{ "statistics": { "processing": [ { "name": "CAPE", "time": 15.083 }, { "name": "AnalysisInfo", "time": 0.075 }, { "name": "BehaviorAnalysis", "time": 0.983 }, { "name": "Debug", "time": 0.002 }, { "name": "NetworkAnalysis", "time": 25.519 }, { "name": "Suricata", "time": 21.601 }, { "name": "UrlAnalysis", "time": 0.0 }, { "name": "script_log_processing", "time": 0.0 }, { "name": "ProcessMemory", "time": 0.0 } ], "signatures": [ { "name": "packer_themida", "time": 0.0 }, { "name": "stealth_network", "time": 0.0 }, { "name": "disable_driver_via_blocklist", "time": 0.0 }, { "name": "disable_driver_via_hvcidisallowedimages", "time": 0.0 }, { "name": "disable_hypervisor_protected_code_integrity", "time": 0.0 }, { "name": "pendingfilerenameoperations_Operations", "time": 0.0 }, { "name": "anomalous_deletefile", "time": 0.0 }, { "name": "antiav_360_libs", "time": 0.0 }, { "name": "antiav_ahnlab_libs", "time": 0.0 }, { "name": "antiav_avast_libs", "time": 0.0 }, { "name": "antiav_bitdefender_libs", "time": 0.0 }, { "name": "antiav_bullguard_libs", "time": 0.0 }, { "name": "antiav_emsisoft_libs", "time": 0.0 }, { "name": "antiav_qurb_libs", "time": 0.0 }, { "name": "antiav_servicestop", "time": 0.0 }, { "name": "antiav_apioverride_libs", "time": 0.0 }, { "name": "antidebug_guardpages", "time": 0.0 }, { "name": "antidebug_ntcreatethreadex", "time": 0.0 }, { "name": "antiav_nthookengine_libs", "time": 0.0 }, { "name": "antidebug_outputdebugstring", "time": 0.0 }, { "name": "antidebug_setunhandledexceptionfilter", "time": 0.0 }, { "name": "antidebug_windows", "time": 0.0 }, { "name": "antisandbox_cuckoo", "time": 0.0 }, { "name": "antisandbox_cuckoocrash", "time": 0.0 }, { "name": "antisandbox_foregroundwindows", "time": 0.0 }, { "name": "mouse_movement_detect", "time": 0.0 }, { "name": "antisandbox_sboxie_libs", "time": 0.0 }, { "name": "antisandbox_sboxie_objects", "time": 0.0 }, { "name": "antisandbox_script_timer", "time": 0.0 }, { "name": "antisandbox_sleep", "time": 0.0 }, { "name": "antisandbox_sunbelt_libs", "time": 0.0 }, { "name": "antisandbox_unhook", "time": 0.0 }, { "name": "antivm_directory_objects", "time": 0.0 }, { "name": "antivm_display", "time": 0.0 }, { "name": "antivm_generic_disk", "time": 0.0 }, { "name": "antivm_generic_scsi", "time": 0.0 }, { "name": "antivm_generic_services", "time": 0.0 }, { "name": "antivm_generic_system", "time": 0.0 }, { "name": "antivm_checks_available_memory", "time": 0.0 }, { "name": "detect_virtualization_via_recent_files", "time": 0.0 }, { "name": "antivm_vbox_libs", "time": 0.0 }, { "name": "antivm_vbox_window", "time": 0.0 }, { "name": "antivm_vmware_events", "time": 0.0 }, { "name": "antivm_vmware_libs", "time": 0.0 }, { "name": "antivm_wmi", "time": 0.0 }, { "name": "api_spamming", "time": 0.0 }, { "name": "api_uuidfromstringa", "time": 0.0 }, { "name": "banker_prinimalka", "time": 0.0 }, { "name": "bcdedit_command", "time": 0.0 }, { "name": "bootkit", "time": 0.0 }, { "name": "direct_hdd_access", "time": 0.0 }, { "name": "physical_drive_access", "time": 0.0 }, { "name": "potential_overwrite_mbr", "time": 0.0 }, { "name": "read_file_raw_disk_access", "time": 0.0 }, { "name": "suspicious_iocontrol_codes", "time": 0.0 }, { "name": "browser_needed", "time": 0.0 }, { "name": "firefox_disables_process_tab", "time": 0.0 }, { "name": "regsvr32_squiblydoo_dll_load", "time": 0.0 }, { "name": "uac_bypass_cmstp", "time": 0.0 }, { "name": "uac_bypass_eventvwr", "time": 0.0 }, { "name": "uac_bypass_windows_Backup", "time": 0.0 }, { "name": "dotnet_code_compile", "time": 0.0 }, { "name": "queries_computer_name", "time": 0.0 }, { "name": "queries_user_name", "time": 0.0 }, { "name": "creates_largekey", "time": 0.0 }, { "name": "creates_nullvalue", "time": 0.0 }, { "name": "access_windows_passwords_vault", "time": 0.0 }, { "name": "dump_lsa_via_windows_error_reporting", "time": 0.0 }, { "name": "lsass_credential_dumping", "time": 0.0 }, { "name": "critical_process", "time": 0.0 }, { "name": "cryptopool_domains", "time": 0.0 }, { "name": "dead_connect", "time": 0.0 }, { "name": "dead_link", "time": 0.0 }, { "name": "decoy_document", "time": 0.0 }, { "name": "decoy_image", "time": 0.0 }, { "name": "deletes_consolehost_history", "time": 0.0 }, { "name": "deletes_self", "time": 0.0 }, { "name": "deletes_shadow_copies", "time": 0.0 }, { "name": "deletes_system_state_backup", "time": 0.0 }, { "name": "dep_bypass", "time": 0.0 }, { "name": "dep_disable", "time": 0.0 }, { "name": "disables_mappeddrives_autodisconnect", "time": 0.0 }, { "name": "disables_spdy", "time": 0.0 }, { "name": "disables_wfp", "time": 0.0 }, { "name": "add_windows_defender_exclusions", "time": 0.0 }, { "name": "mountpoints_volume_discovery", "time": 0.0 }, { "name": "dll_load_uncommon_file_types", "time": 0.0 }, { "name": "document_script_exe_drop", "time": 0.0 }, { "name": "guloader_apis", "time": 0.0 }, { "name": "driver_load", "time": 0.0 }, { "name": "dynamic_function_loading", "time": 0.0 }, { "name": "encrypted_ioc", "time": 0.0 }, { "name": "exec_crash", "time": 0.0 }, { "name": "process_creation_suspicious_location", "time": 0.0 }, { "name": "exploit_getbasekerneladdress", "time": 0.0 }, { "name": "exploit_gethaldispatchtable", "time": 0.0 }, { "name": "exploit_heapspray", "time": 0.0 }, { "name": "koadic_apis", "time": 0.0 }, { "name": "koadic_network_activity", "time": 0.0 }, { "name": "downloads_from_filehosting", "time": 0.0 }, { "name": "generic_phish", "time": 0.0 }, { "name": "http_request", "time": 0.0 }, { "name": "infostealer_browser", "time": 0.0 }, { "name": "infostealer_browser_password", "time": 0.0 }, { "name": "infostealer_cookies", "time": 0.0 }, { "name": "cryptbot_network", "time": 0.0 }, { "name": "masslogger_artifacts", "time": 0.0 }, { "name": "masslogger_version", "time": 0.0 }, { "name": "purplewave_network_activity", "time": 0.0 }, { "name": "quilclipper_behavior", "time": 0.0 }, { "name": "raccoon_behavior", "time": 0.0 }, { "name": "captures_screenshot", "time": 0.0 }, { "name": "vidar_behavior", "time": 0.0 }, { "name": "injection_createremotethread", "time": 0.0 }, { "name": "creates_suspended_process", "time": 0.0 }, { "name": "injection_explorer", "time": 0.0 }, { "name": "injection_needextension", "time": 0.0 }, { "name": "injection_network_traffic", "time": 0.0 }, { "name": "injection_runpe", "time": 0.0 }, { "name": "injection_rwx", "time": 0.0 }, { "name": "injection_themeinitapihook", "time": 0.0 }, { "name": "resumethread_remote_process", "time": 0.0 }, { "name": "injection_write_exe_process", "time": 0.0 }, { "name": "injection_write_process", "time": 0.0 }, { "name": "internet_dropper", "time": 0.0 }, { "name": "escalate_privilege_via_named_pipe", "time": 0.0 }, { "name": "ipc_namedpipe", "time": 0.0 }, { "name": "js_phish", "time": 0.0 }, { "name": "js_suspicious_redirect", "time": 0.0 }, { "name": "loader_alien", "time": 0.0 }, { "name": "execute_binary_via_internet_explorer_exporter", "time": 0.0 }, { "name": "execute_binary_via_run_exe_helper_utility", "time": 0.0 }, { "name": "execute_ps_via_syncappvpublishingserver", "time": 0.0 }, { "name": "malicious_dynamic_function_loading", "time": 0.0 }, { "name": "encrypt_pcinfo", "time": 0.0 }, { "name": "encrypt_data_agenttesla_http", "time": 0.0 }, { "name": "encrypt_data_agentteslat2_http", "time": 0.0 }, { "name": "encrypt_data_nanocore", "time": 0.0 }, { "name": "reads_memory_remote_process", "time": 0.0 }, { "name": "mimics_filetime", "time": 0.0 }, { "name": "amsi_bypass_via_com_registry", "time": 0.0 }, { "name": "access_auto_logons_via_registry", "time": 0.0 }, { "name": "access_boot_key_via_registry", "time": 0.0 }, { "name": "create_suspicious_lnk_files", "time": 0.0 }, { "name": "credential_access_via_windows_credential_history", "time": 0.0 }, { "name": "dll_hijacking_via_microsoft_exchange", "time": 0.0 }, { "name": "dll_hijacking_via_waas_medic_svc_com_typelib", "time": 0.0 }, { "name": "execute_file_downloaded_via_openssh", "time": 0.0 }, { "name": "execute_safe_mode_from_suspicious_process", "time": 0.0 }, { "name": "execute_scripts_via_microsoft_management_console", "time": 0.0 }, { "name": "execute_suspicious_processes_via_windows_mssql_service", "time": 0.0 }, { "name": "execution_from_self_extracting_archive", "time": 0.0 }, { "name": "ip_address_discovery_via_trusted_program", "time": 0.0 }, { "name": "load_dll_via_control_panel", "time": 0.0 }, { "name": "network_connection_via_suspicious_process", "time": 0.0 }, { "name": "potential_location_discovery_via_unusual_process", "time": 0.0 }, { "name": "store_executable_registry", "time": 0.0 }, { "name": "Suspicious_Execution_Via_MicrosoftExchangeTransportAgent", "time": 0.0 }, { "name": "suspicious_java_execution_via_win_scripts", "time": 0.0 }, { "name": "Suspicious_Scheduled_Task_Creation_Via_Masqueraded_XML_File", "time": 0.0 }, { "name": "uses_restart_manager_for_suspicious_activities", "time": 0.0 }, { "name": "modify_desktop_wallpaper", "time": 0.0 }, { "name": "modify_zoneid_ads", "time": 0.0 }, { "name": "move_file_on_reboot", "time": 0.0 }, { "name": "multiple_useragents", "time": 0.0 }, { "name": "network_anomaly", "time": 0.0 }, { "name": "network_bind", "time": 0.0 }, { "name": "network_cnc_https_archive", "time": 0.0 }, { "name": "network_cnc_https_free_webhosting", "time": 0.0 }, { "name": "network_cnc_https_generic", "time": 0.0 }, { "name": "network_cnc_https_interactsh", "time": 0.0 }, { "name": "network_cnc_https_opensource", "time": 0.0 }, { "name": "network_cnc_https_pastesite", "time": 0.0 }, { "name": "network_cnc_https_payload", "time": 0.0 }, { "name": "network_cnc_https_serviceinterface", "time": 0.0 }, { "name": "network_cnc_https_socialmedia", "time": 0.0 }, { "name": "network_cnc_https_telegram", "time": 0.0 }, { "name": "network_cnc_https_tempstorage", "time": 0.0 }, { "name": "network_cnc_https_temp_urldns", "time": 0.0 }, { "name": "network_cnc_https_urlshortener", "time": 0.0 }, { "name": "network_cnc_https_useragent", "time": 0.0 }, { "name": "network_cnc_smtps_exfil", "time": 0.0 }, { "name": "network_cnc_smtps_generic", "time": 0.0 }, { "name": "network_dns_idn", "time": 0.0 }, { "name": "network_dns_suspicious_querytype", "time": 0.0 }, { "name": "network_dns_tunneling_request", "time": 0.0 }, { "name": "network_document_http", "time": 0.0 }, { "name": "explorer_http", "time": 0.0 }, { "name": "network_fake_useragent", "time": 0.0 }, { "name": "legitimate_domain_abuse", "time": 0.0 }, { "name": "suspicious_communication_trusted_site", "time": 0.0 }, { "name": "network_document_file", "time": 0.0 }, { "name": "network_tor", "time": 0.0 }, { "name": "office_com_load", "time": 0.0 }, { "name": "office_dotnet_load", "time": 0.0 }, { "name": "office_mshtml_load", "time": 0.0 }, { "name": "office_vb_load", "time": 0.0 }, { "name": "office_wmi_load", "time": 0.0 }, { "name": "office_cve2017_11882", "time": 0.0 }, { "name": "office_cve2017_11882_network", "time": 0.0 }, { "name": "office_cve_2021_40444", "time": 0.0 }, { "name": "office_cve_2021_40444_m2", "time": 0.0 }, { "name": "office_flash_load", "time": 0.0 }, { "name": "office_postscript", "time": 0.0 }, { "name": "office_suspicious_processes", "time": 0.0 }, { "name": "office_write_exe", "time": 0.0 }, { "name": "persistence_via_autodial_dll_registry", "time": 0.0 }, { "name": "persistence_autorun", "time": 0.0 }, { "name": "persistence_autorun_tasks", "time": 0.0 }, { "name": "persistence_bootexecute", "time": 0.0 }, { "name": "persistence_registry_script", "time": 0.0 }, { "name": "powershell_network_connection", "time": 0.0 }, { "name": "powershell_download", "time": 0.0 }, { "name": "powershell_request", "time": 0.0 }, { "name": "createtoolhelp32snapshot_module_enumeration", "time": 0.0 }, { "name": "enumerates_running_processes", "time": 0.0 }, { "name": "process_interest", "time": 0.0 }, { "name": "process_needed", "time": 0.0 }, { "name": "mass_data_encryption", "time": 0.0 }, { "name": "ransomware_file_modifications", "time": 0.0 }, { "name": "ransomware_message", "time": 0.0 }, { "name": "nemty_network_activity", "time": 0.0 }, { "name": "nemty_note", "time": 0.0 }, { "name": "sodinokibi_behavior", "time": 0.0 }, { "name": "stop_ransomware_registry", "time": 0.0 }, { "name": "blackrat_apis", "time": 0.0 }, { "name": "blackrat_network_activity", "time": 0.0 }, { "name": "blackrat_registry_keys", "time": 0.0 }, { "name": "dcrat_behavior", "time": 0.0 }, { "name": "karagany_system_event_objects", "time": 0.0 }, { "name": "rat_luminosity", "time": 0.0 }, { "name": "rat_nanocore", "time": 0.0 }, { "name": "netwire_behavior", "time": 0.0 }, { "name": "obliquerat_network_activity", "time": 0.0 }, { "name": "orcusrat_behavior", "time": 0.0 }, { "name": "trochilusrat_apis", "time": 0.0 }, { "name": "reads_self", "time": 0.0 }, { "name": "recon_beacon", "time": 0.0 }, { "name": "recon_programs", "time": 0.0 }, { "name": "recon_systeminfo", "time": 0.0 }, { "name": "accesses_recyclebin", "time": 0.0 }, { "name": "remcos_shell_code_dynamic_wrapper_x", "time": 0.0 }, { "name": "removes_zoneid_ads", "time": 0.0 }, { "name": "script_created_process", "time": 0.0 }, { "name": "script_network_activity", "time": 0.0 }, { "name": "suspicious_js_script", "time": 0.0 }, { "name": "javascript_timer", "time": 0.0 }, { "name": "secure_login_phishing", "time": 0.0 }, { "name": "securityxploded_modules", "time": 0.0 }, { "name": "get_clipboard_data", "time": 0.0 }, { "name": "sets_autoconfig_url", "time": 0.0 }, { "name": "spoofs_procname", "time": 0.0 }, { "name": "stack_pivot", "time": 0.0 }, { "name": "stack_pivot_file_created", "time": 0.0 }, { "name": "stack_pivot_process_create", "time": 0.0 }, { "name": "set_clipboard_data", "time": 0.0 }, { "name": "stealth_childproc", "time": 0.0 }, { "name": "stealth_file", "time": 0.0 }, { "name": "stealth_timeout", "time": 0.0 }, { "name": "stealth_window", "time": 0.0 }, { "name": "queries_keyboard_layout", "time": 0.0 }, { "name": "queries_locale_api", "time": 0.0 }, { "name": "terminates_remote_process", "time": 0.0 }, { "name": "trickbot_task_delete", "time": 0.0 }, { "name": "uiautomationcore_load", "time": 0.0 }, { "name": "user_enum", "time": 0.0 }, { "name": "mmc_dll_script_load", "time": 0.0 }, { "name": "mmc_dotnet_load", "time": 0.0 }, { "name": "virus", "time": 0.0 }, { "name": "neshta_files", "time": 0.0 }, { "name": "neshta_regkeys", "time": 0.0 }, { "name": "webmail_phish", "time": 0.0 }, { "name": "persists_dev_util", "time": 0.0 }, { "name": "spawns_dev_util", "time": 0.0 }, { "name": "alters_windows_utility", "time": 0.0 }, { "name": "overwrites_accessibility_utility", "time": 0.0 }, { "name": "Potential_Lateral_Movement_Via_SMBEXEC", "time": 0.0 }, { "name": "potential_WebShell_Via_ScreenConnectServer", "time": 0.0 }, { "name": "uses_Microsoft_HTML_Help_Executable", "time": 0.0 }, { "name": "uses_windows_utilities_to_create_scheduled_task", "time": 0.0 }, { "name": "wiper_zeroedbytes", "time": 0.0 }, { "name": "wmi_create_process", "time": 0.0 }, { "name": "wmi_script_process", "time": 0.0 }, { "name": "antianalysis_tls_section", "time": 0.0 }, { "name": "antivirus_clamav", "time": 0.0 }, { "name": "antivirus_virustotal", "time": 0.0 }, { "name": "bad_certs", "time": 0.0 }, { "name": "bad_ssl_certs", "time": 0.0 }, { "name": "banker_zeus_p2p", "time": 0.0 }, { "name": "banker_zeus_url", "time": 0.0 }, { "name": "binary_yara", "time": 0.0 }, { "name": "bot_athenahttp", "time": 0.0 }, { "name": "bot_dirtjumper", "time": 0.0 }, { "name": "bot_drive", "time": 0.001 }, { "name": "bot_drive2", "time": 0.001 }, { "name": "bot_madness", "time": 0.0 }, { "name": "phishing_kit_detected", "time": 0.0 }, { "name": "family_proxyback", "time": 0.0 }, { "name": "flare_capa_antianalysis", "time": 0.0 }, { "name": "flare_capa_collection", "time": 0.0 }, { "name": "flare_capa_communication", "time": 0.0 }, { "name": "flare_capa_compiler", "time": 0.0 }, { "name": "flare_capa_datamanipulation", "time": 0.0 }, { "name": "flare_capa_executable", "time": 0.0 }, { "name": "flare_capa_hostinteraction", "time": 0.0 }, { "name": "flare_capa_impact", "time": 0.0 }, { "name": "flare_capa_lib", "time": 0.0 }, { "name": "flare_capa_linking", "time": 0.0 }, { "name": "flare_capa_loadcode", "time": 0.0 }, { "name": "flare_capa_malwarefamily", "time": 0.0 }, { "name": "flare_capa_nursery", "time": 0.0 }, { "name": "flare_capa_persistence", "time": 0.0 }, { "name": "flare_capa_runtime", "time": 0.0 }, { "name": "flare_capa_targeting", "time": 0.0 }, { "name": "threatfox", "time": 0.0 }, { "name": "log4shell", "time": 0.0 }, { "name": "mimics_extension", "time": 0.0 }, { "name": "network_country_distribution", "time": 0.0 }, { "name": "network_cnc_http", "time": 0.005 }, { "name": "network_ip_exe", "time": 0.001 }, { "name": "network_dga", "time": 0.0 }, { "name": "network_dga_fraunhofer", "time": 0.0 }, { "name": "network_dyndns", "time": 0.008 }, { "name": "network_excessive_udp", "time": 0.0 }, { "name": "network_http", "time": 0.002 }, { "name": "network_icmp", "time": 0.0 }, { "name": "network_irc", "time": 0.0 }, { "name": "network_open_proxy", "time": 0.002 }, { "name": "network_questionable_http_path", "time": 0.0 }, { "name": "network_questionable_https_path", "time": 0.0 }, { "name": "network_smtp", "time": 0.0 }, { "name": "network_torgateway", "time": 0.003 }, { "name": "origin_langid", "time": 0.0 }, { "name": "origin_resource_langid", "time": 0.0 }, { "name": "overlay", "time": 0.0 }, { "name": "packer_unknown_pe_section_name", "time": 0.0 }, { "name": "packer_aspack", "time": 0.0 }, { "name": "packer_aspirecrypt", "time": 0.0 }, { "name": "packer_bedsprotector", "time": 0.0 }, { "name": "packer_confuser", "time": 0.0 }, { "name": "packer_enigma", "time": 0.0 }, { "name": "packer_entropy", "time": 0.0 }, { "name": "packer_mpress", "time": 0.0 }, { "name": "packer_nate", "time": 0.0 }, { "name": "packer_nspack", "time": 0.0 }, { "name": "packer_smartassembly", "time": 0.0 }, { "name": "packer_spices", "time": 0.0 }, { "name": "packer_themida", "time": 0.0 }, { "name": "packer_titan", "time": 0.0 }, { "name": "packer_upx", "time": 0.0 }, { "name": "packer_vmprotect", "time": 0.0 }, { "name": "packer_yoda", "time": 0.0 }, { "name": "pdf_annot_urls_checker", "time": 0.0 }, { "name": "polymorphic", "time": 0.0 }, { "name": "punch_plus_plus_pcres", "time": 0.0 }, { "name": "procmem_yara", "time": 0.0 }, { "name": "recon_checkip", "time": 0.001 }, { "name": "static_authenticode", "time": 0.0 }, { "name": "invalid_authenticode_signature", "time": 0.0 }, { "name": "static_dotnet_anomaly", "time": 0.0 }, { "name": "static_java", "time": 0.0 }, { "name": "static_pdf", "time": 0.0 }, { "name": "contains_pe_overlay", "time": 0.0 }, { "name": "static_pe_anomaly", "time": 0.0 }, { "name": "pe_compile_timestomping", "time": 0.0 }, { "name": "static_pe_pdbpath", "time": 0.0 }, { "name": "static_rat_config", "time": 0.0 }, { "name": "static_versioninfo_anomaly", "time": 0.0 }, { "name": "suricata_alert", "time": 0.0 }, { "name": "suspicious_html_body", "time": 0.0 }, { "name": "suspicious_html_name", "time": 0.0 }, { "name": "suspicious_html_title", "time": 0.0 }, { "name": "volatility_devicetree_1", "time": 0.0 }, { "name": "volatility_handles_1", "time": 0.0 }, { "name": "volatility_ldrmodules_1", "time": 0.0 }, { "name": "volatility_ldrmodules_2", "time": 0.0 }, { "name": "volatility_malfind_1", "time": 0.0 }, { "name": "volatility_malfind_2", "time": 0.0 }, { "name": "volatility_modscan_1", "time": 0.0 }, { "name": "volatility_svcscan_1", "time": 0.0 }, { "name": "volatility_svcscan_2", "time": 0.0 }, { "name": "volatility_svcscan_3", "time": 0.0 }, { "name": "whois_create", "time": 0.0 }, { "name": "accesses_mailslot", "time": 0.001 }, { "name": "accesses_netlogon_regkey", "time": 0.001 }, { "name": "accesses_public_folder", "time": 0.001 }, { "name": "accesses_sysvol", "time": 0.002 }, { "name": "writes_sysvol", "time": 0.001 }, { "name": "adds_admin_user", "time": 0.0 }, { "name": "adds_user", "time": 0.0 }, { "name": "overwrites_admin_password", "time": 0.0 }, { "name": "antianalysis_detectfile", "time": 0.019 }, { "name": "antianalysis_detectreg", "time": 0.057 }, { "name": "modify_attachment_manager", "time": 0.0 }, { "name": "antiav_detectfile", "time": 0.035 }, { "name": "antiav_detectreg", "time": 0.271 }, { "name": "antiav_srp", "time": 0.0 }, { "name": "antiav_whitespace", "time": 0.0 }, { "name": "antidebug_devices", "time": 0.006 }, { "name": "antiemu_windefend", "time": 0.002 }, { "name": "antiemu_wine_reg", "time": 0.0 }, { "name": "antisandbox_cuckoo_files", "time": 0.001 }, { "name": "antisandbox_fortinet_files", "time": 0.001 }, { "name": "antisandbox_joe_anubis_files", "time": 0.001 }, { "name": "antisandbox_sboxie_mutex", "time": 0.0 }, { "name": "antisandbox_sunbelt_files", "time": 0.001 }, { "name": "antisandbox_threattrack_files", "time": 0.001 }, { "name": "antivm_bochs_keys", "time": 0.005 }, { "name": "antivm_generic_bios", "time": 0.003 }, { "name": "antivm_generic_diskreg", "time": 0.012 }, { "name": "antivm_hyperv_keys", "time": 0.005 }, { "name": "antivm_parallels_keys", "time": 0.016 }, { "name": "antivm_recentdocs", "time": 0.0 }, { "name": "antivm_vbox_devices", "time": 0.003 }, { "name": "antivm_vbox_files", "time": 0.014 }, { "name": "antivm_vbox_keys", "time": 0.031 }, { "name": "antivm_vmware_devices", "time": 0.0 }, { "name": "antivm_vmware_files", "time": 0.005 }, { "name": "antivm_vmware_keys", "time": 0.021 }, { "name": "antivm_vmware_mutexes", "time": 0.001 }, { "name": "antivm_vpc_files", "time": 0.001 }, { "name": "antivm_vpc_keys", "time": 0.011 }, { "name": "antivm_vpc_mutex", "time": 0.0 }, { "name": "antivm_xen_keys", "time": 0.015 }, { "name": "asyncrat_mutex", "time": 0.0 }, { "name": "gulpix_behavior", "time": 0.0 }, { "name": "ketrican_regkeys", "time": 0.005 }, { "name": "okrum_mutexes", "time": 0.0 }, { "name": "banker_cridex", "time": 0.001 }, { "name": "geodo_banking_trojan", "time": 0.01 }, { "name": "banker_spyeye_mutexes", "time": 0.001 }, { "name": "banker_zeus_mutex", "time": 0.001 }, { "name": "bitcoin_opencl", "time": 0.001 }, { "name": "enumerates_physical_drives", "time": 0.0 }, { "name": "bot_russkill", "time": 0.0 }, { "name": "browser_addon", "time": 0.001 }, { "name": "chromium_browser_extension_directory", "time": 0.0 }, { "name": "browser_helper_object", "time": 0.0 }, { "name": "browser_security", "time": 0.002 }, { "name": "browser_startpage", "time": 0.0 }, { "name": "ie_disables_process_tab", "time": 0.0 }, { "name": "odbcconf_bypass", "time": 0.0 }, { "name": "squiblydoo_bypass", "time": 0.0 }, { "name": "squiblytwo_bypass", "time": 0.0 }, { "name": "bypass_chromium_protection", "time": 0.0 }, { "name": "bypass_firewall", "time": 0.005 }, { "name": "checks_uac_status", "time": 0.002 }, { "name": "uac_bypass_cmstpcom", "time": 0.001 }, { "name": "uac_bypass_delegateexecute_sdclt", "time": 0.0 }, { "name": "uac_bypass_fodhelper", "time": 0.0 }, { "name": "cape_extracted_content", "time": 0.0 }, { "name": "carberp_mutex", "time": 0.0 }, { "name": "clears_logs", "time": 0.001 }, { "name": "cmdline_obfuscation", "time": 0.0 }, { "name": "cmdline_switches", "time": 0.0 }, { "name": "cmdline_terminate", "time": 0.0 }, { "name": "cmdline_forfiles_wildcard", "time": 0.0 }, { "name": "cmdline_http_link", "time": 0.0 }, { "name": "cmdline_long_string", "time": 0.0 }, { "name": "cmdline_reversed_http_link", "time": 0.0 }, { "name": "long_commandline", "time": 0.0 }, { "name": "powershell_renamed_commandline", "time": 0.0 }, { "name": "copies_self", "time": 0.0 }, { "name": "credwiz_credentialaccess", "time": 0.0 }, { "name": "enables_wdigest", "time": 0.0 }, { "name": "vaultcmd_credentialaccess", "time": 0.0 }, { "name": "file_credential_store_access", "time": 0.002 }, { "name": "file_credential_store_write", "time": 0.001 }, { "name": "kerberos_credential_access_via_rubeus", "time": 0.0 }, { "name": "registry_credential_dumping", "time": 0.0 }, { "name": "registry_credential_store_access", "time": 0.002 }, { "name": "registry_lsa_secrets_access", "time": 0.001 }, { "name": "comsvcs_credentialdump", "time": 0.0 }, { "name": "cryptomining_stratum_command", "time": 0.0 }, { "name": "cypherit_mutexes", "time": 0.0 }, { "name": "darkcomet_regkeys", "time": 0.004 }, { "name": "datop_loader", "time": 0.0 }, { "name": "deepfreeze_mutex", "time": 0.0 }, { "name": "deletes_executed_files", "time": 0.0 }, { "name": "disables_app_launch", "time": 0.0 }, { "name": "disables_auto_app_termination", "time": 0.0 }, { "name": "disables_appv_virtualization", "time": 0.0 }, { "name": "disables_backups", "time": 0.002 }, { "name": "disables_browser_warn", "time": 0.002 }, { "name": "disables_context_menus", "time": 0.0 }, { "name": "disables_cpl_disable", "time": 0.0 }, { "name": "disables_crashdumps", "time": 0.0 }, { "name": "disables_event_logging", "time": 0.0 }, { "name": "disables_folder_options", "time": 0.0 }, { "name": "disables_notificationcenter", "time": 0.0 }, { "name": "disables_power_options", "time": 0.002 }, { "name": "disables_restore_default_state", "time": 0.0 }, { "name": "disables_run_command", "time": 0.0 }, { "name": "disables_smartscreen", "time": 0.001 }, { "name": "disables_startmenu_search", "time": 0.001 }, { "name": "disables_system_restore", "time": 0.001 }, { "name": "disables_uac", "time": 0.0 }, { "name": "disables_wer", "time": 0.0 }, { "name": "disables_windows_defender", "time": 0.001 }, { "name": "disables_windows_defender_logging", "time": 0.001 }, { "name": "removes_windows_defender_contextmenu", "time": 0.001 }, { "name": "removes_windows_defender_updates", "time": 0.0 }, { "name": "windows_defender_powershell", "time": 0.0 }, { "name": "disables_windows_file_protection", "time": 0.0 }, { "name": "disables_windowsupdate", "time": 0.0 }, { "name": "disables_winfirewall", "time": 0.0 }, { "name": "discover_registry_mount_points", "time": 0.001 }, { "name": "adfind_domain_enumeration", "time": 0.0 }, { "name": "domain_enumeration_commands", "time": 0.0 }, { "name": "andromut_mutexes", "time": 0.0 }, { "name": "downloader_cabby", "time": 0.0 }, { "name": "phorpiex_mutexes", "time": 0.0 }, { "name": "protonbot_mutexes", "time": 0.0 }, { "name": "driver_filtermanager", "time": 0.001 }, { "name": "dropper", "time": 0.0 }, { "name": "dll_archive_execution", "time": 0.0 }, { "name": "lnk_archive_execution", "time": 0.0 }, { "name": "script_archive_execution", "time": 0.0 }, { "name": "excel4_macro_urls", "time": 0.0 }, { "name": "escalate_privilege_via_ntlm_relay", "time": 0.0 }, { "name": "spooler_access", "time": 0.0 }, { "name": "spooler_svc_start", "time": 0.0 }, { "name": "mapped_drives_uac", "time": 0.0 }, { "name": "hides_recycle_bin_icon", "time": 0.0 }, { "name": "apocalypse_stealer_file_behavior", "time": 0.001 }, { "name": "arkei_files", "time": 0.001 }, { "name": "azorult_mutexes", "time": 0.002 }, { "name": "infostealer_bitcoin", "time": 0.02 }, { "name": "cryptbot_files", "time": 0.001 }, { "name": "echelon_files", "time": 0.003 }, { "name": "infostealer_ftp", "time": 0.102 }, { "name": "infostealer_im", "time": 0.06 }, { "name": "infostealer_mail", "time": 0.024 }, { "name": "masslogger_files", "time": 0.0 }, { "name": "poullight_files", "time": 0.009 }, { "name": "purplewave_mutexes", "time": 0.0 }, { "name": "quilclipper_mutexes", "time": 0.0 }, { "name": "qulab_files", "time": 0.007 }, { "name": "qulab_mutexes", "time": 0.0 }, { "name": "asyncrat_mutex", "time": 0.0 }, { "name": "Evade_Execution_Via_ASPNet_Compiler", "time": 0.0 }, { "name": "Evade_Execute_Via_DeviceCredentialDeployment", "time": 0.0 }, { "name": "Evade_Execution_Via_Filter_Manager_Control", "time": 0.0 }, { "name": "Evade_Execution_Via_Intel_GFXDownloadWrapper", "time": 0.0 }, { "name": "execute_binary_via_appvlp", "time": 0.0 }, { "name": "execute_binary_via_pcalua", "time": 0.0 }, { "name": "Execute_Binary_Via_OpenSSH", "time": 0.0 }, { "name": "execute_binary_via_pcalua", "time": 0.0 }, { "name": "Execute_Binary_Via_PesterPSModule", "time": 0.0 }, { "name": "Execute_Binary_Via_ScriptRunner", "time": 0.0 }, { "name": "execute_binary_via_ttdinject", "time": 0.0 }, { "name": "Execute_Binary_Via_VisualStudioLiveShare", "time": 0.0 }, { "name": "Execute_Msiexec_Via_Explorer", "time": 0.0 }, { "name": "execute_remote_msi", "time": 0.0 }, { "name": "execute_suspicious_powershell_via_runscripthelper", "time": 