Exes_be99e3d9cec624afe102e52ddb8be793_1_2019-06-27_20_30.json

[*] MalFamily: "Shade"

[*] MalScore: 10.0

[*] File Name: "Exes_be99e3d9cec624afe102e52ddb8be793.1"
[*] File Size: 1186056
[*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
[*] SHA256: "dfa8f8fa060226161b3f4a00844196cb883e274d22f6623196553c41244a93fc"
[*] MD5: "be99e3d9cec624afe102e52ddb8be793"
[*] SHA1: "f28bc0e2cfbe1f0e11317e19318334e50016794b"
[*] SHA512: "9c416206c4fd843b6b3e8530c53eed098a7246b9f8bc3916d745c73cc65766b9bd217ae644234cb106a5feb2a8206696aa571e68ecc543636aeb1e7e64541731"
[*] CRC32: "DAE12605"
[*] SSDEEP: "24576:0HtrdKYVVSrqGDohJ3STZG8vIn/sCBGnWsY03+T:0HtV7GwBSTc8An/4YJT"

[*] Process Execution: [
    "Exes_be99e3d9cec624afe102e52ddb8be793.1"
]

[*] Signatures Detected: [
    {
        "Description": "Creates RWX memory",
        "Details": []
    },
    {
        "Description": "Attempts to connect to a dead IP:Port (6 unique times)",
        "Details": [
            {
                "IP": "62.210.177.181:8080"
            },
            {
                "IP": "128.31.0.39:9101"
            },
            {
                "IP": "131.188.40.189:443"
            },
            {
                "IP": "80.127.137.14:443"
            },
            {
                "IP": "88.198.17.248:8443"
            },
            {
                "IP": "159.69.36.3:8080"
            }
        ]
    },
    {
        "Description": "Starts servers listening on 127.0.0.1:44717",
        "Details": []
    },
    {
        "Description": "Reads data out of its own binary image",
        "Details": [
            {
                "self_read": "process: Exes_be99e3d9cec624afe102e52ddb8be793.1, pid: 2384, offset: 0x00000000, length: 0x00121908"
            }
        ]
    },
    {
        "Description": "The binary likely contains encrypted or compressed data.",
        "Details": [
            {
                "section": "name: .text, entropy: 7.12, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00113200, virtual_size: 0x00113184"
            },
            {
                "section": "name: .rsrc, entropy: 7.29, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x0000a200, virtual_size: 0x000ed1c0"
            }
        ]
    },
    {
        "Description": "Installs Tor on the infected machine",
        "Details": []
    },
    {
        "Description": "Installs itself for autorun at Windows startup",
        "Details": [
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem"
            },
            {
                "data": "\"C:\\ProgramData\\Windows\\csrss.exe\""
            }
        ]
    },
    {
        "Description": "Collects information about installed applications",
        "Details": [
            {
                "Program": "Google Update Helper"
            },
            {
            },
            {
                "Program": "Microsoft Excel MUI  2013"
            },
            {
                "Program": "Microsoft Outlook MUI  2013"
            },
            {
            },
            {
                "Program": "Google Chrome"
            },
            {
                "Program": "Adobe Flash Player 29 NPAPI"
            },
            {
                "Program": "Adobe Flash Player 29 ActiveX"
            },
            {
                "Program": "Microsoft DCF MUI  2013"
            },
            {
                "Program": "Microsoft Access MUI  2013"
            },
            {
                "Program": "Microsoft Office Proofing Tools 2013 - English"
            },
            {
                "Program": "Adobe Acrobat Reader DC"
            },
            {
                "Program": "Microsoft Publisher MUI  2013"
            },
            {
                "Program": "Microsoft Office Shared MUI  2013"
            },
            {
                "Program": "Microsoft Office OSM MUI  2013"
            },
            {
                "Program": "Microsoft InfoPath MUI  2013"
            },
            {
                "Program": "Microsoft Office Shared Setup Metadata MUI  2013"
            },
            {
                "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
            },
            {
                "Program": "Microsoft Word MUI  2013"
            },
            {
                "Program": "Microsoft OneDrive"
            },
            {
                "Program": "Microsoft Groove MUI  2013"
            },
            {
                "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
            },
            {
            },
            {
                "Program": "Microsoft Access Setup Metadata MUI  2013"
            },
            {
                "Program": "Microsoft Office OSM UX MUI  2013"
            },
            {
                "Program": "Java Auto Updater"
            },
            {
                "Program": "Microsoft PowerPoint MUI  2013"
            },
            {
                "Program": "Microsoft Office Professional Plus 2013"
            },
            {
                "Program": "Adobe Refresh Manager"
            },
            {
                "Program": "Microsoft Office Proofing  2013"
            },
            {
                "Program": "Microsoft Lync MUI  2013"
            },
            {
            },
            {
                "Program": "Microsoft OneNote MUI  2013"
            }
        ]
    },
    {
        "Description": "Creates a hidden or system file",
        "Details": [
            {
                "file": "C:\\ProgramData\\Windows\\"
            }
        ]
    },
    {
        "Description": "File has been identified by 54 Antiviruses on VirusTotal as malicious",
        "Details": [
            {
                "MicroWorld-eScan": "Trojan.GenericKD.31712355"
            },
            {
                "FireEye": "Generic.mg.be99e3d9cec624af"
            },
            {
                "CAT-QuickHeal": "Ransom.Vigorf"
            },
            {
                "McAfee": "Trojan-FQSD!BE99E3D9CEC6"
            },
            {
                "Zillya": "Trojan.Shade.Win32.1052"
            },
            {
                "CrowdStrike": "win/malicious_confidence_100% (W)"
            },
            {
                "BitDefender": "Trojan.GenericKD.31712355"
            },
            {
                "K7GW": "Trojan ( 005486271 )"
            },
            {
                "K7AntiVirus": "Trojan ( 005486271 )"
            },
            {
                "TrendMicro": "Ransom.Win32.SHADE.THBBHAI"
            },
            {
                "NANO-Antivirus": "Trojan.Win32.Shade.fnghyj"
            },
            {
                "Cyren": "W32/Trojan.ZKKX-0640"
            },
            {
                "Symantec": "Downloader"
            },
            {
                "APEX": "Malicious"
            },
            {
                "Paloalto": "generic.ml"
            },
            {
                "Kaspersky": "HEUR:Trojan.Win32.Generic"
            },
            {
                "Alibaba": "Ransom:Win32/Shade.44a1481a"
            },
            {
                "ViRobot": "Trojan.Win32.Ransom.1186056"
            },
            {
                "AegisLab": "Trojan.Win32.Shade.4!c"
            },
            {
                "Tencent": "Win32.Trojan.Falsesign.Pjdp"
            },
            {
                "Ad-Aware": "Trojan.GenericKD.31712355"
            },
            {
                "Emsisoft": "Trojan-Ransom.Shade (A)"
            },
            {
                "Comodo": "Malware@#npeim2up6cv9"
            },
            {
                "F-Secure": "Trojan.TR/Crypt.Agent.rgiui"
            },
            {
                "DrWeb": "Trojan.Encoder.26818"
            },
            {
                "Invincea": "heuristic"
            },
            {
                "McAfee-GW-Edition": "Trojan-FQSD!BE99E3D9CEC6"
            },
            {
                "Sophos": "Mal/Cerber-AL"
            },
            {
                "SentinelOne": "DFI - Malicious PE"
            },
            {
                "F-Prot": "W32/Ransom.KY.gen!Eldorado"
            },
            {
                "Endgame": "malicious (high confidence)"
            },
            {
                "Webroot": "W32.Trojan.Gen"
            },
            {
                "Avira": "TR/Crypt.Agent.rgiui"
            },
            {
                "Fortinet": "W32/Kryptik.GQEV!tr"
            },
            {
                "Antiy-AVL": "Trojan/Win32.SGeneric"
            },
            {
                "Arcabit": "Trojan.Generic.D1E3E463"
            },
            {
                "AhnLab-V3": "Trojan/Win32.RL_Shade.R274732"
            },
            {
                "ZoneAlarm": "HEUR:Trojan.Win32.Generic"
            },
            {
                "Microsoft": "Ransom:Win32/Shade.B!bit"
            },
            {
                "ESET-NOD32": "a variant of Win32/Kryptik.GPYH"
            },
            {
                "Acronis": "suspicious"
            },
            {
                "VBA32": "BScope.Malware-Cryptor.Filecoder"
            },
            {
                "ALYac": "Trojan.GenericKD.31712355"
            },
            {
                "Cylance": "Unsafe"
            },
            {
                "Panda": "Trj/GdSda.A"
            },
            {
                "TrendMicro-HouseCall": "Ransom.Win32.SHADE.THBBHAI"
            },
            {
                "Rising": "Ransom.Cerber!8.3058 (CLOUD)"
            },
            {
                "Yandex": "Trojan.Shade!"
            },
            {
                "Ikarus": "Trojan-Ransom.Crypted007"
            },
            {
                "GData": "Trojan.GenericKD.31712355"
            },
            {
                "AVG": "Win32:RansomX-gen [Ransom]"
            },
            {
                "Cybereason": "malicious.9cec62"
            },
            {
                "Avast": "Win32:RansomX-gen [Ransom]"
            },
            {
                "Qihoo-360": "Win32/Trojan.Ransom.3e9"
            }
        ]
    },
    {
        "Description": "Creates a copy of itself",
        "Details": [
            {
                "copy": "C:\\ProgramData\\Windows\\csrss.exe"
            }
        ]
    },
    {
        "Description": "Harvests information related to installed mail clients",
        "Details": [
            {
                "file": "C:\\Users\\user\\Documents\\Outlook Files\\Outlook.pst"
            }
        ]
    },
    {
        "Description": "Anomalous binary characteristics",
        "Details": [
            {
                "anomaly": "Actual checksum does not match that reported in PE header"
            }
        ]
    },
    {
        "Description": "Created network traffic indicative of malicious activity",
        "Details": [
            {
                "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 650"
            },
            {
                "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 121"
            },
            {
                "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 536"
            },
            {
                "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 590"
            },
            {
                "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 168"
            }
        ]
    }
]

[*] Started Service: []

[*] Executed Commands: []

[*] Mutexes: []

[*] Modified Files: [
    "\\??\\PIPE\\wkssvc",
    "C:\\ProgramData\\Windows\\csrss.exe",
    "\\??\\PIPE\\srvsvc",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\lock",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus"
]

[*] Deleted Files: [
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp"
]

[*] Modified Registry Keys: [
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\System32\\Configuration\\",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xi",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xVersion"
]

[*] Deleted Registry Keys: []

[*] DNS Communications: []

[*] Domains: []

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: []

