OeATZCF1SmX2jWFM3fR", "SS1oZd026ssKwrJgVmZ", "uxXkx8GGJWbafwZRkaEP", "gWr5q6CWQhUh7v4pfL", "WScaaGGXA6HeitYvjR5y", "g@aOr", "I|s\\|", "Process", "2IkPV", "get_ServerCertificateValidationCallback", "gsNLPoatCQEeBlD6whH", "EVu58Ps3El", "EoJKHCG8A75GOBvOvWIX", "b`>&J", "Xm653HMg0j", "uvV1YEh0PITkJCkKo2", "dbov51GgCp3kUDcVpE8G", ";0el:=", "|2q0:", "_,?!F", "Jq5bnQHwkk", "pqAqAy69h3Wxp3yCgGQ", "MXCXDoGyNfNh4hJsptyS", "System", "get_ExceptionObject", "NKwL3c2wlZYh5f3qrKg", "g4vWhkwlo1HHuM2Bjd7", "Fs$W1q", "nL6qp", "\"C@u4", "kjcjGIweiyUkb5962Gd", "#GUlD", "Q23TagoQlDneAW7vLjh", "ik5N4JGxbVfX8rJbyV0D", "klFxwdR0VZ", "Aa5g8eGRZhhuJ3M3JYt1", "mSlpEkMKiJ93U76lEqa", "haAnCkGyKYFbFsqclx7h", "kMsgQl", "Y+0~/", "PRY2OEdepIBUZ", "D6u1NvX7qhFei63O3vj", "Gi2bvOQ0so", "fYHSJsGrPGI2YoGHpqOa", "set_Bounds", "nBeFs2ODcunOFPGAmqS", "h4Om6qG8cIgBZifunFEQ", "SioPh", "chaRKABTCy", "E5jdNJne9F", "JjXNX", "s8xi1sKqQB", "FD/c(c", "HXlY9", "NJd0rgRFgkE2iZaElix", "QmJgnA8wmqseWwPHZyj", "wVNHyI5OFpfN3HUEO5f", "fVK1Fq07lAAagoNrbr6", "rDjbRyGAtKGoUtHIniKe", "qC~~{", "e-\"}Q", "hIBYe7Xp9wJ6rIO3CIs", "w5iiDPM2sW", "TmciM", "IconDir", "mo7rMoR0ay", "Fq46WZxu1Ne2YNIWt5t", "set_ShowCheckMargin", "ERPT7lDEQ9", "get_Goldenrod", "_Lambda$__82", "abFShMG4di", "W4ihGMxGf6wXrGKiw6S", "DmjJO9D6nD", "PMTIqNsf9ylw1dYFM6o", "p08icjMJhiXPkvjgyZe", "TabPage", "vMAB9ghsbC", "z69hD0Ypti", "lXSdekaFxN", "SetSocketOption", "JGyjx0JxsT", "tajY9OWNMa", "OnMouseWheel", "0Z~Duo", "1f-mB", "SJ}C1t", "dQq1Cx1VbcYWHUehew.artNy78tGiZRfZXjIU", "rC,z9", "On8oItnaQwa6XIqWJHK", "g7Pprq", "hpDAyTFUKXmHWE5r2jp", "r3qkDZ2x3c2BjlKy5Qy", "5\"098=D", "0Eo8JkY", "C6US1rgMcN", "8KMC$", "Nl4RJrjZhd", "XKRxxvCNXq", "[2L;D/", "u8q2ncGrVexe4FsAUKFR", "cabCGPGnRAEPHdNeF8kp", "VfUA5H", "UrjndZ85AAesq1q5NcZ", "fnJN13hIY10B1UQ8mQ", "System.Collections.Generic", "response", "rHGZcoXG6mRmRV0Iw0W", "@{{wx}", "ehNqYZfqIyhCksj1iIK", "WlGEDV7CkbcjruuCekA", "9Z?t(a", "VZ90GYOteVCjhjJJGxN", "Ay)+;", "VJmTdqoLQ2", "Dbmjy9lvmg", "gclass25_0", "FkPv4bXSEc3vI2JJZBq", "set_Multiline", "dclXPfaIdNEFBwJZNPW", "7#qr-", "jN9FCBOBfm1ZfxhIdX5", "uF7H7cvIYR8pIwPcvT6", "set_Dock", "GroupIconDirEntry", "TjDq6YbvZp", "get_Disposing", "KQLCyuJtfU", "qdYU1", "YMjeTtKkOjmn0Cgq0hm", "Persistent", "ITtfXIACeKim0Qcy4vh", "C2cr6BaeW1ASX7WrdYv", "GO7i3O8MLx", "RqOiL1mrH4", "sxpZSMV7hD1uG8VEEW", "x6j6FsU4ARKefvjGtOm", "zWg1u3Yci3", "ShowWindow", ";'N(n", "SQjYlsQKfSipfJXUU8u", "aop0i0GROqMde8NrIbxP", "ns2wjdHyiF8Je7NUHDH", ";i&~3-", "RAqt7Je8xatsQTQG78w", "JTk?S", "CUAjL8gziEHKU11MH8N", "dhQwYy8LnSPE2ZvgGHj", "aLceVG1mLm", "FEjtO0GRHTvhhJJvXQi0", "uhxwOSeRDm", "HIRARZToXb", "+D8Ay", "2]!H0", "USt,Bq", "JxAr2IuElH", "wrEHqEkR2IXq5WH0pfF", "lRB5CibjVWvAW8vJlp5", "KUAeiMOV5HTfj8mbf4", "w93qHyZZOK", "kajsdEFFZU3g2smjn15", "*)#d@", "UV19Qn3EUwHBtuQvRLM", "GetHINSTANCE", "iyXr0Rc77u", "GetExecutingAssembly", "l7cgZ", "fgHqIVNRgt", "5CO($", "BeginUpdateResource", "_{Miw", "SuspendLayout", "", "Delegate1", "tiU7KUGCuKQQHQf4lXa9", "ov091ITSVNaJ9PseJEB", "EGsqbS5RnY", ".zraji", "dR2oQseini", "sGv0JvCU6C", "hMXhGkWtBiPhUOgjGyD", "4ZFpr", "RlGoGOGXWconhbGAl8Qd", "prZ>52", "1l7:IT", "EscapeSQLParam", "aMmssFG8GnKXxJk8u0EV", "c!NtL", "WY7aa9PfsA9LMps3p0R", "set_SelectionLength", "kDyr5YflfV", "RSiTLuemhR", "DEgwNFGnZ9W9Iw9aEjSR", "@s$-VM", "ColumnHeader3", "aX>]Q", "hBBeIlN93RcG0efIlre", "ST&Vo", "vZ`c|\"", "c79VuszhXslBx7oD5La", "PLfDo5bweX", "#\\pdl", "L82F6AGCyTcV1jQW9wwV", "LiX", "auSadoVA3xyA9BaRC58", "BwktDWsJI0SrtMmMTV5", "%n>M_", " ~?d]", ">qQUAAG3", "mtH0tKunmxjtd9KxVlU", "zuqCehEnIp", "w7HYPVrWsqDIcyS4Kag", "[}&l>|i", "UEGK5a6oSr0V6WAILwH", "ydZ7Ni3Pph53ouOFX12", "I5ktWk0SeobMNNCCiKM", "|ct}[", "WCvxNCn0wstgFF4iZt5", "NavigationControl1", ":T^AumU", "a5uFkyAxKnNMSpPCKea", "ListView1", "get_Y", "GetManifestResourceNames", "KZkUbKN", "mZEbEGXJqU", "xq4bWYQNIA", "LUEcOOGGwZp6ooEi17GP", "av`|3i+{", "aPbVou9PC00LwlhAbeS", "ATIRHbB9LL", "hQnL6MGLGRX2Mx5YZjnK", "opvwQ9oyMC", "KrWGNXoJQFl8Zqb8bj7", "aGt17tGVPIBB7skmF0Kn", "add_ItemCheck", "D5o6XXyvrXQ5NpcGy0Q", "tabEntry", "Jokv2irXVh", "+^:f\"8", "oKydZYFocP", "tKKwXAyCS3GVeSZqyS9", "NFRd51RUdM", "HQyrBAyBdk", "_y!l U", "ReadProcessMemory", "SNSUJtPxk1ubvnufaC", "q9bkB", "RICcVMxtQ48nBtr65c", "USFIwNmh3PYJ7lvUAwR", "TYKdMmiL9xXZEH6fKas", "FyFYkbFIMQ3CY7IKeZl", "s3GYRfRSdbBdRjArcYk", "FWyYRXqI4kpelyCuroC", "JiqUbQGXjtv2uaq41it1", "PQywraGM8LpgtNLjcSHL", "ON_HP", "zfdNT3s4F5", "tJZA<", "vHD", "lgU\\h", "UUWn6WGKBNjGDYSnLNaV", "gphQ5WI7fr", "M1XMDKUHfk68vUlf9YG", "p8xvHWauyAXteW4JwrQ", "zq3ylF7AcO", "tSpPE7GGkoTi8n8C8bSw", "vG)c{;)", "eXeVPH534", "jkPoxvjhuX", "sQUIfVG34hCNHUW5e9C6", "Synchronized", "get_Checked", "lndv9WF", "olH0zQPBvC", "F0f3Rd6KUOy0dOC9TB", "YWDKJ", "set_MinimizeBox", "AHmOkM9oNuEiklEhyL0", "pmF0btqjr62223pCF5W", "RahmoHGhKPuJpu7MU8WT", "6&5sJ", "set_SizeMode", "wE7SeYFBD4", "GGgifqpqvq9XLyTZCDt", "OWrkf3IuxLYTfjLMkb4", "$k*C:", "yn>zk", "hhxOvl71uZ", "HOEjVYg3TSOidV2Dgtu", "G2PDf1uCWdE7L5nlddL", "oBTiCrFsLZ0O3UcamOK", "kf3YAwYuJiH9ItnTDh", "rlJeAEakvGTylJNaoJw", "eGXAYsGA8xGe7cvAlOHP", "tRcRlh7S50", "j3idq0Ykq3iJnKXdD00", "LtOOwFdyJo", "UkT42i64F9bGeqvxt5k", "PaintEventArgs", "lz=`{", "cagd07GlznrYJRJGGcvS", "C2gRcNItsaIXdHJUo44", "Write", "zcfk6rGA7kwwPO4xYW1a", "MG6Wv02OukyB7b9nHmQ", "Rxa6Q{VL", "nis88hIgKWySWVBhZtX", "set_ShowIcon", "yb0yVCJUmh", "/wzzV", "PC01Hn1MMk", "1{\"*b0Y}g", "wGEKwMrlCgwmrMRM5WQ", "M^c|f;->", "TabControlAction", "rNue1", "AuWONubaW1kOhfAJGIe", "AddSeconds", "vOYYhBGAG2o2pdfn5La3", "oE9GLAQWnaiGYib26oK", "2O4d/", "kS\\ES#", "xPH7jWJDUA7u56LsYFF", "aCu3t5oleTIG8tdRYqN", "vKe8irGmQcOuxa6KdcJR", "DQkxQiP6ETYidxjXf5W", "ntRTPEQziSVpbB86yUs", "ArJqkmGYvqk59fNXiXOP", "CfKyKqkPnHsBOOAWMDO", "Qe7xj1Ojw7", "za1xyEQhUw", "BXSgPDLqu", "ED4|(", "NCgRHjYB2P8TkJYFgdk", "SX2t7YGCD16EqU4duVgY", "^CB^.", "eTEmutDB8Wol8fjr9qM", "iOtSqBRvDKFZyHQuD1r", "z1njCU78hg", "il936", "ipBiSegIrv", "yI`J9f", "j\\<=~4", "dB2uH7U6TUyoiByonD", "fBO6fHFQI", "HfdW6RGm0GZhwjbcy3KP", "3HQ{b", "PNKQFvBDOk", "ControlStyles", "qAV6GL4EsO", "sVT,]", "GviHT", "WBhvH4MVan", "xDEcnhznBdlPvSpAa9d", "PqJII", "d`pa:(c", "~Lpy2", "b[V5a", "Hrb8E0HDhXp3QY168Oe", "comboBox_2", "*Ti'{B", "LllabcGIGPYvaYpj4A2j", "dZDh4EeIu7HcWBSd8Cd", "Dd6iCp54ZUAmDIkCpuw", "muk~2EMT", "LTI7ZmVG2nnAhNasBrw", "VA@_I", "R52X8)", "tikZPxApDUJmlQh2o8Z", "_CorExeMain", "Label", "dkG**", "mxhlehAHxUGXCsesEyr", "/!If{J", "kYKYGR2fTM", "GDelegate15", ",?AMb", "7E4|Wo", "zoe8OuGeZOEDDerd8pAg", "LwLc75X908FEroFfpN2", "XUhGuRX2cE6AX1mxpw5", "* `a0", "}p!:o", "CMbAhIGChXagvk2MeEHF", "~,iekv\"", "oMUddgROvOreVhU961b", "}rex_", "ERjKXjGYkSmyXa0Z88rl", "/z=OL", "YUlL7NGhTpUl1AGJroWc", "YnRqZEGRIgt3dSufGNka", "LwDjH", "XU1IFwGhaAY7fcpksbig", "UJUMiBGYBfY0ONuOdHy", "dMkyiSdB1w", "PVc902dO8igS2jTCbjD", "{294_", "UZMLUfZDOMwjL7h3tWF", "ChashcEH1QCoFOpklV7", "nQU49WGRdUfq4sY1xh3e", "hjRlriwnWX", "o1ovzHxo7X", "BS6iyqrQnBwtKsRkpMj", "RuntimeHelpers", "$lgpF", "dgYIDnUjwYoBxwbHtkY", "jGhOKSGV8CDiPteQCGGe", "NQU", "!XRex", "ZPg1W", "PA5V9sGKkZwcIiFgdTB7", "Z#W[x", "CZpR9dauXP", "g&&$h", "X\"XI]", "]i]|*w", "N6Gre^v\"", "oCPBr", "A7uApNGYuDAsdB1kdPIO", "IXYrOkGGV4GxhHTfLg5r", "tmgv5OSy5pnwfjmbakD", "V6jiPeGxYRqiR3nDFJSL", "d2GQVlGhYuPaQNtWqlo0", "l]YP3", "cbB?Q", "toolStripItemImageRenderEventArgs_0", "B3aKHQGLOGLMwW7OmtO", "HostData", "}1=*E", "nJ8CpQ2WUG", "ColumnEntry", "Rfhn M", "Ace5AHIm0k", "A\"@'g%", "qfpOpr8aSH", "x1obkKGghknbaO9Pd6hU", "JRVp0FxadAnJwvMXJZh", "W80V2JtQkxWxd0G1ngT", "#cAIH", "RRrwu4rS3B", "cICCqtavR4V3m0KxP5Q", ",MHp!", "vWWIRq3M7rma96KCCc2", "eYXBT0Uqkl", "ToolStripProfessionalRenderer", "IWcmMGiRHDcrwYPlA48", "remove_Opening", "AgFV3KYNRDbALANKx8w", "vTqpFLGYSmE1JwXChxDV", "BFSppPyK785Qc01WC1I", "get_MenuItemBorder", "cdpleP7IOyv04BCJmi", "y7jqpdQkvl", "VLgSuaJdgyqJG1j80wO", "SystemIcons", "Jj712GHauSQnZEtNNIs", "get_State", "yhyLLOojsgjPEpPOVWm", "dtP68qGhZ8dFiN0TThwH", "DPErljGfuXEr6Di7nVPK", "xkOH~", "columnClickEventArgs_0", "get_GrayText", "x=b/+", "Ysp4hxY2l9nJ0e9moY7", "wi8c48q9BGI6kkLXdMf", "rcEVqFGKJWEfZVKQbxPO", "J1jwxkZbQUPDSWS6LUW", "aGLqLSSzm4hQInNqcCY", "PpJTNlfEeA", "lJk51mmYmp", "2?zb:", "InR8Cs", "ij9vhSGEWpdwrn8ocVRM", "ValidateSource", "ldqjZKGYKhV5fJlDBp5P", "eTTitCGC6RuUEeEkNXjl", "=nGsP", "eOnBokGCXvF9lXItDKgS", "=M6f|S", "GiIuRoxy5th9Hwgo7yV", "WNPOHswtCOibZUdDRrA", "BwTXafo1KFxLFLKkNKc", "CQZzs", "+ Et}", "'sstH", "CO4YNE35ncyKKaxgOPs", "&k!o~", "Ep65MgDY3s1uDopLK91", "textBox_2", "OxG5]", "9>=PI<", "uf5qD2UVuP", "ToByte", "F{}c\\", "Op5I4Iwch6MXDT2UPJH", "3dh>c", "rUiDdSGYyS2Q0V1heN3I", "c1sd2MwWqZr6kyZCNba", "zQ>Z?", "h6KUJQR4yxfOm6hY5yr", "B2OJq0crR2", "rgP5K9ccr6jmbilwkqj", "C2pXUASDLffM5FfYIMq", "sp7ZAXi1pBTdRnYVxJO", "w9kQAxGYm02Ys7IXp9OZ", "oSh0ZXGPd1H8VpVH6m6V", "&CVe\"t(", "cd5t>P", "SN2HS7GMr9mME5Y5rgc4", "Rg1nZg9JNZi0b0Km0mn", "vrBuY7GPF8rqIaJEMvP5", "VlZnDI28I3JB2GRY0XT", "1B62H", "vE{{O", "QUcCgSqPRg", "FileTransferStatus", "ColumnWidthChangingEventHandler", "s9lbc4e3sH", "rVQmKr", "Q\"#.]", "gclass22_1", "get_GetCheckStateCallback", "='Se0SE:", "gVBg19GLmZvebt35tLdD", "OqijmLvXd", "kGudUoKHY6VGY0rv2Gc", "add_FormClosing", "qZU9ZQrmvmun1DmxBZL", "ParameterInfo", "uXuDFk2WCa", "get_White", "OQnufSBNd1yE5VEDH6s", "fpZOVZ0dVn9JugS46p7", ">w+2J", "viHuVotkbNcJNKHQOxu", "hacKVE8FMjvkYjEXYyP", "get_ClickedItem", "fGmAO03m8BJRuanY7wv", "twF3yE2fHgDBHnZyHq2", "bool_9", "kFHmch05rEgj6FEE6jC", "sphgMLQglCgClUKgfFx", "JKfkvkLTc4bHqJW2aZ", "YohPPJONZ1o8E8EHotM", "EBh7AFGNZnCiOMQ0gWRY", "Ih>ANT", "BSnmenJEMRg1tFgfMWg", "k@W \\", "IYWf3f", "SocketAsyncEventArgs", "gcontrol2_1", "RtlZeroMemory", "BhRy6FXTJN0uJxSjpjm", "4.!(1", "0V cUx", "lbUwIYiurQ", "PutqO0am1oJg5NdZ2Bt", "RL;]r", "nA2Fe", "VYyBFlLQ7ryUfmQK9ir", "9%I%e", "ajQq0r4AMW", "vDcBrh5rXa", "G94e.,F", "~A_m;", "\\_0D\\", "_Lambda$__14", "*=SK>&", "set_CompositingQuality", "c3j5xkeeB7", "CCaUDwGVBqWor2kulEef", "ea1lt6mUJa", "eLWbGlJ5YO", "soGFg8GE2T4HrpdZncOV", "wk0JDk2fDWUIfMO1yd", "ProfessionalColorTable", "NoRGgSG43yN10SbUEH77", "meXCwQ38RlTpy5sxIi0", "k1je7eqpc0", "TbbtJLdPXeN9qZUJg3K", "BCTLfABDjoKR0U8eakk", "SvHbRTcwNONAgbbylfS", "8V'Ku", "nCe4hKGmUyu5LJ8DaP2b", "l~G3Wr", "HnqLgvGLYFlwR8VZwgte", "UlGk9VGZEFJxWcwQlTaD", "gYrUwIWBIIrAbGWSTul", "UXxXBh2g39MfBg8pgnD", "state", "E0~1\"hV", "Go5rtWQhYuPLjIjKjWh", "MBwQHqG8bTIgsWUqwUx3", "m_pData", "D^U3\\", "gOVdE0HbOOK0FqRnXPY", " ", "rdnMKUGX503Enqo6a0gF", "1P*+]", "G#{\"A", "P330Uv5cH1", "AQeUVNGxsh2uaNnymIZ9", "CJSymKwhh0m6UQPLn5s", "ReadUInt32", "get_AllowGrouping", "sDdCfNrJXS", "c84hDC6QIW1ImRN4q0I", "e01qDCGVznosRO6sftNg", "tx(71<>", "Yj^R9P", "iHxmgygoTJEAabP2YSw", "=#`@G", "@l]]_", "A'XE9!", "c46McAKR7pWkiJA62Qn", "r9Q6bk710MIWDnQBsMP", "PostSelected", "uke3bDPsZfZfmS5cLID", "E-U4E", "w8YaC6VBH9JFiuJs4fw", "GdGzmUKp", "ulSkGqZj83OI0Y9E915", "t[>'LMj", "(&j{H", " C!T!l!y!", "avtZsKt7vMVjnkDc46k", "SetClientColumnValue", "gcontrol1_1", "DEuU61GNhTQmhGnLAW25", "=uy|\"Z", "@j?'z~", "bo<\"z", "u)\"Jh\"", "GetNotifyIcon", "TFDiwGVrSqcQmv8xdYS", "lQNbmspc8hV4eQe6Fp8", "B9ygqNMZXEHOhEGTj6M", "CijsrCOjmHqgTOoPCdu", "BWwLV3GemKKLGAp9pHk5", "get_BuilderSettings", "ep'9x", "aKEU5", "hwtm8rGJwJw5SOFXyHX", "8.:7BE@", "scO61NZh5O", "zQItMlldkBhfHTHhGlt", "nAVGU5GRmZDbEMuGOuJA", "aPIwTOq3sY", "$$method0x6000039-1", "G28nD5ExwK", "Uk(Q7", "WiB])", "HkSwahGbZ6xBPPMlcICh", "listView_1", "e?F#[", "Sga5Q7GbNg0yllMPCMDO", "daDtv9omrEhLpu15MAn", "YLIlHNQ78m", "sPk0Mq4mWwLuA7fOdCA", "E8wU2o2u51keKcblDDC", "RQw5SFcXXP", "set_TabStop", "ICryalnq9y", "iQ4i64lgUBFcELLhig0", ":WNTh", "ittS7t9tHlnRvMCqC1A", "i431y3GyAZHT6Es3OoNn", "=*^<)", "IE{Xl", "SAEAMQ51aNfulM7idYH", "System.CodeDom.Compiler", "Cb6QIBPFDd", "`l2 O_w", "`\"xF]aO1", "i&2;m", "Label31", "EehrSfEIy3vShetJIoP", "AddTabIcon", "fU76fRml4pm1ocoKYEU", "oeaW'S", "oP1b5oGMX6IJEk6BpCYh", "FxcbPShGG", "FH1PnxyW7D", "HKjfP1GfbF7J0S5idlcb", "BybNLYuX1t5PZcgBjFe", "\"b~9\\", "F1yRFRGYQ5byGI38jeq4", "566bd", "9|48u", "pADV6iG3EWanhrAY7jRT", "aB9lHmGN9uVU6ZX7BmwU", "H|6j@", "V2mPC1XtUveicu4Fq3d", "wMq5VsRmxwSCaGW4Li9", "foMgHiF7Lavxmiih9pV", "xEe1wqGCl1MvoRiy1xk4", "#,@^.t", "Kwe8GXaprB9ImncJwaS", "V1BBd5GNgpvIePXJq8AN", "HbjHLYlpdhMl1O4t6JU", "AUDm1ZzqJiQfDT14mnG", "WebRequest", "CZtoFyFZfm38plYH0Xp", "set_ContextMenuStrip", "fZlYHyGGGYTfuho6JogU", "ELPqMHmnEx", "(!:PW", "IkAErUGVg1lAC11hBX2F", "s@(kU", "fileTransferDirection_0", "LU86Yf0Vh1kBcSAqafG", "LE5o14GgQV9VAwdUEg2X", "S@C`|", "p6DJTIg1oLT9CvtGfbp", "jrNPXBGRamWdDYwu4412", "mstCIOmy648y1ALCR7", "yB2k3rGyU66WENdodYph", "t7RvLKPk8yK11MZSZQp", "Yp4NSZVC1U", "yoNvq6dnWf", "jP1LWuIHu2cv9mdMxmu", "ziI#r", "LjLlyAPKvt", "get_Rtf", "EinihssTfweZAVsSM98", "Es bT", "+o\\^L", "FVS653KSEjfTVvGWrRI", "sUHeMRWrdjECHvNi7M", "VhY2D6GISl2i2vA0yPb6", "OQ6qrYpN3yVAfZ2TuNE", "D6sbqYEhrI", "dc5JQhGXpTAJng8Nc2S6", "COhXr1UCK8salFYtwNW", "YngrO8Q2jLTxiEDA6Cj", "pkgiV1vPPHHyskm52xY", "KQ\"R6x", "rNBYPYgAMk", "BVvQvoIOb7", "IHL6K", "G6nfWbLLtM6ubUEJOwS", "oinaSSkAjOLlaDyXv2M", "hTPS7LLJDfrYhIGgWEK", "zcT7qqDyktNQLLmSb8V", "Kz[+[", "T5gOh2GkPtMUC6WTubTl", "snUHdJhjiNdufTIV46M", "vrVOKQq0KXjWrrIhZFN", "gstruct2_0", "Y^]$b", "i|L-/g", "IrU9ANKPCyPnwCREFLC", "H_<]H", "Invoke", "a6S6ttGglLct1LkGnb4Q", "int_0", "RSBFEXGNQcAyDXRMasu", ";V?;9", "KIJK9emCZ5MWtZJxq23", "kOIR9BG4c2rLjlNNwiCX", "qvlt8uG8jirnTm6mcNvH", "PT?o^", "set_AllowAutoRedirect", "^", "nrF6MP80npMcj5gyYvh", "O240jSSmrX", "v9uxnEHfhXPLgB8EfjS", "HcF19UEuCN17ZZ1RnOe", "VpQkkt1xG4rFQIcJjfe", "hxslcp26sI2WF3ZJ0jS", "@C]S*", "mLRt2mhRhgQ7XjE30H5", "mN0VsY9TZ7FP6Vr3egM", "xmUYkWqDmp7JLBY5dPJ", "HqPicCCSlR", "YOe0TfGVlwgDg7S2wlmK", "GClass33", "I9R12oWz9BqHdOi3lXJ", "FaRiBAGMCV8ELbqse9g7", "SimpleGraph1", "jD`d%", "get_Color", "RICMcirZhrByvFo4QSw", "Label16", "8me:@", "h8ZPYKXc4WanYOgBNbd", "Va7xoZwprM", "SYng5hgWqLLY3jP76Cd", "VCvRivjfMGnid5i5yeP", "xM.|&", "Tfl1cjqTVGJce2dmDXf", "sL0C3Bvqw0X6T2UZrbb", "GetEnumerator", "Y2nvoGkV7bHDjhCXJEw", "mUbxOyMm7K", "nXsvtGj1wXgeiljf0Y8", "yCQQngGGTJb31tB6XVQx", "drfwzwiiP4", "UFShzwXHTF", "SendMessage_1", "set_UseMnemonic", ";S=YJ", "|qS{J", "*5 |_45x", "mpVxwZGV2NOw9ROTkDFM", "_wHEc", "J9SJHJ6n9CJx5GtjK3m", "N+=g7", ">C!d&f", "get_ServerSettings", "Fvy9GXXec4rCv8o7nuX", "idoe1nGZe7eVJAJDfPep", "RaCA1Clmye", "vlVAMqWI4fOPbxsPUIR", "6];[i", "cSZ2iy41GagJ0KAKlcO", "CRmZHirKcM83cLBvNdc", "jk8vILTCNG", "1vZB!", "JDo5rZ5whj", "iD|ft$2", "CS0NyHG3MRO70IC13Lso", "--QG+", "~^j{-N", "cEegSpV2Cl4nLL8Qkto", "s2QTVkhxRb", "$Ws-6W!", "#Pq5]", "puvxZXtLjS", "kernel32.dll", "GFAf5BK8YuZY11gsV6r", "kayqGdpt3e", "8t2G&", "Q", "CI8xORNm93pqMk8R73v", "saESuSLF5Vsh72fiwSr", "GbtyPiQ1RARNCWXxsPj", "dISePYA6SQ", "ajTyM1CIH8", "UwQV09hmc4EdEkp6hfD", "get_SetupPhase", "}w!a}iQ", "VPuP,", "eAONLl3U7Y", "3b+h}&", "DdjZyvlg9a4FXub4v1", "nFn2wcaSLBm8otu9vT9", "mv6IUAv0j2WC3FRk2Bo", "Qu xra", " ", "IServerLoggingHost", "g8KWo5bHI5B1tXRqdL5", "nHX<^", "qWbkoaSowjyxhBbwNDI", "N4W7yRGPHc489vMvqjVB", "Jj([A", "get_ClientFileName", "UUnSwkK7Jpr19mwqEP", "sskxbUDC9p", "get_ColumnIndex", "jAsxATsuga", "rm%f~&", "o8e8AsGwGny6BCF0xqFv", "IryvPeTtEn", "SG.[h", "x@og7", "tUcCRAN4MvSXE5sOkwd", "y3gLc8IUhuvDFsqEy4g", "get_Warning", "y4gSjwlvex", "8t+Hq", "caeiBQUKU0kcV70elZR", "get_BackColor", "Te0Q/6", "IServerNetwork", "ASOkBKxfSrdF8ZYT7cG", "GxOukHGg2y9WPnyNHFxL", "_bM0f", "SnITC62P93", "FAA4ZJnOpYnOMsJL7qJ", "y8Pq9MgkYV", "a3h'?1", "A2PDx1hUc5x5ylWCnRR", "WXgevFrYAH", "P79od34K8J", "OM7ZSAfguwE39xR8xa2", "xkOEe2GKH7CdYFgs5ebJ", "GKeSEUGlOrSnfBVExnSd", "OCWo2UGL6ml1uonwhu2y", "QOGRJx8OAo7Bor3PTsN", "lqMc9ZGPI6WLLLPQqoCy", "UgsZ9SGRgmtLCe4RD0vZ", "GSClDZquXnsNI7WLVq3", "zKUPMZaFn3UYOaWRr1r", "0':D?P(OfW", "SymmetricAlgorithm", "y2eC1dlNB0", "yaVQNTGVSREgoBxcEnTl", "s3JGHZytGCkmcTQBAlv", "rJDMbxv16yPiYFcnShX", "q_MzU", "dctenmbsKm", "sEgBApGrJaLWmipwLbnr", "jT0y6RHig8KgtvmVFKh", "NoticeButton1", "ImageList2", "[F5S.", "nYCk1pjO0aJRSMMDVhu", "HUKqHLGgrAn0qc5ICRgg", "f-CEOKhX", "'MKFP@", "eKQDwgvtw8", "dzTW%", "jTA>`", "Ja9foxqtX", "CGdqBIGwSexRiwainkMw", "a(a*U", "N5JOC5fyOF", "?qI}E", "EventHandler`1", "g/4`C", "get_VerticalScrollBarThumbHeight", "nNEsV", "IH0itghNpiTfbZuwjG.9Ef3p7T2phSLlhNo0k", "ycMJwJK5Ze", "cNe64ud4Sy", "wCV7cvBo1AvnsBrCq9D", "r;G4j4`", "UnVRXHvM2V", "1D.tp", "dEt7am8UGfLbqAMPxqt", "cancelEventArgs_0", "hPBYorGIcie6sVA80lUE", "k3Id8cGAvJ9dQypw4m6g", "set_ShutdownStyle", "oS73ArKyGgM7xE1ctE8", "6CS*-", "FjG4TeSmCmlIh0KFjS9", "NtlVY1IpoIhasB0Fwq", "Z9:y1.", "ToolStripItemClickedEventArgs", "jmvFeJiZdxaA0aE3JY0", "*YRF1", "gv5jzc1Mte", "ncsC7Se0Vqvq5t8CYSe", "set_Alignment", "uZ@go", "xZ4vlcZpQy9RHgXtpC", "_Lambda$__50", "Si2dqpfPm7", "qibdKZGesyEBg6bARskh", "cRE3VvlZxDr6bRWnAP5", "cIuq7fSQXuDdb9Z6mUO", "OWx8yKnes6Pt4JAlWZK", "Ql35Fdw5GB", "Vr6nsuGPMoxtUnBIJWq8", "1iMqQA", "KeepAlive", "PortRow", "AZplrPMbhtRk300a9FI", "DXmPYdGLUtf44Q2em8JT", "8*QLW", "KiK3VumTE2Mq3VPYcH6", "OHFwtbGPO7HfijrIf1bG", "PM%3?#", "System.Net.Security", "uS90uAGRiyJ1n17X89rk", "Ub2D.", "tYylpqcvSh", "yYunsVGIkTy6x93xau2K", "ufl10M6WPbe3SpACwcp", "UGKdbkaKOQ", "XXyNz8xGSv", "Y\"sIw", "m7wPVSf1MKlR1S8SwBk", "KHhQayltSMfjwmlT1oO", "Yo4lZ1s8WO", "JdyrI3yF75FD96bnmxs", "ReadIntPtr", "BetterRichTextBox3", "^4SZpb", "EscapeSQLQuery", "O4ZeEsYiwE18hUxoniQ", "BQGJ5hdVmZ", "8hZ_x1=", "TextWriter", "ih9uOfOMGtjR7l5CTgX", "iOsP8dHEODY31dq1EJ", "WkQFIp1v9XC5KaaquOY", "get_Address", "StructureToPtr", "YtGOVuV8w8vBGAcs7OX", "UDeFyTGnGrJCyeLoDgSK", "uo4D6sQb9i8MdRZF9tQ", "fYvMtpGfof2vTwW1hPs0", "uS7qEb8ftj", "SelectedIndexChanged", "+kP^,]N", "+JI)3", "?ZZTJV,", "TAQeuQDkEaiwWZ6XAHI", "ydjG)", "OTv9QTjP7DTs4Tk7D0J", "jUOlfqUEOF", "T2JXvLGEUIiBMb8tMPpN", "Label14", "nf0w9", "`DLM!=Q(", ">x[%Be", "l7QJ3r2G0YpMIV6ovP1", "DateTime", "FBwCDWmxnJsMK6ZgtV6", "u{]jr", "iqrKteBxAlvS9SgUbHd", "F8xHeJSuRUC3WpaSShg", "lFHCw2o90b", "xJb1KZGZLfCPviLEHU8W", "=YC:4", "dOXD5BG3YLjboiTP4qPO", "V6lqZ0wOlprS3YLUxkn", "xG?FNH", "string_0", "O=%qx1G|", "JFrAffhkNaG3XBHk9Jm", "Fdd]:", "eFCepDlqas", "u4Rqv0JYxV", "tGhBDd9jop", "_Lambda$__75", "ePN6~", "aRwn5yOdF4", "0!qtx", "Thread", "BNSe5iGkmdOwvF3P062P", "0\\cp>", "UlfBh2VSn2fVBRDrwVP", "9G)%8", "m~Rl91", "OO8G2P30AurIWpCrA6j", "KsPqpAtumMuyuLfCAX", "GetAddressBytes", "cHp9Cxq4MGEUoK2Okyv", "VUWHFqpeo", "pp{gk", "int_9", "P8OaYFHCWxfCfWF5tD5", "zHRq9mpyGA", "Rt;6O", "Rud072UFe6Wg7CsBQCT", "u0mjZ1CBkq", "fMLQ5WGgkZZUsaU7VJ4r", "aDwjqpze4Yu8XPetRkC", "Tt8CdvGNG5TmqEDb01Q2", "Qc8NfBocTZXdIpHEhlN", "IitTkDqr2u", ":[D*6.", "cd3q1sIvOf", "Mh3WWf8C2vToulJDvSi", "get_CurrentThread", "w/\"%lG", "IoxiuJE3mpBwwRF4Pc2", "GBDe4rWZi6jF1hVZ2Og", "F21yM4zoG6oktIhcyU1", "UamT5vGZ3YBBlMkixVTC", "/a-H$b2", "JXbDehZ5wcoiroFV69Y", "Fqu1hnGYh47aFapB9g42", "xHC1LLOlVL", ".kK(4", "[\"cxsl", "OccbgtGfldA6Kdq7Fnc", "({\"S)", "iehY[", "ushort_0", "74:zB", "FlagsAttribute", "ctq4afGMsHGMFNjB4ZHx", "KEhQJCKMW8FvWb39AOi", "6TnK\\", "GDelegate11", "GetDataPresent", "^Rut'", "GetBytes", "hIMo8vwU1ebl4UA0wAN", "LIlBRSJPRJvRqDb0oME", "y0cfiEGKiRYXod2WvZpW", "^_^", "Label17", "Lf(nl", "CivWTLGm1daf5gK1RrvI", "IeLhRFGKXCRu2sg428W7", "m2942ZQlOx3wxEr02Jd", "lZsYCHdVG8c52xS8wV2", "iGH36YDRvGkq55FjOAP", "HdGigaGXeKpsvhNMcFY8", "W|D5\"", "6~JE>d", "K5fstPGNVhGivOye625X", "hnytmrGbxU46a5QRnkjv", "i5-*0", "aAKoFTIBUv3T6W7tfPs", "_Lambda$__84", "Cen8w0GrXbFGKftFjCjH", "t3Xqkfdir3ulRM1Dc5", "e*e7k", "ncU&H", "bool_1", "Hau1FjfFLh", "R52hX", "G2dlAeeLtw47R2NKxEi", "RdyyKsNN5Q", "LnltGrqvgEIB97ZkauG", "get_CheckOnClick", "Lq0ilGl1kCv1ZruuahI", "MDKCH", "I5dphwRhbh3ZBpPrF5t", "BQL26tGPqjBiPCctci9m", "QFO0yAcgo1", "zBbmIZviN57eT9InZad", "Ta41b0GE9C54UmsujjE9", "$,jxY", "Xl1qA4AXs4GWHcKbou", "Ox9TeUGgLdkhhWP3wxMO", "get_RemoteEndPoint", "ArLSbLG4X4ZJQjvclEe0", "ToolStripSeparator4", "gdelegate8_1", "manfkDGGdZXwR27G6e9o", "C)ktC", "int_12", "AgbDHj6J8o", "cVj7pJ1hubJZVvt59hn", "OtZyXC7MD7", "NumericUpDown7", "Kn*JK", "g!%D9", "zoo6SZGCrofeKF94XIoT", "xvrSSpNq1PuLYAcEZLF", "GetTempPath", "THQu5rGgIK2Ouy3OeRSp", "DnHQhXGIILlb7gO6uRW7", "OpenFileDialog", "zgsIgnGEi5xnePYKqQoN", "nTjUfbGPD0S31kweHLGW", "KDHv3oz5oST7bksBpun", "lT7~R", "WWWRdrn2GDq3y2sHYaf", "MMCmgaGGoJ3KyCsHb87m", "pkLcN40mfrq6DukUZ5P", "YjobHxxV1H7Ir66Qk2A", "BuGosLLwOxyKSOpoIg4", "H5mxrFGL0ZpeFCjoKS3I", "h04J7I91WG", "CvN13bGVNHh09Wd0EMqV", "VxlhdkGhRQADTtTQ8PLl", "font_0", "LogBuilderException", "AmWNrChprhSwoyQmv2y", ":AW[ ;L!*", "op_Addition", "VGvq3qEog32dMpY17IT", "TableLayoutControlCollection", "reaQEEGnWuVNGO4DTUuk", "{oY2.", "IComparer", "ik1:}>g", "-As@}", "q#d#Y", "T1z*F", "method_49", "ProjectData", "gHVdVmZpj1", "Wi]l5", "1n$pn", "piK0wbGPV0m8aLJCPhEp", "hMhUMXbFpGyyO1Lk3eP", "hBvT1MVtq9v0Yn2o9mJ", "HQqXeMGkIXY7xZNNEAKK", "@6/5X0", "CheckBox7", "pQRdo4Gw7nVqpLq5rU01", "xcS3JH6RoJPrJMW5whj", "LISGxB2kmvCIapOOfv2", "ApplicationSettingsBase", "MVV8bLGbYonY4G3PSPY5", "TvO>C", "AHPBSqGmtvYmnW428qyj", "KQfqAV2NP1", "sUToWMIzwqKnoEBgOHK", "#Oih[", "get_TextLength", "y8yIrPn3nk18V2UqoCi", "method_19", "dfrl3ZGAqYB8fQEwBbTm", "pxP82jXjvF31Hl97N3f", "_Lambda$__48", "sLShKNM7HE", "}(q'|v", "MyNyxTGAsGSog818sPaF", "yX[Wd", "UiPZtk3G4kFsAlQn4x2", "CfmvtfGEhiLBetvMjwbs", "get_Listeners", "Bbre2tUN0oOmTgIegE1", "cwg0noJBULvMUyuni9S", "(]JJV", "CjcNRq6vTXmEg0micgE", "a\"WPV", "OhLA7xZNXk", "UNJgmHtDFpkSMwQKmbf", "KA3sDDG8HYuvIu2iguwW", "k9Qswi5mQihnEM2mfst", "~VcaD", "((=3e", "!W/\\-", "dbmHiH", "fRo3QOSAfKJkQafiTb9", "GetType", "uY8xqVtf23ZjGhKcOie", "`WqaaB", "T{b9/S", "C50rpLbrxr", "aaDkN4sWktpvOxwnKUX", "fgMg38dD0a614l1gaIv", "\"YzSx", "q1TURhGgHRp5XHtOvisW", "KLCw47GN4rDp7qAKJM2G", "!P{ 6", "H9lpNKVkemHvksSosia", "UHFR2HUDTy", "mHwZaXYFJp5iY034i5j", "fVcM1E0nUTDN3ASETI", "TR6M18G3ZBynjiqxaDsI", "doMh0Xr4fuGUbfJomkr", "aXg2EfDEAMIsAFcVWwb", "ivJ^RB}w", "uPoRAHWNer", "ImageLayout", "H&w@-", "IServerNameObjectCollection", "=)sF3", ">8`3B", "kdZe:", "CancelEventHandler", "J4'xy", "MeX6joeM7IClQ9fCkDC", "sFYT74GLIceiTpIRbKrE", ";R9Hf", "MgvxrEZXvh", "NnBOk9PMA9", "^e?kJ", "BWKAspn36E", ".F<]U", "mfYbhZGy9LCl7p98EOax", "GSe3Wk2CfaSZFMuuMos", "lueF*eIJ", "uVBEbOi7EQ4Mo8RsttZ", "URY5wHfKfH", "IVWvHuGEsf5OUuiNDM2C", "wzTqs", "InterfaceTypeAttribute", "tPnrrujXao", "RxIq0b5llCtB4Afqimd", "GPa7mUGgXuBA0atGry3I", "^z^{x", "ocHInVsLPg2gDmGLIQd", "&Gq:(", "ThreadPool", "f'(p:4", "Control", "YS5fOniEwAJHoiUungT", "N)[hZy", "kwChpCSRSk", "O;sQ/4", "zskDCsrcF01Qim0qUus", "w3Ccophvq616lHMyNyh", "FQdYF1ttwDpFI1xMWl0", "Y3tjo7Nsd4yf5c7Ekwk", "KuDH5nMyqbhrR289yB7", "eDQF67T1qXQjwesjP9a", "[\\!