Exes_21d5abb9977d71918ee1de4e83dc8e84_2_2019-06-28_01_30.json

[*] MalFamily: "Shade"

[*] MalScore: 10.0

[*] File Name: "Exes_21d5abb9977d71918ee1de4e83dc8e84.2"
[*] File Size: 1085192
[*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
[*] SHA256: "2710580e6191bfdd72494a6e00548c6a697ad2f88bccc3cc73fc1100b4e60782"
[*] MD5: "21d5abb9977d71918ee1de4e83dc8e84"
[*] SHA1: "9f26bdd44c8283ccd83b46e62fc5687dc7bd4c9c"
[*] SHA512: "4613eb9edbe7b0eff338ddafb403a437e95d16e761e2a09c757c8e6e956045b3d34f64225773575a6654d233f258937eed4102935c6afa9bd1a4a2c9c5b1ca0a"
[*] CRC32: "068F16BE"
[*] SSDEEP: "12288:9+iDmbczDn6ILWGXhkogkuSeJLYeOfbg4TIvhVe/v82WgDSMy6ReTcERcu:0iDmwjLWVogkuSeuzT/Jpyumce/"

[*] Process Execution: [
    "Exes_21d5abb9977d71918ee1de4e83dc8e84.2",
    "vssadmin.exe",
    "vssadmin.exe",
    "vssadmin.exe",
    "cmd.exe",
    "chcp.com"
]

[*] Signatures Detected: [
    {
        "Description": "Creates RWX memory",
        "Details": []
    },
    {
        "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
        "Details": [
            {
                "IP": "104.16.155.36:80"
            },
            {
                "IP": "86.59.21.38:443"
            },
            {
                "IP": "172.245.126.96:443"
            },
            {
                "IP": "131.188.40.189:443"
            },
            {
                "IP": "138.201.250.33:9011"
            },
            {
                "IP": "104.18.34.131:80"
            },
            {
                "IP": "127.0.0.1:21601"
            },
            {
                "IP": "51.38.164.157:20000"
            }
        ]
    },
    {
        "Description": "Starts servers listening on 127.0.0.1:21601",
        "Details": []
    },
    {
        "Description": "Reads data out of its own binary image",
        "Details": [
            {
                "self_read": "process: Exes_21d5abb9977d71918ee1de4e83dc8e84.2, pid: 3060, offset: 0x00000000, length: 0x00108f08"
            }
        ]
    },
    {
        "Description": "Performs some HTTP requests",
        "Details": [
            {
                "url": "http://whatismyipaddress.com/"
            },
            {
                "url": "http://whatsmyip.net/"
            }
        ]
    },
    {
        "Description": "The binary likely contains encrypted or compressed data.",
        "Details": [
            {
                "section": "name: .text, entropy: 7.55, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x000ffa00, virtual_size: 0x000ff99d"
            }
        ]
    },
    {
        "Description": "Looks up the external IP address",
        "Details": [
            {
                "domain": "whatismyipaddress.com"
            }
        ]
    },
    {
        "Description": "Attempts to delete volume shadow copies",
        "Details": []
    },
    {
        "Description": "Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config",
        "Details": [
            {
                "regkeyval": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1"
            }
        ]
    },
    {
        "Description": "Installs Tor on the infected machine",
        "Details": []
    },
    {
        "Description": "Installs itself for autorun at Windows startup",
        "Details": [
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem"
            },
            {
                "data": "\"C:\\ProgramData\\Windows\\csrss.exe\""
            }
        ]
    },
    {
        "Description": "Exhibits possible ransomware file modification behavior",
        "Details": [
            {
                "file_modifications": "Performs 116 file moves indicative of a potential file encryption process"
            },
            {
                "drops_unknown_mimetypes": "Drops 106 unknown file mime types which may be indicative of encrypted files being written back to disk"
            },
            {
                "appends_new_extension": "Appends a new file extension to multiple modified files"
            },
            {
                "new_appended_file_extension": ".crypted000007"
            }
        ]
    },
    {
        "Description": "Collects information about installed applications",
        "Details": [
            {
                "Program": "Google Update Helper"
            },
            {
            },
            {
                "Program": "Microsoft Excel MUI  2013"
            },
            {
                "Program": "Microsoft Outlook MUI  2013"
            },
            {
            },
            {
                "Program": "Google Chrome"
            },
            {
                "Program": "Adobe Flash Player 29 NPAPI"
            },
            {
                "Program": "Adobe Flash Player 29 ActiveX"
            },
            {
                "Program": "Microsoft DCF MUI  2013"
            },
            {
                "Program": "Microsoft Access MUI  2013"
            },
            {
                "Program": "Microsoft Office Proofing Tools 2013 - English"
            },
            {
                "Program": "Adobe Acrobat Reader DC"
            },
            {
                "Program": "Microsoft Publisher MUI  2013"
            },
            {
                "Program": "Microsoft Office Shared MUI  2013"
            },
            {
                "Program": "Microsoft Office OSM MUI  2013"
            },
            {
                "Program": "Microsoft InfoPath MUI  2013"
            },
            {
                "Program": "Microsoft Office Shared Setup Metadata MUI  2013"
            },
            {
                "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
            },
            {
                "Program": "Microsoft Word MUI  2013"
            },
            {
                "Program": "Microsoft OneDrive"
            },
            {
                "Program": "Microsoft Groove MUI  2013"
            },
            {
                "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
            },
            {
            },
            {
                "Program": "Microsoft Access Setup Metadata MUI  2013"
            },
            {
                "Program": "Microsoft Office OSM UX MUI  2013"
            },
            {
                "Program": "Java Auto Updater"
            },
            {
                "Program": "Microsoft PowerPoint MUI  2013"
            },
            {
                "Program": "Microsoft Office Professional Plus 2013"
            },
            {
                "Program": "Adobe Refresh Manager"
            },
            {
                "Program": "Microsoft Office Proofing  2013"
            },
            {
                "Program": "Microsoft Lync MUI  2013"
            },
            {
            },
            {
                "Program": "Microsoft OneNote MUI  2013"
            }
        ]
    },
    {
        "Description": "Creates a hidden or system file",
        "Details": [
            {
                "file": "C:\\ProgramData\\Windows\\"
            }
        ]
    },
    {
        "Description": "File has been identified by 57 Antiviruses on VirusTotal as malicious",
        "Details": [
            {
                "MicroWorld-eScan": "Trojan.GenericKD.31989955"
            },
            {
                "CAT-QuickHeal": "Ransom.Troldesh"
            },
            {
                "McAfee": "Trojan-FQSD!21D5ABB9977D"
            },
            {
                "Cylance": "Unsafe"
            },
            {
                "AegisLab": "Trojan.Win32.Shade.4!c"
            },
            {
                "K7AntiVirus": "Trojan ( 0054862b1 )"
            },
            {
                "Alibaba": "Ransom:Win32/Shade.bad99a13"
            },
            {
                "K7GW": "Trojan ( 0054862b1 )"
            },
            {
                "Cybereason": "malicious.9977d7"
            },
            {
                "TrendMicro": "Ransom.Win32.SHADE.THCAAAI"
            },
            {
                "Cyren": "W32/Trojan.HIUY-2822"
            },
            {
                "Symantec": "Ransom.Troldesh"
            },
            {
                "APEX": "Malicious"
            },
            {
                "Paloalto": "generic.ml"
            },
            {
                "Kaspersky": "Trojan-Ransom.Win32.Shade.psy"
            },
            {
                "BitDefender": "Trojan.GenericKD.31989955"
            },
            {
                "NANO-Antivirus": "Trojan.Win32.Kryptik.fntnnp"
            },
            {
                "ViRobot": "Trojan.Win32.S.Ransom.1085192"
            },
            {
                "Rising": "Trojan.Kryptik!8.8 (TFE:3:h81h44Nk1aG)"
            },
            {
                "Endgame": "malicious (high confidence)"
            },
            {
                "Sophos": "Troj/Ransom-FGW"
            },
            {
                "Comodo": "Malware@#2epmyldjgukxz"
            },
            {
                "F-Secure": "Heuristic.HEUR/AGEN.1040230"
            },
            {
                "DrWeb": "Trojan.Siggen8.13058"
            },
            {
                "VIPRE": "Trojan.Win32.Generic!BT"
            },
            {
                "Invincea": "heuristic"
            },
            {
                "McAfee-GW-Edition": "Trojan-FQSD!21D5ABB9977D"
            },
            {
                "FireEye": "Generic.mg.21d5abb9977d7191"
            },
            {
                "Emsisoft": "Trojan-Ransom.Shade (A)"
            },
            {
                "Ikarus": "Trojan-Ransom.Crypted007"
            },
            {
                "F-Prot": "W32/Emotet.SI.gen!Eldorado"
            },
            {
                "Jiangmin": "Trojan.Shade.ra"
            },
            {
                "Webroot": "W32.Trojan.Gen"
            },
            {
                "Avira": "HEUR/AGEN.1040230"
            },
            {
                "MAX": "malware (ai score=100)"
            },
            {
                "Antiy-AVL": "Trojan/Win32.Agent"
            },
            {
                "Microsoft": "Ransom:Win32/Shade.C!bit"
            },
            {
                "SUPERAntiSpyware": "Trojan.Agent/Gen-Dropper"
            },
            {
                "ZoneAlarm": "Trojan-Ransom.Win32.Shade.psy"
            },
            {
                "GData": "Trojan.GenericKD.31989955"
            },
            {
                "AhnLab-V3": "Trojan/Win32.Ransom.R258048"
            },
            {
                "Acronis": "suspicious"
            },
            {
                "VBA32": "BScope.Malware-Cryptor.Filecoder"
            },
            {
                "ALYac": "Trojan.Ransom.Shade"
            },
            {
                "Ad-Aware": "Trojan.GenericKD.31989955"
            },
            {
                "Malwarebytes": "Spyware.PasswordStealer"
            },
            {
                "Panda": "Trj/GdSda.A"
            },
            {
                "ESET-NOD32": "a variant of Win32/Kryptik.GPYH"
            },
            {
                "TrendMicro-HouseCall": "Ransom.Win32.SHADE.THCAAAI"
            },
            {
                "Tencent": "Win32.Trojan.Shade.Hrfh"
            },
            {
                "Yandex": "Trojan.Shade!"
            },
            {
                "SentinelOne": "DFI - Malicious PE"
            },
            {
                "Fortinet": "W32/Kryptik.GPYH!tr.ransom"
            },
            {
                "AVG": "Win32:Trojan-gen"
            },
            {
                "Avast": "Win32:Trojan-gen"
            },
            {
                "CrowdStrike": "win/malicious_confidence_100% (W)"
            },
            {
                "Qihoo-360": "HEUR/QVM20.1.AE12.Malware.Gen"
            }
        ]
    },
    {
        "Description": "Creates a copy of itself",
        "Details": [
            {
                "copy": "C:\\ProgramData\\Windows\\csrss.exe"
            }
        ]
    },
    {
        "Description": "Harvests information related to installed mail clients",
        "Details": [
            {
                "file": "C:\\Users\\user\\Documents\\Outlook Files\\Outlook.pst"
            }
        ]
    },
    {
        "Description": "Anomalous binary characteristics",
        "Details": [
            {
                "anomaly": "Actual checksum does not match that reported in PE header"
            }
        ]
    },
    {
        "Description": "Created network traffic indicative of malicious activity",
        "Details": [
            {
                "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 185"
            },
            {
                "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 122"
            },
            {
                "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 132"
            },
            {
                "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 505"
            },
            {
                "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 640"
            }
        ]
    }
]

[*] Started Service: []

[*] Executed Commands: [
    "C:\\Windows\\system32\\vssadmin.exe List Shadows",
    "C:\\Windows\\system32\\vssadmin.exe Delete Shadows /All /Quiet",
    "C:\\Windows\\system32\\cmd.exe",
    "chcp"
]

[*] Mutexes: []