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "GetStartupInfoA",
                        "address": "0x51512c"
                    },
                    {
                        "name": "GetStdHandle",
                        "address": "0x515130"
                    },
                    {
                        "name": "GetStringTypeA",
                        "address": "0x515134"
                    },
                    {
                        "name": "GetStringTypeW",
                        "address": "0x515138"
                    },
                    {
                        "name": "GetSystemInfo",
                        "address": "0x51513c"
                    },
                    {
                        "name": "GetSystemTimeAsFileTime",
                        "address": "0x515140"
                    },
                    {
                        "name": "GetTempFileNameA",
                        "address": "0x515144"
                    },
                    {
                        "name": "GetTempFileNameW",
                        "address": "0x515148"
                    },
                    {
                        "name": "GetTempPathA",
                        "address": "0x51514c"
                    },
                    {
                        "name": "GetTickCount",
                        "address": "0x515150"
                    },
                    {
                        "name": "GetTimeFormatA",
                        "address": "0x515154"
                    },
                    {
                        "name": "GetTimeFormatW",
                        "address": "0x515158"
                    },
                    {
                        "name": "GetTimeZoneInformation",
                        "address": "0x51515c"
                    },
                    {
                        "name": "GetUserDefaultLCID",
                        "address": "0x515160"
                    },
                    {
                        "name": "GetVersionExA",
                        "address": "0x515164"
                    },
                    {
                        "name": "GetVolumeInformationA",
                        "address": "0x515168"
                    },
                    {
                        "name": "GetVolumeInformationW",
                        "address": "0x51516c"
                    },
                    {
                        "name": "GetVolumeNameForVolumeMountPointW",
                        "address": "0x515170"
                    },
                    {
                        "name": "GlobalAddAtomA",
                        "address": "0x515174"
                    },
                    {
                        "name": "GlobalAlloc",
                        "address": "0x515178"
                    },
                    {
                        "name": "GlobalDeleteAtom",
                        "address": "0x51517c"
                    },
                    {
                        "name": "GlobalFindAtomA",
                        "address": "0x515180"
                    },
                    {
                        "name": "GlobalFlags",
                        "address": "0x515184"
                    },
                    {
                        "name": "GlobalFree",
                        "address": "0x515188"
                    },
                    {
                        "name": "GlobalGetAtomNameA",
                        "address": "0x51518c"
                    },
                    {
                        "name": "GlobalHandle",
                        "address": "0x515190"
                    },
                    {
                        "name": "GlobalLock",
                        "address": "0x515194"
                    },
                    {
                        "name": "GlobalMemoryStatus",
                        "address": "0x515198"
                    },
                    {
                        "name": "GlobalReAlloc",
                        "address": "0x51519c"
                    },
                    {
                        "name": "GlobalSize",
                        "address": "0x5151a0"
                    },
                    {
                        "name": "GlobalUnlock",
                        "address": "0x5151a4"
                    },
                    {
                        "name": "HeapAlloc",
                        "address": "0x5151a8"
                    },
                    {
                        "name": "HeapCreate",
                        "address": "0x5151ac"
                    },
                    {
                        "name": "HeapFree",
                        "address": "0x5151b0"
                    },
                    {
                        "name": "HeapReAlloc",
                        "address": "0x5151b4"
                    },
                    {
                        "name": "HeapSize",
                        "address": "0x5151b8"
                    },
                    {
                        "name": "InitializeCriticalSection",
                        "address": "0x5151bc"
                    },
                    {
                        "name": "InitializeCriticalSectionAndSpinCount",
                        "address": "0x5151c0"
                    },
                    {
                        "name": "InterlockedCompareExchange",
                        "address": "0x5151c4"
                    },
                    {
                        "name": "InterlockedDecrement",
                        "address": "0x5151c8"
                    },
                    {
                        "name": "InterlockedExchange",
                        "address": "0x5151cc"
                    },
                    {
                        "name": "InterlockedIncrement",
                        "address": "0x5151d0"
                    },
                    {
                        "name": "IsDBCSLeadByte",
                        "address": "0x5151d4"
                    },
                    {
                        "name": "IsDebuggerPresent",
                        "address": "0x5151d8"
                    },
                    {
                        "name": "IsValidCodePage",
                        "address": "0x5151dc"
                    },
                    {
                        "name": "IsValidLocale",
                        "address": "0x5151e0"
                    },
                    {
                        "name": "LCMapStringA",
                        "address": "0x5151e4"
                    },
                    {
                        "name": "LCMapStringW",
                        "address": "0x5151e8"
                    },
                    {
                        "name": "LeaveCriticalSection",
                        "address": "0x5151ec"
                    },
                    {
                        "name": "LoadLibraryA",
                        "address": "0x5151f0"
                    },
                    {
                        "name": "LoadLibraryExA",
                        "address": "0x5151f4"
                    },
                    {
                        "name": "LoadLibraryW",
                        "address": "0x5151f8"
                    },
                    {
                        "name": "LoadResource",
                        "address": "0x5151fc"
                    },
                    {
                        "name": "LocalAlloc",
                        "address": "0x515200"
                    },
                    {
                        "name": "LocalFree",
                        "address": "0x515204"
                    },
                    {
                        "name": "LocalReAlloc",
                        "address": "0x515208"
                    },
                    {
                        "name": "LockFile",
                        "address": "0x51520c"
                    },
                    {
                        "name": "LockResource",
                        "address": "0x515210"
                    },
                    {
                        "name": "MapViewOfFile",
                        "address": "0x515214"
                    },
                    {
                        "name": "GetShortPathNameA",
                        "address": "0x515218"
                    },
                    {
                        "name": "OpenEventA",
                        "address": "0x51521c"
                    },
                    {
                        "name": "OpenFileMappingA",
                        "address": "0x515220"
                    },
                    {
                        "name": "OpenProcess",
                        "address": "0x515224"
                    },
                    {
                        "name": "OutputDebugStringA",
                        "address": "0x515228"
                    },
                    {
                        "name": "PulseEvent",
                        "address": "0x51522c"
                    },
                    {
                        "name": "QueryPerformanceCounter",
                        "address": "0x515230"
                    },
                    {
                        "name": "RaiseException",
                        "address": "0x515234"
                    },
                    {
                        "name": "ReadFile",
                        "address": "0x515238"
                    },
                    {
                        "name": "ReleaseMutex",
                        "address": "0x51523c"
                    },
                    {
                        "name": "ReleaseSemaphore",
                        "address": "0x515240"
                    },
                    {
                        "name": "ResetEvent",
                        "address": "0x515244"
                    },
                    {
                        "name": "RtlUnwind",
                        "address": "0x515248"
                    },
                    {
                        "name": "SetConsoleCtrlHandler",
                        "address": "0x51524c"
                    },
                    {
                        "name": "SetEndOfFile",
                        "address": "0x515250"
                    },
                    {
                        "name": "SetEnvironmentVariableA",
                        "address": "0x515254"
                    },
                    {
                        "name": "SetErrorMode",
                        "address": "0x515258"
                    },
                    {
                        "name": "SetEvent",
                        "address": "0x51525c"
                    },
                    {
                        "name": "SetFileAttributesA",
                        "address": "0x515260"
                    },
                    {
                        "name": "SetFilePointer",
                        "address": "0x515264"
                    },
                    {
                        "name": "SetHandleCount",
                        "address": "0x515268"
                    },
                    {
                        "name": "SetLastError",
                        "address": "0x51526c"
                    },
                    {
                        "name": "SetStdHandle",
                        "address": "0x515270"
                    },
                    {
                        "name": "SetThreadIdealProcessor",
                        "address": "0x515274"
                    },
                    {
                        "name": "SetThreadUILanguage",
                        "address": "0x515278"
                    },
                    {
                        "name": "SetUnhandledExceptionFilter",
                        "address": "0x51527c"
                    },
                    {
                        "name": "SizeofResource",
                        "address": "0x515280"
                    },
                    {
                        "name": "Sleep",
                        "address": "0x515284"
                    },
                    {
                        "name": "TerminateProcess",
                        "address": "0x515288"
                    },
                    {
                        "name": "TerminateThread",
                        "address": "0x51528c"
                    },
                    {
                        "name": "Thread32Next",
                        "address": "0x515290"
                    },
                    {
                        "name": "TlsAlloc",
                        "address": "0x515294"
                    },
                    {
                        "name": "TlsFree",
                        "address": "0x515298"
                    },
                    {
                        "name": "TlsGetValue",
                        "address": "0x51529c"
                    },
                    {
                        "name": "TlsSetValue",
                        "address": "0x5152a0"
                    },
                    {
                        "name": "UnhandledExceptionFilter",
                        "address": "0x5152a4"
                    },
                    {
                        "name": "UnlockFile",
                        "address": "0x5152a8"
                    },
                    {
                        "name": "UnmapViewOfFile",
                        "address": "0x5152ac"
                    },
                    {
                        "name": "VirtualAlloc",
                        "address": "0x5152b0"
                    },
                    {
                        "name": "VirtualFree",
                        "address": "0x5152b4"
                    },
                    {
                        "name": "VirtualProtect",
                        "address": "0x5152b8"
                    },
                    {
                        "name": "VirtualQuery",
                        "address": "0x5152bc"
                    },
                    {
                        "name": "WaitForMultipleObjects",
                        "address": "0x5152c0"
                    },
                    {
                        "name": "WaitForSingleObject",
                        "address": "0x5152c4"
                    },
                    {
                        "name": "WideCharToMultiByte",
                        "address": "0x5152c8"
                    },
                    {
                        "name": "WriteConsoleA",
                        "address": "0x5152cc"
                    },
                    {
                        "name": "WriteConsoleW",
                        "address": "0x5152d0"
                    },
                    {
                        "name": "WriteFile",
                        "address": "0x5152d4"
                    },
                    {
                        "name": "WriteProfileStringW",
                        "address": "0x5152d8"
                    },
                    {
                        "name": "lstrcatW",
                        "address": "0x5152dc"
                    },
                    {
                        "name": "lstrcmpA",
                        "address": "0x5152e0"
                    },
                    {
                        "name": "lstrcmpW",
                        "address": "0x5152e4"
                    },
                    {
                        "name": "lstrcmpiA",
                        "address": "0x5152e8"
                    },
                    {
                        "name": "lstrcpyA",
                        "address": "0x5152ec"
                    },
                    {
                        "name": "lstrcpyW",
                        "address": "0x5152f0"
                    },
                    {
                        "name": "lstrcpynA",
                        "address": "0x5152f4"
                    },
                    {
                        "name": "lstrcpynW",
                        "address": "0x5152f8"
                    },
                    {
                        "name": "lstrlenA",
                        "address": "0x5152fc"
                    },
                    {
                        "name": "lstrlenW",
                        "address": "0x515300"
                    },
                    {
                        "name": "GetProcessHeap",
                        "address": "0x515304"
                    },
                    {
                        "name": "GetProcAddress",
                        "address": "0x515308"
                    },
                    {
                        "name": "GetOEMCP",
                        "address": "0x51530c"
                    },
                    {
                        "name": "GetModuleHandleW",
                        "address": "0x515310"
                    },
                    {
                        "name": "GetModuleHandleA",
                        "address": "0x515314"
                    },
                    {
                        "name": "GetModuleFileNameA",
                        "address": "0x515318"
                    },
                    {
                        "name": "GetLocaleInfoW",
                        "address": "0x51531c"
                    },
                    {
                        "name": "CloseHandle",
                        "address": "0x515320"
                    },
                    {
                        "name": "GetLocaleInfoA",
                        "address": "0x515324"
                    },
                    {
                        "name": "GetLastError",
                        "address": "0x515328"
                    },
                    {
                        "name": "GetFullPathNameA",
                        "address": "0x51532c"
                    },
                    {
                        "name": "GetFileType",
                        "address": "0x515330"
                    },
                    {
                        "name": "GetFileTime",
                        "address": "0x515334"
                    },
                    {
                        "name": "GetFileSizeEx",
                        "address": "0x515338"
                    },
                    {
                        "name": "GetFileSize",
                        "address": "0x51533c"
                    },
                    {
                        "name": "GetFileAttributesExA",
                        "address": "0x515340"
                    },
                    {
                        "name": "GetFileAttributesA",
                        "address": "0x515344"
                    },
                    {
                        "name": "GetExitCodeThread",
                        "address": "0x515348"
                    },
                    {
                        "name": "GetEnvironmentStringsW",
                        "address": "0x51534c"
                    },
                    {
                        "name": "GetEnvironmentStrings",
                        "address": "0x515350"
                    },
                    {
                        "name": "GetDriveTypeW",
                        "address": "0x515354"
                    },
                    {
                        "name": "GetDateFormatW",
                        "address": "0x515358"
                    },
                    {
                        "name": "GetDateFormatA",
                        "address": "0x51535c"
                    },
                    {
                        "name": "GetCurrentThreadId",
                        "address": "0x515360"
                    },