_ebR", "O6PKaozZoZrJ3VnQGyI", "q|MvId+", ".bx|m8", "2VjRX|)7Iv", "J<(!?C:k", "get_ManifestModule", "oclRlQGtyRgbxkBxcoA", "BorderStyle", "dKr;G", "w/br/Z", "AapjhVV0OGB13gYCuDf", "iLYiFjMSaE", "GetProcAddress", "ax.5h", "jrutWdiWeBPSfve3Et6", "]_|8g", "TrialStatusWidget", "uZCDzNjwGq", "S-ri}", "xx7dURGIJ8jFaZ2nNiWW", "wpBNTalEYis5EPrBwj2", "X5TTYkGK7L6mxAc8X9K8", "g Bu", "t^ED7", "cGWo8s1Be8", "ItuOLMGIDgGujihc3Tjx", "TextBox3", "W_$u5", "iEeQPqWkEs77pWS4o9v", "ColumnRow", "*g,n,z,", "GLg2BPeceFyH8kWdxIc", "K1u'F", "m27sPjMtaHe8kUTRPtx", "jMOd6HouxU", "HYv5g4Gmx1lb8W6UDqRN", "wb/if<", "wO", "yJpe$", "_Lambda$__87", "3oVF #", "sV3O7gzcUNQ8rjbqkfW", "YZQUhPG1iKvMOJ9gRXA", "L2Tn~P9H", "H26VUxG352NDMvQo8p81", "+{)^I", "get_MenuItemSelected", "SaSGFpGxBIkkVJE80v4A", ".*.J.W.f.m.", "}/D]*a", "fEoHyIeiOS2tDY9fo2L", "EW2cw7oU55lgVUPPvW", "VVhvi\\/v", "<&qI3'QM", "ojxv9NiyDj", "Jd1O8GxPY0", "}XX@o", "wA9Es9s05y4MQ5NTncu", "hRpu[l'z", "JJvXOtGnb41gtqyDNCen", "MEnwCl9zlIqTMM66Nf3", "e5IwW3GKtn26rQ2KEUUY", "BuqPEVHO7i", "nRxuy}}", "gFiuPHGI9g0s8sfi4lG", "y11LfeGlraxeWS4mOaW7", "get_ExitCode", "QqcCWE7m5o3F6VrkVvY", "f+^,h", "WMwB8P18oFOK5oalNgN", ">)uwP", "p4YNL8GAgB8k3K5rxxv4", "CKTTAfy1LZyVRmsdfi0", "ClientReadPacket", "XZ9iHyTR08", "unP(&5p", "CbDcrCUxyVZ4npwHbgA", "TNoWqMGncYE96cmuKGNe", "]geE2", "e0CsFeU8tvHqjtZ4OtS", "mCM(L", "H4hRIc6T60", "Mn12REGXTrMc6kdMAHIp", "@YmC|", "qK=Q/PzA", "Q(>Na", "GSy1{", "ToLongDateString", "yL\"`6h", "rtPGLqoncthkjeRspV2", "Button5", "asyncCallback_0", "dRfbGTGNSrp54ls3duP8", "J[ge`", "iD2Z51G3m8GdYRhffrPu", "WriteIntPtr", "W9ywFHsI5kRVDrVA6uI", "AdvancedServerSettings", "fhewgMlVgH", ":BM'g", "rTxR09GHdQ", "PrepareMethod", "1FWa6", "8V))y", "CloseHandle", ".1yBE", "QIRoacWRGI", "WWEiV4O9YwMs61E5SX5", "OJGiynVZ8R0y5GWdVsC", "LYHZeCvfS5VVWv1o9Ts", "-H6uP>[", "amoR3tjhEZHNTLs3mE3", "A|rmO", "wb+^5*", "set_Maximum", "9=:36", "s;|tL/", "wqh99JReCYKWcZF9AvQ", "nHRRN1jM19PhPgQknIO", "{|p'_", "GhW]r", "zmF|+", "y9oZ02YtOZKPXpn476w", "pj10f82QNk", "nfjeZ8ETq8CFwSjwU10", "gdelegate17_1", "SjUwqQ9nSE", "napvxf6KoQmPm91w00R", "lRlVG6G3V2J4ZY8hJuRl", "axL97K8VmwwWw6CSfUx", "n6AufHTAKkbss8uaaFC", "26*,rg", "zN7_(C7", "a1tBeJSNeLXRIlNaC8l", "m0O\\t~tm", "M1Xe6ytX7vbCNYPtlGD", "KnGoqL6xcASZuyuaZbA", "L39erxzljsIp0D7uYJB", "KQQohsGObNu0dobfO9S", "_Lambda$__53", "xuBUycGNn10V9cegLQmY", "IHgvWpGP8DFcmsgXcgOi", "(V5-J", "_jR'qV", "Q`H'4", "ToolStripItemClickedEventHandler", "SPxCBNGRfrdPHpDEuTX`1", "vK8V7sys8N7GeIfiIC7", "method_3", "RseoZRI8JGT3uZfgNMl", "", "kcd1vWKAjKAGxB9PF5c", "f1Tp0ZVa6", "S{z]2", "gclass31_1", "MEphoFViMGmCjQMvlLY", "Xl5SXEGUqu", ".(ru/", "B5JlPRGVU48Pwf6dv3w", "jpIrCbcHOp4LsjCxkuv", "UCKjTVv9EK", "owka7Nx0CWyTE7KsNMK", "O934qmDPV3T3qdAEuZj", "cquTkrGPToHyn92B6Agt", "IwhQ71Fq8sqG7yMjFaZ", "AN3RbmgjCaBcbbgONbE", "L37MJJGL2ctnnjgo22s1", "Gr4RmPNx07m4KjmPIn7", "OYL0hoPJn2VDnhvYkCc", "LinkClickedEventHandler", "Orientation", "Cursor", "{q0'T", "j7kr1IFTpU", "Y5QvfJJJwN", "<8851N_bN", "poijeA3omf", "Ee50v3AaRT", "IListener", "hDy1PfGypw4xhnkyS8rs", "y4msC", "QJWx5qww6h", "set_Font", "h9YKxAGVrbW6mDUmL6YD", "Enter", "Co{B}k", "@';Q,", "fhuFlGalFuRs921kucD", "mwIwYDGrntlvq66ARn46", "ShowAndBringToFront", "WRwwsFGAaC5VFaacDfTx", "LL=]9", "{C7uqo", "zTVenBB7KnDyk5Ai7PP", "&? $yKmTI`~", ">W=o/", "apLeKE5Kea", "IamrOCPnXd", "jT2nUIwf5N", "AssemblyName", "PHnmNYGxavB6Zcie5qOw", "NewsBrowser1", "XstZl18ZVliUDboyUuW", "mN805GUdxq", "'Wh;", "dYOOlea6K3", "u aw0", "#`yk`?", "xGtB5I1o7aCiN8OxtfU", "AGpAyfs2xdTcYALRc5h", "mrQoR8Hj3u", "y7WkSZG4TdAG7nO1fEkS", "set_ImageScaling", "oB6OykbF5b", "`cwX/", "hW2MkruGtkeoUMNiZGo", "!gu(@", ",]v|;", "ldWevi2ex9NKZ6Xch2A", "uWCEKxGR9as9aCL0kW75", "J8ZB65GDIG", "uCn05TNQfWh2VDMxVSy", "ikLLo5GK5YhYgoIXZaUv", "UjZ13tGVxRxI3SGQvGJX", "TnSjGVDme1", "UpdateNavigationOrientation", "get_Information", "BvDWlqscPKZ8wDItjh1", "F4PJh|", "UE1rtkYMVqiCtoa7a4", "oIPxrLxi8QcRtKFqvun", "j3tXT8HdWKhx8c0D54D", "a4VC0BHq4GX8sh5wEXo", "aulSDm6cRIFRcLGn8rM", "UCnFYKh3Yf2pAiSWo2D", ".H6kel^z7", "M`

", "%:f.U", "bfhPd", "GetClients", "ihgac22MPp8U4KOmXjY", "J2BRtlJaw", "_Lambda$__42", "UquQULGlUKaVOy9ksIbL", "e|*}_Q", "Y7rj0FhsaNJ2DFZRprF", "f{P^0.", "1kd t", "R0sVAckKlm6GXu9OkW", "get_Control", "Q9bSgLi0Pi", "KxfO305TGXrLOCxpGpb", "get_Transparent", "Ks3n86ivCtrAm5VEn4Y", "o\"pu_'[", "fEbql", "file:///", "P16yyLjaBX", "MD5CryptoServiceProvider", "w8M66d0HioEl7A2dw0b", "0(cuK}", "7&;Q.", "AddNotification", "K1Ysxo5CROPdG8nn3a1", "WCwWp4G8oeaJH4FdYgaC", "get_BytesPerSecond", "CMPRfYcyGI", "BnWi9n7OjPZMUpebqPL", "SG78IGk1Yp5qJYx32Un", "\\'7>|s", "L2\\44n", "hstAbxfLUyUU9WVX6GL", "P3kimmR2ipCH5RE0KU8", "categoryName", "zoYNQKh5yM", "B1\\s>", "3%7/~n_", "dK9KZhGegn0efoMnZrBv", "Th\\b#", "aHMefZJAk8", "XF74h", "BoVB5UwfKJ", "AXoddxukU6JtrOghlD9", "j7JhB0JLgk2YEkPAKUn", "dcKTEuBXfYjfNFo8TDs", "BFTyv1Qbet", "`[=E?", "GClass28", "JOIHLGjtJsH0OgykUVj", "n1v9FylhoCQwgmMqP1B", "ColumnHeader1", "Jfy_0A", "P{VELGf", "hp7Hh&", "X\\rqj", "g`J^v", "HZPyD", "dUDf6ZovvKCyfEHUqMK", "HHGkitXMxoPa1UAG4cQ", "RVP82Weugns7RHbLouV", "ReadBoolean", "NTjf9eNgWKZTk9DhwwT", "Ot8TXmtU7lhOEGisWJZ", "OT0RtlJ055", "System.Net", "ygReIWPKYp", "_Lambda$__35", "HOZo0RKc26", "F82Rs79k5BcP5BIUQb2", "J5DKbGZeFIAuJsu3508", "v7WC6Jbakj", "IF))[7", "Stkb0oElqu", "IServerNetworkHost", "xXDA3XGTuD", "FG_'L", "NKlM6onNXSOsj0AcwFK", "i0p62HGwtcbMAxNZHw9a", "Hl2.=4", "HoMo0HcBRMES8dKjeZO", "2*242J2^2", "VirtualAlloc", "zY`jU@", "sB~VIt", "imageList_2", "\\.W^q", "pPb91SGYsXMokPKTSvog", "BdQed4WIXl", ",YK9tz", "rne7QF6e1B5qAO4MwW6", "p1lcvWG4vsjlmUyPUWuk", "IUhrAlZJQaURpn2V7Sr", "tO6v10rvKq", "dnsapi.dll", "CultureInfo", "rKNFsjGlVUNjIR9JQHmr", "WvZatTkKawMMc6GdnNN", "mk\"CV", "LdwSiVxnLa", "R1dlJ", "c5PxN6mkLc", "dmYjJhJ0896AUKcYfyB", "GVeg1rGAPfUU5RPIw7TT", "kFapmkG8Zr4p2M0UX81N", "KkdTiMP9vvyHdGh1I9b", "Ucs5d8Bqu5XCh1w0kTf", "%.k/O7u", "GDelegate7", "{j+gM", "DefWndProc", "KW46rjlje6oBuOtEUkF", "xQAAgsXXGanKOIMZcw6", "jJRqE", "Close", "gBRy9yihuU", "IServerData", "DrRxPqGMeSJsUvlokEPn", "lF1rG9GgvE4H4UNCgj6X", "FBoYPvu4VPiB94272P", "{hwbL", "p8LxPpGbgB3A1jHPDOf8", "VeHh)", "Sw23WQ6zZwtl5QEdYkm", "*k0h8", ")5T3R", "CvMbniGGmwTE4JKEeOL", "FbikTBo2nMWoEn4ubCi", "Kk2bLmGCJ8U68DWpOX4", "YARfrd8NAWuex3kC0u6", "Lk51qBpXPaM2vvMnf1Y", "J6kJNXWL8aSaQCeZSjg", "jmMrIeGmErcbNshEIxJC", "Dm9S8DGmMYfmYrbuGAQn", "hC0htf7KJ3AhsKEbCIG", "mg2rCQG8ijG49bykPul1", "PpFenOuTWhpCXAldIGp", "i;/9}A.", "Gk3TSaKpTG5SrPqEO78", "DQMl3efykX", "WvnoDlUWs55buc0kadO", "Bqq8KvGw9eZ9TVCyE2hP", "ghoJBFrOjq", "n2sOXbysdJ", "__StaticArrayInitTypeSize=64", "6ppM3G%,]", "kZy4fO89a9lGebD2vis", "wFgGIjMjfBIWX3ixHEj", "F999puSoaD6PcjcfRnX", "agBAM6F13v", "ciCjZTeJEagVuBtPqfC", "{fydk", "aWI01YG9NXiaCYhndLM", "kHYHAhqWn4MGPh2LlTL", "eqcQ9odedMjXL4jh5Q6", "xKn7rcl8YQ5LnDGcPmP", "tGZCnKG876KIR75KBsL7", "imNyF", "K*(kS@", "yyILUiGfVfQSMXMaoSNd", "dl9BEW9gXhXup4ZKQCr", "TVS12KGZnyEUiMhYxEWo", "R1g1YRGyd5Md8VoWAOZZ", "E9cB6qGkhOpWWfbkxF0h", "ThemeSettings", "IServerApp", "set_Top", "NCTbxcQdMu", "T12ZwiijxMkBAPuMgtc", "GClass29", "G0r:t4=", "Kqi9COKCHBqXO6AuRny", "idhGjUGmqEYJe9h8w8JS", "cWQwppEU7kVmi2YVRab", "ProtocolType", "SWTSWqBqy5", "&i\"}`", "padjNgp3oh", "nh4bsAMLZC", "_Lambda$__6", "EndInit", "Ncj1vkmjxrdXStfxguA", "fO71mm7fK3eas0B0otR", "int_11", "WQiDk7GVdUn6UlLkpEFt", "nPcb3reYoMrryc8SU9d", "RuntimeCompatibilityAttribute", "uOSh6vVebYlbl3a1dQX", "Qj6G3uGK9sx5NSmh9NFx", "uSvyV8GIEtmNE1a5UNn3", "AlGS3J5Aun", "]rdRe", "aoMOVI9RyQ9Ka22KXss", "gvEaFL5DnGKFaFR090m", "ljAueHx2Uwp4a86Qpsv", "mJXD47ZC5Cpk63m3sXa", "My91fvAAFe", "s2aqkRnES", "get_ContainsFocus", "VU8w5gi3nm", "CreateInstance", "AGfy77AEdN2or1XS43M", "aNjtR5GvoQ3vJyyAfSm", "aA3HejGGZMsXP2xRaCe0", "P4yUopGCeJIO42gKTuZL", "hSU1toZll2bbjnthIEF", "ymjp8UFDlL9ZgGVygLu", "z6K35vk3kY424lPXuF3", ".$a]k", " 3NXd*", "JrMIece349T3wjCiE3K", ":|n8O", "i4bl1dGuI7", "LlaytyubTFyp2bTGLeb", "OeswFTGI0fECcYyJK3sA", "IconDirEntry", "KD4f0FdZm4YHS7OOCh7", "Kdn1MALrTsNnrZxxKo7", "QIrQYS9v0crdWmwG1YF", "~", "k2owsDZj20", "Dbm2UnNAYNsi1uFbmDE", "$$method0x6000279-1", "yxCkdrGML5mhVcT054JE", "06kc}", "NmthTMAthieytxRGy9F", "w`f:F&t", "fqcRpyqL8W", "(@kd(8", "sDQx4DZE3VkkLxOxQai", "get_Persistent", "d5Uc3npJd1EYElKrTNQ", "IEnumerator", "TrMBnh8fJhe8na93Waf", "$K^E~j", "k6gndu54qp", "MSAW9W4JqqDdVPUboKt", "nAMIoVGwwWu2n8RhOaFF", "jlSpnSGerOCBbHotk60F", "8q1g-", "oFb3BYc1jAK1jsBq0Qq", "yw7kPJGrixT48pTs5Ag", "ToolStripDropDownClosedEventHandler", "WndProc", "I>8uN", "s3qXrtNGbG9VnWJXN0a", "ABUYPIoUB2gtBaeluDp", "yB82ixsg9Hxmud3kHVy", "IsaYy5GnKD3Gry5eSPIj", "TQqCMXeTX3MFlcpBQfP", "kklvKedGYD", "g3JIlKGeen1MwDm0tbqI", "BDKCY.V:", "Collect", "method_20", "tO0uwlpCe3BeyJlaeJ7", "DrawImageUnscaled", "VpewcMGhIauAR7QWtP5A", ":jv2\\~", "\"w?& ", "imageList_1", "ReadUInt16", "tjsBGTGRkgiNMoPtwSZy", "P8kU3IG8aw0PE4vy0vlO", "QtJKU1W08SfnMFxwS4x", "Xwt3FGTJk29WSICeUhp", "RestartFileTransfer", "y6LwjwSbiZpHPyvguld", "_Lambda$__22", "Qp2dt8LHFP", "ewNQs6rf1N", "label_16", "oeLBimpLKdGx42Y7f51", "ASOPdDpzfaDe6oI3Pby", "-Av82'", "FxsHJGGR56mDWUOnQxTO", "/Z]=5", "TGBq8vGXPZMQJ1kreydU", "Y0ksFfGRu3RMqA1tOKXE", "NanoCore.ServerPluginHost.IServerNetworkHost.AddListener", "DB0rlVZ9wZ", "etcL6BbLPyduVFANpxa", "u9VaOBZIyR9Hoxgg8QV", "rXWiERgO8E", "nHooTVJUtHBBAnCg2Cw", "Image", "Mm7VcvGyyHRskZPqYWEx", "ru6JnEGrhAs6DY9LoOJ0", "CuZS3c0Wx4Cj6rTqHPU", "HhL6hmHjvBerkirjuO", "fUlj1ynBctobxl4QMV6", "XAC8RfbB0xNgE67Rv7k", "akZSGKFgNtCRwsp5QKj", "KJ0T73czvqWlQRQvXQx", ":9zP3", "a2cK3t5eUHOXUDcZxaq", "addedHandler", "GT8yQQ5s8m", "hoCODoLKlE", "XLerweNsEO", "E1k58", "sLhIRUEP1kSqYfLUXDX", "v6ADCElcmGyJ4U0NZvi", "ngiNXhujUWmGkDjYmeV", "t9pc6wUlHM6DyGZgsJd", "yV\"%4K", "gdelegate2_1", "aUZQ9ljabH", "t}{/@", "r4FY2pGJbs", "u+/&o;*D5", "FG&L`", "VZ4jM6j4QViiEFSIVE0", "Holttd0s2gvC1vsIdjj", "wNd G", "y:D+_", "ProcessStartInfo", "jaN1hiAlI5b8GB3IYyq", "muXowpMnxm", "cacD3ef3KV", "OS2vd7X5RoSDomWfID", "O~j37", "pXt96Wni1sVrXkGS7Cv", "{q=eB", "Footer", "ListenerAdded", "f9CQ5euhtaCPg7HrK0m", "wH8vI5lTRQ2ooRUCxOS", "&0@0.", "oN0nAHG8NbfPlI8HlbhU", "ymrAHFhQaVicnwp3rFV", "x18SlYA6ch", "PJxgtoft3PhSeJMaEYI", "l9Wm6eGwpr3uwEIIdmJX", "MXq8a4GN08rO8eqdd6EA", "shEb2orYQE", "qhpcF", "VINy64GGx77ZLSn79trC", "Owx506GhW8yVbIPEaCTf", "\"1ZNxw", "!9XZI", "NfVlc8Q0bF", "y3l6ZcGw17K3NgHEy0f5", "set_ThousandsSeparator", "el>J])S", "olu2OiTkRluGLua8VCB", "TrIA9n@v", "add_DragOver", "zvU<8*", "anXAhcLzOwcG5XbpO0j", "i31vyCPy6x", "pDcShXsKyqalSJia2aW", "Vu;?8/", "jIR6K2OrFAKuEceVDVE", "zjhXp9wR47jCa2je4Wy", "get_ClickedCallback", "[F2&o", "Initializing", "Fe95Aslueol5ZiISgs1", "HI9hshFI2K", "AalZuD7sJ9i6cPhcXnb", "eh)<*m", "RU32f4sqK1USVhfSb2M", "rj8dKfPDTV2CWjx9dEu", "RkDiUsOL4s", "^xGG-7", "JU5it4tUOW", "jqEL;P", "ICJhLmGf1NMORATH7GMe", "URtflLyWBcoOn9MKemY", "MMCxj8JWs4kaQWMDs0Y", "(BGQ} ", "@JKM 8", "set_Rtf", " _y@}", "enpLFKGMIUQg3DoE27aO", "ControlCollection", "AddMinutes", "ki3s46GV32JZ90gNOn8y", "ToolStripDropDownClosedEventArgs", "lnHnGeGgxTm24kHbSnfJ", "aJFePdGYLGMM3WZBmDCp", "P1}RM", "O\\A+V", "{c28$Y", "LrFT3wrkc1aSbqOgwe", "EkXAJfi5GX", "gMhgogZgfJZkA0R3eNt", "fD2J89FeQ0", "Label8", "cLevUY2W9R", "otvDeuTBth", "R1OcG ", "k%C||H", "yh/SsF^Ur", "STKMGQGmvaL09FOdQ068", "get_MetadataToken", "*aps~", ";wrpj", "C?+x3", "(8A4M", "z5weslHIJB8P2OsPShS", "TSw&d", "ykLoi9GHKJtyn1N0Qn7", "dRkNxMOvpo8EPqpkde9", "hskBKrG85RuSQaE9tXks", "gT7WM8W6Kb6CIM3M9wZ", "Fb3hL4opkwb0wBmpexl", "t$Opa", "tc8BGMh4JQ5BBlr4Zwp", "gdelegate4_1", "dvPoTAJYLO", "get_Now", "KXocHwUVO1EnQU7HteI", "fPXdbnGxK8iYiC59wA0w", "/PsQ(", "#IErq", "lEh7UsfSCXXiy2u7WJY", "R'/4T", "aIoiNeGVGqvZ3rsin8Mx", "ListenerStatus", "GcAZZCGgMy51lAadTc4Z", "Delete", "PSFiuaIAyC", "aXE0HPzRgxye4OQdEtN", "Nn3kZyrJq9H7oM8oGbZ", "\\WsXz", "hXUZf9GfkKqnca6QcV7H", "<>Bq*", "CImqh3pp24", "Label13", "yD*>w", "`'\"0d", "X5M1YuTiqlI9ovC0Kb9", "#als4", "Label9", "QNdUR6G89fb65pTjRvEN", "notifyIcon_1", "E62MWmtZp1VTENMBmoO", "fWUBhM2g4Q", "AddServerSettingEntry", "XGHZD79cMGnxZ4bCfn", "AdvancedBuilderSettings", "xTYSP0ZyGT", "ColorDepth", "M`! JA", "X0N2gmbD0ODxSWmPvMX", "[ic+;'rc", "Convert", "get_KeyCode", "hd5Wl0eCvFWhxtcVJmH", "otk5pTQs5P", "WM\\y,", "9I:Sn", "BL,@Z", "kAWd7hErcs", "f!jw=", "Cd3CRDEwyxC1S5slqFT", "UsYsSqfeWUxTDuQl8o0", "BaseCommand", "CS1YU3Tcqd", "FkgFxXzmWlorRvIfmPk", "y7mBwjGKo6bTHeWuArRw", "7!%DW", "#gn!|U", "WirRGrA6kxPLA2OlNO3", "YMaahNGVZSpR9QyGUdXm", "&d#f$", "IER<-RI", " ", "(ZwpPot", "mgeANayHw6oEjJGFtb", "BsLCdKGC8p8lLsIBQOE0", "checkBox_4", "up2WaMG3LmV65LQbrBCi", ":vFWj", "d?GG\\(", "get_Locked", "$]2`O", "sk80J3GZDQh9qyQVexhb", "int_1", "ckuLVTwYvL0mJ2Tt5pT", "Nw3RhXMgxEEKRucR3ZB", "jxBx2s", "hnuldkGgvb3Vm2QKse3", "yjdrEdbLPT", "Sb7xdnipQpbeJiEYNoC", "t9O1 ", "hdKu+QrQ", "UyoQXWjXoHKAYHhJIou", "Module", "wJfJ3UGbWuj4QPQ7ntpW", "NeguqOcMDQ1ptwrlrJr", "9gC(Q4", "G!7W=.KX", "m4lhvvoFVjhudM6Ayc0", "YwNLqLuExhJAd773Q7H", "ecIhOkGZKTBU5PfQUZgb", "oR9dymjaPBjttvyYe2", "_l+&lp", "JiQComGXqJql0aB96OGD", "gIPddwxWoQ", "@`NW<#a", "w<8R@T", "qlLDSaJA0IGEYQb1Rac", "aVARskDHDPNHX7ViEZk", "yIUufO0qx52DetGDo9j", "{}*gTV", "VariableChanged", "@mm;EqO\\y", "YVHrsFLd7", "eemYe6b5DL", "yXH4lP[f", "9?Vp{S", "MenuItemBorder", "IfhjAAFPZqvtbWuNBqW", "|'JP`", "wyMfkIGy5UgZkMEBL0Nj", "get_NameText", "yomRnoRUbttuMg1CfH8", "dpaoJUU2Nr22CNObfvF", "SitV<", "tPCXapziktx0TaSRO2h", "XxTPMWfohXfYYxnKQ6R", "QDYWuSG4jZPGYo2gAU6X", "xvAP5AyhJUEEeNcTsdk", "z9gIorXrM2p4JT4hlgf", "tXdvMI4GvBTKoN2FOY3", "cf3dLdNHo2oL99LELDK", "S6_B(sl", "ToolTip", "Brushes", "DialogResult", "mLDTLFGLRB4dBgQHyMZy", "fgdAc4GIr7obXUSAVUYw", "hTWOgKsnue", "TZrtCfGek01uyvdIArSb", "IGaDPgaBpF295kSMEph", "KaslrsSFVVpRIgNpKSU", "nativeEntry", "get_IsEnum", "g0fCYxoyJN", "Silver", "set_Arguments", "z?WF&", "nS3BPYzWUHi2c8gOIaA", "K/vu@:N|", "vd1475YGjSBWjFl4rw5", "Fax0pc8AY0P95P1acUh", "WriteProcessMemory", "kPRQf5SJ1G", "b|U74 >", "QvMO1lGVy76sq5FcWySs", "sUuPvPGNblZBV4a0Ra8N", "OnSelecting", "CMc5QNhZ1kPYwHl87Pg", "NKf0gJybRC", "W=gg ", "g3[Bm", "g2VvBqK5NV", "NXIw1tJJttuhVYUsVT7", "rZHSr1GXY4TRZwW1fmH4", "mm7d1QZsLMSKX8iFR4I", "eYyFR8lXUJlkcSv31u4", "HNAPXJmmqJLY39GGerc", "cr1m0uBPW4rmZ8T7cPd", "JolSwJbEUeIiESbExXN", "Y7ZIgjlwbGZdf9rArXc", "Z9L,0n+Z", "nZrGighJJXuOlpFXELA", "zgqJQ0NXDQ", "EGKnOQW0aj", "EDW5jqpkp9U84PBkaLE", "OgawqUX5f6hMiiXTQbP", "GjX8Z=", "MLJ5pPGY14tgL0VRJqdU", "EAi9qjGPhZuOAaIvar7C", "get_StateChangedCallback", "Y%\"VR", "d9empGGndonybcNGLmfc", "B5Lpx9KKqf9pP98YLfJ", "g\"aGD", "Qj7H?", "get_Priority", "w0e724ZdMufhTpV01Gx", "hh{T>", "wB47FZGm60rDHkVYpbJs", "AssemblyCopyrightAttribute", "2t6&50|", "GDelegate24", "tq56VbGN2bmFKFcPSP2M", "pWi\\b", "set_LinkColor", "X8gKqltLfitPdXBbBgO", "4System.Web.Services.Protocols.SoapHttpClientProtocol", "m1wvacGlWuCemM0t4SyD", "MF9Qgv4P7nqKahqhVZe", "nV&(R0:D", "ToByteArray", "fJIOKw8qy6P4LwciaY8", "CS1LrnhH7aKD81PS6vu", "twXismvy6Vy7d6ByAyb", "lWiog2Jw1xe4HixXqNC", "nT[P8", "s^5/L", "m44BI4GPbkQhD3Te2NOg", "NPpCeea7mC6Ab4toZ9a", "zTiRDwGG9T3S14eNChXs", "BkKLrU?", "l.'%#", "Q4DHqqbAYlQfcALIYqa", "=VN,e", "YxgKkLWVkXcfQBqsils", "zTCeHOLa9Q", "O0O3YDmcvNQF250IiYs", "ewRBT0D4GMvkQyjRvsW", "kq1U5qHvMCL9mqC6J66", "VoteChanged", "Xm16603QFv", "N.5Kc", "uYX,Q", "IServerFileTransferHost", "Tsx0RkYIwA", "get_ControlLightLight", "oyOj71jIfZ0uZk83n1B", "RMxxUladBRUyvnso7gl", "yFoZAfo45uh2vj6KueA", "uak3kBut8g3Ji0jLe4i", "kK9ofwHPJ9hsxTqc9Dy", "ZP\\L@", "k6JqJ0CQEU", "Djxhh0iwLR", "hNgxMdGC4cOH4wEIBk7i", "i9WOJiGbIwrSydYaVfXW", "=UJ1N", "Cl9E=", "hMt8DSGWCHf0iivXE2P", "JUIAyBKpa1", "gcontrol9_1", "GClass2", "WriteAllText", "rxo2D3G8vHFZuRQ35cKC", "}=Xr+", "mxoib5TjjJ", "RA:0]", "AddressFamily", "Int32", "IuI0HS21Jh", "UwhbrrgITQ", "qT8LP", "-4]3-.", "X2VYo", "50_(p&", "TOtvn3ZkF88MB94jPhF", "C&w,c", "HlDG\"", "D@*O,}", "FileCommand", "(0?RyL?0", "}+XhLi", "S42nH", "cjE2f5RAjFrvg9YCy1h", "PPe3lCgSHp4wLrgK7ae", "uyPeZ9DKhL", "=-KO/9Jw", "_Lambda$__43", "pQYV^", "r j)@", "\"fLa-v", "NvmZ5lQpgMTTGIU1OrA", "VDux^", "JqfyYgGrR8at337KglZK", "IVQdDY7rT", "yjHyWbi0Jp3IBBbQXO0", "o>jMk", "VhDlK9KZ3J", "font_2", "jSoqopgyhqc2RG6uCO", "oOvqiiubwu", "LET5l5D0bN", "hrD1x", "z,c0jm0", "rM7XU3yT7RktjjXnOQN", "NumericUpDown9", "NanoCore.ServerPluginHost.IServerNetworkHost.Listeners", "/nl%H", "4~H{|", "CreateCommand", "IVFlQFadvf", "BlpsDasloj0gnVsMAg", "BQn1N798a0qnbL95VCn", "B:\\p&", "YXKOVBplDF", "DlEhGa3h7K", "NEBabCO0Ts8dEV4rbnx", "pXIPlTTSyp7PPO3rYfe", "wnJOLrI3GOCodGDvFnA", "FUG19N8IvaF1bIHqoew", "GetDelegateForFunctionPointer", "ACJ3K8GGW5w26rwNZfdU", "K6haeunxj2ExL1LkjS8", "nKIHoeGnLNuePVdReh3w", "F8N5zHoDVB", "cK:sV", "mf5DXETrXBx8s2ByGVA", "24mEL", "ReadAllBytes", "LRce733BYhrpXcNqelF", "guVqUgURvL", "tNf1XdsSisy16R32m9I", "Lm7iCx6SLHfn2LxB66", "*2D@wfR", "EA7bkLGbDTG0ghXH4NPK", "#4ZblI", "kmM6LWrEPP", "NW#97v(lY", "P8oZPRGG3rNy3tFnYadw", "=u-i>", "RBVHZclnOHEBYGhCEq", "sjzut", "~#j4]", "9w6)+", "AKOMbRnoJ65cYrjKdeS", "DrawPath", "YYpSyBGbodrVte3R51VV", "Yj7iAJGY9DuYv9s6xZHY", "v8cBLdGbOLoeusyOUKQY", "NT,\"P", "eTxhtEGhlAMxQ0cTQCn6", "BeL452Gr5nigEYEisF1k", "VpD1rKjKfo", "FjUyRaGmplmKdbITgwP3", "guPi7a767jPiPrW4t99", "k1hAo479qT", "_:v+L", "s\\Zdqd", "set_ColumnCount", "enHlLl7MpS", "al4oKiNpaw", "XqovV6TASekhWX8AC7y", "iG1B1XRyyuYMDGvCNX7", "{[kJr*", "button_3", "_Lambda$__30", "Jm7Rucs5Y0", "LMaXCDiISSd6YbqeDUu", "JPWe92541H", "sgMUUKQfws3fb6qLUoZ", "PortNumber", "Gu8ejnG7fcUWloCZjrm", "cP3gYJG4kBZ23naCS933", "e'WT.u", "8.0.0.0", "NlFAaXQq10", "-8*1^", "tvlychHlbr", "Xt2Ty12dMNdmu8ZXPaP", "wJdF7LGyvB9tZJUFA5Oo", "}_RS*", "XsCJJtoGBg1ftZsAud3", "aWaqy8Md5F", "N4fwwhA34xgieTlIeob", "RcuiMIlyal9tXs2RH84", "mGZbwlqI11", "wC7UeN3tajtURIUNZBH", "System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089", "h3mNkQpM6kkgp4BGQHY", "Rc822TwzM1K0v6sOpAZ", "QM3tVwrrqbcftwEUKWB", "uVM7IeO21uCJrhBSR6J", "rX79ifGVESFL4U0b7iCg", "^<=Nt", "GetModules", "E9yq3jG4bjTsOJhEIoSo", "Yn5lJiwjF9fwtTUs8FP", "AQmYEwk5FKXqs8Bd6X2", "PreBuild", "XvoZ\";QX", "IServerDatabaseHost", "bK6(T (h", "get_Buffer", "\\7uKws", "VwnUoi", "QjQDLwRktD", "PY%0=d", "rMP9LDLhFx43Mfwig0f", "icdikuGGsDorNkx4Ts47", "XlkhfD5NJa", "5<\"58", "Gb^lhi`", "cqOUvcGbd0tUVreYWqJx", "GetString", "q!C)5", "QFLJOQSERKDaw9CsCo7", "FckeS3aLELS7O59rLF", "%1%D%", "BWh5P36iJJ", "DJ6TZ9Mrf2", "kEGS9bMk4K", "_KQaA", "w[2SNN", "System.Security.Cryptography.AesCryptoServiceProvider", "b.N4K", "_Lambda$__10", "d0TVMtGxJ1L4tLFvJEpr", "dvXO1HJMy70nIdHXAWk", "WCWff8GZIROwrXDvTnIL", "z7OXB1yEXly6Z1wskm", "KyNZM46hZRBhpgjuAaf", "DrQQL83Vj6SghFT19YS", "ltlWT9G4eIyCywRpeGiL", "a]b<", "jx7Js3G8VlGUtavkCcSB", "rK7088bxYaAhO6yUbRL", "x4ar7CNmNx", "paWarm1mWHDZTIcLnob", "xDGC7GixCSEmqrhvaeS", "TF5EuUGwJLOx0jSLk4Ck", "method_9", "afRIrwlDDZyp3FwD2wJ", "cGE28kP5lB3BmOUdFTV", "dBB0Myc45J", "lk9ZAmGb8JR6PgbvjxaU", "get_AddressList", "n3IKstr8XHWqOcni314", "m9YW6CHKDwQdWvVjf3K", "jCvIvQIIhNlmSWLgrYA", "HPSSdK0Y1YQv7Luere", "GH5VnZmYDngujKblEEq", "/$y:z", "b|h6!", "qG7Wm;", "gnmex2avR0", "$+$D$", "e3haASVUpD5AdbOe54P", "KBfxU7d2wZvilZVOZ2e", "h7fOBwJ8sJ", "n3HYXkBPEOCAFYO68r", "ogmnSdqY68", "s3Q.N", "i0AklI96Wdu8doyeJm8", "xoDsHDsVC6Z5vMJ7ayS", "?p4=s", "ANrKLai5Bn914Z7iGUS", "EBv47LQrnj139F83PZB", "BetterRichTextBox1", "NOivxH7dAFX0q0JENNx", "xbkZkNtBjqs8j0fRpM", "(!JO<", "Xcf6+C@", "SocketException", "X3ureBGmCgJj7PjXhIlL", "sf7byCGeQLRE8AmJGYsr", "5AL@%U", "jPE;7z", "]_N3y{", "r9MW82038W8d1Bx61Nt", "u5fKM1zAAfHvUBRKdkh", "Activate", "6n3[Ma", "hlISIt5LiXG7jbpJppD", "dHdaRGfHQeYOP6IBXg2", "zIU0YXYVpk", "}tu$A", "FI8YfYNPqe", "OE3Rb8GTDyrhtc40a7p", "IYeekstSQbWyjWXGP7f", "FromBinary", "EQfsFUGYHtYFvDffwfvV", "RJ6cQHISTMZucwsqQl2", "method_29", "GTI3IlGeuQGX3RZEYXo0", "iqKPxTG36dvsUkta19NY", "Hgz&`_U", "0l$*uR", "\"e1Py", "Yq66b2pU3gCTAcICjIQ", "o5yCXhHgu2", "a??`k9?V", "BL2xHwJ3XsqAaf6I6j", "oRfI4Ah9B6ht1rwwwUN", "q0EqA7OJ2HkjtAVapg4", "PbYkgYGyIWEiNyATOQUj", "PKGh*", "@y>RE.'9", "md1MD4Q53E37y3AyuuD", "66Xi[", "HiddenTabControl2", "mY7/S", "SSG0ZpF58g", "vEqsodGxtjMKcoxBlNiA", "ImportCspBlob", "Y851YZBLiIiETHWBcxZ", "MfcfO-0", "NNH7EpGN3jVT4HAHBQxK", "set_CheckBoxes", "Q3JH5LUR7rjQSMx35ck", "JJlwE", "57,;U", "xGqFMhGZ9wkZlIivIUr1", "fUlA9yGiEQ6kKB89WLk", "XIhqqLihjk", "tk4LXBNaaCkKNLSaEme", "R5Zs2n2l9BHRKPGThYd", "MRTefZS3PFyw7TsFABs", "aYK@:", "pZL.hV", "RijndaelManaged", "r7KyqU3MJO", "nrU0#i", "set_ColorDepth", "GoNqemaA9Z", "KZB1XL6FsTbM5nUHnlb", "CheckBox1", "CommonDialog", "WISigKiaix", "OnControlRemoved", "VtYDBLGyXSjd3UmfqTIu", "lwV7m", "c8F9ToGGOloTWIygyvX0", "qZ5C0UPEXf", "B3Cs9BcppQF7VhxSqYk", "w8FAfeB3V7e8SW5U1gC", "fM$vq", "jHS0ceGElRPZma1lRPwZ", "set_DefaultConnectionLimit", "AqSIJfGfmlY9nF7DjIiU", "~LKG8", "py[ER", "QGW8cFQc67C6W0PYDwH", "dq4dN", "OhmVi4iDjODSkbxUMdB", "PsC01djt71", "V4kYwqGi9f86UTSr69p", "v2.0.50727", "CJmihNrp2FQ1AewvpxJ", "BlockCopy", "KUjOG2xG95", "uE5ibqtCvaB91ijMnFY", "toolStripMenuItem_3", "mtnqH&CW", "UploadFile", "zTZ7pighQakPjnGaxET", "KGqSuVVdEBy5BME1JYe", "CK00wyGKHr0qq1dvKvq", "a9BKJ6RqEsuonjLEjsm", "Pr9dAhnPPS", "set_Y", "aXQnwLGf7mQPBhNeDA9W", "VbArJUGIptGS5cbksirR", "dAQ9ra", "ags1JBfwGRW8DAGsUTH", "A6rYUMM79pIETIgF5wW", "Label6", "set_Item", "method_18", "x'I&PLT", "cTuqu4Bkp7", "B!KOW", "set_TileSize", "lVvdORG84YJQuahJF77Y", "CmaFB", "q,/8&", "QwA13iGwWgCs5OeOpaa1", "^-0x>", "{F4B45B4B-739C-406C-A9CF-5A589EA4A5AC}", "get_Created", "f?&iR", "K8S0QDG3KNun7S35jtb1", "YGk8p4GLCgXlyvLt3WHH", "0O-;NS", "cEMCUNKl6E", "w@j.b", "o5rlR9aGwy", "4cb75+", "P6xJDNFOjL", "h9DOq4GPg6MthKkQc72B", "CommandType", "BxVqRfxijB", "lcm5EyHeKv", "t['--", "rHVl4IcfIc", ".1gNe", "r1weANbPrW", "f8LvCFxP5oRqBA74eb3", "; aM^f", "NoticeButton2", "PlaySync", "set_Expect100Continue", "tvZNAcReq0", "qkV.5Y", "cflohibby2OLBSUH4SP", "MMxBg4xkjF", "MySettings", "wM2h6fGV6M9bIx0nvZKZ", "Vgn7SFGEPtnoBUhd0ePZ", "u0eoT9S4UxIwXB4NMvu", "ListenerFailed", "vO7HOorCBOwJAGtt1Jk", "KFFTtclUJe", "TextImageRelation", "n!;6\\D6", "c02vR57QYwRboiyJMus", "set_CommandText", "P6fOgcGmABy4DiYV7Hks", "vrhV28dTQJJTI92nqeP", "HjSyJrIvpr", "s:h'L", "`.sdata", "P6soGwrQSp", "N6TQZXebbeqgSLFOxJ", "ComboBoxStyle", "EWUQr4cRLZ", "VTu19bdnu2", "\\FYmi3", "cldniMGR3QWf8jdxoLfn", "7EVc(", "B]H?9&", "FJmln", "ListViewItemSelectionChangedEventArgs", "M27L0l2pgQ5Jx7RDcWI", "CdKD5R93mQdkYF2TuG2", "QoXQQ010Up", "tOoSLbSd97", "MTxAb50QFA", "oAHGqpWXOlxAQGbuKbu", "jUKEnMaU1I4mM94Z9EV", "System.Reflection", "pk080C", "hZdn1g9E9C", "HwjktEFVAqq47TCJWqN", "Jxx55aGAf0q5xZjUkRtM", "mhtY7tGkXOB4rxnbuiJD", "aVkuvbZwTBjKN1dyC1R", "lkp5OKGC7xpESx3vg2P3", "nuZMBYGeM2dcS5j2ib7", "dQ~kX", "aI57fZGZb8dS9rUhhZ7a", "yu5QCtoHhf", "jalGmSNN7tKfyYqo5MH", "iBwmAg3iqNODHoRTex5", "Dh\\dC-", "iWRlvMlGoC", "yy9zn|0", "cadYn4ouSK", "bool_4", "chc045GVC88imF0P4lKb", "rj5\"(", "c3Pg4iGnNHWf5T1lhJep", "qB2LJDGlGf2FY4qWTWFx", "JWR0GtHJtg", "DqW5wYG4M6tpJBHIuUZX", "Int64", "K7cB3VoCJR8TrL9Tge3", "method_33", "add_Load", "get_ModuleName", "KrlifRx15QTiQOHin7l", "Dvqq[", "|A,/tM7", "oY0OxmnRPD", "N!