Exes_6bb55449f9ad55bb73f25877a1041e1f_jpg_2019-06-27_21_30.json

[*] MalFamily: ""

[*] MalScore: 10.0

[*] File Name: "Exes_6bb55449f9ad55bb73f25877a1041e1f.jpg"
[*] File Size: 1253640
[*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
[*] SHA256: "701d3db21920f78b8ed2eb6b4286f858277928f50d567c9c6594bd1971e9c07e"
[*] MD5: "6bb55449f9ad55bb73f25877a1041e1f"
[*] SHA1: "b303f1c9c4564551853cd08a770836aae5725cf2"
[*] SHA512: "b6e5393b39ca5f0fc2f5f4a0ed0e5aeb8207e228abb676f4f25a069289dd322cb17b38b0e83f9767a32f9e202fff2adb26d6c4f00660721d3b4b161c07f8e49c"
[*] CRC32: "2FBE35E9"
[*] SSDEEP: "24576:nCM1zIIQedHu6nxFMHjM8lJ5bnAd+V/PTfnT:P1zVB1yI8lJ5bZxTnT"

[*] Process Execution: [
    "Exes_6bb55449f9ad55bb73f25877a1041e1f.jpg",
    "vssadmin.exe",
    "vssadmin.exe",
    "vssadmin.exe",
    "cmd.exe",
    "chcp.com",
    "cmd.exe",
    "chcp.com"
]

[*] Signatures Detected: [
    {
        "Description": "Creates RWX memory",
        "Details": []
    },
    {
        "Description": "A process attempted to delay the analysis task.",
        "Details": [
            {
                "Process": "Exes_6bb55449f9ad55bb73f25877a1041e1f.jpg tried to sleep 516 seconds, actually delayed analysis time by 0 seconds"
            }
        ]
    },
    {
        "Description": "Attempts to connect to a dead IP:Port (7 unique times)",
        "Details": [
            {
                "IP": "208.83.223.34:80"
            },
            {
                "IP": "145.239.66.236:9001"
            },
            {
                "IP": "127.0.0.1:42464"
            },
            {
                "IP": "148.251.11.21:443"
            },
            {
                "IP": "51.15.88.21:443"
            },
            {
                "IP": "194.109.206.212:443"
            },
            {
                "IP": "86.59.21.38:443"
            }
        ]
    },
    {
        "Description": "Starts servers listening on 127.0.0.1:42464",
        "Details": []
    },
    {
        "Description": "Reads data out of its own binary image",
        "Details": [
            {
                "self_read": "process: Exes_6bb55449f9ad55bb73f25877a1041e1f.jpg, pid: 1140, offset: 0x00000000, length: 0x00132108"
            }
        ]
    },
    {
        "Description": "The binary likely contains encrypted or compressed data.",
        "Details": [
            {
                "section": "name: .text, entropy: 7.12, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00113200, virtual_size: 0x0011311c"
            }
        ]
    },
    {
        "Description": "Attempts to delete volume shadow copies",
        "Details": []
    },
    {
        "Description": "Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config",
        "Details": [
            {
                "regkeyval": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1"
            }
        ]
    },
    {
        "Description": "Installs Tor on the infected machine",
        "Details": []
    },
    {
        "Description": "Installs itself for autorun at Windows startup",
        "Details": [
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem"
            },
            {
                "data": "\"C:\\ProgramData\\Windows\\csrss.exe\""
            }
        ]
    },
    {
        "Description": "Exhibits possible ransomware file modification behavior",
        "Details": [
            {
                "file_modifications": "Performs 150 file moves indicative of a potential file encryption process"
            },
            {
                "drops_unknown_mimetypes": "Drops 136 unknown file mime types which may be indicative of encrypted files being written back to disk"
            },
            {
                "appends_new_extension": "Appends a new file extension to multiple modified files"
            },
            {
                "new_appended_file_extension": ".crypted000007"
            }
        ]
    },
    {
        "Description": "Collects information about installed applications",
        "Details": [
            {
                "Program": "Google Update Helper"
            },
            {
            },
            {
                "Program": "Microsoft Excel MUI  2013"
            },
            {
                "Program": "Microsoft Outlook MUI  2013"
            },
            {
            },
            {
                "Program": "Google Chrome"
            },
            {
                "Program": "Adobe Flash Player 29 NPAPI"
            },
            {
                "Program": "Adobe Flash Player 29 ActiveX"
            },
            {
                "Program": "Microsoft DCF MUI  2013"
            },
            {
                "Program": "Microsoft Access MUI  2013"
            },
            {
                "Program": "Microsoft Office Proofing Tools 2013 - English"
            },
            {
                "Program": "Adobe Acrobat Reader DC"
            },
            {
                "Program": "Microsoft Publisher MUI  2013"
            },
            {
                "Program": "Microsoft Office Shared MUI  2013"
            },
            {
                "Program": "Microsoft Office OSM MUI  2013"
            },
            {
                "Program": "Microsoft InfoPath MUI  2013"
            },
            {
                "Program": "Microsoft Office Shared Setup Metadata MUI  2013"
            },
            {
                "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
            },
            {
                "Program": "Microsoft Word MUI  2013"
            },
            {
                "Program": "Microsoft OneDrive"
            },
            {
                "Program": "Microsoft Groove MUI  2013"
            },
            {
                "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
            },
            {
            },
            {
                "Program": "Microsoft Access Setup Metadata MUI  2013"
            },
            {
                "Program": "Microsoft Office OSM UX MUI  2013"
            },
            {
                "Program": "Java Auto Updater"
            },
            {
                "Program": "Microsoft PowerPoint MUI  2013"