                    {
                        "name": "GetCurrentThread",
                        "address": "0x515364"
                    },
                    {
                        "name": "GetCurrentProcessId",
                        "address": "0x515368"
                    },
                    {
                        "name": "GetCurrentProcess",
                        "address": "0x51536c"
                    },
                    {
                        "name": "GetConsoleOutputCP",
                        "address": "0x515370"
                    },
                    {
                        "name": "GetConsoleMode",
                        "address": "0x515374"
                    },
                    {
                        "name": "GetConsoleCP",
                        "address": "0x515378"
                    },
                    {
                        "name": "GetCommandLineA",
                        "address": "0x51537c"
                    },
                    {
                        "name": "GetCommMask",
                        "address": "0x515380"
                    },
                    {
                        "name": "GetCommConfig",
                        "address": "0x515384"
                    },
                    {
                        "name": "GetCPInfo",
                        "address": "0x515388"
                    },
                    {
                        "name": "GetACP",
                        "address": "0x51538c"
                    },
                    {
                        "name": "FreeLibrary",
                        "address": "0x515390"
                    },
                    {
                        "name": "FreeEnvironmentStringsW",
                        "address": "0x515394"
                    },
                    {
                        "name": "FreeEnvironmentStringsA",
                        "address": "0x515398"
                    },
                    {
                        "name": "FormatMessageW",
                        "address": "0x51539c"
                    },
                    {
                        "name": "FormatMessageA",
                        "address": "0x5153a0"
                    },
                    {
                        "name": "FlushFileBuffers",
                        "address": "0x5153a4"
                    },
                    {
                        "name": "FindResourceA",
                        "address": "0x5153a8"
                    },
                    {
                        "name": "FindNextChangeNotification",
                        "address": "0x5153ac"
                    },
                    {
                        "name": "FindFirstFileA",
                        "address": "0x5153b0"
                    },
                    {
                        "name": "FindFirstChangeNotificationA",
                        "address": "0x5153b4"
                    },
                    {
                        "name": "FindCloseChangeNotification",
                        "address": "0x5153b8"
                    },
                    {
                        "name": "FindClose",
                        "address": "0x5153bc"
                    },
                    {
                        "name": "FileTimeToSystemTime",
                        "address": "0x5153c0"
                    },
                    {
                        "name": "FileTimeToLocalFileTime",
                        "address": "0x5153c4"
                    },
                    {
                        "name": "FileTimeToDosDateTime",
                        "address": "0x5153c8"
                    },
                    {
                        "name": "ExpandEnvironmentStringsW",
                        "address": "0x5153cc"
                    },
                    {
                        "name": "ExitThread",
                        "address": "0x5153d0"
                    },
                    {
                        "name": "ExitProcess",
                        "address": "0x5153d4"
                    },
                    {
                        "name": "EnumSystemLocalesA",
                        "address": "0x5153d8"
                    },
                    {
                        "name": "EnterCriticalSection",
                        "address": "0x5153dc"
                    },
                    {
                        "name": "DuplicateHandle",
                        "address": "0x5153e0"
                    },
                    {
                        "name": "DeviceIoControl",
                        "address": "0x5153e4"
                    },
                    {
                        "name": "DeleteFileW",
                        "address": "0x5153e8"
                    },
                    {
                        "name": "DeleteFileA",
                        "address": "0x5153ec"
                    },
                    {
                        "name": "DeleteCriticalSection",
                        "address": "0x5153f0"
                    },
                    {
                        "name": "CreateThread",
                        "address": "0x5153f4"
                    },
                    {
                        "name": "CreateSemaphoreW",
                        "address": "0x5153f8"
                    },
                    {
                        "name": "CreateProcessA",
                        "address": "0x5153fc"
                    },
                    {
                        "name": "CreateMutexA",
                        "address": "0x515400"
                    },
                    {
                        "name": "CreateMailslotA",
                        "address": "0x515404"
                    },
                    {
                        "name": "CreateFileW",
                        "address": "0x515408"
                    },
                    {
                        "name": "CreateFileMappingA",
                        "address": "0x51540c"
                    },
                    {
                        "name": "CreateFileA",
                        "address": "0x515410"
                    },
                    {
                        "name": "CreateEventW",
                        "address": "0x515414"
                    },
                    {
                        "name": "CreateEventA",
                        "address": "0x515418"
                    },
                    {
                        "name": "CreateDirectoryA",
                        "address": "0x51541c"
                    },
                    {
                        "name": "CopyFileA",
                        "address": "0x515420"
                    },
                    {
                        "name": "CompareStringW",
                        "address": "0x515424"
                    },
                    {
                        "name": "CompareStringA",
                        "address": "0x515428"
                    },
                    {
                        "name": "MultiByteToWideChar",
                        "address": "0x51542c"
                    }
                ],
                "dll": "KERNEL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "SetForegroundWindow",
                        "address": "0x515434"
                    },
                    {
                        "name": "SetMenu",
                        "address": "0x515438"
                    },
                    {
                        "name": "SetMenuItemBitmaps",
                        "address": "0x51543c"
                    },
                    {
                        "name": "SetPropA",
                        "address": "0x515440"
                    },
                    {
                        "name": "SetTimer",
                        "address": "0x515444"
                    },
                    {
                        "name": "SetWindowLongA",
                        "address": "0x515448"
                    },
                    {
                        "name": "SetWindowPos",
                        "address": "0x51544c"
                    },
                    {
                        "name": "SetWindowTextA",
                        "address": "0x515450"
                    },
                    {
                        "name": "SetWindowsHookExA",
                        "address": "0x515454"
                    },
                    {
                        "name": "SystemParametersInfoA",
                        "address": "0x515458"
                    },
                    {
                        "name": "TabbedTextOutA",
                        "address": "0x51545c"
                    },
                    {
                        "name": "UnhookWindowsHookEx",
                        "address": "0x515460"
                    },
                    {
                        "name": "ValidateRect",
                        "address": "0x515464"
                    },
                    {
                        "name": "WinHelpA",
                        "address": "0x515468"
                    },
                    {
                        "name": "wsprintfA",
                        "address": "0x51546c"
                    },
                    {
                        "name": "wvsprintfA",
                        "address": "0x515470"
                    },
                    {
                        "name": "WindowFromDC",
                        "address": "0x515474"
                    },
                    {
                        "name": "LoadCursorFromFileA",
                        "address": "0x515478"
                    },
                    {
                        "name": "GetClipboardData",
                        "address": "0x51547c"
                    },
                    {
                        "name": "InSendMessage",
                        "address": "0x515480"
                    },
                    {
                        "name": "IsMenu",
                        "address": "0x515484"
                    },
                    {
                        "name": "DestroyIcon",
                        "address": "0x515488"
                    },
                    {
                        "name": "CharLowerW",
                        "address": "0x51548c"
                    },
                    {
                        "name": "GetMenuContextHelpId",
                        "address": "0x515490"
                    },
                    {
                        "name": "VkKeyScanA",
                        "address": "0x515494"
                    },
                    {
                        "name": "CountClipboardFormats",
                        "address": "0x515498"
                    },
                    {
                        "name": "IsCharAlphaA",
                        "address": "0x51549c"
                    },
                    {
                        "name": "IsCharAlphaNumericA",
                        "address": "0x5154a0"
                    },
                    {
                        "name": "GetProcessWindowStation",
                        "address": "0x5154a4"
                    },
                    {
                        "name": "IsWindowUnicode",
                        "address": "0x5154a8"
                    },
                    {
                        "name": "GetKeyboardLayout",
                        "address": "0x5154ac"
                    },
                    {
                        "name": "VkKeyScanW",
                        "address": "0x5154b0"
                    },
                    {
                        "name": "GetActiveWindow",
                        "address": "0x5154b4"
                    },
                    {
                        "name": "GetKBCodePage",
                        "address": "0x5154b8"
                    },
                    {
                        "name": "GetClipboardOwner",
                        "address": "0x5154bc"
                    },
                    {
                        "name": "GetAsyncKeyState",
                        "address": "0x5154c0"
                    },
                    {
                        "name": "DestroyCursor",
                        "address": "0x5154c4"
                    },
                    {
                        "name": "CloseClipboard",
                        "address": "0x5154c8"
                    },
                    {
                        "name": "PaintDesktop",
                        "address": "0x5154cc"
                    },
                    {
                        "name": "GetInputState",
                        "address": "0x5154d0"
                    },
                    {
                        "name": "GetCursor",
                        "address": "0x5154d4"
                    },
                    {
                        "name": "CloseDesktop",
                        "address": "0x5154d8"
                    },
                    {
                        "name": "ReleaseCapture",
                        "address": "0x5154dc"
                    },
                    {
                        "name": "EnumClipboardFormats",
                        "address": "0x5154e0"
                    },
                    {
                        "name": "GetWindowContextHelpId",
                        "address": "0x5154e4"
                    },
                    {
                        "name": "GetWindowTextLengthA",
                        "address": "0x5154e8"
                    },
                    {
                        "name": "GetClipboardViewer",
                        "address": "0x5154ec"
                    },
                    {
                        "name": "GetThreadDesktop",
                        "address": "0x5154f0"
                    },
                    {
                        "name": "IsCharAlphaW",
                        "address": "0x5154f4"
                    },
                    {
                        "name": "AnyPopup",
                        "address": "0x5154f8"
                    },
                    {
                        "name": "CharUpperW",
                        "address": "0x5154fc"
                    },
                    {
                        "name": "IsCharLowerW",
                        "address": "0x515500"
                    },
                    {
                        "name": "IsClipboardFormatAvailable",
                        "address": "0x515504"
                    },
                    {
                        "name": "GetQueueStatus",
                        "address": "0x515508"
                    },
                    {
                        "name": "CloseWindow",
                        "address": "0x51550c"
                    },
                    {
                        "name": "GetDialogBaseUnits",
                        "address": "0x515510"
                    },
                    {
                        "name": "OemKeyScan",
                        "address": "0x515514"
                    },
                    {
                        "name": "SendMessageA",
                        "address": "0x515518"
                    },
                    {
                        "name": "RemovePropA",
                        "address": "0x51551c"
                    },
                    {
                        "name": "ReleaseDC",
                        "address": "0x515520"
                    },
                    {
                        "name": "RegisterWindowMessageA",
                        "address": "0x515524"
                    },
                    {
                        "name": "RegisterClassA",
                        "address": "0x515528"
                    },
                    {
                        "name": "PtInRect",
                        "address": "0x51552c"
                    },
                    {
                        "name": "PostThreadMessageA",
                        "address": "0x515530"
                    },
                    {
                        "name": "PostQuitMessage",
                        "address": "0x515534"
                    },
                    {
                        "name": "PostMessageA",
                        "address": "0x515538"
                    },
                    {
                        "name": "PeekMessageA",
                        "address": "0x51553c"
                    },
                    {
                        "name": "ModifyMenuA",
                        "address": "0x515540"
                    },
                    {
                        "name": "MessageBoxA",
                        "address": "0x515544"
                    },
                    {
                        "name": "MapWindowPoints",
                        "address": "0x515548"
                    },
                    {
                        "name": "LoadStringA",
                        "address": "0x51554c"
                    },
                    {
                        "name": "LoadIconA",
                        "address": "0x515550"
                    },
                    {
                        "name": "LoadCursorA",
                        "address": "0x515554"
                    },
                    {
                        "name": "LoadBitmapA",
                        "address": "0x515558"
                    },
                    {
                        "name": "KillTimer",
                        "address": "0x51555c"
                    },
                    {
                        "name": "IsWindowEnabled",
                        "address": "0x515560"
                    },
                    {
                        "name": "IsWindow",
                        "address": "0x515564"
                    },
                    {
                        "name": "IsIconic",
                        "address": "0x515568"
                    },
                    {
                        "name": "GrayStringA",
                        "address": "0x51556c"
                    },
                    {
                        "name": "GetWindowThreadProcessId",
                        "address": "0x515570"
                    },
                    {
                        "name": "GetWindowTextA",
                        "address": "0x515574"
                    },
                    {
                        "name": "GetWindowRect",
                        "address": "0x515578"
                    },
                    {
                        "name": "GetWindowPlacement",
                        "address": "0x51557c"
                    },
                    {
                        "name": "GetWindowLongA",
                        "address": "0x515580"
                    },
                    {
                        "name": "GetWindow",
                        "address": "0x515584"
                    },
                    {
                        "name": "GetTopWindow",
                        "address": "0x515588"
                    },
                    {
                        "name": "GetSystemMetrics",
                        "address": "0x51558c"
                    },
                    {
                        "name": "GetSysColorBrush",
                        "address": "0x515590"
                    },
                    {
                        "name": "GetSysColor",
                        "address": "0x515594"
                    },
                    {
                        "name": "GetSubMenu",
                        "address": "0x515598"
                    },
                    {
                        "name": "GetPropA",