0.0 }, { "name": "execute_suspicious_powershell_via_sqlps", "time": 0.0 }, { "name": "Indirect_Command_Execution_Via_ConsoleWindowHost", "time": 0.0 }, { "name": "Perform_Malicious_Activities_Via_Headless_Browser", "time": 0.0 }, { "name": "Register_DLL_Via_CertOC", "time": 0.0 }, { "name": "Register_DLL_Via_MSIEXEC", "time": 0.0 }, { "name": "Register_DLL_Via_Odbcconf", "time": 0.0 }, { "name": "Scriptlet_Proxy_Execution_Via_Pubprn", "time": 0.0 }, { "name": "ie_martian_children", "time": 0.0 }, { "name": "office_martian_children", "time": 0.0 }, { "name": "mimics_icon", "time": 0.0 }, { "name": "masquerade_process_name", "time": 0.035 }, { "name": "mimikatz_modules", "time": 0.0 }, { "name": "ms_office_cmd_rce", "time": 0.0 }, { "name": "mount_copy_to_webdav_share", "time": 0.0 }, { "name": "potential_protocol_tunneling_via_legit_utilities", "time": 0.0 }, { "name": "potential_protocol_tunneling_via_qemu", "time": 0.0 }, { "name": "suspicious_execution_via_dotnet_remoting", "time": 0.0 }, { "name": "modify_certs", "time": 0.0 }, { "name": "dotnet_clr_usagelog_regkeys", "time": 0.0 }, { "name": "modify_hostfile", "time": 0.0 }, { "name": "modify_oem_information", "time": 0.001 }, { "name": "modify_security_center_warnings", "time": 0.001 }, { "name": "modify_uac_prompt", "time": 0.001 }, { "name": "network_dns_blockchain", "time": 0.001 }, { "name": "network_dns_opennic", "time": 0.002 }, { "name": "network_dns_paste_site", "time": 0.002 }, { "name": "network_dns_reverse_proxy", "time": 0.0 }, { "name": "network_dns_temp_file_storage", "time": 0.002 }, { "name": "network_dns_temp_urldns", "time": 0.0 }, { "name": "network_dns_url_shortener", "time": 0.019 }, { "name": "network_dns_doh_tls", "time": 0.001 }, { "name": "suspicious_tld", "time": 0.015 }, { "name": "network_tor_service", "time": 0.001 }, { "name": "office_code_page", "time": 0.0 }, { "name": "office_addinloading", "time": 0.0 }, { "name": "office_perfkey", "time": 0.0 }, { "name": "office_macro", "time": 0.0 }, { "name": "changes_trust_center_settings", "time": 0.0 }, { "name": "disables_vba_trust_access", "time": 0.0 }, { "name": "office_macro_autoexecution", "time": 0.0 }, { "name": "office_macro_ioc", "time": 0.0 }, { "name": "office_macro_malicious_prediction", "time": 0.0 }, { "name": "office_macro_suspicious", "time": 0.0 }, { "name": "rtf_aslr_bypass", "time": 0.0 }, { "name": "rtf_anomaly_characterset", "time": 0.0 }, { "name": "rtf_anomaly_version", "time": 0.0 }, { "name": "rtf_embedded_content", "time": 0.0 }, { "name": "rtf_embedded_office_file", "time": 0.0 }, { "name": "rtf_exploit_static", "time": 0.0 }, { "name": "office_security", "time": 0.0 }, { "name": "accesses_office_username", "time": 0.001 }, { "name": "office_anomalous_feature", "time": 0.0 }, { "name": "office_dde_command", "time": 0.0 }, { "name": "packer_armadillo_mutex", "time": 0.0 }, { "name": "packer_armadillo_regkey", "time": 0.001 }, { "name": "persistence_ads", "time": 0.0 }, { "name": "persistence_safeboot", "time": 0.0 }, { "name": "persistence_ifeo", "time": 0.0 }, { "name": "persistence_silent_process_exit", "time": 0.0 }, { "name": "persistence_rdp_registry", "time": 0.001 }, { "name": "persistence_rdp_shadowing", "time": 0.0 }, { "name": "persistence_service", "time": 0.0 }, { "name": "persistence_shim_database", "time": 0.001 }, { "name": "powerpool_mutexes", "time": 0.0 }, { "name": "powershell_scriptblock_logging", "time": 0.0 }, { "name": "powershell_command_suspicious", "time": 0.0 }, { "name": "powershell_history_save_mod", "time": 0.0 }, { "name": "powershell_renamed", "time": 0.0 }, { "name": "powershell_reversed", "time": 0.0 }, { "name": "powershell_variable_obfuscation", "time": 0.0 }, { "name": "prevents_safeboot", "time": 0.0 }, { "name": "cmdline_process_discovery", "time": 0.0 }, { "name": "cryptomix_mutexes", "time": 0.0 }, { "name": "dharma_mutexes", "time": 0.0 }, { "name": "ransomware_extensions_generic", "time": 0.001 }, { "name": "ransomware_extensions_known", "time": 0.018 }, { "name": "ransomware_files", "time": 0.038 }, { "name": "fonix_mutexes", "time": 0.0 }, { "name": "gandcrab_mutexes", "time": 0.0 }, { "name": "germanwiper_mutexes", "time": 0.0 }, { "name": "medusalocker_mutexes", "time": 0.0 }, { "name": "medusalocker_regkeys", "time": 0.002 }, { "name": "nemty_mutexes", "time": 0.0 }, { "name": "nemty_regkeys", "time": 0.001 }, { "name": "pysa_mutexes", "time": 0.0 }, { "name": "ransomware_radamant", "time": 0.001 }, { "name": "ransomware_recyclebin", "time": 0.0 }, { "name": "revil_mutexes", "time": 0.002 }, { "name": "ransomware_revil_regkey", "time": 0.0 }, { "name": "satan_mutexes", "time": 0.001 }, { "name": "snake_ransom_mutexes", "time": 0.0 }, { "name": "stop_ransom_mutexes", "time": 0.0 }, { "name": "stop_ransomware_cmd", "time": 0.0 }, { "name": "ransomware_stopdjvu", "time": 0.0 }, { "name": "rat_beebus_mutexes", "time": 0.0 }, { "name": "blacknet_mutexes", "time": 0.0 }, { "name": "blackrat_mutexes", "time": 0.0 }, { "name": "crat_mutexes", "time": 0.001 }, { "name": "dcrat_files", "time": 0.001 }, { "name": "dcrat_mutexes", "time": 0.0 }, { "name": "rat_fynloski_mutexes", "time": 0.0 }, { "name": "limerat_mutexes", "time": 0.0 }, { "name": "limerat_regkeys", "time": 0.004 }, { "name": "lodarat_file_behavior", "time": 0.0 }, { "name": "modirat_behavior", "time": 0.002 }, { "name": "njrat_regkeys", "time": 0.0 }, { "name": "obliquerat_files", "time": 0.002 }, { "name": "obliquerat_mutexes", "time": 0.0 }, { "name": "parallax_mutexes", "time": 0.0 }, { "name": "rat_pcclient", "time": 0.003 }, { "name": "rat_plugx_mutexes", "time": 0.0 }, { "name": "rat_poisonivy_mutexes", "time": 0.0 }, { "name": "rat_quasar_mutexes", "time": 0.0 }, { "name": "ratsnif_mutexes", "time": 0.0 }, { "name": "rat_spynet", "time": 0.001 }, { "name": "venomrat_mutexes", "time": 0.0 }, { "name": "warzonerat_files", "time": 0.002 }, { "name": "warzonerat_regkeys", "time": 0.003 }, { "name": "xpertrat_files", "time": 0.0 }, { "name": "xpertrat_mutexes", "time": 0.001 }, { "name": "rat_xtreme_mutexes", "time": 0.0 }, { "name": "reads_password_database", "time": 0.002 }, { "name": "recon_fingerprint", "time": 0.004 }, { "name": "remcos_files", "time": 0.001 }, { "name": "remcos_mutexes", "time": 0.0 }, { "name": "remcos_regkeys", "time": 0.003 }, { "name": "rdptcp_key", "time": 0.0 }, { "name": "uses_rdp_clip", "time": 0.0 }, { "name": "uses_remote_desktop_session", "time": 0.0 }, { "name": "removes_networking_icon", "time": 0.0 }, { "name": "removes_pinned_programs", "time": 0.001 }, { "name": "removes_security_maintenance_icon", "time": 0.0 }, { "name": "removes_startmenu_defaults", "time": 0.001 }, { "name": "removes_username_startmenu", "time": 0.0 }, { "name": "spicyhotpot_behavior", "time": 0.001 }, { "name": "sniffer_winpcap", "time": 0.004 }, { "name": "spreading_autoruninf", "time": 0.001 }, { "name": "stealth_hidden_extension", "time": 0.0 }, { "name": "stealth_hiddenreg", "time": 0.001 }, { "name": "stealth_hide_notifications", "time": 0.0 }, { "name": "stealth_webhistory", "time": 0.001 }, { "name": "sysinternals_psexec", "time": 0.0 }, { "name": "sysinternals_tools", "time": 0.0 }, { "name": "language_check_registry", "time": 0.003 }, { "name": "tampers_etw", "time": 0.001 }, { "name": "lsa_tampering", "time": 0.0 }, { "name": "tampers_powershell_logging", "time": 0.0 }, { "name": "targeted_flame", "time": 0.002 }, { "name": "territorial_disputes_sigs", "time": 0.093 }, { "name": "trickbot_mutex", "time": 0.0 }, { "name": "fleercivet_mutex", "time": 0.0 }, { "name": "lokibot_mutexes", "time": 0.001 }, { "name": "ursnif_behavior", "time": 0.002 }, { "name": "uses_adfind", "time": 0.0 }, { "name": "uses_ms_protocol", "time": 0.0 }, { "name": "neshta_mutexes", "time": 0.0 }, { "name": "renamer_mutexes", "time": 0.0 }, { "name": "owa_web_shell_files", "time": 0.0 }, { "name": "web_shell_files", "time": 0.0 }, { "name": "web_shell_processes", "time": 0.0 }, { "name": "dotnet_csc_build", "time": 0.0 }, { "name": "mavinject_lolbin", "time": 0.0 }, { "name": "multiple_explorer_instances", "time": 0.0 }, { "name": "script_tool_executed", "time": 0.0 }, { "name": "suspicious_certutil_use", "time": 0.0 }, { "name": "suspicious_command_tools", "time": 0.008 }, { "name": "suspicious_mpcmdrun_use", "time": 0.0 }, { "name": "suspicious_ping_use", "time": 0.0 }, { "name": "uses_powershell_copyitem", "time": 0.0 }, { "name": "uses_windows_utilities", "time": 0.009 }, { "name": "uses_windows_utilities_appcmd", "time": 0.0 }, { "name": "uses_windows_utilities_csvde_ldifde", "time": 0.0 }, { "name": "uses_windows_utilities_cipher", "time": 0.0 }, { "name": "uses_windows_utilities_clickonce", "time": 0.0 }, { "name": "uses_windows_utilities_curl", "time": 0.0 }, { "name": "uses_windows_utilities_dsquery", "time": 0.0 }, { "name": "uses_windows_utilities_esentutl", "time": 0.0 }, { "name": "uses_windows_utilities_finger", "time": 0.0 }, { "name": "uses_windows_utilities_mode", "time": 0.0 }, { "name": "uses_windows_utilities_ntdsutil", "time": 0.0 }, { "name": "uses_windows_utilities_nltest", "time": 0.0 }, { "name": "uses_windows_utilities_setx", "time": 0.0 }, { "name": "uses_windows_utilities_xcopy", "time": 0.0 }, { "name": "wmic_command_suspicious", "time": 0.0 }, { "name": "scrcons_wmi_script_consumer", "time": 0.0 }, { "name": "allaple_mutexes", "time": 0.001 } ], "reporting": [ { "name": "BinGraph", "time": 0.0 } ] }, "target": { "category": "file", "file": { "name": "sex1.exe", "path": "/opt/CAPEv2/storage/binaries/2c14151d8f546aed480a7eda9be556bd37831020a3ab6d40eb993c260c9ee26b", "guest_paths": "", "size": 207872, "crc32": "EE2F2CEA", "md5": "ec0381bf2a31d2ce2e4a00f809db6266", "sha1": "cbb5b6fc88aa57b1675a71a7e1d9eede95238315", "sha256": "2c14151d8f546aed480a7eda9be556bd37831020a3ab6d40eb993c260c9ee26b", "sha512": "f4d2af561ceabbb1793af9866d1efc6497886d6447b658e1ac37fbc650ba95a27a017b16574959388ca88354c9041ae781aa31caeaa5cc06b26b017d819b8614", "rh_hash": null, "ssdeep": "6144:sLV6Bta6dtJmakIM5PMBrwBJnaMC8xFev7y4QT1ta:sLV6BtpmkKMFIPHPe2Dta", "type": "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows", "yara": [ { "name": "DITEKSHEN_MALWARE_Win_Nanocore", "meta": { "description": "Detects NanoCore", "author": "ditekSHen", "id": "931b98f6-df2b-538b-bc49-ecbbd24334da", "date": "2020-11-06", "modified": "2024-11-01", "reference": "https://github.com/ditekshen/detection", "source_url": "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7654-L7681", "license_url": "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt", "logic_hash": "6336260e0af2b4b51338ee066f41b7c58aa134a6c03ca110db7e088edf2b65a7", "score": 75, "quality": 75, "tags": "FILE" }, "strings": [ "NanoCore Client", "NanoCore.ClientPlugin", "NanoCore.ClientPluginHost", "IClientApp", "IClientData", "IClientNetwork", "IClientAppHost", "IClientDataHost", "IClientLoggingHost", "IClientNetworkHost", "IClientUIHost", "IClientNameObjectCollection", "IClientReadOnlyNameObjectCollection", "ClientPlugin", "EndPoint", "IPAddress", "IPEndPoint", "get_ClientSettings", "get_Connected" ], "addresses": { "x1": 65285, "x2": 65869, "x3": 65933, "i1": 65858, "i2": 65891, "i3": 65903, "i4": 65918, "i5": 65959, "i6": 65975, "i7": 65994, "i8": 66013, "i9": 66027, "i10": 66055, "s1": 65878, "s2": 67146, "s3": 67155, "s4": 67165, "s6": 73875, "s7": 75319 } }, { "name": "Windows_Trojan_Nanocore_d8c4e3c5", "meta": { "author": "Elastic Security", "id": "d8c4e3c5-8bcc-43d2-9104-fa3774282da5", "fingerprint": "e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4", "creation_date": "2021-06-13", "last_modified": "2021-08-23", "threat_name": "Windows.Trojan.Nanocore", "reference_sample": "b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd", "severity": 100, "arch_context": "x86, arm64", "scan_context": "file, memory", "license": "Elastic License v2", "os": "windows" }, "strings": [ "NanoCore.ClientPluginHost", "NanoCore.ClientPlugin", "get_BuilderSettings", "ClientLoaderForm.resources", "PluginCommand", "IClientAppHost", "GetBlockHash", "AddHostEntry", "LogClientException", "PipeExists", "IClientLoggingHost" ], "addresses": { "a1": 65933, "a2": 65869, "b1": 73894, "b2": 65449, "b3": 71622, "b4": 65918, "b5": 108030, "b6": 75518, "b7": 91121, "b8": 75371, "b9": 65975 } }, { "name": "Nanocore", "meta": { "description": "detect Nanocore in memory", "author": "JPCERT/CC Incident Response Group", "rule_usage": "memory scan", "reference": "internal research" }, "strings": [ "NanoCore Client", "PluginCommand", "CommandType" ], "addresses": { "v1": 65285, "v2": 71622, "v3": 71598 } }, { "name": "Nanocore_RAT_Gen_2", "meta": { "description": "Detetcs the Nanocore RAT", "author": "Florian Roth", "score": 100, "reference": "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/", "date": "2016-04-22", "hash1": "755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050" }, "strings": [ "NanoCore.ClientPluginHost", "IClientNetworkHost", "#=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe" ], "addresses": { "x1": 65933, "x2": 65994, "x3": 81149 } }, { "name": "NanoCore", "meta": { "author": " Kevin Breen ", "date": "2014/04", "ref": "http://malwareconfig.com/stats/NanoCore", "maltype": "Remote Access Trojan", "filetype": "exe" }, "strings": [ "NanoCore", "ClientPlugin", "ProjectData", "DESCrypto", "KeepAlive", "LogClientMessage", "get_Connected", "#=q" ], "addresses": { "a": 65933, "b": 65942, "c": 65659, "d": 68226, "e": 99406, "g": 91196, "i": 75319, "j": 108466 } }, { "name": "NETexecutableMicrosoft", "meta": { "author": "malware-lu" }, "strings": [ "{ 00 00 00 00 00 00 00 00 5F 43 6F 72 45 78 65 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 00 00 00 FF 25 }" ], "addresses": { "a0": 117102 } }, { "name": "IsPE32", "meta": {}, "strings": [], "addresses": {} }, { "name": "IsNET_EXE", "meta": {}, "strings": [], "addresses": {} }, { "name": "IsWindowsGUI", "meta": {}, "strings": [], "addresses": {} }, { "name": "IsPacked", "meta": { "description": "Entropy Check" }, "strings": [], "addresses": {} }, { "name": "Microsoft_Visual_Studio_NET", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "a": 117138 } }, { "name": "Microsoft_Visual_C_v70_Basic_NET_additional", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "a": 117138 } }, { "name": "Microsoft_Visual_C_Basic_NET", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "b": 117138 } }, { "name": "Microsoft_Visual_Studio_NET_additional", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "a": 117138 } }, { "name": "Microsoft_Visual_C_v70_Basic_NET", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "b": 117138 } }, { "name": "NET_executable_", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "a": 117138 } }, { "name": "NET_executable", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "b": 117138 } } ], "cape_yara": [ { "name": "NanoCore", "meta": { "author": " Kevin Breen ", "ref": "http://malwareconfig.com/stats/NanoCore", "maltype": "Remote Access Trojan", "filetype": "exe", "cape_type": "NanoCore Payload" }, "strings": [ "NanoCore", "ClientPlugin", "ProjectData", "DESCrypto", "KeepAlive", "LogClientMessage", "get_Connected", "#=q" ], "addresses": { "a": 65933, "b": 65942, "c": 65659, "d": 68226, "e": 99406, "g": 91196, "i": 75319, "j": 108466 } } ], "clamav": [], "tlsh": "T1D814C01577A94A2FD2DE82B961221143937CC2E399C3F7EE28D864B74F267E50A071D3", "sha3_384": "ec3dce417ea77de9d5ffe299d314856d9fe313aef6f2d0756bd3c1d5189229fa7ec47b248eca9b4b3e92aa5ea87b0095", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "pe": { "guest_signers": { "aux_sha1": null, "aux_timestamp": null, "aux_valid": false, "aux_error": true, "aux_error_desc": "No signature found.", "aux_signers": [] }, "digital_signers": [], "imagebase": "0x00400000", "entrypoint": "0x0001e792", "ep_bytes": "ff250020400000000000000000000000", "peid_signatures": null, "reported_checksum": "0x00000000", "actual_checksum": "0x00032e66", "osversion": "4.0", "machine_type": "IMAGE_FILE_MACHINE_I386", "pdbpath": null, "imports": { "mscoree": { "dll": "mscoree.dll", "imports": [ { "address": "0x402000", "name": "_CorExeMain" } ] } }, "exported_dll_name": null, "exports": [], "dirents": [ { "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "virtual_address": "0x0001e738", "size": "0x00000057" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "virtual_address": "0x00022000", "size": "0x00015fa8" }, { "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "virtual_address": "0x00020000", "size": "0x0000000c" }, { "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_TLS", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IAT", "virtual_address": "0x00002000", "size": "0x00000008" }, { "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "virtual_address": "0x00002008", "size": "0x00000048" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESERVED", "virtual_address": "0x00000000", "size": "0x00000000" } ], "sections": [ { "name": ".text", "raw_address": "0x00000200", "virtual_address": "0x00002000", "virtual_size": "0x0001c798", "size_of_data": "0x0001c800", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "6.60" }, { "name": ".reloc", "raw_address": "0x0001ca00", "virtual_address": "0x00020000", "virtual_size": "0x0000000c", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x42000040", "entropy": "0.10" }, { "name": ".rsrc", "raw_address": "0x0001cc00", "virtual_address": "0x00022000", "virtual_size": "0x00015fa8", "size_of_data": "0x00016000", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "8.00" } ], "overlay": null, "resources": [ { "name": "RT_RCDATA", "offset": "0x00022058", "size": "0x00015f50", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "8.00" } ], "versioninfo": [], "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "timestamp": "2015-02-22 00:49:37", "icon": null, "icon_hash": null, "icon_fuzzy": null, "icon_dhash": null, "imported_dll_count": 1 }, "data": null, "strings": [ "|\"$V1", "#=qoTNlk$Wngv$bqPRyj4mJig==", "Environment", "#=qKraENZVscKMtH4GMIJjzqA==", "_Lambda$__2", "ReadInt16", "NtSetInformationProcess", "RebuildHostCache", "EndPoint", "Random", "#=qbwvWShVSL8DgrXXfPQ9kNmpf6pmcj6q57bPfcsBp938=", "WriteAllText", "AddressFamily", "#=qZ8pysPk74rQ5GX0s5CkOJQ==", "Int32", "#=qYpD2x2QTNARNJcnXxG0OjQ==", "#=qeMVJwq86lZc4hsNJNMQJVYiQqG94mfqhBGc9gH9UUgM=", "2}}bV", "#=qB4sApeDyjGxBivHLwR3FTJejGBlbih3hr3f3TS7BFbY=", "System.Text", "#=qmcl1D6lgUOLuKGFFyxMamg==", "FileCommand", "#=qN9Enun6Rlq30xNdBjhzY0A==", ":Xj|:\"", "add_Completed", "Uninstall", "#=qq_SehjaC_F9U66vu1NLqjA==", "#=qL6PdpQwMNSdyVKw3FgboNw==", "#=qPfVuk6552RtecCgHDnGSkA==", "iFl8H", "#=qkcVkJskuGA4o7kGuN79i1w==", "#=q$6NbEg0Hb4neXdXPgEgHJA==", "#=qd8WIZO8f6IRqdUmvxawj1w==", "#=qGxD085Z3RQaUY4iGwWH$xgEmRYVWDAN6hxNjaXokfVc=", "#=qyM$eq2QFDjIwNzxtrtw3WE5gHFsUOsREqnRunYWzTvs=", "ReadAllBytes", "FileStream", "MemberInfo", "get_Width", "#=qCJD3QzeNpOG7t7hUNPqgxgwPhMjv4aui2ikN049iz28=", "#=qzRcQ_b8FoTlpKT_BObsgBl2bj71wU5HcYdpIIgiTJ5c=", "#=q$njopRrPblqe$yrs$rsu5Q==", "SpecialFolder", "#=q5QHPwKvqpNRA$cKFBj8i9w==", "0*KfE[", "#=q$YUIMaEFO5IFZXBvo0kclw==", "DebuggerDisplayAttribute", "]", "e?A?v", "EntryExists", "#=qoGHQsKlZ7jK$YeTeBpzDNYYM4Z1FIrOpXaDV$VTAdfM=", "Process", "#=qHamFicykpD9fQKnU2wtqJw==", "cV?Z|N'", "#=qWaMf_MISHPEu34of2Bm5$ay6Z6PuaGN7w1jlKYjzwdE=", "5s4*D", "n6X_V", "#=qlV3FbiF00r5Vrp5nqoncyxDHZMuHB7yuJa7xS77K3BQ=", "#=qvPYkN4Wli543LScsy6rh$bZ0bDIN0tYd5zlNUibOEKfBRc13v6NIDRtsxPOZzKpX", "#=qE8a8ikTp6zyXXyhNYzK8Wg==", "#=qScWgGHvDwJ0da_7qXoO28aGE1ea7zp5$XjEJLTXkuHQ=", "SocketException", "ResolveEventHandler", "*PuZI", "/U-WT}", "System", "#=qKxYY$jYG8_7mT_7R0n5jfw==", "#=q5s6lzZCgRNNe2Z9HZfa94HOHkpUfSnAwZsGo$hzh7hY=", "get_ExceptionObject", "ReceiveAsync", "#=qksh921Ur22JKhSIAXESSag==", "#=qwK7$pNtMfqKNZt8gGYd$pw==", "#=qEoM$dAPD9j9L1YOZU2B97iwm0vZOJe13LDB3GayWQEo=", "#=qZ79zrlLw6T9kJCHt$e306HkmYpQl8J1ugf3bmy8tycE=", "#=qKoyC_0Y6bPLCPvDcJr2y5A==", "set_Verb", "FromBinary", "#=qwSPuuWVW8tz$gDazhda2d$myXXX0Ro_wRP7Rmm8JiiT9wA1EeeaPUV2jnUkQOCHa", "J.eD$", "Rb:1>@", "6t|Oj", "#=qiIt1yNcUYn9ksB4loCZmUQ==", "s~F,r", "GetUnderlyingType", "-$& ,'", "48saj", "-p&~C", ",@&(\\", "#=qwdHHpd7UWv1_2lcOeunA18XKUsrG9D8S$xli$tkAMlI=", "#=qp7rlpRCprgGh7RCnHteaLw==", "#=qU1g6m1CiJ5yzLECox1hBrw==", "#=qkrqC_kLD0I$zOgfqD$aGaA==", "ToInteger", "#=qaCmGqb7phy5lq$DAzhK3vB71XCZSvhKm3BtGKq_xBto=", "Wsr!&", "CompilerGeneratedAttribute", "#=qXfm3QhQkyfcZgbFdAZgHHmadm7n1N0mfKcKBqrdfAk4=", "#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=", "#=qzB1OZ89gRpxcPckUn_afNY2d0beSpEyl40_4IarIxzM=", "pe&fz", "RijndaelManaged", "#=qgSHqO_KLHRARFg70SGn_Mw==", "0D2T)", "~(0(UV", "#=qDx8yS5wU6EQSawGC841xnw==", "SetValue", "#=qJe4Aop6J2k_bK0f$hS3ZOQ==", "LingerOption", "WindowsIdentity", "#=q4KMIX0AcXAdYuUiSKvyy9Q==", "DeleteValue", "#=qbOmsEb0zGpdZukI0D4Idug==", "#=q23tIFHA2cbwzlg6YDYhwLkXCJGgIhllZCGmc4pRC8rI=", "#=q1uJdtbJoEKhZjOld7SeHjw==", "#=q4N2IYJkFi2VWiCVDKVND$8gixU$DXUcX8F2LiLBxLHw=", "#=qzjMBSDJWeEdkUWCBxYatrQ==", "#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=", "#=qb$tFKVReqZMI9M678cKWGdlE1UJqJBfHAfOfQhXuW5c=", "v2.0.50727", "BlockCopy", "#Strings", "afeffeefeffe", "System.Collections.Generic", "#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=", "FzAV/k!", "#=q2dXdGRU_h62YVIUhgXBQJzEnralpXNvp017RQs19jjo=", "Replace", "#=q$XurN5kwCvUuDGDncP4myluEGVmoB5AfvTb_Ct0PT5c=", "<_bG;ZY", "s8=V<", "#=qWcYPgOJASLG6mRBDPhOIZERKO3Eig2IiEWCrUa$w_Mw=", "set_Item", "#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=", "c`iD>", "0vn50\\", "#=qTfMnD_jfiITiB95ES2nWdLlDTdGOSDVgXEnjKNGkWcM=", "#=qxb6WVOMh6wjcZFY_Q0MJOQ==", "EndOfStreamException", "ToBinary", "#=qUWYBucdXrqr2Ksc_3qKZcA==", "#=q97ilq24aAenhk$hG8MzEMQ==", "BuildingHostCache", "DirectoryInfo", "#=q8r1xTCj7grAlhMxU0cmrbA==", "value__", "#=qFv$qWif57TCUNsu_O3F3gA==", "rYs|e", "#=qSYke1CBEgOP5WhDQ2wCOhA==", "SuppressIldasmAttribute", "CommandType", "#=qTSoRMaNGYiiBNK9Yfq59T$2z3sNScYh9uxoeWlhnD_A=", "get_Hash", "UIntPtr", "#=qJY6uBmA7bjB3pfI3CAMZ7w==", "GetFrame", "G4pEt", "#=q8Lz$o21atQxw0qUwF07ufqfk8jjJrspNc$L9E2y_kjQA$2GQzuj5BmjDMXRcd0oL", "#=qkcPDXy2$GrSLn1ykhNxS$A==", "NE7WV", "#=qLJcloNvItceT7R54Ssv5HVCoj0j2JUUq_dQXQpFZZjM=", "#=qafzQcMCK0eVSctI0IcD2PA==", "#=q5W7RemVArrFCeEyFuvU4Hg==", "MoveNext", "UInt32", "#=qV4bSY95FY8CPz8U7EzzkRg==", "#=qUaHlQloQ1heHsricyshXiA==", "#=qYVgYkiAmhdTmisXUMVHYlJUHzcBdggj3Sn3nLI_MDJ4=", "#=qulZN_JfMbEqc2jFbEooALI6mh8tLy9$3NFedHEXAIAw=", "u~-U8", "=oRe%L6j", "Assembly", "#=qUbRtqAPcSxRMI51YgNXGZ9omJvV5BvuqBNocgi7xl6Q=", "sRvb\\", "#=qrIbbxniIme2qLTdRw6i0wDoZFMH5BWs03iMeSnjojQU=", "System.Reflection", "#=qAoRzrFi9HiHjyPL0ixkVXA==", ".", "DebuggerStepThroughAttribute", "#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=", "#=qJrzYsTPKAwT$ubz_aq99mw==", "Cf{vp", "Int64", "#=qtBt$1AtaHrrce6fc6LOT3axuBNxZ$SQPty78qYGi1os=", "#=qfjs2lYYPRWKuXjeHrc8Rtg==", "\\CZM8", "#=qbUu2Y2P9FL2iRkWyb62gww==", "GetCustomAttributes", "#=qul8YRvQj1pWpo4_UxgOSzOBvtncEE$VPCzTeLK_rIz4EnXxineVkwF$lTxruKPxr", "IntPtr", "9beO0o", "#=q91nKS7P$i0qKCqvUAPW9EQ==", "#=qos7yzAcb5jR$ypc0Qk3OWQ==", "#=qw9FR63zXVj$omVnwg0u37A==", "ReadUInt64", "#=q$Rh_ulnlhN$9Zn9n4fKAsvWT9cisaHT_PgvcGANnd6o=", "&&*}#", "#=qiCTCgJQkyH_Kzq$FT43G4Q==", "#=qCeJ_QwVb__fbuEImkTXwSg==", "#=qURIxMOG0HImwEP4A6zEiPg==", "#=qxQTn_t1ZFKKNm77mQ5vH9cInicm2Cv9jGtv9vmIpksI=", "#=qQLqXliLS$ujl108DGV7$zv9jo8WyYr7oxBJvAgzllyk=", "0e%.d|", "GetExecutingAssembly", "#=qqIzVXHiNuUY4ZNiSxkqEGQ==", "GetTempFileName", "_Lambda$__5", "#=qEnv9WsExz6baZJKRUDupw9eEQbgJVjj69NjcsJ7hrBk=", "$5ce1dc0b-04ba-4048-aa8d-caa0354c0972", "Xy{K-", "#=q6pErmyx6x4$YkotXXEXGCt_ysi5JdNm1fpNgnUvZ9LE6EtA8E0TapqXrPnqyBO1x", "#=qr6ouJTA2RwDm_3Z$eUP6TCvbpSA$yAFGnut7D4kG2$I=", "#=qjM89gxwDLZ9izFxrYPCtcA==", "EditorBrowsableAttribute", "#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq", "Lw;(\"", "get_Offset", "#=qyxpfolLUhMvFTDE2h_syvQ==", "+C? 0H", "~&h9W", "#=qAp_zHqT7acjq$QNiBoq2EA==", "bBQZ`", "#=q0msvLo3fKjQ5ucIFxkdur24Cc0tFDGimgcqgtAeKZq8=", "#=q2nHH3haw3R0VWVw4qHOwKw==", "ConnectionStateChanged", "#=qRxKU0X3UfYwXoOTtDpEVW6z4XRgE1s4V5zOQsfCCSqM=", "RegistryKey", "F% 6[Me", "#=qwogjI4gN1imp1VeWLroXTk41PgYeLQ34zunh6NYu_3g=", "M`o}+", "MyTemplate", "#=qm5VvJvLZD$UcnjvypC5XcA==", "1i^I2p", "#=qtWaDSiZ3KDHpQtSfxDZV0w==", "#=qbpvfREN3OwaXBj6J3WBAim$AQyJ99fz1ef01qn6kVrs=", "D>)TY", "#=qTEC8gcgkt672qW159Oe_Iw==", "StartsWith", "Rectangle", "#=qwNkTTorgPauZQTT6jiqLIA==", "System.IO", "$>lPy", "get_ExecutablePath", "9g}MS", "#=q$c3lXLbhl3Qzil6Z9hYEopCTRdsG8WE_1ZuhF2KQELQ=", "#=qm_Podb$DJ6CfxMwMnaj6heXfc210URbSx7p$rJGFPmA=", "GetFiles", "#=qay$wDBdxvh$MBWrC9YMhC_f55kIvkv7I_BjPu_7Ajsw=", "#=q8NzetUGGc1cM4ZGyRGGlug$fKAOwmcPqe4nFzDGKLk0=", "ReadInt32", "Remove", "#=qTAs57ZkYafcLC2FZLCGAiQ==", "get_DeclaringType", "ExceptionData", "Format", "#=qvX$J24rI0eJ0gWfA6CEdzVJN7bQN_YTuS98N0yyMYPo=", "9RNWA", "#=qLKYxZZVHP8wT4ocBxnjPXg==", "#=qTLmFjOt1Rq5$fqQEFVZ2zg==", "#=q3S7bY847GmpPliI1m7tZaAVifJNdeHclZJyeY2JTxN8=", "ArgumentException", "#=qWQUgmvsTzj15wSjWQHZnng==", "&2+0\\", "HdXLH.", "AssemblyCompanyAttribute", "#=qfvzoVBS4j9KdxyngOlL_NauqVYLAaOZVw9dutKQSAp4=", "_Lambda$__4", "/!|Sq", "#=qO7YVPb8fjfyGw81pHcJjnw==", "GetPublicKeyToken", "#=q1A7nXYgjUuxh_0aV4fZMB87On7HuSdbeS8x$mfXfW2c=", "#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=", "CreateEncryptor", "#=q5OunwTi_tYTGCTkAtZ8rARxlhmXbFcAf_e1GiEt$FEA=", "#=qhWn12I_bGxHfrIrnto3QAA==", "IClientAppHost", "#=qWgd5i$rED0nEbfExDCteKBL09U6dKm2BW1AXqZVXCWk=", "#=qjlBNihUiUO2oBJbOEbdB4u8xmfTL9EQ3AEFa$nrdzJY=", "#=qoTGj8$mBoje$u1RSJ6obYA==", "t:0e)W", "ReadPacket", "-#&~7", "4+Ot=]", "CU fL", "Int16", "WaitCallback", "#=qlIUFl2SBYSRov3A1WGimWQ==", "#=qVEEdpD96A48uRzPJT7G_w60gIZo4tH1_e21GoRWPFm8=", "#=qChPTKc$8xcHrcle7anHYNe0wH_TweGkex2nGe9n8WDs=", "#=q8uMGC19QD5WGzpkzUOu0SQ==", ",@W", "ToUpper", "49#m`.", "#=qVXB_y3eN_sp1$Md9UoJeYQ==", "v,=E.j", "System.Drawing", "#=q6uR3lWd6_aD2reKUDlx$OA==", "#=qEIPcndOLrV2GJmno7zKtBA==", "Details", "x!3GE-", "{G!0'", "ExceptionHash", "#=q8T1neNU8Flp1WaNsBKnRHQ==", "#=qfPf03rjJVGFkLtYSr7zDRw==", "#=qUUt$Zm9DEy7746wMpw0nOgKcClljRPRKWyhQ21GyaOQ=", "#=q2X26s_rFZ25AY$hOcf_6zA==", "StringComparison", "#=q9heLrZy3cpWSk7do8VVthg==", "#=q8McCIarwH$XScVz0xkTmJw==", "Combine", "#=qBhG6LJNfmJspOR5A5YrkZB3a_dWOpJYSj4Mo9vfL8qo=", "Create__Instance__", "-'&oN", "#=qDOdV5duF980CDFSFl8oQpw==", "ReadString", "Client", "Object", "#=qe5qrWacQXGv9g0P5D_mRuQ==", "#=qluYNp43cwlAh9yLdLZolDw==", "#=q6Aboe3ONIkez7GgqcdWPi0_vrT_i53_89HUeagGM6MThXvFkvl8hpSeHO1UJawKN", "Tk~rs", "get_Message", "fefefeffea", "ha|H=+'", "#=qe0mY$R_rBsPIZZv3hPLS4g==", ".4Ccq", "PD/wj", "-O&~r", "}qh3`", "+^Tw.", "#=qKYm_FHWoJ42y$VrakLgWfw==", "FindResourceEx", "Concat", "SocketError", "get_Unicode", "#=q2gthvB62n07fYVTx5fwIqxBAo1t_hs$il9Ac$4FY_Gw=", "GetInterfaces", "ah@GI", "#=qYMGXxffne_DlG2tyCliUw119RPUt2rJt6SWle_TPkBA=", "#=qCgskv3QU4cEy8M7hqvNNBbFyow$DvbmSQrN8A5JJJWs=", "#=qgB3pFGrOVxm7f$sXZD67nQ==", "#=qQRAhbbFlVBfqrgso8zehPg==", "#=q3_xjz98EYRXgLslROl8imQ==", "#=qmuy0ee0GJl13ksvWRbOSbofOCTPf0dv0HYdjJq9H_Es=", "=DLV(", "OperatingSystem", "#=qnY1InNbQmfgiJXdGVH6rvQ==", "#=qYI$MiBdzcplbf7GqrUf7Ig==", "&DL9/M", "fefefeffe(", "#=qyEH54IW$f9fUJb7FOR8r3vj6e$onLGrpm2VGycjbl9TZJEqkwtA4y4bL9ExOWpiA", "#=qMWVV4JCreo65oWvwYJqZWobqlgJkr$K2AUIqF$weF5s=", "MethodBase", "#=qw39MYiiaN1XJbqsDq$LgQw==", "f!~>~j", "-\\&~]", "#=qg9gWuHgvaa6cHg9wj9NSQQ==", "#=qr9m9EjuYAP$2E3p2xadfFhcTH6toAhrm0dlfOTldiWRsdXd8UmnkRkYrV_8$1gaA", "#Blob", "4{'Wg", "#=qzTUdhpx_l8oNrXik8Q6a51kZkIp$waiEMbjMOU1bFOc=", "#=qABSlSWKh$8sT$UF4sG_vQMmKqh5lDRXHlL1yCp0W8x0=", "#=qw2XWrJCQCyTO0Iwdbz8TWw==", "AddRange", "#=qQ3JMSE9km3mGmL6lmUfRHw==", "#=qEQtWieYw8BPdEE4hbsjTLrq$BwGjJOBoaDYJmV9xVgE=", "\\M/e(", "#=qtIl3MhjXHsnCHvTVFi9hFg==", "#=qfozjXlIKX6LyHHXB6wCG9g==", "#=qjIje6jGWLd2EOkfZXKqBbg==", "AddHostEntry", "&&*}X", "#=qKdZKgyAqL_iP0GUSJkXePw==", "ffeefeffeefhah", "LoadResource", "get_IsDisposed", "#=qeKiN0Pwa0MwkK0uB$Ook97TrMQC$LNj1jgF6xTuSA2g=", "!d{t,bk", "add_UnhandledException", "#=q637XAKKKpMW09u9r97v4lg==", "#=qwGMLoIBYlotM6E$y2KTAuQ==", "=!#0jR", "#=qeeDSInMnFASKK3QXGIKUxuxDb8FgGi0XLXRlZ2oJdWM=", "PzHP/SB", "WellKnownSidType", "get_Port", "GetMethod", ";!5mi", "#=qehEpCuPIxZRbHczlt$dAWi4yWi9o1_noSvuo$Wzvtyo=", "#=q0REOJwjO1qsE01G_RQE1TQ==", "EndInvoke", "#=qPNzwB3EyeKwH$TwKjEdAjAC6A3IlGhANCdkUFCgvEiw=", "#=qpXfSNxR7J3tqOHyqT6s_Aw==", "{!rE[", "#=qNz_Hz8DMWPqA8pVcg8d0UVymwvCurvyYgdZaMK3OhQE=", "#=q0PMcXQJxcLLr1sYO0fpyhPjUwjQtInL_vJPQSgCsfio=", "!