            },
            {
                "Program": "Microsoft Office Professional Plus 2013"
            },
            {
                "Program": "Adobe Refresh Manager"
            },
            {
                "Program": "Microsoft Office Proofing  2013"
            },
            {
                "Program": "Microsoft Lync MUI  2013"
            },
            {
            },
            {
                "Program": "Microsoft OneNote MUI  2013"
            }
        ]
    },
    {
        "Description": "Creates a hidden or system file",
        "Details": [
            {
                "file": "C:\\ProgramData\\Windows\\"
            },
            {
                "file": "C:\\ProgramData\\System32\\"
            },
            {
                "file": "C:\\ProgramData\\System32\\xfs"
            }
        ]
    },
    {
        "Description": "File has been identified by 48 Antiviruses on VirusTotal as malicious",
        "Details": [
            {
                "MicroWorld-eScan": "Trojan.GenericKD.31723157"
            },
            {
                "CAT-QuickHeal": "Trojan.Multi"
            },
            {
                "McAfee": "Trojan-FQSD!6BB55449F9AD"
            },
            {
                "K7AntiVirus": "Trojan ( 0054862b1 )"
            },
            {
                "Alibaba": "Ransom:Win32/Shade.4bd3fd69"
            },
            {
                "K7GW": "Trojan ( 0054862b1 )"
            },
            {
                "Cybereason": "malicious.9f9ad5"
            },
            {
                "Cyren": "W32/Trojan.SVEG-8986"
            },
            {
                "Symantec": "Downloader"
            },
            {
                "APEX": "Malicious"
            },
            {
                "Paloalto": "generic.ml"
            },
            {
                "Kaspersky": "HEUR:Trojan.Win32.Generic"
            },
            {
                "BitDefender": "Trojan.GenericKD.31723157"
            },
            {
                "NANO-Antivirus": "Trojan.Win32.Shade.fnmdxy"
            },
            {
                "ViRobot": "Trojan.Win32.S.Ransom.1253640"
            },
            {
                "AegisLab": "Trojan.Win32.Generic.4!c"
            },
            {
                "Rising": "Ransom.Cerber!8.3058 (TFE:2:msoaiq1Yc8G)"
            },
            {
                "Endgame": "malicious (high confidence)"
            },
            {
                "Sophos": "Mal/Cerber-AL"
            },
            {
                "Comodo": "Malware@#15febuywl3tzo"
            },
            {
                "F-Secure": "Trojan.TR/AD.Troldesh.mlupg"
            },
            {
                "DrWeb": "Trojan.Encoder.858"
            },
            {
                "Zillya": "Adware.Generic.Win32.117648"
            },
            {
                "Invincea": "heuristic"
            },
            {
                "McAfee-GW-Edition": "Trojan-FQSD!6BB55449F9AD"
            },
            {
                "FireEye": "Generic.mg.6bb55449f9ad55bb"
            },
            {
                "Emsisoft": "Trojan-Ransom.Shade (A)"
            },
            {
                "Ikarus": "Trojan-Ransom.Crypted007"
            },
            {
                "Webroot": "W32.Trojan.Gen"
            },
            {
                "Avira": "TR/AD.Troldesh.mlupg"
            },
            {
                "Microsoft": "Ransom:Win32/Shade.C!bit"
            },
            {
                "Arcabit": "Trojan.Generic.D1E40E95"
            },
            {
                "AhnLab-V3": "Trojan/Win32.Kryptik.R256857"
            },
            {
                "ZoneAlarm": "HEUR:Trojan.Win32.Generic"
            },
            {
                "GData": "Win32.Trojan-Ransom.Shade.T3K7KT"
            },
            {
                "ESET-NOD32": "a variant of Win32/Kryptik.GPYH"
            },
            {
                "Acronis": "suspicious"
            },
            {
                "VBA32": "BScope.Malware-Cryptor.Filecoder"
            },
            {
                "ALYac": "Trojan.Ransom.Shade"
            },
            {
                "Ad-Aware": "Trojan.GenericKD.31723157"
            },
            {
                "Tencent": "Win32.Trojan.Falsesign.Wsan"
            },
            {
                "Yandex": "Trojan.Shade!"
            },
            {
                "SentinelOne": "DFI - Malicious PE"
            },
            {
                "Fortinet": "W32/Kryptik.GQEV!tr"
            },
            {
                "AVG": "Win32:RansomX-gen [Ransom]"
            },
            {
                "Panda": "Trj/GdSda.A"
            },
            {
                "CrowdStrike": "win/malicious_confidence_100% (W)"
            },
            {
                "Qihoo-360": "Win32/Trojan.Ransom.e2c"
            }
        ]
    },
    {
        "Description": "Creates a copy of itself",
        "Details": [
            {
                "copy": "C:\\ProgramData\\Windows\\csrss.exe"
            }
        ]
    },
    {
        "Description": "Harvests information related to installed mail clients",
        "Details": [
            {
                "file": "C:\\Users\\user\\Documents\\Outlook Files\\Outlook.pst"
            }
        ]
    },
    {
        "Description": "Anomalous binary characteristics",
        "Details": [
            {
                "anomaly": "Actual checksum does not match that reported in PE header"
            }
        ]
    },
    {
        "Description": "Created network traffic indicative of malicious activity",
        "Details": [
            {
                "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 639"
            },
            {
                "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 497"
            },
            {
                "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 153"
            },
            {
                "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 150"
            },
            {
                "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 274"
            }
        ]
    }
]