[*] Modified Files: [
    "\\??\\PIPE\\wkssvc",
    "C:\\ProgramData\\Windows\\csrss.exe",
    "\\??\\PIPE\\srvsvc",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\lock",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs.new",
    "C:\\README1.txt",
    "C:\\README2.txt",
    "C:\\README3.txt",
    "C:\\README4.txt",
    "C:\\README5.txt",
    "C:\\README6.txt",
    "C:\\README7.txt",
    "C:\\README8.txt",
    "C:\\README9.txt",
    "C:\\README10.txt",
    "C:\\Users\\user\\Pictures\\Host.zip",
    "C:\\Users\\user\\Pictures\\LI2KCl7rHPyc82f1AXVvtLXMSGdNOrzBjsbopQSpxvM=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.xls",
    "C:\\Users\\user\\Pictures\\eqYsbmYYmeZyBUm2zy7b+JU-KTqkChvcTnn7ttohXps=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.pptx",
    "C:\\Users\\user\\Pictures\\8u4dCRGKhRk5J7OFWyL60oTDhHN+r+xCJlZ7RYkV6lI=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.ppt",
    "C:\\Users\\user\\Pictures\\sxKy4ZjNkTuZ7g+wuRPNKgUBUNIFtJWpIhe63zeTi0M=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.pdf",
    "C:\\Users\\user\\Pictures\\qBATXM4QBwBgOVppG20Zup3m+agY3cDbpf3ciUk9VL0=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.jpg",
    "C:\\Users\\user\\Pictures\\1uZ2KJA7Z1hH56c--U6PfX5z8LLy4dfA6wPHl34GpIw=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.html",
    "C:\\Users\\user\\Pictures\\1Y0vPWNgouPLih35fUvr+TwjRCMt1o5A3IEu3-1NkNI=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.gif",
    "C:\\Users\\user\\Pictures\\248lYIbceNiO17lXHsshtIcegpW7sGnZveeXpKErsbU=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.doc",
    "C:\\Users\\user\\Pictures\\SH16tgAz71tWomxN9O02BKm440SaCxmEwI-IjuL-oMU=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\.xls",
    "C:\\Users\\user\\Pictures\\eouFtkfq8grn62NIwB1uTA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\.jpg",
    "C:\\Users\\user\\Pictures\\gDOOTp3FqDZc85bz-rFf-Q==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\.html",
    "C:\\Users\\user\\Pictures\\cAxhqhf1iyyXdafWlMKb1Q==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\.doc",
    "C:\\Users\\user\\Pictures\\RSetaJ9UlqmV7gZg1epMHg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\.bmp",
    "C:\\Users\\user\\Pictures\\5nhcjhDWxfOG4ijQUtNXuw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\ZpCt3h0gTLbDfFFkFTgDS7LAG88NaufHyHLebPbMbUfHOYW+4eofopAVMNdmHu0rbyk89K2n6a5ZHf+1NEY3ibW7ecqCCf-H69zbKjhibFpH5TtdAnlFJXeaTISiIA9a.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\RlAzNd2xNmPMxhCOnYXH8aXQcAmpNIih19aucTyNuco=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\6XuWG0HelL90iWaDa7EiBgKVH63eE9lfXn1KrvR5VtUrrpPvoBRDOcCOG5k1cTAb.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\2SdYxYKgZstRV2s4gpxgDf0ibyvak3IjCUfhebWUqsY=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\szxxQ48l5ECFxnWg91AT58TfXxA8uYkBwKpxxYNOUpE=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\9hq+603E0gC8F2a9Dt09wChkg5nE7+zbtfMWz0MjPI8=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\uzadiKWvTCUwBdZoUNJK8txtakZKxlxGYYAW0C-Dcr7y0c03mEv+ns1+b0IILqpr.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\lUHDb0Ef+ewQHbErwZHesF5--pI-zDZunL1eLr3+8OA=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\7oI4OPelj84UFREaW95C74wGWJM2LpTdpYTzYa-CWKeheLSlaH6HVhXk+VqfYFTT.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\yry9Kl32wmS+1kxfs3aG14u0Tj7OjaeE8ak8hGvUUUs=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\gIkyPZR+e9-A3loBBFKeSclmsy3ZivZ+tGDP6SCVieo=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\VP5kKP7gJnOtAcIkYcXQzbxw2cFMlQAymorYqpdC5Bo=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\NuOh1ZXA-wlRE8vSO9cLMEF3utSzYUKoTasSAHgdSv8=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\rVo6TDyxikoFed8Lmx0ECXRzt-i8Noq16Gc8QydwqDdP2dra48PHZtTZlo-Prx7r.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\uigCAVZhPdXKIobfF6BnXPeWRnZNzj7Ehw2lldly9wI=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\hQiv-duNO+q7io0AVKffCuofywSFQnNsehu9eu2infzYZu6rWCq2uyHdR3XiZ10C.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\nS1JCB7py3E5iyTiQaUhqcqnFW2U4r5FxVIQ+Dya2rQ=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\eBsOkNsqpcrllldBOqZB-0BzPvyvviyk6HbRJvFItZs=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\PT47hXDsFlYDyWDLrP2Kv4f1G+kW9bqVrUG42ZyGfzw=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\4DiCDKwsFT2jRLlnrHKEPbGtgTDtxNyhcBDgT5PiNzs=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\8fK-UpYmr++k2MrCzJ5boXyun2nLmlSyGtCKYmnLWFA=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\I-r9MNCuBUAC8SWZs7Mwp9wBTBvHd9LRY-VMVD1ChSU=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\SvbbW6xFc0A6ALuPNEAPuxREIFYx0tlMPw9BgZotNz0=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\lqi1L9K5SqGxLwWSFQ0Ha+jAStXjFgsRvIsaZOz+X-0=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\txu3e93GD4kUuHUyi8Yz1gqrJtIiCX+Pcr8mK-lV59k=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\79puKkAWBRd7eJIthel9A6Bf5Ro18IbbQesbFL5ZAQg=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\oJefCxKxMv5lVwT+owIyogHp24rSMlBeGGLr0pBpBOc=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\FnvYi4RgIefIVZSn4iSR4EmPLneDT2F4fZ06jIa1mDY=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\w3NI5oNARq+AEEoqedMbuHG9LzjPIlWLR9WFtpgMLhw=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\bQkX6ADtr2nSz71E6yYxEPhjxGipMvzxdhiFLcKRiJk=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159[[fn=Insight]].dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\K-z0JwD720LH3tS44-HspoFIQCIaQQDuZBGPVNfl1bTdWPm-XA+tBigSiz5qyd4qzF3BDBQGkvr36f5gL0qndg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158[[fn=Element]].dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\5CzHnoNEEyMd-mDOKG15gkEhes-HaYKssdMyFG4YAC1l2KZMQLNUMGRqqvIJ0p4o9E8RCjHjUeAl9x0RVq582A==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\dRtKinuQKcxKxNd4rThy6BirjniTyXANSqCHrsJQHMPSIYgRTwhRTVemRrnBGCk-aQEYirx7fngPhY73j-0rp8pQDKduQ1Z5WRBPHNjj9ySlxuJV2GNX13C+X80uZ7skjH0D7QW3207o-Mnmf6dEONrj9rMZf-WIGnijrMj6QwsH293Ov0oNFsUm5X6X0wgQ.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907[[fn=Equations]].dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\7OVu8GyTrOW60R-m7qtXdhzO5gGhYOwyHjjXRgCWwR3RPoLqByuvpHMzGzoilmIMhctoVKDxaN14ExG7xF9YIA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227[[fn=sist02]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\ll-VAGARECBLw5Ub5gzS+zlMuxp49R0ZpnWSvOCKBy0aStbdTjzAFKiK24GkS+DgmoGoOq45Awsq6BhCVX2sTQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226[[fn=turabian]].xsl",
    "\\Device\\NamedPipe",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\3PL0OWYgZgjOl31kN2LwLnK3JzDfGqBYzdOtsW+bwGSw0MxKEYOIGgP6wZ+K5vt9hWZwbFzfU7BWYzZZFkuDcg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225[[fn=mlaseventheditionofficeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\1YnAxk2LL4mkhPXkEp8XXAM62Lt0tXBIv+1wwiU2s7AV8vsN8-FSgESXzqB4kXLOTbbxIgbFL6WBIVxt3nKrW5+ZsTxe3BhRGELJjS8PgS32giROde8PwgibOIV2NTKr0ANqdVDRUCwS1x8tmomiYQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224[[fn=iso690nmerical]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\BgEvWSYq7zpdp1K6gLpiZSu50mAy4tBrMP4iDC8kI8A6S6DLFWO2Z7lS4d0NNiFsuya2Z+6SkqW7oLhnknrUtdbv4cGtMlqJ3eT4t81ZHsI=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223[[fn=iso690]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\wzDtn2t2znqMIicUKzHPwCt8Yi-baA16N6dXz9WW4kJjtwOM6075Gxdeo31XF5EoPVPSEb8f6in3StSCCux2iA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222[[fn=ieee2006officeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\41R8SbtC3nY4qTz2bUEdRJ0h6efL+lS7ocEEUgrycXYA71xcaZCSK3FoIbQqgWpxKy8nwwsDaKqB3fnVXLR8sETNHa3ZkuxhkwmSZJy-bwI8kYIzHirxiee5vCk+HliZ.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221[[fn=harvardanglia2008officeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\8OuNdDESv-pxcX4iufDsZ-Id07oYNKSySgZJqYQD1mGBg1bBnxTQGt4CLfa7RaQJSCQxkvaH49YPwthFH5Cue6qf8+NtWMQNKGKr802yvI0tNZ3c+puoOs-egNisXWXWUYLgSiTzjQdZkG2wMOVrVw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220[[fn=gosttitle]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\xV33xcAg6rqb8RO4IPbqQAFMqMuCKlcf0DUXq7xVe2QVWX1f1uNKxw6+yMDOlAlQzwmUXjfRi82cJ-Mg1NlwJg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219[[fn=gostname]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\g3-kG7AfjBxlr6P8cERQ3Rq3BYguDOhfAbVZJcQgAbZBhng9tOVqaJ-NqISnkq2mcG-sGGHRV4uGO3Oq0SvMbQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218[[fn=gb]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\n0QafW7sJdLHNeI6JwYNcJ4iAidopD9j-u-rqupkqx6xZcA20F6hgH1nrkAE5LUJ.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217[[fn=chicago]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\Aw3q3FVGeL8MhnZaNpC6xJjX1rt+okxvR2pIxDIpLm4BysWBoOAjfGIxey6U2aMdUajVnEfrNdwGT7Qwkv+ihg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216[[fn=apasixtheditionofficeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\kJRHQuk7osncQlGXINO1pxjMDU8mKDKswdWwxazEhlzoIBnN3Xf66g5zwvTGiQMlcZkwbi2Q7KoHC0DIhdjQG8Bs6R84gPnCIJWj+SaGi2PypTsuCBl7Yp15zqLgc4AI.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\wHZLHt1Lah7TpBPfusEMM2D8l9vu4RF+Q6gIzsOVwfUolB1kO4oQ7QxGLklGZW4kyulazWLmimue6EepfueqzA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\CdyKHGYAiPcWTNJhpTCShaxx2L9EC4EomrnSs19UhRlEflIXf6PjO0LdCWna8OMnxSSvq3terDIEaCmfoGm5Dw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\5CV4d7vtq1D+diNMpB6xn4sdmzd8AewUDaLgZL-z+82+FvTQwXiFzYXQ1QfpZWx68D92u1EM0ZtFy8VB1P4+-A==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\lktYpB4q21eGn-pikRsY48DkjTn30qfbvoWHjPTS1KGHB5sgvMDLAADSEQ4zbPKgd70PVpWYgKpQE4XJ5Clucg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\h9K2olx2+5GMxVIulbzPGE5f7UO-M4i0xjyel6U83+Y1TaiCtn-z6zTaCvWIoUIBdJxvmk5tBCr2wvNnsTJANw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\0clInSjdTtHOs3zYkEnBlD5nvFlT+T+gw8xWlnqD70FY9twbCLNtSd8j3nM3tt0Ca9P2Lq3Eo6X32uracLfeSg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\CbF65-YB50-n+bOoPNyhKaN3umK2u2wDnVgKIUlzephhKoqPtbQgwcHOFBFj0vdBi7jpw1aXerEzwp4c7r+KvSx9GLZO7XX7j5YLs4LmEDI=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\xgrQMJstPpdLnE+GKHMXux7b68BODo184uH9nTFFp0qwiR4spoLF+tuNqGJPXBAaRs0cxg+ZnxPyeNY4fCsx6g==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\18oDFDeT4FMf187OCdjnY-uhkgkvxNc4qXBYiBELSgLm80NikkHm8YdAfGuFqqjJ6aFYkifR7VV3bRJe7LZrqA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\V-ylV8i6ER7zGKTWe4CB0S0V4RTPy2XSfzlFY4TqfQaMmQwW5TGyQ1uLkrP1DN7lO0O+0W-2MilM1pyRComfpg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\U79ykAWBeaXHUpvSm2B87pStcqe6aaKm6dYrr1Fi8K9n60j+XYH+zFiuMxxhMRECEY5gPr8acVtmfiYS4ExDBg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\vw2xXGQlka9Fve0jo2jxsDLcvxJd3diEghLuClX50OaGFXC6tjXGZmfX8OmY5fS2Z-CKBXzAYWymUh6a6APjnQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\IL5AaXJcxkFKlTWdgzO5yZSrSk9jNWCEzszzyNvmJEnPdyaYHz7cbovObv1F74xXQDlq7rlayiR1uXESi6-XPg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\ebzpixPka69t0mz1XCAGtSkRSWooolHlR0Ku8gxNtZdAxoA9A3F0ujTjZzXyen0T-OkthGQ8TNKMTCqmtOEYsA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\N7ElJ3My6cT9ksWTVD-9duCtnOQzAp44rOiwy0QWJC1CbZXIfP3AA4CmqrTOz47Fuxg8d4EzhSYDWEdjGv6+Zw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\HAUY1SNFXUh4KxIp7JFhFXGhAeMH2Ly8R4p5VPv7aoavW315IWQIodd-wm7M6QczLcGBO2bONBfMuLIYS8l72A==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\fvpkDU4cDs8H5FPAZIfRj6gQPj4T2RxUInxHf7RjXw+OSvLXy2HCh6LclQXCnA08Wxthqf9mkit46N4vJnhlvw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\8QgbpScVoYUXano+fZrCQxZQ4N6D6XdJP-xtNolObfdGQEfGFspe1ZklQPrAVd5S6nHqPX7edkbUmMJ2YFeUVQ+iOnKXjhnbLk09g66Szzg=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\bb8TTWOMBowz5IgFTpUa8UeIrGDolybps6hkWVtfkbntdiw4ZObnPCd1uMSPOD5VZxkRjBCXjOghD9pkjFdd7Q==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\9IOrHzYOZSzoyOIF0MEw5-mE60UUhHZc0WuOHZWzH0qgvjpuLs6rU0DlriunZwKy+iEL3rGTLaY0kf4tBABW8A==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\jwwuXUbaN50uS6nB25QZCbFcY0rP-htTndeevnA7WEl65R445--xut5ylcn16GjLiYnAWjqcFg7D9bDphjLVIA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\lzvlmRIBiMtylPfnCgteAobnfDSmlbmu+yRQLjtv0nNAn9oXgL0YWr6iF3hZjskeRfwq4C2iuMA5WgWPL2fvLA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\QPFvgbcpj7YpkIwKNNj6pGrHf4WQ0BDc4jwGxxLLREiQRKGyn5wrvufY6JgXk5y9kf6BhtS7O+qCu1YMJ2Dwcw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\ajo0ABugjkbZw+XIJoWTX-tZVoMrOZZNMPE0AV-U9lHk4voI3Znl3+OR50+1ONLkpm+RM5Sub00sVjVy4vzpyg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\BP3mbnY1H4Cmsmo8sUVOUXc7Mf63Ymcm0lG2Qtn-Js1wCwIJVdBYqqQOnkER6b41.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\UyGugJ58Ngsbh08JWfqlgLhr0ud4SLPu5v11GJyjU1M=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\i7G1e86riInFiFhDcEjAbNecLlWs0aSqyi9usIFA3pE=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\o5GieVaOE-sxCk+RT+X70jUrTRDzwIlYaXkCzWyL4A8=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\vRbkq7VrhSpAuNC7SZMdr5Tks5LbbxNf4BWCoA5ifZw=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\HKC4kTaW6raellMrArQ1iJI1NJ3p4FzF98DVIc1GGUU=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\teaQYhB2M8DJa3z6z8-aPvc2WoBnGISPvX7oZOC0qaT8Mqt6MmjOFWoa-+s-skV+ug00pIRi-cisMPCUBbMjcg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\glr13lotmRtaz0mv9VI1D3-45nBu-9zi32TV+7nRbVqufNQe3EHW4yhyrv4uWA-Or3Rj6r5NxFA+fM+A3Ze-dQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\dRPvk0bKqMzv9jLfsJaa8SKK2NxtQsCH7d1sUuGJc8s=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\5xwZ7NPWzJHbvr4W22pTX+xmEJXt+NKSD1DaSPGCDFY=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\jUSVLN9MuVq7NOEc9RoHYzFk7HCPhh-x9q5CDF+R2CNUespkKa-esB4JuD5zS6tPvv7amZAB3RtJjrkRvJBO0clUi3T77zoK-ljnYx0JWaM=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\A8irWVEIa7WNSf-Oq6JPVmeAXpOB4QQkiK804ATs9JV1z1blGfjv9h7+m4kxe0ur.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\91BaKv9TX8lRhJhDF4QaHyP6A-lL9txRigGMm9rwT3w=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SdEBi1hCg2nS5fAgXw64tZqEAvisH7EiqsbvAD4-29MDur6d2F9U9DuCZDHfoynv.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\2wgfEK8B67pKYGcNfPYiAMUUPQ+FAD1MsaCu+QLu4u83HMAM8F2ZgQkaeguWFBm7oz21DSfQh9xBshrAnKmC8p+X2ttfY4R9jq-djygjW60=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\bHpzwg73RaR4a-WxR8xhnnBEV7oGIV2EZvgAZz-+JcA=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\bUdEWbb0z+iybaOqD1KdjhfmJ9noUe68dcC7WG-Esck=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\bm0nyxjOwR0mjolIDulxcg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\N5+n0NXElID-0Be+gVSVMxPHYhUHhl0KYSstWQEpSdg=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\UDTG79OWNbNjZxhMwiAk7EF1ttBFlELSf-N5X+s4wJj19jL0yyp1k0jXll-nLKpSlMIB8Sx6yYeEc8YIjIvOxg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\BSJVsJFPTjvOm2t1ilm2trIvVDxEGCJalqvKs2P9xXAsb773dehsgnf0A-J3MPoGUp56JM5JTencgD7JAdV1tIeukcNKXO36X4VG6FuqWVSyU0rw1HidbPssrNjAuzXcNO65vzFj6DUibLM2a8XiNQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\KuKLXXWH74tW8SSCzELBx+0fFH4-rSri3LCIQPv31izxEVFlyBA4RujTVL4a7KwnMsPLWiWOvQuy0Qf1z4ELwA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\-67vo7b4AUeoTdZ3FLqurdnJOqQeiuyV-uOEmEWpkdqFIracFi521ZgipdH7SbFfDFhR-ZVUuqkTKYEN9IjywP6aJj3UAF3rXP7qDGDaA6A=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\+kfzJvNIYY2ibIt2qrDtbaoxGu5SxlgcSNflfqxyHyA=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\GCabfL-YHSYSuMrd75w8ALgIBCOYYDBo2CMXZb3xTHQ=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\M2Ok8V06V9HlU6Yb9OoRfvKWMQ3zNY2FLJYrWMSORCM=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\Dho6Flr5bzzq7SKJKrNsH7wJe+A0Uv8+0a6cVCbvYEk4p1EHalU-YU97bXi3QgH2ynQ+LetN3+rSYKIP9A-eZii81ZFa1Ytpkpu9D2POz+4=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\zyGGG484IuC0DVRbyRoJaAgV8dwH1vwPVLVebf+6m6Y=.C30C4DA81AE308962B9A.crypted000007"
]