}n^", "EhjcuOGldvG9WlPr5Y2O", "W5iaHuq5rpS0DATPjf5", "xsCggmWewG9CWItERFI", "cbaM6H4NecYRDEoVkn9", "e2ntT8GrL6SFSfSY1L5Z", "zbVADboqN7KTFCEySeu", "ReadUInt64", "S9{*x#8", "NotifyIcon", "object", "SlIfvZO73pIWyi5j6AI", "addedHandlerLockObject", "PgT5xBGZlQ0LBHHD8Pq2", "dtmNQ4nUZi1mWBAfMjP", "__StaticArrayInitTypeSize=18", "(rb_p", "PuliAjBefe6uHFl8cyS", "ox6403UJJ0GKJF08bPj", "zCqCTudjjyxolWpKU0o", "MB_`{", "[+BvO", "PUmCJbd3tF", "e2MpuiGL1ZC8vijpixaY", "_Lambda$__5", "WTdBK7mFHVpyAoG9OMe", "w4SshYLK7wFL1aP4Iy8", "Go6BSiqgOfSVoaSIVef", "K1xwadcXC0", "skNlMhGxmQ5Zpl9aTQ1X", "OopvR1p8M7LskVs8iGa", "/R%~2Ve", "AM:W:", "remove_TextChanged", "j3S3jsEQjVcUcd3GYe", "DOu1Q2jNn72GMeh9gMJ", "xlcj0NGMGowPJ6rbBmRC", "NI9akYGgzwyCHeMh5XbW", "RjFNmnEdsG", "EditorBrowsableAttribute", "ADOAx5bhFZcgmLdDFu6", "ytCgKcxkdj7QTdqUnCq", "NanoCore.exe", "GG0CBYGKO2ev9tVyvOCG", "y#t&>", "X7|bEm", "J44a79VCrk9DV3LiX6v", "rbP1KAc0199csHlW7Cj", "Q2xMaEGNI5tWjajfZek6", "j4BC0VG8gAXFo6u3LX8f", "ImageList4", "v9s5iAVaIgXbndm8NOR", "get_TotalSeconds", "xgCOjgKBrq7X4tiWvmr", "t1z'I", "VA1U6NGEBKwLOlR71cql", "x7paNDT3JU7y34NcZ8q", "Nyn6jv247nNKTUMfOgO", " Wekw", "aFp52YJyxj", "dWdBcpGXIcSUoiCKg3dw", "iJ6lsqScoqD9thENRWN", "|5$eKH", "FileDialog", "{GQ+TCg", "K,.3/", "I6bqffkrS6eaVDZGnrN", "oa8ATeHeUpf48PXHfjI", "aAkplacEuAPgQ7ym0ym", "yiNK0sKrMLCeSnGeBO4", "R0RYy6ZnXb", "zYWaUmHH67vipx39XhC", "cdTkwCRtahhFK07qwLE", "I(#85", "DUpZqj6iMSCOCN7MacK", "mZcljGGIgAeTTfC8wl4e", "long_2", "gcEWkWM21LUsxdl1p7l", "lAlCbW8swvhBv6Sinln", "get_ExecutablePath", "GxqxeVBgib", "Aeb\"H", "shnFBumiTMVY1U5kWJU", "JkYsSr0yQMAZNqE4nAQ", "dXD9Jdacj51Id56UMbS", "yH1G70jMxk2L34eby0", "arICHrGVFdXBguTb0GaM", "K8y8896ZKD9xWqTAcW", "cppVnl0eQBCqY3UbfIq", "toolStripSeparator_1", "Remove", "MPqvTBaOrn", "6?C!M", " v]h]l_R", "[$B^a", " LJ3\"9w", "FS6iPuGCLSkO6FZwAEB5", "XxMG8HGluL1YiFLv3hQW", "\"@tVt", "$$method0x6000007-1", "Kajy8Qtn3X", "3Ils\\", "nYmOd90Ep8", ">8HBk", "ExceptionData", "JTCrjl2Foi", "xTswY9G0IoFZdo4CO1x", "get_HasChildren", "apseY3cAWE", "TT4arHkaykFkk1bHvMa", "lt9TQDuPjp", "909w,L|", "MP6cSeGgqVQDOHOmXm6L", "FlD08LWWDdvNnNke6wn", "fVyM459hSShf3FnPl6D", "{SHH`", "UpVb4FX5OH", "u.!c}", "mE2TjnlMshNkDTcIrW4", "dc4ddwGf85eK0DcQfCEr", "ArgumentException", "4G)0U", "_D0a~", "oI462XjJRf", "FHMVXNkqVFaLU6HCRbb", "8D}!n", "Ww&h/", "pT25yrCNYK", "o) yG", "(kc-C", "566L=w", "RXEiaCRo9v2YtfxnWcR", "XVJ{<", "FPkXXEmuxvT6DKVyP1I", "RemoveActiveNotification", "NShk5YO6KyQh3GZYM01", "6x[zh", "Le+ym", "float_1", "ImageList1", "n3deUsYoYn02WiFELFW", "BindingFlags", "tU>H~r", "ColorMatrix", "WSnyFRGhE6fBy7MUoPuJ", "a26UZwYs3eXRg0m31K8", "G'kAd", "UAih&", "AnchorStyles", "AV8OmhjRNXUAPq3B0pZ", "LfC) ", "KeyEventHandler", "3x)P}", "HxEHHhm0tsxZdelOsOw", "yfLELMOKXDK9n0h13pI", "LinkLabel1", "zsD8ZBGK1FwbNMuy3gCv", "eA0TBan8ad", "s9q45VGyky2ChRq4q2xK", "ThemeChanged", "(@.Ljw", "tpFDH3GrwOxCOSrbFZ0C", "+2UuM", "GXf0DWSPZhngSguaVcJ", "E4fSuK2nBg", "int_3", "WaitCallback", "Int16", "xQptXtWRWy62ANaA9Tp", "VYkNYCy9mM", "Label21", "set_AutoSizeMode", "mHYMGgTtlm76mW0BWb", "qbr3rjGryFccw8Fv3TaY", "MqH>+{", "Yofo5ZG1W0M69S2X2MR", "]w1j_*", "DCoWayvXW8Mh7XQrAsg", "|YwK.", "I\"^[Bg~S/", "BWC3UsGwWj4Tk1ribmy", "jDW18XT0Uw", "KegmbxIe4fwag7EQuxJ", "'~wNr9", "7R^0Hr", "SHWSqUJp5G", "Dictionary`2", "xt}HU", "Uto'8", "3~I0@", "set_NameText", "ybblGxtqQI", "/}VYD", "AddWidgetEntry", "ok3H ", "yNNdHf2E0GpB9PQtOQ3", "elQ9VDGmwwcSgJedVMhV", "dVhBsqg6sGHX7QiZNhj", "get_Keys", "DoDragDrop", "cxJLZVGYb97tjHafVTN1", "MeyNNMdpFU", "eHnett7rZg", "WCCNajGVnFgExtV20dvd", "Q8\\rsf", "raHD59PRWk", "JNWPEBGgENqZN8G72DxP", "sYVcABGXh3SinMRwO98Y", ";,G9K", "TSwhUGGAMe6nPhWjHPmm", "ProcessWindowStyle", "columnEntry_0", "ygw3u", "FUH3HQ", "9[Wb8w", "GDelegate27", "N'X_$xv", "StringEnumerator", "zxC5Bbk6kaBMs4tZ9IV", "G5NYBUGI73TvruqN8pZv", "MgTGsZ449w1e1ODuMrO", "NG_>>", "RioOffenbx", "+yI=z", "set_Location", "zbXqP0WsVKmNCeaMFhj", "CallingConvention", "~kv;v", "timer_1", "ujVcUcKu0", "GControl7", "QDmexF8t1qQp7ArmCO0", "wnhwLL5jeFnRMbGPQG", "ID>%+", "a30HUR0rLYxHRKtp2kO", "RotatingLogoControl1", "TPKZodH6jBcrfeJtVcs", "O\\!4i", "qq5ctOWGTDe4PajSlg", ":upe5", "vGeJKclduJ", "Iliv6m6nsR", "emoRt", "ToCharArray", "42,Gp!", "GClass1", "ufZUVvtl7crM1cGHvIo", "HJyD7YgFZAb7R6hhh9B", "Gtd1Xm6ZOva1ncBYu84", "X5cZPmGfI3NLA2fxEy6l", "EjoyW3rvMD", "get_InnerException", "OnOpening", "ZQm[FY", "JTAHAUnQfs8X1tdkfZy", "xm5wVPXGVf", "NumericUpDown", "NX16s4Pf8e", "Marshal", "znyxRB1SN3ZFaCYbqE5", "CVWBvJMP57S7Ts5ArBo", "gvo43JGEumnP0clqqZcd", "N7Ay8oGKeFyGD7HRxB87", "$m1KK", "vkivmCGKdGIAcYMSA6QX", ",MG~X", "MqDDf0fzPa4cVee3Hc7", "method_12", "jbnXwYGfhXl2b6QpCeLH", "aJrCX77qUtrhkNLXJUc", "KruNgvQdXe", "ToBitmap", "EvcLqggb6Q4dg00hh92", "hCq1WVpDvqTieSOlFoJ", "IXqmVB2bODyoyAItlTu", "RZGbVg9WYWh6ZAFbSCf", " ", "y~KH}p", "VHG E", "add_KeyDown", "KeUMpUMaWZu9G7LXFGD", "BN$>J ", "StringReader", "\\!n :", "q0LO7", "u8mN<", "nQZOUEFNYg", "~Eeelm", "!H-9_", "smethod_0", "CCp6TUK7Tsn2j0phqOq", "lcSvpx3shGpZVd33aoB", "LTxbcK9y5iSLv2GHjwL", "lO{{`", "xcMe`9", "6}r.u]", "LRp1S2dXA9", "xDIGM8GLvVqsj2hJ74G0", "MhFUcyAYQV18mVNRcdB", "Vf4TMnGMJEeGSsuD9Ux7", "0+k7_s", "n7Xp(", "get_DesignMode", "YMLiJS90V9", "c4wBkBGbfqpLBlbmfW9h", "oTjZdQG83gTDMnjkVLGK", "gEilEiVhRnZBtvIJFh2", "uXUHC6pgGstxx2tlBEF", "dI44BHGhP3bQnUQ8Q2Ud", "TIWyTLGYCM4kfm5fMUdF", "ldvi61G31sTBgZy1oXu1", "MRo7lZ4W83dtgCmQrH", "O?MHO", "skm1lqrQdl", "lQDbrUQvBWMrfeFe2Io", "Iii13mkLvv", "WjB97c", "yHPFV", "pictureBox_2", "xvpD7IrFOn", "CheckForSyncLockOnValueType", "SROHQEVxCZ9LGPptPp6", "U8C3Z9m8glLEKD9bDlU", "set_Cancel", "Qr9QoEnViW", "ThreadExceptionEventArgs", "ddPTkSYXbSTH4vZSRI3", "[Ykje4", "rY0wxnGY7AN0Gwq5W2Pq", "Ad:'k", "$M(_ oh3", "DrYp1xeKTdcicNJZFi", "RmoUtUJXdp5jJOBm3pG", "a8POKvLDSS", "F2bFtXGIMZrJ6IYwxgTC", "pA465PWui11n8NqegPS", "Z,kre#", "r#hz?", "Ss6LvmE7q51jeo7H66L", "zgkERJG8kqGsSnyy12uU", "r45bDtlMql", "(gfT*(", "PuJGK5EcJ8ygTH0EVJO", "tXWNSdECCXZMMB52PxO", "nIl%XLP0", "Vim3Gmb5gxPo2uFna31", "lAegQHtPoZw2bAE9QMR", "WWAKiQGb7H52qjVnHFr5", "NanoCore.ServerPluginHost", "^BaHm", "W0-2P", "irGCXyRpGPamasBqQdP", "dV2PWpGwNjeZKBKFimIY", "QS6e2vs87B", "HUvTwGfbkG", "r 9y0", "h%yl|", "eicNlhcBfH", "dmIcETguq8nWOTMhamy", "(S\"CCv", "qFS9OCdbJniUj3L4kdb", "vaA5w5F6V5IL9X8DX6j", "get_Bottom", "qRoDv0GCTCTfSs7kPg1F", "{LwY*:", "ToolStripDropDownClosingEventHandler", "OHLoCnfX6J", "Cw8DbI7qyn", "AUSInl5cZisTqonlPlJ", "FromBase64String", "vsiNsZxL9mUlM82CNOn", "GDelegate23", "get_Method", "Qau0iCZclp", "StateMask", "scLyfkffw6", "IxgFZYyiG43Ldf1KDvL", "e37s1vkhjpy9OQTRfjT", "Hjrpwcs5V0VpjNR3QaW", "@gHT#", "N140nKiqxE", "h+/st8", " compatibility then delete the requestedExecutionLevel node.", "get_Day", "Fm9vCeGwvUo3QadEdqTg", "N3mQnpGlnOyvwd3yFo7o", "Ati061sycy", "fx1j!", "vrshavJ7fqmZ7kJlVn", "\" ZJO", "vWxcCh4tSIZYfJmNGFg", "nub1W97767wuT9CYcbl", "!2xAW", "apJjbxG8S6v0lq4FlwAi", "YF#p#", "ServicePointManager", "fsRVwHiwiJcMwCeiTtu", "VF8BZR5Xp", "Y75DE21d4Y", "NBPppGn7wePv0o2cNoc", "JVfofmbAcX", "tEkv8AUg2f", "Eqrb2MYuOq4437Qur6w", "QPrESQnPVMvWWWWGcf3", "tBhrP3taNblPKMqu8Q5", "LBfrd4G8L5vZroME71Vn", "_Lambda$__88", "columnName", "A4215vVs1T", "ExceptionHash", "l3knAPi8hH", "zXDV6r1KMtH0c9laGBh", "hnRDJalJvd", "a.H>k", "X3effkWd1Wuv4j8W2f", "E:~`5", "pM%", "oQNInmQxLqCigcU7TH0", "set_AutoScroll", "Vn8OtHGrGfeA2Wh4Iqc7", "mLl9LPxdP85VooptG4P", "d1OVx23gjf8LlcbL4vL", "vo`sD\"", "uRms2jofoCxO0cVtdAF", "aibo9i6CEu", "q+x/+", "}YR[&W", "LXgN6KexYi", "rEn0FtSxGJ", "OnHandleCreated", "DVNGkFGn1U0mWuIQM5jW", "R4oY6q700Y", "T3I5slWyLA", "kIX5e5GyJB0uC5HupXR7", "FTg8RADoQCDuKp5ngmG", "SL~AT", "ImageList", "l7}{q", "xJxgpXGGtVgr2H0tugrn", "hNnPsZGl8P8TB8k1k9LF", "_Lambda$__60", "ayaYAtKl3I", "CipherMode", "v]6c ?", "aoPQD9zxstPftRBKdcF", "iasyncResult_0", "nkmFQ3dEJndZ2l2WADc", "XEPIucO5ose3iQTVxlw", "etmk38WvJ7IqhtFUiWo", "GUnA64GNwUQY5DXL0n91", "cHk5RucNkOZDNqgynjW", "SrEiRCGg9qs3xYErHBmu", "_Lambda$__73", "SocketError", "GfZAy6GgRUlaYfDJ7fPd", "5nz1?ZP", "wATnqqyar", "IServerDataHost", "ayMiaiDnnUVRo7vBdjh", "iEy7)", "xlZl5BNhIM", "HYmXt56PY93Jwimngib", "ErjI0sfMr3bRZhKTRgE", "vjTMwZRbdwxRo8GuMZ9", "YX56\"", "7F0h.k", "i9hQVdlqpQ3Ge4HaRLj", "xx0HJ9GXbeVpiyjBiuJ7", "O2yxj867nOVEfs5rfYN", "3hWt/NL", "qoAOG1yUn7U5gttXdVw", "7JRs?f", "w;8kn3^", "[^n''K39b", "C6ebff8D9C", "pK5CxCxSpX", "^I>!wfMTH", "JPWWqLGLVeP9eK0EqiMM", "~\"B\"{", "sxAd9", "whVhK1GC24VAQtAXXciC", "fHidSAfZQm", "fbLJJQWNPHwh6VBlW5x", "fs7R4YGY39VHeBdeGRbL", "oGfIIcGfK4dAXHDYQOHq", "#Blob", "ImrbhubNT0", "Ap9eDoG441kx948YdncM", "kOvWod8mPX9Uo5sys0T", "JvqIid4MaNvn3ALQdEQ", "Fq76yH5WAUvfFLZCDvB", "chtsOuGAEG0Egylfw81G", "Z0Xmzj}", "~X*xU", "kOafMB85f4dYicKyKq", "aCyQUk6qNl", "get_ClientRectangle", "vVX6nudLuvTTsCiVcRx", "UnmanagedFunctionPointerAttribute", "dT5&(8", "get_IsDisposed", "kayAdblwm0", "NoThb87o4w", "uKx6SbCSJo", "SBbjlh7OQm", "kgwM9xS76ITIt6R5sxc", "G8xeZ6ybyUWRNTlkVX1", "IWQ6HwtmcyGKfNygEOm", "K*@\\h", "gS3SNY8yF2", "pA3jQTTUCXDss1f7Fbl", "Qilg_", "GFQwC3lsr0diJhlIL54", "cmBD!", "SKUS02llou", "mIXDRDqZR", "z;GD<", "Nfu0B1ZUHe975tVixcS", "VPBdzJ1jVh", "int_15", "Rn6XotTmHltWxrKfi1k", "ScUeCBGCmCf87IJsGgwx", "w`\\a)", "GDelegate20", "EndInvoke", ">Ct?X", "q89KkLa6v5lxnZNGdeJ", "mgRJ28GltpulH2U3Ctv3", "H>zNy#J%", "Clone", "E4GJyFo3Y6avtjD0Ff5", "Dr566MB8oI7i8AbtaHd", "vSm8wYTR0", "Label19", "", "'W8KS", "set_SaveMySettingsOnExit", "EphREvGmL7ArNjOq5KSN", "RwUYoNGZO9dbXPMOCvWL", "`EKmf", "xyQ7fZGdS4frCocJK8X", "Y5Vlwke6SK", "TF8pXNFsk3QO0poH66", "YT8Ho6NWbYkVqQvo2B", "4H8t#y\"o", "uPNBPLygb6dCSFFnNqs", "mACbsTGysG9vFTgsPJcr", "sv0XFUD6tPMx3sJ1AKy", "JKFDrGT6A5", "MPHNqVQvZT", "q4gS-", "0r><[", "l6hUkxX46pv5i7q56TM", "^$jmP7\\", "kB8R$", "T32mUXFn2", "D$O9q", "![]2&", "?s&oug", "EE0lYOvUhTlWht2ThnD", "9n\\A:", "P,Kl7", "mM3VXbGGn6cDi325hcsY", "4GqT+", "~% T4", "_Lambda$__85", "BP9yGWGGLDvCW9bZBCcy", "AQdQAi4dNcyTWvfOJR7", "iserverData_0", ";pwiD", "get_Position", "pm7qjQGF9NUYk0OJ6LX", "oBkYTqe5u7", "ySqgJSL7GKW6jusG0Oa", "lE#_G", "HNTg25GhAoRPmnMjfYEJ", "Xu8hq6Z2jYxvCens28v", "OjJnkuGGjDUxAslia2E2", "I{Qyj", "HOP3kFF5cnLoAPJDCyQ", "bool_5", "NkdladrFp3RTmj8B1f7", "BCU7P8GhfwO8ZoRu1HJQ", "kVSEotGy4w4k5FQPDOom", "nD9Ctrp2rN", "[q@an", "M&V }G", "V!`Fv", "hM }_", "\"]B|P", "CheckBox", "11l7)N-", "@1U>Jm+", "Ou2Ww5SeLfUKFJaX1kj", "TCAa2iGnAS9MyDqk7n9Z", "`.:.u", "QR2S3oP8eM5TqHqB8ir", "k02jlRzuWuYlGGeMitk", "f=:%f", "SelectedIndexCollection", "RfcCkiGCRoaWVCQIE288", "wr7TOlYE3a", "2c@{+", "get_Connections", "QqewktBsGS7ZRwYCmnn", "mt4CvLt0RMLEsy306rQ", "MpPOM", "87ne-|", "tCe7bhGr0c16oD4skHO6", "ViafSt9ldA", "4lr&8", "Pb3=d", "UkW0h6L5fvW3HCinN6l", "AQ.|m", "eYpPpWGDqPyGWy3Irxy", "SZIE81VFdql373h28B7", "@dA-@", "U4%BN|", "I1MIkaQuysyR8EFosfR", "z!V80", "zTiMFr5X2qp46hrx1iG", "sEstrtGKuy1nNwKd2bBd", "gdelegate27_1", "Edn1dpEvbjmhfbJmRw6", "iLjY82Z3R4OYtnRoevW", "add_ItemChecked", "GtDFw", "GxJD8nWy4MXfpZVVpSG", "oHkUbFGADlCwAEl98Jp1", "WekfR", "jqd671pRt6ymK7ikg4P", "UKQAI4jPcy", "S5c6UDZLmcdPPS9mCbo", "lL1DDpGbK92WmqI7L1DZ", "IWmlV3UuBG", "_Lambda$__16", "DRbnBCrI7u", ">`%3q", "v2dQL2fw3V", "k2kJb6vki7ypg7TkuKH", "tHWY1u9It7D69W8pd1t", "YNXo3nG5FYShA4EpUYJ", "EnHIjA3ojI7XCCTHhPV", "Uhh5mTXpXw", "FJ9VnrNE6UMnYsVFXb4", "x8bA61MHGZ1gxcBFucb", "AKJGZgXdoGugnhTKru7", "QqWXasGbjDkGisgm9hxR", "wpY7oVTneM2HTaX2fPP", "hy%57", "dZXPo9ma8TNnU3W7auW", "ow86f4rA4m", "mN6IsnGjoueL0FkEkeg", "ReadByte", "gYh6rNGe1p0qUnMFLsYT", "xIZAB6HoJt", "yBv12lfblGTb4AgR1v8", "gkFnby0GlYnl6PJqt1d", "&iFsT", "CT&bw=", "DRYTk1oAD7Ue68yi8Fs", "^SCjP", "i|'z\"", "nTh*G", "^n/Xa", "'2#1(", "AddLines", "JvTVupYOf33uHDO7F6O", "xVHxEmeJd0", "vu3e1dWlmqH61wtp4dd", "NUIs9haJVuIOYiDKGmX", "m6cDilGZaJqSoiib7rb1", "hucxM1NoIO", "\\z\"lQ", "SWMb6boZTY", "set_IV", "dh0RnLGbmpq3cNMxrTMT", "set_CategoryName", "T5MVu5Gr2m8OvVtkbllf", "3d2e63ea-22f5-47ef-8205-1ca77ef2fe6e", "T(N]Wr", "m65cfsGEH4EMptnLD166", "hv6!A", "d2EQ729NiVCPCvjR8Pi", "pTK5JKZ87q", "NXU5YcWhokZZyrk6Awj", "z8qE2NGXiXjc67sK6axm", "{GJoI", "eNmRNgOaa5", "Je+I#", "I~E5]", "Mh4jsdyXGdVlOnEme0u", ")Ce6'", "fRyrqyoTxyk3NNBReAV", "k02.e", "c3K+p", "aKrTmxGyWUoSJYlSyPyT", "e5BAC1965n", "nGDMw3dQn5yFDUOhWOb", "s5Q5|", "mfktxl4ynmiljBE7yQq", "op_Equality", "TopRight", "oae{4", "LSV7bCG8e4g2OaX7QaNK", "d7fRRVDfoeYiNky1vwJ", "T\"\\@@$+", "H9uVSOAAWf9up1cCd3c", "BN1JTgDadZlwwZrobnF", "VMu/;", "\"9c>WR", "w8aUTi7wTDdFkXMoXe0", "mBgF8txYqk5FvjVLJDW", "RMEuiCRkA6xrA7hL3pL", "Ha'^7yf", "eaqy4Mq8Ur", "aGpJivv3eFOsNN11KrT", "HCX1FZNXxROC3ayV45m", "GQ8LWUwVBsJ4krhCyPT", "B53twIkOpWspofGXcAB", "L4DtXvS5djeVjUapacp", "WdWan3wiMxbcYAR2idF", "byte_4", "hvhDIalByg", "BTXIA04XgXDK6gumDRZ", "87e7Ast0", " publicKeyToken=\"6595b64144ccf1df\"", "get_UTF8", "R3GeTUnAfph7xQ2Wjx", "ResolveMethod", "lnaLPTcuUiyaiklSRMm", "RakTs48QXyytA33x3Ix", "GetHostEntry", "olaP|", "o:u6`", "o3Q3NaG4AXKST4Ql1QeA", "TZAPmndFvSj8cIa1Hq5", "eBO87P3nQnehE3TpIDX", "long_0", "|lV,1", "tciLnDobHjAxbLseaL.nsYexfrawa3IjKj96p", "Cwm|ab", "J>9)<", "GpxEMU7JqhOh5y0h1Oy", "v<|h\\", "0OQ|h", "-)c/|", "py56tR6pSy", "YvcyvI8Nw5QGwUvMim", "h0VvOSVvrO", "awM7WgGYDZkLtvm1x6WL", "P54qZs7IAI8GwU5HS64", "++}2j", "gJ1OeCeGZ8Vn2RislTg", "NcjLk5GrCSbJsfcBiLaQ", "pWfHNbGE03RctsNjL61j", "TabEntry", "_Lambda$__27", "MNdCs6mIyQ2k6ujyJ4N", "NumericUpDown10", "mz@4!", "<6%c;", "K5N9Zg9abwwfYTM7Clj", "TUnioXZtkLWsWGDQeyS", "Start", "HLkUo199jkoPRDHJMrU", "yG+NA", "GByyADHTElAio2Qp5Gf", "JH8vlgBmFA03nS4QKZ4", "'kY_iS#2@", "JC1jqTJQeH", "System.Drawing.Drawing2D", "pvP88dLITIs2lGyc8FR", "ySH.0", " type=\"win32\"", "fBeWcbQG3lVLlIxCwjx", "QKf7U1HVl30eEh060ac", "XleGQaGeIsuBvbD5iBOv", "BVnX2XgN97primOh0pc", "set_Size", "HibSTqGYYacG8HOrKEL3", "System.Net.Sockets", "xqy6YfjQkF", "'L-x\"=-.", "JcKyJ6G8fj7HPSuqkjdd", "hFIf4bPps5k2mYifT7", "GSNrXJY1fs4eFwyZlM", "KPgEEFXlUQbC2EQCRwC", "ueI1d7GAFVVmSjCX1Aut", "FtIoMsGC17silmj1A0E3", "DesignerGeneratedAttribute", "gD*i'", "Aui6FgcPUe", "lQIu3C8aa4jPjG2gZmW", "smGjboOstOjJ8NmXQoI", "jXjSWPHpaopiGE0kQUG", "fO7x3wGKIeTUDa2AKcIT", "znymVc", "XJZhgvghbq", "nPgQNsGGgFnMlANtm1a5", "vmVw66hswi", "kDctMqGPucNijsgpkuOr", "AutoSizeMode", "yMkJo9l7w4", "kQbolpbX9W", "kffpeU", "tfJw6xqZ7Y40l4yMNBw", "lx8x8gGEv2isgHefD85M", "FmWXTeFskusKehRmT6", "X)f`-E", "Q334P2Ei32Cy3kOvnkQ", "7#S4Le", "color_0", "Decrement", "set_InterpolationColors", "g1vRntq6R99rXIpx2ai", "Pxv'M", "rDAYYeGMWWdP573NmUNK", "usYxFMdWT4", "PFuSH3GrDr8dnQ1q7Q5L", "4.0.0.0", "kaR>q", "KClxVkbe91", "p1sCdL5gR0TiSCRixcP", "DaLYnuR8O", "yh9sDwjZXUniG4ffqPk", "?#42?*5", "kc1B8IzyMESL8UGLsTB", "XXLT4PvJhqCGNXxXRlG", "Jj5NQq5rv5d4guldfc8", "WUso8S1BxneGODANr56", "ur4ZXFUgODYZSZU2JHM", "JH2gwjKGMCCoi3SLaKF", "gPaveHccTl", "miaGprxlTQUNHGjSLyD", "ja0eFiYEYBqsCC34kJt", "ysxVf", "EHuoOCGmcQgin0hGGhjh", "s6Ggy2pGEDISe7SVA3", "Impw1aGYoqUZgKkpNdcG", "nSQsC0wkYosA4u9yTTJ", "d12hktdAWQ", "uDQRiRDyDn", "[Pz~9", "WqCC58BYxH", "_Lambda$__49", "G57ktKGNvIToO0I4hfkl", "user32.dll", "cucVogGfea6ebKEnAH5J", "UbpX8bGAbYVonegxq9Yl", "$=/Z?1", "vmethod_0", "lOmr70GxrXu8qlFfHne", "FZJv5PCZlX", "?)kg ", "gdelegate18_1", "wLxpoeGAtW8qw4aGVu9", "IWBWvMghlXQQrt236b", "qQgxPNZOYeEng8KTNQh", "LAZaR0GZ40RsUTLbfeme", "Button6", "1MV~I}r", "]voelY", "E1Y[8", "DHL6VkMCiLC1dI4vJPE", "wcFMu7Gnj1XnXh1e2NWZ", "mGvTy0ADQfI4s1EGju3", "ntmeMAJTx0ZbVfWAp1B", "Direction", "oEv4Z", "DnsBuilderSettings", "TdxROl3l6F", "HiddenTabControl1", "TreeView", "WCmOMatU9V", "XYSdCboy9UAEXYNIxvi", "get_TotalMinutes", "yoXbYJDKAJ", "TCW_R", "intptr_0", "M4daRA", "ToBoolean", "encx0x9CiN", "26I})", "get_MenuBorder", "apgq8loSAN5Nn0GYZuF", "^ibT=", "qxNuStKX6abfNBmWwIZ", "DEcGPtAu8Lkbi7gN2tH", "GSUbR4vlV3", "sMpnbl0bhgBAtAUOg9O", "ooswt1tHKt", "FU2qtSGmrM1C3O0Ck3Gh", "gdIP\\", "Ylw90OGyqtyxmrmq4j7Y", "cPHCKZSGd5PlQoaDSPD", "Y$?-qSzyib", "QYTOF5HGMl", "ikT0rJocXp", "gr2SUAWni0", "mPwtNkOMyu8s3davR1", "Fy4Ne9GPKN6qDiSnpI5K", "QG,KRL", "WHd9HIGrOxxbOOfM9faa", "LZeWP", "Mpvb8bLysh67KBeLx2n", "aIxdO4RgdN", "w+w;l", "8T9xC'", "nm5dgiq2pZ", "yQtnfQuI0rM0SNDBaO5", "'qX@t", "wmHUEjwN1UBpYmPrBxT", "Label7", "y[q[}", "UZdGg9jLsNip7YXGI2d", "jKSq3gfGUOrBHs5pYaV", "InternalName", "AWxyhAuFPRsyjcS7JCZ", "/A!z5E;", "4fJHa", "Y_eU%5", "NameForm", "DEAXGRdSt54mYU2Wrfc", "nT7vleEItq", "rx8qQLGPkUio0pslyN1J", "kJxkSeQ4qSA49H7nDjL", "whmmypNPeBlmLJ9wY0f", "set_KeyPreview", "HPm5hLGAx24E4GuGpB7V", "EQwS0VDsKTBdJHeFokl", "wVh5G6gSrP", "LHu0,", "5@i<0", "Xd[~a", "@?9OHKs@", "bfV*p", "wfMmlAaP3BJOvm7ybGO", "lv5khgGf6CtdicKCLLvd", "KGRoRTSluUrwC4kYm1N", "~U.tx", "Cj3JSYO1RoWpge3RFJC", "\"gj*x$", "coRieUYq5EEZteUn4VA", "uoJz(", "IPYkvKIX13Rh2vwyLJs", ":IEUF{", "?E*.G", "zPs0Vjblq8NZpju9ZJq", "NBdRIskbOCeaxK6Pgq", "vVOJmJLGCuBu6yQ93mV", "SetBuffer", "get_Height", "z&G.ZG*W", "TOnTWGu9rk", "(L1+\\j", "YZEYNcUU3X", "TdfktsMROHaslSIFulN", "j98wj68xMd", "TabPage1", "aBqnWfruyKCb1AMIm6y", "eQHt4JGbTWcvAeBWUxxI", "OnDeselecting", "m9P+3", "mFZbVdGYfCOJAX6jG1mV", "fileTransferStatus_0", "TporeIDwUVWPiqJdtxr", "method_32", "Tt5qAiGmupEexf5MkgoM", "j034DA3vmdlZpDMD4Ok", "ljW8CiGNrXe49tYdeGmP", "Uv8J42xe6M", "WnAj7GtxdK6ZfwgpFYj", "oUHxiv3IlWkRrpl6fuT", "tB2JAxGj8r", "N2xNz", "Ec'&g", "52GW(", "XmlNode", "WWjHubWD5g2XSgysg6n", "YO39J2TMoxWZ3k6cBlL", "8&_E;", "GetField", "mZ2mdq04ho4JHaN7kgi", "stj34HGIw7tJOUn0U8rv", "pKle8QVp5S", "qNJDR5GV1yR2nh4FPlaZ", "eASASlwowh", "Aga5iYApc3", "jXVkaLvHc7d6pG5PkpK", "r}_|b", "q6jegIMW9A1eoSNOAFK", "xpHoEqtuy6", "RSbmyosCgabirK8rob1", "tWOnGa036K", "cWUVIadv0pbaayhDOrn", "$uqf?M", "MvieQ5J", " Specifying requestedExecutionLevel node will disable file and registry virtualization.", "TZMe7R", "T5oNRfuJtV", ";Z.1t", "o/MYAyq", "Variables", "EyIwYxLmsU", "MyMOrOck2PHXcIcgdSy", "xkEJVT0XcL6Phcq3CTE", "5?{iq", "cQm5vXhGLb", "r8XUw0fNDpeyejSJpay", "M2eHMRGlLLvVdkuOWvca", "I1inyityPe", "RdO42rickklOvOq2GOc", "SendMessage_2", "Kq4`.h", "ybkCfYZ0P0BdkkG2kpr", "CreateDelegate", "`EZNDJ", "JUGsseGfdUVKco74S8aS", "MBblB0lhKm", "FHETdpGxpcWblVT9boJD", "obO1Cj0FNeOyhR9ATx5", "Nf@nGq", "\\Cnkaf0m", "6+R6EX", "SslPolicyErrors", "zqV2adGXZ7ZIYdHWSWdb", "mMx91uo1L", "Dispose__Instance__", "set_Children", "RMr`.", "eRQjdGjM1y", "oDLl7xGrSHpSa6UF2FRg", "AnJ0rDydOCJP1rhhr9k", "E5ahkkGfZZycqqoK5jrH", "nWRgPttirWcHP3TinS3", "set_Effect", "socket_1", "W63TtAGVfbDLMPEU4Ghn", "znfJpOGV5VV12X6WZASL", "ClientFileName", "get_CurrentDomain", "Xt2AHr", "RcPYtCFXbp", "HgN6s6kZSa2h8qWqO9G", "IServerBuild", ",b0guh", "Hu0J8FleRIH5Ydwv8qS", "Pa5XvktMAY2WmNqfbhs", "tjpvfeGLKwLkiQ665oJQ", "UOzei", "iyWCXvJ9JlYveXw0wXZ", "SMufHuGeLR03ABJa3v10", "nativeSizeOfCode", "Uunl3LGeGOg3bZsjhm6q", "s7oOV6AReM3dhJSiplp", "SKjfg", "rv]s1", "JVmL70ymEIxTkXJajb0", "MOKTtdGMy66CR3IrwNnr", "aJLEFoLZWAh2u2tmP2c", "JLPhUFGlHiVvVGOfI5IW", "get_TotalHours", "Pn8##", "edgNi3WUJQ", "afNQ5`", "tOdSv2ghjx", "FAFJ4pVsMsKaQhGmsXh", "LR29sZmyNyFvNUvTEFI", "CSIVogkY5meSWrH8s9", "fgatmDGKwwiFZtabXphp", "client_1", "hqqYcRm51b", "FjqoeeKjgibP9MJ87yO", "ERE\"d", "gypyAsoD3ZFl9mly8NN", "ToolStripDropDownMenu", "KfJJdsGP0d9h2EWUtnEq", "S0pa4vGhNZoZ6ObSqqTL", "erWootGyZfWqoV4015ne", "wT2jElwMUWflrh2CRLA", "GDelegate9", "LogColor", "qDUuNUh1AkA2uGlOHwh", "z7WR30MrDg94J7B2W9f", "t4PDVPGEA44x9DWGmuaZ", "CancelEventArgs", "_Lambda$__86", "jVC9x1lUg4IF8WsPH5b", "sd3Is", "<4}\"E", "+m%b&", "bX*\"U", "DownloadFile", "h~Kn6#", "mgv3XeGKQBMyY80CDq1L", "laEkiCmD7APcvhspPLU", "*b{%qe", "jYwpN8GZSmvYhRAig8Wx", "I", "CJiYhUGC5LCdPXA1EZvc", "DAkwwoZ66l", "InvalidateNotifyIcons", "gDJS5V20wm", "H3J2kFGgSj8DW4MIMcJm", "OYB08g2qK6", "uSGDsiSPRZexU87fj26", "dFHtRCdr0RVZDyZdDRe", "7so p", "a8POdgFHttXYP1ncwGf", "eutfePO8ffFHR2jt0fW", "nbTdNNLRV6gLPp7nhur", "oRZch2GKfcJ7rD7q2PbP", "BfMruiGwMLaVqAwUV6Zt", "x3A4m97YwcpUx7Q4nuX", "VjIxTWA40b", "F9kvOrGlJOCEnlXYFycn", "label_12", "JdTTeqeqjHdro2aTgen", "Amdy0DtWrkEE2mF0wI8", "IUYkErP1CMvica5ZNEi", "T`W~ ", "BP0jbN8obU", "BHieukGMEZcWUtflS3AM", "0V4lmx%", "KieDcxuulV", "OL>oF", "F'aRS\\M*gi0{K", "fBgBCWpVUN", "remove_ItemChecked", "_Lambda$__11", "cAfEnx4SVU0x71bRZuh", ".ctor", "lAJmGEoh3MMwmvWCypw", "vNo}y3", "AwQdCJIohV", "f`ehQ", "vfPbdYSUWIjBmhYGH7t", "MRTVSoPPunRAbMjpuhi", "lBughCGmhKyQ4SblAepD", "Label15", "hEA6JHGwEuCtyCP3F0vA", "PQHMkMOEqMGZEs1gtfY", "hZdBKGWavfV3lrysdMV", "neJOj3D9ZQyn9lobG9m", "rlX1cI05ZW", "BQFj2bgprp", "RC#[@7[", "m5Un7hYuNE", "qWej0iKVG0", "Fd9QT6X6PT", "#0eyJ{", "dBKeNR4iGCAJMV8xn9n", ",M8r=(", "TV6duPvDux", "NotifyIcon1", "m>1'3", ".w>6\"PO", "wbQE5eGmehBt0ww7Jb9U", "uBarcBHiLK", "aEQkLiaRt23g2Wt7ngL", "ieJhcunCnt", "tnHUoUzsyrjNHrQVOuT", "gxjBloGE3o10xWUJH2gs", "OCveR3vGBqam5MjOA3L", "t(:QL", "VQy8.", "iVVnVspu6h", "XxCUoKjlqADfmIYKxgd", "add_CheckedChanged", "OyD8eJ15VinIpQJSngv", "c6?%F%", " ]\\Bw", "M_OEyR", "uxFCTJuA0hPBo5LnTNT", "s7PD8QGnMaQjHlKPBHlZ", "set_Priority", "yt8nhZ87nO7ACKcdcWB", "k38NwE7E7n1sB1ffM6P", "M4SSYPN9LH", "l5mllZtvZT", "Rg1Y5TOzYIJGkqJkOrJ", "fY9\\OI", "HccRKRLoMHNl6PAgJIj", "RNyvYvKtFw", "{B50\"s", "N4PJ6DLuBR", "set_CancelButton", "2LZ.H?", "eocSySN5Kb", "^9pxQ", "WsEi5ioi1UnAM58FBO3", "S0ns8qo7o4acmkPnxNJ", "qCZ532G9mMAMXJvtATX", "t}nx)", "lS{Vv", "AyIGuJdkldlf2SyfoB", "wb7mcdhLOgWPKXRY7XC", "wdY0erO5TN", "G4GnRoGEfALoi3hEiAlb", "b1(b/", "eO\"W)/3", "[^ibl@", "MtEryMVCXN", "zM5q4ixe0gp77RLBdVX", "EE>L9", "GetHashCode", "fltYBm3uX2", "Nh8XpKx4EvJJJlXv2FR", "EyJ1jSG8zytNd9EWKJ1k", "xYBbL8rSkH5uUBY5S63", "N@[CW[3", "TjuvhsbiYFvHkk8V8UU", "x._/9", "aMZMINGmWVkcdL2XkKrv", "WxawoF4Sgw", "LO0KGkElogJM2hsMKUB", "AuthenticationMode", "T-p8@", "tpBxtBVpyRfMcN4lexS", "FkjrFnGrZbPaySwsTHCM", "ExceptionText", " 'i:$", "QD@-/", "iqn5Qu9Esy", "TXW~5", "1\"+((r", "yynxmZfrhQ", "\"A$W/V|", "FileTransferPriority", "Y37rp", "Rr5N72GVvxcjrh6GHo", "iQiRas2m8y6dBi6VLAv", "H8HSq5Ge48NU5fP5fc2s", "'W;Wm", "q*}.44", ">'8#C9; ", "`0`V\"", "Y}9]oGa", "NWbq3HFNaLLwTnJjewW", "lLvJ8HiJseWgfvRW5jx", "iD8gdlnlBgMAtHZMTIG", "dnNHbMariMgQhjfgqlk", "UY36#eh", "M3/89", "CXJUqsGENZixWKQJjJNv", "ImageOffset", "yq3IoiGFsNs2MD9uiqi", "uhVkris7aGmZWVSGA6n", "set_RestoreDirectory", "u17k3NGySFjb4ATK7K3a", "qXkQ2nIP8X", "aqCP7asdJOHZNNNXCyU", "meiY4252Pc", "ow7iV739fO", "iNh2n32jkLfsg9upmSE", " If you want to change the Windows User Account Control level replace the ", "set_UseShellExecute", "e(#?q", "get_X", "ALgNpBGlDsQyWoRCwuJq", "t>7BU", "PxtHJAGNNCHlC7A34oEK", "_Lambda$__47", "method_30", "CwQNTVGrdMr4engiIeF2", "r8R8qOGmbymk8PTAcl80", "BzF/V", "%mQ+#", "P7JjU23PkG", "k4tJGEMciyfar590qrV", "-v{3w", "Label22", "al91xCGgw8XIaCT9oCHS", "7%DGt", "uJa6el0kIydEGWmf0du", "y5dZZlGVQwmUjd9F3mwu", "NewsPost", "_Lambda$__65", "db7tNDp7olRXSP76ySC", "itYLMJBCKsTQmLHmpVQ", "=olL=", "nxU6y1aRZq", "Y9g9dnerdUcN03woWpY", "g16,MmSs", "LGU5qumvWAGJJ9i3qcF", "vjldhe64vB", "J1V21SgG5l6f1KQ6bEH", "G_h?E", "a5\\P ", "LLwJaLIHBQ", "O^$s;6", "m&=<$", "ScnBDlGxobbWtQ13qMpS", "g7Dl2HntPqgNoOA3SRf", "D7Bn/", "VgVYQR2Vtb", "SXrQ3WanYd", "eT26xrQBXHGyC4yjpb", "jAAU5jWmdDr2JDPmLFr", "cWcwd9a0LxuHkmYV8GI", "TT=(0", "Fd77xdzVIywMGrwu26W", "VYMyPxndN9hu9vEaMJE", "yQgmfTSGtI1c0Lj7F7d", "kuDiGG6Cog", "K2ks2FGbb6y4RTbJqSBx", "sM1NY19pNFlysiDrxWW", "\"/b4q", "$V|JO", "2>*_[x1", "CreateClientPipe", "u7bu0TGAVSYw83LqHSSY", "kUgpca5dcd7L6I2jW8N", "WTaCKQYWJmva1TD5NAZ", "o8Gcbe!", "eWaXHPGfC0WPSK4aTY02", "mLyosO7T9DH70peE5I1", "d9YaVtpuAM7F0A0ryZC", "yal\\hi", "K7PX0rylw5igPvSIo2Q", "mfoCuIrV4E", "d15DJS3u1cYuPQ1vnb", "i3PrgbYxoA", "$\"=M@e", "Mp8fBWGwiKxRO00JIfhZ", "ORxeVOyqeirjF7piRT8", ".7C~-", "Jh1&|", "j093V3gYt2bKb1oG5bx", "w8BqC2GM1m2BwbCf5Mjx", "intptr_1", "iW8QIxigsZCVKCFQlOR", "gbqagfps9PvR4ZHZ3GI", "FHfPgYGwsDKTBFTMBmIo", "TZLn1nG4Eaq2pO0qeTPs", "rSl5YMU5u794TpuKYtL", "veBoLjGlZinp8EOK9kEo", "set_ShowLines", "Dl9kyAPQxxYZweD6O4I", "PgRQQodBNj8nojs1unq", "YG0btrcr0s8eqbyhgJB", "CompositingQuality", "gYRapwGCUNmnhdXGaA07", "uVYv6bGgAchtaXnajqMx", "aCFiObFw1C5pgLFADnv", "pQTqQGHqmR", "K2vnYY8XOk", "@%Qp[6v", "jK5%R", "eA1RbyGlBo9RwWwfaJTH", "?BRe<", "QPhCUO", "z1PnhxGwPvnhFGiqFmBR", "wEItE", "LWiTYIoFbp", "eQD2OE1dDH1GZ", "XtRST77STB", "g7QnbEGMBnly4Upakv0", "n!