[*] Started Service: []

[*] Executed Commands: [
    "C:\\Windows\\system32\\vssadmin.exe List Shadows",
    "C:\\Windows\\system32\\vssadmin.exe Delete Shadows /All /Quiet",
    "C:\\Windows\\system32\\cmd.exe",
    "chcp"
]

[*] Mutexes: []

[*] Modified Files: [
    "\\??\\PIPE\\wkssvc",
    "C:\\ProgramData\\Windows\\csrss.exe",
    "\\??\\PIPE\\srvsvc",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\lock",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs.new",
    "C:\\README1.txt",
    "C:\\README2.txt",
    "C:\\README3.txt",
    "C:\\README4.txt",
    "C:\\README5.txt",
    "C:\\README6.txt",
    "C:\\README7.txt",
    "C:\\README8.txt",
    "C:\\README9.txt",
    "C:\\README10.txt",
    "C:\\Users\\user\\Pictures\\Host.zip",
    "C:\\Users\\user\\Pictures\\plrsPYi5s7Y2WU0P8S2CTgoHCSet60wAvRw79cFdK18=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.xls",
    "C:\\Users\\user\\Pictures\\75CcF3tr5uspfC9UPnY3Mip6oQ23cgyb23rjjDZNWWs=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.pptx",
    "C:\\Users\\user\\Pictures\\IVFxDffUubQR8IBQTDXd7gJEG1QSc60It1sku6BsfKQ=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.ppt",
    "C:\\Users\\user\\Pictures\\KVJMr0eYLY78+e4WrPNhfwDUxT5zLDjhyZSHjrRWqF8=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.pdf",
    "\\Device\\NamedPipe",
    "C:\\Users\\user\\Pictures\\45evb56miSzvvFrP3dk0N8efcYCj+jDUsq58sE12evw=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.jpg",
    "C:\\Users\\user\\Pictures\\YXDRR0nwyqTmp51ZOWW+kFzHvvA4hEtZbz5j8onmf6g=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.html",
    "C:\\Users\\user\\Pictures\\GC-ifFeFbjQU9TQp0oubHUrLGWrx17sXakG3BLXg+A0=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.gif",
    "C:\\Users\\user\\Pictures\\kw3VsDJOe0J-YCW2w4xUuMR9vKPSIuTI9Jm1k1-zt0w=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\Host.doc",
    "C:\\Users\\user\\Pictures\\BxCetG-mBm2OIU4sVNTQ9n1TTR2VvkTpo+ue0aFs-M4=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\.xls",
    "C:\\Users\\user\\Pictures\\0p5-OQwW2IPSxrtHREhZ0g==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\ProgramData\\System32\\xfs",
    "C:\\Users\\user\\Pictures\\.jpg",
    "C:\\Users\\user\\Pictures\\dkLVaETxQfGRow5HQtcxbQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\.html",
    "C:\\Users\\user\\Pictures\\B2fRKG7603qydepVX2VTsQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\.doc",
    "C:\\Users\\user\\Pictures\\MUSXCHQcD5myGvNi2P-hyA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\Pictures\\.bmp",
    "C:\\Users\\user\\Pictures\\TEoFpdSPKB7Ey1uKijZmYQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\+bsZtcTVbzYwy5LV+0e2Mp2ez5z8wJGXoD57MmCxFuIb56EDAZXXDRDrc3GP8Fq3RMwNgY1cayC5bbsk9p2BIE7t5992-UOzrwZ1I52R5S59xsbLugtcMdm9SIlns7-u.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\0vabW22AfPo6qaXHeIr3TlxByiHKCqxjQotHg3Rl8NU=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\c1uT8XWACoTPp4lImjiy3d-bHrP7BiKRGD8HsZwNeIgx571dHHlQtgaEhhOmceoP.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\QDho96SH0xYEoj4Y6bakj7uXcWwcdIEfak-nO5N3Mdk=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\STZMrk4rC5PQ1il4IESLkrGSlppuyjtrRBouqtcpWjc=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vh9BR9PKa3mPXiFP46KDtgsifqgceh9FbnxSKr1oHcI=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\gexXW9hAUHP9LFabzoZfl5FUfvezL+o5DJlmsSyDTVwxRyev0qtLPNomFZfp-JgL.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\qxA4JMrtDGY+KdJsY23EYcyj8QVd9GZWN2HHzz+RfUI=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Fxq+APuXU2PB9aAKwDuzVtT6X3+jSqdE37b5v2tL-wrFeEumF7P2LlJGiUJrRh2L.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\UUlcjOhUGIJQjvFsJxJEHFny5aEbwx9dGZuM452O+Xw=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\6Ht05N3YE6gB5ZBywgRGQC5DIFzqjIBexvBLP3Frbrc=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\5iO0XV4HYlO4gBz6i0laxFv3a0SUQoeV7huVSGHSDW0=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\x864HHWCB5ltGmKGZv8mIxMTImJYg3CZnyEue1IHS2Y=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\swgyhv0oQBvnB1FhLbSCO7G2454hH1LUp4YYK25vw20Lrb14TiI1RNoUfvv27rWF.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\XuVWYXUFCu2HYfNGZ0Btk-jJeBr1cOTuDJjsttQCDK0=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\jFRD37Qi3S9Y0DznZVUdiaRONGeJlbsv83JZGeckqtgliDbAPS201MkhUaNP7iLS.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\R9yD0buIkYP7ncv1WU7EbsgPCSrXRTYLaV42JyzWgvs=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\47ztotI6WZi+3Udt4f6cpy1nqN06BVt4Cnz-v3VK-kQ=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\DArZ83GI4X5l7czOnIOuevZi8PVeJvsIiPQqN3EzDjw=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\1C81QCUrw8PZNiYnLb6KgOGuaTbA11SAcmLyBpguWag=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\qKGbNmNpwRBNnkLE+-twWjpvrfRql3PFShpAOfjW5IQ=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\YI9ImLBqhH1865b2xsrVWOZMES3gc1DWuMG3wU7i9zQ=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\xmVLxoCF07fdfZ966nkyaCz1+9QlJYUAB5vx1464PbY=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\eM4JVAH53+UZl3o3z0iZjI9rjJDpKMcZ2OMChEuYg-8=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\Jhym7y39u3z0M