[*] Deleted Files: [
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
    "C:\\Users\\user\\Pictures\\Host.zip",
    "C:\\Users\\user\\Pictures\\Host.xls",
    "C:\\Users\\user\\Pictures\\Host.pptx",
    "C:\\Users\\user\\Pictures\\Host.ppt",
    "C:\\Users\\user\\Pictures\\Host.pdf",
    "C:\\Users\\user\\Pictures\\Host.jpg",
    "C:\\Users\\user\\Pictures\\Host.html",
    "C:\\Users\\user\\Pictures\\Host.gif",
    "C:\\Users\\user\\Pictures\\Host.doc",
    "C:\\Users\\user\\Pictures\\.xls",
    "C:\\Users\\user\\Pictures\\.jpg",
    "C:\\Users\\user\\Pictures\\.html",
    "C:\\Users\\user\\Pictures\\.doc",
    "C:\\Users\\user\\Pictures\\.bmp",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159[[fn=Insight]].dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158[[fn=Element]].dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907[[fn=Equations]].dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227[[fn=sist02]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226[[fn=turabian]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225[[fn=mlaseventheditionofficeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224[[fn=iso690nmerical]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223[[fn=iso690]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222[[fn=ieee2006officeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221[[fn=harvardanglia2008officeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220[[fn=gosttitle]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219[[fn=gostname]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218[[fn=gb]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217[[fn=chicago]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216[[fn=apasixtheditionofficeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl"
]

[*] Modified Registry Keys: [
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\System32\\Configuration\\",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xi",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xVersion",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmail",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmode",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xpk",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xstate",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xcnt",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shst",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh2",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shsnt"
]

[*] Deleted Registry Keys: []

[*] DNS Communications: [
    {
        "type": "A",
        "request": "whatismyipaddress.com",
        "answers": [
            {
                "data": "104.16.154.36",
                "type": "A"
            },
            {
                "data": "104.16.155.36",
                "type": "A"
            }
        ]
    },
    {
        "type": "A",
        "request": "whatsmyip.net",
        "answers": [
            {
                "data": "104.18.35.131",
                "type": "A"
            },
            {
                "data": "104.18.34.131",
                "type": "A"
            }
        ]
    }
]

[*] Domains: [
    {
        "ip": "104.16.154.36",
        "domain": "whatismyipaddress.com"
    },
    {
        "ip": "104.18.34.131",
        "domain": "whatsmyip.net"
    }
]

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: [
    {
        "count": 10,
        "body": "",
        "uri": "http://whatismyipaddress.com/",
        "user-agent": "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0",
        "method": "GET",
        "host": "whatismyipaddress.com",
        "version": "1.1",
        "path": "/",
        "data": "GET / HTTP/1.1\r\nHost: whatismyipaddress.com\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://whatsmyip.net/",
        "user-agent": "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0",
        "method": "GET",
        "host": "whatsmyip.net",
        "version": "1.1",
        "path": "/",
        "data": "GET / HTTP/1.1\r\nHost: whatsmyip.net\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0\r\n\r\n",
        "port": 80
    }
]