#B\\@M%", "$|\\Kj", "GetWebRequest", "JWWohk46AjPLltsQygV", "_D(s$", "int_5", "tga9yFc4F5xnymRZcNW", "quTtXiRNJZs9WaO4ix1", "iDiMcWqeC7hDCcLCQJV", "CFMG$w", "RIFBqxmHJa", "eSYmXkJyu4l43wVuyMJ", "YX0tuE7P2leleAw2eJ7", "+E", "YKhI05ah7amjIWFMsDe", "ibYwAEGeX3LwRmrDKrKt", "alF57uHuxLJfNOtFnbU", ";b9l\\", "qDnRsuiBPe9RPR46LwG", "FocusClient", "nMobSkGL718egQKjEBJy", "z QK7", "syR/&FW", "^6~y]", "AP0u12uDoZ3SPaMaYr1", "PVhJYvBEm9kC25j0Alp", "vrtn1PJvuA6E7e7gDe7", "UpgradeLabel", "lmWDsIMbrr", "(GNp=", "HBCAZ1lLmo", "Directory", "f1q5KlGLp0aquEpIO2rK", "*Xu<*I$", "oZsxVbrqvaIuwI3OhiA", "R9NytTIKKx", "KFoSqrGrAeAb0pLA6ZT5", "aFPVb3w583WuUjvfE5F", "ImageList5", "IComparer`1", "ZvFv)", "`RF8a", "_Lambda$__78", "SQ65yrGCpi48xC2tbMTi", "rX|v5@", "()\\SP", "w5yhP0Erlm", "vNA9x5jod0OBIYm31P8", "qM52J0cekx0F8Cpq08J", "{+fEG11O!", "IUyFxLKQpnCjcoRYG9P", "Ecb1RJGMzVr9yQ1jIKpU", "Do+/b", "QxJH5qGAJ2y1oTiqAVdV", ".83tv", "Uw15uxnH5JsoA6k61FQ", "CiI't]\"{", "BxCoPkQ899q4bi0Rq7", "Iu0C7cgT8iStlsiXwCp", "cOuGcMG4rgttxQvBEAux", ".i>Y@,/Rj", "gvHBIjRR9BUkM7RmuKl", "ToUInt32", "BitConverter", "GClass21", "S5qBnZGEIfDk1Vtt4Dny", "dOOaRsGPP3kFYgmuTbHh", "fCiH4CZc6g7fe281vdJ", "VVJ\"E)]TF|", "gclass27_2", "%L*';", "VVM73ZGlIOuTRP3NKIfY", "GetTypeFromHandle", "EPf0n", "UvJeKpMd5trtV82sq76", "WB3AAgvR6kGEK3kDUAL", "tHfPpMQ6BpqEUq04gCJ", "kfWrGFkMe0Frku7cAXH", "l1s3XFaaivuFH1Jb2mf", "columnHeader_1", "lDycCEGwqrk7M5Nlja0l", "mw/#Z", "get_Current", "l6Lj8dj0ZL", "HTviPfGfaoksrJ1FNYL0", "].EfZ<", "uhsrZdGw45xFbmXJyjyj", "set_BackgroundImageLayout", "cNyav6GbUBvETerMHsDI", "QE7FMmgCf7KYLwECci6", "aQ6@bF", "prd13mptIa8HDVYoZU0", "jr[uV", "XhY5CrkCRC", "aYM1kEe1Eg", "JD}B!", "IBU6iTGfrf8kL9SZnvek", "CLK,&", "aDWDwQGmVZ2OKi3SKmp8", "bf.K2", "ee5x2VLKji", "OPxQ6QM1fk", "KB0pDLG4A6xItviCmKh", "T$8Z|r@0", "RadioButton2", "cNxe4Sbca1X9XiIu3ZY", " pv-ZCy", "set_Tag", "aeKjQW9BTctsFF0St2h", "E5bNE0W8B5", "w4OGB6IWPDIsERDNleT", "Wh4UDtS", "F5knZGqyBA", "t`9/@", "}$R;Y", "WHXPRk8gvWdNG5hJuag", "G6Bz_", "OECV8q5uiUsKqe8dCRf", "XWdq48ERBt", "al39jkki4jRobIg5tUJ", "o3hBzpQOWm", "i9lAOQaHj5", "Kv70CHlCGw", "jEiPeJpyMdxp2OTU3Za", "get_VerticalScrollBarWidth", "N3yJsmuwpE", "qXknFKnDmE", ";JbO/", "lfd6P4bIGWLlKFSrEH4", "gdelegate22_1", "J~%F,M", "g/i_OC", "aSfV3Ia2sYj1ivXF177", "XBHD58RGd4rB1GtxnhG", "qvqTlPynlMc6jqF1RFb", "Status", "w@Pd\\", "mFY@s9", "eMgb0mGPwt4vLqBrtxZ8", "Ibefu8Byx11gufitS7g", "LvfrqxyO9SDXl5hUApG", "3$T x%", "kmzsd", "tGljbjGZukGrhSCAP2K", "KINZ4oTBhjvdwZVriDN", "FuenlBGAWVgghUGHCnut", "zolcdopBasKu17dWUN8", "Gk824TanldEAtoPHc6c", "62Ec!", "UpdateResource", "YOHMOXDzs47Td4WE8Yh", "aEmAKbIcVi", "wTWmtAj9f0JIsInHkNa", "DBYUQdaKEYDwbMaYpHG", "5>WKk", "Es,Fw", "zN}nd-R", "YxURjff5ww", "i6Ib86qMXcIYm5CITCp", "gstruct5_0", "okLOARtANa", "#ZKuE", "Version", "eTQW5pGCbaIMCDXnM7BZ", "hhgZHDGnrLGA1sZKMBSe", "Enw4XOGYrAPVVfJ2lLTa", "IArp\\", "#D%Wj", "oSkg4BuJ9Ff2Uqu9KqZ", "HRfi6s6GqUoZvppCK7D", "jN.#T", "TDiDT5VNqH", "[d+O\"", "E\\x@k", "get_Parent", "ZhQF\\", "Qsp3pCw8EOW2JeprPGp", "#C7t@", "wCb0AFfK1t", "C7vPwqG469TE3wAWBybO", "XoT0S4yHu8OIRAcj5ei", "cwLRJeGwgijp4Obpb8U9", "I289DodfCqofcw0QDoZ", "tZYntYcRvyOfVYUv9rR", "Ttjwx9d2vT", "State", "qfLWP53Y3c6plC2IPcD", "J^]a8v", "zhcS7xpmRA", "islYCnrIf0", "gs6S88GfRJbfZ2ohwCx5", "R1|D\"!", "ReadSByte", "V0von1ycBLcMHW43eIY", "clientFileName", "T)l+8", "MFLHkAMvOoZIkhL5ojq", "iTcAM0jr6W56RQa00bA", "zrLKy", "jPAWb6GZyiWXEl4Phmcg", "kuiokxg8xx", "d,:ePA", "GpFet7V1OryMJklipSl", "l1baO2fWFfSISCAIi0d", "WtaZtPZiXEfG4pMNEF9", "EYHy5HGZ6neNnJauHWPg", "DJESBkGf54rjeYOyWBW8", "set_Orientation", "CKkGhsIffeXDgtXFZEq", "dFuNdDGfUayQBeKj1B3R", "diCEZqGYwDDv3pU5x3a1", "DebuggerHiddenAttribute", "WSCjP6yK2A", "yybK67GX35GaPRHciZKM", "Fr_KA", "&~x8g", "GlU!{", "KYksOqXHwQhji49C5kk", "+m>+|", "[ZY?!", "YxiQoYGwzoMilwPd7twJ", "R@]+H", "k2gl6yMFNlIhxUG3tI", "`?iU/", "xh4TBsPKOE37k4P06Si", "PuRvN+X", "e5goNEBy3w", ":3bo/j", "i;[fo", "ProcessModule", "Vd34ONOAnTYTjyTtYnX", "t?J)j", "gChopWIgVM", "nTu6VycGCc", "SSwHh6QoYlDBZoqmtLs", "A2e6jVl4jt", "{T5qH", "FKLgDIGnJ4rWQd5dlDQ8", "r5mD7HGRl27kS5jd4Ql7", "dipYHGi6s7", "GroupId", "My.MyProject.Forms", "LosOjBGl26vDlWe6VNoV", "get_OldDisplayIndex", "set_ForeColor", "Di0L7RE5wepHWywBL2t", "jECG0XGEYxjt0HviIN7W", "zC4bJLFtYs", "q7VBXX8Jmg7ouvHDGv3", "hWH1Gj9Z30xFjdtSHlm", "IpIb6P9R7AO0bAl5Qk", "SRnQDnLVchijFEvtvxv", "Vq3r9PGCWggp1jg8H0dd", "WQuTw8iFlc7WMRGB1Pt", "cmMyjgGA3n7McffIY6xw", "fbPQB", "WPAHc0kLehTcWdYIGCc", "V:.T|L+", "cUfy4Ubqtsml9aIrPKS", "ym8iGfGZqTQkpSMJmp9u", "HJ7NaaAbEt", "zPTxpjSZuD", "contextEntry", "Np%G4s", "z3~ty", "LXM68VXD5Ul2LgGFmo1", "#jX~%", "oijt5NXEcUUU2iNMHey", "V4IeV4jw56nqXZsYe9l", "TqcPE9vCiUxHqgMTg8J", "AAggLVGZhGjK02aSGsDn", "E88THCdwnW", "XyvAXIQ0upoBX1y6YI8", "NuJFUTGCdsThqtSXvlOt", "L@ei_@", "VZf8eMJzBvns7a08Vv6", "get_TickCount", "u7h2Ey5ZwVJfxovERvk", "fBAAeBOyaopFx0PhYTA", "IClientNetworkHost", "remove_ColumnWidthChanging", "ServerSettingsPage", "BeginInit", "wXhoY6GV7kp9CPDX7N2w", "h24ItJcWD0As7gFajr6", "BYdG\\", "oYRj9Mteo4", "ECnjtQGZVnTf562QrlAm", "Av8gLNL810o58U35loc", "TabPage5", "K6RGHcKs8WZFNlyE0LW", "xTs6L9useqMLK4PxFsv", "WL\\sk", "zt6wB3", "O05QMeHF1A", "AssemblyConfigurationAttribute", "CjuBKOl9Eb2313DbarT", "QbDtkcGExTfUfKbGvNmX", "RU66nrGf0PZLGYG0JDv9", "l4VeyUGbJT6hgZOI9fUj", "fJ+50", "ewYA5LwtaU", "QegMOrGy07ELbBIfYlf8", "LhCkPv1URsLelVUFIIu", "v9bab83SPtWtCCKKZIx", "pX&Zx", "uyMdfsPaWh", "F:ta5", "nb]f:K", "gLY8yThFb8Keh18qKlf", "<}Vw!", "2H)5o0", "vR)UZqi", "W9b93wGxq39TnXpH8bHO", "/[{bQ&", "W0yX=", "PictureBox", "h93gIPFtl1yvu5GVtRB", "eqIOm5ZLZk", "pMrvS_", "fHCR9RwT5aoLhiKlZNt", "\\mlGE", "mn.>!\\", "9CB]X", " 87bI", "rsMqwmqBdWqH5vwvPLk", "q8KV7QG8Kg0LuxwXAO3h", "+IUT^", "xkm\"j", "qaxYgecKn3QL557iYIb", "pHjPGj750fhK3DlTbs8", "RntQeEemAy", "db8QZGYuqB", "agfDvtGR17Kngv4fPCeE", "up6sRZkDWnTmx6YGDnU", "add_Selected", "Gy7nf7dslK9VHfbSVhY", "yScGmm568hQrmALbCFN", "OwwjY", "WtWSjN0apYeTofwKIIs", "Tpn1MpgTiE", "xoOcmJGna2BQ6uJaW8bf", "IC3ujrGMAxIIB7JHwBci", "NfZUBxGyu2jYDEotaNUy", "Io6DMxGrI76GRYMIfR6Q", "KAxbQ4rmuk", "set_Interval", "W^)L ", "qlUgJaaQPI0D2mxXFjK", "vEKAiFPOMO", "V>TR,", "s34Y6dwHnOIxg7N3bMn", "l1jHiDlv23SauypAuqf", "gPf1bcxwIk", "iY)UC", "set_WindowStyle", "set_ReadOnly", "?MrcK", "FSMcdVLuVW3r0NIPva9", "`HN]0", "RecEn3O3ZLDecXor8l8", "a>#Vd", "X1L1qAJNSKDAPCI0EO", "yN47upMzF1Vxw7WfZJ9", "set_CurrentUICulture", "TUx6zq3Gkf", "wJFYuZ748Z", "'Y7_Q", "zlUqnX#o", "#QNcq", "XZ2YMwKJI2", "EgcLbWe6xiqpHySYuZN", "fDun0pwStl", "XYj2ytGkGsFIrrZCVCAf", "Increment", "yF4WNyGrvML42HdmcwUa", "set_AutoPopDelay", "vboHFnVPJF2GbPHGTiD", "gcontrol5_1", "QueueUserWorkItem", "g\\J4|", "RBqwD83gIv", "B0y4GkGyaGZIkM3AMMNx", "YiUwQkGqKLZTZeOtobL", "kA75eOWyqJ", "FromHandle", "Ju9QmggZhnCW7ErCLeI", "AqIxcQ4kJUnnTaM8NBB", "kAElLLEjYV503LA7qY9", "zawGkSGe6jVrQncKiUaW", "MDS2Z", "Gc2G4RGxdQbb00UWA0HP", "s6khaMp3XdANSQW7Nq6", "VY90olZhERZMLHaWOpO", "7mP@w", "s6qr99S61cEjXj6Eodh", "*1c#b", "EoUgaL7xkO7Zhot7Ldp", "doSlOr6OjN", "4<$8s", " ", "VqgwXmTnO", "gPo5jPAdlmUfuUXKx77", "Vh8b2suxVSUPBxvPplx", "XDmdV8119CXVtqnsa4h", "o>{/v", "rcDUf4LSyZBYA4y2gIT", "ot3sEI", "V+7?wm2G", "set_ClickedCallback", "X3eTJmGZcDx9fXueoGKq", "CLSCompliantAttribute", "aBKGo3GVWnDPo49Lsrvr", "C4C68O2sR3", "Yr3wRXE2WPqgFfaLRSI", "kdyeMiHs9G", "WvoK13GMnES8rliylddx", "({$f[", "Bm?dTu", "T\\f^W", "eDpcrRHod9rovLjB1KA", "YaZliv4ekwRa0V7q81U", ">C3sE", "WT5qq4XLxXcahLLa7f8", "CornerStyle", "t.;dd", "cdGDVPcgqK", "k9#R%", "uN29XrGx8Hrtywr7yauf", "get_Initializing", "Ertfn2P3qLOGEG5HRLG", "cOsqyph7oeJ1K2sRjNC", "dHwNMyiHLA", "metvVANEvU", "MrS9hoJHYJZlcAht9u", "fiV^(f", "r0kgv", "Il7WnWixSD5dUOpN89", "ys7y7l7cOl2npjdJOa9", "gfkRCGGN7scWJlPpTZLI", "CloseClientPipe", "FontStyle", "QBNJ3Ig6v1", "yJEL5Qu3qSgieQsTcsH", "v5cWp1H44Nv2OUU6onv", "kGiMxlGVpyLC1rCOOZwV", "}OvJ=", "DGkB78FF1d", " ", "Encoding", "gxdjignwfE", "kiJXsrG4z87UqZt3SjFF", "Iqbr5mdnKHsTGoa4qwM", "StringFileInfo", "dYN4JnGOh7ANoqkPxUy", "Bp5wPZsU9opnAnMoaCp", "GmKCcJjSc0HrbkdIJGy", "set_CancelReason", "%V*Gg", "gdelegate24_1", "l@Vx.", "VhJlI7c15q", "pS?Z`", "iZGY3Q9ioQ", "lY0nill6S4", "xffyPKCekiUQoH5fmF", "aeCluXUex6", "sDp:>", "FuSYVqwJELQOXjPQDc7", "hDKjcqICUkIPl95d5oR", "uaLkaAePQct3sHl7Qrf", "CMU=o", "xWlpr1GCNAiRA5KKkPv5", ">LY,I", "aLr04NbbaF", "get_Location", "Dk]Yy", "VxpJkkT7l0vdGGNnebZ", "ap36IK0P7iVHWbKvwT0", "CmdtCmGn3oS3PDVXwvc3", "cUHFX", "control_1", "RJfxLFGbhM95d1X5xa0q", "a1D9RwGKjKHCiRY3ac5A", "NotificationServerSettingsControl", "uqjqPMZyMe", ";R7-B", "SPFLdoBUPgiFSbLHihN", "hbxoS5hAh3skE51rDPf", "q1tU2]", "columnEntry", "mnUAu2UwYr", "zWK1j", "+8B]Vm", "nCeAWNGImr5LiAJIvV26", "EmBVs", "N6PBD4T0bCRYBreq4gv", "wNcE' ", "aZGolI8yR78D49tcPV7", "KRp67oo5JI8qBcytlGR", "TIfTh9BItjlCLOUsZty", "set_ExceptionText", "Zm:DfTO", "color_4", "FMduaCOqKysOXnfc12N", "diX1FhUY1PexYv3ivnO", "tOZN0igxjG", "_Lambda$__44", "EyJNxXOhEgiYEymYRKm", "l28PLBKonm29wCO0SQa", "muCn8gFvxuJWOJVZiHO", "GStruct3", "VwdwBS75rI", "HeaderLength", "e1p0APddwA5P2ifeV4Y", "pEfCJeGhqa6m7g0qR9CU", "ub6R7PBbxJC4t3fw0G0", "_Lambda$__39", "n5WkSsyLkTbFQrB5H88", "aVgxigcSa5", "p<,]NKv", "ResolveType", "HEMK8PGMMtqijIYgBrqQ", "Ugb4pH4KVyKyLfJO8rg", "dGGbLR8osHoDItH7vCf", "cGK0uGelkN", "z8WrQn1xVQ", "JBsCtp323mcneRKPJTY", "qViT0jGOIn", "SdMhF0GyBZ5aotjrDFEg", "A\\py2", "Olk5h6gta5pxUTsMC3D", "SepawBT5IEKJ4d0yq6T", "?\\pDV", "PauseFileTransfer", "TNjLwR", "QUOXysGG8NDXDQqY3DjD", ")5 TLn", "eoI1YjRD9v", "EhiwiuiAHv", "Label10", "llGgrFGmgtqCTEhiGxIp", "xI0byEzHD92VYD7nqZi", "OcH1d:", "KG;{ ", "w&)$i", "SplitterPanel", "wp4yPFx7aaZI6H2hJTb", "ivenkQGn5t", "e3eT6EBOME", "w*IA+H", "ServerSettingChanged", "QCeVb9dkOkAbPiRDJ9q", "OBdrYiw3yMTwjsAq2Vw", "H>t^T", "v|4,t", "=-[SqN", "mgHr3fk7LJRaU9obGwL", "eljbNY73Vi", "I6DbOy7Qb4", "G2P1U4Pghj", "hprPOPG8MPgRu0glBCvU", "$Qdp6", "VMhX5L1P5", "GScTgtKt41eKUSNOsVd", "t1j2KQNo4Uyba1a4ss9", "Invalidate", "Ljkr+7.", "S8bHNgmOfro4G5MD98Q", "guid_1", "xc4fwjI7363Cjy92dQL", "]0n6,", "YkuScmIebq", "VYTJp?", "nocqB8Lk8O", "KlLBeYcPWV23PClDXyx", "pRFMZsmaMBrJa1ukM6", "aVEbZQpNWL", "x@FU3%4rW", "xBCiE3HXbamsAOxHqu", "Id5U=#Z", "yG4MRsg9HVsDcYPry6O", "g44eYPQwPWwKL0uqeiO", "kZm!?F0", "x1LL5KcEAFwGVmH9k7", "+-{2sy", "uQXdcoaqQM79eq2j9ny", "mscoree.dll", "jlMJdZGrcJEjAuQ54Uhh", "RNpkE7i2kX8OpKMxZFb", "Yd1i7QG79j8DbVVAnIX", "ContextMenuStrip1", "GClass12", "CvlDnXGwUL0ooCM5YJji", "P){ar", "dCGixDGgNFvZcaws1cel", "LoadingScreenControl", "aPFMgDGIzi7fL7gp5NM6", "HQO0tb0OG44WTcNp3YL", "yQBdXGgLt8", "XooAVY1ZRp", "9Hrr:", "ewDktdMupXdkLJOLfq8", "3{PNd", "0yx$qQ|", "O1>1'", "J:hK$1", "{6.xT", "numericUpDown_9", "tlA9rF6AXwjW1gRsYgE", "z1u1symfIj", "rk3hk8UT6IHXArgQZs2", "ButtonBase", "pnfcp8EM1VLeeoCjN44", "gfN2]g", "get_Header", "KydiPLGIyJcW3xqZ6hqi", "HgsiPsqcPD7Ftq8MeJN", "gB%)m", "I+*!v", "qp1LbeiIEKrXCZAFkw", "KUR5avZmIDbO0cryAoR", "mYArhMu2w1", "j#?\\?", "84~+9", "System.Reflection.RuntimeModule", "DOGxn8GKEhJ7QfoYALLw", "aOTQANvttF", "&3fE|", "_Lambda$__40", "a1Er3Ad6gx", "UjaS7AKULbnYqsmJhqL", "yUiy]", "VOe9G4GfQDWwsMttSmrR", "pcB5FXRyhgLd80pf96", "Dvanw5ZT7pPN4Xmbq8V", "jreTfTdAh", "ScrollableControl", "aNCbNxdKGf6oPDJWxD0", "C34ekTGZri0Y0YahXtA2", "H4xHwyL6SmL6GeYDBTt", "h4xUqrm6Vo3vj7446F3", "pxUAwMWbjjlB4erweGd", "}\\I33.", "l1jLO7kJVDjKgMEYMtr", "Cagju6AtJ9", "kK@+T;", "si5L0tRVFqHxVLDSMUo", "CheckBox8", "TPX2wEVfNeATLpNlWwU", "xUgCkcG4hIXyksnZxIxf", "XRFLL`", "IYVJiL2QONparrEcvfD", "~+cO-", "Q4foE9eBgrAgYmF9uFX", "cqFSvlGeh6AmJU1hikij", "\"ots8", "YOh6IU8u3D", "KtejfYG8dX6XstaJcBPS", "LA4LiIn8UDsR05JUoUX", "yaiqhpShVA", "TJ6utFLsDkBN00WL8T0", "QXfJheVWeiwVId9LPT", "cYvjt8GXER7onkaEAkHh", "m5G89n66Tdt9kYOMPQA", "ApplicationIcon", "E35jvyGfS8QUoyOVmGl", "button_4", "h1dhowr0up", "itUJgNDNhBLijRwCpiL", "Q84b9BIKKTEjPbuHouH", "dZ60qgGrpa9FurXu4Hyp", "j832dutTA4A8fYTSqaD", "t7\",~", "TH914eGCEhqwis1fYbSw", "I4wFfQhaN9WRqqNbT8F", ".8H`H", "hpbJ2we2fvmBrT4LnMx", "pwgHyYGhxArtTsW6pWHX", "Cl6RynyA0RnccmKBWEn", "hO3fr<", "gcontrol0_1", "remove_ItemCheck", "c8Gv7NkP7T", "G53gaV2AHefDKSh97yD", "WPXE3E5pkLykq7AMmme", "JqNAEcGE6Aqd9ZATUSFj", "69UQp", "HandleBulletinData", "jkpNFhGuvK", "gE561wGbGY3DfnAwXWdC", "GZK7I8OfkyvaBhAvENu", "A&'da", "E~Ur\"", "WhssFKXTSspGy2kjs1", ";vAd(", "EoyNsDGLw2BDENvpA1EU", "\\ydu$", "PrepareDelegate", "nq0ydkGRemRCMg3Iwnrm", "kCd2OEdgg4EQt", "NVjd2xWgQT", "\\W7 &x1", "KVsd8I1nc1", "wiIHmvpfCCK7dnt3fke", "X8ADq8nOWX", "cKUZhaHcfbN1SXBDlVD", "w)je7", "cdI0XWsMlxYSmlRkgGJ", "UnABOskCce", "vuLZaCVwEnJM4slcdVf", "FDEbQOOdZWm6D8jwLen", "zi1qL4CDsx", "nkU8kUkIEZHGaQXbJxp", "FW0qJLs9Vr1wZuFoew", "yZ1LHmGPEs69HSbPpIiS", "BUdE6HJZO7Xyn5QgWEj", "Go3UD8GAZImm3IQ6S6E7", "VeQQaxGxLcNOqDeBOMpV", "qrFGapGPBkx2fny2AmlJ", "laxzoPHB7", "9U9h9", "gpBgO4vm2vcTyF3Nrgx", "vh1QPUGdPU", "Initialize", "dH`Hc", "Ls65GLUommqHfX5H03r", "K/yJ7r,D2P[;", "FKomUdVlr2tZLVtMCiU", "CreateFile", "tI4hdDLTP5GchDAVhPf", "YG7PIPGEA3De0KUT9md", "qwBhYW95S6", "rOYUEuSaPQOfrh8rivX", "oxsiAVIm6D4S3d8wFc0", "D;A4q", "Point", "set_ShowInTaskbar", "Kr8Dr49AV7Km9KsdboP", "set_AutoScaleMode", "PuQc&", "csDCXESMBtpLdbgkOWE", "-%yQtf,", "VY363cPVIc", "dwCxjturoEE7uNtbleP", "XPKwIXG4uYpmrW8u8FE8", "eK8TbJxzWjSKuXZ7iCf", "SBAjsiRQWmx3x7xInyC", "gclass15_1", "System.Windows.Forms.Form", "cf1mDkvMp50NuVTT1Ha", "V6wJWmGRUBoiVP6deOjV", "FileSize", "get_TabPage", "i{V+^", "fnd|~", "nu9rlJGar1QtOlyv49h", "atewSuGrzPjhRLNXhuwm", "m561xkU1Pg2r3B2WnO1", "oMq1afujHC", "xuqdlRGx1GErnENBLofq", "ColorTranslator", "saM>lIOOsEB$", "M7A?1", "tHUol1DbwCPL03GfaSP", "add_ColumnWidthChanging", "CCaIcfqpUpFJ5l0IyYA", "DeAbpvwQxKsjPA4I5MI", "c1AOrpxwKjQxysNhsWl", "u:+Bh[", "StandardModuleAttribute", "E5DxPLGRSUsS0Jmjj7BR", "(Yd!&)", "gxRx32EbKF", "tableName", "set_SuppressKeyPress", "gdelegate19_1", "NKQCjMR13eyjecPtHO9", "IPEndPoint", "kaP0P6U9xL", "sbxFjKlFw9romINNuMh", "KQmwYDGMkWhLnkLnwLJc", "p(KJ{", "s-Q'H", "TabControlEx1", "q0FKdgGLb53s3oaClucq", "MC+?^,", "sXM1VO60dNZX7MH91S0", "giJRnOSM8D", "iK3RRqs1Lq", "ListViewSubItemCollection", "wpI5q2NVMQ", "J3byZh2seDXtlmNTNBr", "SvIGkSI4L1j1jFNS8g0", "aaXTPWPyToEbWkfJxHv", "ebUeQ2HZYHOmvoNpyVl", "wo3BPfsxL7", "set_SplitterWidth", "set_Height", "\"\\tHB\\", "{q4jL", "get_LocalEndPoint", "XI8yvUK4TLyyAdlgq3", "anGW87G3B3PA0NXAPTN", "(`WXC", "3I\\v#B", "TKR1wjZKAXRdiEN1Ghw", "akaqnxGeKSF2uKSkv8o1", "yh5C8fGLyh6rHXADZsiG", "byte_1", "Oc2YljpZ5Gm7iZlOURq", "XMXpcTGeN8Z6yMuJZ3qy", "cLSaYYXmPjbCo8MBd0X", "q9mEt", "lj ]3a", "dp8TVxG0WDOsqSYwWby", "ibuildEventArgs_0", "/c", "wZikRGFOYQUJUM36m33", "BH3yepJh5kqsDUjyOL5", "lNMIj21qpmco5B7W26U", "1=Sm2", "ql61vGV69v", "MZokFG9K685FIVWLl0D", "LGxFpEGVDgtSgCuFEGr0", "SendMessage_3", "LU9m2HGyhBHa4VxN41Ai", "xNgyexRifC", "gKBjLi4", "gHhFLBzFDHj9flptlQl", "ks1SLDBWjqY9g81g6nB", "Aa21UW", "c')^%", "TSX1pT6Ev2", "H2wlTq/", "8!4,LPSy|", "](V&\\", "0[ljf", "MOXr6PA9U0", "ExecuteScalar", "IServerUI", "MulticastDelegate", "AigxIbo0HFS0VycIKLV", "(oQ|G", "Ko8YpWR61D", "fYMEN3PVjr8tYCGmowY", "(Nu-y", "i0/c:dH-dP", "liGm#", "utFrQWXsGLgOaufmmDM", "SZWla5mfh99SCCyEQFQ", "remove_ItemDrag", "/FV+Y", "System.Windows.Forms.Layout", "0gRZn", "method_34", "FlushFinalBlock", "get_BytesTransferred", "SFU4mbT3GMret7THonf", "WTkf7osjtbIRcoDqn51", "Ggt8cNlma0LubqVlQhx", "uqOlUeGGyiaSEumZ6Ry1", "get_ExceptionText", "XVYJ5", "ToolStripItemRenderEventArgs", "DownloadString", "XUi5mqGY2CoErSaQ5To0", ",oiQ\"", "9:~pu", "YCQ5ZUGKCp5Y05kh7O5e", "UulpG1tvXYhxgdadeAL", "nKwUUkG4GbuiyFDsiKcT", "get_Panel1", "LbTxcfFZXA", "S `i9", "Yf79OcGeAOVwN0ym06Tf", "Ua7pS1Lnfg9bNcih2Vm", "X3if2Q9SktfSdXRj4uW", ":p;A'", "XJTxqG4WruNIgoShTEk", "sCahOspfKR", "E6JjdiJaeyLomaXREWl", "vD7qdf17Lv", "l\"K/c", "GeYyQo3ZGFYmyJGU2xh", "hBABdo5XWF", "9#8I7", "I1C7rfsY3sVMdWsabao", "MJrHfxBKZ84SllMOiH8", "L|'3", "pyMtH90wN76AddTYjS6", "FQsTMRcLjg", "RJd2WLUPnMTtY9MYhV1", "0@n-lW", "ea2IPYGCaXZTLhWw0J2R", "nepXvIGGaKS9vqESgHfA", "HoCFEQaZC", " -D\"y", "soRrP", "I3bvDW6GuD", "H9ZJCLb90p", "ctcXsyULUIA3AwUZMgE", "vwHeDl14SqSBElcw2X8", "QBIeEga5HF", "pNWPixqPLb", "pyHHiQsraLbCoheYvuE", "iTWKPDQUWIsQ0tH6G8", "rfDbs9GKqhDwV0rEGpgP", "(9MU=", "T[t_$A(=", "v^rKd*", "jsnjIUlPh7", "7+;\"cY", "get_Item", "ERtLVqdUeYgeuVynYqI", "ko'Juu}sY", "uVRi5WGX8yg5RUYxpvRw", "k6t7bCbOUi1Wkm6Aadm", "i6xqgUTsnp", "eowU7xFb79kHw309AIo", "PpgjSjr70f", "AUfyL8XrZ5", "Label26", "N2Rjv3yVAt3PhMj5eoJ", "TableLayoutRowStyleCollection", "MGd9QgGNENRskvXUPdRy", "ulye4ADdAE6ZS4mHxgT", "ylTRFmEtgF", ">~5", "LDODvawpppieqM7sTs7", "v0OqQwpWsvfl7o6qptJ", "V(_Z=v", "ItemDragEventHandler", "vlRnJhkBWB", "iqC0F4FKpKF83Wpd6On", "y*93[A", "WZGTJIkHWI", "SoXn'", "SdQOuyBcQ6", "x7lJ2dZPDSr8G79Kp5", "method_45", "{kDPn", "Ms$.'", "duCq6nUd9K", "set_ClientSize", "CK]9R", "Gjk0apUvWJ", "BGP5eCSBJr4loGGJUe7", "Rhe4Ryo97ZKGZVNQvU1", "@eNS7~#", "System.IO.Compression", "ColumnReorderedEventHandler", "S35or00lGjKiZZFEtuO", "mNk28OGLxFRaUCdnmNuM", "ArwhHRmZC5", "BJ/X*", "chyEj4bmqvEmeRie0S5", "gePHlShyFJfWMjv0VBy", "ax3DcXGkEAwpYa6sKRgs", "zJIXb", "elRvhvGn7ihlj6KUHFOc", "gc6343SIGR4mQhE95Yf", "k{y'&P", "C^m?JG", "rCJs4HGEDHB2hJRmvjWQ", "lBnHCwTc1a99TGGIAwd", "WOYWB6", "get_Key", "ListViewItemSelectionChangedEventHandler", "BpXPxghsTi", "dG5DcSt1wqevxMBS8oF", "iserverFileTransfer_0", "DL\\(m", " py7R;", "_i ?1", "[H%Z\"=", "dl1sRfm5wGJiVxZPEAj", "N6B6eMbYw6X0ixX63mV", "oVvJ8OGyRoGVdXy36ijd", "EXbBeJtY2K", "xQ5QGA4L1k", "POPVBFELBGKyjwH5ycl", "e7dLWHG4Kii3OC7qLTs6", "iEnT[\\b", "o75T5lGhibec2HYlNKD0", "R4i2FQtpCufJgv609hy", "eJ42Z", "E<)_M", "w1b092GXCWX5WHbG99tm", "@=)I!", "6,mC-", "ClHJwhiPdhkJT8RhZX7", "|ISd*I!-", "/]py/y", "axM2iB4pwq7sQmKDl0W", "eUtUJHG8PKUpV5vxCDMR", "plRb>X", "acHT9Hri68", "BottomRight", "W6SbB5G8FVTI2Q5tZ44E", "Um8ScPXhftxcpjWjrOt", "q0cj5gGYElF9gL6bDKqL", "get_Callback", "Button7", "A79N|", "iLoWhnw9VaQuPtuOAbZ", "xIBn4TIFAb", "z7fwfdbW0p", "FoJT2GZ7A4", "ToolStripControlHost", ";pF\"1H", "y\\DI\"I", "zTeI4Rl6QJNSaiXfsvQ", "omBf68eN5d", "Klg/s", "set_Minimum", "FuVcrbGm5IeG5cgUee7C", "iBc/%", "AxemHoEOahaJuDhJ8Gm", "cYfflBgq8O", "QuIYjxLg1yLxww4ClvG", "PortManagerPage", "aSZGJG59e2kSHPt0oh", "DR4IhaUW3", "jAnORRyVKU", "N#'!;^i*',x", "enC8VErXyo5AZHWIMII", "GControl4", "GClass23", "?G|hT", "\"PX,U", "kZn7SCHGULqAnXP1mLc", "c7vdyRG0Ca", "sI4w8bUDXZFIvGblKDx", "Xb7ORF2iWXvanVBRRoG", "KVwVV4OCoB25fN8j6Zy", "YQYs^", "TETBYqMPWG", "iLDb8gXDGN", "toolStripMenuItem_2", "|sP*@", "eQYiqnbCJq", "H0oEsbKH19scIN7wrw", "AssemblyDelaySignAttribute", "get_MainModule", "E*E6EIE]EpE", "Jo$ -D", "+m/0x", "RiDDMsGyf23NE9K9UdQS", "fR27N", "SkHfB7DpINLuKqNJpKi", "-( hi", "ke7ypLAK1M", "bI;q^S", "F0T7dxvKha1xngFQFtN", "'8-dH", "EeffoTGnkxWN4GBcH1KW", "Attribute", "QFMoZaFjCUOcg92s4kr", "Z/Xu_g", "s5 SXU|~", "lZ8ifMiKGK", "method", "RV}P`", "edaV^", "VoHvRxGn9QNB6RuDHYoT", "tolZGc9i2klEmfWU0YP", "hA_-&", "k9PAASGLDWKcthxfnUwD", "MEMd7IGRAwaDctOCfYn6", "S{$#l", "LpCsJfr0BUP6jMSB3iG", "mx* R", "Mlu4k1aZER5FHrqy8sn", "PortManagerAddForm", "q5dxBjIhtRTyWoIbCeu", "uUcoTCSnqWquIkkx5ZN", "set_Image", "ServerFileName", "PXyxnO5aBdtg257JcuJ", "tqSyTjxPeM", "LD~?Y", "sHfSOALZA2" ], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 0, "cape_type": "" } }, "procdump": [ { "name": "41aadfb791505cfdbc1cc8cec5346e64c46896a6778c737ead64f384b55d504e", "path": "/opt/CAPEv2/storage/analyses/42/procdump/41aadfb791505cfdbc1cc8cec5346e64c46896a6778c737ead64f384b55d504e", "guest_paths": "1;?C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\dw20.exe;?C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\dw20.exe;?", "size": 28672, "crc32": "99A06415", "md5": "9f49104a3abfa469ef8f494167117b37", "sha1": "c79e3f1c0d20218678b9442b044bbe0f63b5abab", "sha256": "41aadfb791505cfdbc1cc8cec5346e64c46896a6778c737ead64f384b55d504e", "sha512": "d4ff8b3372a203437f783392679189bcd2b04e2616b754c78ea3ca8aa21e5949b7895208377ddebb9c5060c6e3b54e3aa2a77d7ac34cd703cec82db569599ab2", "rh_hash": null, "ssdeep": "768:bm3EGjuzCMFspRmiuadnC8RGy8NoJIqkKaIgi:afpRLuadCV41aId", "type": "PE32 executable (GUI) Intel 80386, for MS Windows", "yara": [ { "name": "IsPE32", "meta": {}, "strings": [], "addresses": {} }, { "name": "IsWindowsGUI", "meta": {}, "strings": [], "addresses": {} }, { "name": "HasDebugData", "meta": { "author": "_pusher_", "description": "DebugData Check", "date": "2016-07" }, "strings": [], "addresses": {} }, { "name": "HasRichSignature", "meta": { "author": "_pusher_", "description": "Rich Signature Check", "date": "2016-07" }, "strings": [ "Rich" ], "addresses": { "a0": 224 } }, { "name": "Visual_Cpp_2005_Release_Microsoft", "meta": {}, "strings": [ "{ E8 84 06 00 00 E9 A2 FD FF FF }" ], "addresses": { "a": 16772 } }, { "name": "VC8_Microsoft_Corporation", "meta": {}, "strings": [ "{ E8 84 06 00 00 E9 A2 FD FF FF }", "{ E8 FB FE FF FF E9 DD FF FF FF }", "{ E8 EC FE FF FF E9 CE FF FF FF }" ], "addresses": { "a": 17059 } }, { "name": "Microsoft_Visual_Cpp_8", "meta": {}, "strings": [ "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000", "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000", "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000", "{ 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 1A A6 DC 9E 1A A6 DC 9E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }", "{ 00 00 00 00 00 00 02 00 00 00 00 00 00 00 1A A6 DC 9E 1A A6 DC 9E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }", "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000", "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000\u0000", "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000", "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0003\u0000\u0006\u0000\u0000", "{ E8 84 06 00 00 E9 A2 FD FF FF }" ], "addresses": { "a": 28590, "b": 16772 } } ], "cape_yara": [], "clamav": [], "tlsh": "T132D23D20774596BBE5B61730F96A92392AFD31226CB6950FA3661F0C3D785C3B438B13", "sha3_384": "f523d18a35a3f1bc7c0e8d912f62abb36a772e1d775d78667b69de112e924f3aa2438e213eb65bd3978ad0c7dcfeab02", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "pe": { "guest_signers": { "aux_sha1": null, "aux_timestamp": null, "aux_valid": false, "aux_error": true, "aux_error_desc": "No signature found.", "aux_signers": [] }, "digital_signers": [], "imagebase": "0x10000000", "entrypoint": "0x00004d84", "ep_bytes": "e884060000e9a2fdffffff255c110010", "peid_signatures": null, "reported_checksum": "0x00013ae9", "actual_checksum": "0x00011ce0", "osversion": "5.0", "machine_type": "IMAGE_FILE_MACHINE_I386", "pdbpath": "dw20.pdb", "imports": { "MSVCR80": { "dll": "MSVCR80.dll", "imports": [ { "address": "0x100010bc", "name": "_crt_debugger_hook" }, { "address": "0x100010c0", "name": "_controlfp_s" }, { "address": "0x100010c4", "name": "_invoke_watson" }, { "address": "0x100010c8", "name": "_decode_pointer" }, { "address": "0x100010cc", "name": "_onexit" }, { "address": "0x100010d0", "name": "_lock" }, { "address": "0x100010d4", "name": "__dllonexit" }, { "address": "0x100010d8", "name": "_unlock" }, { "address": "0x100010dc", "name": "_except_handler4_common" }, { "address": "0x100010e0", "name": "?terminate@@YAXXZ" }, { "address": "0x100010e4", "name": "__set_app_type" }, { "address": "0x100010e8", "name": "_encode_pointer" }, { "address": "0x100010ec", "name": "__p__fmode" }, { "address": "0x100010f0", "name": "__p__commode" }, { "address": "0x100010f4", "name": "_adjust_fdiv" }, { "address": "0x100010f8", "name": "__setusermatherr" }, { "address": "0x100010fc", "name": "_configthreadlocale" }, { "address": "0x10001100", "name": "_initterm_e" }, { "address": "0x10001104", "name": "_initterm" }, { "address": "0x10001108", "name": "__winitenv" }, { "address": "0x1000110c", "name": "exit" }, { "address": "0x10001110", "name": "_XcptFilter" }, { "address": "0x10001114", "name": "_exit" }, { "address": "0x10001118", "name": "_cexit" }, { "address": "0x1000111c", "name": "__wgetmainargs" }, { "address": "0x10001120", "name": "_amsg_exit" }, { "address": "0x10001124", "name": "iswspace" }, { "address": "0x10001128", "name": "memmove" }, { "address": "0x1000112c", "name": "_vscwprintf" }, { "address": "0x10001130", "name": "_vsnwprintf_s" }, { "address": "0x10001134", "name": "_wcsnicmp" }, { "address": "0x10001138", "name": "??