}T", "#=q51SFR_Fbl10nUMKjGTtHqA==", "#=q3TG8MLoZf1Y44PREVW$6m76IGmuYE_BOhC_OTjkQJFtYWwRtSeFqevP9hiteuLfz", "#=qmbdg4P9$2ouafwS8nEs4lA==", "#=qudwGeEjJDUB9pt$_k0YOgc30ZWMo1bIGmdknk40OWog=", "fefeffefefea", "#=qH8FTQLBlM6o0t6zf8SLPUg==", "N1-M0", "CreateDirectory", "#=q8SIEDcn4WoT9RcZmFK9tzQ==", "#=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA=", "#=q1jj2Lo3UBKUZkdI2bLcg4QlXuNGNWZ$CYnK9VTZNEsA=", "#=q8nWzev5go3NKhN5Gk9NzTmM91eKwrK00n3U6GWmH8Kc=", "#=qjYgYU6Lnx_W1ikVtBmjm3w==", "&&*}&", "RuntimeHelpers", "LocalMachine", "7;TB S", "IClientReadOnlyNameObjectCollection", "StreamWriter", "#=qGqugi8s64S3wxXEod1SSyA==", "WaitForExit", "#=qV9UIxiLyaOi7XoTx2DUJwr8Ior26OirSZwM3mOvftrw=", "#=quO7UmvJ4RBuIIChSn0jx_M$HL4rBuRuRZnNBEMlpsJw=", "#=qxWNhTH3aUmlSLTvydVoCIQ==", "Boolean", "#=q4P_5NYDHZX9MPbDZuNFOAbRpAmJ2c_TFz8M5ulhIFApTRNfzn3_E1__1$MVw8$WV", "get_Major", "e9j,2", "#=qa9HOmSrK7mjt1ZxVRncCgFoJUA6N3DmB1Rc$YUfcSKM=", "#=qN1bIi$08taNozgdgDWdXVA==", "t/[C#XKs", "#=qAM4ZJ3aDwBm_a3IkqHxLmjdKzHIQbFeE9thLHux2o6g=", "HostData", "ControlFlags", "#=qdZqWoaYN68rlMOX4HkTLdA==", "#=qru2ORBLxmt_CUDya_FEQGA==", "AssemblyDescriptionAttribute", "#=qxWp4ETQRrgcfPChnmxhivyMmb5p6MuyluC9Tc_Mhkec=", "fefefeffeXa", "#=qVQoZlgR59_v4NYIa4CBPQw==", "xI\"MVk", "$F0@_", "m1hxT", "#=qVHGoZQC06Wdz1fJDKkoeiKu9aci51znqNtMz8dGZQMQ=", "PN_&7w", "get_LastOperation", "%i]xD", "lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet", "-(&s8", "ReadByte", "#=q1tLM5Gk001IDETj3RhJ2ESaIo2XgaV2vMWhqISqSHy8=", "#3uzz", "#=qRxR4aJg8TX8oM$OpeoviZQ==", "#=q2V8VN1ZqnXOBhkZZr6w3VA==", "ReadSingle", "rv/1D", "#=qOxeV7mwtJT4AH3HtBqNUXw==", "set_IV", "#=qzx697Szk1moqO$yUynaioQ==", "#=q2XZFEYqbf67s$PRf9Xyx7Q==", "#=q1abXKhVCyzVldE9ra9z81A==", "#=qgHxgiBgB0FhzEGOOs2Dqnfh3XnJ7nEmajCNqRqFR3Fg=", "ValidateSource", "BSn][g", " c,g`", "#=qA1_qolTI9aVdwnEde3ubqM6zKBigTZiyb5_iHpeZQDI=", "#=q3fzZpU7POi9yYKua762KimE0tXDV2VRrjyJcPuwXgTs=", "#=qxp6ct4JGLaMDbwg6fkrIEw==", "#=qCA$7lFkUlfYTBh0Hp6uY4w==", "op_Equality", "ClientLoaderForm.resources", "-!& 4'", "#=qRLk0VFphuSTh16H1MGZUv_HwKU6b1$OQZ0l10zUjPKU=", "#=qbbSw65PC$nto6DJiWxTawg==", "MyGroupCollectionAttribute", "#=qA5pFz5LZPgfUa5zon4beRA==", "ParamArrayAttribute", ")", "'ZI&m", "get_UTF8", "ToString", "#=q1t2nN1p2nWkytA1wjQ32JyClWcTGIZMOEV9XOIYf1xQ=", "GetHostEntry", "`.reloc", "#=qoKFLFqm7bb3VWsU2QKXIQ4_6anGbTCWiZAfrNlgq8fc=", "+.Pb/", "OU)=\"", "#=qLYpbsprg$ymVLeNEwEpYlA==", "#=qG2DPieaEKCS$j6T6yTf$qg==", "&&*}(", "&&*}e", "#=qSyCMza09ItB79lrZlFBuQQ==", "#=q$mqGRbJ2J2TNgadoLHYnIQ==", "-m,Ol", "LM|s6&", "#=q9tI5WfBIFIPW_84mZnHV05cJ9fSyOCl9wA8lwPxs3PQ=", "NfefeffeefY", "WriteAllBytes", "#=q$XxqrIH7dyYqacMzR_CjGA5JAR0vUKiq1f0DFqS1mcI=", "add_FormClosing", "#=q0g2hVR4CYkiIvLHeQL6tUkW2KQhRibG1DIo1pReSOj8=", "ParameterInfo", "#=qWbDVCvJRlY$nWsVAToK13K8LD9gZFcJQAtBUvjDEcyo=", "SByte", "#=qQ9gevS7b4oTsdxtV36c3$A==", "#=qrWKlHKCxTKueolOR4ohc7D_cBhjLv1zNIcftgcigaGU=", "0aQ^C", "_g0,g", "#=qKxL6kQaUyB_6jIG3mQUGOw==", "ReadChar", "Start", "#=qEbf5uxiH92v$7mL0TnmsnA==", "haE4k", "#=qvJ_V3lJRnVEW6EI74n63zg==", "#=qFxElXT3T_$sB_0gpbmQGIA==", "#=q7wsNZ$btlm7uRzkYXMkJl8JrBCKSYJt4if2WiKQrObs=", "#=qYGU8a5KOsYzqpvljkWGWKuQS9mZuJYQa$8g5J6c9rho=", "#=qxRbSDXwo6eARhpCjqJa2Fg==", "#=qEn9Mtg$AIqWbq3whj1y5N12e3KXi_NwIIcl2i$FXNSk=", "$_di;", "SocketAsyncEventArgs", "ConnectionFailed", "get_Exception", "System.Net.Sockets", "#=qOn6YhA2JjwnYZ_7D0fnnEw==", "8uk-|", "#=qu0EIqDRT_HlTe4PqaMKdozL1lQ0SgTtqFucuF2vFq50=", "b|g+-", "~utVN", "#=qI5Vms5JVXaVkwalJFV3L6w==", "evb3+sG", "SetLength", "#=qAySeqCaPs9tWWTa_P8M4Zg==", "-l&~s", "#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs=", "#=qtcncUaS1HcVKUD5AEGHBokWqEL$GDDjoAu8asy_oLis=", "ffefeeffe", "ffefeefeffe", "#=qEDU5bqS$T9T0k2xHaznuPTNI8j4z6II52ItUe0wjyZ4=", "#=qXCoQdguduOewiATPKLDvyekx3X3r68VNkZOPBX9O5lY=", "#=qvJN63xerlaB42Q0XUG621g==", "Decrement", "PluginUninstalling", "#=qwnMPoJqYBxCKR$s5x3I3EQ==", "#=q$sTc1AZMnHRC7q_PL2hWs4JIEJoo88_IAFcWtrdNt$4=", "feffefefeY", "#=q00kXQ$0a$SV9DIgRtf4NWQ==", "SocketType", "#=qdw5QBoXX8FR0LrkjhWN3qw==", "ReadUInt32", "#=q1ZcUbkVKv7wahbk_Am8y6A==", "1)!1_", "_/o{U(A{", "#=qJ2Bo_iSk1Tt7sQHk7C2ESQ==", "System.Windows.Forms", "7I)qt", "GY!>yw", "#=q0zLeEY98tybLc8FS6iVEWjGp4MNZxETphcH7ohzBXuY=", "#=q7O26Wc9N845khaV1IlgZGg==", "#=q7Tql80HUgCLaL3e0n4j7ew==", "#=qCSC3Khfzx9$ef45TjPThpcJgh1Y2yjEovdFzCbywzqU=", "#=qiGEsYAsOSz$jy0hyBv5MGPdLIlePpwWMgCE_Abe_mLY=", "#=qHU4s4cJ8BUWy$MQH9LPGxTniDgLcWFlt1CmhZ7PNRWA=", "#=qoKX_5NDx$uDAqG3r2Qdnaw==", "-?&~]", "IClientDataHost", "get_BuilderSettings", "_Lambda$__3", "He?J^", "Single", "#=qXjNBjXFhVcOvrRAG8alfq96_gJ4jOa0wwNOaztY3QjLWnMT6wXGDzBnHuUkef5N0", "STAThreadAttribute", "RegOpenKeyEx", "VDw){", "#=qX52fPnzDspvxDLERxqgnmVyN3O6kmNVEBrlqQ9OVPeE=", "#=qsqmAgLqQh_pOiJq5Mcf5Ii66zl6iLnAX8VtqTy$uxhY=", "get_Name", "#=q6oykuAaezoPWCQHwIFBGYQJoT_doGKMmOjpzn6ZJomA=", "#=qORcQ89THKgijJ1sWRyjf4hLd1g4H_sosI9t_gkVfZ7g=", "#=qZHoyzaJ9rjmsFI5qWuYXUQ==", "GetResourceString", "EditorBrowsableState", "B8i\"~", "#=qRUXz_3fP21juNHWjDYL16Q==", "#=qcyp860KJctHXULF8nCr1oMRR0y2kU8XZrQHqsInbsAM=", "InsertAce", "#=q9rPQSTp$UBZiTGc7mKlh7h1QvRgfs0p_mQAaIRjRIsQ=", "System.CodeDom.Compiler", "#=qNQZrJgmZwpZh_4yrtaf9Gg==", "get_ClientSettings", "DeleteFile", "&'E,]", "Double", "GetCurrentProcess", "#=qU0vjurWIhbfq4$RoGXKKVfTj5MJBenZeu2wAtoCJAJY=", "#=qYGqPwTlQx5HSyCMpKnJtwO$bA4uyJcKD$pA6WpBamRM=", "#=q9M64o5ghSlB001vxhTt2kVIQeNtcHtzTvRgoYr2$PVs=", "|5rpe7", "#=q$JqWZLd6UPV3jmsDHksd2EmkHWISQtPlvGx8vZ7hHXE=", "#=qClMnNCTDhIIGUYHmdm$xCQ==", "Clear", "GenericSecurityDescriptor", "U!+sTj", "#=qikOQWBxvreUKIkKm4o4DoA==", "'6KfR7O", "#=qI2pAr92bRdzddapVaPVhbQ==", "#=qHy8pXlBCL$mvAXWQDJUnVpxgTTYNWuQ4Z7NdFPUhcZs=", "#=qEKdoqcCD2XVb2atXAIOmL$Gnnk$r2oNLDVsEymHbxMo=", "#=qU_ZXXWlv_8PtJY9coDWiH8$dVbE9S$EoqFVRvxhPtE8=", "#=qOgcjmweVxeuvMU4cvcFOmg==", "#=q0qLVKF4NbQlcaunYsixITQ==", "ComVisibleAttribute", "#=qWCa2pDyuMnzTMLUOIIx_zqZ1n0nAbCh3XpyakFsKTbQ=", "IPHostEntry", "32EJC6u;IYz9", "^RH\"-&", "#=qFaxhQMbuEyPeOadTfKIzX7ulwKfSulnteVvHU$QDlcs=", "b`h*&+", "#=qS8syUoAGHVUW8$eQd6_3_g==", "-kL?R", "set_WindowState", "S$'U|", "#=qfXdNdmKHZO9pILMTQ4gUIFhfl9KPJm2rU8y_LQsTH4c=", "#=q7EIL8N8VWglyI984D7TGpzIPvdOcvYIRRwfMeKNyDDs=", "#=qgPQkZ3GBDc371jzhubcNPqmxfqhr7b78DNmenmuxGa8=", "#=q85afbI_HcqBFOZnC0iAqsNghLb3LsuyjFtpLEYYoPX8=", "ConnectDone", "#=qfpNcQ8IYoPRIQgVc_nBfXzVjxVN2nY_mFz$PcDXaKKw=", "#=qnk9x1Gmlq5UZ_X95yAl14A==", "#=qrpluguOr5I7WIqr51cA8ZQ==", "#=qeWvkoUO61qxfYbQKV$cOPQ==", "SetBuffer", "get_Height", "ClearProjectError", "#=qCSH0DtnYKogitTpLw_M85GR1jr6BVuF$16hm8cfUYWw=", "KseXr", "^YkG#C", "-&&~r", "ptQY1D", "OpenProcess", "48zmp", "uP}b7", "#=qKqE6jaRKu5jJvHl8RwywXQDv4h_f2ISEaHK__Drdd$M=", "#=qR_QBxpRX$xZ1vjqVv0afDQ==", "ZRvcv", "#=qYuHUjnyRYHZqCkKAt0jj_9qFBzmTZKte4i1ou04eBWY=", "#=qAkkjpY6IHZssIsQ9hAxzTw==", "Invoke", "-T&s,", "#=qGHv1IOurZ6januU0XCThS7E6H0kqAtBD9d30RkoHFXM=", "~:}ew`", "#=qOsVShdMttD8jGLf8zW9G7g==", "#=qEWXagqzV$_PB$92aNfTAHdvK2qw2uvSxy$UVh0K_lso=", "ClientSettings", "#=qrzlCozsOJIqLxGzoulKftCL7kUWSuMYFdc1ca_yCcBA=", "#=qGjStw3GYbvUue5kapeAzmPJAl5$UDUb723PSvMiCGdU=", "#=qtLsfqPVQ47D3cdxmiwAJAQ==", "#=qnnmAgQGEsJw4dsVn9gN4wJbRL4WqsDa_V0QuBPM2E4A=", "get_Chars", "Variables", "Ns\\8OX", "#=qQoUfP$jAQrKMjDuqm54QmA==", "#=qnaTZqk95Z1a8JBLdKiF8aw==", "#=qwyLCYYp4MoTtTA6T$fEOIg==", "GetEnumerator", "d)PG ", "AllocConsole", "Dispose__Instance__", "#=q5j3wvJXlnrGmRnKUHr_1SQ==", "#=qyow7wBpiCNNIoap9jI9L3Q==", "#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L", "EnableVisualStyles", "fefeffefeef", "CreatePipe", "get_CurrentDomain", "#=qo5Pv9nXCIU9X_B8SJDUR_qgp7npNK2pA1rGP0GNQ51o=", "#=qQJBwIjtEvP$UD5Stcfj2wASGBDPz6YiX1yXx_MSfzPs=", "Empty", "#=qTZGarPS37Dw3Z3Ipg_AFug==", "#=qNdKVs_XU_xYgnUK9ZfVshw==", "#=quXVzKqGldmgtXgVm61aLog==", "#=qAR9aFFQPEovpFzvfokoGkw==", "#=q61s8d6EIAdSsDLLjqchw1w==", "ffefeeffefea(", "#=q6CxZjTl3_v2RHWKegcqMWw==", "#=qek1Oy3FoZ8ULt6r5iL2pEQ==", "kernel32.dll", "#=qvA35ZDPTM3VgF89oJb9AmWFE4pqnIDYGjeV5H4uvblU=", "bIC)<", "#=qxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecU=", "#=qJRbhy7_BbunS1O6hH3MqZIufpnZboV6cb5Cv4qZI1D0=", "MaxValue", "&&*}o", "get_MachineName", "#=qp4XZ9Ss3K04S36I$7WhtwQ==", "V._H8", "#=qMpgSfrZ_Z1PFlMpqVHDctw==", "ubzrn*", "a!5aE", "X*]x.", "NanoCore Client.exe", "#=qKKh2V4W51UBGXR09J__pug==", "#=qmL2H5Qgs6vv79mCqS$t3qg==", "#=qG8K0lOrmHWfP2KExoNv$5w==", "]I]XLh$*A", "3,bDD", "#=qUDQctXsgw3eGxqcYAxP8MQ==", "#=qWFUoT0l6elO8yn$hIYUL6Q==", "#=qhPT6K66KztLE5cE8YZMEsw==", "RawSecurityDescriptor", "#=qhz4yMg0WDLwu3BJp4fYr0w==", "lSgV'", "#=qgBCfMYp3J4fCYU13EId5uw==", "BinaryWriter", "go,NAw", "|I5v}", "set_BlockSize", "#=qg$lb3t6abG6vgSpzSjJlb_$AIzqYfos5cl9DWFolUwM=", "#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=", "#=q_gCP8hm5SSW7J$3R7xJuSA==", "z#cuch6ZI", "#=qQKYqF9uhb3QdjdrkvuxjUw==", "LeaveDebugMode", "#=qXKuFJhTO9qh0nlK1iXbbSH7y8Djn0mggfIDxOoarDyE=", "ComputeHash", "ConnectAsync", "#=qB7XWHK8gygwSs$Fj70FiWw==", "#=qJ598Vnr_RIwGnHqFfQsYCw==", "set_CurrentDirectory", "fSgHd", "#=qHj$POo$6pkhWHVC5cES_2g==", "#=qAsEDmMyJR5b6o5oAn_4$qhqe51JCfsU9Gffe156c8UU=", "#=qukf_DyAYprvhLsdhT4CGuA==", "#=qoTZi9XCxEGJXLELWnV3yfQ==", "#=qDEcM8KorEdChS9luywSNQA==", "IClientNameObjectCollection", "get_StartupPath", "MessageBoxDefaultButton", "oL)c3", "#=qkFwCVmJ2HhZ6r$uKeVZFFfVLdddj$WEInl9bSgbErDM=", "#=qEk42FAaXkrNIu2TP76IakA==", ".# G'", ".ctor", "#=q5MtzoDWNtlkksfPTHs5qXlK2k7ZehKenYzDJQrgdOII=", "#=qdPDxrK7XRQZlwY8QeW6oe0AEoOr3qND_WVi1o6l48tc=", "#=qvRKdouixzy3mopZ1VtjZRIxbtiSW2GAGLD$37iVLn9U=", "#=qJLXxSZzWSVDQjBBC8RxpqVbwxFaxTu3ygaLrjLvlmTw=", "LogClientException", "#=qJAZ7is41tIXMNDQIkGLgjRC15Eis_QBrdFx8JT2Rx54=", "#=qqCUKpKbVq45Cc9OUN5wTXw==", "AsyncCallback", "#=q8GRQigucU81Rfg9VpK7PVLcjulhhYVPijYKMm9N3PJs=", "C4rwC", "r[D}E", "", "#=qXz2OER2RItZOjngvYurWLQ==", "#=qXCUD4SfDr7DmFI64sweGXTg5Ns_ZxTOZPqBRcEKWTQk=", "#=qhVWucYSqOmMmp4RgG95tFA==", "Si+ze", "4.'[G", "ClientInvokeDelegate", "#=qlMIFeU84lweg5Ul5iSg2vZUvNnPKw11XA1pEUQfzDeg=", "#=q3d9CqFPpPy$rBhZvyFIRs_ElAFMHTo4ZZuE_g$Nfrnk=", "IClientNetwork", "#=q0myQQ6i89t9SZyjYDXZrBLa9ljWEUD7zAwJyyFZowQc=", "#=qKY90T141DaVDQT0DHaMEr8C6aPEoolamkqMM94Ir$TE=", "#=qM_mpCWjOCBlruGH_QcTQHocD7LUJCLuKe8ntf2VtQlk=", "IsNullOrEmpty", "#=qD3hoTFeBJT$SvX_fQh_aIw==", "#=qs202XG_JxpBwpKhptOZhRA==", "]FG;K3k", "#=qJMNT6BwQKSi707UHw9_x7oci6egKjto_AgHYlITH34c=", "#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8", "GetConstructors", "#=qVl3h61LTPSW_ew_st_OlTAm7x_6Xu4hQK$pi2fSiEIs=", "#=qSpdFO0arrQmbwA1JpPKL4TCAmwZYVDNVmpRQ6ryTPgs=", "Contains", "ThreadStaticAttribute", "#=qEhveuZChxbRj66Cj2kCGjw==", "#=qIe49uN8SyHwjwKdv9N2r$A==", "get_Assembly", ".*%6M", "GetHashCode", "#=qA4f0kKyGXTRnU4z03oji_RIPyVnvoC_BRjpESDLHXqY=", "#=qL_Q_RdUm_wJ7VeVwUqRXbA==", "DESCryptoServiceProvider", "#=q5WjY_m3ubVFfbJuyu7GMxA==", "#=qrJaovDbn6146mBrhFbUMbw==", "MemoryStream", "#=qhA4OqIvVSMpJakxtoytoCw==", "!U7aX", "#=qTYemjRfvVDuBO5lrz3Aq6g==", "#=q35mMBfMcRRKrjeZsPOCz3A==", "SecurityIdentifier", "#=q65znFg0_234nfnhL4I8yRSIMDpdjAosbzeDfyRZVW08=", "#=q_5hmJXim2EG1abw3Kju8nMffXDIbl5na4zXqclsRK_s=", "#=qAzhW8LcEnUCELlhG4klMCnw00GcHco1N61RthSA9zQU=", "#=qjcSlrUNMLgvZWN$58FXdrl22$0OjCpoqksNsslRtIFE=", "set_Visible", "-SK1$", "#=qmLTtz8OEDrkzFTzYkI_Dg1dvKwiGw9blNcZSU_QqMsg=", "#=qi3LnKomYQ5KrkAbxbJpKCg==", "#=qjAD5jc_8Kg9x$NoAqFAvpA==", "Application", "RemoveValue", "#=qNn8WS2rooUJUoMsG84mQ7PkK4IQF8$E42cyDjfL7Kqc=", "X8.2@$3", "IsInRole", "-,& ~(", "MF{B.\\,", "s%dEUK", "_}<>b(", "#=q6TsObh1LqPbvVPPz_YjbtgEdyXL$082jRqG42$db3nw=", "#=qq2h0VNJ4eWuHP5LphH0mpA==", "#=qGWcF1$SkVAOkK9Bjc82XDg==", "!V,(q", "GetManifestResourceStream", "c[Zpv", "set_UseShellExecute", "get_X", "ffeeffefehah", "FdlvK", "OlfJ@", "CompressionMode", "#=qkzr_P52_BAWJXliKWvb8Z6oiWEishcUAemTNzwiiwkk=", "@DFe]g", "#=qhYMTmNdkO7UsEcfduWinsQ==", "get_Value", "add_AssemblyResolve", "#=qee1h2XwRBJvy2g__X40enQ==", "#=qFNeaOBvMHuebCbgh$0IKkw==", "#=q$jOt_Qd3idEY2i2z8zIong==", "#=qoStPOR6UymX3IGbwW$iFxA==", "#=qkxH2pC1tIcRyW8E4TCtfHw==", "#=qecBuZmXKFD$jZa5T0d0L1w==", "#=qwrVB2mw7gzmYRanSJvSoPg==", "SymmetricAlgorithm", "(~3c82", ".cctor", "#=qGGQk9IvbDfVOJG_jRDHqOA==", "'UD_'j", "GetParameters", "OKoB<", "#=qhSKaq9YW4A_ja0UC7Difmw==", "*%x(#", "#=qr1BSJWWt4_gjKhDM1XdrUmEEDWmH$7z1xaJvthJ97EQ=", "#=q0yJsLo0aFpSu9ky8R9f$lw==", "#=qbbzTfwYbEfmovMRrVY462ipA8X_tt3oO3M_wSSE0I_A=", "OpenRead", "EventHandler`1", "CommonAcl", "System.Collections", "#=qW1UvUJT2hH$HRJ6kt_DhXQ==", "xFPb*", "#=q3VDCpnvucWhkt3J6zytXBA==", "#=qo8wG17V6QHcxsU4R0xmY_Q==", "#=qjVLlQtRAzKVOtyLrw5PhiGVVmXqMJJOsTT5DxaenWCY=", "#=q6FX$JRP_bY_ZCQbx1UwWug==", "#=q7_KHECinDx5vq1IBX7p8Ow==", "#=qK5Mf9uxDCjwDRfyJQ6kp8A==", "#=qx4AWw22LafncEy7CESjbGQ==", "c`RGU0", "#=q1Ld$ycQpy0q1QvYRFk1k5lwgysKVR2tJyNFjakVtbYY=", "#=qVVQJ$z9bl7kHgfvJohZnMPofzhiFJ4f4yMGK7Tpp6xg=", "_XvmS", "#=qFWLbBQgFiIpy22HFbhF9GQ==", "#=qmvGJ0E7$XHigSQAtHtZ6z$on2iAwFLBiFtrUR$DFhQPAtVI2LIgzNztIgPvlO9K$", "#=ql4R4vy5H067cy2C3KkF7Mg==", "DefaultMemberAttribute", "#=qGgXamaT7IeK3DM0oRfGI7LZg7FrEWNz8CI_5MUlFEJw=", "#=qo_N0HkUaMUQFRCOsgr2ciQEl_IzgJy64oQzCRnN$Qy4=", "v_E7o", "/.ffefefeeffe ", "#=qFBEI0HItLMNpyOY0AgRxSg==", "KeepAlive", "bZ-zT", "#=q$E54nUJeqC5jURP4oCRU9g==", "#=qMMkhBs_8vtf4989qCM6TUw==", "4'aDHS{D<", "#=qUzL7S_0eXIkbwTon4AS_WA==", "1j@@C", "U&3d>{", "\")cs`", "Restart", "&HjNa.q~", "#=qObBSq08BLhHK8B6pYQSLOw==", "#=q3p_D2U81K1hW2D54P32yDw==", "_Lambda$__8", "#=q62cZqzG2QOltpyG5v7exPQ==", "[SZB+T*", "B.u91E", "#=qiNB6YyqAJbx2uPAiP1Ihw9dTNEtwaZElmpYLZcGO64Q=", "#=qtcl57G6kPr7DDYeWeY389w==", "#=qQ7tSKwAULKz8TSFsLbtapA==", "Xj08'", "#=qOmCJCQ4xVqqqlvNEZD66Wg==", "#=qTawRDksY2KFvY5V2vw1_pA==", "`uc0^],\"", "get_RemoteEndPoint", "2jx>7", "#=qiJXCsKWBF9DB88uzW4b92A==", "#=qo8RCFr_ecPE9NSA5cyD6QQ==", "#=qQUdl15sQ0xTV$45YaAtVB9Bx2NeRc0CC_5Lr_HuNXwU=", "System.Security.Cryptography", "#=qw42CdKVHw2dycv8VU7DItg==", "dyt-W", "TGpuY", "GetValue", "Enqueue", "#=qeADSRAqxC2FlJbA5Uc5$2A==", "#=qVqTMYHwCmwUHM6kkpNkbGw==", "YV= J", "#=qwGYG3$xqr6oMjxRyF4i0Uw==", "get_Count", "rm-^|", "#=qRtpaHvp1hQcEDS$UubP_mA==", "#=q1r$Sd9Acbw6KsKv_F9uYTPvvGAfiEwUnai9OGYAUQBg=", "#VO'S", "43s@a", "#=qL2Az2fdQv6DkEBC_x$bbMA==", "ProjectData", "#=qWszclzYrfU2ikD2Jo7BLiQ==", "-[L=k", "#=qcfHq18AlWjOy12tBCM8Tbw==", "ValueType", "#=qaysgaPdcuRrUvev6__tYEA==", "EnterDebugMode", "ResolveEventArgs", "#=qokX_wSaMFvPLXvDQY377gw==", "Delegate", "V`6Xa", "Interlocked", "#=qs1aB65G6$bPi1$cdOrXkCA==", "#=qFWCMyHOrl7QbIPkMYdiWJg==", "#=qM4zv780c6Jc3GVu15xhaulIEjuiWD$RKEtosugOXKLA=", "{p@==", "MKV)/>", "#=qnDLRD4lBlfyGeJyuSeq2WA==", "-/&~J", "#=qd92UVUgmlXoQZdJDkVvBpfqQ5IrxjaeWORyWFC422PQ=", "NanoCore.ClientPlugin", "#=qYCS3QLrXk$FWhHR$BIzDXQ==", "#=qJOtLSdKNdNGjNNoElacScY2TTWmLUvN6XZsl_FLfP4o=", "get_SocketError", "#=qOgNXWEIS3IQJCnff_sTmrA==", "v9?*<", "#=qHdV5wMNiXS49lDrqJF3pqA==", "WrapNonExceptionThrows", "GetType", "set_Key", "#=q3C4Iol1nMl5AFLWNdE6nxB2_kG0uXzx35vvsn$gQzt8=", "#=qdiuHngY4wejUsgFY5u7CtQ==", "SocketAsyncOperation", "gw~L\\", "fefefeffeefa", "#=qDTvHA26pSwiGBDknUzewBVNt3YGW7YeSiQRH8F$_CMA=", "feffefefe_-", "Version", "#=qpSjmalSIZ6iBUAWRLBOkQ5sPqtZAetb$LjkOVwAdUac=", "#=qD_C1_4vUU8j6eQSUvsJDw_O6DZliNi$NDCaON05RwdmBpVqAu68W00hmx80mCKp6", "KeyValuePair`2", "#=qbzig1$2CwLluEJt5uPtpgqPx5y_2S$GoPgJP36N8bTE=", "#=q3eIsVMg85$T5I_yeach_tN$TJG7$vFUaeExZx7tMHps=", "#=qxLboOdsVFLmyLD939$tUsnUMYRMeFnzOLiWxQdY7sdc=", "#=qSl7F7iXGTH9iNXHds05fxcgA7Cydd52A6vZtHH_41F4=", "#=qCy_StxaanQioOSGQ9LimCF9_Wy9AMBNKclrIIUI0AWs=", "#=qUomzGDQTZY7jASgBmW35Fw==", "#=q7Kx5VWqZvUxLZ2L5c7WH8A==", "ntdll.dll", "Wq(`eA]", "feffeeffeef", "#=qc46h_4WA5z0UkWODs1nwXg==", "#=qB8Wn1MJrSNWupWDx0sYcAQ==", "Mutex", "#=qHtBOSXbLfhirIdzL218uOQ==", "ClientPlugin", "#=qeXI2ChPq1TaKaY8cTwWe4uWAyXSGUqAWxM21uH$6gYc=", "9feffeeffefe", "ReadSByte", "}Fu\"$b", "#=qo734_kbse$6lTIlwlz6A8A==", "#=qhnLoeDP_EbzJexQQPp_LLA==", "3[@N:", "#=qnDc3CmkCB1QeN2dXbmqV1Q==", "'5$&;", "DebuggerHiddenAttribute", "#=qfoMVJHfk0BnMs4x6mHO77Q==", "#mvl9", "afeffeefef", "p20S:[!", "#=qWsrg06gTzsE5hhHu57fJFw==", "#=q$6Q_u19FhL$wNOun9AB$CQ==", "#=qW1Ty88cS3yMuRwgBrH3qpw==", "#=qGPdnFVTlqnS4tiFpuQulXa$2eC7Pe6YqVeImkUGsMl0=", "#=qXOmEbR_8DUzPz6sW4Kmd6kaKUIQOYZdTpvq2CkB17PTlG1zEUgI_P4skJXU2VwtO", "!7k&Y", "ArgumentOutOfRangeException", "#=q6uKQziMZIL8_PaX2KpbPTA==", "/l\\g06", "#=qvz1sVA0ePAgs1nzIHQTFVtjljpeJ1QO1S19vLxn8DMU=", "GetName", "ThreadPool", "#=qOYQA1S8VHR$mOO6XXuyF9Q==", "Control", "#=qsB4PatedVyMOyo9s5n1OTA==", "#=qi_z83UuaQZa6UsXCAahbTQ==", "#=qQqZpewiWxGMAW$tQ9Rz23Q==", "c1 [1", "My.MyProject.Forms", "Vy`?:o", "0J8>')", "#=qZvjD49iuetyLKBIiF$ZmjA==", "EventHandler", "StringBuilder", "get_FullName", "&&*}c", "#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA", "#=qw1t7iX7Q4P$CBQxdhg13BQ==", "#=qrQRxQdT4MC1qfwOd4n14uA==", "#=qa3EpMqO3KVCTrDUnetWt6fRbeWox1uN3vfSP5v_W_wc=", "#=quebj1wBCmruzAKmg6Y4Igg==", "#=qhme1CFqs_evb4VXik7N4x7lNdqSfuNy3r3OUWZ1V4Zk=", "#=qKpwDTqgBVuprqflj1$7QZw==", "#=q2Xp4jW9C8Ta21HxmpVVhKkrHyOAsktLziyvL$pPr$5o=", "#=qCaHpjtavBmCU_o5x0kJsKA==", "#=qxG1wJpkOHyc4AD8gtAdxAA==", "-<&~C", "#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=", "#=qui$hq6ka6v3VYA7sCjpJmcmNECKESf33DUzrmeSOmg8_E_GsgWi7VMMVWUGuO5wH", "SearchOption", "ClosePipe", "+`(Gb", "#=qb0tmyILenEyH_R9DXJFwB5rGNfkKkR0Y5sGtBRsV3YE=", "IClientNetworkHost", "#=q9Dmi1iXzL1JAj2RiS$Q5mw==", "krmWR", ",$&s:", "Microsoft.Win32", "#=qqRc2eOIidDtWq4y7W2lAhSyv$pBRJdAsYlXSRUcwizw=", "#=qvbTNBihG2zARsewkRIFTSQ==", "#=qWLKNBubktRcyu8vI4dIAJNOqajvyL7NccmUEC4QD9y8=", "#=qHiBdWLOLLVg67b8lN8FRqgmYNWZfcDieu2MH9_zIY6Q=", "#=qOsu3u3mLIa8ikCCuCoOv_w==", "#=qs0qPjhSgxy3k5gj_gt12EQ==", "Component", "#=qcrlhteALkcfYnKFH$UWw$HzZqj8gdN8_KwUKIC_ywUo=", "#=qXuSOL4ETByiwdARI_Ds0Cg==", "ReadAllText", "#=qUVvjDZc2eypEDWG9cFZdTg==", "#=qP6OAxyfxw$Mj0oVKCDnh2VZfwY2Ap_uDBmUyxkn98Eo=", "#=qsOMWyP3LvE9$utIXVnRnmQ==", "FileAccess", "GetCallingAssembly", "%vz4x", "#=qIOX_rwHrS_RLFL2igzRsUQ==", "4FS;,MM", "#=qKXWwuvxG9klNObPbc$UF0LIw0aZIk7Z0VPIncl8uFJQ=", "D|3[5", "#=qhv_9OQaSyr5PWElvgkBxFw==", ".a;*x", "get_Variables", "#=q_UogavoS8ANyZp2cF0B9t7qG1b3QUqGTYeTlmQIKxqY=", "G&Eg\\", "!].p]", "#=qU_UZ3uhfwWgI9uBw5HT3xA==", "#=qbFnmVfulgLVjclcqmmhqFw==", "#=qccx4d_xNMPrZUHpmyYb7fIKkXAFa5XEyOIxXg$XLtBw=", "#=q9WHClFSp7T8oS_DNFEbAHQ==", "GeneratedCodeAttribute", "#=qIKJSaaKraxRzi3AD57FKg9MQkSdmOqUcHNxKjSZFGkg=", "#=qixBu4j6Hm11f3$mLrzkCcE4AVWtWeNn5nQguwdGbWGg=", "SffeeffefeYa*&+", "get_ExitCode", "mBS|c", "set_WindowStyle", "#=qRkk_hj7p4gbUu59IVllqeQ==", "op_Subtraction", "#=qy1cXcK8A6uRpLlCz7UKkNw==", "#=q_kGyEn8KrmBmt5M1N9cUSg==", "#=qSJAMGBE37IZjr90jS4_MYNWNa1$s8PXhOErbnAhK_ZI=", "1.2.2.0", "#=q$7KUBFuOZT85iBmKYeGgXQ==", "2N`i!", "#=qFU5Nq8bBPIPoBGBl$k8ehEhmgSoFzsflrFNnOQsCK6E=", "WdSH6", "ToLongDateString", "#=qpNR_LpdLu_eSOZVgxbr8UFRlKjbiBX7LOuGAbGS07mXUJI3AAilu14uPN_kfaTpW", "#=q1vWrLhskrN4OoWzxKuDDSQ==", "Increment", "QueueUserWorkItem", "#=qyo6slTMfgD8IrZ7nr6inHA==", "#=qz5nGZygXT2sWR5FWGAcAzA==", "i,Id`", "-4&{c", "CloseHandle", "Qo)hSX", "mb]OE)u", "get_DiscretionaryAcl", "#=qyMcWoZuG7jRWeztMnp6fPmxxmqfVgP7DLzGs7HeF4Mo=", "#=qDJ0VTVPWfAWYghKX_DdnsQ==", "@4;oOB", "#=qSh9$w8INPkos7acCjV2yFw==", "#=q99eEsMLSp2$EVfl66Ua2d1YMqB58RPj30lLgJzJJ64o=", "System.Diagnostics", "|.euR", "#=q8xbuK7pqyq7mWB67vviBtOo1WSCccuR7xEQnGnyxMyQ=", ")}8.m", "#=qtS81hD$ORACBvdEkFyqaXA==", "c_Nd<", "#=qxG$Aklpbf6gyBfAqTMmORA==", "#=qqj4vWwKBJgvjF_JTc8V9cQ==", "SetProjectError", "get_AddressFamily", "set_LingerState", "#=q02vg4rlYSKrSiDNi4xWbtg==", "@iOLO>??3", "#=q44BQlEuOnjFd0LbnzKKIIg==", " :hu'a", "CLSCompliantAttribute", "j#'B=C", "#=qy7SaTx6mT2Pix1CP6ET1Hw==", "b'Ohi", ",Q:i7", "#=qyU_gXk4hv73zg3zoSZSLhQ==", "ReadDecimal", "ffeeffefeXa*&+", "#=qpXMe_UDgWsOaRVi$02jxzg==", "#=qM9NIml9iDZh$Fjh9MocFWw==", "#=qVqLFp2u1the0Txg1vhieSw==", "NW@5q", "-&&s9", "#=qmzYu_D9f4dvUPauEaU7zvyNjCyGp_73Xn5SffrcfQAU=", "Encoding", "#=qZDHx38VzWszDP$NdqQpGo3ak_Z$zbLpODJse1_Sr2hk=", "Dequeue", "#=qi6IJz6lHhd8GI6qygHcvTxSTD2wk_BSYwC2NR2eR0yg=", "Ko*/B", "fAE`C", "#=qaPkEKJmdD7BgG18R0WsnHA==", "FYodp$", "#=qbYAYBaHwcEbf1CaxjAi1bw==", "#=qGjp0Vb6efONwANkcKrMTkIBxJvr9AleFfJriudyTw3c=", "#=qpghRvZG4ZfcsmvAYC$o8qN0WjB387Pn9cG$Y9HJ3uwU=", "ZLvpY", "]%vkmj", "BinaryReader", "#=qbmVTgf9cRSZkM_UgFSJrlQ==", "#=q3rtw1eBB$yyPLXzQW$mDOw==", "#=qD4n8L4W9wQXrF7w_31K9bjmy3jeB41mSJJrYkh6lpiE=", "GetCurrent", "#=qdObzsTSX0MpvDi$OPjsFh219oh6Iw7DshgNWGveAvBQ=", "ConsoleApplicationBase", "#=qRIR1iTmdtHs$eBwEdoKphw==", "#=qth3CIdKay4zIa5SBJzx7eA==", "#=qglhcKpwNlOshaHMfwiT0UA==", "PipeExists", "#=qFgBBonKcV6U3Je0BKZZdAZdyEla0MkDel5SRrEzLUvs=", "aBXL!C", "#=qwTOYF_qEkI0dXowKJYtI6A==", "#=qeE3S$kdx9R0s10U9GzzcFw==", "#=qNZVIIdU4QECigaum94nwLctVkDSuRt$X4_IjuFpWVuY=", "#=qRACckQ0ejzlKZgeXX_CPJUyKbl7Zu7QfhWW6eMM03VPusMYB8LREfJZQVcTGHBm_", "#=qIrsTmpVUMRgxokIHlpGfmLtKeqxo7vQsjSkKUKFpH4k=", "#=qt0$GxMKBUHqpa$X5z4IJNA==", "#=qEVnoj7wKonGmgnYpK7PNGg==", "#=qtz1ayBjdbHAw$ecbWtEnYJXs5RBd798kqoBvIJunFxc=", "#=q0M0RRypoNIjajWAugf6WjbxM$GiKS9VjK_mg6sI0TI8=", "ClientLoaderForm", "#=qqMkZyGiL$PHkYblZrq1S69029tlEdPXkxbM_smmrcRU=", "System.Runtime.InteropServices", "@pN_02Z", "#=qAlVTP0_ZXWJdoW5RI3VoXQ==", "#=q_$06eDx4N3eSJzkchUhbnjKtHnRsckM7I4ZqcwfQO8E=", "#=q_jQLaNdtSDa6ovA0VGw50w==", "#=qyNgKOA3iTYvKx8QtBmkDXA==", "U/8?8@8A8B8C8", "#=q4kUEXPi93MnvgzV6ySNPRQ==", "a%sdRwu", "%5HEl+?", "#=qeAvM9D2ZXEFg7Zo1J5PeVA==", "Connected", "ThreadExceptionEventHandler", "#=qqsKAc3v0igxVSmn4Feg8q$1tNTWiqtCBpA_xMlgU$f8=", "#=qtkqHWk1kvmO5zt3tTCyF2Q==", "CurrentUser", "#=q3vPs064Rj1jBOLtFVqV4DA==", "#=qYfWGXuhZd0cmWjiCvW2EPw==", "_Lambda$__7", "Initialize", "B)b;q", "#=qTKJrybVS3pgV4uZ4KNtp3g==", "-,&~~", "#=qxybSLhWq6EDNDl0$FuPN8g==", "#=qGfiJ4oSCDzJJaNmf22anQw==", "#=q5esm6BVWqrzEai7Zgw0cmQ==", "{%PH7M", "advapi32.dll", "#=qKXbEtqEIo3E2xdYWIElxIQ==", "set_ShowInTaskbar", "z7zqT", "get_Exists", "DiscretionaryAcl", "&&*}n", "MD5CryptoServiceProvider", "#=qiO2giJomMFK1wa5$389nVw==", "System.Windows.Forms.Form", "TimeSpan", "B8h%X", "#=qe99VPFgyNENK$KtARK_iPuwvOEw_NRgC00PdG55dmGA=", "#GUID", "#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=", "beh~@", "^85", "m1<", "#=qsUdW_kbiEct8_uosknsYUQ==", "_Lambda$__9", "#=qb8Z0_4AS4r8OSPknVYvDfA==", "Monitor", "#=qxO41EOA8VDczxcMMPD9Hv85pbiPnTbukmYyDI5Z6X8A=", "#=qrYH2MBQ1J6Wu3hhoHHVW0JQwxTYC8hYBTLbQIYHNBds=", "#=qWkPc$uBFgJrhuimjKXkFcw==", "#=qs4p7qYamgHyRCYZsTKM03Q==", "#=qXyCbQ53pEXrdqhJ6oXoHqg==", "/.B!n", "#=qo$DZvhC1PKdsChUToY52NA==", "#=qGCYL9FviWCrv0prWZC8VfgL34V_6XyB$buFX2LkjbCg=", "#=q5$hUSQAZNmEXcUcvGVFJrlqtw6IWJBy6C7LN$kOmTWU=", "b`*&+", "`%,h}", "]H1e%", "_R@5h.", "UInt64", "#=qUZMwlqlTBPLi1iscPEnOdMZqp5jDsQ1UK2Kgux$Yn40=", "#=qxOFsoGbvlBlUujyS9g3fPQ==", "#=q5WXECfTJPQIQ2JoJDGsf9pTFKCPzQGp3$QlyT_g_ZCY=", "-2&~}", "Stream", "#=qNc0O1YGwS4NhcbB7sgpVgg==", "#=qlt$K8Ex4tZEPwTl4RuqGMw==", "ObjectFlowControl", "bN;k0", "DnsQuery_A", "#=quRXaU$OHlRs_89kacdiUMQ==", "#=qb_soGTESOxGbPyWr9RZjig==", "#=qqLNJOrQl$9SirTNF5ZKaLA==", "RuntimeTypeHandle", "#=qZb1TYPPMMY64aTN2MpcGOQ==", "DC[(H\\C", "#=q9x6KBL_arYpQC$zFf4pEFQ==", "IPAddress", "HashAlgorithm", "#=qBuMzaVqxpYkDVtTnLpbYyjTfZNKm8_4JkuoFHPxOBFo=", "System.Security.AccessControl", "Z6-yS", "#=q1BpeNGUQvsUFoXPmB6q50A==", "SvO!$", "RestoreProtection", "#=qiY1B9yU2oVkPHxhn$y67SFTP8x1Jb0botGqdUGkdpQg=", "Timer", "#=qkxzumuLbzy2O2XsBlM3j$g==", "#=qvQfNpqhSbw_$p1TB3UFgJA==", "#=qDBRodZmvuO0qLafxHA9KMQ==", "#=qrWXrfWfqyzD06oY$LsE9ww==", "SendToServer", "=1ZEm", "#=qJEtGIBRUjtEusa67yMyqWQ==", "#=qVvEn7vdm6JlvG9koG0JUIQ==", "WindowsPrincipal", "#=qqReemZdhHj1veATVZbU2_Q==", "#=qWfwpJtKOXBFXf_1zpmLUrQ==", "Collect", "#=q5mGK9suCIiUDZgS_YSrSQg==", "ReadUInt16", "#=qcp_YDS3uDXZMDFWGeFYphA==", "MulticastDelegate", "#=qP5B75c4g32E_HsewCKc$Ig==", "-*&{c", "#=q4kB_KjL2oo8adT7lfnt6ew==", "#=qPbvCT$UNIh_DPMt5F02Hyw==", "#=qKtJTKEkNf2mJVHcZzSW8iQIcsBglzcJJOkX7V_uB55w=", "#=q4o4zrrzr7uOw3pySDBOwZtAOdlhvudqcbIbhABkQfe4=", "#=qenWi8guqQrvoGB55djo0ka_844yTmViBn5_Fr2X6HAceO7AJErk_Rh7nfkfqtUbq", "LockResource", "#=q5fG5Wo3pzujuJKotO2WwDQ==", "get_BytesTransferred", "GetProcessImageFileName", ")L>$t", "#=qQbsDS5g6rYgVt4AUW_pPJ8MQlCJBs7uyF9EY8OKREmQ=", "#=qyYejfncvZCW4q4y4GEV7QqOL4Aox1NSDqQmcpM4TQVA=", "|u.4By", "#=q0f150kYsIx0s3raR3xq1xQ==", "Utils", "#=q6ARXRSe2PbSpq5u4_c1Rsw==", "#=qpE_mRkS89WMXbQTdLD7bwp4pTt2zrWY_WBF1BLz1fes=", "GetEntries", "@kEpU6", "#=qtussAh$DpHFmu7sm9TXJyZsrjeJ6Xm9c2y22v4wQG2s=", "StackTrace", "#=qc3tkHe_7v$eGA2x6krh72Q==", "ClientSettingChanged", "Registry", "ProcessStartInfo", "#=qXzCb60v8h3v0rPCrGf606Q==", "#=qvvhgGCgMlZiK63M2bP1Kcg==", "#=qpaOobmVTnUS0322VEUTQd53tn4HeMWSoV2XuTUOmp6U=", "#=qCQ9vY8iVniiFr_C0wuoMFHQgjJIll0MjoDGXuPo1hYk=", "#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q", "HostDetails", "#=qwWiTcboLi4zF4ycKWLBprqWhuc6ZDNNDjC8OE8DG1$c=", "#=qFTBwGADWl13TibdOa5ODk_Y2qcfMGC4lp4rhrZcE84kZNE6dU4EqEk2ZYKuJAWo9", "#=qK7tJUw5nsLE_rt2JHgqYI6_vH0s$mFFB1QifRuMCr34=", "#=qKwlvi80KuDBelBsvucNuhRsqXRtqCfWqVH1dUPmd6_o=", "#=qzI8efPARogp2CZcGB2UtfAz2tJs0A4fM9fKvuTKYqi8=", "-!