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "GetStringTypeW",
                        "address": "0x5010e4"
                    },
                    {
                        "name": "GetSystemDefaultLCID",
                        "address": "0x5010e8"
                    },
                    {
                        "name": "GetSystemTimeAsFileTime",
                        "address": "0x5010ec"
                    },
                    {
                        "name": "GetThreadLocale",
                        "address": "0x5010f0"
                    },
                    {
                        "name": "GetThreadPriority",
                        "address": "0x5010f4"
                    },
                    {
                        "name": "GetTickCount",
                        "address": "0x5010f8"
                    },
                    {
                        "name": "GetUserDefaultUILanguage",
                        "address": "0x5010fc"
                    },
                    {
                        "name": "GetVersionExA",
                        "address": "0x501100"
                    },
                    {
                        "name": "GetVersionExW",
                        "address": "0x501104"
                    },
                    {
                        "name": "GlobalAddAtomW",
                        "address": "0x501108"
                    },
                    {
                        "name": "GlobalAlloc",
                        "address": "0x50110c"
                    },
                    {
                        "name": "GlobalDeleteAtom",
                        "address": "0x501110"
                    },
                    {
                        "name": "GlobalFindAtomW",
                        "address": "0x501114"
                    },
                    {
                        "name": "GlobalFlags",
                        "address": "0x501118"
                    },
                    {
                        "name": "GlobalFree",
                        "address": "0x50111c"
                    },
                    {
                        "name": "GlobalHandle",
                        "address": "0x501120"
                    },
                    {
                        "name": "GlobalLock",
                        "address": "0x501124"
                    },
                    {
                        "name": "GlobalReAlloc",
                        "address": "0x501128"
                    },
                    {
                        "name": "GlobalUnlock",
                        "address": "0x50112c"
                    },
                    {
                        "name": "Heap32ListNext",
                        "address": "0x501130"
                    },
                    {
                        "name": "HeapAlloc",
                        "address": "0x501134"
                    },
                    {
                        "name": "HeapCreate",
                        "address": "0x501138"
                    },
                    {
                        "name": "HeapFree",
                        "address": "0x50113c"
                    },
                    {
                        "name": "HeapReAlloc",
                        "address": "0x501140"
                    },
                    {
                        "name": "HeapSize",
                        "address": "0x501144"
                    },
                    {
                        "name": "HeapValidate",
                        "address": "0x501148"
                    },
                    {
                        "name": "InitializeCriticalSection",
                        "address": "0x50114c"
                    },
                    {
                        "name": "InitializeCriticalSectionAndSpinCount",
                        "address": "0x501150"
                    },
                    {
                        "name": "InterlockedDecrement",
                        "address": "0x501154"
                    },
                    {
                        "name": "InterlockedExchange",
                        "address": "0x501158"
                    },
                    {
                        "name": "InterlockedIncrement",
                        "address": "0x50115c"
                    },
                    {
                        "name": "IsDebuggerPresent",
                        "address": "0x501160"
                    },
                    {
                        "name": "IsValidCodePage",
                        "address": "0x501164"
                    },
                    {
                        "name": "LCMapStringA",
                        "address": "0x501168"
                    },
                    {
                        "name": "LCMapStringW",
                        "address": "0x50116c"
                    },
                    {
                        "name": "LeaveCriticalSection",
                        "address": "0x501170"
                    },
                    {
                        "name": "LoadLibraryA",
                        "address": "0x501174"
                    },
                    {
                        "name": "LoadLibraryW",
                        "address": "0x501178"
                    },
                    {
                        "name": "LoadResource",
                        "address": "0x50117c"
                    },
                    {
                        "name": "LocalAlloc",
                        "address": "0x501180"
                    },
                    {
                        "name": "LocalFree",
                        "address": "0x501184"
                    },
                    {
                        "name": "LocalReAlloc",
                        "address": "0x501188"
                    },
                    {
                        "name": "LocalSize",
                        "address": "0x50118c"
                    },
                    {
                        "name": "LockResource",
                        "address": "0x501190"
                    },
                    {
                        "name": "MapViewOfFile",
                        "address": "0x501194"
                    },
                    {
                        "name": "MultiByteToWideChar",
                        "address": "0x501198"
                    },
                    {
                        "name": "OpenEventW",
                        "address": "0x50119c"
                    },
                    {
                        "name": "OpenMutexW",
                        "address": "0x5011a0"
                    },
                    {
                        "name": "OpenSemaphoreA",
                        "address": "0x5011a4"
                    },
                    {
                        "name": "GetStringTypeExW",
                        "address": "0x5011a8"
                    },
                    {
                        "name": "OutputDebugStringA",
                        "address": "0x5011ac"
                    },
                    {
                        "name": "QueryPerformanceCounter",
                        "address": "0x5011b0"
                    },
                    {
                        "name": "RaiseException",
                        "address": "0x5011b4"
                    },
                    {
                        "name": "ReadConsoleW",
                        "address": "0x5011b8"
                    },
                    {
                        "name": "ReadFile",
                        "address": "0x5011bc"
                    },
                    {
                        "name": "ReleaseMutex",
                        "address": "0x5011c0"
                    },
                    {
                        "name": "ReplaceFileA",
                        "address": "0x5011c4"
                    },
                    {
                        "name": "RtlUnwind",
                        "address": "0x5011c8"
                    },
                    {
                        "name": "SetComputerNameExA",
                        "address": "0x5011cc"
                    },
                    {
                        "name": "SetConsoleCtrlHandler",
                        "address": "0x5011d0"
                    },
                    {
                        "name": "SetConsoleMode",
                        "address": "0x5011d4"
                    },
                    {
                        "name": "SetConsoleOutputCP",
                        "address": "0x5011d8"
                    },
                    {
                        "name": "SetConsoleTextAttribute",
                        "address": "0x5011dc"
                    },
                    {
                        "name": "SetErrorMode",
                        "address": "0x5011e0"
                    },
                    {
                        "name": "SetEvent",
                        "address": "0x5011e4"
                    },
                    {
                        "name": "SetFilePointer",
                        "address": "0x5011e8"
                    },
                    {
                        "name": "SetHandleCount",
                        "address": "0x5011ec"
                    },
                    {
                        "name": "SetLastError",
                        "address": "0x5011f0"
                    },
                    {
                        "name": "SetStdHandle",
                        "address": "0x5011f4"
                    },
                    {
                        "name": "SetThreadLocale",
                        "address": "0x5011f8"
                    },
                    {
                        "name": "SetUnhandledExceptionFilter",
                        "address": "0x5011fc"
                    },
                    {
                        "name": "SetVolumeMountPointW",
                        "address": "0x501200"
                    },
                    {
                        "name": "SizeofResource",
                        "address": "0x501204"
                    },
                    {
                        "name": "Sleep",
                        "address": "0x501208"
                    },
                    {
                        "name": "SystemTimeToFileTime",
                        "address": "0x50120c"
                    },
                    {
                        "name": "TerminateProcess",
                        "address": "0x501210"
                    },
                    {
                        "name": "TerminateThread",
                        "address": "0x501214"
                    },
                    {
                        "name": "TlsAlloc",
                        "address": "0x501218"
                    },
                    {
                        "name": "TlsFree",
                        "address": "0x50121c"
                    },
                    {
                        "name": "TlsGetValue",
                        "address": "0x501220"
                    },
                    {
                        "name": "TlsSetValue",
                        "address": "0x501224"
                    },
                    {
                        "name": "UnhandledExceptionFilter",
                        "address": "0x501228"
                    },
                    {
                        "name": "UnmapViewOfFile",
                        "address": "0x50122c"
                    },
                    {
                        "name": "VerLanguageNameA",
                        "address": "0x501230"
                    },
                    {
                        "name": "VirtualAlloc",
                        "address": "0x501234"
                    },
                    {
                        "name": "VirtualFree",
                        "address": "0x501238"
                    },
                    {
                        "name": "WaitForMultipleObjects",
                        "address": "0x50123c"
                    },
                    {
                        "name": "WaitForSingleObject",
                        "address": "0x501240"
                    },
                    {
                        "name": "WideCharToMultiByte",
                        "address": "0x501244"
                    },
                    {
                        "name": "WriteConsoleA",
                        "address": "0x501248"
                    },
                    {
                        "name": "WriteConsoleW",
                        "address": "0x50124c"
                    },
                    {
                        "name": "WriteFile",
                        "address": "0x501250"
                    },
                    {
                        "name": "WritePrivateProfileStringW",
                        "address": "0x501254"
                    },
                    {
                        "name": "_lwrite",
                        "address": "0x501258"
                    },
                    {
                        "name": "lstrcmpA",
                        "address": "0x50125c"
                    },
                    {
                        "name": "lstrcmpW",
                        "address": "0x501260"
                    },
                    {
                        "name": "lstrlenA",
                        "address": "0x501264"
                    },
                    {
                        "name": "lstrlenW",
                        "address": "0x501268"
                    },
                    {
                        "name": "GetStringTypeA",
                        "address": "0x50126c"
                    },
                    {
                        "name": "GetStdHandle",
                        "address": "0x501270"
                    },
                    {
                        "name": "GetStartupInfoW",
                        "address": "0x501274"
                    },
                    {
                        "name": "GetStartupInfoA",
                        "address": "0x501278"
                    },
                    {
                        "name": "GetShortPathNameW",
                        "address": "0x50127c"
                    },
                    {
                        "name": "GetProcessHeaps",
                        "address": "0x501280"
                    },
                    {
                        "name": "GetProcessHeap",
                        "address": "0x501284"
                    },
                    {
                        "name": "GetProcAddress",
                        "address": "0x501288"
                    },
                    {
                        "name": "GetOEMCP",
                        "address": "0x50128c"
                    },
                    {
                        "name": "GetModuleHandleW",
                        "address": "0x501290"
                    },
                    {
                        "name": "GetModuleHandleA",
                        "address": "0x501294"
                    },
                    {
                        "name": "GetModuleFileNameW",
                        "address": "0x501298"
                    },
                    {
                        "name": "GetModuleFileNameA",
                        "address": "0x50129c"
                    },
                    {
                        "name": "GetLocaleInfoW",
                        "address": "0x5012a0"
                    },
                    {
                        "name": "GetLocaleInfoA",
                        "address": "0x5012a4"
                    },
                    {
                        "name": "GetLocalTime",
                        "address": "0x5012a8"
                    },
                    {
                        "name": "GetLastError",
                        "address": "0x5012ac"
                    },
                    {
                        "name": "GetFileType",
                        "address": "0x5012b0"
                    },
                    {
                        "name": "GetExitCodeThread",
                        "address": "0x5012b4"
                    },
                    {
                        "name": "GetEnvironmentStringsW",
                        "address": "0x5012b8"
                    },
                    {
                        "name": "GetCurrentThreadId",
                        "address": "0x5012bc"
                    },
                    {
                        "name": "GetCurrentThread",
                        "address": "0x5012c0"
                    },
                    {
                        "name": "GetCurrentProcessId",
                        "address": "0x5012c4"
                    },
                    {
                        "name": "CloseHandle",
                        "address": "0x5012c8"
                    },
                    {
                        "name": "GetCurrentProcess",
                        "address": "0x5012cc"
                    },
                    {
                        "name": "GetConsoleScreenBufferInfo",
                        "address": "0x5012d0"
                    },
                    {
                        "name": "GetConsoleOutputCP",
                        "address": "0x5012d4"
                    },
                    {
                        "name": "GetConsoleMode",
                        "address": "0x5012d8"
                    },
                    {
                        "name": "GetConsoleFontSize",
                        "address": "0x5012dc"
                    },
                    {
                        "name": "GetConsoleCP",
                        "address": "0x5012e0"
                    },
                    {
                        "name": "GetComputerNameW",
                        "address": "0x5012e4"
                    },
                    {
                        "name": "GetCommandLineW",
                        "address": "0x5012e8"
                    },
                    {
                        "name": "GetCPInfo",
                        "address": "0x5012ec"
                    },
                    {
                        "name": "GetACP",
                        "address": "0x5012f0"
                    },
                    {
                        "name": "FreeLibrary",
                        "address": "0x5012f4"
                    },
                    {
                        "name": "FreeEnvironmentStringsW",
                        "address": "0x5012f8"
                    },
                    {
                        "name": "FormatMessageW",
                        "address": "0x5012fc"
                    },
                    {
                        "name": "FlushFileBuffers",
                        "address": "0x501300"
                    },
                    {
                        "name": "FindResourceW",
                        "address": "0x501304"
                    },
                    {
                        "name": "FindNextFileW",
                        "address": "0x501308"
                    },
                    {
                        "name": "FindFirstFileW",
                        "address": "0x50130c"
                    },
                    {
                        "name": "FindClose",
                        "address": "0x501310"
                    },
                    {
                        "name": "FileTimeToLocalFileTime",
                        "address": "0x501314"
                    },
                    {
                        "name": "FileTimeToDosDateTime",
                        "address": "0x501318"
                    },
                    {
                        "name": "ExitProcess",
                        "address": "0x50131c"
                    },
                    {
                        "name": "EnumResourceLanguagesW",
                        "address": "0x501320"
                    },
                    {
                        "name": "EnterCriticalSection",
                        "address": "0x501324"
                    },
                    {
                        "name": "DeleteCriticalSection",
                        "address": "0x501328"
                    },
                    {
                        "name": "CreateThread",
                        "address": "0x50132c"
                    },
                    {
                        "name": "CreateMutexW",
                        "address": "0x501330"
                    },
                    {
                        "name": "CreateMutexA",
                        "address": "0x501334"
                    },
                    {
                        "name": "CreateFileW",
                        "address": "0x501338"
                    },
                    {
                        "name": "CreateFileMappingW",
                        "address": "0x50133c"
                    },
                    {
                        "name": "CreateFileA",
                        "address": "0x501340"
                    },
                    {
                        "name": "CreateEventW",
                        "address": "0x501344"
                    },
                    {
                        "name": "ConvertDefaultLocale",
                        "address": "0x501348"
                    },
                    {
                        "name": "OpenThread",
                        "address": "0x50134c"
                    }
                ],
                "dll": "KERNEL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "GetWindowThreadProcessId",
                        "address": "0x501354"
                    },
                    {
                        "name": "GrayStringW",
                        "address": "0x501358"
                    },
                    {
                        "name": "IsIconic",
                        "address": "0x50135c"
                    },
                    {
                        "name": "IsWindow",
                        "address": "0x501360"
                    },
                    {
                        "name": "IsWindowEnabled",
                        "address": "0x501364"
                    },
                    {
                        "name": "IsWindowVisible",
                        "address": "0x501368"
                    },
                    {
                        "name": "LoadBitmapW",
                        "address": "0x50136c"
                    },
                    {
                        "name": "LoadCursorW",
                        "address": "0x501370"
                    },
                    {
                        "name": "LoadIconW",
                        "address": "0x501374"
                    },
                    {
                        "name": "LoadMenuW",
                        "address": "0x501378"
                    },
                    {
                        "name": "MapWindowPoints",
                        "address": "0x50137c"
                    },
                    {
                        "name": "MessageBoxA",
                        "address": "0x501380"
                    },
                    {
                        "name": "MessageBoxW",
                        "address": "0x501384"
                    },
                    {
                        "name": "ModifyMenuW",
                        "address": "0x501388"
                    },
                    {
                        "name": "MsgWaitForMultipleObjectsEx",
                        "address": "0x50138c"
                    },
                    {
                        "name": "NotifyWinEvent",
                        "address": "0x501390"
                    },
                    {
                        "name": "PeekMessageW",
                        "address": "0x501394"
                    },
                    {
                        "name": "PostMessageW",
                        "address": "0x501398"
                    },
                    {
                        "name": "PostQuitMessage",
                        "address": "0x50139c"
                    },
                    {
                        "name": "PostThreadMessageA",
                        "address": "0x5013a0"
                    },
                    {
                        "name": "PtInRect",
                        "address": "0x5013a4"
                    },
                    {
                        "name": "RegisterClassW",
                        "address": "0x5013a8"
                    },
                    {
                        "name": "RegisterWindowMessageW",
                        "address": "0x5013ac"
                    },
                    {
                        "name": "ReleaseDC",
                        "address": "0x5013b0"
                    },
                    {
                        "name": "RemovePropW",
                        "address": "0x5013b4"
                    },
                    {
                        "name": "SendMessageA",
                        "address": "0x5013b8"
                    },
                    {
                        "name": "SendMessageW",
                        "address": "0x5013bc"
                    },
                    {
                        "name": "SetCursor",
                        "address": "0x5013c0"
                    },
                    {
                        "name": "SetForegroundWindow",
                        "address": "0x5013c4"
                    },
                    {
                        "name": "SetMenu",
                        "address": "0x5013c8"
                    },
                    {