_U@YAPAXI@Z" }, { "address": "0x1000113c", "name": "??_V@YAXPAX@Z" }, { "address": "0x10001140", "name": "_wtoi64" }, { "address": "0x10001144", "name": "??2@YAPAXI@Z" }, { "address": "0x10001148", "name": "??3@YAXPAX@Z" }, { "address": "0x1000114c", "name": "memset" }, { "address": "0x10001150", "name": "wcschr" }, { "address": "0x10001154", "name": "wcsrchr" }, { "address": "0x10001158", "name": "_wcsicmp" }, { "address": "0x1000115c", "name": "__CxxFrameHandler3" } ] }, "ADVAPI32": { "dll": "ADVAPI32.dll", "imports": [ { "address": "0x10001000", "name": "RegisterEventSourceW" }, { "address": "0x10001004", "name": "ReportEventW" }, { "address": "0x10001008", "name": "DeregisterEventSource" }, { "address": "0x1000100c", "name": "RegOpenKeyExW" }, { "address": "0x10001010", "name": "RegQueryValueExW" }, { "address": "0x10001014", "name": "RegCloseKey" } ] }, "KERNEL32": { "dll": "KERNEL32.dll", "imports": [ { "address": "0x1000101c", "name": "Sleep" }, { "address": "0x10001020", "name": "ReadProcessMemory" }, { "address": "0x10001024", "name": "GetTickCount" }, { "address": "0x10001028", "name": "WaitForMultipleObjects" }, { "address": "0x1000102c", "name": "GetModuleHandleW" }, { "address": "0x10001030", "name": "lstrlenA" }, { "address": "0x10001034", "name": "lstrlenW" }, { "address": "0x10001038", "name": "GetCommandLineW" }, { "address": "0x1000103c", "name": "GetSystemDirectoryW" }, { "address": "0x10001040", "name": "LoadLibraryW" }, { "address": "0x10001044", "name": "GetProcAddress" }, { "address": "0x10001048", "name": "CreateThread" }, { "address": "0x1000104c", "name": "SetThreadStackGuarantee" }, { "address": "0x10001050", "name": "MapViewOfFile" }, { "address": "0x10001054", "name": "GetUserDefaultUILanguage" }, { "address": "0x10001058", "name": "MultiByteToWideChar" }, { "address": "0x1000105c", "name": "Module32FirstW" }, { "address": "0x10001060", "name": "CreateToolhelp32Snapshot" }, { "address": "0x10001064", "name": "GetProcessId" }, { "address": "0x10001068", "name": "SetEnvironmentVariableW" }, { "address": "0x1000106c", "name": "GetCurrentProcess" }, { "address": "0x10001070", "name": "Module32NextW" }, { "address": "0x10001074", "name": "InterlockedExchange" }, { "address": "0x10001078", "name": "InterlockedCompareExchange" }, { "address": "0x1000107c", "name": "SetUnhandledExceptionFilter" }, { "address": "0x10001080", "name": "QueryPerformanceCounter" }, { "address": "0x10001084", "name": "GetCurrentThreadId" }, { "address": "0x10001088", "name": "GetCurrentProcessId" }, { "address": "0x1000108c", "name": "GetSystemTimeAsFileTime" }, { "address": "0x10001090", "name": "TerminateProcess" }, { "address": "0x10001094", "name": "UnhandledExceptionFilter" }, { "address": "0x10001098", "name": "IsDebuggerPresent" }, { "address": "0x1000109c", "name": "SetEvent" }, { "address": "0x100010a0", "name": "GetLastError" }, { "address": "0x100010a4", "name": "UnmapViewOfFile" }, { "address": "0x100010a8", "name": "ReleaseMutex" }, { "address": "0x100010ac", "name": "CloseHandle" }, { "address": "0x100010b0", "name": "WaitForSingleObject" }, { "address": "0x100010b4", "name": "OpenThread" } ] }, "USER32": { "dll": "USER32.dll", "imports": [ { "address": "0x1000116c", "name": "LoadStringW" } ] }, "VERSION": { "dll": "VERSION.dll", "imports": [ { "address": "0x10001174", "name": "GetFileVersionInfoW" }, { "address": "0x10001178", "name": "VerQueryValueW" }, { "address": "0x1000117c", "name": "GetFileVersionInfoSizeW" } ] }, "PSAPI": { "dll": "PSAPI.DLL", "imports": [ { "address": "0x10001164", "name": "GetModuleFileNameExW" } ] } }, "exported_dll_name": null, "exports": [], "dirents": [ { "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "virtual_address": "0x0000608c", "size": "0x0000008c" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "virtual_address": "0x00008000", "size": "0x00000874" }, { "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "virtual_address": "0x00006a00", "size": "0x000023a8" }, { "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "virtual_address": "0x000011a0", "size": "0x0000001c" }, { "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_TLS", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "virtual_address": "0x000014c0", "size": "0x00000040" }, { "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IAT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESERVED", "virtual_address": "0x00000000", "size": "0x00000000" } ], "sections": [ { "name": ".text", "raw_address": "0x00000400", "virtual_address": "0x00001000", "virtual_size": "0x00006000", "size_of_data": "0x00005a00", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xe0000020", "entropy": "6.24" }, { "name": ".data", "raw_address": "0x00005e00", "virtual_address": "0x00007000", "virtual_size": "0x00001000", "size_of_data": "0x00000600", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "0.63" }, { "name": ".rsrc", "raw_address": "0x00006400", "virtual_address": "0x00008000", "virtual_size": "0x00001000", "size_of_data": "0x00000c00", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "3.89" } ], "overlay": null, "resources": [ { "name": "RT_STRING", "offset": "0x00008118", "size": "0x00000162", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.90" }, { "name": "RT_STRING", "offset": "0x0000827c", "size": "0x0000006c", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.43" }, { "name": "RT_VERSION", "offset": "0x000082e8", "size": "0x000003c8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.52" }, { "name": "RT_MANIFEST", "offset": "0x000086b0", "size": "0x000001c1", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "5.01" } ], "versioninfo": [ { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Microsoft .NET Error Reporting Shim" }, { "name": "FileVersion", "value": "2.0.50727.9149 (WinRelRS6.050727-9100)" }, { "name": "InternalName", "value": "dw20.exe" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. All rights reserved." }, { "name": "OriginalFilename", "value": "dw20.exe" }, { "name": "ProductName", "value": "Microsoft® .NET Framework" }, { "name": "ProductVersion", "value": "2.0.50727.9149" }, { "name": "Comments", "value": "Flavor=Retail" }, { "name": "Translation", "value": "0x0409 0x04b0" } ], "imphash": "99c2283e16a84760f7d38eab01642407", "timestamp": "2019-10-25 08:48:29", "icon": null, "icon_hash": null, "icon_fuzzy": null, "icon_dhash": null, "imported_dll_count": 6 }, "data": null, "strings": [ "4=ylL=_", "unknown", "USER32.dll", "??_U@YAPAXI@Z", "040904B0", "Application Name ", "_wcsicmp", "MSVCR80.dll", "GetCurrentProcess", "SetEnvironmentVariableW", "CreateThread", "ReleaseMutex", "__winitenv", "Ios[Hos", "memset", "RegQueryValueExW", "\\VarFileInfo\\Translation", "RegOpenKeyExW", "RegisterEventSourceW", "_except_handler4_common", "nsgFns=", "RegCloseKey", "__CxxFrameHandler3", "drwtsn32", "4=ylH=_", "InternalName", "PSVW3", "_encode_pointer", "CloseHandle", "MapViewOfFile", "KERNEL32.dll", "_XcptFilter", "Mutex while in notify loop", "Fault Module Name ", "__wgetmainargs", "??_V@YAXPAX@Z", "MultiByteToWideChar", "Debugger", "ReadProcessMemory", "Exception Offset ", "UnmapViewOfFile", "moddir", "Flavor=Retail", "WerReportSetParameter", "Module32NextW", "Application Timestamp ", "LegalCopyright", "VarFileInfo", "WerReportCloseHandle", "GetCurrentThreadId", "LoadLibraryW", "appdir", "wcsrchr", "??3@YAXPAX@Z", "CompanyName", "_exit", "SetUnhandledExceptionFilter", "__p__commode", "_vscwprintf", "WerReportAddDump", "FileVersion", "Notification handles", "GetFileVersionInfoW", "SetThreadStackGuarantee", "??2@YAPAXI@Z", "__dllonexit", "__set_app_type", "qs JosIqos", "_crt_debugger_hook", ".text", "LoadStringW", "wcschr", "2.0.50727.9149", "GetCommandLineW", "StringFileInfo", "iswspace", "_amsg_exit", "GetUserDefaultUILanguage", "GetCurrentProcessId", "ProductVersion", "TerminateProcess", "ReportEventW", "GetSystemTimeAsFileTime", " Microsoft Corporation. All rights reserved.", "FileDescription", "_controlfp_s", "HtZHu", "__p__fmode", "WaitForSingleObject", "GetModuleHandleW", "WerReportAddFile", "lstrlenW", "GWPCS", "APPCRASH", ".data", ".rsrc", "!This program cannot be run in DOS mode.", "ADVAPI32.dll", "QueryPerformanceCounter", "WerReportCreate", "SetEvent", "DeregisterEventSource", "UnhandledExceptionFilter", "ProductName", "_invoke_watson", "_decode_pointer", " .NET Framework", "_initterm", "Application Error", "GetSystemDirectoryW", "RSDSQF", "VERSION.dll", "memmove", "WaitForMultipleObjects", "drwatson", "e\\wer.dll", "GetFileVersionInfoSizeW", "VtAHt", "Microsoft .NET Error Reporting Shim", "PSAPI.DLL", "GetProcAddress", "_unlock", "FHPj8", "GetLastError", "__setusermatherr", "nsb+ns9 ns", "Translation", "OriginalFilename", "bad allocation", "VVVVV", "GetProcessId", "OpenThread", "%General_AppName%", "_vsnwprintf_s", "2.0.50727.9149 (WinRelRS6.050727-9100)", "Fault Module Timestamp ", "Application Version ", "?terminate@@YAXXZ", "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug", "%d.%d.%d.%d", "\\StringFileInfo\\%04x%04x\\%s", "Exception Code ", "CreateToolhelp32Snapshot", "f98t7", "VS_VERSION_INFO", "_onexit", "GetTickCount", "dw20.pdb", "os Sos", "IsDebuggerPresent", "f98t.", "_lock", "Sleep", "PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD", "Microsoft", "InterlockedCompareExchange", "dw20.exe", "Comments", "Module32FirstW", "Microsoft Corporation", "InterlockedExchange", "_wcsnicmp", "_configthreadlocale", "lstrlenA", "GetModuleFileNameExW", "WerReportSubmit", "Y__^[", "4=ylZ=T", "_wtoi64", "VerQueryValueW", "Fault Module Version ", "Stopped working", "_adjust_fdiv", "_initterm_e", "4=Rich^", "WerReportSetUIOption", "_cexit" ], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 1, "cape_type": "", "process_path": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\dw20.exe", "process_name": "dw20.exe", "module_path": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\dw20.exe", "pid": 3832 } ], "CAPE": { "payloads": [ { "name": "9c5081d0edccacc1efd6579e5076ca888a0cb1ba5e338c4716a471729d425336", "path": "/opt/CAPEv2/storage/analyses/42/CAPE/9c5081d0edccacc1efd6579e5076ca888a0cb1ba5e338c4716a471729d425336", "guest_paths": "9;?C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe;?C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe;?0x02F70000;?", "size": 21, "crc32": "B0B5AEF7", "md5": "7e3fd3b1c52ef864300309a100f326b3", "sha1": "6743e47f4195b3f003b895af8299603b447b8f9e", "sha256": "9c5081d0edccacc1efd6579e5076ca888a0cb1ba5e338c4716a471729d425336", "sha512": "5b4972750837f9dec646ea86d72c3853d94ea80cab133ef8cf3e7528be3c6793144277c5c3e2d4eea4bf58afc6cb8650f5d71a345bf4ea09572ca7185286d9fa", "rh_hash": null, "ssdeep": "3:pSl3+:8U", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": null, "sha3_384": "fde328ba1bae94265af3aabe140505d595db1b11ada2b334b00c919ff3b85ba862b8dfd92ff880f4fdeefa928f9a9bf9", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": null, "strings": [], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 9, "cape_type": "Unpacked Shellcode", "process_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe", "process_name": "NanoCore.exe", "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe", "pid": 7684, "virtual_address": "0x02F70000" }, { "name": "263a6494a70b1f92ad33ea287eccd6e216498a709c6a5719167942e06d329d8d", "path": "/opt/CAPEv2/storage/analyses/42/CAPE/263a6494a70b1f92ad33ea287eccd6e216498a709c6a5719167942e06d329d8d", "guest_paths": "9;?C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe;?C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe;?0x07EC0000;?", "size": 844, "crc32": "63E1CB5B", "md5": "980f50f12e31562ce740375eb3d309c4", "sha1": "087ee96d860c053a2da4d55852d1bb10829f67a0", "sha256": "263a6494a70b1f92ad33ea287eccd6e216498a709c6a5719167942e06d329d8d", "sha512": "847b93f2b5e89b3a6c20f152b4409e3b00a07768bfbbb8733c10c7db079db551e68275a1a8b199c503a38616d8073d4a239d1f8cf9ff5e46d3cef68091f1617f", "rh_hash": null, "ssdeep": "12:Xkow+u/IxNpuiZATjGDwhGRkRSl4RlGjw0o2u/4KpWLZVfIhLli+u/QtocwuRTlB:X1uPhTiD6GR9l4TGjWwz9JBoaIE0n", "type": "Windows boot log, header size 0x7ec0000, 0x1 valid bytes", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1ED01BD4F1BC450A5CC88D0FB5569E387EA1D827A6252A5B5DA6C72B0263CAE4249D072", "sha3_384": "8ca96ce8c78cb93cbd0cfe27075dcf285892d2579f20e22bd070937d59e7e33732c5e2658b9a060959420b5846193a28", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": null, "strings": [ "kXPRV", "Pj0h|", "8~sUSVW", "PRh`9~sUSVW" ], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 9, "cape_type": "Unpacked Shellcode", "process_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe", "process_name": "NanoCore.exe", "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe", "pid": 7684, "virtual_address": "0x07EC0000" }, { "name": "492405dd52974c0a6af2eecee33f3534ca32947fc3f0358a3e283886c9e89acc", "path": "/opt/CAPEv2/storage/analyses/42/CAPE/492405dd52974c0a6af2eecee33f3534ca32947fc3f0358a3e283886c9e89acc", "guest_paths": "9;?C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe;?C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe;?0x08020000;?", "size": 825, "crc32": "A06F2E76", "md5": "22da360861bfd4848de36bd865ef5a48", "sha1": "b4b39e5945d1a0be2c58d20b83f0175257e21473", "sha256": "492405dd52974c0a6af2eecee33f3534ca32947fc3f0358a3e283886c9e89acc", "sha512": "298331a1a5f4b3acae090640d2d767853f0c0fc806d5aadd3ca76db50d5d523891e17b47957106f655603e35974b4169d980e412181d815e80c7d936c5025fed", "rh_hash": null, "ssdeep": "12:HFwQlvrnQ9CJECIgXSecd/s8XLfxBL384Yv7NktCr2LocUs3QmvEPRG:1v/pI+6/3XT78HWgKLyTmas", "type": "Matlab v4 mat-file (little endian) \\230\\3370\\001\\, numeric, rows 134348800, columns 65536, imaginary (1)", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T147012083DB17A4B6D04B62F00162FBB2E5B59D46253F0F8823BA9DD03C7802553C66C1", "sha3_384": "c86cf165fc05de9e2fa016ee73db40f6d69409d14a4550122c8342d4991d07d1925d91ed7dbc19554d06a0b79b3c1d2b", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": null, "strings": [], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 9, "cape_type": "Unpacked Shellcode", "process_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe", "process_name": "NanoCore.exe", "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe", "pid": 7684, "virtual_address": "0x08020000" }, { "name": "cb8b0403fbdc0da56c6e048cecba3ba5f7a294d4afdc2ea5b42584c27a264e82", "path": "/opt/CAPEv2/storage/analyses/42/CAPE/cb8b0403fbdc0da56c6e048cecba3ba5f7a294d4afdc2ea5b42584c27a264e82", "guest_paths": "9;?C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe;?C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe;?0x00B10000;?", "size": 536, "crc32": "77C338CA", "md5": "f905cd35858da9305a541be9b5693cc0", "sha1": "4e059e428b6b1de25fdaf7829cda1404dce8821c", "sha256": "cb8b0403fbdc0da56c6e048cecba3ba5f7a294d4afdc2ea5b42584c27a264e82", "sha512": "2c93a697349b0f54842f733bb8de3f716ec56f1841d9c9d302dad37d2d9013a8038ffb06a02c12adee0dbdfa6fe22dd846ccaa6013f92757a5886a080b373ed3", "rh_hash": null, "ssdeep": "6:idqGVg3F+X32QlwXo2ONs02//ad7/iH9cq4/Id5:etGSGQlwXo26WXadzHj25", "type": "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows", "yara": [ { "name": "IsPE32", "meta": {}, "strings": [], "addresses": {} }, { "name": "IsWindowsGUI", "meta": {}, "strings": [], "addresses": {} }, { "name": "IsBeyondImageSize", "meta": { "author": "_pusher_", "date": "2016-07", "description": "Data Beyond ImageSize Check" }, "strings": [], "addresses": {} } ], "cape_yara": [], "clamav": [], "tlsh": "T183F0C283BBA458BBC028037A4283AD4831BE1B380F61910B0EA0113F786216455B97C0", "sha3_384": "1de05cbc9d03ea5327545b7b78cf8c772b4ee8bd73ccb7d20b602f7fd9a2b36b9b00d37f0148cf2c81f04560c50464ec", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "pe": { "guest_signers": { "aux_sha1": null, "aux_timestamp": null, "aux_valid": false, "aux_error": true, "aux_error_desc": "No signature found.", "aux_signers": [] }, "digital_signers": [], "imagebase": "0x00400000", "entrypoint": "0x0015d0ce", "ep_bytes": "", "peid_signatures": null, "reported_checksum": "0x00000000", "actual_checksum": "0x0000a872", "osversion": "4.0", "machine_type": "IMAGE_FILE_MACHINE_I386", "pdbpath": null, "imports": {}, "exported_dll_name": null, "exports": [], "dirents": [ { "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "virtual_address": "0x0015d080", "size": "0x0000004b" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "virtual_address": "0x00160000", "size": "0x000049d8" }, { "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "virtual_address": "0x00166000", "size": "0x0000000c" }, { "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_TLS", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IAT", "virtual_address": "0x00002000", "size": "0x00000008" }, { "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "virtual_address": "0x00002008", "size": "0x00000048" } ], "sections": [ { "name": ".text", "raw_address": "0x00000400", "virtual_address": "0x00002000", "virtual_size": "0x0015b0d4", "size_of_data": "0x0015b200", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "0.00" }, { "name": ".sdata", "raw_address": "0x0015b600", "virtual_address": "0x0015e000", "virtual_size": "0x000001e8", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "0.00" }, { "name": ".rsrc", "raw_address": "0x0015b800", "virtual_address": "0x00160000", "virtual_size": "0x000049d8", "size_of_data": "0x00004a00", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "0.00" }, { "name": ".reloc", "raw_address": "0x00160200", "virtual_address": "0x00166000", "virtual_size": "0x0000000c", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x42000040", "entropy": "0.00" } ], "overlay": { "offset": "0x00000178", "size": "0x000000a0" }, "resources": [], "versioninfo": [], "imphash": "", "timestamp": "2015-07-01 07:55:53", "icon": null, "icon_hash": null, "icon_fuzzy": null, "icon_dhash": null }, "data": null, "strings": [ "!This program cannot be run in DOS mode.", "`.sdata", "@.reloc", ".rsrc", ".text" ], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "selfextract": { "overlay": { "extracted_files": [ { "name": "a67d08b6d561773840fdb8bcacdde7ba2ad7a8446cebdd9dc7416ae978dbdd70", "path": "/opt/CAPEv2/storage/analyses/42/selfextracted/a67d08b6d561773840fdb8bcacdde7ba2ad7a8446cebdd9dc7416ae978dbdd70", "guest_paths": [ "overlay" ], "size": 160, "crc32": "622436FF", "md5": "e3d4837cce811d8db6381c974df0f481", "sha1": "591c840e17f916509796475cb53422ff3de02d59", "sha256": "a67d08b6d561773840fdb8bcacdde7ba2ad7a8446cebdd9dc7416ae978dbdd70", "sha512": "52b03fdc5019a1095fcd6d7d16b1760f4085acb8aaaccd21150bcde65a22aca0267c5727cf135be3347ad361b90a90893b4d2df3808132b2469da0cb906b9fca", "rh_hash": null, "ssdeep": "3:ilf7/lllltFiCEFEIlSlJZ/8le/7cdFx//1:id7/iH9cq4/Id5", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T16EC012937B611123C411067980C2250475BC53301D25204F4D651061346015068B63C0", "sha3_384": "0398033c0dd80a0e094b9c2893036061247fc347aed550596f0077a0b3f15cfec391fc6b691dfea9f21cabea7f96568d", "data": null } ], "extracted_files_time": 0.0023010169970802963, "password": "" } }, "cape_type_code": 9, "cape_type": "Unpacked Shellcode: 32-bit executable", "process_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe", "process_name": "NanoCore.exe", "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe", "pid": 7684, "virtual_address": "0x00B10000" }, { "name": "064ec728231780bebf305dc752c6dbeca6cb311f53dec5a57657cd7d5a42f2a9", "path": "/opt/CAPEv2/storage/analyses/42/CAPE/064ec728231780bebf305dc752c6dbeca6cb311f53dec5a57657cd7d5a42f2a9", "guest_paths": "9;?C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe;?C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe;?0x7F550000;?", "size": 