                        "address": "0x51559c"
                    },
                    {
                        "name": "GetParent",
                        "address": "0x5155a0"
                    },
                    {
                        "name": "GetMessageTime",
                        "address": "0x5155a4"
                    },
                    {
                        "name": "GetMessagePos",
                        "address": "0x5155a8"
                    },
                    {
                        "name": "GetMessageA",
                        "address": "0x5155ac"
                    },
                    {
                        "name": "GetMenuState",
                        "address": "0x5155b0"
                    },
                    {
                        "name": "GetMenuItemID",
                        "address": "0x5155b4"
                    },
                    {
                        "name": "GetMenuItemCount",
                        "address": "0x5155b8"
                    },
                    {
                        "name": "GetMenuInfo",
                        "address": "0x5155bc"
                    },
                    {
                        "name": "GetMenuCheckMarkDimensions",
                        "address": "0x5155c0"
                    },
                    {
                        "name": "GetMenu",
                        "address": "0x5155c4"
                    },
                    {
                        "name": "GetLastActivePopup",
                        "address": "0x5155c8"
                    },
                    {
                        "name": "GetKeyState",
                        "address": "0x5155cc"
                    },
                    {
                        "name": "GetForegroundWindow",
                        "address": "0x5155d0"
                    },
                    {
                        "name": "GetFocus",
                        "address": "0x5155d4"
                    },
                    {
                        "name": "GetDlgItem",
                        "address": "0x5155d8"
                    },
                    {
                        "name": "GetDlgCtrlID",
                        "address": "0x5155dc"
                    },
                    {
                        "name": "GetDC",
                        "address": "0x5155e0"
                    },
                    {
                        "name": "GetClientRect",
                        "address": "0x5155e4"
                    },
                    {
                        "name": "GetClassNameA",
                        "address": "0x5155e8"
                    },
                    {
                        "name": "GetClassLongA",
                        "address": "0x5155ec"
                    },
                    {
                        "name": "GetClassInfoExA",
                        "address": "0x5155f0"
                    },
                    {
                        "name": "GetClassInfoA",
                        "address": "0x5155f4"
                    },
                    {
                        "name": "GetCapture",
                        "address": "0x5155f8"
                    },
                    {
                        "name": "EnableWindow",
                        "address": "0x5155fc"
                    },
                    {
                        "name": "EnableMenuItem",
                        "address": "0x515600"
                    },
                    {
                        "name": "DrawTextExA",
                        "address": "0x515604"
                    },
                    {
                        "name": "DrawTextA",
                        "address": "0x515608"
                    },
                    {
                        "name": "DispatchMessageA",
                        "address": "0x51560c"
                    },
                    {
                        "name": "DestroyWindow",
                        "address": "0x515610"
                    },
                    {
                        "name": "DestroyMenu",
                        "address": "0x515614"
                    },
                    {
                        "name": "DefWindowProcA",
                        "address": "0x515618"
                    },
                    {
                        "name": "CreateWindowExA",
                        "address": "0x51561c"
                    },
                    {
                        "name": "CopyRect",
                        "address": "0x515620"
                    },
                    {
                        "name": "CheckMenuItem",
                        "address": "0x515624"
                    },
                    {
                        "name": "CharUpperA",
                        "address": "0x515628"
                    },
                    {
                        "name": "CharNextW",
                        "address": "0x51562c"
                    },
                    {
                        "name": "CharNextA",
                        "address": "0x515630"
                    },
                    {
                        "name": "CallWindowProcA",
                        "address": "0x515634"
                    },
                    {
                        "name": "CallNextHookEx",
                        "address": "0x515638"
                    },
                    {
                        "name": "AdjustWindowRectEx",
                        "address": "0x51563c"
                    },
                    {
                        "name": "ClientToScreen",
                        "address": "0x515640"
                    }
                ],
                "dll": "USER32.dll"
            },
            {
                "imports": [
                    {
                        "name": "CreateRectRgn",
                        "address": "0x51500c"
                    },
                    {
                        "name": "EngDeletePath",
                        "address": "0x515010"
                    },
                    {
                        "name": "EngFreeModule",
                        "address": "0x515014"
                    },
                    {
                        "name": "EngUnlockSurface",
                        "address": "0x515018"
                    },
                    {
                        "name": "EngWideCharToMultiByte",
                        "address": "0x51501c"
                    },
                    {
                        "name": "EnumFontFamiliesA",
                        "address": "0x515020"
                    },
                    {
                        "name": "EnumFontsA",
                        "address": "0x515024"
                    },
                    {
                        "name": "Escape",
                        "address": "0x515028"
                    },
                    {
                        "name": "FontIsLinked",
                        "address": "0x51502c"
                    },
                    {
                        "name": "GdiAddGlsRecord",
                        "address": "0x515030"
                    },
                    {
                        "name": "GdiArtificialDecrementDriver",
                        "address": "0x515034"
                    },
                    {
                        "name": "GdiConvertPalette",
                        "address": "0x515038"
                    },
                    {
                        "name": "GdiCreateLocalMetaFilePict",
                        "address": "0x51503c"
                    },
                    {
                        "name": "GdiEndDocEMF",
                        "address": "0x515040"
                    },
                    {
                        "name": "GdiEntry4",
                        "address": "0x515044"
                    },
                    {
                        "name": "GdiGetCodePage",
                        "address": "0x515048"
                    },
                    {
                        "name": "GdiGetDC",
                        "address": "0x51504c"
                    },
                    {
                        "name": "GdiGetLocalBrush",
                        "address": "0x515050"
                    },
                    {
                        "name": "GdiReleaseDC",
                        "address": "0x515054"
                    },
                    {
                        "name": "GdiSetServerAttr",
                        "address": "0x515058"
                    },
                    {
                        "name": "GdiStartPageEMF",
                        "address": "0x51505c"
                    },
                    {
                        "name": "GetCharABCWidthsA",
                        "address": "0x515060"
                    },
                    {
                        "name": "GetCharWidthFloatW",
                        "address": "0x515064"
                    },
                    {
                        "name": "GetCurrentPositionEx",
                        "address": "0x515068"
                    },
                    {
                        "name": "GetDCPenColor",
                        "address": "0x51506c"
                    },
                    {
                        "name": "GetFontUnicodeRanges",
                        "address": "0x515070"
                    },
                    {
                        "name": "GetGlyphOutlineW",
                        "address": "0x515074"
                    },
                    {
                        "name": "GetMiterLimit",
                        "address": "0x515078"
                    },
                    {
                        "name": "GetNearestColor",
                        "address": "0x51507c"
                    },
                    {
                        "name": "GetTextExtentExPointI",
                        "address": "0x515080"
                    },
                    {
                        "name": "GetTextFaceAliasW",
                        "address": "0x515084"
                    },
                    {
                        "name": "LPtoDP",
                        "address": "0x515088"
                    },
                    {
                        "name": "PATHOBJ_vGetBounds",
                        "address": "0x51508c"
                    },
                    {
                        "name": "PolyPatBlt",
                        "address": "0x515090"
                    },
                    {
                        "name": "CreateColorSpaceW",
                        "address": "0x515094"
                    },
                    {
                        "name": "RemoveFontResourceExA",
                        "address": "0x515098"
                    },
                    {
                        "name": "RemoveFontResourceW",
                        "address": "0x51509c"
                    },
                    {
                        "name": "SelectObject",
                        "address": "0x5150a0"
                    },
                    {
                        "name": "SetGraphicsMode",
                        "address": "0x5150a4"
                    },
                    {
                        "name": "SetMetaRgn",
                        "address": "0x5150a8"
                    },
                    {
                        "name": "SetPixel",
                        "address": "0x5150ac"
                    },
                    {
                        "name": "cGetTTFFromFOT",
                        "address": "0x5150b0"
                    },
                    {
                        "name": "GetTextCharset",
                        "address": "0x5150b4"
                    },
                    {
                        "name": "SwapBuffers",
                        "address": "0x5150b8"
                    },
                    {
                        "name": "DeleteObject",
                        "address": "0x5150bc"
                    },
                    {
                        "name": "CreateSolidBrush",
                        "address": "0x5150c0"
                    },
                    {
                        "name": "SaveDC",
                        "address": "0x5150c4"
                    },
                    {
                        "name": "FlattenPath",
                        "address": "0x5150c8"
                    },
                    {
                        "name": "GdiGetBatchLimit",
                        "address": "0x5150cc"
                    },
                    {
                        "name": "AbortDoc",
                        "address": "0x5150d0"
                    },
                    {
                        "name": "GetStockObject",
                        "address": "0x5150d4"
                    },
                    {
                        "name": "GetLayout",
                        "address": "0x5150d8"
                    },
                    {
                        "name": "GetBkColor",
                        "address": "0x5150dc"
                    },
                    {
                        "name": "GdiFlush",
                        "address": "0x5150e0"
                    },
                    {
                        "name": "CreateHalftonePalette",
                        "address": "0x5150e4"
                    },
                    {
                        "name": "GetSystemPaletteUse",
                        "address": "0x5150e8"
                    },
                    {
                        "name": "GetObjectType",
                        "address": "0x5150ec"
                    },
                    {
                        "name": "GetTextColor",
                        "address": "0x5150f0"
                    },
                    {
                        "name": "GetColorSpace",
                        "address": "0x5150f4"
                    },
                    {
                        "name": "GetPolyFillMode",
                        "address": "0x5150f8"
                    },
                    {
                        "name": "GetGraphicsMode",
                        "address": "0x5150fc"
                    },
                    {
                        "name": "AbortPath",
                        "address": "0x515100"
                    },
                    {
                        "name": "DeleteColorSpace",
                        "address": "0x515104"
                    },
                    {
                        "name": "CreateCompatibleDC",
                        "address": "0x515108"
                    },
                    {
                        "name": "UnrealizeObject",
                        "address": "0x51510c"
                    },
                    {
                        "name": "UpdateColors",
                        "address": "0x515110"
                    },
                    {
                        "name": "CreatePatternBrush",
                        "address": "0x515114"
                    },
                    {
                        "name": "StrokePath",
                        "address": "0x515118"
                    },
                    {
                        "name": "CloseEnhMetaFile",
                        "address": "0x51511c"
                    },
                    {
                        "name": "PolyPolyline",
                        "address": "0x515120"
                    },
                    {
                        "name": "AddFontResourceW",
                        "address": "0x515124"
                    }
                ],
                "dll": "GDI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "RegOpenKeyExW",
                        "address": "0x515000"
                    },
                    {
                        "name": "RegQueryValueExA",
                        "address": "0x515004"
                    }
                ],
                "dll": "ADVAPI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "CoCreateFreeThreadedMarshaler",
                        "address": "0x515648"
                    },
                    {
                        "name": "CoCreateInstance",
                        "address": "0x51564c"
                    },
                    {
                        "name": "CoInitialize",
                        "address": "0x515650"
                    },
                    {
                        "name": "CoInitializeSecurity",
                        "address": "0x515654"
                    },
                    {
                        "name": "CoRegisterClassObject",
                        "address": "0x515658"
                    },
                    {
                        "name": "CoRevokeClassObject",
                        "address": "0x51565c"
                    },
                    {
                        "name": "CoTaskMemAlloc",
                        "address": "0x515660"
                    },
                    {
                        "name": "CoTaskMemFree",
                        "address": "0x515664"
                    },
                    {
                        "name": "CoTaskMemRealloc",
                        "address": "0x515668"
                    },
                    {
                        "name": "CoUninitialize",
                        "address": "0x51566c"
                    },
                    {
                        "name": "StringFromGUID2",
                        "address": "0x515670"
                    }
                ],
                "dll": "ole32.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x0012de78",
        "overlay": {
            "size": "0x00000d08",
            "offset": "0x00120c00"
        },
        "imagebase": "0x00400000",
        "reported_checksum": "0x00127e5c",
        "icon_hash": null,
        "entrypoint": "0x005136e0",
        "timestamp": "2019-02-20 05:33:55",
        "osversion": "5.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x00113200",
                "entropy": "7.12",
                "raw_address": "0x00000400",
                "virtual_size": "0x00113184",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rdata",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00115000",
                "size_of_data": "0x00003200",
                "entropy": "5.58",
                "raw_address": "0x00113600",
                "virtual_size": "0x000030b8",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x00119000",
                "size_of_data": "0x00000200",
                "entropy": "1.93",
                "raw_address": "0x00116800",
                "virtual_size": "0x00000258",
                "characteristics_raw": "0xc0000040"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x0011a000",
                "size_of_data": "0x0000a200",
                "entropy": "7.29",
                "raw_address": "0x00116a00",
                "virtual_size": "0x000ed1c0",
                "characteristics_raw": "0x40000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00115d2c",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x00000078"
            },
            {
                "virtual_address": "0x0011a000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x0000a1c0"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00120c00",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000d08"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00115000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000678"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "fa2d21c960425e9ec6378d6769bb3c1a",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 5,
        "versioninfo": []
    }
}