                        "name": "SetMenuItemBitmaps",
                        "address": "0x5013cc"
                    },
                    {
                        "name": "SetMessageQueue",
                        "address": "0x5013d0"
                    },
                    {
                        "name": "SetPropW",
                        "address": "0x5013d4"
                    },
                    {
                        "name": "SetWindowLongW",
                        "address": "0x5013d8"
                    },
                    {
                        "name": "SetWindowPos",
                        "address": "0x5013dc"
                    },
                    {
                        "name": "SetWindowTextW",
                        "address": "0x5013e0"
                    },
                    {
                        "name": "SetWindowsHookExW",
                        "address": "0x5013e4"
                    },
                    {
                        "name": "ShowWindow",
                        "address": "0x5013e8"
                    },
                    {
                        "name": "SystemParametersInfoA",
                        "address": "0x5013ec"
                    },
                    {
                        "name": "TabbedTextOutW",
                        "address": "0x5013f0"
                    },
                    {
                        "name": "TranslateMessage",
                        "address": "0x5013f4"
                    },
                    {
                        "name": "UnhookWinEvent",
                        "address": "0x5013f8"
                    },
                    {
                        "name": "UnhookWindowsHookEx",
                        "address": "0x5013fc"
                    },
                    {
                        "name": "UnregisterClassW",
                        "address": "0x501400"
                    },
                    {
                        "name": "UnregisterDeviceNotification",
                        "address": "0x501404"
                    },
                    {
                        "name": "ValidateRect",
                        "address": "0x501408"
                    },
                    {
                        "name": "WinHelpW",
                        "address": "0x50140c"
                    },
                    {
                        "name": "CharNextW",
                        "address": "0x501410"
                    },
                    {
                        "name": "WindowFromDC",
                        "address": "0x501414"
                    },
                    {
                        "name": "LoadCursorFromFileA",
                        "address": "0x501418"
                    },
                    {
                        "name": "GetClipboardData",
                        "address": "0x50141c"
                    },
                    {
                        "name": "InSendMessage",
                        "address": "0x501420"
                    },
                    {
                        "name": "IsMenu",
                        "address": "0x501424"
                    },
                    {
                        "name": "DestroyIcon",
                        "address": "0x501428"
                    },
                    {
                        "name": "CharLowerW",
                        "address": "0x50142c"
                    },
                    {
                        "name": "GetMenuContextHelpId",
                        "address": "0x501430"
                    },
                    {
                        "name": "VkKeyScanA",
                        "address": "0x501434"
                    },
                    {
                        "name": "CountClipboardFormats",
                        "address": "0x501438"
                    },
                    {
                        "name": "IsCharAlphaA",
                        "address": "0x50143c"
                    },
                    {
                        "name": "IsCharAlphaNumericA",
                        "address": "0x501440"
                    },
                    {
                        "name": "GetProcessWindowStation",
                        "address": "0x501444"
                    },
                    {
                        "name": "IsWindowUnicode",
                        "address": "0x501448"
                    },
                    {
                        "name": "GetKeyboardLayout",
                        "address": "0x50144c"
                    },
                    {
                        "name": "VkKeyScanW",
                        "address": "0x501450"
                    },
                    {
                        "name": "GetKBCodePage",
                        "address": "0x501454"
                    },
                    {
                        "name": "GetClipboardOwner",
                        "address": "0x501458"
                    },
                    {
                        "name": "GetAsyncKeyState",
                        "address": "0x50145c"
                    },
                    {
                        "name": "DestroyCursor",
                        "address": "0x501460"
                    },
                    {
                        "name": "CloseClipboard",
                        "address": "0x501464"
                    },
                    {
                        "name": "PaintDesktop",
                        "address": "0x501468"
                    },
                    {
                        "name": "GetInputState",
                        "address": "0x50146c"
                    },
                    {
                        "name": "GetCursor",
                        "address": "0x501470"
                    },
                    {
                        "name": "CloseDesktop",
                        "address": "0x501474"
                    },
                    {
                        "name": "ReleaseCapture",
                        "address": "0x501478"
                    },
                    {
                        "name": "EnumClipboardFormats",
                        "address": "0x50147c"
                    },
                    {
                        "name": "GetWindowContextHelpId",
                        "address": "0x501480"
                    },
                    {
                        "name": "GetWindowTextLengthA",
                        "address": "0x501484"
                    },
                    {
                        "name": "GetClipboardViewer",
                        "address": "0x501488"
                    },
                    {
                        "name": "GetThreadDesktop",
                        "address": "0x50148c"
                    },
                    {
                        "name": "IsCharAlphaW",
                        "address": "0x501490"
                    },
                    {
                        "name": "AnyPopup",
                        "address": "0x501494"
                    },
                    {
                        "name": "CharUpperW",
                        "address": "0x501498"
                    },
                    {
                        "name": "IsCharLowerW",
                        "address": "0x50149c"
                    },
                    {
                        "name": "IsClipboardFormatAvailable",
                        "address": "0x5014a0"
                    },
                    {
                        "name": "GetQueueStatus",
                        "address": "0x5014a4"
                    },
                    {
                        "name": "CloseWindow",
                        "address": "0x5014a8"
                    },
                    {
                        "name": "GetDialogBaseUnits",
                        "address": "0x5014ac"
                    },
                    {
                        "name": "OemKeyScan",
                        "address": "0x5014b0"
                    },
                    {
                        "name": "GetWindowTextW",
                        "address": "0x5014b4"
                    },
                    {
                        "name": "GetWindowRect",
                        "address": "0x5014b8"
                    },
                    {
                        "name": "GetWindowPlacement",
                        "address": "0x5014bc"
                    },
                    {
                        "name": "GetWindowLongW",
                        "address": "0x5014c0"
                    },
                    {
                        "name": "GetWindow",
                        "address": "0x5014c4"
                    },
                    {
                        "name": "GetTopWindow",
                        "address": "0x5014c8"
                    },
                    {
                        "name": "GetSystemMetrics",
                        "address": "0x5014cc"
                    },
                    {
                        "name": "GetSysColorBrush",
                        "address": "0x5014d0"
                    },
                    {
                        "name": "GetSysColor",
                        "address": "0x5014d4"
                    },
                    {
                        "name": "GetSubMenu",
                        "address": "0x5014d8"
                    },
                    {
                        "name": "GetScrollPos",
                        "address": "0x5014dc"
                    },
                    {
                        "name": "GetPropW",
                        "address": "0x5014e0"
                    },
                    {
                        "name": "GetParent",
                        "address": "0x5014e4"
                    },
                    {
                        "name": "GetMessageW",
                        "address": "0x5014e8"
                    },
                    {
                        "name": "GetMessageTime",
                        "address": "0x5014ec"
                    },
                    {
                        "name": "GetMessagePos",
                        "address": "0x5014f0"
                    },
                    {
                        "name": "GetMessageExtraInfo",
                        "address": "0x5014f4"
                    },
                    {
                        "name": "GetMenuState",
                        "address": "0x5014f8"
                    },
                    {
                        "name": "GetMenuItemID",
                        "address": "0x5014fc"
                    },
                    {
                        "name": "GetMenuItemCount",
                        "address": "0x501500"
                    },
                    {
                        "name": "GetMenuCheckMarkDimensions",
                        "address": "0x501504"
                    },
                    {
                        "name": "GetMenu",
                        "address": "0x501508"
                    },
                    {
                        "name": "GetLastActivePopup",
                        "address": "0x50150c"
                    },
                    {
                        "name": "GetKeyState",
                        "address": "0x501510"
                    },
                    {
                        "name": "GetForegroundWindow",
                        "address": "0x501514"
                    },
                    {
                        "name": "GetFocus",
                        "address": "0x501518"
                    },
                    {
                        "name": "GetDlgItem",
                        "address": "0x50151c"
                    },
                    {
                        "name": "GetDlgCtrlID",
                        "address": "0x501520"
                    },
                    {
                        "name": "GetDC",
                        "address": "0x501524"
                    },
                    {
                        "name": "GetCursorPos",
                        "address": "0x501528"
                    },
                    {
                        "name": "GetClientRect",
                        "address": "0x50152c"
                    },
                    {
                        "name": "GetClassNameW",
                        "address": "0x501530"
                    },
                    {
                        "name": "GetClassLongW",
                        "address": "0x501534"
                    },
                    {
                        "name": "GetClassInfoExW",
                        "address": "0x501538"
                    },
                    {
                        "name": "GetCapture",
                        "address": "0x50153c"
                    },
                    {
                        "name": "GetActiveWindow",
                        "address": "0x501540"
                    },
                    {
                        "name": "EnableWindow",
                        "address": "0x501544"
                    },
                    {
                        "name": "EnableMenuItem",
                        "address": "0x501548"
                    },
                    {
                        "name": "EmptyClipboard",
                        "address": "0x50154c"
                    },
                    {
                        "name": "DrawTextW",
                        "address": "0x501550"
                    },
                    {
                        "name": "DrawTextExW",
                        "address": "0x501554"
                    },
                    {
                        "name": "DispatchMessageW",
                        "address": "0x501558"
                    },
                    {
                        "name": "DestroyWindow",
                        "address": "0x50155c"
                    },
                    {
                        "name": "DestroyMenu",
                        "address": "0x501560"
                    },
                    {
                        "name": "DefWindowProcW",
                        "address": "0x501564"
                    },
                    {
                        "name": "DefWindowProcA",
                        "address": "0x501568"
                    },
                    {
                        "name": "DdeQueryConvInfo",
                        "address": "0x50156c"
                    },
                    {
                        "name": "CreateWindowExW",
                        "address": "0x501570"
                    },
                    {
                        "name": "CreateDialogParamW",
                        "address": "0x501574"
                    },
                    {
                        "name": "CopyRect",
                        "address": "0x501578"
                    },
                    {
                        "name": "ClientToScreen",
                        "address": "0x50157c"
                    },
                    {
                        "name": "CheckMenuItem",
                        "address": "0x501580"
                    },
                    {
                        "name": "CharLowerA",
                        "address": "0x501584"
                    },
                    {
                        "name": "CallWindowProcW",
                        "address": "0x501588"
                    },
                    {
                        "name": "CallNextHookEx",
                        "address": "0x50158c"
                    },
                    {
                        "name": "AdjustWindowRectEx",
                        "address": "0x501590"
                    },
                    {
                        "name": "GetClassInfoW",
                        "address": "0x501594"
                    }
                ],
                "dll": "USER32.dll"
            },
            {
                "imports": [
                    {
                        "name": "XLATEOBJ_cGetPalette",
                        "address": "0x501038"
                    },
                    {
                        "name": "GetTextCharset",
                        "address": "0x50103c"
                    },
                    {
                        "name": "SwapBuffers",
                        "address": "0x501040"
                    },
                    {
                        "name": "DeleteObject",
                        "address": "0x501044"
                    },
                    {
                        "name": "CreateSolidBrush",
                        "address": "0x501048"
                    },
                    {
                        "name": "SaveDC",
                        "address": "0x50104c"
                    },
                    {
                        "name": "FlattenPath",
                        "address": "0x501050"
                    },
                    {
                        "name": "GdiGetBatchLimit",
                        "address": "0x501054"
                    },
                    {
                        "name": "AbortDoc",
                        "address": "0x501058"
                    },
                    {
                        "name": "GetStockObject",
                        "address": "0x50105c"
                    },
                    {
                        "name": "GetLayout",
                        "address": "0x501060"
                    },
                    {
                        "name": "GetBkColor",
                        "address": "0x501064"
                    },
                    {
                        "name": "GdiFlush",
                        "address": "0x501068"
                    },
                    {
                        "name": "CreateHalftonePalette",
                        "address": "0x50106c"
                    },
                    {
                        "name": "XFORMOBJ_iGetXform",
                        "address": "0x501070"
                    },
                    {
                        "name": "GetObjectType",
                        "address": "0x501074"
                    },
                    {
                        "name": "GetColorSpace",
                        "address": "0x501078"
                    },
                    {
                        "name": "AddFontResourceW",
                        "address": "0x50107c"
                    },
                    {
                        "name": "GetPolyFillMode",
                        "address": "0x501080"
                    },
                    {
                        "name": "GetGraphicsMode",
                        "address": "0x501084"
                    },
                    {
                        "name": "AbortPath",
                        "address": "0x501088"
                    },
                    {
                        "name": "DeleteColorSpace",
                        "address": "0x50108c"
                    },
                    {
                        "name": "CreateCompatibleDC",
                        "address": "0x501090"
                    },
                    {
                        "name": "UnrealizeObject",
                        "address": "0x501094"
                    },
                    {
                        "name": "GetDCPenColor",
                        "address": "0x501098"
                    },
                    {
                        "name": "UpdateColors",
                        "address": "0x50109c"
                    },
                    {
                        "name": "CreatePatternBrush",
                        "address": "0x5010a0"
                    },
                    {
                        "name": "StrokePath",
                        "address": "0x5010a4"
                    },
                    {
                        "name": "StartDocW",
                        "address": "0x5010a8"
                    },
                    {
                        "name": "SetWindowExtEx",
                        "address": "0x5010ac"
                    },
                    {
                        "name": "SetTextColor",
                        "address": "0x5010b0"
                    },
                    {
                        "name": "GetTextColor",
                        "address": "0x5010b4"
                    },
                    {
                        "name": "GetICMProfileW",
                        "address": "0x5010b8"
                    },
                    {
                        "name": "GetCharABCWidthsA",
                        "address": "0x5010bc"
                    },
                    {
                        "name": "GdiStartDocEMF",
                        "address": "0x5010c0"
                    },
                    {
                        "name": "GdiDllInitialize",
                        "address": "0x5010c4"
                    },
                    {
                        "name": "EngReleaseSemaphore",
                        "address": "0x5010c8"
                    },
                    {
                        "name": "EngQueryLocalTime",
                        "address": "0x5010cc"
                    },
                    {
                        "name": "EngLoadModule",
                        "address": "0x5010d0"
                    },
                    {
                        "name": "DPtoLP",
                        "address": "0x5010d4"
                    },
                    {
                        "name": "GetSystemPaletteUse",
                        "address": "0x5010d8"
                    },
                    {
                        "name": "CopyMetaFileW",
                        "address": "0x5010dc"
                    }
                ],
                "dll": "GDI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "RegSetValueExA",
                        "address": "0x501000"
                    },
                    {
                        "name": "RegQueryValueW",
                        "address": "0x501004"
                    },
                    {
                        "name": "RegQueryValueExW",
                        "address": "0x501008"
                    },
                    {
                        "name": "RegQueryValueExA",
                        "address": "0x50100c"
                    },
                    {
                        "name": "RegOpenKeyW",
                        "address": "0x501010"
                    },
                    {
                        "name": "RegOpenKeyExW",
                        "address": "0x501014"
                    },
                    {
                        "name": "RegOpenKeyExA",
                        "address": "0x501018"
                    },
                    {
                        "name": "RegEnumKeyW",
                        "address": "0x50101c"
                    },
                    {
                        "name": "RegDeleteKeyW",
                        "address": "0x501020"
                    },
                    {
                        "name": "RegCreateKeyExW",
                        "address": "0x501024"
                    },
                    {
                        "name": "RegCreateKeyExA",
                        "address": "0x501028"
                    },
                    {
                        "name": "RegCloseKey",
                        "address": "0x50102c"
                    },
                    {
                        "name": "RegSetValueExW",
                        "address": "0x501030"
                    }
                ],
                "dll": "ADVAPI32.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x0010eac1",
        "overlay": {
            "size": "0x00000d08",
            "offset": "0x00108200"
        },
        "imagebase": "0x00400000",
        "reported_checksum": "0x00114aa1",
        "icon_hash": null,
        "entrypoint": "0x005002c0",
        "timestamp": "2019-03-06 20:01:50",
        "osversion": "5.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x000ffa00",
                "entropy": "7.55",
                "raw_address": "0x00000400",
                "virtual_size": "0x000ff99d",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rdata",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00101000",
                "size_of_data": "0x00007a00",
                "entropy": "2.71",
                "raw_address": "0x000ffe00",
                "virtual_size": "0x00007956",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x00109000",
                "size_of_data": "0x00000200",
                "entropy": "3.90",
                "raw_address": "0x00107800",
                "virtual_size": "0x000002f8",
                "characteristics_raw": "0xc0000040"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x0010a000",
                "size_of_data": "0x00000800",
                "entropy": "4.76",
                "raw_address": "0x00107a00",
                "virtual_size": "0x000fd7f8",
                "characteristics_raw": "0x40000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00106ab0",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x00000064"
            },
            {
                "virtual_address": "0x0010a000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x000007f8"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00108200",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000d08"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00101000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x0000059c"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "7d6c8070a47bef32500cde51100d1e17",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 4,
        "versioninfo": []
    }
}