3uaIbwK0qiOY4PIg9e2LeavxyXIZz4=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\p8n5-u7hE3Tqxuv8rxIlCm0DiyoWG8qjV1kd+vHN3j8=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\Vu0vwl0HLDF550hFdSNbK1juaNa9QhG2lK06zgPaaMM=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\D4LrOsZ1ZRcq6TM-FwHXIynt94zeUfvn8ysEfAyVXhg=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\pJUHBirj+8QUNdqzMs7EDsxvPstnB2DtJBampBxGPb8=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\JJ3QTT80B29054GVUf-B2nTixtjF+ULQjgdEeMCFnRg=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159[[fn=Insight]].dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\HJNItzRnbQYqXl17B8iwGR7F1DKgTz9L7a63YLYfrzB3WPGrqNq4z-6WyparHe7e6EYjz4+EBKvzurMLq-1yig==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158[[fn=Element]].dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\Uh1QZenzItN6gURwWQJZLsjzYWAA1kFZfmnKpIzfZjxYrv62WQye3mlnHi71GOAXrlMK9-+m3utA8zD+EDSnmQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\fCTBXpqlHo5nEIji1BhMYm7KEbnowG1K6oPxvCj8gF0EjOGvI+OgxhabC1m2qzl3rBd1rIQGZVq4FqB8YzYu8Js1saHwqjNHCLrKmclqofW-DOvMD0+NSqW1-IUkZ3VwQc4ERchlTk+0QYAadzWOnEWKL8-F4i4v3xfxN-ec8Taesyd9047YjQ-MlGG9+Yi1.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907[[fn=Equations]].dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\1Z+6pzkvC3qzn2LrrIQLSkxPeQyvMrImsAgRTGwnieE84eEFswUHoAuC2TURVhCYx9KPtOMOpn+KdFPt+s0FfA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227[[fn=sist02]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\eUiW5zsh6oZq6hvk8R9Y8sCHSgaaEGURlhC75I3m7S7jZ9WElWAnv7-5OdoBBGyNGI6itDMc0ZrEcr7DFQMByA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226[[fn=turabian]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\+ft3e9G45vqqtBVbt4ki0s8rZPB1AO0fVrGfBqGOBNYSOw-5pOaW55+EfOXPY9e-Tn2uVjWDhpRfqLZeLK7hqQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225[[fn=mlaseventheditionofficeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\wOo421UhuAfed+-UT32bG+j-o-l8r+avi-g5ZFK8V7vGqHSUiJPKWrSPqlTutTddXRp0e34hu56ym1+fB3XMaoCc7NgvSDoYEWFTXZxA+3ln7tBKpcnatf4feAa2mb-HuUwIAbhIY78k3Pm0cf-hKg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224[[fn=iso690nmerical]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\mfxquQ+nstH3YkD+nOdEXXJFw5iukCUx4RCmp88luqwh1b607DITy2RTQFAcC5wc9Bhgh9kfFvzVdJ-UuKiC-UgiRjSn1-XrsNiYX4mtMZw=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223[[fn=iso690]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\bNU6E3tf7rV1q3Eft5TCDGOCQMmLM3CpIWwY-wdQwvYguVK1fvixZBz-IAlqc6Jg2dtfYcFMDtFf00030ZGdwA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222[[fn=ieee2006officeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TB5kFOqskCI3VlqbZYz8rpEk4BdzdLqp5+bg39QtHNPaU3xL-GixhB-X7rzmZjOCjuh7P-0nb4CaVhjUdeA26OR7vEznUMo7suh5Dc6gFNX6k7jrWffU5F82KYpnoOv2.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221[[fn=harvardanglia2008officeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\PqbGpHXeVw9qI-73kzAczG7u++JG4x3MEGRxMnywre0uEfsU3LIgjf0L1a4CB7tOIvdLOM5fJdiWBXyZ3nfhF5gj4ofKQEMvbll2aAZQQYefwlnm+ONEhJqS1TfGYXMQBqK1sPj3G1Lq05L152ZZGg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220[[fn=gosttitle]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\B5-eaF8jcCr8WIHeElIr+Nn3T74q-Th1Y-yYu6URn3FxqY-wAziQ0lUCh72+4iWHBSnbZdIVHeVD3nSD2o4RWw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219[[fn=gostname]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\CJhCJWeMaXdHIjcuuX3QSOp8qr3Xe3uuFYlIsBV6LFV+1QneU7iZEOggUO3bX6HC1ffkdEwW6h3XrdRIqckzcg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218[[fn=gb]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\aHaZWJbm2+k0EYuZgtZIdUz5JrY5B92cG9z8o50s4fPCuPgCvAyvLZbc8SG3U5LN.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217[[fn=chicago]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\rqovKcrnJY+6sP4wxKY0U5o5bxdsTgiErqws3IDkpscnX2FflgWYvCn1fLlw9HxMBgTplwszMJfmZegdjuTObw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216[[fn=apasixtheditionofficeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\HP+kjGlfp-gE28CkLtNqMq2PUUsNMukoXDXARV5+L635vqN1XcRZGlhs0Ue1NyoIEzdKI2-unbwqGQ3CFbuq0hX6DjwjX6fm7o9HI4iri-24u8gAOIhhT-JmXZ5yFuBQ.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\HHpN6RtWB9O6XrSoRfFCtWh4KXR-4P7T8pSUFU3XdojuMOviJ8abJuq2u1-vzauBDX7srIH0PdC7HuwAjrn+iw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\FyQ7Romaw8Hg5fY-X32qManEuOePrbS85om1MrNfu977Fbf51+uCDFhlZ38x46IaMwCmSUpQerJKK6MmKPpcBQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\ehdokwgXh6rFMnh7De4Yvzkz2kuGgALrsn5ItSEjeOwZQ25Bx8+lz95ZdFhwV3WtFaueapaItMqPYyaaE44FyQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\WkllER7s-GvZZPWbze0B-uJONC8Jh7BILNHzZLA+KPvTGoi+YlRTXwccwYMQXDAbkO2BN4WSyBRMwjZS6aVMdg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\cN9d5WSHWCmX+EZfGziqcIJplaOx+Z3PD50FqlrH9bxMCqPGjbw2JzelGcs09tCZytlDxWUsfrLi6lVB2JQcLg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\VZG8LlZqXQjsE9c+0TydhweFWLRuLso0cB1MiOijanjQb5u+e--W8VVA-XTmzslJ3slC+il57kD-naux7zVszA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\P1UvzF104n03tKl6-Yen0EjTOja5XFVOPylyevmLSnDS-zvCK7jkvfvWUGQPRoVeSgUNZQfP-wYvootrTgp1A0hmXQ+pbp2U-iN8yBXFIzo=