&o/", "1cz[u", "#=qphSRC1xHjYarc$NSFAVMID1iP8dwbr6BCaxyrkptDP0=", ";6y\\;;", "#=qPYtEwg1BZk5tP9KKNl$36tqIdWilqjeWcpWKL2Zxnug=", "q F%f\"", "#=qmTxGiMA05lTEtoPPV6RFOih4DYS0uxrxPO4vA1H2j6U=", "#=qRNkKSXdFDcR_p8Jbzx9WJQ==", "IClientUIHost", "#=qGvpT_A2MS3Oi797y6jojBg==", "#=q0xixHwSTS$a9x5dtNZccvebVLuO4euYOepae9m2S64s=", "#=qSJci08l8EqyD9KF0joWzSA==", "]\"Q+a-Y6I", "afeffefeeffe", "y`sRE", "#=qYKspnFhL3rrV8a6zSvXJWA==", "#=qzAgp3UwWT0075L6Sh4PfZA==", "'bpAb", "ReadBlockData", "AddMinutes", "#=qDJ4yS7fCDfIiEVFkwyEE6G3$$73HwRgy2_eKZUkxaSo=", "-\"&~k", "#=qhE2P2k46jiSSjO86g3nB1MkLGC9_3avDpI7iYbUHr5g=", "#=q98hMbgVf4fBR3MKeaM4uQI$YRLQdIr1biYYF5369cW8=", "#=q5bws5LlHvLK62TcSJadQTw==", "3byRy", "W{S2o", "#=qP9qYgJs5_O2GP2pI$ho4ZSa8wQkwNQEBMg8VjNRrUWE=", "#=qQkx1bBZns8hPde7$PcvfUl2fAairj6t_H8ve7nJO2s3BIB3t7PXd4ZR9h0JHyxrX", "ToArray", "#=q9LcncGbDdZaeonfU3943IQ==", "#=qhufLjssUmkN_mXHuWOXl8gUDxidnVdWY$tHhp2HS0ic=", "#=qJpz_ygP5AiHfhtTxRulSsw==", "#=qtNbB44E34Ui_i5yJYQ5ntw==", "#=q752iy7NeRDzz3UAYRlXXfQ==", "get_MetadataToken", "#=qAbQ42UrUbGpmkYA2zun7Tg==", "#=qFY80y4KcMQywRNP$ttVIXw==", "#=q2LHISsr6oVwPjyrC2AFTD2_CdAouK60pDkoTs0efRSU=", "#R%W^", "get_Item", "UInt16", "#=qN6ip4UNq3TKArPG3ZZy$zw==", "4zSXe$", "get_Now", "#=qLEtx_37WeiIPQPYSN8vY0qTNiL_L6nA6vkFQwNlcU2Y=", "FormWindowState", "1i~WO", "SQZE!", "Delete", "ClientUninstalling", "G", "#=q6OqJPhANvYfkdc5uh_IKsUbLoI4zVFCxs4fpu7Vxr_U=", "affefeeffe", "#=q7uQjJN4fKJgs403tXnERFbQ1VWp3FBsMW_1ZAWZtc1g=", "#=q_0gCRmXint4znUKVJR_bzg==", "740kw", "#=qBk9t7p9S5R095rOkFdE8GQ==", "w;O,;)W", "#=qT9sog7FujhNJZHxxUXVGPg==", "#=qYhk_OkZkBWola80M6EUqow==", "#=q74AbaKJhduohKQ4YDrC28g==", "#=q2n0wwv9OpsrMrxVUVHoqGw==", "#=qVxXNKnhAcArgJoGGYXiyyQ==", "#=q8WaW5L3_NY3KPDRN6V9mCI08mHUZbTcARcexWvaAL6A=", "String", "Mqb $", "#=qxe_BfLLMHqYa_KBeLsRfpw==", "GetObjectValue", "#=qWNtQAckY3EoQ$HeRpEQ9MEcj4oiFXpw6QZThgsGNZIA=", "#=qscQJIcBkI9VH8bZTZtABeA==", "#=qXULhMbqiur_al62NrjaiXWJ8rme0bKMO8KkV356NZwk=", "", "#=qalo3zYdlWWh$dYSx9JnNrw==", "ContainsKey", "f9P{%", "#=qKaOsg8ghd7KyYDCm3RhDg9KJrf7McwaH92TdOJzSw6s=", "#=q60UcvJzzgao2Rv_stV3rQhhxCdm95L1Gb83mKGH1VxQ=", "#=qHauijmh2nJ5kHO6fTYBnJFZKkfzkWt5gB4mYS5OLOVc=", "#=q2c1dOwAlqEVK063i13$4Vg==", "-0&sY", "#=qcMb6hxBpdyTwCjvpzaQcC5dS3wbplPqOta7ERz_lMIo=", "IEnumerable`1", "#=qfLFZgbR_r0GETPSprP6O9w==", "#=q3$9MQ9O56ldzMJGDeTdBZw==", "ToInt64", "#=qkgpjO3I2rdg6Il4nyqzgDw==", "#=qSbcOBh8Kf7zb$IciDxPlGw==", "4+xNLK6", "aT<%u", "#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=", "#=qKU0J1fiP8KA33eFK1owekQ==", "Gs#&f", "Console", "#=qsR25pLrAgwps$DwdB_BuUbMipiUFFEDkypROuvRRPj4=", "#=qKi0KrAcAGUOMcS5S$2tJyg==", "-!R,_y", "#=q5grPwgEurSn6KutVLS5_oPClPR_aCEdSRk5nKP5bDm4=", "B%n!0", "#=q8VTskDJ5TyHJcDeWmklddw==", "#=qbn24Ox5i732BM_T_R4Q3RtK1pEoSIYmxE9Rba9DDKEA=", "SizeofResource", "#=q2WFu5tRyicebO6UkQga8SbXrngw5YigfLTTVJqQy1qI=", "BaseCommand", "I29WQ", "System.IO.Compression", "#=qwSqLSPEuM8lJy4sOeuH92YjPodcLquqdG$OodozwC60=", "Transmission", "StackFrame", "#=q8d8q1KZbTCKTAZreko1Lug==", "#=qgW$Sn0ALOASuZcEZHxiZDaj3mNXTljqLa5onSc7M0U0=", "get_Key", ":@*I*", "V`zy4", "Intern", "PipeCreated", "-,&~C", "#=q7b0FP8eSMCctHkHIxEb12w==", "#=qG5YZbexfSlZk_cwFxKFh4HaY$Krp4rK2HdCH8OIs4EI=", "LogClientMessage", "/Had+4", "#=qEqEPF0jj3sUIryvQNEKKCV9boaHFZuHXMROqSn28L3g=", "#=q9iu_XWrg9WTOw3hVDQcP8ZcABJLoMYtAY0HfRbaBN24=", "#=qdDrSQoelY6gHzRt_ma5NQg==", "add_ThreadException", "AssemblyProductAttribute", "#=qwBDUI_NSPNLYbPH4gy$3uQ==", "#=qsWAbPBa1yptbB97zoAjeSA==", "get_Length", "*YZSi", "#=qc7QknLi4DrEENw9hVJyfaw==", "VariableChanged", "#=qN76bQl1CQ6EpIJzS4bbSnw==", "#=qA32zcbPIWwOaURCE8zDGfw==", "#=qqROT7DfncW7strhZvp0iRQ==", "FileInfo", "ConstructorInfo", "T~4jn", "#=qqnp3i0xG3gb2LwEmwQLB8NQerATuB2G0aH1k$$26lgk=", "x\\]DM", "Change", "get_BinaryLength", "#=qbWN2780y2PKcyDt_4uktmA==", "DialogResult", "#=q6wR5WMLGkL9afTpqmWsw9g==", "MessageBoxButtons", "Activator", "#=q48p8EJcbwRuSJ9efJfzTZ7uyOBVlFQpnFVv30w93EJA=", "get_IsEnum", "#=qrmavK4kbgFTgX3_IUlEoRw==", "#=qoygY$KIlhsLDneTXkJ_L9A==", "#=qhPbzHXREadcUSl6d6LhVYw==", "#=qVCHxDTr$$bwFMb6i9vBKRZciaa69edA3gsLNOty0RAzCorWRBUh2v0PgySYBEvZ0", "O?bY |/", "-*& r ", "#=q6k7flm9GMlPIija7ZH1xJg==", "UnhandledExceptionEventArgs", "=W~mJ", "#=qbLBIoIXYNfJl3x9LHqBWNA==", "#=q9RHjNFjnLkbqjNKidtUNeAGLmByWXgbKwjLfhcq9NOc=", "List`1", "AssemblyCopyrightAttribute", "#=q0U3u45cUl83Kicjfx0RmVA==", "#=q9T406SLBpfhYfDTkCrB28g==", "#=qO0bmWYqIZnaB7Udo1OTvUuiP36Q9Z_7hz6URm1Yr1hM=", "#=qibDx9sEkAVZroec7HmNu4g==", "4System.Web.Services.Protocols.SoapHttpClientProtocol", "#=q6V4Kle56uZFNUY$zkrrKJQ==", "ToByteArray", "ICryptoTransform", "3u1,O", "(2YGk", "#=qzDzg9a$HVGG1G5cdhqbdwO3OG_SFijGXN8Towa37$TQ=", "#=qd4_A7Y1qGQ8QAgHfK8_ssQ==", "#=q3qYAJGveL_cxux6_2m4Vaw==", "TryParse", "#=qDB62T9X0iP_6WNTXOuwQnA==", "PipeClosed", "#=q8eJA0L4q0RMnuOJCvpFj3133vZRxVnxvHST9vysUWYQ=", "Array", "Microsoft.VisualBasic.ApplicationServices", "#=qpQiSeXaCc6qGNX49vDbcMYyzv_UpV$YoUyrH0l6FW6Q=" ], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 0, "cape_type": "NanoCore Payload: 32-bit executable" } }, "detections": [ { "family": "NanoCore", "details": [ { "Yara": "2c14151d8f546aed480a7eda9be556bd37831020a3ab6d40eb993c260c9ee26b" }, { "Behavior": "" } ] } ], "procdump": [ { "name": "e4dd7d882e7afe04c9b7bddfc0a6251193152d26b730d2625db3646f88c717b3", "path": "/opt/CAPEv2/storage/analyses/47/procdump/e4dd7d882e7afe04c9b7bddfc0a6251193152d26b730d2625db3646f88c717b3", "guest_paths": "1;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?", "size": 91136, "crc32": "2C5E18AA", "md5": "7b798ec5a4fab49bb47b934b73dc2a14", "sha1": "e07ecbff698af029c14f8b155c34a3c75827fdb3", "sha256": "e4dd7d882e7afe04c9b7bddfc0a6251193152d26b730d2625db3646f88c717b3", "sha512": "69c7c3dce712af8e5e6d5629ac50dc6321ef3a54147017632a1bbc783c65c7e8a19770a78757e9773d035cbbe1f8b5a7c7889cb8be3e1d4ec6e7eda474b220b7", "rh_hash": null, "ssdeep": "1536:Xdw7/pRromCZr1BuscKvaopCrYNbdFLGVUruvaSsLsbUbdkFBpNUc+qKDpukM:NM/prm1BusvvaMC8xFYxvG+UbO3Qc+1w", "type": "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows", "yara": [ { "name": "IsPE32", "meta": {}, "strings": [], "addresses": {} }, { "name": "IsWindowsGUI", "meta": {}, "strings": [], "addresses": {} }, { "name": "IsPacked", "meta": { "description": "Entropy Check" }, "strings": [], "addresses": {} } ], "cape_yara": [], "clamav": [], "tlsh": "T13B93124DC817AF29C85AA2FB05B318C3523C219317DFAF33158E7465157A63BBA25B44", "sha3_384": "e806a0212de819f4b61e690e1de386b470e36157562a91056693ceaa993f4fc85c4f2d9a703126d07396c4162e2901b5", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "pe": { "guest_signers": { "aux_sha1": null, "aux_timestamp": null, "aux_valid": false, "aux_error": true, "aux_error_desc": "No signature found.", "aux_signers": [] }, "digital_signers": [], "imagebase": "0x00400000", "entrypoint": "0x0001e792", "ep_bytes": "", "peid_signatures": null, "reported_checksum": "0x00000000", "actual_checksum": "0x000206d1", "osversion": "4.0", "machine_type": "IMAGE_FILE_MACHINE_I386", "pdbpath": null, "imports": {}, "exported_dll_name": null, "exports": [], "dirents": [ { "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "virtual_address": "0x0001e738", "size": "0x00000057" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "virtual_address": "0x00022000", "size": "0x00015fa8" }, { "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "virtual_address": "0x00020000", "size": "0x0000000c" }, { "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_TLS", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IAT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "virtual_address": "0x00002008", "size": "0x00000048" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESERVED", "virtual_address": "0x00000000", "size": "0x00000000" } ], "sections": [ { "name": ".text", "raw_address": "0x00000400", "virtual_address": "0x00002000", "virtual_size": "0x0001e000", "size_of_data": "0x00000000", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xe0000020", "entropy": "0.00" }, { "name": ".reloc", "raw_address": "0x00000400", "virtual_address": "0x00020000", "virtual_size": "0x00002000", "size_of_data": "0x00000000", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x42000040", "entropy": "0.00" }, { "name": ".rsrc", "raw_address": "0x00000400", "virtual_address": "0x00022000", "virtual_size": "0x00016000", "size_of_data": "0x00016000", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "8.00" } ], "overlay": null, "resources": [ { "name": "RT_RCDATA", "offset": "0x00022058", "size": "0x00015f50", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "8.00" } ], "versioninfo": [], "imphash": "", "timestamp": "2015-02-22 00:49:37", "icon": null, "icon_hash": null, "icon_fuzzy": null, "icon_dhash": null }, "data": null, "strings": [ "*%x(#", "HOf{`", "|\"$V1", "ah@GI", "KNTzW", "xFPb*", "=DLV(", "&DL9/M", "f!~>~j", "c`RGU0", "4{'Wg", ":UkKI", "_XvmS", "2}}bV", "b0+MtA", "\\M/e(", "}*Skz#\\r", "v_E7o", "bZ-zT", ":X{", ">j|:\"", "\")cs`", "P1K.d", "&Hj}T", "rG~$5", "a%sdRwu", "TLDP@", "N1-M0", "%5HEl+?", "%d/RXj", "U-hW*", "7;TB S", "lw&y_", "Q@Xr_", "B)b;q", "JUz|G", "5/fKR\\", "e9j,2", "_$cN4pZ", "{%PH7M", "Yvc),", "z7zqT", "Q!Y+M", "t/[C#XKs", "TBXJD", "g/)p[", "B8h%X", "beh~@", "x&bLGY", "05MB0", "^85]", "e?A?v", "{J82]", "KJkhAEW*\\", "cV?Z|N'", "5s4*D", "n6X_V", "%InJca", "($(6h", "BSn][g", " c,g`", "*PuZI", "l[WM%", "WMPZv", "/U-WT}", "XKic8", ";_Zf[", "J.eD$", "Rb:1>@", "f11Yo", "v/,En\\", "C4vSd", "'ZI&m", "6t|Oj", "s~F,r", "aC@5=", "48saj", "/QX}e", "+.Pb/", "OU)=\"", "ubd_A|^", "Wsr!&", "LM|s6&", "pe&fz", "~(0(UV", "h]rYT\\", "suq)-\"", ">Na.q~", "7", "oFu$!", "<_bG;ZY", "s8=V<", "JafPr", "`", "TGpuY", "8uk-|", "b|g+-", "evb3+sG", "`5q}'pG", "rYs|e", "rm-^|", "G4pEt", "#VO'S", "g=KP&", "43s@a", "NE7WV", "\\^lE_", ",@Nrs8r", ",g>m1<", "-[L=k", "1)!1_", "_/o{U(A{", "7I)qt", "GY!>yw", "u~-U8", "/.B!n", "V`6Xa", "=oRe%L6j", "{p@==", "]H1e%", "MKV)/>", "_R@5h.", ".reloc", "sRvb\\", "He?J^", ".", "DC[(H\\C", "Cf{vp", "B8i\"~", "SvO!$", "\\CZM8", "&'E,]", "gw~L\\", "9beO0o", "|5rpe7", "=1ZEm", "U!+sTj", "'6KfR7O", "0e%.d|", "Wq(`eA]", "Xy{K-", "32EJC6u;IYz9", "Lw;(\"", "}Fu\"$b", "^RH\"-&", "3[@N:", "+C? 0H", "~&h9W", "bBQZ`", "-kL?R", "'5$&;", "S$'U|", "#mvl9", ")L>$t", "|u.4By", "F% 6[Me", "p20S:[!", "M`o}+", "!7k&Y", "@kEpU6", "/l\\g06", "1i^I2p", "KseXr", "D>)TY", "ptQY1D", "c1 [1", "48zmp", "uP}b7", "ZRvcv", "Vy`?:o", "0J8>')", "$>lPy", "9g}MS", "1cz[u", ";6y\\;;", "q F%f\"", "9RNWA", "y`sRE", "Ns\\8OX", "+`(Gb", "&2+0\\", "HdXLH.", "krmWR", "/!|Sq", "'bpAb", "d)PG ", "3byRy", "W{S2o", "%vz4x", "t:0e)W", "4+Ot=]", "CU fL", "#R%W^", "4FS;,MM", "D|3[5", "4zSXe$", "bIC)<", ".a;*x", ",@WG", "B.dIs", "B.rsrc", "V._H8", "ubzrn*", "740kw", "a!5aE", "w;O,;)W", "mBS|c", "C{A/{", "1;sKPkj", "]I]XLh$*A", "lSgV'", "2N`i!", "go,NAw", "WdSH6", "|I5v}", "Mqb $", "z#cuch6ZI", "i,Id`", "f9P{%", "Qo)hSX", "mb]OE)u", "@4;oOB", "fSgHd", "L3&UNmY^!^", "/;ol]", "|.euR", ")}8.m", "oL)c3", "c_Nd<", "jsND)F", "4+xNLK6", "aT<%u", "@iOLO>??3", "|*mnk2B", "Gs#&f", "-!R,_y", "C{]_o", "j#'B=C", "B%n!0", "C4rwC", "b'Ohi", "I29WQ", "^s,}W", ",Q:i7", "Si+ze", "%XfzR(Z", "4.'[G", "xUB.i", "NW@5q", ":@*I*", "V`zy4", "!e~uh", "/Had+4", "Ko*/B", "]FG;K3k", "fAE`C", "FYodp$", "ZLvpY", "*YZSi", "]%vkmj", "\\8SYH", ".*%6M", ".]7=2_la$U<", "T~4jn", "!U7aX", "x\\]DM", "-SK1$", "BS", "aBXL!C", "49#m`.", "v,=E.j", "X8.2@$3", "O?bYb(", "@pN_02Z", "!V,(q", "U/ |/", "6BAna", "TMpO|}-", "OlfJ@", "=W~mJ", "QLgQ=", "@DFe]g", "c!};z", "Tk~rs", "nT={iz", "{4u-1u", "(~3c82", "3u1,O", "ha|H=+'", "(2YGk", ".4Ccq", "PD/wj", "+^Tw.", "}qh3`", "'UD_'j", "OKoB<" ], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 1, "cape_type": "", "process_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "process_name": "sex1.exe", "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "pid": 6648 } ], "dropped": [ { "name": [ "tmp2CBA.tmp" ], "path": "/opt/CAPEv2/storage/analyses/47/files/067d3f5167cab2ea4e76f59386df4eaf49c6008f6451e1971274a938ad7bcf44", "guest_paths": [ "C:\\Users\\cape\\AppData\\Local\\Temp\\tmp2CBA.tmp" ], "size": 1308, "crc32": "DFC53F5D", "md5": "f3cda3e6bab1951e8d59c3eb775a14c6", "sha1": "434c1ec851a45c0505fd8fd28159f549e2e9adfd", "sha256": "067d3f5167cab2ea4e76f59386df4eaf49c6008f6451e1971274a938ad7bcf44", "sha512": "bc79446e4e0204c04abcacef6799aeafe7915c1a5c6bdb3573ba40370d6a6a1e2590eb6315151d12a9447970f993a17463442c5dc0ba97c58df17dddfd73d62c", "rh_hash": null, "ssdeep": "24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0RyKqhxtn:cbk4oL600QydbQxIYODOLedq3SyKUj", "type": "XML 1.0 document, ASCII text, with CRLF line terminators", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T15021C064ACC0F61B66715625A39197C2DF2A97A301564138FCCC4E7F2FB6186305356B", "sha3_384": "1eb93f230a5f047b6d766169b634e81bfc13787304efced3c798eae10e87825e08181f98f6e13bfa644749fba3b38ee6", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": "\n\n \n \n \n \n InteractiveToken\n HighestAvailable\n \n \n \n Parallel\n false\n false\n true\n false\n false\n \n false\n false\n \n true\n true\n false\n false\n false\n PT0S\n 4\n \n \n \n \"C:\\Program Files (x86)\\WAN Manager\\wanmgr.exe\"\n $(Arg0)\n \n \n", "strings": [], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 0, "cape_type": "", "pid": 6648 }, { "name": [ "task.dat" ], "path": "/opt/CAPEv2/storage/analyses/47/files/18dfaf9bd0867e40bf38b6f31369867a9d3ed42ac0a7a313753ad173556a4225", "guest_paths": [ "C:\\Users\\cape\\AppData\\Roaming\\F3037635-6191-4C44-BD96-905F1B4FEAFD\\task.dat" ], "size": 41, "crc32": "7ED1E097", "md5": "a6bbb34741376ac2a4a2ae37846e6e08", "sha1": "febe5edca9a7b94cc4b96a51cc41aa2850ad6c5c", "sha256": "18dfaf9bd0867e40bf38b6f31369867a9d3ed42ac0a7a313753ad173556a4225", "sha512": "439a2958149c5e11fff10111269752d42ed625397c1d710c76bd7e0387ecdeb4c12df45a9038de780e3ccd6ff997d306ebb985bee039d97dc9cc97ab19e61f80", "rh_hash": null, "ssdeep": "3:oNTqE2J5xAIpULACn:oNb23fAn", "type": "ASCII text, with no line terminators", "yara": [], "cape_yara": [], "clamav": [], "tlsh": null, "sha3_384": "dabe121803234b876b9f7dbc5bdc37931bbc7596ada27081a6f83f04d92fc52add147059f0169848d1efb86094046b3d", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "strings": [], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 0, "cape_type": "", "pid": 6648 }, { "name": [ "tmp16B1.tmp" ], "path": "/opt/CAPEv2/storage/analyses/47/files/4931757751d7c9d49e74bf11f86be68591998ab3608b8a0d8cca6b531f1451a6", "guest_paths": [ "C:\\Users\\cape\\AppData\\Local\\Temp\\tmp16B1.tmp" ], "size": 1304, "crc32": "FA07A1F8", "md5": "f08fb725f4cb00c9cbdaea414924186b", "sha1": "213e1ba4cbf97cc15078aa7525dfdf1ec14765b9", "sha256": "4931757751d7c9d49e74bf11f86be68591998ab3608b8a0d8cca6b531f1451a6", "sha512": "d25a30b1f36ff3acb53ed5ed1604bca83a9d4742bc2deaa8fd0d5ef0f5d8a8c8f3b8ff836fdfc33cc0b938859389d530ca8d720f15b8a10b9b14b6a2fb57284f", "rh_hash": null, "ssdeep": "24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0yoXxtn:cbk4oL600QydbQxIYODOLedq3boXj", "type": "XML 1.0 document, ASCII text, with CRLF line terminators", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1FB219D68ACC0F61F66B19629A39197C2DE2A97A301564138FCCC4E7F3FB6186305356B", "sha3_384": "452153ccc56a1af13a66cebb3214161d2b6cd027af8cd95f1bc82c7e0b79207d51a73a446f4d20801a0db02147b66883", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": "\n\n \n \n \n \n InteractiveToken\n HighestAvailable\n \n \n \n Parallel\n false\n false\n true\n false\n false\n \n false\n false\n \n true\n true\n false\n false\n false\n PT0S\n 4\n \n \n \n \"C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe\"\n $(Arg0)\n \n \n", "strings": [], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 0, "cape_type": "", "pid": 6648 }, { "name": [ "run.dat" ], "path": "/opt/CAPEv2/storage/analyses/47/files/36bafa5002051a4b9b6881e5a98a99819e4d0b662428a35760be4ff269b74707", "guest_paths": [ "C:\\Users\\cape\\AppData\\Roaming\\F3037635-6191-4C44-BD96-905F1B4FEAFD\\run.dat" ], "size": 8, "crc32": "74E3501B", "md5": "92f616e30feb8f3c9fcbb420cdb90f4b", "sha1": "16c273b953b195e0d6f5341b9e41b4b6963290c7", "sha256": "36bafa5002051a4b9b6881e5a98a99819e4d0b662428a35760be4ff269b74707", "sha512": "37358ecc84a4edc24a65efe39b3f76ec76860c291e9faf4313c69929ab1374b17f383e614b55e4341dc86e2de4cbbd1110cfbd5fc07eb6cedc51e134c55c7dab", "rh_hash": null, "ssdeep": "3:Nw/t:+l", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": null, "sha3_384": "1663741d0a38596f6a5bcc30f66040acdc4265e0770884324e77a3558cbf9d0f8141b984af379c5558bff5942ffd80db", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": null, "strings": [], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 0, "cape_type": "", "pid": 6648 } ], "CAPE": { "payloads": [ { "name": "61e9d5c0727665e9ef3f328141397be47c65ed11ab621c644b5bbf1d67138403", "path": "/opt/CAPEv2/storage/analyses/47/CAPE/61e9d5c0727665e9ef3f328141397be47c65ed11ab621c644b5bbf1d67138403", "guest_paths": "8;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?0x08110000;?", "size": 19968, "crc32": "BE3B83AB", "md5": "bdc8945f1d799c845408522e372d1dbd", "sha1": "874b7c3c97cc5b13b9dd172fec5a54bc1f258005", "sha256": "61e9d5c0727665e9ef3f328141397be47c65ed11ab621c644b5bbf1d67138403", "sha512": "4fa0ed4ef66e4c442f5fc628e8bfc8a4f84cb213210643996d9387027edb619c054f6104ac889ae77cece09f0304f95d5f20e14d66847e2d382ef51eecec0962", "rh_hash": null, "ssdeep": "192:VYLQui6h6p5WW3tZVTnlYJL/eLYLTr2/C8:VYLQu/6/fKqLYLTR", "type": "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows", "yara": [ { "name": "DITEKSHEN_MALWARE_Win_Nanocore", "meta": { "description": "Detects NanoCore", "author": "ditekSHen", "id": "931b98f6-df2b-538b-bc49-ecbbd24334da", "date": "2020-11-06", "modified": "2024-11-01", "reference": "https://github.com/ditekshen/detection", "source_url": "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7654-L7681", "license_url": "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt", "logic_hash": "6336260e0af2b4b51338ee066f41b7c58aa134a6c03ca110db7e088edf2b65a7", "score": 75, "quality": 75, "tags": "FILE" }, "strings": [ "NanoCore.ClientPlugin", "NanoCore.ClientPluginHost", "IClientApp", "IClientData", "IClientNetwork", "IClientAppHost", "IClientDataHost", "IClientLoggingHost", "IClientNetworkHost", "IClientUIHost", "IClientNameObjectCollection", "IClientReadOnlyNameObjectCollection", "ClientPlugin", "get_ClientSettings", "get_Connected" ], "addresses": { "x2": 3640, "x3": 3701, "i1": 3674, "i2": 3662, "i3": 3625, "i4": 3779, "i5": 3685, "i6": 3760, "i7": 3727, "i8": 3746, "i9": 3794, "i10": 3831, "s1": 6025, "s6": 4601, "s7": 4681 } }, { "name": "Windows_Trojan_Nanocore_d8c4e3c5", "meta": { "author": "Elastic Security", "id": "d8c4e3c5-8bcc-43d2-9104-fa3774282da5", "fingerprint": "e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4", "creation_date": "2021-06-13", "last_modified": "2021-08-23", "threat_name": "Windows.Trojan.Nanocore", "reference_sample": "b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd", "severity": 100, "arch_context": "x86, arm64", "scan_context": "file, memory", "license": "Elastic License v2", "os": "windows" }, "strings": [ "NanoCore.ClientPluginHost", "NanoCore.ClientPlugin", "get_BuilderSettings", "IClientAppHost", "AddHostEntry", "LogClientException", "PipeExists", "IClientLoggingHost" ], "addresses": { "a1": 3701, "a2": 3640, "b1": 4620, "b4": 3779, "b6": 4733, "b7": 4844, "b8": 4705, "b9": 3760 } }, { "name": "Nanocore_RAT_Gen_2", "meta": { "description": "Detetcs the Nanocore RAT", "author": "Florian Roth", "score": 100, "reference": "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/", "date": "2016-04-22", "hash1": "755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050" }, "strings": [ "NanoCore.ClientPluginHost", "IClientNetworkHost" ], "addresses": { "x1": 3701, "x2": 3727 } }, { "name": "NETDLLMicrosoft", "meta": { "author": "malware-lu" }, "strings": [ "{ 00 00 00 00 00 00 00 00 5F 43 6F 72 44 6C 6C 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 00 00 00 FF 25 }" ], "addresses": { "a0": 6858 } }, { "name": "IsPE32", "meta": {}, "strings": [], "addresses": {} }, { "name": "IsNET_DLL", "meta": {}, "strings": [], "addresses": {} }, { "name": "IsDLL", "meta": {}, "strings": [], "addresses": {} }, { "name": "IsWindowsGUI", "meta": {}, "strings": [], "addresses": {} }, { "name": "Microsoft_Visual_Studio_NET", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "a": 6894 } }, { "name": "Microsoft_Visual_C_v70_Basic_NET_additional", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "a": 6894 } }, { "name": "Microsoft_Visual_C_Basic_NET", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "b": 6894 } }, { "name": "Microsoft_Visual_Studio_NET_additional", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "a": 6894 } }, { "name": "Microsoft_Visual_C_v70_Basic_NET", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "b": 6894 } }, { "name": "NET_executable_", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "a": 6894 } }, { "name": "NET_executable", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "b": 6894 } } ], "cape_yara": [], "clamav": [], "tlsh": "T1CA924D1362CE7DE6E5B916303B3387C1C72DDE041653DA2E16D87629E97E2833A523D8", "sha3_384": "34e76812c5bbcc4e39114f9560b049a9e8ac0f74800b55f33641134edf5dfb32ff8a420a55be3ca4c294e8d1f69db255", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "pe": { "guest_signers": { "aux_sha1": null, "aux_timestamp": null, "aux_valid": false, "aux_error": true, "aux_error_desc": "No signature found.", "aux_signers": [] }, "digital_signers": [], "imagebase": "0x00400000", "entrypoint": "0x000038ee", "ep_bytes": "ff250020400000000000000000000000", "peid_signatures": null, "reported_checksum": "0x00000000", "actual_checksum": "0x0000721e", "osversion": "4.0", "machine_type": "IMAGE_FILE_MACHINE_I386", "pdbpath": null, "imports": { "mscoree": { "dll": "mscoree.dll", "imports": [ { "address": "0x402000", "name": "_CorDllMain" } ] } }, "exported_dll_name": null, "exports": [], "dirents": [ { "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "virtual_address": "0x0000389c", "size": "0x0000004f" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "virtual_address": "0x00004000", "size": "0x00002f58" }, { "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "virtual_address": "0x00008000", "size": "0x0000000c" }, { "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_TLS", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IAT", "virtual_address": "0x00002000", "size": "0x00000008" }, { "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "virtual_address": "0x00002008", "size": "0x00000048" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESERVED", "virtual_address": "0x00000000", "size": "0x00000000" } ], "sections": [ { "name": ".text", "raw_address": "0x00000200", "virtual_address": "0x00002000", "virtual_size": "0x000018f4", "size_of_data": "0x00001a00", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "5.26" }, { "name": ".rsrc", "raw_address": "0x00001c00", "virtual_address": "0x00004000", "virtual_size": "0x00002f58", "size_of_data": "0x00003000", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "3.31" }, { "name": ".reloc", "raw_address": "0x00004c00", "virtual_address": "0x00008000", "virtual_size": "0x0000000c", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x42000040", "entropy": "0.08" } ], "overlay": null, "resources": [ { "name": "RT_ICON", "offset": "0x00004468", "size": "0x000002e8", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "1.71" }, { "name": "RT_ICON", "offset": "0x00004750", "size": "0x00000128", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "2.08" }, { "name": "RT_ICON", "offset": "0x00004878", "size": "0x000008a8", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "1.72" }, { "name": "RT_ICON", "offset": "0x00005120", "size": "0x00000568", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "1.05" }, { "name": "RT_ICON", "offset": "0x00005688", "size": "0x00000353", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "4.05" }, { "name": "RT_ICON", "offset": "0x000059e0", "size": "0x000010a8", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "2.72" }, { "name": "RT_ICON", "offset": "0x00006a88", "size": "0x00000468", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "2.76" }, { "name": "RT_GROUP_ICON", "offset": "0x00006ef0", "size": "0x00000068", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "2.69" }, { "name": "RT_VERSION", "offset": "0x00004208", "size": "0x0000025c", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.23" } ], "versioninfo": [ { "name": "Translation", "value": "0x0000 0x04b0" }, { "name": "FileDescription", "value": " " }, { "name": "FileVersion", "value": "1.2.0.0" }, { "name": "InternalName", "value": "ClientPlugin.dll" }, { "name": "LegalCopyright", "value": " " }, { "name": "OriginalFilename", "value": "ClientPlugin.dll" }, { "name": "ProductVersion", "value": "1.2.0.0" }, { "name": "Assembly Version", "value": "1.2.0.0" } ], "imphash": "dae02f32a21e03ce65412f6e56942daa", "timestamp": "2014-11-23 01:09:01", "icon": "iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAY0lEQVR4nO3XIQ6AMBBE0YH0eGuAcwKmZ1sLCkHRZUj4o9qaeVmzqfT3DJl5OAGjs1ySynWIiFeLa62SPjABAABK+7Cte9fCeZlud/sEAAAAAAAAADvgsY7bddk79gnwMSH2nLDUDvNx5OJLAAAAAElFTkSuQmCC", "icon_hash": "f66c7c86e9ab59ef3f289acd613a3738", "icon_fuzzy": "c3ca946d749a15ad18efd3e5d7b0d8f5", "icon_dhash": "454545d4d4d44503", "imported_dll_count": 1 }, "data": null, "strings": [ "System.CodeDom.Compiler", "get_ClientSettings", "RestoreProtection", "mscoree.dll", "EntryExists", "params", "Assembly Version", "ClientPlugin.dll", "SendToServer", "RebuildHostCache", "m_Context", "KeyValuePair`2", "GetObjectValue", "set_Value", "TargetMethod", "My.Application", "1.2.0.0", "NanoCore.My", "IDATx", "Microsoft.VisualBasic.CompilerServices", "InternalName", "message", "System", "#Blob", "_CorDllMain", "System.Diagnostics", "MulticastDelegate", "ClientPlugin", "ComVisibleAttribute", "MyApplication", "IClientNameObjectCollection", "MyGroupCollectionAttribute", "EditorBrowsableAttribute", "pipeName", "AddHostEntry", "ParamArrayAttribute", "MyComputer", "BeginInvoke", ".ctor", "MyProject", "compress", "ThreadSafeObjectProvider`1", "LogClientException", "ConnectionStateChanged", "DebuggerHiddenAttribute", "System.ComponentModel", "ToString", "DelegateCallback", "instance", "wwwwwwwwwwwwww", "VarFileInfo", "LegalCopyright", "My.Computer", "get_Connected", "GetEntries", "AsyncCallback", "MyTemplate", "m_AppObjectProvider", "Restart", "System.Runtime.CompilerServices", "", "GetInstance", "Uninstall", "get_GetInstance", "Equals", "IAsyncResult", "wwwwww", "ClientSettingChanged", "EndInvoke", "My.User", "FileVersion", "ClientInvokeDelegate", "ContextValue`1", "SetValue", "IClientNetwork", "get_WebServices", "PipeCreated", "`.rsrc", ".text", "AssemblyFileVersionAttribute", "WebServices", "Invoke", "StringFileInfo", "LogClientMessage", "GuidAttribute", "NanoCore", "AssemblyTrademarkAttribute", "DelegateAsyncState", "v2.0.50727", "ProductVersion", "#Strings", "System.Collections.Generic", "System.ComponentModel.Design", "Microsoft.VisualBasic", "AssemblyProductAttribute", "ClientSettings", "FileDescription", "@.reloc", "ConnectionFailed", "IClientUIHost", "$d6e3c4d8-8560-4021-a765-fad7362f3388", "VariableChanged", "MyWebServices", "!This program cannot be run in DOS mode.", "ClosePipe", "My.WebServices", "Variables", "IClientLoggingHost", "GetHashCode", "IClientNetworkHost", "TargetObject", "AssemblyCompanyAttribute", "BuildingHostCache", "GetValue", "m_UserObjectProvider", "Connected", "IClientApp", "RuntimeCompatibilityAttribute", "Dispose__Instance__", "8.0.0.0", "CompilationRelaxationsAttribute", "get_Application", "IClientData", "Activator", "000004b0", "PipeExists", "state", "PluginUninstalling", "Application", "Translation", "mscorlib", "OriginalFilename", "RuntimeHelpers", "RemoveValue", "IClientReadOnlyNameObjectCollection", "get_User", "CreateInstance", "IClientAppHost", "HideModuleNameAttribute", "connected", "ReadPacket", "System.Runtime.InteropServices", "value", "VS_VERSION_INFO", "HelpKeywordAttribute", "get_Variables", "Create__Instance__", "Computer", "Disconnect", "Exception", "AssemblyTitleAttribute", "defaultValue", "ApplicationBase", "#GUID", "ClientUninstalling", "AssemblyDescriptionAttribute", "NanoCore.ClientPlugin", "IClientDataHost", "Object", "get_BuilderSettings", "method", "System.Reflection", "AssemblyCopyrightAttribute", "DisableProtection", "get_Value", "Microsoft.VisualBasic.Devices", "4System.Web.Services.Protocols.SoapHttpClientProtocol", "m_MyWebServicesObjectProvider", "m_ComputerObjectProvider", "BuilderSettings", "GeneratedCodeAttribute", "NanoCore.ClientPluginHost", "Shutdown", "DelegateAsyncResult", "RuntimeTypeHandle", "WrapNonExceptionThrows", "get_Computer", ".cctor", "GetType", "StandardModuleAttribute", "GetTypeFromHandle", "PipeClosed", "EditorBrowsableState", "Microsoft.VisualBasic.ApplicationServices", "Microsoft.VisualBasic.MyServices.Internal" ], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 8, "cape_type": "Unpacked PE Image: 32-bit DLL", "process_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "process_name": "sex1.exe", "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "pid": 6648, "virtual_address": "0x08110000" }, { "name": "f9b8c3f31375e9a1ec105f930f751869a804110d29d6b38e7298622eb74b2bec", "path": "/opt/CAPEv2/storage/analyses/47/CAPE/f9b8c3f31375e9a1ec105f930f751869a804110d29d6b38e7298622eb74b2bec", "guest_paths": "8;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?0x08510000;?", "size": 12288, "crc32": "8EB03B4F", "md5": "42006852619847f368bc4062849cd6dc", "sha1": "ba6edc3a5aba8eac15b6a30e1407cdae80b2481d", "sha256": "f9b8c3f31375e9a1ec105f930f751869a804110d29d6b38e7298622eb74b2bec", "sha512": "92f8f8d8809c37927e6c0f94d35450b16f71b4252d2e316558991105b1bd90b644bc9f8cbbca68423e1371215567b11c631eee5fcbf42dc08c2341cc91dd053e", "rh_hash": null, "ssdeep": "192:Wb5lecl5SzxgU1g16ldP8i9CL69w582bDAetqL0yQA+cj:Wb5QlnrdP8ICL6q5vb0et9yQXo", "type": "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows", "yara": [ { "name": "NETDLLMicrosoft", "meta": { "author": "malware-lu" }, "strings": [ "{ 00 00 00 00 00 00 00 00 5F 43 6F 72 44 6C 6C 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 00 00 00 FF 25 }" ], "addresses": { "a0": 10346 } }, { "name": "IsPE32", "meta": {}, "strings": [], "addresses": {} }, { "name": "IsNET_DLL", "meta": {}, "strings": [], "addresses": {} }, { "name": "IsDLL", "meta": {}, "strings": [], "addresses": {} }, { "name": "IsConsole", "meta": {}, "strings": [], "addresses": {} }, { "name": "Microsoft_Visual_Studio_NET", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "a": 10382 } }, { "name": "Microsoft_Visual_C_v70_Basic_NET_additional", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "a": 10382 } }, { "name": "Microsoft_Visual_C_Basic_NET", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "b": 10382 } }, { "name": "Microsoft_Visual_Studio_NET_additional", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "a": 10382 } }, { "name": "Microsoft_Visual_C_v70_Basic_NET", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "b": 10382 } }, { "name": "NET_executable_", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "a": 10382 } }, { "name": "NET_executable", "meta": {}, "strings": [ "{ FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }" ], "addresses": { "b": 10382 } } ], "cape_yara": [], "clamav": [], "tlsh": "T1B042D61EDF8CC667DB6993BCD4E24E0A1760A431BA73DB9FB80481640587BF8051B39B", "sha3_384": "201a8c71a37dc4dbd0df68b438794dab6fa7ae615b5a6a2e73ad4db8e2173640f1fd04e11272028001a4a010d64b85b6", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "pe": { "guest_signers": { "aux_sha1": null, "aux_timestamp": null, "aux_valid": false, "aux_error": true, "aux_error_desc": "No signature