44, "crc32": "DF43BF57", "md5": "323fa4ac3cfca4d00ad5d478a70b0b22", "sha1": "600b38be261cc37e2344ce5bc57cd6ad69ed832e", "sha256": "064ec728231780bebf305dc752c6dbeca6cb311f53dec5a57657cd7d5a42f2a9", "sha512": "a6d9742460b7a6fc3ecb27812092ae9ec34163e26ca85d4b538a39b4b2ccdbdb49c72128110ad2a3bb2978844ec655dba2cca4e6445dbd798ff572545663077d", "rh_hash": null, "ssdeep": "3:Uaql/stl+ClrxlvLlXf:UF/sX+mXv5", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": null, "sha3_384": "2f0992b7985ab64371a06839435ae2b63c8fc37f942a8547ed9636ee8919ef42cbae60d64ce51659a671f2c0df229989", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": null, "strings": [], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 9, "cape_type": "Unpacked Shellcode", "process_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe", "process_name": "NanoCore.exe", "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe", "pid": 7684, "virtual_address": "0x7F550000" }, { "name": "cc1ac7194daa2648e44bdd561a682e0e9ed3c808978b881348f8a4080d151f19", "path": "/opt/CAPEv2/storage/analyses/42/CAPE/cc1ac7194daa2648e44bdd561a682e0e9ed3c808978b881348f8a4080d151f19", "guest_paths": "9;?C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe;?C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe;?0x02F6A000;?", "size": 534, "crc32": "F3DF47EB", "md5": "9558ae86d97d54270b214e5cbcc7e469", "sha1": "0dc551d1dd604c43b7a3c22f6549aad025420a7b", "sha256": "cc1ac7194daa2648e44bdd561a682e0e9ed3c808978b881348f8a4080d151f19", "sha512": "0690414acb747b97cbab0417ac1f4395238c65b4f50e17baa24699a97b8aa1e2af49fe1bc5ca4b8957c0ef6610842a253c1eb579a771b0a9a99de7fce931f4c0", "rh_hash": null, "ssdeep": "6:7x3lOIGYUi5phKp9lM/gAEHsQsYHo2l1aB3LXXlM252VgbPo2lM/q8unKpWArY6m:7FXG9u/WBf1G3TlM204Po2u/4KpWdZk4", "type": "Matlab v4 mat-file (little endian) 3, numeric, rows 49717248, columns 8192", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1E3F09E17070080F6DC58D6FA0A6EE7DBEE8D112D61E0A685CF2CE07325362E4A021111", "sha3_384": "e1cd875aedd80f4e2e149a15023529abd92fd23a808d867037b4e084b85415bd93779bda434470ede38a4726a6efbf45", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": null, "strings": [ "~sUSVW", "PRh`9~sUSVW", "PRhX<~sUSVW" ], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 9, "cape_type": "Unpacked Shellcode", "process_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe", "process_name": "NanoCore.exe", "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe", "pid": 7684, "virtual_address": "0x02F6A000" }, { "name": "d9a05b5e933480cb3a0a75e9adf8cbc2c8f30ab0308ace4f6da94281910a9880", "path": "/opt/CAPEv2/storage/analyses/42/CAPE/d9a05b5e933480cb3a0a75e9adf8cbc2c8f30ab0308ace4f6da94281910a9880", "guest_paths": "9;?C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe;?C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe;?0x07C60000;?", "size": 823, "crc32": "81EDBB10", "md5": "b1813a782b6c965c53bf836d792273b8", "sha1": "69cb3f99a847ddd904540d337140879de3ea0acd", "sha256": "d9a05b5e933480cb3a0a75e9adf8cbc2c8f30ab0308ace4f6da94281910a9880", "sha512": "0902d0d6f5f45c84d6da50d95e9ebcbc78e2098cb2fd9ff053270edd6222aa41f134a8a573ecc0b1944d19417742c3a4f79936a5b0bc20155abfc53d6a6b0d2f", "rh_hash": null, "ssdeep": "12:OuBKJEDX9RbBu3bIKtn1lfg4dsAs6ZTPIS2iU8i4HI9n1gVawlPPaRBKMZ/L1Q:NoETrB+8Kd1lflVv9i4uywwURQ", "type": "Windows boot log, header size 0x7c60000, 0x1 valid bytes", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T16B0149A415DBE7FED644EC389484C0F83969D917519DCBC65AD668ECD806C35700225D", "sha3_384": "ce0e1e7d531b8ea01a8976a7476ab6bfd3f33ac70ed3784673298b7dd013d987b3b6cb2fb83210c0e124b82deb13ab7b", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": null, "strings": [ ";7`k]" ], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 9, "cape_type": "Unpacked Shellcode", "process_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe", "process_name": "NanoCore.exe", "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe", "pid": 7684, "virtual_address": "0x07C60000" }, { "name": "fdc26f772969ee511a5d7efb14854e93192cc93a5a5a06677795c676b7b02b91", "path": "/opt/CAPEv2/storage/analyses/42/CAPE/fdc26f772969ee511a5d7efb14854e93192cc93a5a5a06677795c676b7b02b91", "guest_paths": "9;?C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe;?C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe;?0x05730000;?", "size": 4094, "crc32": "126EAF48", "md5": "fc150ad0e2720e84eb59e44730595b4b", "sha1": "dfa7a10c0446078a6f87a04edbe069e8f6b35795", "sha256": "fdc26f772969ee511a5d7efb14854e93192cc93a5a5a06677795c676b7b02b91", "sha512": "786701a4832c86f290a1621085eb6784ea1ea5205237c8a5a24450afe9776a421db12d84e9cdc9834825b926cd1335e6e52a49c644e4e8b3b6c0f2238a1ddefa", "rh_hash": null, "ssdeep": "12:H8CvZsjnZR26YCwEO7hwgfttBtpQux3KoyKbN3s5fIn4D5H3Z51H:H8SqnZRwCi7tvx3HRbMfI2F3H1H", "type": "DOS executable (COM), start instruction 0xeb4a5b84 2a4c0001", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T19281FEDC9E00866CCC17D6313D3E0B12181DC3CAA5847E884D4C97A30D3A66435F1714", "sha3_384": "fb0dc91e6d355c1c24425e83e7670a6322549375a075762df28ab1415cc7cb5154f94615296e7e9c6d7292dbc5f7287e", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": null, "strings": [ "<~sUSVW", ";~sUSVW", "PPPPPhZ" ], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 9, "cape_type": "Unpacked Shellcode", "process_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe", "process_name": "NanoCore.exe", "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe", "pid": 7684, "virtual_address": "0x05730000" }, { "name": "fffd2718e42793784f270c7cf9e47d11004eb3eebfe45efc1e8a52c87ea86373", "path": "/opt/CAPEv2/storage/analyses/42/CAPE/fffd2718e42793784f270c7cf9e47d11004eb3eebfe45efc1e8a52c87ea86373", "guest_paths": "9;?C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe;?C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe;?0x08290000;?", "size": 15341, "crc32": "1D98DC48", "md5": "74eebdae7abe3cf3319591eb98b7d844", "sha1": "aff81561ff45f8e016c5e73bd70e59cfd19a85b0", "sha256": "fffd2718e42793784f270c7cf9e47d11004eb3eebfe45efc1e8a52c87ea86373", "sha512": "564bb330ef833f6894dcc7f1610d5afd8e604b8479b85daad0d40ca9fa9c2be85fa789858e458b5ab9ece6391adc4eba8c3c0fd23ca5c15473ae66a35b0a4ec2", "rh_hash": null, "ssdeep": "384:N195uEofViSnbUQUbP22SpaboZk9maiG1buVVvreMfQLZzXJc:d8NWNmQtiObWXQA", "type": "Matlab v4 mat-file (little endian) \\230\\3360\\001\\, numeric, rows 136904704, columns 65536, imaginary (1)", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T12B624E208771E777C62A65B27F4E8ABD0431AE36D841C0AAF4562F7AF13C6E49980357", "sha3_384": "7277b13162173e0821f05d2f855456b751ef7f1d9bd519ca7935ac1da003ea2da955d3ec51299a7e7d7a281fc0601688", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": null, "strings": [], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 9, "cape_type": "Unpacked Shellcode", "process_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe", "process_name": "NanoCore.exe", "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe", "pid": 7684, "virtual_address": "0x08290000" }, { "name": "05f88a29590f0789f1239f3d205c6799ff3f18dbfcf11b69b7f97ab2ca399056", "path": "/opt/CAPEv2/storage/analyses/42/CAPE/05f88a29590f0789f1239f3d205c6799ff3f18dbfcf11b69b7f97ab2ca399056", "guest_paths": "9;?C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe;?C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe;?0x09EE0000;?", "size": 2141, "crc32": "32DCBD98", "md5": "22eac65ac942b1bcd910c4ff589ab917", "sha1": "8c38b90e94298131e8a0c0b01cbb29c5b01515f8", "sha256": "05f88a29590f0789f1239f3d205c6799ff3f18dbfcf11b69b7f97ab2ca399056", "sha512": "c6b5c13616cb9cded1a2a196b011fb5da9192f0a1a95f37c43c80d7ca5b874d5c453cee16c394961e27442a1a0dab08e19a22f9249e8cd22fafaa53791200eb8", "rh_hash": null, "ssdeep": "12:F8las0OJ+SgjG2qXae0bCS23Wa4TOLxiNYZaYb7gVOPlxE4OGloiP4nXLCM7qbqr:F8la++SKqIbCbWanxJAYbc8dFZAT7qQn", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T18A410226E1386250C0115A3F9F67872043519D1B5542DBAE4308FD7D9DD25B811E62CC", "sha3_384": "3d673b4b3b66c0a0cee09dc602b25d005784d72c52ccfb9d3b6558cf5293efdd27d189877c6ca34bfd53ca47da5a256a", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": null, "strings": [ "! #!%\"'#)$+%-&/'1(3)5*7+9,;-=.?/A0E1I2M3Q4U5Y6]7a8e9i:m;q}?" ], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 9, "cape_type": "Unpacked Shellcode", "process_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe", "process_name": "NanoCore.exe", "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe", "pid": 7684, "virtual_address": "0x09EE0000" }, { "name": "0b9c693217bdc314aa3dbf7363ef6ae8d0c4104a4e3b3ce52602eb1224e7c260", "path": "/opt/CAPEv2/storage/analyses/42/CAPE/0b9c693217bdc314aa3dbf7363ef6ae8d0c4104a4e3b3ce52602eb1224e7c260", "guest_paths": "9;?C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe;?C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe;?0x05730000;?", "size": 8190, "crc32": "4BCBC51D", "md5": "daa146b7b35ae2c9b1dee8268ecd760f", "sha1": "b71938b16b52251588724be25b6b9122b8132345", "sha256": "0b9c693217bdc314aa3dbf7363ef6ae8d0c4104a4e3b3ce52602eb1224e7c260", "sha512": "e712fd1b9cee2489141f418b6c28dacd45b77a123e304ea30cbe1e49d30fd5f8cea92de6f5309400aa0b2fd6d0927c9e51eb8f17dffbac10a816cd5622cb367c", "rh_hash": null, "ssdeep": "48:xj7XBs3NNk03K2h2jpa0wq1P2HkWOXOGbjSbS3v:x/xJ03bh2jpaY1P2HRbS3v", "type": "DOS executable (COM), start instruction 0xeb4a5b84 2a4c0001", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T136F151C4DF218125E01FD731388E0320E72CE2A99368794DCE44C5B73D362F27A97508", "sha3_384": "ecef52918b7360439a4a8460151aeffbf51523c83adf6e34184d1f3505330d05c774a8f05703cd55340e1a9a27cb663d", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": null, "strings": [ "^J[1)L", ";~sUSVW", "PPPPPhZ", "HJ['!L", "~sUSVW", "<~sUSVW" ], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 9, "cape_type": "Unpacked Shellcode", "process_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe", "process_name": "NanoCore.exe", "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe", "pid": 7684, "virtual_address": "0x05730000" } ], "configs": [] }, "info": { "version": "2.5", "started": "2026-04-16 22:58:10", "ended": "2026-04-16 23:00:52", "duration": 162, "id": 42, "category": "file", "custom": "", "machine": { "id": 35, "status": "stopping", "name": "win10x64", "label": "win10x64", "platform": "windows", "manager": "KVM", "started_on": "2026-04-16 22:58:10", "shutdown_on": "2026-04-16 23:00:52" }, "package": "exe", "timeout": false, "tlp": null, "parent_sample": { "id": 23, "file_size": 13850813, "file_type": "7-zip archive data, version 0.3", "md5": "a17189d956c6d1975717256a6e6418cb", "crc32": "97AFA081", "sha1": "970e16de1d07a90dd285e84b59c0a77e8992ed9f", "sha256": "f9cef6944196d5d27ca99a9c6287d9718b658add797e9cb770789a0c4dbf2bcd", "sha512": "3105fa5d4d6914fe69f4d4ab9e517eab55d225bbdfa199f37f3c9f103805b1b5c587fe5e985a87ea60e2e7d511a0f872619343014233791ef63859130065e9f1", "ssdeep": null, "source_url": null }, "options": {}, "source_url": null, "route": "", "user_id": 0, "CAPE_current_commit": "a9a0887dab232f52c59e955b9984dd494c47ce6b" }, "behavior": { "processes": [ { "process_id": 7684, "process_name": "NanoCore.exe", "parent_id": 7304, "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe", "first_seen": "2026-04-16 19:59:50,799", "calls": [ { "timestamp": "2026-04-16 19:59:51,502", "thread_id": "4344", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-04-16 19:59:51,502", "thread_id": "7688", "caller": "0x77ea64d6", "parentcaller": "0x77ea63e1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1 }, { "timestamp": "2026-04-16 19:59:51,502", "thread_id": "7688", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-04-16 19:59:51,502", "thread_id": "1168", "caller": "0x77ea64d6", "parentcaller": "0x77ea63e1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3 }, { "timestamp": "2026-04-16 19:59:51,502", "thread_id": "1168", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-04-16 19:59:51,502", "thread_id": "5476", "caller": "0x77ea64d6", "parentcaller": "0x77ea63e1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 5 }, { "timestamp": "2026-04-16 19:59:51,502", "thread_id": "5476", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-04-16 19:59:51,502", "thread_id": "176", "caller": "0x77ea64d6", "parentcaller": "0x77ea63e1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7 }, { "timestamp": "2026-04-16 19:59:51,502", "thread_id": "176", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x7418ec20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741ac000" }, { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x77261d96", "parentcaller": "0x77266176", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ADVAPI32.dll" }, { "name": "BaseAddress", "value": "0x76ea0000" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "RegOpenKeyExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76ebe9b0" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x7418ec20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741ac000" }, { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x7417ed49", "parentcaller": "0x7416dccc", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework\\Policy\\" }, { "name": "Handle", "value": "0x00000240" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework\\Policy\\" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x7418ec20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741ac000" }, { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "RegQueryInfoKeyW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76ebeb00" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x7418ec20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741ac000" }, { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x7417e980", "parentcaller": "0x7417ed5c", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "5" }, { "name": "MaxSubKeyLength", "value": "9" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x7418ec20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741ac000" }, { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "RegEnumKeyExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76ebead0" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x7418ec20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741ac000" }, { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x7417e9f7", "parentcaller": "0x7417ed5c", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" }, { "name": "Index", "value": "4" }, { "name": "Name", "value": "v4.0" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\policy\\v4.0" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x7417e9f7", "parentcaller": "0x7417ed5c", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" }, { "name": "Index", "value": "3" }, { "name": "Name", "value": "v2.0" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\policy\\v2.0" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x7417e9f7", "parentcaller": "0x7417ed5c", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "Upgrades" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\policy\\Upgrades" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x7417e9f7", "parentcaller": "0x7417ed5c", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "standards" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\policy\\standards" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x7417e9f7", "parentcaller": "0x7417ed5c", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "AppPatch" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\policy\\AppPatch" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x7417edb8", "parentcaller": "0x7416dccc", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000240" }, { "name": "SubKey", "value": "v4.0" }, { "name": "Handle", "value": "0x00000244" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\policy\\v4.0" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x7417eb88", "parentcaller": "0x7417edde", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000244" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "1" }, { "name": "MaxValueNameLength", "value": "5" }, { "name": "MaxValueLength", "value": "24" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x7418ec20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741ac000" }, { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "RegEnumValueW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76ebeba0" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x7418ec20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741ac000" }, { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x7417ec0a", "parentcaller": "0x7417edde", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Index", "value": "0" }, { "name": "ValueName", "value": "30319" }, { "name": "Data", "value": "30319-30319" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\policy\\v4.0\\30319" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x7418ec20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741ac000" }, { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "RegCloseKey" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76ebeb20" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x7418ec20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741ac000" }, { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x7417ee01", "parentcaller": "0x7416dccc", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x77264429", "parentcaller": "0x741751c9", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\MSCOREE.DLL.local" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x74174e1c", "parentcaller": "0x741752b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000244" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x7418ec20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741ac000" }, { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "RegQueryValueExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76ebe8e0" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x7418ec20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741ac000" }, { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x74174e34", "parentcaller": "0x741752b8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x74174e71", "parentcaller": "0x741752b8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "Data", "value": "C:\\Windows\\Microsoft.NET\\Framework\\" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-04-16 19:59:51,580", "thread_id": "4344", "caller": "0x74174e7f", "parentcaller": "0x741752b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-04-16 19:59:51,611", "thread_id": "4344", "caller": "0x77264566", "parentcaller": "0x74186667", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x012ba5f8", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" }, { "name": "FirstCreateTimeLow", "value": "0x51d5aa91" }, { "name": "FirstCreateTimeHigh", "value": "0x01d8c32f" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-04-16 19:59:51,643", "thread_id": "4344", "caller": "0x77275d68", "parentcaller": "0x74186677", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-04-16 19:59:51,643", "thread_id": "4344", "caller": "0x7417ef8e", "parentcaller": "0x7416dccc", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-04-16 19:59:51,643", "thread_id": "4344", "caller": "0x74174e1c", "parentcaller": "0x741752b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000240" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-04-16 19:59:51,643", "thread_id": "4344", "caller": "0x74174e34", "parentcaller": "0x741752b8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-04-16 19:59:51,643", "thread_id": "4344", "caller": "0x74174e71", "parentcaller": "0x741752b8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "Data", "value": "C:\\Windows\\Microsoft.NET\\Framework\\" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-04-16 19:59:51,643", "thread_id": "4344", "caller": "0x74174e7f", "parentcaller": "0x741752b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-04-16 19:59:51,643", "thread_id": "4344", "caller": "0x77264566", "parentcaller": "0x74186667", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x012ba2b8", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" }, { "name": "FirstCreateTimeLow", "value": "0x51d5aa91" }, { "name": "FirstCreateTimeHigh", "value": "0x01d8c32f" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-04-16 19:59:51,643", "thread_id": "4344", "caller": "0x77275d68", "parentcaller": "0x74186677", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-04-16 19:59:51,658", "thread_id": "4344", "caller": "0x74174e1c", "parentcaller": "0x741752b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000240" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-04-16 19:59:51,658", "thread_id": "4344", "caller": "0x74174e34", "parentcaller": "0x741752b8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-04-16 19:59:51,658", "thread_id": "4344", "caller": "0x74174e71", "parentcaller": "0x741752b8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "Data", "value": "C:\\Windows\\Microsoft.NET\\Framework\\" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-04-16 19:59:51,658", "thread_id": "4344", "caller": "0x74174e7f", "parentcaller": "0x741752b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-04-16 19:59:51,658", "thread_id": "4344", "caller": "0x77261d96", "parentcaller": "0x7417952e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei" }, { "name": "DllBase", "value": "0x73e10000" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-04-16 19:59:51,658", "thread_id": "4344", "caller": "0x77261d96", "parentcaller": "0x73e189ae", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-synch-l1-2-0" }, { "name": "BaseAddress", "value": "0x77150000" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-04-16 19:59:51,658", "thread_id": "4344", "caller": "0x77261d96", "parentcaller": "0x73e189ae", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-fibers-l1-1-1" }, { "name": "BaseAddress", "value": "0x77150000" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-04-16 19:59:51,658", "thread_id": "4344", "caller": "0x77261d96", "parentcaller": "0x73e18760", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-synch-l1-2-0" }, { "name": "BaseAddress", "value": "0x77150000" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-04-16 19:59:51,658", "thread_id": "4344", "caller": "0x77261d96", "parentcaller": "0x73e18760", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-fibers-l1-1-1" }, { "name": "BaseAddress", "value": "0x77150000" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-04-16 