[*] Resolved APIs: [
    "kernel32.dll.VirtualAlloc",
    "kernel32.dll.LoadLibraryExA",
    "kernel32.dll.GetProcAddress",
    "kernel32.dll.SetFilePointer",
    "kernel32.dll.lstrlenA",
    "kernel32.dll.lstrcatA",
    "kernel32.dll.VirtualProtect",
    "kernel32.dll.UnmapViewOfFile",
    "kernel32.dll.GetModuleHandleA",
    "kernel32.dll.WriteFile",
    "kernel32.dll.CloseHandle",
    "kernel32.dll.VirtualFree",
    "kernel32.dll.GetTempPathA",
    "kernel32.dll.CreateFileA",
    "kernel32.dll.LoadLibraryA",
    "kernel32.dll.ExitProcess",
    "advapi32.dll.RegCloseKey",
    "oleaut32.dll.#6",
    "shell32.dll.SHGetMalloc",
    "user32.dll.CharUpperA",
    "ws2_32.dll.#1",
    "kernel32.dll.Sleep",
    "kernel32.dll.GetSystemTimeAsFileTime",
    "kernel32.dll.HeapFree",
    "kernel32.dll.HeapAlloc",
    "kernel32.dll.GetProcessHeap",
    "kernel32.dll.OpenProcess",
    "kernel32.dll.CreatePipe",
    "kernel32.dll.CreateProcessA",
    "kernel32.dll.GetExitCodeProcess",
    "kernel32.dll.SetHandleInformation",
    "kernel32.dll.PeekNamedPipe",
    "kernel32.dll.LocalFree",
    "kernel32.dll.GlobalMemoryStatusEx",
    "kernel32.dll.CreateFileMappingA",
    "kernel32.dll.InitializeCriticalSection",
    "kernel32.dll.InterlockedDecrement",
    "kernel32.dll.ReadFile",
    "kernel32.dll.CreateFileW",
    "kernel32.dll.GetLastError",
    "kernel32.dll.TerminateProcess",
    "kernel32.dll.GetCurrentProcess",
    "kernel32.dll.UnhandledExceptionFilter",
    "kernel32.dll.SetUnhandledExceptionFilter",
    "kernel32.dll.IsDebuggerPresent",
    "kernel32.dll.GetCommandLineA",
    "kernel32.dll.GetStartupInfoA",
    "kernel32.dll.RaiseException",
    "kernel32.dll.RtlUnwind",
    "kernel32.dll.GetModuleHandleW",
    "kernel32.dll.TlsGetValue",
    "kernel32.dll.TlsAlloc",
    "kernel32.dll.TlsSetValue",
    "kernel32.dll.TlsFree",
    "kernel32.dll.InterlockedIncrement",
    "kernel32.dll.SetLastError",
    "kernel32.dll.GetCurrentThreadId",
    "kernel32.dll.HeapSize",
    "kernel32.dll.GetStdHandle",
    "kernel32.dll.GetModuleFileNameA",
    "kernel32.dll.FreeEnvironmentStringsA",
    "kernel32.dll.GetEnvironmentStrings",
    "kernel32.dll.FreeEnvironmentStringsW",
    "kernel32.dll.WideCharToMultiByte",
    "kernel32.dll.GetEnvironmentStringsW",
    "kernel32.dll.SetHandleCount",
    "kernel32.dll.GetFileType",
    "kernel32.dll.DeleteCriticalSection",
    "kernel32.dll.HeapCreate",
    "kernel32.dll.QueryPerformanceCounter",
    "kernel32.dll.GetTickCount",
    "kernel32.dll.GetCurrentProcessId",
    "kernel32.dll.SetEvent",
    "kernel32.dll.GetACP",
    "kernel32.dll.DeleteFileA",
    "kernel32.dll.IsValidCodePage",
    "kernel32.dll.EnterCriticalSection",
    "kernel32.dll.LeaveCriticalSection",
    "kernel32.dll.GetConsoleCP",
    "kernel32.dll.GetConsoleMode",
    "kernel32.dll.FlushFileBuffers",
    "kernel32.dll.MultiByteToWideChar",
    "kernel32.dll.LCMapStringA",
    "kernel32.dll.LCMapStringW",
    "kernel32.dll.HeapReAlloc",
    "kernel32.dll.SetConsoleCtrlHandler",
    "kernel32.dll.FreeLibrary",
    "kernel32.dll.InitializeCriticalSectionAndSpinCount",
    "kernel32.dll.GetLocaleInfoA",
    "kernel32.dll.GetStringTypeA",
    "kernel32.dll.GetStringTypeW",
    "kernel32.dll.GetTimeFormatA",
    "kernel32.dll.GetDateFormatA",
    "kernel32.dll.SetStdHandle",
    "kernel32.dll.WriteConsoleA",
    "kernel32.dll.GetConsoleOutputCP",
    "kernel32.dll.WriteConsoleW",
    "kernel32.dll.GetTimeZoneInformation",
    "kernel32.dll.SetEndOfFile",
    "kernel32.dll.CompareStringA",
    "kernel32.dll.CompareStringW",
    "kernel32.dll.SetEnvironmentVariableA",
    "kernel32.dll.GetSystemInfo",
    "kernel32.dll.OpenEventA",
    "kernel32.dll.ResetEvent",
    "kernel32.dll.ResumeThread",
    "kernel32.dll.SystemTimeToFileTime",
    "kernel32.dll.WaitForMultipleObjects",
    "kernel32.dll.SetWaitableTimer",
    "kernel32.dll.CreateWaitableTimerA",
    "kernel32.dll.GetVersion",
    "kernel32.dll.GlobalMemoryStatus",
    "kernel32.dll.GetVersionExA",
    "kernel32.dll.FlushConsoleInputBuffer",
    "kernel32.dll.VerSetConditionMask",
    "kernel32.dll.SleepEx",
    "kernel32.dll.VerifyVersionInfoA",
    "kernel32.dll.ExpandEnvironmentStringsA",
    "kernel32.dll.FormatMessageA",
    "kernel32.dll.MapViewOfFile",
    "kernel32.dll.GetFileSize",
    "kernel32.dll.CreateIoCompletionPort",
    "kernel32.dll.PostQueuedCompletionStatus",
    "kernel32.dll.ReleaseSemaphore",
    "kernel32.dll.CreateSemaphoreA",
    "kernel32.dll.GetQueuedCompletionStatus",
    "kernel32.dll.GetFileInformationByHandle",
    "kernel32.dll.MoveFileA",
    "kernel32.dll.LockFile",
    "kernel32.dll.UnlockFile",
    "kernel32.dll.GetModuleFileNameW",
    "kernel32.dll.LoadLibraryW",
    "kernel32.dll.CreateDirectoryA",
    "kernel32.dll.GetOEMCP",
    "kernel32.dll.WaitForSingleObject",
    "kernel32.dll.GetCPInfo",
    "kernel32.dll.CreateEventA",
    "kernel32.dll.GetSystemDirectoryA",
    "kernel32.dll.GetCurrentDirectoryA",
    "kernel32.dll.GetFullPathNameA",
    "kernel32.dll.FindFirstFileA",
    "kernel32.dll.GetDriveTypeA",
    "kernel32.dll.FileTimeToLocalFileTime",
    "kernel32.dll.FileTimeToSystemTime",
    "kernel32.dll.FindClose",
    "kernel32.dll.SetConsoleMode",
    "kernel32.dll.ReadConsoleInputA",
    "kernel32.dll.CreateThread",
    "kernel32.dll.ExitThread",
    "kernel32.dll.VirtualQuery",
    "advapi32.dll.DeregisterEventSource",
    "advapi32.dll.RegisterEventSourceA",
    "advapi32.dll.ReportEventA",
    "advapi32.dll.RegQueryValueExA",
    "advapi32.dll.RegOpenKeyExA",
    "advapi32.dll.CryptAcquireContextA",
    "advapi32.dll.CryptGenRandom",
    "oleaut32.dll.#9",
    "oleaut32.dll.#2",
    "shell32.dll.SHGetSpecialFolderLocation",
    "shell32.dll.SHGetSpecialFolderPathA",
    "shell32.dll.SHGetPathFromIDListA",
    "user32.dll.MessageBoxA",
    "user32.dll.CharLowerW",
    "user32.dll.GetUserObjectInformationW",
    "user32.dll.GetDesktopWindow",
    "user32.dll.GetProcessWindowStation",
    "user32.dll.CharUpperW",
    "ws2_32.dll.freeaddrinfo",
    "ws2_32.dll.getaddrinfo",
    "ws2_32.dll.#17",
    "ws2_32.dll.#55",
    "ws2_32.dll.#54",
    "ws2_32.dll.#13",
    "ws2_32.dll.#8",
    "ws2_32.dll.#14",
    "ws2_32.dll.#57",
    "ws2_32.dll.#52",
    "ws2_32.dll.#10",
    "ws2_32.dll.#19",
    "ws2_32.dll.#18",
    "ws2_32.dll.#151",
    "ws2_32.dll.#5",
    "ws2_32.dll.WSAIoctl",
    "ws2_32.dll.#4",
    "ws2_32.dll.#111",
    "ws2_32.dll.#9",
    "ws2_32.dll.#15",
    "ws2_32.dll.#20",
    "ws2_32.dll.#22",
    "ws2_32.dll.#6",
    "ws2_32.dll.#21",
    "ws2_32.dll.#16",
    "ws2_32.dll.#2",
    "ws2_32.dll.#23",
    "ws2_32.dll.#112",
    "ws2_32.dll.#3",
    "ws2_32.dll.#7",
    "ws2_32.dll.#115",
    "ws2_32.dll.#116",
    "kernel32.dll.FlsAlloc",
    "kernel32.dll.FlsGetValue",
    "kernel32.dll.FlsSetValue",
    "kernel32.dll.FlsFree",
    "kernel32.dll.IsProcessorFeaturePresent",
    "kernel32.dll.GetComputerNameW",
    "kernel32.dll.GetLogicalDriveStringsW",
    "kernel32.dll.GetVolumeInformationW",
    "kernel32.dll.GetDriveTypeW",
    "kernel32.dll.GetSystemDirectoryW",
    "kernel32.dll.GetWindowsDirectoryA",
    "kernel32.dll.GetWindowsDirectoryW",
    "kernel32.dll.GetTempPathW",
    "kernel32.dll.FindFirstFileW",
    "kernel32.dll.FindNextFileW",
    "kernel32.dll.SetFileAttributesW",
    "kernel32.dll.GetFileAttributesW",
    "kernel32.dll.MoveFileW",
    "kernel32.dll.CreateDirectoryW",
    "kernel32.dll.DeleteFileW",
    "kernel32.dll.CopyFileW",
    "kernel32.dll.DeviceIoControl",
    "kernel32.dll.GetShortPathNameW",
    "kernel32.dll.GetVersionExW",
    "kernel32.dll.SetErrorMode",
    "kernel32.dll.CreateProcessW",
    "kernel32.dll.Wow64DisableWow64FsRedirection",
    "kernel32.dll.Wow64RevertWow64FsRedirection",
    "advapi32.dll.RegOpenKeyExW",
    "advapi32.dll.RegQueryValueExW",
    "advapi32.dll.RegSetValueExW",
    "advapi32.dll.RegCreateKeyExW",
    "advapi32.dll.RegDeleteValueW",
    "advapi32.dll.RegEnumKeyW",
    "advapi32.dll.RegQueryInfoKeyW",
    "advapi32.dll.GetUserNameW",
    "shell32.dll.SHGetFolderPathW",
    "shell32.dll.ShellExecuteW",
    "shell32.dll.SHGetKnownFolderPath",
    "ole32.dll.CoInitializeEx",
    "ole32.dll.CoUninitialize",
    "ole32.dll.CoCreateInstance",
    "ole32.dll.CoInitializeSecurity",
    "ole32.dll.CoSetProxyBlanket",
    "ole32.dll.CoTaskMemFree",
    "oleaut32.dll.VariantClear",
    "user32.dll.GetWindowRect",
    "user32.dll.GetDC",
    "user32.dll.DrawTextW",
    "user32.dll.SystemParametersInfoW",
    "user32.dll.GetForegroundWindow",
    "gdi32.dll.CreateCompatibleDC",
    "gdi32.dll.CreateCompatibleBitmap",
    "gdi32.dll.SelectObject",
    "gdi32.dll.DeleteObject",
    "gdi32.dll.DeleteDC",
    "gdi32.dll.CreateBrushIndirect",
    "gdi32.dll.SetTextColor",
    "gdi32.dll.SetBkColor",
    "gdi32.dll.GetCurrentObject",
    "gdi32.dll.GetObjectA",
    "gdi32.dll.CreateFontIndirectA",
    "gdi32.dll.CreateDIBSection",
    "gdi32.dll.BitBlt",
    "gdi32.dll.ExtFloodFill",
    "netapi32.dll.NetServerGetInfo",
    "netapi32.dll.NetApiBufferFree",
    "netapi32.dll.NetWkstaGetInfo",
    "kernel32.dll.SetProcessDEPPolicy",
    "netapi32.dll.NetStatisticsGet",
    "advapi32.dll.CryptAcquireContextW",
    "advapi32.dll.CryptReleaseContext",
    "cryptsp.dll.CryptAcquireContextW",
    "cryptsp.dll.CryptGenRandom",
    "cryptsp.dll.CryptReleaseContext",
    "user32.dll.GetCursorInfo",
    "user32.dll.GetQueueStatus",
    "kernel32.dll.CreateToolhelp32Snapshot",
    "kernel32.dll.Heap32First",
    "kernel32.dll.Heap32Next",
    "kernel32.dll.Heap32ListFirst",
    "kernel32.dll.Heap32ListNext",
    "kernel32.dll.Process32First",
    "kernel32.dll.Process32Next",
    "kernel32.dll.Thread32First",
    "kernel32.dll.Thread32Next",
    "kernel32.dll.Module32First",
    "kernel32.dll.Module32Next",
    "cryptsp.dll.CryptAcquireContextA",
    "cryptbase.dll.SystemFunction036",
    "uxtheme.dll.ThemeInitApiHook",
    "user32.dll.IsProcessDPIAware",
    "ole32.dll.CreateBindCtx",
    "ole32.dll.CoTaskMemAlloc",
    "ole32.dll.CoGetApartmentType",
    "ole32.dll.CoRegisterInitializeSpy",
    "comctl32.dll.#236",
    "ole32.dll.CoGetMalloc",
    "comctl32.dll.#320",
    "comctl32.dll.#324",
    "comctl32.dll.#323",
    "comctl32.dll.#328",
    "comctl32.dll.#334",
    "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
    "setupapi.dll.CM_Get_Device_Interface_List_ExW",
    "advapi32.dll.InitializeSecurityDescriptor",
    "advapi32.dll.SetEntriesInAclW",
    "ntmarta.dll.GetMartaExtensionInterface",
    "advapi32.dll.SetSecurityDescriptorDacl",
    "advapi32.dll.IsTextUnicode",
    "comctl32.dll.#332",
    "comctl32.dll.#338",
    "comctl32.dll.#339",
    "shell32.dll.#102",
    "comctl32.dll.#386",
    "ole32.dll.CoRevokeInitializeSpy",
    "comctl32.dll.#388",
    "ole32.dll.NdrOleInitializeExtension",
    "ole32.dll.CoGetClassObject",
    "ole32.dll.CoGetMarshalSizeMax",
    "ole32.dll.CoMarshalInterface",
    "ole32.dll.CoUnmarshalInterface",
    "ole32.dll.StringFromIID",
    "ole32.dll.CoGetPSClsid",
    "ole32.dll.CoReleaseMarshalData",
    "ole32.dll.DcomChannelSetHResult",
    "oleaut32.dll.#500",
    "iphlpapi.dll.GetAdaptersAddresses"
]