found.", "aux_signers": [] }, "digital_signers": [], "imagebase": "0x00400000", "entrypoint": "0x0000468e", "ep_bytes": "ff250020400000000000000000000000", "peid_signatures": null, "reported_checksum": "0x00000000", "actual_checksum": "0x0000580e", "osversion": "4.0", "machine_type": "IMAGE_FILE_MACHINE_I386", "pdbpath": null, "imports": { "mscoree": { "dll": "mscoree.dll", "imports": [ { "address": "0x402000", "name": "_CorDllMain" } ] } }, "exported_dll_name": null, "exports": [], "dirents": [ { "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "virtual_address": "0x00004638", "size": "0x00000053" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "virtual_address": "0x00006000", "size": "0x00000298" }, { "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "virtual_address": "0x00008000", "size": "0x0000000c" }, { "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_TLS", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IAT", "virtual_address": "0x00002000", "size": "0x00000008" }, { "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "virtual_address": "0x00002008", "size": "0x00000048" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESERVED", "virtual_address": "0x00000000", "size": "0x00000000" } ], "sections": [ { "name": ".text", "raw_address": "0x00000200", "virtual_address": "0x00002000", "virtual_size": "0x00002694", "size_of_data": "0x00002800", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "5.43" }, { "name": ".rsrc", "raw_address": "0x00002a00", "virtual_address": "0x00006000", "virtual_size": "0x00000298", "size_of_data": "0x00000400", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "2.14" }, { "name": ".reloc", "raw_address": "0x00002e00", "virtual_address": "0x00008000", "virtual_size": "0x0000000c", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x42000040", "entropy": "0.08" } ], "overlay": null, "resources": [ { "name": "RT_VERSION", "offset": "0x00006058", "size": "0x0000023c", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.19" } ], "versioninfo": [ { "name": "Translation", "value": "0x0000 0x04b0" }, { "name": "FileDescription", "value": " " }, { "name": "FileVersion", "value": "0.0.0.0" }, { "name": "InternalName", "value": "Lzma#.dll" }, { "name": "LegalCopyright", "value": " " }, { "name": "OriginalFilename", "value": "Lzma#.dll" }, { "name": "ProductVersion", "value": "0.0.0.0" }, { "name": "Assembly Version", "value": "0.0.0.0" } ], "imphash": "dae02f32a21e03ce65412f6e56942daa", "timestamp": "2011-04-12 14:47:32", "icon": null, "icon_hash": null, "icon_fuzzy": null, "icon_dhash": null, "imported_dll_count": 1 }, "data": null, "strings": [ "mscoree.dll", "0.0.0.0", "DecodeDirectBits", "ICodeProgress", "rangeDecoder", "kStartPosModelIndex", "kTopValue", "_streamPos", "Assembly Version", "numBitLevels", "WriteCoderProperties", "CoderPropID", "Range", "m_Decoders", "LenDecoder", "kNumFullDistances", "kNumPosStatesBitsEncodingMax", "GetLenToPosState", "m_Choice", "m_MidCoder", "numPosStates", "m_LowCoder", "InternalName", "progress", "distance", "prevByte", "Decode", "GetState", "kNumLitPosStatesBitsEncodingMax", "OutWindow", "#Blob", "System", "State", "LiteralDecoder", "kNumPosStatesEncodingMax", "dictionarySize", "m_IsRepG1Decoders", "_CorDllMain", "m_NumPosStates", "m_DictionarySize", "m_IsRepG2Decoders", "DecodeNormal", "LayoutKind", "SetProgress", "kNumStates", "Lzma#", "m_PosDecoders", "numPosBits", "m_NumPosBits", ".ctor", "ReleaseStream", "_buffer", "MatchFinder", "UpdateChar", "solid", "kNumLowLenBits", "ICoder", "UpdateRep", "_windowSize", "kNumPosSlotBits", "DictionarySize", "NumPasses", "m_LiteralDecoder", "VarFileInfo", "kNumLenSymbols", "kNumMidLenBits", "LegalCopyright", "UsedMemorySize", "kNumLowLenSymbols", "System.Runtime.CompilerServices", "m_RangeDecoder", "propIDs", "", "StructLayoutAttribute", "kNumMoveBits", "_cX*n", "outSize", "numTotalBits", "Algorithm", "inputBytes", "FileVersion", "stream", "Decoder2", "m_IsRepG0Decoders", "BitTreeDecoder", "System.IO", "SetLiteralProperties", "kDicLogSizeMin", "kNumLenToPosStates", "`.rsrc", "SetDictionarySize", ".text", "NumBitLevels", "UpdateMatch", "StringFileInfo", "m_NumPrevBits", "LitContextBits", "kNumRepDistances", "Write", "v2.0.50727", "ReverseDecode", "ProductVersion", "#Strings", "kNumAlignBits", "m_IsMatchDecoders", "get_Length", "Models", "FileDescription", "@.reloc", "inStream", "windowSize", "get_Position", "!This program cannot be run in DOS mode.", "kMatchMinLen", "kAlignTableSize", "m_OutWindow", "Compression.RangeCoder", "m_DictionarySizeCheck", "m_HighCoder", "MemoryStream", "m_IsRepDecoders", "kAlignMask", "value__", "m_PosStateMask", "m_PosMask", "m_RepLenDecoder", "_stream", "RuntimeCompatibilityAttribute", "Index", "numPrevBits", "kNumPosStatesBitsMax", "CompilationRelaxationsAttribute", "CopyBlock", "PutByte", "kMatchMaxLen", "000004b0", "m_PosSlotDecoder", "ToArray", "mscorlib", "Translation", "OriginalFilename", "IWriteCoderProperties", "BitDecoder", "properties", "kNumLenToPosStatesBits", "UpdateShortRep", "m_Coders", "kNumPosStatesMax", "LitPosBits", "MultiThread", "kNumBitModelTotalBits", "posState", "outStream", "System.Runtime.InteropServices", "kBitModelTotal", "Compression.LZMA", "IsCharState", "SetDecoderProperties", "ValueType", "SetCoderProperties", "Order", "Decoder", "VS_VERSION_INFO", "ISetDecoderProperties", "kEndPosModelIndex", "inSize", "Exception", "m_LenDecoder", "DecodeWithMatchByte", "m_Choice2", "EndMarker", "#GUID", "Stream", "startIndex", "Object", "kNumHighLenBits", "Flush", "matchByte", "Lzma#.dll", "NumFastBytes", "kNumMidLenSymbols", "Compression.LZ", "PosStateBits", "ISetCoderProperties", "kNumLitContextBitsMax", "SetPosBitsProperties", "m_PosAlignDecoder", "m_IsRep0LongDecoders", "Create", "SeekOrigin", "ReadByte", "WrapNonExceptionThrows", "kNumPosModels", "GetByte", "Decompress" ], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 8, "cape_type": "Unpacked PE Image: 32-bit DLL", "process_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "process_name": "sex1.exe", "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "pid": 6648, "virtual_address": "0x08510000" }, { "name": "6a4a38c4482e414c906feff2bcb47d46b8ed525c6b88eff38080f494a7163a1b", "path": "/opt/CAPEv2/storage/analyses/47/CAPE/6a4a38c4482e414c906feff2bcb47d46b8ed525c6b88eff38080f494a7163a1b", "guest_paths": "9;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?0x7F6C0000;?", "size": 44, "crc32": "F63A8DE7", "md5": "1479a186780e7c905c7793b85d8dfd00", "sha1": "03a060d75ac7b735913ed1796b03f2acfedd47ee", "sha256": "6a4a38c4482e414c906feff2bcb47d46b8ed525c6b88eff38080f494a7163a1b", "sha512": "d9843f2ed8135182ba7a6ad4ab1989b075e9ef4e63b8ad87aef742cbaf85d165a942aab56617c41b73740ffab9be237e109c2a10a9a11b8533c7da153c6c2639", "rh_hash": null, "ssdeep": "3:Uaql/stl+ClrxlNJ5ZJVhX:UF/sX+mXNJN", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": null, "sha3_384": "8aff1a2ab3cf7f30dea7149c2d02ce55f8ce02a105467e2be9c5d01f72c7baf8d15cf6c93237806654f4b56e4bf534a1", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": null, "strings": [], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 9, "cape_type": "Unpacked Shellcode", "process_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "process_name": "sex1.exe", "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "pid": 6648, "virtual_address": "0x7F6C0000" }, { "name": "7902243f3a376bfaa57345f4323c5ae18f5f180ad0fd75395f6a3344bab889d5", "path": "/opt/CAPEv2/storage/analyses/47/CAPE/7902243f3a376bfaa57345f4323c5ae18f5f180ad0fd75395f6a3344bab889d5", "guest_paths": "9;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?0x051E0000;?", "size": 1380, "crc32": "A17019F5", "md5": "a94b479c5273e54e7a966557098714fa", "sha1": "3051a2e5270a008e337d99bc94b420c1bce0af10", "sha256": "7902243f3a376bfaa57345f4323c5ae18f5f180ad0fd75395f6a3344bab889d5", "sha512": "434deaf6ed29deae7ebec900ec1c7da42a677a69be93a2b6bd081ecbbee1f54efc99a165c2a35291ccf87dcc98dc3189a0069669ce1e0a869a01838a5fbb7659", "rh_hash": null, "ssdeep": "24:rGeQGp9S15T+OkwAzSIfURV/2z0Ww4472jWmiEAWhhgDNBU1k:rGedpk15COqM/ufw44qyohgDIq", "type": "Windows boot log, header size 0x51e0000, 0x1 valid bytes", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T17C21A54281DAA2E1C04D8AF84A289707D4C254C392FF6A7434ACEF2E90F0621CD564E3", "sha3_384": "07b8b4601637716b6b7088b40c1d42a901126f523b7b2d13be7cac8f89a6af65cd337d3c0402339357b7a68028210b4f", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": null, "strings": [ ">gpl]", "Y[^_]" ], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 9, "cape_type": "Unpacked Shellcode", "process_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "process_name": "sex1.exe", "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "pid": 6648, "virtual_address": "0x051E0000" }, { "name": "157b063a2a5ecda11353d506c46d65fac9350decc6f97df21fb48dc66a8a4c99", "path": "/opt/CAPEv2/storage/analyses/47/CAPE/157b063a2a5ecda11353d506c46d65fac9350decc6f97df21fb48dc66a8a4c99", "guest_paths": "9;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?0x0290A000;?", "size": 354, "crc32": "E2F6479D", "md5": "3b0c94f80aa41d3135e58b9b8b11b124", "sha1": "d2ebe6bb0533e433542a2110c8b36ea45b4be777", "sha256": "157b063a2a5ecda11353d506c46d65fac9350decc6f97df21fb48dc66a8a4c99", "sha512": "2cc9d77c4ae3918da0b76ab94ca27d4a4039f5951b01fc0f03971f2638759019593a37de1be6257316896adc76fcb85efc0ffc030ce2fe492c4e606b8f956444", "rh_hash": null, "ssdeep": "6:9x3lObati5pS21zPo2lM/JmJKKpWArUVfll9ZO9ueCXGz:9FiTPo2u/osKpW5ll9ZO9u6z", "type": "Matlab v4 mat-file (little endian) 3, numeric, rows 43032576, columns 8192", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T129E07D07034007F5D808C5FB091BD78BCF8C443D71F8A756CF3C606324366D84011511", "sha3_384": "e3d9c380210402db9ab10cd504f3a34fda1ff0c409501b204cbef2a0e4ba41ba916c4d9a2f431ff5958537d50d402236", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": null, "strings": [ "~sUSVW", "PRh`9~sUSVW", "UX5VS" ], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 9, "cape_type": "Unpacked Shellcode", "process_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "process_name": "sex1.exe", "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "pid": 6648, "virtual_address": "0x0290A000" }, { "name": "01e3b18bd63981decb384f558f0321346c3334bb6e6f97c31c6c95c4ab2fe354", "path": "/opt/CAPEv2/storage/analyses/47/CAPE/01e3b18bd63981decb384f558f0321346c3334bb6e6f97c31c6c95c4ab2fe354", "guest_paths": "8;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?0x083B0000;?", "size": 100352, "crc32": "EDEEDF40", "md5": "9c8242440c47a4f1ce2e47df3c3ddd28", "sha1": "874f3caf663265f7dd18fb565d91b7d915031251", "sha256": "01e3b18bd63981decb384f558f0321346c3334bb6e6f97c31c6c95c4ab2fe354", "sha512": "3525b219fec9894d9d534e6774e19fbf7097c9a00d733c11bee14c90b9beb82ce4cd2a35e97be71f096a7f6d60051da4026ab8e42c0409b0e54b50cd482beb7d", "rh_hash": null, "ssdeep": "3072:2m7DYfm4SRR+NaVEs+k6kiS+94ERR6gR0bRbD:2IoIRRGaVExfd", "type": "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows", "yara": [ { "name": "DITEKSHEN_MALWARE_Win_Nanocore", "meta": { "description": "Detects NanoCore", "author": "ditekSHen", "id": "931b98f6-df2b-538b-bc49-ecbbd24334da", "date": "2020-11-06", "modified": "2024-11-01", "reference": "https://github.com/ditekshen/detection", "source_url": "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7654-L7681", "license_url": "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt", "logic_hash": "6336260e0af2b4b51338ee066f41b7c58aa134a6c03ca110db7e088edf2b65a7", "score": 75, "quality": 75, "tags": "FILE" }, "strings": [ "NanoCore.ClientPlugin", "NanoCore.ClientPluginHost", "IClientData", "IClientNetwork", "IClientDataHost", "IClientLoggingHost", "IClientNetworkHost", "IClientUIHost", "IClientNameObjectCollection", "IClientReadOnlyNameObjectCollection", "ClientPlugin", "get_ClientSettings" ], "addresses": { "x2": 63352, "x3": 63405, "i2": 63340, "i3": 63374, "i5": 63389, "i6": 63431, "i7": 63450, "i8": 63469, "i9": 63483, "i10": 63511, "s1": 63361, "s6": 83874 } }, { "name": "Windows_Trojan_Nanocore_d8c4e3c5", "meta": { "author": "Elastic Security", "id": "d8c4e3c5-8bcc-43d2-9104-fa3774282da5", "fingerprint": "e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4", "creation_date": "2021-06-13", "last_modified": "2021-08-23", "threat_name": "Windows.Trojan.Nanocore", "reference_sample": "b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd", "severity": 100, "arch_context": "x86, arm64", "scan_context": "file, memory", "license": "Elastic License v2", "os": "windows" }, "strings": [ "NanoCore.ClientPluginHost", "NanoCore.ClientPlugin", "get_BuilderSettings", "LogClientException", "IClientLoggingHost" ], "addresses": { "a1": 63405, "a2": 63352, "b1": 83699, "b7": 83554, "b9": 63431 } }, { "name": "Nanocore_RAT_Gen_2", "meta": { "description": "Detetcs the Nanocore RAT", "author": "Florian Roth", "score": 100, "reference": "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/", "date": "2016-04-22", "hash1": "755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050" }, "strings": [ "NanoCore.ClientPluginHost", "IClientNetworkHost" ], "addresses": { "x1": 63405, "x2": 63450 } }, { "name": "NETDLLMicrosoft", "meta": { "author": "malware-lu" }, "strings": [ "{ 00 00 00 00 00 00 00 00 5F 43 6F 72 44 6C 6C 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 00 00 00 FF 25 }" ], "addresses": { "a0": 87502 } }, { "name": "IsPE32", "meta": {}, "strings": [], "addresses": {} }, { "name": "IsNET_DLL", "meta": {}, "strings": [], "addresses": {} }, { "name": "IsDLL", "meta": {}, "strings": [], "addresses": {} }, { "name": "IsConsole", "meta": {}, "strings": [], "addresses": {} } ], "cape_yara": [], "clamav": [], "tlsh": "T134A3490766CD6EAEDABD4638733307C6C328CE425953D6DE28D420659A3A7D33A033D6", "sha3_384": "a9b9993935da4f81da652c08d13476b1a9b1baf3bedb362f5ac175fc33b5fc213b0b5decb98df5aca700b0c7e41e316e", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "pe": { "guest_signers": { "aux_sha1": null, "aux_timestamp": null, "aux_valid": false, "aux_error": true, "aux_error_desc": "No signature found.", "aux_signers": [] }, "digital_signers": [], "imagebase": "0x00400000", "entrypoint": "0x000173f2", "ep_bytes": "ff25002040000000000000000000", "peid_signatures": null, "reported_checksum": "0x00000000", "actual_checksum": "0x00025abf", "osversion": "4.0", "machine_type": "IMAGE_FILE_MACHINE_I386", "pdbpath": null, "imports": { "mscoree": { "dll": "mscoree.dll", "imports": [ { "address": "0x402000", "name": "_CorDllMain" } ] } }, "exported_dll_name": null, "exports": [], "dirents": [ { "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "virtual_address": "0x00017398", "size": "0x00000057" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "virtual_address": "0x0001a000", "size": "0x00002f88" }, { "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "virtual_address": "0x00018000", "size": "0x0000000c" }, { "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_TLS", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IAT", "virtual_address": "0x00002000", "size": "0x00000008" }, { "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "virtual_address": "0x00002008", "size": "0x00000048" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESERVED", "virtual_address": "0x00000000", "size": "0x00000000" } ], "sections": [ { "name": ".text", "raw_address": "0x00000200", "virtual_address": "0x00002000", "virtual_size": "0x000153f8", "size_of_data": "0x00015400", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "6.94" }, { "name": ".reloc", "raw_address": "0x00015600", "virtual_address": "0x00018000", "virtual_size": "0x0000000c", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x42000040", "entropy": "0.10" }, { "name": ".rsrc", "raw_address": "0x00015800", "virtual_address": "0x0001a000", "virtual_size": "0x00002f88", "size_of_data": "0x00003000", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "3.34" } ], "overlay": null, "resources": [ { "name": "RT_ICON", "offset": "0x0001a208", "size": "0x000002e8", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "1.71" }, { "name": "RT_ICON", "offset": "0x0001a4f0", "size": "0x00000128", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "2.08" }, { "name": "RT_ICON", "offset": "0x0001a618", "size": "0x000008a8", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "1.72" }, { "name": "RT_ICON", "offset": "0x0001aec0", "size": "0x00000568", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "1.05" }, { "name": "RT_ICON", "offset": "0x0001b428", "size": "0x00000353", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "4.05" }, { "name": "RT_ICON", "offset": "0x0001b77c", "size": "0x000010a8", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "2.72" }, { "name": "RT_ICON", "offset": "0x0001c824", "size": "0x00000468", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "2.76" }, { "name": "RT_GROUP_ICON", "offset": "0x0001cc8c", "size": "0x00000068", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "2.69" }, { "name": "RT_VERSION", "offset": "0x0001ccf4", "size": "0x00000294", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.30" } ], "versioninfo": [ { "name": "Translation", "value": "0x0000 0x04b0" }, { "name": "FileDescription", "value": " " }, { "name": "FileVersion", "value": "1.0.1.7" }, { "name": "InternalName", "value": "SurveillanceExClientPlugin.dll" }, { "name": "LegalCopyright", "value": " " }, { "name": "OriginalFilename", "value": "SurveillanceExClientPlugin.dll" }, { "name": "ProductVersion", "value": "1.0.1.7" }, { "name": "Assembly Version", "value": "1.0.1.7" } ], "imphash": "dae02f32a21e03ce65412f6e56942daa", "timestamp": "2015-02-22 00:49:49", "icon": "iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAY0lEQVR4nO3XIQ6AMBBE0YH0eGuAcwKmZ1sLCkHRZUj4o9qaeVmzqfT3DJl5OAGjs1ySynWIiFeLa62SPjABAABK+7Cte9fCeZlud/sEAAAAAAAAADvgsY7bddk79gnwMSH2nLDUDvNx5OJLAAAAAElFTkSuQmCC", "icon_hash": "f66c7c86e9ab59ef3f289acd613a3738", "icon_fuzzy": "c3ca946d749a15ad18efd3e5d7b0d8f5", "icon_dhash": "454545d4d4d44503", "imported_dll_count": 1 }, "data": null, "strings": [ "#=qJMk2mm7JzMNLHm_qiokaBg==", "#=qdKcJdwMiOeYxOOef7tprPA==", "FileSystemInfo", "SurveillanceExClientPlugin.dll", "#=qj9ZxzplN98x0cw4vsdTIeAYbm4MuQTx3vvInSGv6TNQ=", "#=qmYO5ZdL8rYBU50vW2vu2vA==", "#=qNvC_NYQ$jxwZUcf0Dch28Q==", "#=q3$2Q8bGYuhwIzDGhDbeVKw==", "Concat", "MatchCollection", "Device", "wgdYBzhSP", "mscoree.dll", "get_Unicode", "DecodeDirectBits", "Environment", "0.0.0.0", "#=qSEueyU62hrm3SqHJ6k683A==", "#=q_DoWG6qBrmNj2sFXhHToddcMKO0wW3x6VUG0Xl$sx6Q=", "_Lambda$__2", "#=qCY4x0Hk1DV3VV540zoAoHq44QCRyxMpq9Z7J0uRDONc=", "AssemblyName", "Handle", "$+8)l", "WriteCoderProperties", "System.Collections", "DnsRecord", "#=qoESbzrXX757aiWupYaS0Fg==", "GetWindowThreadProcessId", "System.Resources", "\\3P0_", "GetProcessById", "set_Value", "#=qLoRN6X6HIt1Xa9meALla1w==", "#=qRLsSPguDZ2WiS_9q1jK0OA==", "feffeeffeefa", "kNumPosStatesBitsEncodingMax", "buffer", "9feffefeefef", "#=qXbC0g0j7eSDHrYXbfI7uUQ==", "numPosStates", "fefeffefefeYa*&+", "#=q1SKypGFVOvRWVSxnayoaZA==", "ffefeeffeefa", "#=qWJ6BottP3sy8x7gEdcb0bA==", "DNSLogging", "`Q[;*", "Int32", "#=qX9Iav0g17FfZrf$Wa_Z$UA==", "MethodBase", "?lg(*%", "#=q1gvzY2QJaRNC2Opj5zvkew==", "#=qQtYdx8zGiMcgHSZRdJY2eNz7X7jeIu77OE$6MbjGdow=", "Operators", "#=qkWsKP7N1mMxiLhNKbBGyYQ==", "OutWindow", "#Blob", "kNumPosStatesEncodingMax", "_CorDllMain", "#=qjuMRqjMOfCBSkBZ$qdWB7gfgShTNiHkLFmJMr9kwm2s=", "dictionarySize", "System.Text.RegularExpressions", "m_IsRepG1Decoders", "AddRange", "m_NumPosStates", "#=qitflJGbE1LvsFZhH2KI8iw==", "m_IsRepG2Decoders", "w,>XG", "FxtdFQ", "#=qLkA5Ktc2Vyv3E0oIB4RaGKVcXXSrFPOpFhegspshwsM=", "#=q3On07nwtezKDVaTvvy7hQw==", "System.Text", "DefaultMemberAttribute", "#=q_lmCRPO7dEMifptlI90PUI6fTs37DVMnLP3Tc_99pO9b_Ar2C6S3QjxXlqu$2$Ji", "Lzma#", "#=qMf1osOFZtYMmK9zzNx40rfvv_YoLwDp8OMEKs9fpung=", "*g!NC'O", "#=qwyZBd1E$zygsKRdrCM1tlg==", "#=qadlAy0ld3tNeu$IcI$2Jq_Arv7ASxtaLzDJHV4HhJlY=", "HideModuleNameAttribute", "_Lambda$__7", "Default", "#=qWmdtsGcuMivbk1JtTASVvg==", "recordList", "o M(d", "outStream", "#=qSseLs6pMe5FoflVo2bRqOQ==", "Wow64SetThreadContext", "rawInputDevices", "ToLower", "IsCharState", "SetDecoderProperties", "Boolean", "8.0.0.0", "q<+-T5", "#=qur7j1M5vHkSPasucOkbcNw==", "J{4!jpH", "Order", "SendMessage", "#=qBcPm_drbp7ocdEoXBCg55Q==", "pAB|\"", "Matches", "#=qbVZ2VGZYhcslyt7WOHvByg==", "#=qZrBp2zQvnJP1R2KqzmmR8A==", "#=qt5WsljHA_z4lWKJJiNRSEGCnAbuC8NDsfhiN_p8Vhq4=", "System.Security", "Resources.resources", "Exception", "td8V/", "Sleep", "#=q$eByR1alsjlxVI5xhSAtpg==", "#=qUvNuZD70A1m1h5rP8mt7hxHu6e1_lErn05OLHflfW_U=", "#=qMxv2Vlcc2Tp8j_uByDYyGJMxccShzf3B6SeYq7g7Daw=", "TimeSpan", "DecodeWithMatchByte", "Tc#Cf", "#=q0$8sFvWAj3Q5z0kt5$qL1A==", "GetString", "#=q2gdZtLtmxCrF2SEuXdll9g==", "#GUID", "#=qy7SdMitZjkIreiUV191vv9ssNSzMPuW8jMow5TTkIUU=", "AssemblyDescriptionAttribute", "afeffeeffefe", "#=qG_YyprUv4EKXjeIN$dVZHA==", "#=qlAdkkonfdPbm4KDS2op$vaZdX8byjv$LxAv$dtNhCYM=", "#=qiuuc1hm1qoPzINMXy6yo6g==", "_Lambda$__10", "Flush", "get_UserName", "#=qf$JSULqR8FwRBjD8O35M78CMWrW22oajqxT6WI8BsvY=", "#=qpQA5HetEkOqW8wCwEjKRvA==", "GetBytes", "& v5n4T", "#=qjPdKXesXFUYK$lTAuWfj4g==", "#=qZ8jdBbqDQs5U27LEbuhkeA==", "#=q2oxbm0Yzi5XQVj1QkCC71A==", "VUyP`\"", "StandardModuleAttribute", "#=qwJ4w0jkRVthW3ex8w5dly$cWay1Am4JSh9ZTwaXqcz4=", "kNumPosModels", "#=qFIAR8B1f$tNJs2xhTgINCnRaZkcxVSBxxXtjUtb7Whs=", "#=qMwDyeKYTOkSPK81Bwd7OY2mUhsDwOc5zugQnqg1ZfW0=", "#=qc3C7cwFHdA0fP9ewBftW90qaZ7YCZNSkeDx2JbA$rIM=", "GetLogs", "GetTypeFromHandle", "Split", "@3n'pA", "!FI};", "#=qr03MMh5pLoqsU2EEvN6ch6Tr7EGrL5c9eR_71qVrp$c=", ",{Uu\"p", "#=qxns0sTKVsgArVmXl3cFChFnM3Jv6Np_VftoasierUvg=", "get_Current", "#=qApHfpHzdRAuqPbkbKAzJmptqQgc7NLQ6T4N$H6aQHdw=", "4System.Web.Services.Protocols.SoapHttpClientProtocol", "FileMode", "#=qzx697Szk1moqO$yUynaioQ==", "#=qryghDdZnHsy$RagUj_T5aw==", "#=q3$4$aeeKw0G6KJpmbsHtCSC3$LdCNMfTzWNTjLVfIoU=", "System.Configuration", "$a58de1a4-5da5-48e4-8e57-197cc7b39b9b", "#=qT03bmh7uoc7QIggZX8722i59yRaiKXEb45q$FKk2uZY=", "GetForegroundWindow", "#=qfvCuRNoH9u00SSFFCvqZfg==", "Enumerator", "_Lambda$__1", "rangeDecoder", "#=qIxjnZll5GhllBN9b$ufZ3w==", "PasswordCommand", "Process", "#=qBvMiXP1hJ6VKxap1MxE0TUe8TQ47t0bgRFkWT_2Ymyk=", "#=q5sfq13B7vXg052uxfqu39g==", "CoderPropID", "]DB?w", "m_Decoders", "handle", "#=qBFvoYJt20gtsoLlWjU7jDuRfeDDIa87upzYCldwrNpI=", "headerSize", "GetLenToPosState", "lR7YPL", "#=qsV5K_71ZHH78FtoiXhsOYTV_Csv1aAdiiSCpj2X2l6o=", "#=qgHfmPA2gNKnydwzqeSF_2nVCUjp4Sfb3eJfQd$j975A=", "GetKeyboardLayout", "progress", "Microsoft.VisualBasic.CompilerServices", "prevByte", "ResolveEventHandler", "KeyboardCommand", "#=qt4h6_$cdnIG2g3BjEtlC9w==", "#=qZL$T$hC424exz5$sUQkm7w==", "#=qgC0tfaC3XL8FoOE$$1EOPjdVRTBNXr2NN6qMTkS_iSk=", "op_Equality", "PtrToStructure", "#=qmj_W3318X7UXjXz1JgFDnA==", "dnsapi.dll", "System", "CultureInfo", "#=qK8YSOZHQFwZhkU76$yIGwZGiGsr64hyFLs_9C0C9am4=", "#=qAQlIVHekXJrJwpDPrher5Q==", "_[&_C", "RawInputDevice", "#=qVa4dlGgXioIeYYgbx3$NvQ==", "~kItE", "m_DictionarySize", "DecodeNormal", "pvKSg&", "#=qPQ2EtheKurZp3OCkjzyyfQ==", "#=qCOMF0I9Fd3HxgGmFBDkurw==", "nextHandle", "#=qXtiqGLzJVH3aswCtlNNiug==", "MyGroupCollectionAttribute", "#=qrfNBcNMYeC4rLqwqMcn1jQ==", "CreateProcess", "#=qqLHT7hLUa1CKAG8LwjstJ5pArtyKEnkhPdyr1iCpbvQ=", "#=qU1ta1c$LOdIR6a7j6Rj67A==", "Group", "#=qKm6o1ledVqdR1Rw65bjQpA==", "MatchFinder", "ToByte", "#=qmHLlS2qqUAdmPyMYO7MoCg==", "UpdateChar", "#=q9kl5SZeUeIanHPXqH8Byvg==", "#=qg8F7l$fE22BW2JsfOcHpQA==", "Close", "#=qLt1igOtnjDbO40cq0340qg==", "#=qq9v5LklzRMUWeC0fX17u2w==", "7bocd", "#=q7SFZv3_X1jh__i0qS$yTrM3aMBoo7MMGOOAa9ltriPA=", "get_UTF8", "yz)X:", ",aNu^", "System.ComponentModel", "PADPADP", "SuppressUnmanagedCodeSecurityAttribute", "#=qqH0HzK5dpalJBOwa$wm3qg==", "ToString", "#=qyyoWizFgb3s$leRoJx8tVA6$nX314Se8B3eVLLvmYmg=", "#=qD_tmohqZXqQNhfRrQTYMfA==", "wwwwwwwwwwwwww", "`.reloc", "kNumMidLenBits", "#=qPS5ww9Qh4Qg1KnC9SiWQMg==", "LegalCopyright", "#=qgfJt9ZkqNp_s2eN$EF8lRoKBGN4LufTLNE1dmIBIf28=", "CompareString", "w,koK", "#=qykGtg3M9D9MTgOzaJO5xlg==", "(P~GY6*", "w,,p\\Rn", "#=qlZpTa_5oxuNhvwPl6FFKJg==", "#=qSq5zYE9oYXENFbc3V2Pe6w==", "kNumMoveBits", "_cX*n", "CompilerGeneratedAttribute", "#=qajec5milwVsqpbQNJ3pdAg==", "#=qE9U$URsu_c0Ig08qpeApRw==", "#=qxNAiPpjp2npMNB0TDaEubA==", "Equals", "#=qJuchJ7XfDSJXhX78ouEvSDi2Fm4IZfphEm1lxVR84W8=", "Extra", "#=qtdpI8mE0PC7HKAm0rggvhIxya1OU5XWEFr8n2AbzdwE=", "#=qbDWEs19y0rXNZJloHjyEAXFFSfYqbb6nrn10YnV15GU=", "inputBytes", "#=qyM4k7EGb5X12gk8YOkeNSQ==", "#=qkQ6DX9hRr8CpN4pCprp8dKTu5XpWEUA3fFuODRBQebM=", "SendTools", "#=q$ga0JQ2t4Nzt317dL7s1HA==", "#=qFiQXtwwrpPrf6i6Nohe$2A==", "#=qizSuKVUZWi22rIa8Z61Irg==", "ContextValue`1", "SetValue", "ResumeThread", "#=q6Yv$G4eHDn8gxVVQ7jH00Q==", "#=qaeAZ85IK9icf1hoO$eIUgQ==", "#=qTm4mE2BvwyQu9opBPZoYvABEXk1NdIbQ5LncPq_d5OQ=", "ApplicationLogging", "SetLiteralProperties", "#=qaGMznr3c$ok6TsLDKsBgpA==", "#=qsWLw4NosPP1gi5wOWkKQoz05m2lejq$6CuB$iOBB3AI=", "#=qGgwwpS30yt7z7wmA5NNa3g==", "_Lambda$__8", "#=qHJ9pmoIz378G1x0B31eH2CidaiOdV6DLfrtp1WQ35Q0=", "&&+%}!", "ReadChar", "4qiu%", "#=qNkF4$24brNGyMOYlUQj393pFEgGc7yicoZSTjZc2U_k=", "#=qt6bzCtEoNTvCkJX9j_4kZA==", "get_LParam", "#=qBTBFzfYdUs1kd$sDfT5Epz4Tl8141_7UIrCZjDszn5Q=", "v2.0.50727", "BlockCopy", "#Strings", "System.Collections.Generic", "#=q93VKpOIqdRN9spJigbfgrQ==", "#=q55q3lEdynyzHRQ573ELk9w==", "Ag<@+[", "#=qkz0tRkb9CLbnp8T0rNs8bD38RdjxjzMZ5i$ZzJHTh88=", "#=qquAKrvKQMWW7XtSurdlOiBConuNVZHvcIKParMXA0xo=", "#=qKdosTQrPrTm1tOzWi7_fuA==", "#=qfcadZftcNHMdcc$N_OWH5w==", "inStream", "ConnectionFailed", "Ru0=?