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\z4sXVYbfMrWbRSkW0F0PuqoUYBJawnV0UFFTKn3yfcsJbCeIZ9Ht+l209Kc4Da0pw+hYz1B9cUDkX7KuLHGQnQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\DUXKwV7843ajk+mqXKJDlg0GJFxMsgSGY8A-dQucZdwOfg7Y6LfuT7iDF5k3-i0cwRrqUSyoXYNT5pujXsyLlg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\SSSXgrgMH-xEZ-jCsReNukvpWcPOZW+cwK4TYbu2ptyB4EVQDFuuHLg6Zm1HdNGfH7XWkW5v0S6mq2i9RuuLmg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\nrQOY6KKn2brFQ1VAuKHCh37UCXNGhSuieToX2tE-zvK6jZYCV63Re6kloTUr7Jf4A61vumgekbHJgjZaQHs9Q==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\zTwmr55hYhWgS3L1uakpKqGnofh++-fbhXccT3po5nxg0j6uqpS4Xm1bKbnIeUAhd1V9rOhi95cNMkPw67VUVA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\RhGIixeZdkpmt8XaYCcs5dG5kVaERLTaUjiijHQ7oUT4RStJSP4fg1I1KKPsoAQTaI5jaEIfljoQtuq2JvG3FQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\RLvjjxJTHz7t41JCwVX-gLA5GVFlz03UvmKx1+0O6vtsp6Yy+tQKXTGp7FiBvdk4HHF70WpBubGZVeWn-rBFqA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\EiSKgnSQlDktK5N+1ApeUXBJ0Ixhse517mhNvxiz86OMrgWhgCvXEy7awQEcD7MzYu4Mo1Ryy5mgm2JDLeTsng==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\e1Jci9O34O+3Ox68Fgr4dkBzh-tu5L6o9u8wBW390Qnk4JfQ+EeAILG80RUxXlJDsHFyU5teaymfUYeIU1ixHA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\9xmU3gXd90lE6bNuYzYM9aM0DnAmtYCjtzMc5rtfjidnkBCHYMFW1ATq9pQ6XX02EEsYmJsnxkh8dXNXvT0FuA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\KMsibN-kHBIGzQY6QUWxQZQsM-GajrvffL8McEeX6+AfMRJ5ndrqefhuXm1g5nEmcZ4dukkccYfQLp0qyzLFdpsDbnH7c5i-G4Yod4Lk8ig=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\0PQ4UR8yQQgfX0vpcJnqBvjGb4uisEa+eDVaV0Ax-ccoqnNLbXGXAofU-coGPpTLFKAay769Suw90d6VohLV1Q==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\qePixszuTfkADjO220HIa6OqE8yY2C3yCFNgm1SPKPtDG7qAd4o5-pdjTsAnHBfIhjiCvVMiyWcNLOn4DRjM-w==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\mwcJeE-8KriK75eiekM0hjRatubFqf4gDpPR5AEhOSGv+peZC5PCmZtLM3kmWymW-sKyTBGdEaDNSfBlaZvuJw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\z6JHTDQGzLcl1v544BySKV0ho5nrotDdl+HWVP20bvaSJh6L0G2kc8kQefcGyvFWq7gCgvbOfcZyRNZsetJ9nQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\Z7i0bb9wr3MqxfL-D8Be2DVB3PCWENzoasXVAUhnKwYIDcQkIkQ+Pqsxfs164bPyH3t126dKxZyOsCGWOVCKgA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\jWQcAs+s9fctxr1x2w+jkAvC3ZmwlZ2JnqWQc4wtvSLrEB8KFBfshGPJ37XfcsfYuzXv-ZDmYUir9CSwejsNZg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\pNCKEXIG2jfm8ykcMO+T4koIBYl9KEpZYPA0VwK+fu0rHHo0e7F4CjymEPbsulPC.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\SphqOMWy5hVS+fryVwOhyubEKpyr-lp-pFUpfMkl2Vw=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\vgzJX-CpO5gMNFh1Yh64j4hxlKgO7MSreb4D4ZeOuVc=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\+0pY-bV4kqfzr89P+xMJWw7XNJCD-5GQbA93meoqHy0=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\gvGfJpBxoHUW85QAr07ebySiS9f2coNoB1GNTz3IIwU=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Tbwcwj72rHE6lPIFsVwCAgtaFtJp5V0Y0ecNAqV2Rio=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\W+t-4ekb8cJ4Udph+J9eMFhHyBVDyUNzG8+kmZb32KVmeOSSOBo7SNkVP6Ojhh3UpGD0N7h9WjDGQ6sfxSfbcQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\l9j-EyGZy3dW68PV2kbpT7yJccAPQesk9Ef-BxXrx3Wecs1MHaISK3qsMdqTgMToISL9YUO-tDq6Iy9VEJ1fFw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\Pov2agFlai5TVZYyW5jYVMcygvLKv4Cjj8PETpejM7E=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\kYAutPIw7irs7BOFTv5y3TQGp6RjBi9lpc1tu4fS3c0=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\PdlgbmAastjXmjvZv5Zr1Ieu3yaiQl2uXa2pWLPpVXgOJfOv0mftSR+4P95Dr4orI7OGLkmuVUluVw5K3gAiP-RIAG064Rj46fGOHIBifKs=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\A3HSbWxF8B5FKz5-Z+a0bjD6qPAbjtmsmDiqFBMNerl5q1unRma6gayJJJPEPmqA.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APAo8ej4qQ-Kgn71JfT3fF8AF6H0Glr4l3o5GG8Fdcs=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\lFrZKPpeNg5j5DRsWFlFBan16eGKiPmuy97VusEdNXuqOTD+FqN8sIDne3xlRuYv.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\Whm8mxO3i3nHPwa5QBqtB4YR7fihEzNNgjYbdqW5h59Sokx0RTjdkRoSoz5e8Vy+Gd9TrUaKNhCUiXEycdn5ze8sMXI3NoSClDjA-CsgreA=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\v+yZTleEXXSRCZmgfWCoGN+NWnSSNGJorXG7u-guTNY=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\Qcl0SfWcm7I6+LRsyvmJqbNBQTvQpMn3jlwZeiU9E9U=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\6uHxAxxsigJQSc5ENnI7mQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\J32IQEtO-0S3k2DWjEhL9lDoGN5RFxJzswJJgp0vL2o=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\J1NHf+eZk5oWPQV4pmKKEaYN0k95GVjtTDlltPzHettA3SFUUV-PRUZfJnzn45YhvyycLxuwnr-28XLCYSqvOQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Kjc0pqmo9WT8Lv4lich3+MD-uiv77b9nzIeZPPZdAe-FCFByE3FTKvCbHjr4uzJ9Zr-I+3cYt3JdpEkjd0gBzQEu7nZb8CtWCvrf-VMhXR9FfeJV9rf7-i3+Sy3iiGs6HqgOB6aQRtUEZNwqvHXVwA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\wJeu9nNrk4ebl1cIOofde+skNIqpLwTIr6qcfda1DE7+xNd3HhF1vkGwZub9BJ-BUs757vHuGdB0lNKTV4GIdQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\6Rp0rAH1P778TfI2LPKi1VoBRItsqeuWLqJHsIsNxnQtuEFQWLOT0lJSWKlf-kS27TjFYV2x+66Bxu51m+sHc5PUE8jPO4XnwD-9-jtDwsU=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\eBX9EIW5tk9tT+rkHq9aAReYVqxpSrYpAw7HYtE4XKE=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\sgXMYKm7RzcBf7rkW5wQnsqH7-dzJvCst0ElyEWo5VA=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\oTblcjccVqGAmgnp5bj5fl2Nc9RLcLJio11AdL5y3qM=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\4aO7vN-Ra38CDu71W1HUBtBw25FNZ4zC0tV9I8iX+9qd8dpx6A2OTZBvOuHTnnLkZ4AjpoL1X2-lfnfIRk6Ubu+pzuYe9rLHd4mJMPsWVOE=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\f9OnIqNEFSnYpowrs1rfGEHf7dW94APT8B6jBR84Fu4=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\uj-MHZL4+nTtY2A8H1DDLZ355-ZlstNMkb9aM18EfzQ=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\aWKZH2KKViTo9yWFe-TLltP+5tz4-b64buOfCTgm1efDH4fiueUZ2Df+HWE+eQpj.