19:59:51,658", "thread_id": "4344", "caller": "0x77261d96", "parentcaller": "0x73e18760", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-l1-2-1" }, { "name": "BaseAddress", "value": "0x77150000" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-04-16 19:59:51,658", "thread_id": "4344", "caller": "0x77261d96", "parentcaller": "0x77266176", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ADVAPI32.dll" }, { "name": "BaseAddress", "value": "0x76ea0000" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-04-16 19:59:51,658", "thread_id": "4344", "caller": "0x77261d96", "parentcaller": "0x7417952e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" }, { "name": "BaseAddress", "value": "0x73e10000" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-04-16 19:59:51,658", "thread_id": "4344", "caller": "0x77261d96", "parentcaller": "0x7417952e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x73e10000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" }, { "name": "dwFlags", "value": "0x00000008" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-04-16 19:59:51,658", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "RegisterShimImplCallback" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x73e114d0" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-04-16 19:59:51,658", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "RegisterShimImplCleanupCallback" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-04-16 19:59:51,658", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "SetShellShimInstance" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-04-16 19:59:51,658", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "OnShimDllMainCalled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x73e19630" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-04-16 19:59:51,658", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "_CorExeMain_RetAddr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-04-16 19:59:51,658", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "_CorExeMain" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x73e1fa20" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-04-16 19:59:51,658", "thread_id": "4344", "caller": "0x77264429", "parentcaller": "0x73e22143", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\MSCOREE.DLL.local" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-04-16 19:59:51,658", "thread_id": "4344", "caller": "0x73e17a31", "parentcaller": "0x73e18d85", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000234" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-04-16 19:59:51,658", "thread_id": "4344", "caller": "0x73e18da2", "parentcaller": "0x73e1924a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-04-16 19:59:51,658", "thread_id": "4344", "caller": "0x73e18de3", "parentcaller": "0x73e1924a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "Data", "value": "C:\\Windows\\Microsoft.NET\\Framework\\" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-04-16 19:59:51,658", "thread_id": "4344", "caller": "0x73e18df4", "parentcaller": "0x73e1924a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-04-16 19:59:51,658", "thread_id": "4344", "caller": "0x77264566", "parentcaller": "0x73e1162d", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x012ba138", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\*" }, { "name": "FirstCreateTimeLow", "value": "0xc87fbef5" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-04-16 19:59:51,674", "thread_id": "4344", "caller": "0x77261999", "parentcaller": "0x772616ce", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-04-16 19:59:51,674", "thread_id": "4344", "caller": "0x77261999", "parentcaller": "0x772616ce", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-04-16 19:59:51,674", "thread_id": "4344", "caller": "0x77261999", "parentcaller": "0x772616ce", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-04-16 19:59:51,674", "thread_id": "4344", "caller": "0x77261999", "parentcaller": "0x772616ce", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-04-16 19:59:51,877", "thread_id": "4344", "caller": "0x77261999", "parentcaller": "0x772616ce", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-04-16 19:59:51,924", "thread_id": "4344", "caller": "0x77261999", "parentcaller": "0x772616ce", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000230" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-04-16 19:59:51,924", "thread_id": "4344", "caller": "0x7726269a", "parentcaller": "0x73e17007", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-04-16 19:59:52,096", "thread_id": "4344", "caller": "0x77261999", "parentcaller": "0x772616ce", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000230" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-04-16 19:59:52,096", "thread_id": "4344", "caller": "0x7726269a", "parentcaller": "0x73e17007", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-04-16 19:59:52,096", "thread_id": "4344", "caller": "0x77275d68", "parentcaller": "0x73e15ff0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-04-16 19:59:52,096", "thread_id": "4344", "caller": "0x73e21a39", "parentcaller": "0x73e16701", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-04-16 19:59:52,096", "thread_id": "4344", "caller": "0x73e21a7f", "parentcaller": "0x73e16701", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000230" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-04-16 19:59:52,096", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-04-16 19:59:52,096", "thread_id": "4344", "caller": "0x77261d96", "parentcaller": "0x77266176", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "SHLWAPI.dll" }, { "name": "BaseAddress", "value": "0x76f20000" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-04-16 19:59:52,096", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "ModuleHandle", "value": "0x76f20000" }, { "name": "FunctionName", "value": "UrlIsW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f343a0" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-04-16 19:59:52,096", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-04-16 19:59:52,096", "thread_id": "4344", "caller": "0x77261999", "parentcaller": "0x772616ce", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe.config" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-04-16 19:59:52,096", "thread_id": "4344", "caller": "0x73e17a31", "parentcaller": "0x73e20224", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x0000022c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-04-16 19:59:52,096", "thread_id": "4344", "caller": "0x73e2024d", "parentcaller": "0x73e20350", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000022c" }, { "name": "ValueName", "value": "UseLegacyV2RuntimeActivationPolicyDefaultValue" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\UseLegacyV2RuntimeActivationPolicyDefaultValue" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-04-16 19:59:52,096", "thread_id": "4344", "caller": "0x73e1760b", "parentcaller": "0x73e202b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-04-16 19:59:52,096", "thread_id": "4344", "caller": "0x73e17a31", "parentcaller": "0x73e20224", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x0000022c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-04-16 19:59:52,096", "thread_id": "4344", "caller": "0x73e2024d", "parentcaller": "0x73e20350", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000022c" }, { "name": "ValueName", "value": "OnlyUseLatestCLR" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\OnlyUseLatestCLR" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-04-16 19:59:52,096", "thread_id": "4344", "caller": "0x73e1760b", "parentcaller": "0x73e202b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-04-16 19:59:52,127", "thread_id": "4344", "caller": "0x77261999", "parentcaller": "0x772616ce", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-04-16 19:59:52,127", "thread_id": "4344", "caller": "0x7727081d", "parentcaller": "0x73e44737", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000022c" }, { "name": "HandleName", "value": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x16\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-04-16 19:59:52,127", "thread_id": "4344", "caller": "0x77260e58", "parentcaller": "0x77260abe", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000224" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000022c" }, { "name": "FileName", "value": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-04-16 19:59:52,127", "thread_id": "4344", "caller": "0x7726f16b", "parentcaller": "0x73e43dc6", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000224" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x055e0000" }, { "name": "SectionOffset", "value": "0x010fecac" }, { "name": "ViewSize", "value": "0x00161000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-04-16 19:59:52,346", "thread_id": "4344", "caller": "0x73e5863e", "parentcaller": "0x73e5740f", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 105 }, { "timestamp": "2026-04-16 19:59:52,346", "thread_id": "4344", "caller": "0x7726269a", "parentcaller": "0x73e43e96", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-04-16 19:59:52,346", "thread_id": "4344", "caller": "0x77270c75", "parentcaller": "0x73e43ec1", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x055e0000" }, { "name": "RegionSize", "value": "0x00161000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-04-16 19:59:52,346", "thread_id": "4344", "caller": "0x7726269a", "parentcaller": "0x73e43ee4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000224" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-04-16 19:59:52,346", "thread_id": "4344", "caller": "0x77261999", "parentcaller": "0x772616ce", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000224" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-04-16 19:59:52,346", "thread_id": "4344", "caller": "0x7727081d", "parentcaller": "0x73e44737", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000224" }, { "name": "HandleName", "value": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x16\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-04-16 19:59:52,346", "thread_id": "4344", "caller": "0x77260e58", "parentcaller": "0x77260abe", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000224" }, { "name": "FileName", "value": "C:\\Users\\cape\\AppData\\Local\\Temp\\NanoCore.exe" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-04-16 19:59:52,361", "thread_id": "4344", "caller": "0x7726f16b", "parentcaller": "0x73e43dc6", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000022c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x055e0000" }, { "name": "SectionOffset", "value": "0x010fecac" }, { "name": "ViewSize", "value": "0x00161000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-04-16 19:59:52,361", "thread_id": "4344", "caller": "0x73e5863e", "parentcaller": "0x73e5740f", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 113 }, { "timestamp": "2026-04-16 19:59:52,361", "thread_id": "4344", "caller": "0x7726269a", "parentcaller": "0x73e43e96", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000224" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-04-16 19:59:52,361", "thread_id": "4344", "caller": "0x77270c75", "parentcaller": "0x73e43ec1", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x055e0000" }, { "name": "RegionSize", "value": "0x00161000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-04-16 19:59:52,361", "thread_id": "4344", "caller": "0x7726269a", "parentcaller": "0x73e43ee4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-04-16 19:59:52,471", "thread_id": "4344", "caller": "0x73e17a31", "parentcaller": "0x73e2fc7b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000006", "arguments": [ { "name": "Registry", "value": "0x00000000" }, { "name": "SubKey", "value": "Policy\\Standards" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "Policy\\Standards" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-04-16 19:59:52,471", "thread_id": "4344", "caller": "0x73e17a31", "parentcaller": "0x73e2fc7b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000230" }, { "name": "SubKey", "value": "Policy\\Standards" }, { "name": "Handle", "value": "0x00000240" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\Policy\\Standards" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-04-16 19:59:52,471", "thread_id": "4344", "caller": "0x73e17a31", "parentcaller": "0x73e2fa9a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000240" }, { "name": "SubKey", "value": "v2.0.50727" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\policy\\standards\\v2.0.50727" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-04-16 19:59:52,471", "thread_id": "4344", "caller": "0x73e2509d", "parentcaller": "0x73e298ef", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-04-16 19:59:52,596", "thread_id": "4344", "caller": "0x77261d96", "parentcaller": "0x73e1dd47", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\kernel.appcore" }, { "name": "DllBase", "value": "0x75250000" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-04-16 19:59:52,611", "thread_id": "4344", "caller": "0x77261d96", "parentcaller": "0x73e1dd47", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-appmodel-runtime-l1-1-2.dll" }, { "name": "BaseAddress", "value": "0x75250000" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-04-16 19:59:52,611", "thread_id": "4344", "caller": "0x77261d96", "parentcaller": "0x73e1dd47", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x75250000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-appmodel-runtime-l1-1-2.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-04-16 19:59:52,611", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "ModuleHandle", "value": "0x75250000" }, { "name": "FunctionName", "value": "AppPolicyGetClrCompat" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75253a00" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-04-16 19:59:52,611", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "ModuleHandle", "value": "0x75250000" }, { "name": "FunctionName", "value": "GetCurrentPackageId" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75253d80" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-04-16 19:59:52,611", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "ModuleHandle", "value": "0x75250000" }, { "name": "FunctionName", "value": "GetCurrentPackageInfo" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75253db0" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-04-16 19:59:52,611", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "ModuleHandle", "value": "0x75250000" }, { "name": "FunctionName", "value": "GetCurrentPackagePath" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75253dd0" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-04-16 19:59:52,611", "thread_id": "4344", "caller": "0x77260848", "parentcaller": "0x73e1db51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "7684" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-04-16 19:59:52,611", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-04-16 19:59:52,611", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "OpenProcessToken" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76ebea30" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-04-16 19:59:52,611", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-04-16 19:59:52,611", "thread_id": "4344", "caller": "0x77263cc4", "parentcaller": "0x73e1dbb9", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000240" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-04-16 19:59:52,611", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-04-16 19:59:52,611", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "GetTokenInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76ebe690" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-04-16 19:59:52,611", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-04-16 19:59:52,611", "thread_id": "4344", "caller": "0x77261446", "parentcaller": "0x73e1dc0a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-04-16 19:59:52,611", "thread_id": "4344", "caller": "0x7726269a", "parentcaller": "0x73e1dc40", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-04-16 19:59:52,611", "thread_id": "4344", "caller": "0x7726269a", "parentcaller": "0x73e1dc62", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-04-16 19:59:52,611", "thread_id": "4344", "caller": "0x73e17a31", "parentcaller": "0x73e17f73", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Fusion" }, { "name": "Handle", "value": "0x0000022c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-04-16 19:59:52,611", "thread_id": "4344", "caller": "0x73e17fa5", "parentcaller": "0x73e18014", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000022c" }, { "name": "ValueName", "value": "NoClientChecks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Fusion\\NoClientChecks" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-04-16 19:59:52,611", "thread_id": "4344", "caller": "0x73e17fd5", "parentcaller": "0x73e18014", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-04-16 19:59:52,611", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-04-16 19:59:52,611", "thread_id": "4344", "caller": "0x77261d96", "parentcaller": "0x77266176", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\VERSION" }, { "name": "DllBase", "value": "0x75460000" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-04-16 19:59:52,611", "thread_id": "4344", "caller": "0x77261d96", "parentcaller": "0x77266176", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "VERSION.dll" }, { "name": "BaseAddress", "value": "0x75460000" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-04-16 19:59:52,611", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "VERSION.dll" }, { "name": "ModuleHandle", "value": "0x75460000" }, { "name": "FunctionName", "value": "GetFileVersionInfoSizeW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x754615c0" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-04-16 19:59:52,611", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-04-16 19:59:56,564", "thread_id": "4344", "caller": "0x73e2080a", "parentcaller": "0x73e1da39", "category": "filesystem", "api": "GetFileVersionInfoSizeW", "status": true, "return": "0x0000081c", "arguments": [ { "name": "PathName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-04-16 19:59:56,564", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-04-16 19:59:56,564", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "VERSION.dll" }, { "name": "ModuleHandle", "value": "0x75460000" }, { "name": "FunctionName", "value": "GetFileVersionInfoW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x754615e0" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-04-16 19:59:56,564", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-04-16 19:59:56,564", "thread_id": "4344", "caller": "0x73e2082b", "parentcaller": "0x73e1da39", "category": "filesystem", "api": "GetFileVersionInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "PathName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-04-16 19:59:56,564", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-04-16 19:59:56,564", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "VERSION.dll" }, { "name": "ModuleHandle", "value": "0x75460000" }, { "name": "FunctionName", "value": "VerQueryValueW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75461560" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-04-16 19:59:56,564", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-04-16 19:59:56,564", "thread_id": "4344", "caller": "0x73e1d044", "parentcaller": "0x73e1cfd3", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-04-16 19:59:56,580", "thread_id": "4344", "caller": "0x77261999", "parentcaller": "0x772616ce", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000240" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-04-16 19:59:56,580", "thread_id": "4344", "caller": "0x7726269a", "parentcaller": "0x73e17007", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-04-16 19:59:56,580", "thread_id": "4344", "caller": "0x73e11e78", "parentcaller": "0x73e1d114", "category": "misc", "api": "HeapCreate", "status": true, "return": "0x05730000", "arguments": [ { "name": "Options", "value": "262144" }, { "name": "InitialSize", "value": "0x00000000" }, { "name": "MaximumSize", "value": "0x00000000" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-04-16 19:59:57,408", "thread_id": "4344", "caller": "0x77261d96", "parentcaller": "0x73e1fecf", "category": "__notification__", "api": "sysenter", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadIdentifier", "value": "4344" }, { "name": "Module", "value": "KERNEL32.dll" }, { "name": "Return Address", "value": "0x76ad24ac" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-04-16 19:59:58,533", "thread_id": "4344", "caller": "0x77261d96", "parentcaller": "0x73e1fecf", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\WinSxS\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\\MSVCR80" }, { "name": "DllBase", "value": "0x736e0000" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-04-16 19:59:58,533", "thread_id": "4344", "caller": "0x77261d96", "parentcaller": "0x73e1fecf", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks" }, { "name": "DllBase", "value": "0x737e0000" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-04-16 19:59:59,299", "thread_id": "4344", "caller": "0x77e80857", "parentcaller": "0x77e8055f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02f31000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-04-16 19:59:59,424", "thread_id": "4344", "caller": "0x77e80857", "parentcaller": "0x77e8055f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02f32000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-04-16 19:59:59,424", "thread_id": "4344", "caller": "0x7373339d", "parentcaller": "0x736e1762", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 164 }, { "timestamp": "2026-04-16 19:59:59,564", "thread_id": "4344", "caller": "0x7726f231", "parentcaller": "0x736e1da6", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x76ab0000" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-04-16 19:59:59,564", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.dll" }, { "name": "ModuleHandle", "value": "0x76ab0000" }, { "name": "FunctionName", "value": "FindActCtxSectionStringW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76ac8900" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-04-16 