+", "#=qTHk4ibx53ALvuTHC2wskqA==", "NtUnmapViewOfSection", "Replace", "windowSize", "set_Item", "!This program cannot be run in DOS mode.", "EmailClient", "get_Handle", "get_Msg", "GetTempPath", "#=qnWasDZNfCexjVbIXlOnpIw==", "ToInt32", "EndOfStreamException", "Compression.RangeCoder", "k,(|T", "#=qQJH4ux8HloTlAflsU0KOQw==", "_Lambda$__6", "DeleteLogs", "m_HighCoder", "RuntimeMethodHandle", "m_IsRepDecoders", "#=qSNORDi2PZ1IaS6Ix8w2Ovw==", "DirectoryInfo", "BuildingHostCache", "#=qsKOmOA5TX7dlM04qtgpOst$qgth3kf9KZZgdjC8x01c=", "Buffer", "#=qqj_P$pMjCtq2aNcNj2bfvufyGKfRlrOOaFr$XqaDVXU=", "#=qPiY_FtDE2jSdy0HqtmetjQ==", "#=qb3mKZgoJuDEsFa1T9bEUEXgvprlgegmeeniWKKiLI3E=", "value__", "#=qoqavODXRVVim6fghcoKuUg==", "GetValue", "#=qxTs7FlUCrQFGhk1vAwkrww==", "_stream", "m_PosMask", "#=q$lT2sqOctP5oFLjWBJEQs0BRL9aPnJgXluSQmhlzNCo=", "#=q4Jhplum5EMsDzltMg_L_tgoPjr8zzldX6k5uL$T8QHU=", "#=qJmGC3VRVk1ET7LjbQuMLjv1DeKxnDw1Daxs6uZ9$FGs=", "RuntimeCompatibilityAttribute", "h[S:<", "Download", "keyState", "numPrevBits", "SuppressIldasmAttribute", "CommandType", "CompilationRelaxationsAttribute", "fefeffeefXa*&+", "#=qzmbTPkKexQ8AS0E1MhJt4_A4SKpUh8ZeSD1Jy_XS9eM=", "ffefeeffe", "#=qTvTlfv6UWF8IdF6Zqmb35eNfTGusCMVLLnh6QIr8tfc=", "ffefeefeffe", "#=qr0WxpkU89pDBkkfgDoLSTA==", "#=qAtoFurjRifVD18ho1R1Dg_WU5nSHW_qH7pBxN8aFTXc=", "get_Count", "GetFrame", "@pd/\\", "#=qTSHkb7KjuVyqS$aEfJJbZSroTPY6PUlDcdx_paGstVs=", "J$xgm", "feffeefefa", "4.0.0.0", "properties", "#=qA_ED7VJLXZPPKs12VIDWHSI60qb9KWEC_8LLPE2krW0=", "#=qxwLQaLG4uRX$LJGVfSKAwQ==", "CreateInstance", "feffefefeY", "MultiThread", "message", "ProjectData", "count", "posState", "#=qv7_G63PaFeyDwnDCC1g_2ru4l8PEzEzyOErEaKVPipg=", "#=qHhkScXruXZT5J3Z7jSiQgw==", "Compression.LZMA", "kBitModelTotal", "UInt32", "#=q9Faq5VxEeRCgWA$Fv2CQA2jL$TcgdmVDlxlkstaRIog=", "_Lambda$__9", "!z4V0?U", "MoveNext", "Monitor", "MySettings", "#=q4$epyV0nlPzbnzRsMLPu97OYyrwjvDZ_OdEY8a656zU=", "ValueType", "Round", "#=qIkSGT4qbCtcFRC7mMAAYkk84I1ZFkrYif3TMjD7ZPA6BOJlmCB8mpgUoVIHLwXka", "System.Windows.Forms", "ResolveEventArgs", "ApplicationSettingsBase", "#=qczls24TWLmlr2uaF9Rt2wA==", "#=q29P5wT0RtOGJtLYYrVuOyQJYKodBvb_Va_4aXFXskAY=", "NextRecord", "JpWt*i*", "Delegate", "inSize", "&&*}R", "~B)^VO$", "#=qm6zrH0rCSTx0zj182i8NBQ==", "#=qZov5VwasIgllCy$iPN3DNw==", "#=q7rWPYdgZxY0QTmTQR2fgkA==", "user32.dll", "iiyAt", "b`*&+", "}uS(zOQ", "Assembly", "#=qoKX_5NDx$uDAqG3r2Qdnaw==", "GetThreadContext", "#=qWToN2VSuMj$dJ8jwWVWiOw==", "m_Choice2", "UInt64", "#=qxBa98CfPwuO0cLdTtVr3UZ7sHS6clgMQTcxeOGfq1S8n3UU_wXWw5dLM3IIxjN4D", "12.0.0.0", "#=qCourOFK6$KSegqeVRJ$n6Q==", "Stream", "T{K+d", "NanoCore.ClientPlugin", "#=q1WnXnf5Kn3oZdelfZ9atXg==", "IClientDataHost", "System.Reflection", "get_BuilderSettings", "_Lambda$__3", "#=qufNwmAe7HQFIL14z99jHZDphg_1JvBp18S4ZB_HYCGk=", "#=qG3u5K_RNSi5MmPk5qGfBKA==", "#=qJOuiYi3iPZ3uVqoeKGMDrA==", "ObjectFlowControl", "#=qyEh7zio04YwNJbA3DRAL$w==", "LT/a%u:", "#=qbnS0OHMEgVPpx0TYW6jRag==", "#=q8gDcBSsTQnbm3KE02hl7OA==", "&&+Y}C", "ISetCoderProperties", "lParam", "get_Name", "SetPosBitsProperties", "#=qBC03ja1g7$0w$eh2jRxaQNyDuxwUf4rZ75JN5N$kch8=", "m_IsRep0LongDecoders", "#=qtR8C6BNO$zdw_O10qjEjJt6JYi$bG2X1MWCDgpSA5qI=", "Create", "RuntimeTypeHandle", "#=qLIG6VCTYxG1r34UESHGfO1ahvp9wHKfNE5aXgNksRVfBCY8bC6m10KiOo8KoXWAp", "SeekOrigin", "WrapNonExceptionThrows", "bufferSize", "get_TotalMinutes", "#=qX35LozMOnZ3iEnR45ploWg==", "HB:9/", "DebuggerStepThroughAttribute", "#=qcxNEmoaEf7Zh660RKW2dVQ==", "#=qlvbeh6Dpr600MHBhM5FM6w==", "EditorBrowsableState", "#=qvSf5MwzG8n0SP5HzSY2_SA==", "MA1O@", "Int64", "#=qatkJDnqMuS21CiNfog8F1qvM$VR71IK88NPDErK$cCY=", "DestroyHandle", "processId", "Microsoft.VisualBasic.MyServices.Internal", "#=qOGgnVTQ4xQCpfQDFVMvxDA==", "aqhgV\"", "System.CodeDom.Compiler", "System.Globalization", "#=q9xDVujoZXiSgiL5U3Ms$Ldw_aEku$YcJRTx_3Mn7bUU=", "VirtualAllocEx", "#=qWOxGbcFRgf83Lr2nIvLxMhjnXfcYgGMTYJ7wrFJ4zpU=", "get_ClientSettings", "removeHandle", "IntPtr", "Double", "#=quC7pb_XLQy2zPy$IHptd3gII7RxTbEmajVwI2QM2uDw=", "#=qWAKUq9CUhmQBqBddF0P5WA==", "#=qTVgha2c6EXq6oFogWKkJ$Q==", "kStartPosModelIndex", "IEnumerator", "#=qjfIm1PIGR6WF2vcep8flyA==", "_streamPos", "Timer", "#=qULF9QYOA4w2wDOoaAUQxV_zVQ8z$1R9w4sOnYqGnVZM=", "Assembly Version", "5Hyt)", "#=qYZPuHqYnW$Jt8HuO33EgZYVEW2BLvhWvH6HqYkna1vM=", "SendToServer", "#=qHs51RKHMwfV41Mwh991L9yGwclD4RD8GoEI6P7yiHCQ=", "SurveillanceExClientPlugin", "KeyValuePair`2", "#=qGlAaJxWXqCLviqDPasqF_1pEmmsHiVpOlHTQMftJNnM=", "LenDecoder", "#=qEwOBNFc9PVbJeL2o1SylSw==", "Clear", "#=q9d$pwaibXpl6EYmDW3LQyA==", "m_Choice", "#=qYczMyu4Q4ODpJ8_8yaxacw==", "#=qyM8Yaoy9PKeQBcWclAVdrdWwWFIiXRRFb3afnMytprg=", "m_MidCoder", "WndProc", "m_LowCoder", "#=q0sFoUO5oar9qfDXWiIsjK8QBKipcWLJeZEeGAn3jKTY=", "#=qoSjdpFhHgKw4ZkLE7HcUsA==", "#=q_0ryHl9Z3pX6cTMt2fN0mgWhGzumbPaq9sRkBsl9r8EcjEOO0EVuY7FHYqQczjcm", "IDATx", "ntdll.dll", "InternalName", "EKL={", "#=qXt41o0joH7oimdyJLyAEgb0$SgCvft18unPo3p7oDZ4=", "#=qErALxYBxbcQx7$wpILZasQ==", "GetExecutingAssembly", "#=qWLNfsz9$tdJq5W5eUmCK3g==", "Decode", "Usage", "kNumLitPosStatesBitsEncodingMax", "#=qniVQeVyK34aPdgdXRnruaUQrXw0DTGkycv51vldfdvs=", "_Lambda$__5", "State", "LiteralDecoder", "ffefeeffe(q", "mFLGG", "MulticastDelegate", "ClientPlugin", "title", "ComVisibleAttribute", "LayoutKind", "w,D.F ", "\\eRsH~&()", "SQnYq", "m_PosDecoders", "EditorBrowsableAttribute", "ReleaseStream", "#=q6edtgiaCLUi7SoZ61U8urA==", "_buffer", "b`h*&+", "#=qWOXTw_dLcjSXp$GN$pp5S1OPD7ZPz6$b2UbsKnONIhg=", "GetText", "solid", "kNumLowLenBits", "ICoder", "DebuggerHiddenAttribute", "ConnectionStateChanged", "#=q8DCG8ySziWq86pz6M2Nm1Q==", "#=qqUu6BRNscFAOfPTSzNJT1w==", "#=qqq0n2rS1_M7ChN0lsGOjWw==", "Window", "get_TotalSeconds", "&&*}5", "#=qWtdqJYyYX8j6Z3apMuSRyQY12glbN$YmR9vdImzaIBw=", "#=qG4$BfgVthjPwAu6cOeCEdA==", "#=qOkM4_GL6iJytfvW8X1Vv0JdORs6j60y4sZk64fltjPs=", "scanCode", "#=qH37BJRRVPDZdt_HquyjQCGhaKFyNxp4uozln_BmzbFU=", "ffefefeeffe", "NumPasses", "#=qaiFlnK6gufs9y1Oc4GuIMH251NlpwpnIGxTExPappTg=", "Di'8f#", "#=qjGf0Fo7ouDsRFksxehS1LLJzkD032TzIZQYMCq6zXPU=", "kNumLenSymbols", "#=qxNhCtLFT$uaHlRVrjNRfgQ==", "#=qNOZ9w$DcFPd9SOpnZgS0RQ==", "#=q9d0qL0bhhHsukDDuSglJm4WCBbjzHE0Bbid8Pr0XWh0=", "MyTemplate", "ArgumentOutOfRangeException", "#=qV79mcqV34cKRcC07zX3EAg==", "#=qgf2HF0U91g7Z5r3b_DTKKen95XyoRNKhJT0tZAdh0qE=", "GetName", "ClearProjectError", "#=qBXqRL3Dv9U6yo_YJzVNueLigr3DbGSqr8_$nTSKtZ2s=", "StackTrace", "outSize", "#=qPvYrleetOagqdcI9DE5KLx58LE24Y4CctC7$504MDk4=", "#=qkt_liXOxhoHW1IdbL3VH8w==", "#=qh9ajRGk2_65Q3Jd9wgongg==", "['c*a", "ClientSettingChanged", "ThreadPool", "threadId", "ffefeeffeXa", "#=qt3y2qSp0dv0vJPWjVw3zrUaK5pF8MkrfIOVi6473g$4=", "RuntimeEnvironment", "#=qr01FMUeoBCjkEqS0Tv6eBA==", "ViewLogs", "#=qc7jxesQacILbzixeNG7FgVPmFPAfjvpvdnuAU2yopkw=", "#=qTDB6veXFhv3LJZPZLsXjAA==", "'b(?P", "StartsWith", "System.IO", "lS]@\\", "#=qa5bWbwMs799DVwO6Xd1rN3bJzFHKr4_gzkvb0x1jS4Fq$eNnm1UXtsC$gMpO485Q", "#=qynZM5QfSMAmkvPfv_N252H9sirBUdDlLNsjX68Ie$iw=", "-b&(f", "[@'s8", "StringBuilder", "get_FullName", "get_LastWriteTime", "#=qnsLPayfk95jd6qjcEgWvsg==", "#=qkJLhjNBL62x0Maq56Qyxvg==", "Regex", "GetFiles", "Invoke", "qL88<", "nC=\"kO", "#=qISpXJwqB9eU0aC9WFSg0Ng==", "ReadInt32", "ep&L2lT", "@o$?H{", "Remove", "#=qsbY2J0lq2mDKdHpdoqFbhILxgHjBTI3htQgLDLlw4tw=", "DateTimeKind", "#=qy62TL0vimm$9c8r9cknBlg==", "#=q7yeIS$Nxs6vRTxwkrC3NI7XBjBtanYpAY7F6lpVJMNs=", "get_WParam", "o3K=M", "#=q9MSpJ0C9gy1tNtiHMT0xuOhK0eh3XkuUCIUdV0CL_Vc=", "feffeeffefe", "#=qDryb$Lj81YuexT_kT546UteX3jn1a5MWE58jzYBzqzA=", "kNumAlignBits", "m_IsMatchDecoders", "vD|Jy", "get_DeclaringType", "#=q5LicbGLyNvYH7rAg86LLew==", "#=qd8PFK0o9ZmfLuRvVs5TueBqBiNJMAYg6mfAY7qPvztw=", "#=qILpIzHL2R4oZr_xuJ35Ks0Qv8efeDFq9$IysEjhmwb8=", "#=qXwgB3iQRF3f74mr47OcIXA==", "Format", "#=qbaeFrXHqfUmKDWhl$m1oW1YJ6aPS$T3nwSKQdfykURs=", "IClientUIHost", "K.^^0d", "Pd5iG", "#>6Mzf", "#=qbt21$tSdKp3amqFUQffN4g==", "#=qmAOt84hQOfmqpLQTy_m9Gw==", "MakeCode", "get_Chars", "w,uNm", "#=qJLhNEnVZH5g1ZqJMJz$RzYGuUiBvJ7jvAqqxd1jmI9w=", "SetThreadContext", "fefeffefefe", "#=qoOW0Qs7uLOIFAgZnF5WYag==", "IClientNetworkHost", "get_TickCount", "KeyboardType", "AssemblyCompanyAttribute", "ResourceManager", "_Lambda$__4", "RawInputHeader", "fefeffeefY", "#=qfGRrfgRh9ShPgCgw1WBGlA==", "UsagePage", "#=q8kI8WUAO3EIwh$dDbLO4hBJVnsPN1Kf$8oLzDKgLItY=", "GetEnumerator", "m_PosStateMask", "GetPublicKeyToken", "defaultInstance", "Dispose__Instance__", "kNumPosStatesBitsMax", "y/Tbb3", "#=quNCOqLbHCNvjlAK7Bf3cDbhyHY_4LIdtbLCWmQ_qI5Y=", "#=qcoWy4j$hfMjQGUjg7sMLcA==", "#=qqAcSxqYR8KvfnXGv78vSLpHnokxYmR2kdhuhJW9_ry8=", "#=qamafmS78hoJBlTvbicCkog==", "#=qFFTan1UEcEUWGr2OOrOYjJGYp4rAAjZjzwTWUS0rVrw=", "#=qph0dM8ScBo399Qc8dFf7SlZHZ5$T9MiuQgUb1gNxX6w=", "#=qafWoeWm0EJ5rJHlvMm4iDkNn$EYGciEBRwJDLt7$nbQ=", "#=qVJN_4jIyRrZ5yAy$Rn5RLinbGCq7szN2kXQqx5f3mq0=", "ReadAllText", "tuerl", "ToArray", "#=qbXdnCoLjynzf7IU_sWtIxQ==", "get_CurrentDomain", "FileAccess", "#=qnkToepswNMS8gbnXEvMwzMYEEKNiPU5uDsX9dRhrWNQ=", "m_Coders", "get_Default", "get_IsAbsoluteUri", "LitPosBits", "4#Q22", "Empty", "#=q6PBQzT2s0OXAPNX0HyA9nA==", "get_MetadataToken", "GetCallingAssembly", "ReadPacket", "#=qB_ief8yBaOrLHFWAY1qqaBDkGFE5diWAXZyimYvjzkY=", "MapVirtualKeyEx", "GetWindowText", "BU2l$", "#=qrrF6$_dvEtwtuQKnJBulHA==", "#=q$SxR33u2B2QKyvTy6OUx3VUEnsU1BBIwrFbNm_dTmvc=", "#=qQ0_U51a7sN5obfKsBtIlCA==", "Int16", "WaitCallback", "LogToServer", "#=qjw6ERKjxRJyhmlKKhTbkm3qZjjnDTqlES7REqNxqUOg=", "get_Item", "UInt16", "#=qyGd52xKGg1UK99QpoNpdz9dSKN3tgIE6mEvh5axkN4DdSC0KoH7ndNvZZfDKjIAY", "Mz&?8", "ffeeffefeef", "#=qy7iFFOCv78505n$_BrNPxRrFO5LEklS7ID6JkyE1sJ0=", "wParam", "maxLength", "fefefeffe_-", "get_Now", "kernel32.dll", "kEndPosModelIndex", "#=qBUViwm1Wzov4U2EcqfWHEYm9yRhCdBkuxxjXALmkpzo=", "#=qVSN1Lpi9mDmMGgmaAHvebQ==", "get_Size", "get_Variables", "pI,4711", "AssemblyTitleAttribute", "#=qhXmGn2CELzUWoG0JCIbI4w==", "#=qUto48Jl62GtgsCwHVL7Hgg==", "Delete", "Dictionary`2", "#=q0XvCVIzf4UbwwbesII8AcyVgrM$fv_y6$FjnV7yW05Q=", "IJxFC", "-H%a=", "get_BaseStream", "#=qkyQiUlPlMKotWknoHqlomhKQpOjgRch0EcZ31P06MMc=", "Dispose", "4UH@9JE", "B.rsrc", "matchByte", "TimerCallback", "fefeffeeffe", "MYkv[", "#=qjTb0yKP0PvX_$sNLZrWc3SrhKi2B8TapGYB0qQ_d2ic=", "NumFastBytes", "#=q2ps$7ibfUjB8cShObHpkOw==", "GetRawInputData", "GeneratedCodeAttribute", "#=qGbx9gQEhahxfxQgVR1WKYA==", "kNumLitContextBitsMax", "#=q1E8O4JTltplIX9hIlv2U_fvNRBdciVrREW4_qwWnAG8=", "#=qrGwSUb5xTQIFyn575GZnPg==", "#=qeRlDn71ka07USXFfJJUR2tjdNrp$C8rMYT7zAiVKaFY=", "#=qho_BPlTxogZ6unjnM3aUEA==", "qKsP&", "#=qjnoznhVPIrOVW7AdFC20oQRiO8PwCQlyil8yL1Vu$kM=", "KeyboardLogging", "u[AF7NM", "#=qO6x5ewjr4GGgRnaDV90ZlA==", "DnsGetCacheDataTable", "GetByte", "#=qXaCFAlCJk0zL$1TRW78z2TZB6TE_kmNEDibtTaGwApE=", "op_Subtraction", "de!#%d", "#=qMUhpaeAQYPZGtrQ6m5D8$T6a5UohdjKBly_QCCrNbic=", "#=qYf8VVQYyVIBbHqbd$XL$cA==", "Decompress", "\"zD_2", "qHF>7K", "#=qyJGUlE1_rLpfgGH0HVA4uA==", "#=qzk3NeGOwuEBmY8yfhx9RGeCtT3ElsluQSWlGax0FSTg=", "layout", "#=q463flxIG4yBvVk$L2nY$rA==", "#=qkArXx5faq_yiVVDZVy8zPg==", "#=qh0PZD5Xzw4GYzrxwVJgNXdBLljub_GVfhqf6qMZuuOM=", "#=q_kf6X0FJYJ49vkYU3o4hF4ABiUFCz_wIANIlPo9Wtqg=", "#=qZDfXudm0$xsDWCHGELpd5JJQykxvZE2iCT02xHzYWZs=", "BinaryWriter", "#=qm8f9k1aXVtORA4naJCkxW5anSegBcHo_NtygLkyg$zI=", "#=q4w8mBBo92N6vPz_rEq4NCg==", "feffefeefef", "#=qGqoN6NYMG6qhAx_trPC_ossyh4syAKivlJ4ofRtY1Bc=", "ICodeProgress", "String", "#=qU5Uv$YfWv4YU_tU0WnuWRQ==", "#=qm6w5$AGhTmDiKS6fDc_8lQ==", "kTopValue", "Append", "numBitLevels", "#=qwRLyHsQEgr3hVfF8nnZ7KA==", "#=qia6Q_CLWGyNlq5m_x$gzsg==", "get_Host", "Yaa*&+", "Range", "#=qUByjqwT1e89jxnX_MQXMWbKNidprz_QzC__AUDqY7Uc=", "#=qt8g2vpq5xuzYmHVNoc4aRQ==", "#=q5B2i_ZFG$fkyLcTMcIhd9w==", "QueueUserWorkItem", "GetObjectValue", "#=qhketRNLRWT8CVAmblf0IwOvCoFFzVqRP3cb74HV_KhA=", "ChangeExtension", "#=qmhUzkJg2ExNnbX_5KEDmiQ==", "#=q4XS3XWwqg0cYnVCF1ZC2NbwZSfEBY5biSs$73sq9_qY=", "kNumFullDistances", "#=q_EpKD6Wcn8v1q27F7Au3V2_q9nsNwbRHldZOuKkGS9M=", "GetRandomFileName", "&&*}8", "#=q5g$eC0ljHvRuQ5Sjg8qhXD5ifXDj39Cm6o39Y5BwaAc=", "#=qLpgJeYVNxM5InVOGfQCJgQGoJXhVBZL78RSpTucm8vM=", "", "#=qR6XN5QQYUNdzcxSpOeojXw==", "#=qRkVCQkwYopuW3FhsOB8R7Q==", "distance", "X!RF,", "V\\CDo", "#=q79jR0bJe_Ob_U2hce_Wy2KY4qSDCR$4x41oNq35cm3Y=", "#=qay1xmyx9Oqat62Q8L3hW8g==", "ContainsKey", "GetState", "#=qGvdgcYjJPldjZjV15YO1AQ==", "ContainsText", "#=qKkT5k_oMJ5jlOboYqGKerA==", "System.Diagnostics", "Marshal", "IClientNameObjectCollection", "SetProgress", "kNumStates", "#=qZDaMo8z4aSDSIJR8FYpOIWr2QgacQNuQzvtxGLdfriI=", "#=qE$fiW9I$YR8wzvprmP6GMg==", "IEnumerable`1", "ReadProcessMemory", "numPosBits", "#=qZVAY6xaoFDtd779Ohye_i7puUwiqn0vUdRn2mygGXjk=", ".ctor", "SetProjectError", "\"!&%'%8797:7;7", "#=q6cFrjMmsBzZaHdwkK64MvIJCVps43s79Zoc5jAQQ3B0=", "UpdateRep", "LogClientException", "rawInput", "DebuggerNonUserCodeAttribute", "#=qTmPD_08CamgMljHM9Dk1O8BoSybsXHEUiOmZnlrjslQ=", "#=qncI$$cNGF5Pots4RoA2KEQ==", "InternetBrowser", "StringReader", "AddDays", "ReferenceEquals", "GroupCollection", " :hu'a", "CLSCompliantAttribute", "virtualKey", "get_Groups", "Reserved", "1(:>/", "#=q3i4wls3IHcjOio705aCSHg==", "DataLength", "AsyncCallback", "#=qiw21QRsOuXRsr0EoFXe6yg==", "", "StructLayoutAttribute", "UriKind", "#=qbb8M4CbvbU9dtw7rljxsOgowhtC_M0HHHYDQvfbewMA=", "!:6=?J", "SizeOf", "Conversions", "numTotalBits", "Synchronized", "%B!eu", "StackFrame", "RegisterRawInputDevices", "FileVersion", "Decoder2", "ClientInvokeDelegate", "get_Key", "CreateHandle", "m_IsRepG0Decoders", "BitTreeDecoder", "CheckForSyncLockOnValueType", "IClientNetwork", "#=q4Nr8w$2KKfb5UztnulwYRg==", "kDicLogSizeMin", "PipeCreated", "Intern", "`.rsrc", "AssemblyFileVersionAttribute", "System.Threading", "ffefeeffea", "UpdateMatch", "Encoding", "IsNullOrEmpty", "#=qkmhFErk5YMKo51GKKlhE9g==", "StringFileInfo", "m_NumPrevBits", "LitContextBits", "Write", "GetRecords", "#=qrs1kHm2Vk1lgdS_uku1L9g==", "#=qMJgjQNh1HDTnQhoJXfa0WA==", "ReverseDecode", "AssemblyProductAttribute", "#=qPRgfS7lOTcyHKSlbB8xgkA==", "Microsoft.VisualBasic", "AppDomain", "#=qT1akwluU_CPHm0nhoKf6Rw==", "#=qfisk2$Joqzyumzd6fh2dOQ==", "get_Length", "#=qvfRcdVwrMsCxkiqADFMhLstfJFNrXezVOSkR7LYl6_c=", ".(\\iF", "#=qhY91O0Ehtf92oxnuh2FVz3zwgJyjBwDokEEXjvLvO6Q=", "feffefefefehah", "Win32", "z0v{1*", "#=qvvwoAYTFwjESTUFg0fNF7SLde7qYhx8qSoPZyr3HMfc=", "Contains", "BinaryReader", "ToInt16", "L269a", "VariableChanged", ",?eg!", "#=qQqcsGt5b2PDsslTZJ$dt_mKNdeXa0POgZBx5R0LjlPM=", "#=qw9VSFm68B5Ljl$xHUUa_Hw==", "get_Assembly", "FileInfo", "#=qbbS2gH77jp8FUp6F13JpY6MGDSb9v3gnCOBNgbF7cVA=", "GetHashCode", "kAlignTableSize", "m_OutWindow", "m_DictionarySizeCheck", "#=qpQr3Y9fGkwa$qRqPoCizPZ9VR0dem4a4NMuT_i6c3sQ=", "#=qUZFlYoOocheA6eC84I2B1Q==", "MemoryStream", "3System.Resources.Tools.StronglyTypedResourceBuilder", "#=q7_TpaeFTuHRPDnfbdnzhMw==", "IsControl", "SettingsBase", "Change", "#=qXH69A$_8u_BEH$6TuzFn6w==", "m_RepLenDecoder", "#=q5kTowhAuuSOCKCKI6_gw5Q==", "Activator", "#=qrrUz6hC0NPP229srrATMtK3maxNKi2E6oaUoFmACl9I=", "DnsCommand", "wisxa", "GetKeyboardState", "Flags", "#=qVmsOOzNjkaQuSyIKz50umg==", "OriginalFilename", "BitDecoder", "#=qeZCoccI3yJdWJ3ayrHW$WA==", "kNumLenToPosStatesBits", "UpdateShortRep", "#=q7xw_62wJAROEdfmrcOfU9A==", "#=qGPyC5Xsppd3A9GM1nbF6UA==", "#=qz_b1L2sFeS3InI52Fcb$xw==", "WriteProcessMemory", "kNumBitModelTotalBits", "#=qhe3YBArn2XZllRv5mtI$IA==", "-7& G", "ToUnicodeEx", "-=&~L", "System.Runtime.InteropServices", "w`TeE", "#=qUUTENRjCs2Tp8v$UkD2pyj$_WERyijyYrwjs9ap51Bc=", "#=qYnC$MeSjL22yOmZmIH9O5Q==", "flags", "add_AssemblyResolve", "SetCoderProperties", "Rz4Zy", "Decoder", "#=qA6W6GWeKbpqYNXHHn0NOqQ==", "GetManifestResourceStream", "VS_VERSION_INFO", "#=qxPKYwApYHsDUAngYujXcMg==", "feffeefeffe ", "ISetDecoderProperties", "Combine", "Create__Instance__", "ffeeffefehah", "Computer", "#=qHULrE3ucj3pP3z4Q8AHNQ6f7gkmXn_0Fohqp275LJtI=", "m_LenDecoder", "ApplicationBase", "#=qL4z9que7yasXNRV3gE808Q==", "EndMarker", "#=qbxOnQHmVH_9KW47BBLVbiw==", "ReadString", "TmYM>K", "E'Y=u", "#=qps$_CRy8QN3tD8_cpxbl5Q==", "#=qOB8cEznqDkvIxRcccHlIsv7sC6k2hObkCZSKdkJ_Zsk=", "#=qv$8E8sC6lJIPtd2$JZCylw==", "startIndex", "List`1", "Object", "kNumHighLenBits", "AssemblyCopyrightAttribute", "DefRawInputProc", "1.0.1.7", "w,X8WD", "#=q4JDS1p4qILBfxV6iYzPvew==", "#=qG0TXdiUc5RapAeqxDJArye7UrdqGI4sA16AWYfcrCf0=", "Lzma#.dll", "fefefeffe", "StringSplitOptions", "#=qMaYcsaYwkZMTqb1yZLawvsT_RxwqTAeocZdt0axWTAI=", "#=qtnUi7yodyLqv1sucEHesww==", "#=qj4ZL7Xa5Jh3aXGsDJ8nwq9Ol$7j95Q2WIH6RXdknYOM=", "get_Value", "Compression.LZ", "PosStateBits", "#=qCqIROk23BL$5SZnsNcMGzw==", "get_ProcessName", "NanoCore.ClientPluginHost", "m_PosAlignDecoder", "#=qgvFUiZFJ0DnA4jPHJSI0$g==", "Header", "afefefeffe", "SetClipboardViewer", ".cctor", "NativeWindow", "#=qp0rjqvRPFB117u1oIM8eyg==", "#=qNwsNe80RUFvWuBVxKYH7CdkcJCEYrUuUzsDzmfG3Y0f_hVViDx0xK8xqdS9y79EZ", "Enter", "#=qMb7ah3f2LZnw5uZZ2MwFiVVbfzLytVjDFOGKjr3$eXM=", "#=q7ZvQqMWc8EiVYIemfr8kugujhdIVidtkVJrdNaMKkMY=", "#=qnKfe8RVyBZnzTVIYVRXs3lz7$G7e6QuPxi3Jx3scwJ4=", "PipeClosed", "#=q8PUUaAp4ut016MmvuKrU1A==", "Message", "#=qcYLUomKQ3VHSKmjKloHutA==", "Array", "#=qdLYSf0D2H54oOFJ36kM4Rg==", "Microsoft.VisualBasic.ApplicationServices" ], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 8, "cape_type": "Unpacked PE Image: 32-bit DLL", "process_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "process_name": "sex1.exe", "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "pid": 6648, "virtual_address": "0x083B0000" }, { "name": "dc4a61046d5f6b52019eda5764ab099414471fc9e9fb50c828092a8db276c84d", "path": "/opt/CAPEv2/storage/analyses/47/CAPE/dc4a61046d5f6b52019eda5764ab099414471fc9e9fb50c828092a8db276c84d", "guest_paths": "9;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?0x08660000;?", "size": 2252, "crc32": "E0DA99CC", "md5": "3b73545169bf86699c7a2f1ab3cbdd5a", "sha1": "f9554b86fcdbe19cd41b276729e4f7247210ade8", "sha256": "dc4a61046d5f6b52019eda5764ab099414471fc9e9fb50c828092a8db276c84d", "sha512": "bfc1aa69f7abb06f2f6eb2cd940e4d077a059a532dd95984df0f0eeb773326785e81f554d7139d3f5be6eff65aca33a7f806fca424d0e19cba75bebf077aa51b", "rh_hash": null, "ssdeep": "48:Ia6qtYYIPFo32G8NKl9yGHvZlHuIEUdufa8fb3sf0uok6s7vcXxaHkxfU:r6OYd8vPHxUb3E/7kQN", "type": "Matlab v4 mat-file (little endian) l\\260\\003\\353h\\260\\006\\353d\\260\\011\\353`\\260\\014\\353\\\\260\\017\\353X\\260\\022\\353T\\260\\025\\353P\\260\\030\\353L\\260\\033\\353H\\260\\036\\353D\\260!\\353@\\260$\\353<\\260'\\3538\\260*\\3534\\260-\\3530\\2600\\353,\\2603\\353(\\2606\\353$\\2609\\353 \\260<\\353\\034\\260?\\353\\030\\260B\\353\\024\\260E\\353\\020\\260H\\353\\014\\260K\\353\\010\\260N\\353\\004\\260Q\\353, numeric, rows 140902400, columns 65536, imaginary (1)", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T17441788BB6600AB8D407F239A5EFD90D7207C03E249EE65C508CD09B9192C9CFD94B33", "sha3_384": "4422d9ed88c824028c6ee70f1d640330ec5197e9d9a0396efe16098ba375dd35cc189878989e669ffc07da138790c9dc", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": null, "strings": [], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 9, "cape_type": "Unpacked Shellcode", "process_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "process_name": "sex1.exe", "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "pid": 6648, "virtual_address": "0x08660000" }, { "name": "93da0626e38b0f52be088e4e0960b629ba52a39a2ca07e32b131a24d489d513d", "path": "/opt/CAPEv2/storage/analyses/47/CAPE/93da0626e38b0f52be088e4e0960b629ba52a39a2ca07e32b131a24d489d513d", "guest_paths": "9;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?0x07810000;?", "size": 2249, "crc32": "F1FA7743", "md5": "04a8fa404ac3f1ad51449ea22a3f9496", "sha1": "d8db2f4bcf1e4aaafacb2b9e777a4b9cd2bca1ed", "sha256": "93da0626e38b0f52be088e4e0960b629ba52a39a2ca07e32b131a24d489d513d", "sha512": "e3de83f1d7b2d50f420b4154623bac49fb5a3b7a4ec5445dfc31a3ddfb40cfe07a2f95589f758d340f9cd0ca525e4d391ee425cfdaf659235bf5a65bce159a9a", "rh_hash": null, "ssdeep": "24:TFmg+SKqIbCbWanxJAYbc8dFZAT7qylllzbEkh2k:4SQbCbjIYrHZdylllzbEkhD", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T11A41F926DA74A242C0009B3C9F278F614374DA0A1742CE2B0309F43A8EE62B211D31CD", "sha3_384": "6af3efea973cc515e6bd6414bf59b04ccaea18bd979e64a27833c5b0c33478edfee16b76332b9d96d596f626a75402fa", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": null, "strings": [ "! #!%\"'#)$+%-&/'1(3)5*7+9,;-=.?/A0E1I2M3Q4U5Y6]7a8e9i:m;q}?" ], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 9, "cape_type": "Unpacked Shellcode", "process_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "process_name": "sex1.exe", "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "pid": 6648, "virtual_address": "0x07810000" }, { "name": "b639220ba55e061b5ed03cb609435b06f2ca7eb4ded611f62778f43d345d4b25", "path": "/opt/CAPEv2/storage/analyses/47/CAPE/b639220ba55e061b5ed03cb609435b06f2ca7eb4ded611f62778f43d345d4b25", "guest_paths": "9;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?0x08640000;?", "size": 9089, "crc32": "E1AB968A", "md5": "cd984e14149e00f2a74c24405e6fa0ee", "sha1": "a6271bb76b311eb63cbe1b6bc0a4846d812d2f78", "sha256": "b639220ba55e061b5ed03cb609435b06f2ca7eb4ded611f62778f43d345d4b25", "sha512": "7a053bec0e6c5d55c017e58fdbc64aac43a90cc387671451c2828e26c2cc6f214eb1b6c730a074ac0beadda4f322dffc02ecca95bc3b70a32ade19994be6549a", "rh_hash": null, "ssdeep": "192:yFX6QkF1+FDEJPY4t5Z3BIgAS99l6xQXf60ss9JhK/cYgdir:bFA491JikxTXftss/hKk3Q", "type": "Matlab v4 mat-file (little endian) P\\370\\256, numeric, rows 140771328, columns 65536, imaginary (1)", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1BF12C601DF86D567C26BBAF902214390D2C8CCB51F3E0A817BD8ECBAAAB01D1C915B43", "sha3_384": "0937ad927d4683f3f2233beb8ab287d05fc18699cd2a9eb52f0a6d22382901399377f4358f5d23efb0f77820fb65a576", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": null, "strings": [ "RO,k^]", "w :G ", "VP,k^]", "8N,k^]" ], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 9, "cape_type": "Unpacked Shellcode", "process_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "process_name": "sex1.exe", "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "pid": 6648, "virtual_address": "0x08640000" }, { "name": "5131cc93670f51e88960065f7bb8df32f8381db790c5a1ab3de61f19dec14c5f", "path": "/opt/CAPEv2/storage/analyses/47/CAPE/5131cc93670f51e88960065f7bb8df32f8381db790c5a1ab3de61f19dec14c5f", "guest_paths": "9;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?0x077F0000;?", "size": 524, "crc32": "916DC393", "md5": "ca56929eaedcdadc8cecfd79bb896ac4", "sha1": "e6dc4731d01d17069cc1df80d3206192d3eb5d90", "sha256": "5131cc93670f51e88960065f7bb8df32f8381db790c5a1ab3de61f19dec14c5f", "sha512": "8f5cfe26c5995deec650875fed6559d195774d23e5d52d986b56350091bb4e61a26cad3438dcdbcc00b03768c8a26f5d07ca627fa277ebee5ceefbf7dc3a2d99", "rh_hash": null, "ssdeep": "6:J1WrKlzQ+lM/JUVD9crQIKaBvQjzCXJT9l+lM/JmJqQJsq1gRiTg9Q2JM+itXYLg:yGQ+u/+VhcLKGv2zAl+u/ocGGM+ugal5", "type": "Windows boot log, header size 0x77f0000, 0x1 valid bytes", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1AAF097430E200895CC8086B94BA0DB86EE5EC1298381A945CB1C02203B3D9E880AC825", "sha3_384": "21b95b2aedbb04cca1a9f358bc303a5e08480c6f058b4f5628ddb8d47f8409bd25f6370f096b6e0b89087787dea3d81b", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": null, "strings": [ "UX5SV", "8~sUSVW" ], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 9, "cape_type": "Unpacked Shellcode", "process_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "process_name": "sex1.exe", "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "pid": 6648, "virtual_address": "0x077F0000" }, { "name": "c53c9857218e56767da2dc2ef8fb81c512704e4023339b58d91ba52cdf903dca", "path": "/opt/CAPEv2/storage/analyses/47/CAPE/c53c9857218e56767da2dc2ef8fb81c512704e4023339b58d91ba52cdf903dca", "guest_paths": "9;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?0x079B0000;?", "size": 32766, "crc32": "3992DEDE", "md5": "e701463d86122f59fe4886730a98ca01", "sha1": "a0066ca487973d7c30726057e34211f0864fecf4", "sha256": "c53c9857218e56767da2dc2ef8fb81c512704e4023339b58d91ba52cdf903dca", "sha512": "15c4dacb925b8f4232ccbdd58b7394851d1136664752447736f7bc7776485ed161f8cb7a19a67f31d5c386b10e21b7402baa54776a556951a9d6970be8545fc1", "rh_hash": null, "ssdeep": "96:VMsiUVMijT8n4e6DXj5+rQLFaFztcLcxmeFLUn1WpFNMVqgG2Mg:ms0J6DXj59gFgcx5I1WpFodGq", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T158E2BA877AB0C913C10C5B3988E7C75B3332F984AB07670F3545B32E5CB63AA9E59588", "sha3_384": "1163b365ff604740a12dfdb5c099e74177e12a8a46f778ff02e09ee5765f6a49ec5df61b8d892e0a8d510491c2bc6882", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": null, "strings": [], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 9, "cape_type": "Unpacked Shellcode", "process_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "process_name": "sex1.exe", "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "pid": 6648, "virtual_address": "0x079B0000" }, { "name": "67a4e4961f92079cfb03d908719e99c6c09b74279b0e37b9d7eea541659f3957", "path": "/opt/CAPEv2/storage/analyses/47/CAPE/67a4e4961f92079cfb03d908719e99c6c09b74279b0e37b9d7eea541659f3957", "guest_paths": "9;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe;?0x02910000;?", "size": 4094, "crc32": "5C7725D6", "md5": "dd9bd03c43f51fcc93f7bfb5cab91f65", "sha1": "f9385ad06d568ca2801fdda27076275261cd1692", "sha256": "67a4e4961f92079cfb03d908719e99c6c09b74279b0e37b9d7eea541659f3957", "sha512": "7867e52424c7901d492ee82868329fca2e8f92903ed189653d01fa28113a7b1c0c553558fa6e43886b531cf406b13b4b2136a52ba3b791cf83e37c1defe290f0", "rh_hash": null, "ssdeep": "24:dvszLNrVbyDF4+ddm3UmbhFfINDfcDlG8FSf:JszFVbyDFJ7mJzMDilGf", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T15F81109837004751DCCEA331086A43A1BF3DCB0866802A8DE95846B62D3F7796502218", "sha3_384": "e24e4065e725c4ebc498711e09fc73cef2c074ea7c5907f2e527105f5c0c1b2f850f6289925c78bf1c1b7707939a07e5", "yara_hash": "b833150b13e1662cfeb7589959edd288cf4e73710395ec5c5f2123f39a668f4d", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": null, "strings": [ "<~sUSVW", ";~sUSVW", "PPPPPh" ], "virustotal": { "error": true, "msg": "VT File lookup disabled in processing.conf" }, "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 9, "cape_type": "Unpacked Shellcode", "process_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "process_name": "sex1.exe", "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "pid": 6648, "virtual_address": "0x02910000" } ], "configs": [ { "NanoCore": { "BuildTime": [ "2026-04-27 13:44:13.898730" ], "Version": [ "1.2.2.0" ], "Mutex": [ "b99f832a-30b2-4929-80df-5af09cffdbc2" ], "DefaultGroup": [ "nnzn.sa.com" ], "PrimaryConnectionHost": [ "nnzn.sa.com" ], "BackupConnectionHost": [ "nnzn.sa.com" ], "ConnectionPort": [ "443" ], "RunOnStartup": [ "True" ], "RequestElevation": [ "True" ], "BypassUserAccountControl": [ "True" ], "ClearZoneIdentifier": [ "True" ], "ClearAccessControl": [ "False" ], "SetCriticalProcess": [ "False" ], "PreventSystemSleep": [ "True" ], "ActivateAwayMode": [ "False" ], "EnableDebugMode": [ "False" ], "RunDelay": [ "0" ], "ConnectDelay": [ "4000" ], "RestartDelay": [ "5000" ], "TimeoutInterval": [ "5000" ], "KeepAliveTimeout": [ "30000" ], "MutexTimeout": [ "5000" ], "LanTimeout": [ "2500" ], "WanTimeout": [ "8000" ], "BufferSize": [ "65535" ], "MaxPacketSize": [ "10485760" ], "GCThreshold": [ "10485760" ], "UseCustomDnsServer": [ "True" ], "PrimaryDnsServer": [ "8.8.8.8" ], "BackupDnsServer": [ "8.8.4.4" ], "cncs": [ [ "nnzn.sa.com:443", "nnzn.sa.com:443" ] ] }, "_associated_config_hashes": [ { "md5": "ec0381bf2a31d2ce2e4a00f809db6266", "sha1": "cbb5b6fc88aa57b1675a71a7e1d9eede95238315", "sha256": "2c14151d8f546aed480a7eda9be556bd37831020a3ab6d40eb993c260c9ee26b", "sha512": "f4d2af561ceabbb1793af9866d1efc6497886d6447b658e1ac37fbc650ba95a27a017b16574959388ca88354c9041ae781aa31caeaa5cc06b26b017d819b8614", "sha3_384": "ec3dce417ea77de9d5ffe299d314856d9fe313aef6f2d0756bd3c1d5189229fa7ec47b248eca9b4b3e92aa5ea87b0095" } ], "_associated_analysis_hashes": { "md5": "ec0381bf2a31d2ce2e4a00f809db6266", "sha1": "cbb5b6fc88aa57b1675a71a7e1d9eede95238315", "sha256": "2c14151d8f546aed480a7eda9be556bd37831020a3ab6d40eb993c260c9ee26b", "sha512": "f4d2af561ceabbb1793af9866d1efc6497886d6447b658e1ac37fbc650ba95a27a017b16574959388ca88354c9041ae781aa31caeaa5cc06b26b017d819b8614", "sha3_384": "ec3dce417ea77de9d5ffe299d314856d9fe313aef6f2d0756bd3c1d5189229fa7ec47b248eca9b4b3e92aa5ea87b0095" } } ] }, "info": { "version": "2.5", "started": "2026-04-28 00:03:23", "ended": "2026-04-28 00:07:29", "duration": 246, "id": 47, "category": "file", "custom": "", "machine": { "id": 40, "status": "stopping", "name": "win10x64", "label": "win10x64", "platform": "windows", "manager": "KVM", "started_on": "2026-04-28 00:03:23", "shutdown_on": "2026-04-28 00:07:28" }, "package": "exe", "timeout": true, "tlp": null, "parent_sample": null, "options": {}, "source_url": null, "route": "", "user_id": 0, "CAPE_current_commit": "a9a0887dab232f52c59e955b9984dd494c47ce6b" }, "behavior": { "processes": [ { "process_id": 6648, "process_name": "sex1.exe", "parent_id": 7304, "module_path": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe", "first_seen": "2026-04-27 21:05:13,697", "calls": [ { "timestamp": "2026-04-27 21:05:14,197", "thread_id": "6700", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-04-27 21:05:14,197", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x7418ec20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741ac000" }, { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-04-27 21:05:14,197", "thread_id": "6700", "caller": "0x77261d96", "parentcaller": "0x77266176", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ADVAPI32.dll" }, { "name": "BaseAddress", "value": "0x76ea0000" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-04-27 21:05:14,197", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "RegOpenKeyExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76ebe9b0" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-04-27 21:05:14,197", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x7418ec20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741ac000" }, { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-04-27 21:05:14,197", "thread_id": "6700", "caller": "0x7417ed49", "parentcaller": "0x7416dccc", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework\\Policy\\" }, { "name": "Handle", "value": "0x00000238" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework\\Policy\\" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-04-27 21:05:14,197", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x7418ec20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741ac000" }, { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-04-27 21:05:14,197", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "RegQueryInfoKeyW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76ebeb00" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-04-27 21:05:14,197", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x7418ec20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741ac000" }, { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-04-27 21:05:14,197", "thread_id": "6700", "caller": "0x7417e980", "parentcaller": "0x7417ed5c", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000238" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "5" }, { "name": "MaxSubKeyLength", "value": "9" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-04-27 