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "GetStartupInfoA",
                        "address": "0x51512c"
                    },
                    {
                        "name": "GetStdHandle",
                        "address": "0x515130"
                    },
                    {
                        "name": "GetStringTypeA",
                        "address": "0x515134"
                    },
                    {
                        "name": "GetStringTypeW",
                        "address": "0x515138"
                    },
                    {
                        "name": "GetSystemInfo",
                        "address": "0x51513c"
                    },
                    {
                        "name": "GetSystemTimeAsFileTime",
                        "address": "0x515140"
                    },
                    {
                        "name": "GetTempFileNameA",
                        "address": "0x515144"
                    },
                    {
                        "name": "GetTempFileNameW",
                        "address": "0x515148"
                    },
                    {
                        "name": "GetTempPathA",
                        "address": "0x51514c"
                    },
                    {
                        "name": "GetTickCount",
                        "address": "0x515150"
                    },
                    {
                        "name": "GetTimeFormatA",
                        "address": "0x515154"
                    },
                    {
                        "name": "GetTimeFormatW",
                        "address": "0x515158"
                    },
                    {
                        "name": "GetTimeZoneInformation",
                        "address": "0x51515c"
                    },
                    {
                        "name": "GetUserDefaultLCID",
                        "address": "0x515160"
                    },
                    {
                        "name": "GetVersionExA",
                        "address": "0x515164"
                    },
                    {
                        "name": "GetVolumeInformationA",
                        "address": "0x515168"
                    },
                    {
                        "name": "GetVolumeInformationW",
                        "address": "0x51516c"
                    },
                    {
                        "name": "GetVolumeNameForVolumeMountPointW",
                        "address": "0x515170"
                    },
                    {
                        "name": "GlobalAddAtomA",
                        "address": "0x515174"
                    },
                    {
                        "name": "GlobalAlloc",
                        "address": "0x515178"
                    },
                    {
                        "name": "GlobalDeleteAtom",
                        "address": "0x51517c"
                    },
                    {
                        "name": "GlobalFindAtomA",
                        "address": "0x515180"
                    },
                    {
                        "name": "GlobalFlags",
                        "address": "0x515184"
                    },
                    {
                        "name": "GlobalFree",
                        "address": "0x515188"
                    },
                    {
                        "name": "GlobalGetAtomNameA",
                        "address": "0x51518c"
                    },
                    {
                        "name": "GlobalHandle",
                        "address": "0x515190"
                    },
                    {
                        "name": "GlobalLock",
                        "address": "0x515194"
                    },
                    {
                        "name": "GlobalMemoryStatus",
                        "address": "0x515198"
                    },
                    {
                        "name": "GlobalReAlloc",
                        "address": "0x51519c"
                    },
                    {
                        "name": "GlobalSize",
                        "address": "0x5151a0"
                    },
                    {
                        "name": "GlobalUnlock",
                        "address": "0x5151a4"
                    },
                    {
                        "name": "HeapAlloc",
                        "address": "0x5151a8"
                    },
                    {
                        "name": "HeapCreate",
                        "address": "0x5151ac"
                    },
                    {
                        "name": "HeapFree",
                        "address": "0x5151b0"
                    },
                    {
                        "name": "HeapReAlloc",
                        "address": "0x5151b4"
                    },
                    {
                        "name": "HeapSize",
                        "address": "0x5151b8"
                    },
                    {
                        "name": "InitializeCriticalSection",
                        "address": "0x5151bc"
                    },
                    {
                        "name": "InitializeCriticalSectionAndSpinCount",
                        "address": "0x5151c0"
                    },
                    {
                        "name": "InterlockedCompareExchange",
                        "address": "0x5151c4"
                    },
                    {
                        "name": "InterlockedDecrement",
                        "address": "0x5151c8"
                    },
                    {
                        "name": "InterlockedExchange",
                        "address": "0x5151cc"
                    },
                    {
                        "name": "InterlockedIncrement",
                        "address": "0x5151d0"
                    },
                    {
                        "name": "IsDBCSLeadByte",
                        "address": "0x5151d4"
                    },
                    {
                        "name": "IsDebuggerPresent",
                        "address": "0x5151d8"
                    },
                    {
                        "name": "IsValidCodePage",
                        "address": "0x5151dc"
                    },
                    {
                        "name": "IsValidLocale",
                        "address": "0x5151e0"
                    },
                    {
                        "name": "LCMapStringA",
                        "address": "0x5151e4"
                    },
                    {
                        "name": "LCMapStringW",
                        "address": "0x5151e8"
                    },
                    {
                        "name": "LeaveCriticalSection",
                        "address": "0x5151ec"
                    },
                    {
                        "name": "LoadLibraryA",
                        "address": "0x5151f0"
                    },
                    {
                        "name": "LoadLibraryExA",
                        "address": "0x5151f4"
                    },
                    {
                        "name": "LoadLibraryW",
                        "address": "0x5151f8"
                    },
                    {
                        "name": "LoadResource",
                        "address": "0x5151fc"
                    },
                    {
                        "name": "LocalAlloc",
                        "address": "0x515200"
                    },
                    {
                        "name": "LocalFree",
                        "address": "0x515204"
                    },
                    {
                        "name": "LocalReAlloc",
                        "address": "0x515208"
                    },
                    {
                        "name": "LockFile",
                        "address": "0x51520c"
                    },
                    {
                        "name": "LockResource",
                        "address": "0x515210"
                    },
                    {
                        "name": "MapViewOfFile",
                        "address": "0x515214"
                    },
                    {
                        "name": "GetShortPathNameA",
                        "address": "0x515218"
                    },
                    {
                        "name": "OpenEventA",
                        "address": "0x51521c"
                    },
                    {
                        "name": "OpenFileMappingA",
                        "address": "0x515220"
                    },
                    {
                        "name": "OpenProcess",
                        "address": "0x515224"
                    },
                    {
                        "name": "OutputDebugStringA",
                        "address": "0x515228"
                    },
                    {
                        "name": "PulseEvent",
                        "address": "0x51522c"
                    },
                    {
                        "name": "QueryPerformanceCounter",
                        "address": "0x515230"
                    },
                    {
                        "name": "RaiseException",
                        "address": "0x515234"
                    },
                    {
                        "name": "ReadFile",
                        "address": "0x515238"
                    },
                    {
                        "name": "ReleaseMutex",
                        "address": "0x51523c"
                    },
                    {
                        "name": "ReleaseSemaphore",
                        "address": "0x515240"
                    },
                    {
                        "name": "ResetEvent",
                        "address": "0x515244"
                    },
                    {
                        "name": "RtlUnwind",
                        "address": "0x515248"
                    },
                    {
                        "name": "SetConsoleCtrlHandler",
                        "address": "0x51524c"
                    },
                    {
                        "name": "SetEndOfFile",
                        "address": "0x515250"
                    },
                    {
                        "name": "SetEnvironmentVariableA",
                        "address": "0x515254"
                    },
                    {
                        "name": "SetErrorMode",
                        "address": "0x515258"
                    },
                    {
                        "name": "SetEvent",
                        "address": "0x51525c"
                    },
                    {
                        "name": "SetFileAttributesA",
                        "address": "0x515260"
                    },
                    {
                        "name": "SetFilePointer",
                        "address": "0x515264"
                    },
                    {
                        "name": "SetHandleCount",
                        "address": "0x515268"
                    },
                    {
                        "name": "SetLastError",
                        "address": "0x51526c"
                    },
                    {
                        "name": "SetStdHandle",
                        "address": "0x515270"
                    },
                    {
                        "name": "SetThreadIdealProcessor",
                        "address": "0x515274"
                    },
                    {
                        "name": "SetThreadUILanguage",
                        "address": "0x515278"
                    },
                    {
                        "name": "SetUnhandledExceptionFilter",
                        "address": "0x51527c"
                    },
                    {
                        "name": "SizeofResource",
                        "address": "0x515280"
                    },
                    {
                        "name": "Sleep",
                        "address": "0x515284"
                    },
                    {
                        "name": "TerminateProcess",
                        "address": "0x515288"
                    },
                    {
                        "name": "TerminateThread",
                        "address": "0x51528c"
                    },
                    {
                        "name": "Thread32Next",
                        "address": "0x515290"
                    },
                    {
                        "name": "TlsAlloc",
                        "address": "0x515294"
                    },
                    {
                        "name": "TlsFree",
                        "address": "0x515298"
                    },
                    {
                        "name": "TlsGetValue",
                        "address": "0x51529c"
                    },
                    {
                        "name": "TlsSetValue",
                        "address": "0x5152a0"
                    },
                    {
                        "name": "UnhandledExceptionFilter",
                        "address": "0x5152a4"
                    },
                    {
                        "name": "UnlockFile",
                        "address": "0x5152a8"
                    },
                    {
                        "name": "UnmapViewOfFile",
                        "address": "0x5152ac"
                    },
                    {
                        "name": "VirtualAlloc",
                        "address": "0x5152b0"
                    },
                    {
                        "name": "VirtualFree",
                        "address": "0x5152b4"
                    },
                    {
                        "name": "VirtualProtect",
                        "address": "0x5152b8"
                    },
                    {
                        "name": "VirtualQuery",
                        "address": "0x5152bc"
                    },
                    {
                        "name": "WaitForMultipleObjects",
                        "address": "0x5152c0"
                    },
                    {
                        "name": "WaitForSingleObject",
                        "address": "0x5152c4"
                    },
                    {
                        "name": "WideCharToMultiByte",
                        "address": "0x5152c8"
                    },
                    {
                        "name": "WriteConsoleA",
                        "address": "0x5152cc"
                    },
                    {
                        "name": "WriteConsoleW",
                        "address": "0x5152d0"
                    },
                    {
                        "name": "WriteFile",
                        "address": "0x5152d4"
                    },
                    {
                        "name": "WriteProfileStringW",
                        "address": "0x5152d8"
                    },
                    {
                        "name": "lstrcatW",
                        "address": "0x5152dc"
                    },
                    {
                        "name": "lstrcmpA",
                        "address": "0x5152e0"
                    },
                    {
                        "name": "lstrcmpW",
                        "address": "0x5152e4"
                    },
                    {
                        "name": "lstrcmpiA",
                        "address": "0x5152e8"
                    },
                    {
                        "name": "lstrcpyA",
                        "address": "0x5152ec"
                    },
                    {
                        "name": "lstrcpyW",
                        "address": "0x5152f0"
                    },
                    {
                        "name": "lstrcpynA",
                        "address": "0x5152f4"
                    },
                    {
                        "name": "lstrcpynW",
                        "address": "0x5152f8"
                    },
                    {
                        "name": "lstrlenA",
                        "address": "0x5152fc"
                    },
                    {
                        "name": "lstrlenW",
                        "address": "0x515300"
                    },
                    {
                        "name": "GetProcessHeap",
                        "address": "0x515304"
                    },
                    {
                        "name": "GetProcAddress",
                        "address": "0x515308"
                    },
                    {
                        "name": "GetOEMCP",
                        "address": "0x51530c"
                    },
                    {
                        "name": "GetModuleHandleW",
                        "address": "0x515310"
                    },
                    {
                        "name": "GetModuleHandleA",
                        "address": "0x515314"
                    },
                    {
                        "name": "GetModuleFileNameA",
                        "address": "0x515318"
                    },
                    {
                        "name": "GetLocaleInfoW",
                        "address": "0x51531c"
                    },
                    {
                        "name": "CloseHandle",
                        "address": "0x515320"
                    },
                    {
                        "name": "GetLocaleInfoA",
                        "address": "0x515324"
                    },
                    {
                        "name": "GetLastError",
                        "address": "0x515328"
                    },
                    {
                        "name": "GetFullPathNameA",
                        "address": "0x51532c"
                    },
                    {
                        "name": "GetFileType",
                        "address": "0x515330"
                    },
                    {
                        "name": "GetFileTime",
                        "address": "0x515334"
                    },
                    {
                        "name": "GetFileSizeEx",
                        "address": "0x515338"
                    },
                    {
                        "name": "GetFileSize",
                        "address": "0x51533c"
                    },
                    {
                        "name": "GetFileAttributesExA",
                        "address": "0x515340"
                    },
                    {
                        "name": "GetFileAttributesA",
                        "address": "0x515344"
                    },
                    {
                        "name": "GetExitCodeThread",
                        "address": "0x515348"
                    },
                    {
                        "name": "GetEnvironmentStringsW",
                        "address": "0x51534c"
                    },
                    {
                        "name": "GetEnvironmentStrings",
                        "address": "0x515350"
                    },
                    {
                        "name": "GetDriveTypeW",
                        "address": "0x515354"
                    },
                    {
                        "name": "GetDateFormatW",
                        "address": "0x515358"
                    },
                    {
                        "name": "GetDateFormatA",
                        "address": "0x51535c"
                    },
                    {
                        "name": "GetCurrentThreadId",
                        "address": "0x515360"
                    },