[*] Resolved APIs: [
    "kernel32.dll.VirtualAlloc",
    "kernel32.dll.LoadLibraryExA",
    "kernel32.dll.GetProcAddress",
    "kernel32.dll.SetFilePointer",
    "kernel32.dll.lstrlenA",
    "kernel32.dll.lstrcatA",
    "kernel32.dll.VirtualProtect",
    "kernel32.dll.UnmapViewOfFile",
    "kernel32.dll.GetModuleHandleA",
    "kernel32.dll.WriteFile",
    "kernel32.dll.CloseHandle",
    "kernel32.dll.VirtualFree",
    "kernel32.dll.GetTempPathA",
    "kernel32.dll.CreateFileA",
    "kernel32.dll.LoadLibraryA",
    "kernel32.dll.ExitProcess",
    "advapi32.dll.RegCloseKey",
    "oleaut32.dll.#6",
    "shell32.dll.SHGetMalloc",
    "user32.dll.CharUpperA",
    "ws2_32.dll.#1",
    "kernel32.dll.Sleep",
    "kernel32.dll.GetSystemTimeAsFileTime",
    "kernel32.dll.HeapFree",
    "kernel32.dll.HeapAlloc",
    "kernel32.dll.GetProcessHeap",
    "kernel32.dll.OpenProcess",
    "kernel32.dll.CreatePipe",
    "kernel32.dll.CreateProcessA",
    "kernel32.dll.GetExitCodeProcess",
    "kernel32.dll.SetHandleInformation",
    "kernel32.dll.PeekNamedPipe",
    "kernel32.dll.LocalFree",
    "kernel32.dll.GlobalMemoryStatusEx",
    "kernel32.dll.CreateFileMappingA",
    "kernel32.dll.InitializeCriticalSection",
    "kernel32.dll.InterlockedDecrement",
    "kernel32.dll.ReadFile",
    "kernel32.dll.CreateFileW",
    "kernel32.dll.GetLastError",
    "kernel32.dll.TerminateProcess",
    "kernel32.dll.GetCurrentProcess",
    "kernel32.dll.UnhandledExceptionFilter",
    "kernel32.dll.SetUnhandledExceptionFilter",
    "kernel32.dll.IsDebuggerPresent",
    "kernel32.dll.GetCommandLineA",
    "kernel32.dll.GetStartupInfoA",
    "kernel32.dll.RaiseException",
    "kernel32.dll.RtlUnwind",
    "kernel32.dll.GetModuleHandleW",
    "kernel32.dll.TlsGetValue",
    "kernel32.dll.TlsAlloc",
    "kernel32.dll.TlsSetValue",
    "kernel32.dll.TlsFree",
    "kernel32.dll.InterlockedIncrement",
    "kernel32.dll.SetLastError",
    "kernel32.dll.GetCurrentThreadId",
    "kernel32.dll.HeapSize",
    "kernel32.dll.GetStdHandle",
    "kernel32.dll.GetModuleFileNameA",
    "kernel32.dll.FreeEnvironmentStringsA",
    "kernel32.dll.GetEnvironmentStrings",
    "kernel32.dll.FreeEnvironmentStringsW",
    "kernel32.dll.WideCharToMultiByte",
    "kernel32.dll.GetEnvironmentStringsW",
    "kernel32.dll.SetHandleCount",
    "kernel32.dll.GetFileType",
    "kernel32.dll.DeleteCriticalSection",
    "kernel32.dll.HeapCreate",
    "kernel32.dll.QueryPerformanceCounter",
    "kernel32.dll.GetTickCount",
    "kernel32.dll.GetCurrentProcessId",
    "kernel32.dll.SetEvent",
    "kernel32.dll.GetACP",
    "kernel32.dll.DeleteFileA",
    "kernel32.dll.IsValidCodePage",
    "kernel32.dll.EnterCriticalSection",
    "kernel32.dll.LeaveCriticalSection",
    "kernel32.dll.GetConsoleCP",
    "kernel32.dll.GetConsoleMode",
    "kernel32.dll.FlushFileBuffers",
    "kernel32.dll.MultiByteToWideChar",
    "kernel32.dll.LCMapStringA",
    "kernel32.dll.LCMapStringW",
    "kernel32.dll.HeapReAlloc",
    "kernel32.dll.SetConsoleCtrlHandler",
    "kernel32.dll.FreeLibrary",
    "kernel32.dll.InitializeCriticalSectionAndSpinCount",
    "kernel32.dll.GetLocaleInfoA",
    "kernel32.dll.GetStringTypeA",
    "kernel32.dll.GetStringTypeW",
    "kernel32.dll.GetTimeFormatA",
    "kernel32.dll.GetDateFormatA",
    "kernel32.dll.SetStdHandle",
    "kernel32.dll.WriteConsoleA",
    "kernel32.dll.GetConsoleOutputCP",
    "kernel32.dll.WriteConsoleW",
    "kernel32.dll.GetTimeZoneInformation",
    "kernel32.dll.SetEndOfFile",
    "kernel32.dll.CompareStringA",
    "kernel32.dll.CompareStringW",
    "kernel32.dll.SetEnvironmentVariableA",
    "kernel32.dll.GetSystemInfo",
    "kernel32.dll.OpenEventA",
    "kernel32.dll.ResetEvent",
    "kernel32.dll.ResumeThread",
    "kernel32.dll.SystemTimeToFileTime",
    "kernel32.dll.WaitForMultipleObjects",
    "kernel32.dll.SetWaitableTimer",
    "kernel32.dll.CreateWaitableTimerA",
    "kernel32.dll.GetVersion",
    "kernel32.dll.GlobalMemoryStatus",
    "kernel32.dll.GetVersionExA",
    "kernel32.dll.FlushConsoleInputBuffer",
    "kernel32.dll.VerSetConditionMask",
    "kernel32.dll.SleepEx",
    "kernel32.dll.VerifyVersionInfoA",
    "kernel32.dll.ExpandEnvironmentStringsA",
    "kernel32.dll.FormatMessageA",
    "kernel32.dll.MapViewOfFile",
    "kernel32.dll.GetFileSize",
    "kernel32.dll.CreateIoCompletionPort",
    "kernel32.dll.PostQueuedCompletionStatus",
    "kernel32.dll.ReleaseSemaphore",
    "kernel32.dll.CreateSemaphoreA",
    "kernel32.dll.GetQueuedCompletionStatus",
    "kernel32.dll.GetFileInformationByHandle",
    "kernel32.dll.MoveFileA",
    "kernel32.dll.LockFile",
    "kernel32.dll.UnlockFile",
    "kernel32.dll.GetModuleFileNameW",
    "kernel32.dll.LoadLibraryW",
    "kernel32.dll.CreateDirectoryA",
    "kernel32.dll.GetOEMCP",
    "kernel32.dll.WaitForSingleObject",
    "kernel32.dll.GetCPInfo",
    "kernel32.dll.CreateEventA",
    "kernel32.dll.GetSystemDirectoryA",
    "kernel32.dll.GetCurrentDirectoryA",
    "kernel32.dll.GetFullPathNameA",
    "kernel32.dll.FindFirstFileA",
    "kernel32.dll.GetDriveTypeA",
    "kernel32.dll.FileTimeToLocalFileTime",
    "kernel32.dll.FileTimeToSystemTime",
    "kernel32.dll.FindClose",
    "kernel32.dll.SetConsoleMode",
    "kernel32.dll.ReadConsoleInputA",
    "kernel32.dll.CreateThread",
    "kernel32.dll.ExitThread",
    "kernel32.dll.VirtualQuery",
    "advapi32.dll.DeregisterEventSource",
    "advapi32.dll.RegisterEventSourceA",
    "advapi32.dll.ReportEventA",
    "advapi32.dll.RegQueryValueExA",
    "advapi32.dll.RegOpenKeyExA",
    "advapi32.dll.CryptAcquireContextA",
    "advapi32.dll.CryptGenRandom",
    "oleaut32.dll.#9",
    "oleaut32.dll.#2",
    "shell32.dll.SHGetSpecialFolderLocation",
    "shell32.dll.SHGetSpecialFolderPathA",
    "shell32.dll.SHGetPathFromIDListA",
    "user32.dll.MessageBoxA",
    "user32.dll.CharLowerW",
    "user32.dll.GetUserObjectInformationW",
    "user32.dll.GetDesktopWindow",
    "user32.dll.GetProcessWindowStation",
    "user32.dll.CharUpperW",
    "ws2_32.dll.freeaddrinfo",
    "ws2_32.dll.getaddrinfo",
    "ws2_32.dll.#17",
    "ws2_32.dll.#55",
    "ws2_32.dll.#54",
    "ws2_32.dll.#13",
    "ws2_32.dll.#8",
    "ws2_32.dll.#14",
    "ws2_32.dll.#57",
    "ws2_32.dll.#52",
    "ws2_32.dll.#10",
    "ws2_32.dll.#19",
    "ws2_32.dll.#18",
    "ws2_32.dll.#151",
    "ws2_32.dll.#5",
    "ws2_32.dll.WSAIoctl",
    "ws2_32.dll.#4",
    "ws2_32.dll.#111",
    "ws2_32.dll.#9",
    "ws2_32.dll.#15",
    "ws2_32.dll.#20",
    "ws2_32.dll.#22",
    "ws2_32.dll.#6",
    "ws2_32.dll.#21",
    "ws2_32.dll.#16",
    "ws2_32.dll.#2",
    "ws2_32.dll.#23",
    "ws2_32.dll.#112",
    "ws2_32.dll.#3",
    "ws2_32.dll.#7",
    "ws2_32.dll.#115",
    "ws2_32.dll.#116",
    "kernel32.dll.FlsAlloc",
    "kernel32.dll.FlsGetValue",
    "kernel32.dll.FlsSetValue",
    "kernel32.dll.FlsFree",
    "kernel32.dll.IsProcessorFeaturePresent",
    "kernel32.dll.GetComputerNameW",
    "kernel32.dll.GetLogicalDriveStringsW",
    "kernel32.dll.GetVolumeInformationW",
    "kernel32.dll.GetDriveTypeW",
    "kernel32.dll.GetSystemDirectoryW",
    "kernel32.dll.GetWindowsDirectoryA",
    "kernel32.dll.GetWindowsDirectoryW",
    "kernel32.dll.GetTempPathW",
    "kernel32.dll.FindFirstFileW",
    "kernel32.dll.FindNextFileW",
    "kernel32.dll.SetFileAttributesW",
    "kernel32.dll.GetFileAttributesW",
    "kernel32.dll.MoveFileW",
    "kernel32.dll.CreateDirectoryW",
    "kernel32.dll.DeleteFileW",
    "kernel32.dll.CopyFileW",
    "kernel32.dll.DeviceIoControl",
    "kernel32.dll.GetShortPathNameW",
    "kernel32.dll.GetVersionExW",
    "kernel32.dll.SetErrorMode",
    "kernel32.dll.CreateProcessW",
    "kernel32.dll.Wow64DisableWow64FsRedirection",
    "kernel32.dll.Wow64RevertWow64FsRedirection",
    "advapi32.dll.RegOpenKeyExW",
    "advapi32.dll.RegQueryValueExW",
    "advapi32.dll.RegSetValueExW",
    "advapi32.dll.RegCreateKeyExW",
    "advapi32.dll.RegDeleteValueW",
    "advapi32.dll.RegEnumKeyW",
    "advapi32.dll.RegQueryInfoKeyW",
    "advapi32.dll.GetUserNameW",
    "shell32.dll.SHGetFolderPathW",
    "shell32.dll.ShellExecuteW",
    "shell32.dll.SHGetKnownFolderPath",
    "ole32.dll.CoInitializeEx",
    "ole32.dll.CoUninitialize",
    "ole32.dll.CoCreateInstance",
    "ole32.dll.CoInitializeSecurity",
    "ole32.dll.CoSetProxyBlanket",
    "ole32.dll.CoTaskMemFree",
    "oleaut32.dll.VariantClear",
    "user32.dll.GetWindowRect",
    "user32.dll.GetDC",
    "user32.dll.DrawTextW",
    "user32.dll.SystemParametersInfoW",
    "user32.dll.GetForegroundWindow",
    "gdi32.dll.CreateCompatibleDC",
    "gdi32.dll.CreateCompatibleBitmap",
    "gdi32.dll.SelectObject",
    "gdi32.dll.DeleteObject",
    "gdi32.dll.DeleteDC",
    "gdi32.dll.CreateBrushIndirect",
    "gdi32.dll.SetTextColor",
    "gdi32.dll.SetBkColor",
    "gdi32.dll.GetCurrentObject",
    "gdi32.dll.GetObjectA",
    "gdi32.dll.CreateFontIndirectA",
    "gdi32.dll.CreateDIBSection",
    "gdi32.dll.BitBlt",
    "gdi32.dll.ExtFloodFill",
    "netapi32.dll.NetServerGetInfo",
    "netapi32.dll.NetApiBufferFree",
    "netapi32.dll.NetWkstaGetInfo",
    "kernel32.dll.SetProcessDEPPolicy",
    "netapi32.dll.NetStatisticsGet",
    "advapi32.dll.CryptAcquireContextW",
    "advapi32.dll.CryptReleaseContext",
    "cryptsp.dll.CryptAcquireContextW",
    "cryptsp.dll.CryptGenRandom",
    "cryptsp.dll.CryptReleaseContext",
    "user32.dll.GetCursorInfo",
    "user32.dll.GetQueueStatus",
    "kernel32.dll.CreateToolhelp32Snapshot",
    "kernel32.dll.Heap32First",
    "kernel32.dll.Heap32Next",
    "kernel32.dll.Heap32ListFirst",
    "kernel32.dll.Heap32ListNext",
    "kernel32.dll.Process32First",
    "kernel32.dll.Process32Next",
    "kernel32.dll.Thread32First",
    "kernel32.dll.Thread32Next",
    "kernel32.dll.Module32First",
    "kernel32.dll.Module32Next",
    "cryptsp.dll.CryptAcquireContextA",
    "cryptbase.dll.SystemFunction036",
    "uxtheme.dll.ThemeInitApiHook",
    "user32.dll.IsProcessDPIAware",
    "ole32.dll.CreateBindCtx",
    "ole32.dll.CoTaskMemAlloc",
    "ole32.dll.CoGetApartmentType",
    "ole32.dll.CoRegisterInitializeSpy",
    "comctl32.dll.#236",
    "ole32.dll.CoGetMalloc",
    "comctl32.dll.#320",
    "comctl32.dll.#324",
    "comctl32.dll.#323",
    "comctl32.dll.#328",
    "comctl32.dll.#334",
    "advapi32.dll.InitializeSecurityDescriptor",
    "advapi32.dll.SetEntriesInAclW",
    "ntmarta.dll.GetMartaExtensionInterface",
    "advapi32.dll.SetSecurityDescriptorDacl",
    "advapi32.dll.IsTextUnicode",
    "comctl32.dll.#332",
    "comctl32.dll.#338",
    "comctl32.dll.#339",
    "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
    "shell32.dll.#102",
    "setupapi.dll.CM_Get_Device_Interface_List_ExW",
    "comctl32.dll.#386",
    "ole32.dll.CoRevokeInitializeSpy",
    "comctl32.dll.#388",
    "ole32.dll.NdrOleInitializeExtension",
    "ole32.dll.CoGetClassObject",
    "ole32.dll.CoGetMarshalSizeMax",
    "ole32.dll.CoMarshalInterface",
    "ole32.dll.CoUnmarshalInterface",
    "ole32.dll.StringFromIID",
    "ole32.dll.CoGetPSClsid",
    "ole32.dll.CoReleaseMarshalData",
    "ole32.dll.DcomChannelSetHResult",
    "oleaut32.dll.#500",
    "iphlpapi.dll.GetAdaptersAddresses",
    "wkscli.dll.NetWkstaGetInfo",
    "cscapi.dll.CscNetApiGetInterface",
    "sechost.dll.LookupAccountNameLocalW",
    "advapi32.dll.LookupAccountSidW",
    "sechost.dll.LookupAccountSidLocalW",
    "kernel32.dll.SetThreadUILanguage",
    "kernel32.dll.SortGetHandle",
    "kernel32.dll.SortCloseHandle",
    "kernel32.dll.CopyFileExW",
    "kernel32.dll.SetConsoleInputExeNameW",
    "ntdll.dll.NtQueryInformationProcess"
]