21:05:14,197", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x7418ec20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741ac000" }, { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-04-27 21:05:14,197", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "RegEnumKeyExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76ebead0" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-04-27 21:05:14,197", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x7418ec20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741ac000" }, { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-04-27 21:05:14,197", "thread_id": "6700", "caller": "0x7417e9f7", "parentcaller": "0x7417ed5c", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" }, { "name": "Index", "value": "4" }, { "name": "Name", "value": "v4.0" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\policy\\v4.0" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-04-27 21:05:14,197", "thread_id": "6700", "caller": "0x7417e9f7", "parentcaller": "0x7417ed5c", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" }, { "name": "Index", "value": "3" }, { "name": "Name", "value": "v2.0" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\policy\\v2.0" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-04-27 21:05:14,197", "thread_id": "8084", "caller": "0x77ea64d6", "parentcaller": "0x77ea63e1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 15 }, { "timestamp": "2026-04-27 21:05:14,197", "thread_id": "8084", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "6700", "caller": "0x7417e9f7", "parentcaller": "0x7417ed5c", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" }, { "name": "Index", "value": "2" }, { "name": "Name", "value": "Upgrades" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\policy\\Upgrades" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "7424", "caller": "0x77ea64d6", "parentcaller": "0x77ea63e1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 18 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "7424", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "6700", "caller": "0x7417e9f7", "parentcaller": "0x7417ed5c", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "standards" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\policy\\standards" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "6700", "caller": "0x7417e9f7", "parentcaller": "0x7417ed5c", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "AppPatch" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\policy\\AppPatch" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "6700", "caller": "0x7417edb8", "parentcaller": "0x7416dccc", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000238" }, { "name": "SubKey", "value": "v4.0" }, { "name": "Handle", "value": "0x00000240" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\policy\\v4.0" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "6700", "caller": "0x7417eb88", "parentcaller": "0x7417edde", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "1" }, { "name": "MaxValueNameLength", "value": "5" }, { "name": "MaxValueLength", "value": "24" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x7418ec20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741ac000" }, { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "RegEnumValueW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76ebeba0" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x7418ec20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741ac000" }, { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "6700", "caller": "0x7417ec0a", "parentcaller": "0x7417edde", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" }, { "name": "Index", "value": "0" }, { "name": "ValueName", "value": "30319" }, { "name": "Data", "value": "30319-30319" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\policy\\v4.0\\30319" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x7418ec20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741ac000" }, { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "RegCloseKey" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76ebeb20" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x7418ec20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741ac000" }, { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "6700", "caller": "0x7417ee01", "parentcaller": "0x7416dccc", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "7420", "caller": "0x77ea64d6", "parentcaller": "0x77ea63e1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 32 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "7420", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "4232", "caller": "0x77ea64d6", "parentcaller": "0x77ea63e1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 34 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "4232", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "6700", "caller": "0x77264429", "parentcaller": "0x741751c9", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\MSCOREE.DLL.local" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "6700", "caller": "0x74174e1c", "parentcaller": "0x741752b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000234" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x7418ec20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741ac000" }, { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "RegQueryValueExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76ebe8e0" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x7418ec20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x741ac000" }, { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "6700", "caller": "0x74174e34", "parentcaller": "0x741752b8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "6700", "caller": "0x74174e71", "parentcaller": "0x741752b8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "Data", "value": "C:\\Windows\\Microsoft.NET\\Framework\\" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "6700", "caller": "0x74174e7f", "parentcaller": "0x741752b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-04-27 21:05:14,213", "thread_id": "6700", "caller": "0x77264566", "parentcaller": "0x74186667", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x00a5e790", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" }, { "name": "FirstCreateTimeLow", "value": "0x51d5aa91" }, { "name": "FirstCreateTimeHigh", "value": "0x01d8c32f" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-04-27 21:05:14,275", "thread_id": "6700", "caller": "0x77275d68", "parentcaller": "0x74186677", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-04-27 21:05:14,275", "thread_id": "6700", "caller": "0x7417ef8e", "parentcaller": "0x7416dccc", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-04-27 21:05:14,275", "thread_id": "6700", "caller": "0x74174e1c", "parentcaller": "0x741752b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000238" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-04-27 21:05:14,275", "thread_id": "6700", "caller": "0x74174e34", "parentcaller": "0x741752b8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-04-27 21:05:14,275", "thread_id": "6700", "caller": "0x74174e71", "parentcaller": "0x741752b8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "Data", "value": "C:\\Windows\\Microsoft.NET\\Framework\\" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-04-27 21:05:14,275", "thread_id": "6700", "caller": "0x74174e7f", "parentcaller": "0x741752b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-04-27 21:05:14,275", "thread_id": "6700", "caller": "0x77264566", "parentcaller": "0x74186667", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x00a5e610", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" }, { "name": "FirstCreateTimeLow", "value": "0x51d5aa91" }, { "name": "FirstCreateTimeHigh", "value": "0x01d8c32f" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-04-27 21:05:14,275", "thread_id": "6700", "caller": "0x77275d68", "parentcaller": "0x74186677", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-04-27 21:05:14,275", "thread_id": "6700", "caller": "0x74174e1c", "parentcaller": "0x741752b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000238" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-04-27 21:05:14,275", "thread_id": "6700", "caller": "0x74174e34", "parentcaller": "0x741752b8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-04-27 21:05:14,275", "thread_id": "6700", "caller": "0x74174e71", "parentcaller": "0x741752b8", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "Data", "value": "C:\\Windows\\Microsoft.NET\\Framework\\" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-04-27 21:05:14,275", "thread_id": "6700", "caller": "0x74174e7f", "parentcaller": "0x741752b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-04-27 21:05:14,307", "thread_id": "6700", "caller": "0x77261d96", "parentcaller": "0x7417952e", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei" }, { "name": "DllBase", "value": "0x73e10000" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-04-27 21:05:14,322", "thread_id": "6700", "caller": "0x77261d96", "parentcaller": "0x73e189ae", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-synch-l1-2-0" }, { "name": "BaseAddress", "value": "0x77150000" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-04-27 21:05:14,322", "thread_id": "6700", "caller": "0x77261d96", "parentcaller": "0x73e189ae", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-fibers-l1-1-1" }, { "name": "BaseAddress", "value": "0x77150000" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-04-27 21:05:14,322", "thread_id": "6700", "caller": "0x77261d96", "parentcaller": "0x73e18760", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-synch-l1-2-0" }, { "name": "BaseAddress", "value": "0x77150000" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-04-27 21:05:14,322", "thread_id": "6700", "caller": "0x77261d96", "parentcaller": "0x73e18760", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-fibers-l1-1-1" }, { "name": "BaseAddress", "value": "0x77150000" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-04-27 21:05:14,322", "thread_id": "6700", "caller": "0x77261d96", "parentcaller": "0x73e18760", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-l1-2-1" }, { "name": "BaseAddress", "value": "0x77150000" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-04-27 21:05:14,322", "thread_id": "6700", "caller": "0x77261d96", "parentcaller": "0x77266176", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ADVAPI32.dll" }, { "name": "BaseAddress", "value": "0x76ea0000" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-04-27 21:05:14,322", "thread_id": "6700", "caller": "0x77261d96", "parentcaller": "0x7417952e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" }, { "name": "BaseAddress", "value": "0x73e10000" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-04-27 21:05:14,322", "thread_id": "6700", "caller": "0x77261d96", "parentcaller": "0x7417952e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x73e10000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" }, { "name": "dwFlags", "value": "0x00000008" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-04-27 21:05:14,322", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "RegisterShimImplCallback" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x73e114d0" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-04-27 21:05:14,322", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "RegisterShimImplCleanupCallback" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-04-27 21:05:14,322", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "SetShellShimInstance" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-04-27 21:05:14,322", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "OnShimDllMainCalled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x73e19630" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-04-27 21:05:14,322", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "_CorExeMain_RetAddr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-04-27 21:05:14,322", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "_CorExeMain" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x73e1fa20" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-04-27 21:05:14,322", "thread_id": "6700", "caller": "0x77264429", "parentcaller": "0x73e22143", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\MSCOREE.DLL.local" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-04-27 21:05:14,322", "thread_id": "6700", "caller": "0x73e17a31", "parentcaller": "0x73e18d85", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x000001e0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-04-27 21:05:14,322", "thread_id": "6700", "caller": "0x73e18da2", "parentcaller": "0x73e1924a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001e0" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-04-27 21:05:14,322", "thread_id": "6700", "caller": "0x73e18de3", "parentcaller": "0x73e1924a", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001e0" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "Data", "value": "C:\\Windows\\Microsoft.NET\\Framework\\" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-04-27 21:05:14,322", "thread_id": "6700", "caller": "0x73e18df4", "parentcaller": "0x73e1924a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001e0" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-04-27 21:05:14,322", "thread_id": "6700", "caller": "0x77264566", "parentcaller": "0x73e1162d", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x00a5e250", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\*" }, { "name": "FirstCreateTimeLow", "value": "0xc87fbef5" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acde" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-04-27 21:05:14,322", "thread_id": "6700", "caller": "0x77261999", "parentcaller": "0x772616ce", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-04-27 21:05:14,322", "thread_id": "6700", "caller": "0x77261999", "parentcaller": "0x772616ce", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-04-27 21:05:14,338", "thread_id": "6700", "caller": "0x77261999", "parentcaller": "0x772616ce", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-04-27 21:05:14,338", "thread_id": "6700", "caller": "0x77261999", "parentcaller": "0x772616ce", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-04-27 21:05:14,353", "thread_id": "6700", "caller": "0x77261999", "parentcaller": "0x772616ce", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-04-27 21:05:14,353", "thread_id": "6700", "caller": "0x77261999", "parentcaller": "0x772616ce", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000234" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-04-27 21:05:14,353", "thread_id": "6700", "caller": "0x7726269a", "parentcaller": "0x73e17007", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-04-27 21:05:14,369", "thread_id": "6700", "caller": "0x77261999", "parentcaller": "0x772616ce", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000238" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-04-27 21:05:14,369", "thread_id": "6700", "caller": "0x7726269a", "parentcaller": "0x73e17007", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-04-27 21:05:14,369", "thread_id": "6700", "caller": "0x77275d68", "parentcaller": "0x73e15ff0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001e0" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-04-27 21:05:14,369", "thread_id": "6700", "caller": "0x73e21a39", "parentcaller": "0x73e16701", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-04-27 21:05:14,369", "thread_id": "6700", "caller": "0x73e21a7f", "parentcaller": "0x73e16701", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000238" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-04-27 21:05:14,369", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-04-27 21:05:14,369", "thread_id": "6700", "caller": "0x77261d96", "parentcaller": "0x77266176", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "SHLWAPI.dll" }, { "name": "BaseAddress", "value": "0x76f20000" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-04-27 21:05:14,369", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "ModuleHandle", "value": "0x76f20000" }, { "name": "FunctionName", "value": "UrlIsW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f343a0" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-04-27 21:05:14,369", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-04-27 21:05:14,369", "thread_id": "6700", "caller": "0x77261999", "parentcaller": "0x772616ce", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe.config" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-04-27 21:05:14,369", "thread_id": "6700", "caller": "0x73e17a31", "parentcaller": "0x73e20224", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000234" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-04-27 21:05:14,369", "thread_id": "6700", "caller": "0x73e2024d", "parentcaller": "0x73e20350", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000234" }, { "name": "ValueName", "value": "UseLegacyV2RuntimeActivationPolicyDefaultValue" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\UseLegacyV2RuntimeActivationPolicyDefaultValue" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-04-27 21:05:14,369", "thread_id": "6700", "caller": "0x73e1760b", "parentcaller": "0x73e202b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-04-27 21:05:14,369", "thread_id": "6700", "caller": "0x73e17a31", "parentcaller": "0x73e20224", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000234" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-04-27 21:05:14,369", "thread_id": "6700", "caller": "0x73e2024d", "parentcaller": "0x73e20350", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000234" }, { "name": "ValueName", "value": "OnlyUseLatestCLR" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\OnlyUseLatestCLR" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-04-27 21:05:14,369", "thread_id": "6700", "caller": "0x73e1760b", "parentcaller": "0x73e202b6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-04-27 21:05:14,385", "thread_id": "6700", "caller": "0x77261999", "parentcaller": "0x772616ce", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000234" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-04-27 21:05:14,385", "thread_id": "6700", "caller": "0x7727081d", "parentcaller": "0x73e44737", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000234" }, { "name": "HandleName", "value": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x000\\x03\\x00\\x00\\x00\\x00\\x00\\x00,\\x03\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-04-27 21:05:14,385", "thread_id": "6700", "caller": "0x77260e58", "parentcaller": "0x77260abe", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000240" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000234" }, { "name": "FileName", "value": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-04-27 21:05:14,385", "thread_id": "6700", "caller": "0x7726f16b", "parentcaller": "0x73e43dc6", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000240" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x028c0000" }, { "name": "SectionOffset", "value": "0x007df334" }, { "name": "ViewSize", "value": "0x00033000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-04-27 21:05:14,447", "thread_id": "6700", "caller": "0x73e5863e", "parentcaller": "0x73e5740f", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 105 }, { "timestamp": "2026-04-27 21:05:14,447", "thread_id": "6700", "caller": "0x7726269a", "parentcaller": "0x73e43e96", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-04-27 21:05:14,447", "thread_id": "6700", "caller": "0x77270c75", "parentcaller": "0x73e43ec1", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x028c0000" }, { "name": "RegionSize", "value": "0x00033000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-04-27 21:05:14,447", "thread_id": "6700", "caller": "0x7726269a", "parentcaller": "0x73e43ee4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-04-27 21:05:14,447", "thread_id": "6700", "caller": "0x77261999", "parentcaller": "0x772616ce", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000240" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-04-27 21:05:14,447", "thread_id": "6700", "caller": "0x7727081d", "parentcaller": "0x73e44737", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000240" }, { "name": "HandleName", "value": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x000\\x03\\x00\\x00\\x00\\x00\\x00\\x00,\\x03\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-04-27 21:05:14,447", "thread_id": "6700", "caller": "0x77260e58", "parentcaller": "0x77260abe", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000234" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000240" }, { "name": "FileName", "value": "C:\\Users\\cape\\AppData\\Local\\Temp\\sex1.exe" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-04-27 21:05:14,447", "thread_id": "6700", "caller": "0x7726f16b", "parentcaller": "0x73e43dc6", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000234" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x028c0000" }, { "name": "SectionOffset", "value": "0x007df334" }, { "name": "ViewSize", "value": "0x00033000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-04-27 21:05:14,447", "thread_id": "6700", "caller": "0x73e5863e", "parentcaller": "0x73e5740f", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 113 }, { "timestamp": "2026-04-27 21:05:14,447", "thread_id": "6700", "caller": "0x7726269a", "parentcaller": "0x73e43e96", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-04-27 21:05:14,447", "thread_id": "6700", "caller": "0x77270c75", "parentcaller": "0x73e43ec1", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x028c0000" }, { "name": "RegionSize", "value": "0x00033000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-04-27 21:05:14,447", "thread_id": "6700", "caller": "0x7726269a", "parentcaller": "0x73e43ee4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-04-27 21:05:14,447", "thread_id": "6700", "caller": "0x73e17a31", "parentcaller": "0x73e2fc7b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000006", "arguments": [ { "name": "Registry", "value": "0x00000000" }, { "name": "SubKey", "value": "Policy\\Standards" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "Policy\\Standards" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-04-27 21:05:14,447", "thread_id": "6700", "caller": "0x73e17a31", "parentcaller": "0x73e2fc7b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000238" }, { "name": "SubKey", "value": "Policy\\Standards" }, { "name": "Handle", "value": "0x00000234" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\Policy\\Standards" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-04-27 21:05:14,447", "thread_id": "6700", "caller": "0x73e17a31", "parentcaller": "0x73e2fa9a", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000234" }, { "name": "SubKey", "value": "v2.0.50727" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\policy\\standards\\v2.0.50727" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-04-27 21:05:14,447", "thread_id": "6700", "caller": "0x73e2509d", "parentcaller": "0x73e298ef", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-04-27 21:05:14,447", "thread_id": "6700", "caller": "0x77261d96", "parentcaller": "0x73e1dd47", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\kernel.appcore" }, { "name": "DllBase", "value": "0x75250000" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-04-27 21:05:14,463", "thread_id": "6700", "caller": "0x77261d96", "parentcaller": "0x73e1dd47", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-appmodel-runtime-l1-1-2.dll" }, { "name": "BaseAddress", "value": "0x75250000" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-04-27 21:05:14,463", "thread_id": "6700", "caller": "0x77261d96", "parentcaller": "0x73e1dd47", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x75250000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-appmodel-runtime-l1-1-2.