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\+oMPPEmVibALTF9Pn+0nkA==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\rOAOtnkmR6iROfF7oO9IU-E-YnOO3SBiPm1ZmCBYTy1MxHqH+D4DZNOmWy23ByW8.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\HoeIQquHR4btjoBEO5xDfyh4F2QBvsCYzTKdLGJTQJ8=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
    "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\iUkm5CELeFZn7RXPjAmyfqOBPxf86qMCPYWEFQAtyJ0=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\8ZCtnyddYc7xj1gsLR404VLx9bcugdz9JAI16zt92nM=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2utreHY+jxgg-ED+mcgOLwecuzrthT4HLUa4g60oPiE5fxH7ssv7ufxvK1GVFoUJy+wQhVhlaJadCnZJlaH+Ng==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\WPlaeZ68SQ3R6N7NAoeIxPiB5S3HK1i2RAC4bTYs8BJ8665z1d7V47d85rJQJh7AqRBPXl62Syh3nKyIp4kTWQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\S-RH2epX7LIP1amxZHSMsH35olczqrUywjPIHPg7IIVIrwT+D6b7i8fZYKARzNxcV-INHp8E3IJ81BysJd67oQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\xMUyClT-1v2yDsMaIRuIS4-KU6P0x04kYV-9-COLk0Y6l2nBmNW6HKLTBwjESZX+eaR23FMgg3IO63V8MyRgOQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\fm4fNaJauGyb6h15eSlI354AgIFtcVCE-yLbdD0lWFLNtdzyvMy1g8JjNL5uZ64rtfbEGK73ZHS7jwve+1AEEg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\9bYdZ2B9ZpdCRrsZva65ouYpY67bp-tvdiKjKjrvI7Lw8uDWZgIBT6cgp2vs2L2BgIhJTBUMgx1hnQy3Na9Odw==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\htnuUHkoovoD2VTtCf-w7gXYbzsqWdL5LxpOhq6S1DSKqIUI4wL4ukAMTQyJaDFU-zDicYcKcEd2cAgCcp6WqQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\O+gYVTRe7qoeQVfqKKEjug==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\u5TOnlQh4PXtOiBPaQElhEd4hFZGkHiAc-IlxRorhhe-rmkoOoTVMXgjQMdYDoZIMdkTIsKLcTTFfrq6kuXIgkM98DvKFwpTdnqoBOQr9uIpB+8Bjsy8PsQqS5GC8OnWREZ9KLbH-V1IIDRAIxxKU19Nj5925FVYOV3bQM8WABM=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\WbyTUKt3sC2MrtJVMeMpHfBv0fvS2iBBrWCfrLHGEOm2kD2SHhyKh1qHVhgZk0TbL8VORsFrHCy5yk5Q3AQ2IiXBhZWTO8tzi0oQBvnIm-wDLsjCYtOVKum8gAiz6As91cZNlgeCeGBbeOjLB4DzwnRUWSWzB4-Zm6ODs6ZruZ4=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\IcDIzoZ00btsEDe9MWVFQod7r7g5Y1WZaq6FBxnzhrNIIgclUHRgivdXosAe2-oBp4Mgw6TTvn5IpbUgx0Q6kObQJ03xY+-thL-u5DfMF7RAnk3Ow-YaUuJKMH0LG1Km96DZkHzr-M31c8l2r-ph953DFZh5+CU7Ri9ZY9UgxPc=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\E15zxGVOI+anP6bB40dbYVF3j4JU3pfOb0jNfGV6A-V6DE8xsbMQ+oFWXsZ7DwSQJxiK2WSJZqyUwd6fHJ-oVGr5dzmJ3sIQZCQRtH3bLJv4TIgf0aXrzFOWgAka7bMWF4p-5dGObLmgCGFcQ7IilJ6aAwaCNXR1T7pvun966bI=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\1EQlsxjFGCyOKhbEVMMdbpknBEGTxXGdljFuaSSvySvCXT-x2uj9oS58FkZDyNo1q8A5JAv7nvt0U4NxJJealyKPJej3nl6VcWoJxBCoEZ3BPs73xE0TNL7U+POQRg8EId1hnszfe5d2VFKjwobZOVcB64zPnEikhceXi9KF0P8=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\y9qBPHbMFf3Hw7GPl9eiOpk7XaK6+k2USM6PaRvgiPsmOnyMygmC8LYKgLdu48mnJ6-hUlWnxPbkU3h-GwHlEQ==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\DNsn0BRHXYqMvJJ45JSAMihRTU1H3mm2WnWSuPMTvu83kfmIQC2JB-6wUmlEUx3mJwJjL976JF1atktIkVUROhFJ+K7Klx54dYE8qbRKsnSqj7L+QhV2yM4y3ZBEWr+lm2cdHbujtjNIVnt1fZtfxT7CNxamQ0WfV-UKcNJ6bHM=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\r9zVjVPgeSbj7SJzmb0O8BBaasFBrxICj01yFVw9m53Svg9DrwY8N3JRinrlrjiCYMv1UNMuICviSUeNNuKno0zknMTvXw3SxusUVTeU2axlrjXd6tSxS9J2UGFlT26OpENXfGrK-WW5sYOBJIH3yWpvr6gI2ZwxfDukHOIqfJk=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Q26A+Adcif2tpdl9eAklaC+fjXpqtuV08QjzS7HI8HDYjYwvLcyWnAjlKP0yMX9X4Nubj1XWmXEkaEQDkeT3HFbjWMRJMh+gqeVOAX1Ai5ZKHIMPsyZPkLEf-TqkDorcHqy5+jJVrQkWv3I0xKO6dabVzD5VDRLionPhdT6XpTU=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\7jA9gHTQSlUf+9aZpo2QBrfixj4I-y2iPFMvePUfcExVWh9WTREG4LyOcevqlbshe7ZNjQBu4YTGXhM-jbtezUC5c1dieFsyCN9oxxLsWFis-RbX4oLhb0jlv9+iK7SxgQoaWELyIXaJUBTf6xe1S2elCmLmbU0wwixlmY8CwD8=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\JpRG7XvkhUK6ID3l1QFg5tWiTONVXomlzsYbqGymZED8cPkYS46IDErJ6CbFYaw6ZwDw36c9qtJsDgvjaSxeqcjLGtit6YEz8izuDyNwogc=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\qGFc3X+y47Lr+5lYfdmVVFDRZaPSwkZuwNaKJnpAvsl7sM0pX0yOfCvkY9HWPwZm.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Sy4SPKiDgx2L3uQe+-F-JY6hcpESf84-6yEwnmO3BWs=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\g7YdjaOqKLWyw1FU0zwOXVesiSoFiLBF1UYuQjsFHbrRSOb3x7HMxEOOLOCbfJp9SSptSLPKNRM7ySADDhTfxg==.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\D3CrQi5hX5holhMp3VAXUgkU-aYg8eVx3+Fmp76fuPM=.C30C4DA81AE308962B9A.crypted000007",
    "C:\\Users\\user\\AppData\\Local\\Temp\\jawshtml.html"
]