                    {
                        "name": "GetCurrentThread",
                        "address": "0x515364"
                    },
                    {
                        "name": "GetCurrentProcessId",
                        "address": "0x515368"
                    },
                    {
                        "name": "GetCurrentProcess",
                        "address": "0x51536c"
                    },
                    {
                        "name": "GetConsoleOutputCP",
                        "address": "0x515370"
                    },
                    {
                        "name": "GetConsoleMode",
                        "address": "0x515374"
                    },
                    {
                        "name": "GetConsoleCP",
                        "address": "0x515378"
                    },
                    {
                        "name": "GetCommandLineA",
                        "address": "0x51537c"
                    },
                    {
                        "name": "GetCommMask",
                        "address": "0x515380"
                    },
                    {
                        "name": "GetCommConfig",
                        "address": "0x515384"
                    },
                    {
                        "name": "GetCPInfo",
                        "address": "0x515388"
                    },
                    {
                        "name": "GetACP",
                        "address": "0x51538c"
                    },
                    {
                        "name": "FreeLibrary",
                        "address": "0x515390"
                    },
                    {
                        "name": "FreeEnvironmentStringsW",
                        "address": "0x515394"
                    },
                    {
                        "name": "FreeEnvironmentStringsA",
                        "address": "0x515398"
                    },
                    {
                        "name": "FormatMessageW",
                        "address": "0x51539c"
                    },
                    {
                        "name": "FormatMessageA",
                        "address": "0x5153a0"
                    },
                    {
                        "name": "FlushFileBuffers",
                        "address": "0x5153a4"
                    },
                    {
                        "name": "FindResourceA",
                        "address": "0x5153a8"
                    },
                    {
                        "name": "FindNextChangeNotification",
                        "address": "0x5153ac"
                    },
                    {
                        "name": "FindFirstFileA",
                        "address": "0x5153b0"
                    },
                    {
                        "name": "FindFirstChangeNotificationA",
                        "address": "0x5153b4"
                    },
                    {
                        "name": "FindCloseChangeNotification",
                        "address": "0x5153b8"
                    },
                    {
                        "name": "FindClose",
                        "address": "0x5153bc"
                    },
                    {
                        "name": "FileTimeToSystemTime",
                        "address": "0x5153c0"
                    },
                    {
                        "name": "FileTimeToLocalFileTime",
                        "address": "0x5153c4"
                    },
                    {
                        "name": "FileTimeToDosDateTime",
                        "address": "0x5153c8"
                    },
                    {
                        "name": "ExpandEnvironmentStringsW",
                        "address": "0x5153cc"
                    },
                    {
                        "name": "ExitThread",
                        "address": "0x5153d0"
                    },
                    {
                        "name": "ExitProcess",
                        "address": "0x5153d4"
                    },
                    {
                        "name": "EnumSystemLocalesA",
                        "address": "0x5153d8"
                    },
                    {
                        "name": "EnterCriticalSection",
                        "address": "0x5153dc"
                    },
                    {
                        "name": "DuplicateHandle",
                        "address": "0x5153e0"
                    },
                    {
                        "name": "DeviceIoControl",
                        "address": "0x5153e4"
                    },
                    {
                        "name": "DeleteFileW",
                        "address": "0x5153e8"
                    },
                    {
                        "name": "DeleteFileA",
                        "address": "0x5153ec"
                    },
                    {
                        "name": "DeleteCriticalSection",
                        "address": "0x5153f0"
                    },
                    {
                        "name": "CreateThread",
                        "address": "0x5153f4"
                    },
                    {
                        "name": "CreateSemaphoreW",
                        "address": "0x5153f8"
                    },
                    {
                        "name": "CreateProcessA",
                        "address": "0x5153fc"
                    },
                    {
                        "name": "CreateMutexA",
                        "address": "0x515400"
                    },
                    {
                        "name": "CreateMailslotA",
                        "address": "0x515404"
                    },
                    {
                        "name": "CreateFileW",
                        "address": "0x515408"
                    },
                    {
                        "name": "CreateFileMappingA",
                        "address": "0x51540c"
                    },
                    {
                        "name": "CreateFileA",
                        "address": "0x515410"
                    },
                    {
                        "name": "CreateEventW",
                        "address": "0x515414"
                    },
                    {
                        "name": "CreateEventA",
                        "address": "0x515418"
                    },
                    {
                        "name": "CreateDirectoryA",
                        "address": "0x51541c"
                    },
                    {
                        "name": "CopyFileA",
                        "address": "0x515420"
                    },
                    {
                        "name": "CompareStringW",
                        "address": "0x515424"
                    },
                    {
                        "name": "CompareStringA",
                        "address": "0x515428"
                    },
                    {
                        "name": "MultiByteToWideChar",
                        "address": "0x51542c"
                    }
                ],
                "dll": "KERNEL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "SetForegroundWindow",
                        "address": "0x515434"
                    },
                    {
                        "name": "SetMenu",
                        "address": "0x515438"
                    },
                    {
                        "name": "SetMenuItemBitmaps",
                        "address": "0x51543c"
                    },
                    {
                        "name": "SetPropA",
                        "address": "0x515440"
                    },
                    {
                        "name": "SetTimer",
                        "address": "0x515444"
                    },
                    {
                        "name": "SetWindowLongA",
                        "address": "0x515448"
                    },
                    {
                        "name": "SetWindowPos",
                        "address": "0x51544c"
                    },
                    {
                        "name": "SetWindowTextA",
                        "address": "0x515450"
                    },
                    {
                        "name": "SetWindowsHookExA",
                        "address": "0x515454"
                    },
                    {
                        "name": "SystemParametersInfoA",
                        "address": "0x515458"
                    },
                    {
                        "name": "TabbedTextOutA",
                        "address": "0x51545c"
                    },
                    {
                        "name": "UnhookWindowsHookEx",
                        "address": "0x515460"
                    },
                    {
                        "name": "ValidateRect",
                        "address": "0x515464"
                    },
                    {
                        "name": "WinHelpA",
                        "address": "0x515468"
                    },
                    {
                        "name": "wsprintfA",
                        "address": "0x51546c"
                    },
                    {
                        "name": "wvsprintfA",
                        "address": "0x515470"
                    },
                    {
                        "name": "WindowFromDC",
                        "address": "0x515474"
                    },
                    {
                        "name": "LoadCursorFromFileA",
                        "address": "0x515478"
                    },
                    {
                        "name": "GetClipboardData",
                        "address": "0x51547c"
                    },
                    {
                        "name": "InSendMessage",
                        "address": "0x515480"
                    },
                    {
                        "name": "IsMenu",
                        "address": "0x515484"
                    },
                    {
                        "name": "DestroyIcon",
                        "address": "0x515488"
                    },
                    {
                        "name": "CharLowerW",
                        "address": "0x51548c"
                    },
                    {
                        "name": "GetMenuContextHelpId",
                        "address": "0x515490"
                    },
                    {
                        "name": "VkKeyScanA",
                        "address": "0x515494"
                    },
                    {
                        "name": "CountClipboardFormats",
                        "address": "0x515498"
                    },
                    {
                        "name": "IsCharAlphaA",
                        "address": "0x51549c"
                    },
                    {
                        "name": "IsCharAlphaNumericA",
                        "address": "0x5154a0"
                    },
                    {
                        "name": "GetProcessWindowStation",
                        "address": "0x5154a4"
                    },
                    {
                        "name": "IsWindowUnicode",
                        "address": "0x5154a8"
                    },
                    {
                        "name": "GetKeyboardLayout",
                        "address": "0x5154ac"
                    },
                    {
                        "name": "VkKeyScanW",
                        "address": "0x5154b0"
                    },
                    {
                        "name": "GetActiveWindow",
                        "address": "0x5154b4"
                    },
                    {
                        "name": "GetKBCodePage",
                        "address": "0x5154b8"
                    },
                    {
                        "name": "GetClipboardOwner",
                        "address": "0x5154bc"
                    },
                    {
                        "name": "GetAsyncKeyState",
                        "address": "0x5154c0"
                    },
                    {
                        "name": "DestroyCursor",
                        "address": "0x5154c4"
                    },
                    {
                        "name": "CloseClipboard",
                        "address": "0x5154c8"
                    },
                    {
                        "name": "PaintDesktop",
                        "address": "0x5154cc"
                    },
                    {
                        "name": "GetInputState",
                        "address": "0x5154d0"
                    },
                    {
                        "name": "GetCursor",
                        "address": "0x5154d4"
                    },
                    {
                        "name": "CloseDesktop",
                        "address": "0x5154d8"
                    },
                    {
                        "name": "ReleaseCapture",
                        "address": "0x5154dc"
                    },
                    {
                        "name": "EnumClipboardFormats",
                        "address": "0x5154e0"
                    },
                    {
                        "name": "GetWindowContextHelpId",
                        "address": "0x5154e4"
                    },
                    {
                        "name": "GetWindowTextLengthA",
                        "address": "0x5154e8"
                    },
                    {
                        "name": "GetClipboardViewer",
                        "address": "0x5154ec"
                    },
                    {
                        "name": "GetThreadDesktop",
                        "address": "0x5154f0"
                    },
                    {
                        "name": "IsCharAlphaW",
                        "address": "0x5154f4"
                    },
                    {
                        "name": "AnyPopup",
                        "address": "0x5154f8"
                    },
                    {
                        "name": "CharUpperW",
                        "address": "0x5154fc"
                    },
                    {
                        "name": "IsCharLowerW",
                        "address": "0x515500"
                    },
                    {
                        "name": "IsClipboardFormatAvailable",
                        "address": "0x515504"
                    },
                    {
                        "name": "GetQueueStatus",
                        "address": "0x515508"
                    },
                    {
                        "name": "CloseWindow",
                        "address": "0x51550c"
                    },
                    {
                        "name": "GetDialogBaseUnits",
                        "address": "0x515510"
                    },
                    {
                        "name": "OemKeyScan",
                        "address": "0x515514"
                    },
                    {
                        "name": "SendMessageA",
                        "address": "0x515518"
                    },
                    {
                        "name": "RemovePropA",
                        "address": "0x51551c"
                    },
                    {
                        "name": "ReleaseDC",
                        "address": "0x515520"
                    },
                    {
                        "name": "RegisterWindowMessageA",
                        "address": "0x515524"
                    },
                    {
                        "name": "RegisterClassA",
                        "address": "0x515528"
                    },
                    {
                        "name": "PtInRect",
                        "address": "0x51552c"
                    },
                    {
                        "name": "PostThreadMessageA",
                        "address": "0x515530"
                    },
                    {
                        "name": "PostQuitMessage",
                        "address": "0x515534"
                    },
                    {
                        "name": "PostMessageA",
                        "address": "0x515538"
                    },
                    {
                        "name": "PeekMessageA",
                        "address": "0x51553c"
                    },
                    {
                        "name": "ModifyMenuA",
                        "address": "0x515540"
                    },
                    {
                        "name": "MessageBoxA",
                        "address": "0x515544"
                    },
                    {
                        "name": "MapWindowPoints",
                        "address": "0x515548"
                    },
                    {
                        "name": "LoadStringA",
                        "address": "0x51554c"
                    },
                    {
                        "name": "LoadIconA",
                        "address": "0x515550"
                    },
                    {
                        "name": "LoadCursorA",
                        "address": "0x515554"
                    },
                    {
                        "name": "LoadBitmapA",
                        "address": "0x515558"
                    },
                    {
                        "name": "KillTimer",
                        "address": "0x51555c"
                    },
                    {
                        "name": "IsWindowEnabled",
                        "address": "0x515560"
                    },
                    {
                        "name": "IsWindow",
                        "address": "0x515564"
                    },
                    {
                        "name": "IsIconic",
                        "address": "0x515568"
                    },
                    {
                        "name": "GrayStringA",
                        "address": "0x51556c"
                    },
                    {
                        "name": "GetWindowThreadProcessId",
                        "address": "0x515570"
                    },
                    {
                        "name": "GetWindowTextA",
                        "address": "0x515574"
                    },
                    {
                        "name": "GetWindowRect",
                        "address": "0x515578"
                    },
                    {
                        "name": "GetWindowPlacement",
                        "address": "0x51557c"
                    },
                    {
                        "name": "GetWindowLongA",
                        "address": "0x515580"
                    },
                    {
                        "name": "GetWindow",
                        "address": "0x515584"
                    },
                    {
                        "name": "GetTopWindow",
                        "address": "0x515588"
                    },
                    {
                        "name": "GetSystemMetrics",
                        "address": "0x51558c"
                    },
                    {
                        "name": "GetSysColorBrush",
                        "address": "0x515590"
                    },
                    {
                        "name": "GetSysColor",
                        "address": "0x515594"
                    },
                    {
                        "name": "GetSubMenu",
                        "address": "0x515598"
                    },
                    {
                        "name": "GetPropA",