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-04-27 21:05:14,463", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "ModuleHandle", "value": "0x75250000" }, { "name": "FunctionName", "value": "AppPolicyGetClrCompat" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75253a00" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-04-27 21:05:14,463", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "ModuleHandle", "value": "0x75250000" }, { "name": "FunctionName", "value": "GetCurrentPackageId" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75253d80" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-04-27 21:05:14,463", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "ModuleHandle", "value": "0x75250000" }, { "name": "FunctionName", "value": "GetCurrentPackageInfo" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75253db0" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-04-27 21:05:14,463", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "ModuleHandle", "value": "0x75250000" }, { "name": "FunctionName", "value": "GetCurrentPackagePath" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75253dd0" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-04-27 21:05:14,463", "thread_id": "6700", "caller": "0x77260848", "parentcaller": "0x73e1db51", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000244" }, { "name": "DesiredAccess", "value": "0x00000400", "pretty_value": "PROCESS_QUERY_INFORMATION" }, { "name": "ProcessIdentifier", "value": "6648" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-04-27 21:05:14,463", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-04-27 21:05:14,463", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "OpenProcessToken" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76ebea30" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-04-27 21:05:14,463", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-04-27 21:05:14,463", "thread_id": "6700", "caller": "0x77263cc4", "parentcaller": "0x73e1dbb9", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000244" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000248" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-04-27 21:05:14,463", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-04-27 21:05:14,463", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "GetTokenInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76ebe690" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-04-27 21:05:14,463", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-04-27 21:05:14,463", "thread_id": "6700", "caller": "0x77261446", "parentcaller": "0x73e1dc0a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-04-27 21:05:14,463", "thread_id": "6700", "caller": "0x7726269a", "parentcaller": "0x73e1dc40", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-04-27 21:05:14,463", "thread_id": "6700", "caller": "0x7726269a", "parentcaller": "0x73e1dc62", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-04-27 21:05:14,463", "thread_id": "6700", "caller": "0x73e17a31", "parentcaller": "0x73e17f73", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Fusion" }, { "name": "Handle", "value": "0x00000244" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Fusion" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-04-27 21:05:14,463", "thread_id": "6700", "caller": "0x73e17fa5", "parentcaller": "0x73e18014", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "ValueName", "value": "NoClientChecks" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Fusion\\NoClientChecks" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-04-27 21:05:14,463", "thread_id": "6700", "caller": "0x73e17fd5", "parentcaller": "0x73e18014", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-04-27 21:05:14,463", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-04-27 21:05:14,463", "thread_id": "6700", "caller": "0x77261d96", "parentcaller": "0x77266176", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\VERSION" }, { "name": "DllBase", "value": "0x75460000" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-04-27 21:05:14,463", "thread_id": "6700", "caller": "0x77261d96", "parentcaller": "0x77266176", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "VERSION.dll" }, { "name": "BaseAddress", "value": "0x75460000" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-04-27 21:05:14,463", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "VERSION.dll" }, { "name": "ModuleHandle", "value": "0x75460000" }, { "name": "FunctionName", "value": "GetFileVersionInfoSizeW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x754615c0" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-04-27 21:05:14,463", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-04-27 21:05:14,525", "thread_id": "6700", "caller": "0x73e2080a", "parentcaller": "0x73e1da39", "category": "filesystem", "api": "GetFileVersionInfoSizeW", "status": true, "return": "0x0000081c", "arguments": [ { "name": "PathName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-04-27 21:05:14,525", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-04-27 21:05:14,525", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "VERSION.dll" }, { "name": "ModuleHandle", "value": "0x75460000" }, { "name": "FunctionName", "value": "GetFileVersionInfoW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x754615e0" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-04-27 21:05:14,525", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-04-27 21:05:14,525", "thread_id": "6700", "caller": "0x73e2082b", "parentcaller": "0x73e1da39", "category": "filesystem", "api": "GetFileVersionInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "PathName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-04-27 21:05:14,525", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-04-27 21:05:14,525", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "VERSION.dll" }, { "name": "ModuleHandle", "value": "0x75460000" }, { "name": "FunctionName", "value": "VerQueryValueW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75461560" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-04-27 21:05:14,525", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-04-27 21:05:14,525", "thread_id": "6700", "caller": "0x73e1d044", "parentcaller": "0x73e1cfd3", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-04-27 21:05:14,525", "thread_id": "6700", "caller": "0x77261999", "parentcaller": "0x772616ce", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000238" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-04-27 21:05:14,541", "thread_id": "6700", "caller": "0x7726269a", "parentcaller": "0x73e17007", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-04-27 21:05:14,541", "thread_id": "6700", "caller": "0x73e11e78", "parentcaller": "0x73e1d114", "category": "misc", "api": "HeapCreate", "status": true, "return": "0x02910000", "arguments": [ { "name": "Options", "value": "262144" }, { "name": "InitialSize", "value": "0x00000000" }, { "name": "MaximumSize", "value": "0x00000000" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-04-27 21:05:16,010", "thread_id": "6700", "caller": "0x77261d96", "parentcaller": "0x73e1fecf", "category": "__notification__", "api": "sysenter", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadIdentifier", "value": "6700" }, { "name": "Module", "value": "KERNEL32.dll" }, { "name": "Return Address", "value": "0x76ad24ac" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-04-27 21:05:16,385", "thread_id": "6700", "caller": "0x77261d96", "parentcaller": "0x73e1fecf", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\WinSxS\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\\MSVCR80" }, { "name": "DllBase", "value": "0x73740000" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-04-27 21:05:16,385", "thread_id": "6700", "caller": "0x77261d96", "parentcaller": "0x73e1fecf", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks" }, { "name": "DllBase", "value": "0x737e0000" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-04-27 21:05:16,432", "thread_id": "6700", "caller": "0x77e80857", "parentcaller": "0x77e8055f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00a72000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-04-27 21:05:16,432", "thread_id": "6700", "caller": "0x77e80857", "parentcaller": "0x77e8055f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05211000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-04-27 21:05:16,510", "thread_id": "6700", "caller": "0x77e80857", "parentcaller": "0x77e8055f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05212000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-04-27 21:05:16,510", "thread_id": "6700", "caller": "0x7379339d", "parentcaller": "0x73741762", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 165 }, { "timestamp": "2026-04-27 21:05:16,557", "thread_id": "6700", "caller": "0x7726f231", "parentcaller": "0x73741da6", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x76ab0000" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-04-27 21:05:16,557", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.dll" }, { "name": "ModuleHandle", "value": "0x76ab0000" }, { "name": "FunctionName", "value": "FindActCtxSectionStringW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76ac8900" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-04-27 21:05:16,557", "thread_id": "6700", "caller": "0x7726f231", "parentcaller": "0x73741dcd", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "MSCoree.dll" }, { "name": "ModuleHandle", "value": "0x74160000" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-04-27 21:05:16,557", "thread_id": "6700", "caller": "0x7726f231", "parentcaller": "0x73741dd6", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "PGORT80.dll" }, { "name": "ModuleHandle", "value": "0x74160000" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-04-27 21:05:16,557", "thread_id": "6700", "caller": "0x77262ba1", "parentcaller": "0x76ace2b9", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x80\\x00\\x00" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-04-27 21:05:16,557", "thread_id": "6700", "caller": "0x77264429", "parentcaller": "0x76ace2c9", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\WinSxS\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\\msvcr80.dll" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-04-27 21:05:16,572", "thread_id": "6700", "caller": "0x77264566", "parentcaller": "0x76ace434", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x00a5e1d0", "arguments": [ { "name": "FileName", "value": "C:\\Windows" }, { "name": "FirstCreateTimeLow", "value": "0x3a6eea36" }, { "name": "FirstCreateTimeHigh", "value": "0x01ca0431" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-04-27 21:05:16,572", "thread_id": "6700", "caller": "0x77275d68", "parentcaller": "0x76ace44d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-04-27 21:05:16,572", "thread_id": "6700", "caller": "0x77264566", "parentcaller": "0x76ace434", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x00a5e1d0", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\WinSxS" }, { "name": "FirstCreateTimeLow", "value": "0x3a6eea36" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acdd" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-04-27 21:05:16,572", "thread_id": "6700", "caller": "0x77275d68", "parentcaller": "0x76ace44d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-04-27 21:05:16,572", "thread_id": "6700", "caller": "0x77264566", "parentcaller": "0x76ace434", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x00a5e350", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\WinSxS\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\\msvcr80.dll" }, { "name": "FirstCreateTimeLow", "value": "0xf1cf05b4" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acdd" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-04-27 21:05:16,588", "thread_id": "6700", "caller": "0x77275d68", "parentcaller": "0x76ace44d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-04-27 21:05:16,588", "thread_id": "6700", "caller": "0x77262ba1", "parentcaller": "0x76ace569", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-04-27 21:05:16,588", "thread_id": "6700", "caller": "0x7726f231", "parentcaller": "0x73741f08", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x76ab0000" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-04-27 21:05:16,588", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.dll" }, { "name": "ModuleHandle", "value": "0x76ab0000" }, { "name": "FunctionName", "value": "GetSystemWindowsDirectoryW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76ac9500" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-04-27 21:05:16,744", "thread_id": "6700", "caller": "0x7726f231", "parentcaller": "0x73896231", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "mscoree.dll" }, { "name": "ModuleHandle", "value": "0x74160000" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-04-27 21:05:16,744", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "ModuleHandle", "value": "0x74160000" }, { "name": "FunctionName", "value": "GetProcessExecutableHeap" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x74171fa0" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-04-27 21:05:16,744", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "GetProcessExecutableHeap_RetAddr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-04-27 21:05:16,744", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "GetProcessExecutableHeap" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x73e11e60" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-04-27 21:05:16,869", "thread_id": "6700", "caller": "0x77e7007d", "parentcaller": "0x7726648d", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-04-27 21:05:16,869", "thread_id": "6700", "caller": "0x738fbaa0", "parentcaller": "0x7389032d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-04-27 21:05:16,869", "thread_id": "6700", "caller": "0x738fbaa0", "parentcaller": "0x73890395", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x0000024c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 187 }, { "timestamp": "2026-04-27 21:05:16,869", "thread_id": "6700", "caller": "0x73832c2e", "parentcaller": "0x738903bc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000024c" }, { "name": "ValueName", "value": "GCStressStart" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\GCStressStart" } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-04-27 21:05:16,869", "thread_id": "6700", "caller": "0x738903cc", "parentcaller": "0x739176dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-04-27 21:05:16,869", "thread_id": "6700", "caller": "0x738fbaa0", "parentcaller": "0x7389032d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 190 }, { "timestamp": "2026-04-27 21:05:16,869", "thread_id": "6700", "caller": "0x738fbaa0", "parentcaller": "0x73890395", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x0000024c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-04-27 21:05:16,869", "thread_id": "6700", "caller": "0x73832c2e", "parentcaller": "0x738903bc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000024c" }, { "name": "ValueName", "value": "GCStressStartAtJit" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\GCStressStartAtJit" } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-04-27 21:05:16,869", "thread_id": "6700", "caller": "0x738903cc", "parentcaller": "0x739176dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-04-27 21:05:16,869", "thread_id": "6700", "caller": "0x738fbaa0", "parentcaller": "0x7389032d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-04-27 21:05:16,869", "thread_id": "6700", "caller": "0x738fbaa0", "parentcaller": "0x73890395", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x0000024c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-04-27 21:05:16,869", "thread_id": "6700", "caller": "0x73832c2e", "parentcaller": "0x738903bc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000024c" }, { "name": "ValueName", "value": "GCStressStart" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\GCStressStart" } ], "repeated": 0, "id": 196 }, { "timestamp": "2026-04-27 21:05:16,869", "thread_id": "6700", "caller": "0x738903cc", "parentcaller": "0x739176dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 197 }, { "timestamp": "2026-04-27 21:05:16,869", "thread_id": "6700", "caller": "0x738fbaa0", "parentcaller": "0x7389032d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 198 }, { "timestamp": "2026-04-27 21:05:16,869", "thread_id": "6700", "caller": "0x738fbaa0", "parentcaller": "0x73890395", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x0000024c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-04-27 21:05:16,869", "thread_id": "6700", "caller": "0x73832c2e", "parentcaller": "0x738903bc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000024c" }, { "name": "ValueName", "value": "GCStressStartAtJit" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\GCStressStartAtJit" } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-04-27 21:05:16,869", "thread_id": "6700", "caller": "0x738903cc", "parentcaller": "0x739176dd", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-04-27 21:05:16,885", "thread_id": "6700", "caller": "0x77261d96", "parentcaller": "0x73e1fecf", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" }, { "name": "BaseAddress", "value": "0x737e0000" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-04-27 21:05:16,885", "thread_id": "6700", "caller": "0x77261d96", "parentcaller": "0x73e1fecf", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x737e0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" }, { "name": "dwFlags", "value": "0x00000008" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-04-27 21:05:16,885", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "mscorwks.dll" }, { "name": "ModuleHandle", "value": "0x737e0000" }, { "name": "FunctionName", "value": "SetLoadedByMscoree" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-04-27 21:05:16,885", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-04-27 21:05:16,885", "thread_id": "6700", "caller": "0x77261d96", "parentcaller": "0x77266176", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "USER32.dll" }, { "name": "BaseAddress", "value": "0x75d10000" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-04-27 21:05:16,885", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x75d10000" }, { "name": "FunctionName", "value": "GetProcessWindowStation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75d517d0" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-04-27 21:05:16,885", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-04-27 21:05:16,885", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-04-27 21:05:16,885", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x75d10000" }, { "name": "FunctionName", "value": "GetUserObjectInformationW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75d518c0" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-04-27 21:05:16,885", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x73e1ce46", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73e95000" }, { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-04-27 21:05:16,885", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscorwks.dll" }, { "name": "ModuleHandle", "value": "0x737e0000" }, { "name": "FunctionName", "value": "_CorExeMain" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7391877c" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-04-27 21:05:16,885", "thread_id": "6700", "caller": "0x73938391", "parentcaller": "0x739383dd", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 213 }, { "timestamp": "2026-04-27 21:05:16,885", "thread_id": "6700", "caller": "0x7726f231", "parentcaller": "0x73895854", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "mscorwks.dll" }, { "name": "ModuleHandle", "value": "0x737e0000" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-04-27 21:05:16,885", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscorwks.dll" }, { "name": "ModuleHandle", "value": "0x737e0000" }, { "name": "FunctionName", "value": "GetCLRFunction" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x738d08a5" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-04-27 21:05:16,900", "thread_id": "6700", "caller": "0x738fbaa0", "parentcaller": "0x7389032d", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-04-27 21:05:16,900", "thread_id": "6700", "caller": "0x738fbaa0", "parentcaller": "0x73890395", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x0000024c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 217 }, { "timestamp": "2026-04-27 21:05:16,900", "thread_id": "6700", "caller": "0x73832c2e", "parentcaller": "0x738903bc", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000024c" }, { "name": "ValueName", "value": "DisableConfigCache" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\DisableConfigCache" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-04-27 21:05:16,900", "thread_id": "6700", "caller": "0x738903cc", "parentcaller": "0x738955f2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-04-27 21:05:16,900", "thread_id": "6700", "caller": "0x738fbaa0", "parentcaller": "0x73895620", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 220 }, { "timestamp": "2026-04-27 21:05:16,900", "thread_id": "6700", "caller": "0x738fbaa0", "parentcaller": "0x73895620", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework" }, { "name": "Handle", "value": "0x0000024c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-04-27 21:05:16,900", "thread_id": "6700", "caller": "0x738c2bb6", "parentcaller": "0x7389565b", "category": "registry", "api": "RegEnumValueW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" }, { "name": "Index", "value": "0" }, { "name": "ValueName", "value": "InstallRoot" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\InstallRoot" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-04-27 21:05:16,900", "thread_id": "6700", "caller": "0x738c2bb6", "parentcaller": "0x7389565b", "category": "registry", "api": "RegEnumValueW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x0000024c" }, { "name": "Index", "value": "1" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "0", "pretty_value": "REG_NONE" }, { "name": "DataLength", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-04-27 21:05:16,900", "thread_id": "6700", "caller": "0x7726074f", "parentcaller": "0x73a192bb", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "advapi32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-04-27 21:05:16,900", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "RegisterTraceGuidsW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77ea44b0" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-04-27 21:05:16,900", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "UnregisterTraceGuids" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77e99a70" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-04-27 21:05:16,900", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "GetTraceLoggerHandle" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77eac810" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-04-27 21:05:16,900", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "GetTraceEnableLevel" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77eac860" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-04-27 21:05:16,900", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "GetTraceEnableFlags" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77eac890" } ], "repeated": 0, "id": 229 }, { "timestamp": "2026-04-27 21:05:16,900", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x76ea0000" }, { "name": "FunctionName", "value": "TraceEvent" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77f41320" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-04-27 21:05:16,916", "thread_id": "6700", "caller": "0x77e7007d", "parentcaller": "0x7726648d", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 231 }, { "timestamp": "2026-04-27 21:05:16,916", "thread_id": "6700", "caller": "0x77260c1f", "parentcaller": "0x7388c16d", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x00000000" }, { "name": "EventName", "value": "Global\\CLR_PerfMon_StartEnumEvent" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-04-27 21:05:16,963", "thread_id": "6700", "caller": "0x73792866", "parentcaller": "0x738953e7", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 233 }, { "timestamp": "2026-04-27 21:05:17,072", "thread_id": "6700", "caller": "0x77261d96", "parentcaller": "0x73857f86", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "mscoree.dll" }, { "name": "BaseAddress", "value": "0x74160000" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-04-27 21:05:17,072", "thread_id": "6700", "caller": "0x77261d96", "parentcaller": "0x73857f86", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x74160000", "arguments": [ { "name": "lpLibFileName", "value": "mscoree.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-04-27 21:05:17,072", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "ModuleHandle", "value": "0x74160000" }, { "name": "FunctionName", "value": "IEE" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x74172e40" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-04-27 21:05:17,072", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "IEE_RetAddr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-04-27 21:05:17,072", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "IEE" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x73e40c70" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-04-27 21:05:17,072", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscorwks.dll" }, { "name": "ModuleHandle", "value": "0x737e0000" }, { "name": "FunctionName", "value": "IEE" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x738954a8" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-04-27 21:05:17,072", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x7385f357", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x737e2000" }, { "name": "ModuleName", "value": "mscorwks.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000040", "pretty_value": "PAGE_EXECUTE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000020", "pretty_value": "PAGE_EXECUTE_READ" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-04-27 21:05:17,072", "thread_id": "6700", "caller": "0x77274faa", "parentcaller": "0x7385f357", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x737e2000" }, { "name": "ModuleName", "value": "mscorwks.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000020", "pretty_value": "PAGE_EXECUTE_READ" }, { "name": "OldAccessProtection", "value": "0x00000040", "pretty_value": "PAGE_EXECUTE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-04-27 21:05:17,088", "thread_id": "6700", "caller": "0x7726074f", "parentcaller": "0x73894c46", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "mscoree.dll" }, { "name": "ModuleHandle", "value": "0x74160000" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-04-27 21:05:17,088", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "ModuleHandle", "value": "0x74160000" }, { "name": "FunctionName", "value": "GetStartupFlags" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7416ffc0" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-04-27 21:05:17,088", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "GetStartupFlags_RetAddr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-04-27 21:05:17,088", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "GetStartupFlags" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x73e3f5a0" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-04-27 21:05:17,088", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "ModuleHandle", "value": "0x74160000" }, { "name": "FunctionName", "value": "GetHostConfigurationFile" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x74172050" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-04-27 21:05:17,088", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "GetHostConfigurationFile_RetAddr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 247 }, { "timestamp": "2026-04-27 21:05:17,088", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "GetHostConfigurationFile" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x73e3f600" } ], "repeated": 0, "id": 248 }, { "timestamp": "2026-04-27 21:05:17,088", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "GetCORVersion_RetAddr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-04-27 21:05:17,088", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "GetCORVersion" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x73e3e060" } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-04-27 21:05:17,088", "thread_id": "6700", "caller": "0x7726074f", "parentcaller": "0x73894634", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "mscoree.dll" }, { "name": "ModuleHandle", "value": "0x74160000" } ], "repeated": 0, "id": 251 }, { "timestamp": "2026-04-27 21:05:17,088", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "MSCOREE.DLL" }, { "name": "ModuleHandle", "value": "0x74160000" }, { "name": "FunctionName", "value": "GetCORSystemDirectory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x741708b0" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-04-27 21:05:17,088", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "GetCORSystemDirectory_RetAddr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x73e3f300" } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-04-27 21:05:17,088", "thread_id": "6700", "caller": "0x73e17a31", "parentcaller": "0x73e523f8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\.NETFramework\\Policy\\AppPatch" }, { "name": "Handle", "value": "0x00000240" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\.NETFramework\\Policy\\AppPatch" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-04-27 21:05:17,103", "thread_id": "6700", "caller": "0x77277bae", "parentcaller": "0x73e52c0b", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319" } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-04-27 21:05:17,103", "thread_id": "6700", "caller": "0x73e17a31", "parentcaller": "0x73e523f8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000240" }, { "name": "SubKey", "value": "v4.0.30319.00000" }, { "name": "Handle", "value": "0x00000224" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\policy\\AppPatch\\v4.0.30319.00000" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-04-27 21:05:17,103", "thread_id": "6700", "caller": "0x73e1760b", "parentcaller": "0x73e50f0e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-04-27 21:05:17,103", "thread_id": "6700", "caller": "0x73e17a31", "parentcaller": "0x73e523f8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000224" }, { "name": "SubKey", "value": "mscorwks.dll" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\.NETFramework\\policy\\AppPatch\\v4.0.30319.00000\\mscorwks.dll" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-04-27 21:05:17,103", "thread_id": "6700", "caller": "0x73e1760b", "parentcaller": "0x73e50b0a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000224" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-04-27 21:05:17,166", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "CreateConfigStream_RetAddr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-04-27 21:05:17,166", "thread_id": "6700", "caller": "0x7726978d", "parentcaller": "0x76acf564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "mscoreei.dll" }, { "name": "ModuleHandle", "value": "0x73e10000" }, { "name": "FunctionName", "value": "CreateConfigStream" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x73e196a0" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-04-27 21:05:17,228", "thread_id": "6700", "caller": "0x77261999", "parentcaller": "0x772616ce", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000224" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-04-27 21:05:17,228", "thread_id": "6700", "caller": "0x77e80857", "parentcaller": "0x77e8055f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00a73000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-04-27 21:05:17,244", "thread_id": "6700", "caller": "0x7726249c", "parentcaller": "0x73e11df9", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000224" }, { "name": "HandleName", "value": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config" }, { "name": "Buffer", "value": "