[*] Deleted Files: [
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
    "C:\\Users\\user\\Pictures\\Host.zip",
    "C:\\Users\\user\\Pictures\\Host.xls",
    "C:\\Users\\user\\Pictures\\Host.pptx",
    "C:\\Users\\user\\Pictures\\Host.ppt",
    "C:\\Users\\user\\Pictures\\Host.pdf",
    "C:\\Users\\user\\Pictures\\Host.jpg",
    "C:\\Users\\user\\Pictures\\Host.html",
    "C:\\Users\\user\\Pictures\\Host.gif",
    "C:\\Users\\user\\Pictures\\Host.doc",
    "C:\\Users\\user\\Pictures\\.xls",
    "C:\\Users\\user\\Pictures\\.jpg",
    "C:\\Users\\user\\Pictures\\.html",
    "C:\\Users\\user\\Pictures\\.doc",
    "C:\\Users\\user\\Pictures\\.bmp",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\userDefineLangs\\userDefinedLang-markdown.default.modern.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Zenburn.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\vim Dark Blue.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Vibrant Ink.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Twilight.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Solarized-light.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Ruby Blue.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Plastic Code Wrap.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Obsidian.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Navajo.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\MossyLawn.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Monokai.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Mono Industrial.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\khaki.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\HotFudgeSundae.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Hello Kitty.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Deep Black.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Choco.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Black board.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\themes\\Bespin.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\plugins\\config\\converter.ini",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\stylers.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\shortcuts.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\session.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\langs.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\functionList.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\contextMenu.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\config.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998159[[fn=Insight]].dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM03998158[[fn=Element]].dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Building Blocks\\1033\\TM01840907[[fn=Equations]].dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851227[[fn=sist02]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851226[[fn=turabian]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851225[[fn=mlaseventheditionofficeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851224[[fn=iso690nmerical]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851223[[fn=iso690]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851222[[fn=ieee2006officeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851221[[fn=harvardanglia2008officeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851220[[fn=gosttitle]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851219[[fn=gostname]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851218[[fn=gb]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851217[[fn=chicago]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Word Document Bibliography Styles\\TM02851216[[fn=apasixtheditionofficeonline]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001115[[fn=Parcel]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001114[[fn=Gallery]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Word.docx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\NormalPre.dotm",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\15\\Built-In Building Blocks.dotx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFF13.tmp\\APASixthEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB4.tmp\\harvardanglia2008officeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFEB3.tmp\\turabian.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE2.tmp\\gosttitle.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC2.tmp\\chicago.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC1.tmp\\mlaseventheditionofficeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC0.tmp\\gostname.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE.tmp\\iso690.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD.tmp\\ieee2006officeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D.tmp\\gb.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C.tmp\\iso690nmerical.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B.tmp\\sist02.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\scoped_dir1924_4570\\CRX_INSTALL\\manifest.json",
    "C:\\Users\\user\\AppData\\Local\\Temp\\outlook logging\\firstrun.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2011.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1934.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1904.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1834.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450a.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1450.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190127-1449.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\SetupExe(2019031622322792C).log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\StructuredQuery.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\MSIcb2dc.LOG",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Host-20190316-2221.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\jusched.log"
]