19:59:59,564", "thread_id": "4344", "caller": "0x7726f231", "parentcaller": "0x736e1dcd", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "MSCoree.dll" }, { "name": "ModuleHandle", "value": "0x74160000" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-04-16 19:59:59,564", "thread_id": "4344", "caller": "0x7726f231", "parentcaller": "0x736e1dd6", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "PGORT80.dll" }, { "name": "ModuleHandle", "value": "0x74160000" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-04-16 19:59:59,564", "thread_id": "4344", "caller": "0x77262ba1", "parentcaller": "0x76ace2b9", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-04-16 19:59:59,564", "thread_id": "4344", "caller": "0x77264429", "parentcaller": "0x76ace2c9", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\WinSxS\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\\msvcr80.dll" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-04-16 19:59:59,674", "thread_id": "4344", "caller": "0x77264566", "parentcaller": "0x76ace434", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x012ba138", "arguments": [ { "name": "FileName", "value": "C:\\Windows" }, { "name": "FirstCreateTimeLow", "value": "0x3a6eea36" }, { "name": "FirstCreateTimeHigh", "value": "0x01ca0431" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-04-16 19:59:59,674", "thread_id": "4344", "caller": "0x77275d68", "parentcaller": "0x76ace44d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-04-16 19:59:59,674", "thread_id": "4344", "caller": "0x77264566", "parentcaller": "0x76ace434", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x012ba138", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\WinSxS" }, { "name": "FirstCreateTimeLow", "value": "0x3a6eea36" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acdd" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-04-16 19:59:59,674", "thread_id": "4344", "caller": "0x77275d68", "parentcaller": "0x76ace44d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-04-16 19:59:59,674", "thread_id": "4344", "caller": "0x77264566", "parentcaller": "0x76ace434", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x012ba138", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\WinSxS\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\\msvcr80.dll" }, { "name": "FirstCreateTimeLow", "value": "0xf1cf05b4" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acdd" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-04-16 19:59:59,674", "thread_id": "4344", "caller": "0x77275d68", "parentcaller": "0x76ace44d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-04-16 19:59:59,674", "thread_id": "4344", "caller": "0x77262ba1", "parentcaller": "0x76ace569", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-04-16 19:59:59,674", "thread_id": "4344", "caller": "0x7726f231", "parentcaller": "0x736e1f08", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x76ab0000" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-04-16 19:59:59,674", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.dll" }, { "name": "ModuleHandle", "value": "0x76ab0000" }, { "name": "FunctionName", "value": "GetSystemWindowsDirectoryW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76ac9500" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-04-16 19:59:59,861", "thread_id": "4344", "caller": "0x7726f231", "parentcaller": "0x73896231", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "mscoree.dll" }, { "name": "ModuleHandle", "value": "0x74160000" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-04-16 19:59:59,861", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "ModuleHandle", "value": "0x74160000" }, { "name": "FunctionName", "value": "GetProcessExecutableHeap" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x74171fa0" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-04-16 19:59:59,924", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "GetProcessExecutableHeap_RetAddr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-04-16 19:59:59,924", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "GetProcessExecutableHeap" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x73e11e60" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-04-16 20:00:00,205", "thread_id": "4344", "caller": "0x77e7007d", "parentcaller": "0x7726648d", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-04-16 20:00:00,361", "thread_id": "4344", "caller": "0x738fbaa0", "parentcaller": "0x7389032d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-04-16 20:00:00,361", "thread_id": "4344", "caller": "0x738fbaa0", "parentcaller": "0x73890395", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000240" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-04-16 20:00:00,424", "thread_id": "4344", "caller": "0x73832c2e", "parentcaller": "0x738903bc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000240" }, { "name": "ValueName", "value": "GCStressStart" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\GCStressStart" } ], "repeated": 0, "id": 187 }, { "timestamp": "2026-04-16 20:00:00,424", "thread_id": "4344", "caller": "0x738903cc", "parentcaller": "0x739176dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-04-16 20:00:00,424", "thread_id": "4344", "caller": "0x738fbaa0", "parentcaller": "0x7389032d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-04-16 20:00:00,424", "thread_id": "4344", "caller": "0x738fbaa0", "parentcaller": "0x73890395", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000240" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 190 }, { "timestamp": "2026-04-16 20:00:00,424", "thread_id": "4344", "caller": "0x73832c2e", "parentcaller": "0x738903bc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000240" }, { "name": "ValueName", "value": "GCStressStartAtJit" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\GCStressStartAtJit" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-04-16 20:00:00,424", "thread_id": "4344", "caller": "0x738903cc", "parentcaller": "0x739176dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-04-16 20:00:00,424", "thread_id": "4344", "caller": "0x738fbaa0", "parentcaller": "0x7389032d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-04-16 20:00:00,424", "thread_id": "4344", "caller": "0x738fbaa0", "parentcaller": "0x73890395", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000240" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-04-16 20:00:00,424", "thread_id": "4344", "caller": "0x73832c2e", "parentcaller": "0x738903bc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000240" }, { "name": "ValueName", "value": "GCStressStart" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\GCStressStart" } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-04-16 20:00:00,424", "thread_id": "4344", "caller": "0x738903cc", "parentcaller": "0x739176dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 196 }, { "timestamp": "2026-04-16 20:00:00,424", "thread_id": "4344", "caller": "0x738fbaa0", "parentcaller": "0x7389032d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 197 }, { "timestamp": "2026-04-16 20:00:00,424", "thread_id": "4344", "caller": "0x738fbaa0", "parentcaller": "0x73890395", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000240" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 198 }, { "timestamp": "2026-04-16 20:00:00,424", "thread_id": "4344", "caller": "0x73832c2e", "parentcaller": "0x738903bc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000240" }, { "name": "ValueName", "value": "GCStressStartAtJit" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\GCStressStartAtJit" } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-04-16 20:00:00,424", "thread_id": "4344", "caller": "0x738903cc", "parentcaller": "0x739176dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-04-16 20:00:00,486", "thread_id": "4344", "caller": "0x77261d96", "parentcaller": "0x73e1fecf", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" }, { "name": "BaseAddress", "value": "0x737e0000" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-04-16 20:00:00,486", "thread_id": "4344", "caller": "0x77261d96", "parentcaller": "0x73e1fecf", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x737e0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" }, { "name": "dwFlags", "value": "0x00000008" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-04-16 20:00:00,486", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "mscorwks.dll" }, { "name": "ModuleHandle", "value": "0x737e0000" }, { "name": "FunctionName", "value": "SetLoadedByMscoree" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-04-16 20:00:00,486", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-04-16 20:00:00,486", "thread_id": "4344", "caller": "0x77261d96", "parentcaller": "0x77266176", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "USER32.dll" }, { "name": "BaseAddress", "value": "0x75d10000" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-04-16 20:00:00,486", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x75d10000" }, { "name": "FunctionName", "value": "GetProcessWindowStation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75d517d0" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-04-16 20:00:00,486", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-04-16 20:00:00,486", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-04-16 20:00:00,486", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x75d10000" }, { "name": "FunctionName", "value": "GetUserObjectInformationW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75d518c0" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-04-16 20:00:00,486", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-04-16 20:00:00,486", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscorwks.dll" }, { "name": "ModuleHandle", "value": "0x737e0000" }, { "name": "FunctionName", "value": "_CorExeMain" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7391877c" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-04-16 20:00:00,736", "thread_id": "4344", "caller": "0x73938391", "parentcaller": "0x739383dd", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 212 }, { "timestamp": "2026-04-16 20:00:00,752", "thread_id": "4344", "caller": "0x7726f231", "parentcaller": "0x73895854", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "mscorwks.dll" }, { "name": "ModuleHandle", "value": "0x737e0000" } ], "repeated": 0, "id": 213 }, { "timestamp": "2026-04-16 20:00:00,752", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscorwks.dll" }, { "name": "ModuleHandle", "value": "0x737e0000" }, { "name": "FunctionName", "value": "GetCLRFunction" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x738d08a5" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-04-16 20:00:00,861", "thread_id": "4344", "caller": "0x738fbaa0", "parentcaller": "0x7389032d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-04-16 20:00:00,861", "thread_id": "4344", "caller": "0x738fbaa0", "parentcaller": "0x73890395", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x0000022c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-04-16 20:00:00,861", "thread_id": "4344", "caller": "0x73832c2e", "parentcaller": "0x738903bc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000022c" }, { "name": "ValueName", "value": "DisableConfigCache" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\DisableConfigCache" } ], "repeated": 0, "id": 217 }, { "timestamp": "2026-04-16 20:00:00,861", "thread_id": "4344", "caller": "0x738903cc", "parentcaller": "0x738955f2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-04-16 20:00:00,861", "thread_id": "4344", "caller": "0x738fbaa0", "parentcaller": "0x73895620", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-04-16 20:00:00,861", "thread_id": "4344", "caller": "0x738fbaa0", "parentcaller": "0x73895620", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x0000022c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 220 }, { "timestamp": "2026-04-16 20:00:00,861", "thread_id": "4344", "caller": "0x738c2bb6", "parentcaller": "0x7389565b", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" }, { "name": "Index", "value": "0" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-04-16 20:00:00,971", "thread_id": "4344", "caller": "0x738c2bb6", "parentcaller": "0x7389565b", "category": "registry", "api": "RegEnumValueW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x0000022c" }, { "name": "Index", "value": "1" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "0", "pretty_value": "REG_NONE" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-04-16 20:00:01,064", "thread_id": "4344", "caller": "0x7726074f", "parentcaller": "0x73a192bb", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "advapi32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-04-16 20:00:01,064", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "RegisterTraceGuidsW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77ea44b0" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-04-16 20:00:01,064", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "UnregisterTraceGuids" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77e99a70" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-04-16 20:00:01,064", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "GetTraceLoggerHandle" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77eac810" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-04-16 20:00:01,064", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "GetTraceEnableLevel" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77eac860" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-04-16 20:00:01,064", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "GetTraceEnableFlags" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77eac890" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-04-16 20:00:01,064", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "TraceEvent" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77f41320" } ], "repeated": 0, "id": 229 }, { "timestamp": "2026-04-16 20:00:01,580", "thread_id": "4344", "caller": "0x77e7007d", "parentcaller": "0x7726648d", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-04-16 20:00:01,580", "thread_id": "4344", "caller": "0x77260c1f", "parentcaller": "0x7388c16d", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x00000000" }, { "name": "EventName", "value": "Global\\CLR_PerfMon_StartEnumEvent" } ], "repeated": 0, "id": 231 }, { "timestamp": "2026-04-16 20:00:01,689", "thread_id": "4344", "caller": "0x73732866", "parentcaller": "0x738953e7", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 232 }, { "timestamp": "2026-04-16 20:00:01,689", "thread_id": "4344", "caller": "0x77261d96", "parentcaller": "0x73857f86", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "mscoree.dll" }, { "name": "BaseAddress", "value": "0x74160000" } ], "repeated": 0, "id": 233 }, { "timestamp": "2026-04-16 20:00:01,689", "thread_id": "4344", "caller": "0x77261d96", "parentcaller": "0x73857f86", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x74160000", "arguments": [ { "name": "lpLibFileName", "value": "mscoree.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-04-16 20:00:01,689", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "ModuleHandle", "value": "0x74160000" }, { "name": "FunctionName", "value": "IEE" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x74172e40" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-04-16 20:00:01,689", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "IEE_RetAddr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-04-16 20:00:01,689", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "IEE" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x73e40c70" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-04-16 20:00:01,830", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscorwks.dll" }, { "name": "ModuleHandle", "value": "0x737e0000" }, { "name": "FunctionName", "value": "IEE" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x738954a8" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-04-16 20:00:01,830", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x7385f357", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x737e2000" }, { "name": "ModuleName", "value": "mscorwks.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000040", "pretty_value": "PAGE_EXECUTE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000020", "pretty_value": "PAGE_EXECUTE_READ" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-04-16 20:00:01,830", "thread_id": "4344", "caller": "0x77274faa", "parentcaller": "0x7385f357", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x737e2000" }, { "name": "ModuleName", "value": "mscorwks.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000020", "pretty_value": "PAGE_EXECUTE_READ" }, { "name": "OldAccessProtection", "value": "0x00000040", "pretty_value": "PAGE_EXECUTE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-04-16 20:00:01,830", "thread_id": "4344", "caller": "0x7726074f", "parentcaller": "0x73894c46", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "mscoree.dll" }, { "name": "ModuleHandle", "value": "0x74160000" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-04-16 20:00:01,830", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "ModuleHandle", "value": "0x74160000" }, { "name": "FunctionName", "value": "GetStartupFlags" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7416ffc0" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-04-16 20:00:01,830", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "GetStartupFlags_RetAddr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-04-16 20:00:01,830", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "GetStartupFlags" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x73e3f5a0" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-04-16 20:00:01,830", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "ModuleHandle", "value": "0x74160000" }, { "name": "FunctionName", "value": "GetHostConfigurationFile" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x74172050" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-04-16 20:00:01,830", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "GetHostConfigurationFile_RetAddr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-04-16 20:00:01,830", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "GetHostConfigurationFile" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x73e3f600" } ], "repeated": 0, "id": 247 }, { "timestamp": "2026-04-16 20:00:01,830", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "GetCORVersion_RetAddr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 248 }, { "timestamp": "2026-04-16 20:00:01,830", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "GetCORVersion" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x73e3e060" } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-04-16 20:00:01,830", "thread_id": "4344", "caller": "0x7726074f", "parentcaller": "0x73894634", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "mscoree.dll" }, { "name": "ModuleHandle", "value": "0x74160000" } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-04-16 20:00:01,830", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "ModuleHandle", "value": "0x74160000" }, { "name": "FunctionName", "value": "GetCORSystemDirectory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x741708b0" } ], "repeated": 0, "id": 251 }, { "timestamp": "2026-04-16 20:00:01,830", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "GetCORSystemDirectory_RetAddr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x73e3f300" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-04-16 20:00:01,846", "thread_id": "4344", "caller": "0x73e17a31", "parentcaller": "0x73e523f8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework\\Policy\\AppPatch" }, { "name": "Handle", "value": "0x00000228" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework\\Policy\\AppPatch" } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-04-16 20:00:01,986", "thread_id": "4344", "caller": "0x77277bae", "parentcaller": "0x73e52c0b", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-04-16 20:00:01,986", "thread_id": "4344", "caller": "0x73e17a31", "parentcaller": "0x73e523f8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000228" }, { "name": "SubKey", "value": "v4.0.30319.00000" }, { "name": "Handle", "value": "0x00000248" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\policy\\AppPatch\\v4.0.30319.00000" } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-04-16 20:00:01,986", "thread_id": "4344", "caller": "0x73e1760b", "parentcaller": "0x73e50f0e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000228" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-04-16 20:00:01,986", "thread_id": "4344", "caller": "0x73e17a31", "parentcaller": "0x73e523f8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000248" }, { "name": "SubKey", "value": "mscorwks.dll" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\policy\\AppPatch\\v4.0.30319.00000\\mscorwks.dll" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-04-16 20:00:01,986", "thread_id": "4344", "caller": "0x73e1760b", "parentcaller": "0x73e50b0a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-04-16 20:00:01,986", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "CreateConfigStream_RetAddr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-04-16 20:00:01,986", "thread_id": "4344", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "CreateConfigStream" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x73e196a0" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-04-16 20:00:02,111", "thread_id": "4344", "caller": "0x77261999", "parentcaller": "0x772616ce", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-04-16 20:00:02,189", "thread_id": "4344", "caller": "0x77e80857", "parentcaller": "0x77e8055f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x012ce000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-04-16 20:00:02,221", "thread_id": "4344", "caller": "0x7726249c", "parentcaller": "0x73e11df9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000248" }, { "name": "HandleName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config" }, { "name": "Buffer", "value": "