                        "address": "0x51559c"
                    },
                    {
                        "name": "GetParent",
                        "address": "0x5155a0"
                    },
                    {
                        "name": "GetMessageTime",
                        "address": "0x5155a4"
                    },
                    {
                        "name": "GetMessagePos",
                        "address": "0x5155a8"
                    },
                    {
                        "name": "GetMessageA",
                        "address": "0x5155ac"
                    },
                    {
                        "name": "GetMenuState",
                        "address": "0x5155b0"
                    },
                    {
                        "name": "GetMenuItemID",
                        "address": "0x5155b4"
                    },
                    {
                        "name": "GetMenuItemCount",
                        "address": "0x5155b8"
                    },
                    {
                        "name": "GetMenuInfo",
                        "address": "0x5155bc"
                    },
                    {
                        "name": "GetMenuCheckMarkDimensions",
                        "address": "0x5155c0"
                    },
                    {
                        "name": "GetMenu",
                        "address": "0x5155c4"
                    },
                    {
                        "name": "GetLastActivePopup",
                        "address": "0x5155c8"
                    },
                    {
                        "name": "GetKeyState",
                        "address": "0x5155cc"
                    },
                    {
                        "name": "GetForegroundWindow",
                        "address": "0x5155d0"
                    },
                    {
                        "name": "GetFocus",
                        "address": "0x5155d4"
                    },
                    {
                        "name": "GetDlgItem",
                        "address": "0x5155d8"
                    },
                    {
                        "name": "GetDlgCtrlID",
                        "address": "0x5155dc"
                    },
                    {
                        "name": "GetDC",
                        "address": "0x5155e0"
                    },
                    {
                        "name": "GetClientRect",
                        "address": "0x5155e4"
                    },
                    {
                        "name": "GetClassNameA",
                        "address": "0x5155e8"
                    },
                    {
                        "name": "GetClassLongA",
                        "address": "0x5155ec"
                    },
                    {
                        "name": "GetClassInfoExA",
                        "address": "0x5155f0"
                    },
                    {
                        "name": "GetClassInfoA",
                        "address": "0x5155f4"
                    },
                    {
                        "name": "GetCapture",
                        "address": "0x5155f8"
                    },
                    {
                        "name": "EnableWindow",
                        "address": "0x5155fc"
                    },
                    {
                        "name": "EnableMenuItem",
                        "address": "0x515600"
                    },
                    {
                        "name": "DrawTextExA",
                        "address": "0x515604"
                    },
                    {
                        "name": "DrawTextA",
                        "address": "0x515608"
                    },
                    {
                        "name": "DispatchMessageA",
                        "address": "0x51560c"
                    },
                    {
                        "name": "DestroyWindow",
                        "address": "0x515610"
                    },
                    {
                        "name": "DestroyMenu",
                        "address": "0x515614"
                    },
                    {
                        "name": "DefWindowProcA",
                        "address": "0x515618"
                    },
                    {
                        "name": "CreateWindowExA",
                        "address": "0x51561c"
                    },
                    {
                        "name": "CopyRect",
                        "address": "0x515620"
                    },
                    {
                        "name": "CheckMenuItem",
                        "address": "0x515624"
                    },
                    {
                        "name": "CharUpperA",
                        "address": "0x515628"
                    },
                    {
                        "name": "CharNextW",
                        "address": "0x51562c"
                    },
                    {
                        "name": "CharNextA",
                        "address": "0x515630"
                    },
                    {
                        "name": "CallWindowProcA",
                        "address": "0x515634"
                    },
                    {
                        "name": "CallNextHookEx",
                        "address": "0x515638"
                    },
                    {
                        "name": "AdjustWindowRectEx",
                        "address": "0x51563c"
                    },
                    {
                        "name": "ClientToScreen",
                        "address": "0x515640"
                    }
                ],
                "dll": "USER32.dll"
            },
            {
                "imports": [
                    {
                        "name": "CreateRectRgn",
                        "address": "0x51500c"
                    },
                    {
                        "name": "EngDeletePath",
                        "address": "0x515010"
                    },
                    {
                        "name": "EngFreeModule",
                        "address": "0x515014"
                    },
                    {
                        "name": "EngUnlockSurface",
                        "address": "0x515018"
                    },
                    {
                        "name": "EngWideCharToMultiByte",
                        "address": "0x51501c"
                    },
                    {
                        "name": "EnumFontFamiliesA",
                        "address": "0x515020"
                    },
                    {
                        "name": "EnumFontsA",
                        "address": "0x515024"
                    },
                    {
                        "name": "Escape",
                        "address": "0x515028"
                    },
                    {
                        "name": "FontIsLinked",
                        "address": "0x51502c"
                    },
                    {
                        "name": "GdiAddGlsRecord",
                        "address": "0x515030"
                    },
                    {
                        "name": "GdiArtificialDecrementDriver",
                        "address": "0x515034"
                    },
                    {
                        "name": "GdiConvertPalette",
                        "address": "0x515038"
                    },
                    {
                        "name": "GdiCreateLocalMetaFilePict",
                        "address": "0x51503c"
                    },
                    {
                        "name": "GdiEndDocEMF",
                        "address": "0x515040"
                    },
                    {
                        "name": "GdiEntry4",
                        "address": "0x515044"
                    },
                    {
                        "name": "GdiGetCodePage",
                        "address": "0x515048"
                    },
                    {
                        "name": "GdiGetDC",
                        "address": "0x51504c"
                    },
                    {
                        "name": "GdiGetLocalBrush",
                        "address": "0x515050"
                    },
                    {
                        "name": "GdiReleaseDC",
                        "address": "0x515054"
                    },
                    {
                        "name": "GdiSetServerAttr",
                        "address": "0x515058"
                    },
                    {
                        "name": "GdiStartPageEMF",
                        "address": "0x51505c"
                    },
                    {
                        "name": "GetCharABCWidthsA",
                        "address": "0x515060"
                    },
                    {
                        "name": "GetCharWidthFloatW",
                        "address": "0x515064"
                    },
                    {
                        "name": "GetCurrentPositionEx",
                        "address": "0x515068"
                    },
                    {
                        "name": "GetDCPenColor",
                        "address": "0x51506c"
                    },
                    {
                        "name": "GetFontUnicodeRanges",
                        "address": "0x515070"
                    },
                    {
                        "name": "GetGlyphOutlineW",
                        "address": "0x515074"
                    },
                    {
                        "name": "GetMiterLimit",
                        "address": "0x515078"
                    },
                    {
                        "name": "GetNearestColor",
                        "address": "0x51507c"
                    },
                    {
                        "name": "GetTextExtentExPointI",
                        "address": "0x515080"
                    },
                    {
                        "name": "GetTextFaceAliasW",
                        "address": "0x515084"
                    },
                    {
                        "name": "LPtoDP",
                        "address": "0x515088"
                    },
                    {
                        "name": "PATHOBJ_vGetBounds",
                        "address": "0x51508c"
                    },
                    {
                        "name": "PolyPatBlt",
                        "address": "0x515090"
                    },
                    {
                        "name": "CreateColorSpaceW",
                        "address": "0x515094"
                    },
                    {
                        "name": "RemoveFontResourceExA",
                        "address": "0x515098"
                    },
                    {
                        "name": "RemoveFontResourceW",
                        "address": "0x51509c"
                    },
                    {
                        "name": "SelectObject",
                        "address": "0x5150a0"
                    },
                    {
                        "name": "SetGraphicsMode",
                        "address": "0x5150a4"
                    },
                    {
                        "name": "SetMetaRgn",
                        "address": "0x5150a8"
                    },
                    {
                        "name": "SetPixel",
                        "address": "0x5150ac"
                    },
                    {
                        "name": "cGetTTFFromFOT",
                        "address": "0x5150b0"
                    },
                    {
                        "name": "GetTextCharset",
                        "address": "0x5150b4"
                    },
                    {
                        "name": "SwapBuffers",
                        "address": "0x5150b8"
                    },
                    {
                        "name": "DeleteObject",
                        "address": "0x5150bc"
                    },
                    {
                        "name": "CreateSolidBrush",
                        "address": "0x5150c0"
                    },
                    {
                        "name": "SaveDC",
                        "address": "0x5150c4"
                    },
                    {
                        "name": "FlattenPath",
                        "address": "0x5150c8"
                    },
                    {
                        "name": "GdiGetBatchLimit",
                        "address": "0x5150cc"
                    },
                    {
                        "name": "AbortDoc",
                        "address": "0x5150d0"
                    },
                    {
                        "name": "GetStockObject",
                        "address": "0x5150d4"
                    },
                    {
                        "name": "GetLayout",
                        "address": "0x5150d8"
                    },
                    {
                        "name": "GetBkColor",
                        "address": "0x5150dc"
                    },
                    {
                        "name": "GdiFlush",
                        "address": "0x5150e0"
                    },
                    {
                        "name": "CreateHalftonePalette",
                        "address": "0x5150e4"
                    },
                    {
                        "name": "GetSystemPaletteUse",
                        "address": "0x5150e8"
                    },
                    {
                        "name": "GetObjectType",
                        "address": "0x5150ec"
                    },
                    {
                        "name": "GetTextColor",
                        "address": "0x5150f0"
                    },
                    {
                        "name": "GetColorSpace",
                        "address": "0x5150f4"
                    },
                    {
                        "name": "GetPolyFillMode",
                        "address": "0x5150f8"
                    },
                    {
                        "name": "GetGraphicsMode",
                        "address": "0x5150fc"
                    },
                    {
                        "name": "AbortPath",
                        "address": "0x515100"
                    },
                    {
                        "name": "DeleteColorSpace",
                        "address": "0x515104"
                    },
                    {
                        "name": "CreateCompatibleDC",
                        "address": "0x515108"
                    },
                    {
                        "name": "UnrealizeObject",
                        "address": "0x51510c"
                    },
                    {
                        "name": "UpdateColors",
                        "address": "0x515110"
                    },
                    {
                        "name": "CreatePatternBrush",
                        "address": "0x515114"
                    },
                    {
                        "name": "StrokePath",
                        "address": "0x515118"
                    },
                    {
                        "name": "CloseEnhMetaFile",
                        "address": "0x51511c"
                    },
                    {
                        "name": "PolyPolyline",
                        "address": "0x515120"
                    },
                    {
                        "name": "AddFontResourceW",
                        "address": "0x515124"
                    }
                ],
                "dll": "GDI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "RegOpenKeyExW",
                        "address": "0x515000"
                    },
                    {
                        "name": "RegQueryValueExA",
                        "address": "0x515004"
                    }
                ],
                "dll": "ADVAPI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "CoCreateFreeThreadedMarshaler",
                        "address": "0x515648"
                    },
                    {
                        "name": "CoCreateInstance",
                        "address": "0x51564c"
                    },
                    {
                        "name": "CoInitialize",
                        "address": "0x515650"
                    },
                    {
                        "name": "CoInitializeSecurity",
                        "address": "0x515654"
                    },
                    {
                        "name": "CoRegisterClassObject",
                        "address": "0x515658"
                    },
                    {
                        "name": "CoRevokeClassObject",
                        "address": "0x51565c"
                    },
                    {
                        "name": "CoTaskMemAlloc",
                        "address": "0x515660"
                    },
                    {
                        "name": "CoTaskMemFree",
                        "address": "0x515664"
                    },
                    {
                        "name": "CoTaskMemRealloc",
                        "address": "0x515668"
                    },
                    {
                        "name": "CoUninitialize",
                        "address": "0x51566c"
                    },
                    {
                        "name": "StringFromGUID2",
                        "address": "0x515670"
                    }
                ],
                "dll": "ole32.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x0012de78",
        "overlay": {
            "size": "0x00000d08",
            "offset": "0x00120c00"
        },
        "imagebase": "0x00400000",
        "reported_checksum": "0x00127e5c",
        "icon_hash": null,
        "entrypoint": "0x005136e0",
        "timestamp": "2019-02-20 05:33:55",
        "osversion": "5.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x00113200",
                "entropy": "7.12",
                "raw_address": "0x00000400",
                "virtual_size": "0x00113184",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rdata",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00115000",
                "size_of_data": "0x00003200",
                "entropy": "5.58",
                "raw_address": "0x00113600",
                "virtual_size": "0x000030b8",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x00119000",
                "size_of_data": "0x00000200",
                "entropy": "1.93",
                "raw_address": "0x00116800",
                "virtual_size": "0x00000258",
                "characteristics_raw": "0xc0000040"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x0011a000",
                "size_of_data": "0x0000a200",
                "entropy": "7.29",
                "raw_address": "0x00116a00",
                "virtual_size": "0x000ed1c0",
                "characteristics_raw": "0x40000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00115d2c",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x00000078"
            },
            {
                "virtual_address": "0x0011a000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x0000a1c0"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00120c00",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000d08"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00115000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000678"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "fa2d21c960425e9ec6378d6769bb3c1a",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 5,
        "versioninfo": []
    }
}