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "GetStringTypeW",
                        "address": "0x5010e4"
                    },
                    {
                        "name": "GetSystemDefaultLCID",
                        "address": "0x5010e8"
                    },
                    {
                        "name": "GetSystemTimeAsFileTime",
                        "address": "0x5010ec"
                    },
                    {
                        "name": "GetThreadLocale",
                        "address": "0x5010f0"
                    },
                    {
                        "name": "GetThreadPriority",
                        "address": "0x5010f4"
                    },
                    {
                        "name": "GetTickCount",
                        "address": "0x5010f8"
                    },
                    {
                        "name": "GetUserDefaultUILanguage",
                        "address": "0x5010fc"
                    },
                    {
                        "name": "GetVersionExA",
                        "address": "0x501100"
                    },
                    {
                        "name": "GetVersionExW",
                        "address": "0x501104"
                    },
                    {
                        "name": "GlobalAddAtomW",
                        "address": "0x501108"
                    },
                    {
                        "name": "GlobalAlloc",
                        "address": "0x50110c"
                    },
                    {
                        "name": "GlobalDeleteAtom",
                        "address": "0x501110"
                    },
                    {
                        "name": "GlobalFindAtomW",
                        "address": "0x501114"
                    },
                    {
                        "name": "GlobalFlags",
                        "address": "0x501118"
                    },
                    {
                        "name": "GlobalFree",
                        "address": "0x50111c"
                    },
                    {
                        "name": "GlobalHandle",
                        "address": "0x501120"
                    },
                    {
                        "name": "GlobalLock",
                        "address": "0x501124"
                    },
                    {
                        "name": "GlobalReAlloc",
                        "address": "0x501128"
                    },
                    {
                        "name": "GlobalUnlock",
                        "address": "0x50112c"
                    },
                    {
                        "name": "Heap32ListNext",
                        "address": "0x501130"
                    },
                    {
                        "name": "HeapAlloc",
                        "address": "0x501134"
                    },
                    {
                        "name": "HeapCreate",
                        "address": "0x501138"
                    },
                    {
                        "name": "HeapFree",
                        "address": "0x50113c"
                    },
                    {
                        "name": "HeapReAlloc",
                        "address": "0x501140"
                    },
                    {
                        "name": "HeapSize",
                        "address": "0x501144"
                    },
                    {
                        "name": "HeapValidate",
                        "address": "0x501148"
                    },
                    {
                        "name": "InitializeCriticalSection",
                        "address": "0x50114c"
                    },
                    {
                        "name": "InitializeCriticalSectionAndSpinCount",
                        "address": "0x501150"
                    },
                    {
                        "name": "InterlockedDecrement",
                        "address": "0x501154"
                    },
                    {
                        "name": "InterlockedExchange",
                        "address": "0x501158"
                    },
                    {
                        "name": "InterlockedIncrement",
                        "address": "0x50115c"
                    },
                    {
                        "name": "IsDebuggerPresent",
                        "address": "0x501160"
                    },
                    {
                        "name": "IsValidCodePage",
                        "address": "0x501164"
                    },
                    {
                        "name": "LCMapStringA",
                        "address": "0x501168"
                    },
                    {
                        "name": "LCMapStringW",
                        "address": "0x50116c"
                    },
                    {
                        "name": "LeaveCriticalSection",
                        "address": "0x501170"
                    },
                    {
                        "name": "LoadLibraryA",
                        "address": "0x501174"
                    },
                    {
                        "name": "LoadLibraryW",
                        "address": "0x501178"
                    },
                    {
                        "name": "LoadResource",
                        "address": "0x50117c"
                    },
                    {
                        "name": "LocalAlloc",
                        "address": "0x501180"
                    },
                    {
                        "name": "LocalFree",
                        "address": "0x501184"
                    },
                    {
                        "name": "LocalReAlloc",
                        "address": "0x501188"
                    },
                    {
                        "name": "LocalSize",
                        "address": "0x50118c"
                    },
                    {
                        "name": "LockResource",
                        "address": "0x501190"
                    },
                    {
                        "name": "MapViewOfFile",
                        "address": "0x501194"
                    },
                    {
                        "name": "MultiByteToWideChar",
                        "address": "0x501198"
                    },
                    {
                        "name": "OpenEventW",
                        "address": "0x50119c"
                    },
                    {
                        "name": "OpenMutexW",
                        "address": "0x5011a0"
                    },
                    {
                        "name": "OpenSemaphoreA",
                        "address": "0x5011a4"
                    },
                    {
                        "name": "GetStringTypeExW",
                        "address": "0x5011a8"
                    },
                    {
                        "name": "OutputDebugStringA",
                        "address": "0x5011ac"
                    },
                    {
                        "name": "QueryPerformanceCounter",
                        "address": "0x5011b0"
                    },
                    {
                        "name": "RaiseException",
                        "address": "0x5011b4"
                    },
                    {
                        "name": "ReadConsoleW",
                        "address": "0x5011b8"
                    },
                    {
                        "name": "ReadFile",
                        "address": "0x5011bc"
                    },
                    {
                        "name": "ReleaseMutex",
                        "address": "0x5011c0"
                    },
                    {
                        "name": "ReplaceFileA",
                        "address": "0x5011c4"
                    },
                    {
                        "name": "RtlUnwind",
                        "address": "0x5011c8"
                    },
                    {
                        "name": "SetComputerNameExA",
                        "address": "0x5011cc"
                    },
                    {
                        "name": "SetConsoleCtrlHandler",
                        "address": "0x5011d0"
                    },
                    {
                        "name": "SetConsoleMode",
                        "address": "0x5011d4"
                    },
                    {
                        "name": "SetConsoleOutputCP",
                        "address": "0x5011d8"
                    },
                    {
                        "name": "SetConsoleTextAttribute",
                        "address": "0x5011dc"
                    },
                    {
                        "name": "SetErrorMode",
                        "address": "0x5011e0"
                    },
                    {
                        "name": "SetEvent",
                        "address": "0x5011e4"
                    },
                    {
                        "name": "SetFilePointer",
                        "address": "0x5011e8"
                    },
                    {
                        "name": "SetHandleCount",
                        "address": "0x5011ec"
                    },
                    {
                        "name": "SetLastError",
                        "address": "0x5011f0"
                    },
                    {
                        "name": "SetStdHandle",
                        "address": "0x5011f4"
                    },
                    {
                        "name": "SetThreadLocale",
                        "address": "0x5011f8"
                    },
                    {
                        "name": "SetUnhandledExceptionFilter",
                        "address": "0x5011fc"
                    },
                    {
                        "name": "SetVolumeMountPointW",
                        "address": "0x501200"
                    },
                    {
                        "name": "SizeofResource",
                        "address": "0x501204"
                    },
                    {
                        "name": "Sleep",
                        "address": "0x501208"
                    },
                    {
                        "name": "SystemTimeToFileTime",
                        "address": "0x50120c"
                    },
                    {
                        "name": "TerminateProcess",
                        "address": "0x501210"
                    },
                    {
                        "name": "TerminateThread",
                        "address": "0x501214"
                    },
                    {
                        "name": "TlsAlloc",
                        "address": "0x501218"
                    },
                    {
                        "name": "TlsFree",
                        "address": "0x50121c"
                    },
                    {
                        "name": "TlsGetValue",
                        "address": "0x501220"
                    },
                    {
                        "name": "TlsSetValue",
                        "address": "0x501224"
                    },
                    {
                        "name": "UnhandledExceptionFilter",
                        "address": "0x501228"
                    },
                    {
                        "name": "UnmapViewOfFile",
                        "address": "0x50122c"
                    },
                    {
                        "name": "VerLanguageNameA",
                        "address": "0x501230"
                    },
                    {
                        "name": "VirtualAlloc",
                        "address": "0x501234"
                    },
                    {
                        "name": "VirtualFree",
                        "address": "0x501238"
                    },
                    {
                        "name": "WaitForMultipleObjects",
                        "address": "0x50123c"
                    },
                    {
                        "name": "WaitForSingleObject",
                        "address": "0x501240"
                    },
                    {
                        "name": "WideCharToMultiByte",
                        "address": "0x501244"
                    },
                    {
                        "name": "WriteConsoleA",
                        "address": "0x501248"
                    },
                    {
                        "name": "WriteConsoleW",
                        "address": "0x50124c"
                    },
                    {
                        "name": "WriteFile",
                        "address": "0x501250"
                    },
                    {
                        "name": "WritePrivateProfileStringW",
                        "address": "0x501254"
                    },
                    {
                        "name": "_lwrite",
                        "address": "0x501258"
                    },
                    {
                        "name": "lstrcmpA",
                        "address": "0x50125c"
                    },
                    {
                        "name": "lstrcmpW",
                        "address": "0x501260"
                    },
                    {
                        "name": "lstrlenA",
                        "address": "0x501264"
                    },
                    {
                        "name": "lstrlenW",
                        "address": "0x501268"
                    },
                    {
                        "name": "GetStringTypeA",
                        "address": "0x50126c"
                    },
                    {
                        "name": "GetStdHandle",
                        "address": "0x501270"
                    },
                    {
                        "name": "GetStartupInfoW",
                        "address": "0x501274"
                    },
                    {
                        "name": "GetStartupInfoA",
                        "address": "0x501278"
                    },
                    {
                        "name": "GetShortPathNameW",
                        "address": "0x50127c"
                    },
                    {
                        "name": "GetProcessHeaps",
                        "address": "0x501280"
                    },
                    {
                        "name": "GetProcessHeap",
                        "address": "0x501284"
                    },
                    {
                        "name": "GetProcAddress",
                        "address": "0x501288"
                    },
                    {
                        "name": "GetOEMCP",
                        "address": "0x50128c"
                    },
                    {
                        "name": "GetModuleHandleW",
                        "address": "0x501290"
                    },
                    {
                        "name": "GetModuleHandleA",
                        "address": "0x501294"
                    },
                    {
                        "name": "GetModuleFileNameW",
                        "address": "0x501298"
                    },
                    {
                        "name": "GetModuleFileNameA",
                        "address": "0x50129c"
                    },
                    {
                        "name": "GetLocaleInfoW",
                        "address": "0x5012a0"
                    },
                    {
                        "name": "GetLocaleInfoA",
                        "address": "0x5012a4"
                    },
                    {
                        "name": "GetLocalTime",
                        "address": "0x5012a8"
                    },
                    {
                        "name": "GetLastError",
                        "address": "0x5012ac"
                    },
                    {
                        "name": "GetFileType",
                        "address": "0x5012b0"
                    },
                    {
                        "name": "GetExitCodeThread",
                        "address": "0x5012b4"
                    },
                    {
                        "name": "GetEnvironmentStringsW",
                        "address": "0x5012b8"
                    },
                    {
                        "name": "GetCurrentThreadId",
                        "address": "0x5012bc"
                    },
                    {
                        "name": "GetCurrentThread",
                        "address": "0x5012c0"
                    },
                    {
                        "name": "GetCurrentProcessId",
                        "address": "0x5012c4"
                    },
                    {
                        "name": "CloseHandle",
                        "address": "0x5012c8"
                    },
                    {
                        "name": "GetCurrentProcess",
                        "address": "0x5012cc"
                    },
                    {
                        "name": "GetConsoleScreenBufferInfo",
                        "address": "0x5012d0"
                    },
                    {
                        "name": "GetConsoleOutputCP",
                        "address": "0x5012d4"
                    },
                    {
                        "name": "GetConsoleMode",
                        "address": "0x5012d8"
                    },
                    {
                        "name": "GetConsoleFontSize",
                        "address": "0x5012dc"
                    },
                    {
                        "name": "GetConsoleCP",
                        "address": "0x5012e0"
                    },
                    {
                        "name": "GetComputerNameW",
                        "address": "0x5012e4"
                    },
                    {
                        "name": "GetCommandLineW",
                        "address": "0x5012e8"
                    },
                    {
                        "name": "GetCPInfo",
                        "address": "0x5012ec"
                    },
                    {
                        "name": "GetACP",
                        "address": "0x5012f0"
                    },
                    {
                        "name": "FreeLibrary",
                        "address": "0x5012f4"
                    },
                    {
                        "name": "FreeEnvironmentStringsW",
                        "address": "0x5012f8"
                    },
                    {
                        "name": "FormatMessageW",
                        "address": "0x5012fc"
                    },
                    {
                        "name": "FlushFileBuffers",
                        "address": "0x501300"
                    },
                    {
                        "name": "FindResourceW",
                        "address": "0x501304"
                    },
                    {
                        "name": "FindNextFileW",
                        "address": "0x501308"
                    },
                    {
                        "name": "FindFirstFileW",
                        "address": "0x50130c"
                    },
                    {
                        "name": "FindClose",
                        "address": "0x501310"
                    },
                    {
                        "name": "FileTimeToLocalFileTime",
                        "address": "0x501314"
                    },
                    {
                        "name": "FileTimeToDosDateTime",
                        "address": "0x501318"
                    },
                    {
                        "name": "ExitProcess",
                        "address": "0x50131c"
                    },
                    {
                        "name": "EnumResourceLanguagesW",
                        "address": "0x501320"
                    },
                    {
                        "name": "EnterCriticalSection",
                        "address": "0x501324"
                    },
                    {
                        "name": "DeleteCriticalSection",
                        "address": "0x501328"
                    },
                    {
                        "name": "CreateThread",
                        "address": "0x50132c"
                    },
                    {
                        "name": "CreateMutexW",
                        "address": "0x501330"
                    },
                    {
                        "name": "CreateMutexA",
                        "address": "0x501334"
                    },
                    {
                        "name": "CreateFileW",
                        "address": "0x501338"
                    },
                    {
                        "name": "CreateFileMappingW",
                        "address": "0x50133c"
                    },
                    {
                        "name": "CreateFileA",
                        "address": "0x501340"
                    },
                    {
                        "name": "CreateEventW",
                        "address": "0x501344"
                    },
                    {
                        "name": "ConvertDefaultLocale",
                        "address": "0x501348"
                    },
                    {
                        "name": "OpenThread",
                        "address": "0x50134c"
                    }
                ],
                "dll": "KERNEL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "GetWindowThreadProcessId",
                        "address": "0x501354"
                    },
                    {
                        "name": "GrayStringW",
                        "address": "0x501358"
                    },
                    {
                        "name": "IsIconic",
                        "address": "0x50135c"
                    },
                    {
                        "name": "IsWindow",
                        "address": "0x501360"
                    },
                    {
                        "name": "IsWindowEnabled",
                        "address": "0x501364"
                    },
                    {
                        "name": "IsWindowVisible",
                        "address": "0x501368"
                    },
                    {
                        "name": "LoadBitmapW",
                        "address": "0x50136c"
                    },
                    {
                        "name": "LoadCursorW",
                        "address": "0x501370"
                    },
                    {
                        "name": "LoadIconW",
                        "address": "0x501374"
                    },
                    {
                        "name": "LoadMenuW",
                        "address": "0x501378"
                    },
                    {
                        "name": "MapWindowPoints",
                        "address": "0x50137c"
                    },
                    {
                        "name": "MessageBoxA",
                        "address": "0x501380"
                    },
                    {
                        "name": "MessageBoxW",
                        "address": "0x501384"
                    },
                    {
                        "name": "ModifyMenuW",
                        "address": "0x501388"
                    },
                    {
                        "name": "MsgWaitForMultipleObjectsEx",
                        "address": "0x50138c"
                    },
                    {
                        "name": "NotifyWinEvent",
                        "address": "0x501390"
                    },
                    {
                        "name": "PeekMessageW",
                        "address": "0x501394"
                    },
                    {
                        "name": "PostMessageW",
                        "address": "0x501398"
                    },
                    {
                        "name": "PostQuitMessage",
                        "address": "0x50139c"
                    },
                    {
                        "name": "PostThreadMessageA",
                        "address": "0x5013a0"
                    },
                    {
                        "name": "PtInRect",
                        "address": "0x5013a4"
                    },
                    {
                        "name": "RegisterClassW",
                        "address": "0x5013a8"
                    },
                    {
                        "name": "RegisterWindowMessageW",
                        "address": "0x5013ac"
                    },
                    {
                        "name": "ReleaseDC",
                        "address": "0x5013b0"
                    },
                    {
                        "name": "RemovePropW",
                        "address": "0x5013b4"
                    },
                    {
                        "name": "SendMessageA",
                        "address": "0x5013b8"
                    },
                    {
                        "name": "SendMessageW",
                        "address": "0x5013bc"
                    },
                    {
                        "name": "SetCursor",
                        "address": "0x5013c0"
                    },
                    {
                        "name": "SetForegroundWindow",
                        "address": "0x5013c4"
                    },
                    {
                        "name": "SetMenu",
                        "address": "0x5013c8"
                    },
                    {
                        "name": "SetMenuItemBitmaps",
                        "address": "0x5013cc"
                    },
                    {
                        "name": "SetMessageQueue",
                        "address": "0x5013d0"
                    },
                    {
                        "name": "SetPropW",
                        "address": "0x5013d4"
                    },
                    {
                        "name": "SetWindowLongW",
                        "address": "0x5013d8"
                    },
                    {
                        "name": "SetWindowPos",
                        "address": "0x5013dc"
                    },
                    {
                        "name": "SetWindowTextW",
                        "address": "0x5013e0"
                    },
                    {
                        "name": "SetWindowsHookExW",
                        "address": "0x5013e4"
                    },
                    {
                        "name": "ShowWindow",
                        "address": "0x5013e8"
                    },
                    {
                        "name": "SystemParametersInfoA",
                        "address": "0x5013ec"
                    },
                    {
                        "name": "TabbedTextOutW",
                        "address": "0x5013f0"
                    },
                    {
                        "name": "TranslateMessage",
                        "address": "0x5013f4"
                    },
                    {
                        "name": "UnhookWinEvent",
                        "address": "0x5013f8"
                    },
                    {
                        "name": "UnhookWindowsHookEx",
                        "address": "0x5013fc"
                    },
                    {
                        "name": "UnregisterClassW",
                        "address": "0x501400"
                    },
                    {
                        "name": "UnregisterDeviceNotification",
                        "address": "0x501404"
                    },
                    {
                        "name": "ValidateRect",
                        "address": "0x501408"
                    },
                    {
                        "name": "WinHelpW",
                        "address": "0x50140c"
                    },
                    {
                        "name": "CharNextW",
                        "address": "0x501410"
                    },
                    {
                        "name": "WindowFromDC",
                        "address": "0x501414"
                    },
                    {
                        "name": "LoadCursorFromFileA",
                        "address": "0x501418"
                    },
                    {
                        "name": "GetClipboardData",
                        "address": "0x50141c"
                    },
                    {
                        "name": "InSendMessage",
                        "address": "0x501420"
                    },
                    {
                        "name": "IsMenu",
                        "address": "0x501424"
                    },
                    {
                        "name": "DestroyIcon",
                        "address": "0x501428"
                    },
                    {
                        "name": "CharLowerW",
                        "address": "0x50142c"
                    },
                    {
                        "name": "GetMenuContextHelpId",
                        "address": "0x501430"
                    },
                    {
                        "name": "VkKeyScanA",
                        "address": "0x501434"
                    },
                    {
                        "name": "CountClipboardFormats",
                        "address": "0x501438"
                    },
                    {
                        "name": "IsCharAlphaA",
                        "address": "0x50143c"
                    },
                    {
                        "name": "IsCharAlphaNumericA",
                        "address": "0x501440"
                    },
                    {
                        "name": "GetProcessWindowStation",
                        "address": "0x501444"
                    },
                    {
                        "name": "IsWindowUnicode",
                        "address": "0x501448"
                    },
                    {
                        "name": "GetKeyboardLayout",
                        "address": "0x50144c"
                    },
                    {
                        "name": "VkKeyScanW",
                        "address": "0x501450"
                    },
                    {
                        "name": "GetKBCodePage",
                        "address": "0x501454"
                    },
                    {
                        "name": "GetClipboardOwner",
                        "address": "0x501458"
                    },
                    {
                        "name": "GetAsyncKeyState",
                        "address": "0x50145c"
                    },
                    {
                        "name": "DestroyCursor",
                        "address": "0x501460"
                    },
                    {
                        "name": "CloseClipboard",
                        "address": "0x501464"
                    },
                    {
                        "name": "PaintDesktop",
                        "address": "0x501468"
                    },
                    {
                        "name": "GetInputState",
                        "address": "0x50146c"
                    },
                    {
                        "name": "GetCursor",
                        "address": "0x501470"
                    },
                    {
                        "name": "CloseDesktop",
                        "address": "0x501474"
                    },
                    {
                        "name": "ReleaseCapture",
                        "address": "0x501478"
                    },
                    {
                        "name": "EnumClipboardFormats",
                        "address": "0x50147c"
                    },
                    {
                        "name": "GetWindowContextHelpId",
                        "address": "0x501480"
                    },
                    {
                        "name": "GetWindowTextLengthA",
                        "address": "0x501484"
                    },
                    {
                        "name": "GetClipboardViewer",
                        "address": "0x501488"
                    },
                    {
                        "name": "GetThreadDesktop",
                        "address": "0x50148c"
                    },
                    {
                        "name": "IsCharAlphaW",
                        "address": "0x501490"
                    },
                    {
                        "name": "AnyPopup",
                        "address": "0x501494"
                    },
                    {
                        "name": "CharUpperW",
                        "address": "0x501498"
                    },
                    {
                        "name": "IsCharLowerW",
                        "address": "0x50149c"
                    },
                    {
                        "name": "IsClipboardFormatAvailable",
                        "address": "0x5014a0"
                    },
                    {
                        "name": "GetQueueStatus",
                        "address": "0x5014a4"
                    },
                    {
                        "name": "CloseWindow",
                        "address": "0x5014a8"
                    },
                    {
                        "name": "GetDialogBaseUnits",
                        "address": "0x5014ac"
                    },
                    {
                        "name": "OemKeyScan",
                        "address": "0x5014b0"
                    },
                    {
                        "name": "GetWindowTextW",
                        "address": "0x5014b4"
                    },
                    {
                        "name": "GetWindowRect",
                        "address": "0x5014b8"
                    },
                    {
                        "name": "GetWindowPlacement",
                        "address": "0x5014bc"
                    },
                    {
                        "name": "GetWindowLongW",
                        "address": "0x5014c0"
                    },
                    {
                        "name": "GetWindow",
                        "address": "0x5014c4"
                    },
                    {
                        "name": "GetTopWindow",
                        "address": "0x5014c8"
                    },
                    {
                        "name": "GetSystemMetrics",
                        "address": "0x5014cc"
                    },
                    {
                        "name": "GetSysColorBrush",
                        "address": "0x5014d0"
                    },
                    {
                        "name": "GetSysColor",
                        "address": "0x5014d4"
                    },
                    {
                        "name": "GetSubMenu",
                        "address": "0x5014d8"
                    },
                    {
                        "name": "GetScrollPos",
                        "address": "0x5014dc"
                    },
                    {
                        "name": "GetPropW",
                        "address": "0x5014e0"
                    },
                    {
                        "name": "GetParent",
                        "address": "0x5014e4"
                    },
                    {
                        "name": "GetMessageW",
                        "address": "0x5014e8"
                    },
                    {
                        "name": "GetMessageTime",
                        "address": "0x5014ec"
                    },
                    {
                        "name": "GetMessagePos",
                        "address": "0x5014f0"
                    },
                    {
                        "name": "GetMessageExtraInfo",
                        "address": "0x5014f4"
                    },
                    {
                        "name": "GetMenuState",
                        "address": "0x5014f8"
                    },
                    {
                        "name": "GetMenuItemID",
                        "address": "0x5014fc"
                    },
                    {
                        "name": "GetMenuItemCount",
                        "address": "0x501500"
                    },
                    {
                        "name": "GetMenuCheckMarkDimensions",
                        "address": "0x501504"
                    },
                    {
                        "name": "GetMenu",
                        "address": "0x501508"
                    },
                    {
                        "name": "GetLastActivePopup",
                        "address": "0x50150c"
                    },
                    {
                        "name": "GetKeyState",
                        "address": "0x501510"
                    },
                    {
                        "name": "GetForegroundWindow",
                        "address": "0x501514"
                    },
                    {
                        "name": "GetFocus",
                        "address": "0x501518"
                    },
                    {
                        "name": "GetDlgItem",
                        "address": "0x50151c"
                    },
                    {
                        "name": "GetDlgCtrlID",
                        "address": "0x501520"
                    },
                    {
                        "name": "GetDC",
                        "address": "0x501524"
                    },
                    {
                        "name": "GetCursorPos",
                        "address": "0x501528"
                    },
                    {
                        "name": "GetClientRect",
                        "address": "0x50152c"
                    },
                    {
                        "name": "GetClassNameW",
                        "address": "0x501530"
                    },
                    {
                        "name": "GetClassLongW",
                        "address": "0x501534"
                    },
                    {
                        "name": "GetClassInfoExW",
                        "address": "0x501538"
                    },
                    {
                        "name": "GetCapture",
                        "address": "0x50153c"
                    },
                    {
                        "name": "GetActiveWindow",
                        "address": "0x501540"
                    },
                    {
                        "name": "EnableWindow",
                        "address": "0x501544"
                    },
                    {
                        "name": "EnableMenuItem",
                        "address": "0x501548"
                    },
                    {
                        "name": "EmptyClipboard",
                        "address": "0x50154c"
                    },
                    {
                        "name": "DrawTextW",
                        "address": "0x501550"
                    },
                    {
                        "name": "DrawTextExW",
                        "address": "0x501554"
                    },
                    {
                        "name": "DispatchMessageW",
                        "address": "0x501558"
                    },
                    {
                        "name": "DestroyWindow",
                        "address": "0x50155c"
                    },
                    {
                        "name": "DestroyMenu",
                        "address": "0x501560"
                    },
                    {
                        "name": "DefWindowProcW",
                        "address": "0x501564"
                    },
                    {
                        "name": "DefWindowProcA",
                        "address": "0x501568"
                    },
                    {
                        "name": "DdeQueryConvInfo",
                        "address": "0x50156c"
                    },
                    {
                        "name": "CreateWindowExW",
                        "address": "0x501570"
                    },
                    {
                        "name": "CreateDialogParamW",
                        "address": "0x501574"
                    },
                    {
                        "name": "CopyRect",
                        "address": "0x501578"
                    },
                    {
                        "name": "ClientToScreen",
                        "address": "0x50157c"
                    },
                    {
                        "name": "CheckMenuItem",
                        "address": "0x501580"
                    },
                    {
                        "name": "CharLowerA",
                        "address": "0x501584"
                    },
                    {
                        "name": "CallWindowProcW",
                        "address": "0x501588"
                    },
                    {
                        "name": "CallNextHookEx",
                        "address": "0x50158c"
                    },
                    {
                        "name": "AdjustWindowRectEx",
                        "address": "0x501590"
                    },
                    {
                        "name": "GetClassInfoW",
                        "address": "0x501594"
                    }
                ],
                "dll": "USER32.dll"
            },
            {
                "imports": [
                    {
                        "name": "XLATEOBJ_cGetPalette",
                        "address": "0x501038"
                    },
                    {
                        "name": "GetTextCharset",
                        "address": "0x50103c"
                    },
                    {
                        "name": "SwapBuffers",
                        "address": "0x501040"
                    },
                    {
                        "name": "DeleteObject",
                        "address": "0x501044"
                    },
                    {
                        "name": "CreateSolidBrush",
                        "address": "0x501048"
                    },
                    {
                        "name": "SaveDC",
                        "address": "0x50104c"
                    },
                    {
                        "name": "FlattenPath",
                        "address": "0x501050"
                    },
                    {
                        "name": "GdiGetBatchLimit",
                        "address": "0x501054"
                    },
                    {
                        "name": "AbortDoc",
                        "address": "0x501058"
                    },
                    {
                        "name": "GetStockObject",
                        "address": "0x50105c"
                    },
                    {
                        "name": "GetLayout",
                        "address": "0x501060"
                    },
                    {
                        "name": "GetBkColor",
                        "address": "0x501064"
                    },
                    {
                        "name": "GdiFlush",
                        "address": "0x501068"
                    },
                    {
                        "name": "CreateHalftonePalette",
                        "address": "0x50106c"
                    },
                    {
                        "name": "XFORMOBJ_iGetXform",
                        "address": "0x501070"
                    },
                    {
                        "name": "GetObjectType",
                        "address": "0x501074"
                    },
                    {
                        "name": "GetColorSpace",
                        "address": "0x501078"
                    },
                    {
                        "name": "AddFontResourceW",
                        "address": "0x50107c"
                    },
                    {
                        "name": "GetPolyFillMode",
                        "address": "0x501080"
                    },
                    {
                        "name": "GetGraphicsMode",
                        "address": "0x501084"
                    },
                    {
                        "name": "AbortPath",
                        "address": "0x501088"
                    },
                    {
                        "name": "DeleteColorSpace",
                        "address": "0x50108c"
                    },
                    {
                        "name": "CreateCompatibleDC",
                        "address": "0x501090"
                    },
                    {
                        "name": "UnrealizeObject",
                        "address": "0x501094"
                    },
                    {
                        "name": "GetDCPenColor",
                        "address": "0x501098"
                    },
                    {
                        "name": "UpdateColors",
                        "address": "0x50109c"
                    },
                    {
                        "name": "CreatePatternBrush",
                        "address": "0x5010a0"
                    },
                    {
                        "name": "StrokePath",
                        "address": "0x5010a4"
                    },
                    {
                        "name": "StartDocW",
                        "address": "0x5010a8"
                    },
                    {
                        "name": "SetWindowExtEx",
                        "address": "0x5010ac"
                    },
                    {
                        "name": "SetTextColor",
                        "address": "0x5010b0"
                    },
                    {
                        "name": "GetTextColor",
                        "address": "0x5010b4"
                    },
                    {
                        "name": "GetICMProfileW",
                        "address": "0x5010b8"
                    },
                    {
                        "name": "GetCharABCWidthsA",
                        "address": "0x5010bc"
                    },
                    {
                        "name": "GdiStartDocEMF",
                        "address": "0x5010c0"
                    },
                    {
                        "name": "GdiDllInitialize",
                        "address": "0x5010c4"
                    },
                    {
                        "name": "EngReleaseSemaphore",
                        "address": "0x5010c8"
                    },
                    {
                        "name": "EngQueryLocalTime",
                        "address": "0x5010cc"
                    },
                    {
                        "name": "EngLoadModule",
                        "address": "0x5010d0"
                    },
                    {
                        "name": "DPtoLP",
                        "address": "0x5010d4"
                    },
                    {
                        "name": "GetSystemPaletteUse",
                        "address": "0x5010d8"
                    },
                    {
                        "name": "CopyMetaFileW",
                        "address": "0x5010dc"
                    }
                ],
                "dll": "GDI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "RegSetValueExA",
                        "address": "0x501000"
                    },
                    {
                        "name": "RegQueryValueW",
                        "address": "0x501004"
                    },
                    {
                        "name": "RegQueryValueExW",
                        "address": "0x501008"
                    },
                    {
                        "name": "RegQueryValueExA",
                        "address": "0x50100c"
                    },
                    {
                        "name": "RegOpenKeyW",
                        "address": "0x501010"
                    },
                    {
                        "name": "RegOpenKeyExW",
                        "address": "0x501014"
                    },
                    {
                        "name": "RegOpenKeyExA",
                        "address": "0x501018"
                    },
                    {
                        "name": "RegEnumKeyW",
                        "address": "0x50101c"
                    },
                    {
                        "name": "RegDeleteKeyW",
                        "address": "0x501020"
                    },
                    {
                        "name": "RegCreateKeyExW",
                        "address": "0x501024"
                    },
                    {
                        "name": "RegCreateKeyExA",
                        "address": "0x501028"
                    },
                    {
                        "name": "RegCloseKey",
                        "address": "0x50102c"
                    },
                    {
                        "name": "RegSetValueExW",
                        "address": "0x501030"
                    }
                ],
                "dll": "ADVAPI32.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x0010eac1",
        "overlay": {
            "size": "0x00000d08",
            "offset": "0x00108200"
        },
        "imagebase": "0x00400000",
        "reported_checksum": "0x00114aa1",
        "icon_hash": null,
        "entrypoint": "0x005002c0",
        "timestamp": "2019-03-06 20:01:50",
        "osversion": "5.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x000ffa00",
                "entropy": "7.55",
                "raw_address": "0x00000400",
                "virtual_size": "0x000ff99d",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rdata",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00101000",
                "size_of_data": "0x00007a00",
                "entropy": "2.71",
                "raw_address": "0x000ffe00",
                "virtual_size": "0x00007956",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x00109000",
                "size_of_data": "0x00000200",
                "entropy": "3.90",
                "raw_address": "0x00107800",
                "virtual_size": "0x000002f8",
                "characteristics_raw": "0xc0000040"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x0010a000",
                "size_of_data": "0x00000800",
                "entropy": "4.76",
                "raw_address": "0x00107a00",
                "virtual_size": "0x000fd7f8",
                "characteristics_raw": "0x40000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00106ab0",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x00000064"
            },
            {
                "virtual_address": "0x0010a000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x000007f8"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00108200",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000d08"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00101000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x0000059c"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "7d6c8070a47bef32500cde51100d1e17",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 4,
        "versioninfo": []
    }
}