[*] Modified Registry Keys: [
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\System32\\Configuration\\",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xi",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xVersion",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmail",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmode",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xpk",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xstate",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xcnt",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\shst",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh1",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\sh2"
]

[*] Deleted Registry Keys: []

[*] DNS Communications: []

[*] Domains: []

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: []

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "GlobalUnlock",
                        "address": "0x51512c"
                    },
                    {
                        "name": "Heap32ListNext",
                        "address": "0x515130"
                    },
                    {
                        "name": "HeapAlloc",
                        "address": "0x515134"
                    },
                    {
                        "name": "HeapCreate",
                        "address": "0x515138"
                    },
                    {
                        "name": "HeapFree",
                        "address": "0x51513c"
                    },
                    {
                        "name": "HeapReAlloc",
                        "address": "0x515140"
                    },
                    {
                        "name": "HeapSize",
                        "address": "0x515144"
                    },
                    {
                        "name": "HeapValidate",
                        "address": "0x515148"
                    },
                    {
                        "name": "InitializeCriticalSection",
                        "address": "0x51514c"
                    },
                    {
                        "name": "InitializeCriticalSectionAndSpinCount",
                        "address": "0x515150"
                    },
                    {
                        "name": "InterlockedDecrement",
                        "address": "0x515154"
                    },
                    {
                        "name": "InterlockedExchange",
                        "address": "0x515158"
                    },
                    {
                        "name": "InterlockedIncrement",
                        "address": "0x51515c"
                    },
                    {
                        "name": "IsDebuggerPresent",
                        "address": "0x515160"
                    },
                    {
                        "name": "IsValidCodePage",
                        "address": "0x515164"
                    },
                    {
                        "name": "LCMapStringA",
                        "address": "0x515168"
                    },
                    {
                        "name": "LCMapStringW",
                        "address": "0x51516c"
                    },
                    {
                        "name": "LeaveCriticalSection",
                        "address": "0x515170"
                    },
                    {
                        "name": "LoadLibraryA",
                        "address": "0x515174"
                    },
                    {
                        "name": "LoadLibraryW",
                        "address": "0x515178"
                    },
                    {
                        "name": "LoadResource",
                        "address": "0x51517c"
                    },
                    {
                        "name": "LocalAlloc",
                        "address": "0x515180"
                    },
                    {
                        "name": "LocalFree",
                        "address": "0x515184"
                    },
                    {
                        "name": "LocalReAlloc",
                        "address": "0x515188"
                    },
                    {
                        "name": "LocalSize",
                        "address": "0x51518c"
                    },
                    {
                        "name": "LockResource",
                        "address": "0x515190"
                    },
                    {
                        "name": "MapViewOfFile",
                        "address": "0x515194"
                    },
                    {
                        "name": "MultiByteToWideChar",
                        "address": "0x515198"
                    },
                    {
                        "name": "OpenEventW",
                        "address": "0x51519c"
                    },
                    {
                        "name": "OpenMutexW",
                        "address": "0x5151a0"
                    },
                    {
                        "name": "OpenSemaphoreA",
                        "address": "0x5151a4"
                    },
                    {
                        "name": "OpenThread",
                        "address": "0x5151a8"
                    },
                    {
                        "name": "OutputDebugStringA",
                        "address": "0x5151ac"
                    },
                    {
                        "name": "QueryPerformanceCounter",
                        "address": "0x5151b0"
                    },
                    {
                        "name": "RaiseException",
                        "address": "0x5151b4"
                    },
                    {
                        "name": "ReadConsoleW",
                        "address": "0x5151b8"
                    },
                    {
                        "name": "ReadFile",
                        "address": "0x5151bc"
                    },
                    {
                        "name": "ReleaseMutex",
                        "address": "0x5151c0"
                    },
                    {
                        "name": "ReplaceFileA",
                        "address": "0x5151c4"
                    },
                    {
                        "name": "RtlUnwind",
                        "address": "0x5151c8"
                    },
                    {
                        "name": "GlobalReAlloc",
                        "address": "0x5151cc"
                    },
                    {
                        "name": "SetConsoleCtrlHandler",
                        "address": "0x5151d0"
                    },
                    {
                        "name": "SetConsoleMode",
                        "address": "0x5151d4"
                    },
                    {
                        "name": "SetConsoleOutputCP",
                        "address": "0x5151d8"
                    },
                    {
                        "name": "SetConsoleTextAttribute",
                        "address": "0x5151dc"
                    },
                    {
                        "name": "SetErrorMode",
                        "address": "0x5151e0"
                    },
                    {
                        "name": "SetEvent",
                        "address": "0x5151e4"
                    },
                    {
                        "name": "SetFilePointer",
                        "address": "0x5151e8"
                    },
                    {
                        "name": "SetHandleCount",
                        "address": "0x5151ec"
                    },
                    {
                        "name": "SetLastError",
                        "address": "0x5151f0"
                    },
                    {
                        "name": "SetStdHandle",
                        "address": "0x5151f4"
                    },
                    {
                        "name": "SetThreadLocale",
                        "address": "0x5151f8"
                    },
                    {
                        "name": "SetUnhandledExceptionFilter",
                        "address": "0x5151fc"
                    },
                    {
                        "name": "SetVolumeMountPointW",
                        "address": "0x515200"
                    },
                    {
                        "name": "SizeofResource",
                        "address": "0x515204"
                    },
                    {
                        "name": "Sleep",
                        "address": "0x515208"
                    },
                    {
                        "name": "SystemTimeToFileTime",
                        "address": "0x51520c"
                    },
                    {
                        "name": "TerminateProcess",
                        "address": "0x515210"
                    },
                    {
                        "name": "TerminateThread",
                        "address": "0x515214"
                    },
                    {
                        "name": "TlsAlloc",
                        "address": "0x515218"
                    },
                    {
                        "name": "TlsFree",
                        "address": "0x51521c"
                    },
                    {
                        "name": "TlsGetValue",
                        "address": "0x515220"
                    },
                    {
                        "name": "TlsSetValue",
                        "address": "0x515224"
                    },
                    {
                        "name": "UnhandledExceptionFilter",
                        "address": "0x515228"
                    },
                    {
                        "name": "UnmapViewOfFile",
                        "address": "0x51522c"
                    },
                    {
                        "name": "VerLanguageNameA",
                        "address": "0x515230"
                    },
                    {
                        "name": "VirtualAlloc",
                        "address": "0x515234"
                    },
                    {
                        "name": "VirtualFree",
                        "address": "0x515238"
                    },
                    {
                        "name": "WaitForMultipleObjects",
                        "address": "0x51523c"
                    },
                    {
                        "name": "WaitForSingleObject",
                        "address": "0x515240"
                    },
                    {
                        "name": "WideCharToMultiByte",
                        "address": "0x515244"
                    },
                    {
                        "name": "WriteConsoleA",
                        "address": "0x515248"
                    },
                    {
                        "name": "WriteConsoleW",
                        "address": "0x51524c"
                    },
                    {
                        "name": "WriteFile",
                        "address": "0x515250"
                    },
                    {
                        "name": "WritePrivateProfileStringW",
                        "address": "0x515254"
                    },
                    {
                        "name": "_lwrite",
                        "address": "0x515258"
                    },
                    {
                        "name": "lstrcmpA",
                        "address": "0x51525c"
                    },
                    {
                        "name": "lstrcmpW",
                        "address": "0x515260"
                    },
                    {
                        "name": "lstrlenA",
                        "address": "0x515264"
                    },
                    {
                        "name": "lstrlenW",
                        "address": "0x515268"
                    },
                    {
                        "name": "GlobalLock",
                        "address": "0x51526c"
                    },
                    {
                        "name": "GlobalHandle",
                        "address": "0x515270"
                    },
                    {
                        "name": "GlobalFree",
                        "address": "0x515274"
                    },
                    {
                        "name": "GlobalFlags",
                        "address": "0x515278"
                    },
                    {
                        "name": "GlobalFindAtomW",
                        "address": "0x51527c"
                    },
                    {
                        "name": "GlobalDeleteAtom",
                        "address": "0x515280"
                    },
                    {
                        "name": "GlobalAlloc",
                        "address": "0x515284"
                    },
                    {
                        "name": "GlobalAddAtomW",
                        "address": "0x515288"
                    },
                    {
                        "name": "GetVersionExW",
                        "address": "0x51528c"
                    },
                    {
                        "name": "GetVersionExA",
                        "address": "0x515290"
                    },
                    {
                        "name": "GetUserDefaultUILanguage",
                        "address": "0x515294"
                    },
                    {
                        "name": "GetTickCount",
                        "address": "0x515298"
                    },
                    {
                        "name": "GetThreadPriority",
                        "address": "0x51529c"
                    },
                    {
                        "name": "GetThreadLocale",
                        "address": "0x5152a0"
                    },
                    {
                        "name": "GetSystemTimeAsFileTime",
                        "address": "0x5152a4"
                    },
                    {
                        "name": "GetSystemDefaultLCID",
                        "address": "0x5152a8"
                    },
                    {
                        "name": "GetStringTypeW",
                        "address": "0x5152ac"
                    },
                    {
                        "name": "GetStringTypeExW",
                        "address": "0x5152b0"
                    },
                    {
                        "name": "GetStringTypeA",
                        "address": "0x5152b4"
                    },
                    {
                        "name": "GetStdHandle",
                        "address": "0x5152b8"
                    },
                    {
                        "name": "GetStartupInfoW",
                        "address": "0x5152bc"
                    },
                    {
                        "name": "GetStartupInfoA",
                        "address": "0x5152c0"
                    },
                    {
                        "name": "GetShortPathNameW",
                        "address": "0x5152c4"
                    },
                    {
                        "name": "GetProcessHeaps",
                        "address": "0x5152c8"
                    },
                    {
                        "name": "GetProcessHeap",
                        "address": "0x5152cc"
                    },
                    {
                        "name": "GetProcAddress",
                        "address": "0x5152d0"
                    },
                    {
                        "name": "GetOEMCP",
                        "address": "0x5152d4"
                    },
                    {
                        "name": "GetModuleHandleW",
                        "address": "0x5152d8"
                    },
                    {
                        "name": "GetModuleHandleA",
                        "address": "0x5152dc"
                    },
                    {
                        "name": "GetModuleFileNameW",
                        "address": "0x5152e0"
                    },
                    {
                        "name": "GetModuleFileNameA",
                        "address": "0x5152e4"
                    },
                    {
                        "name": "GetLocaleInfoW",
                        "address": "0x5152e8"
                    },
                    {
                        "name": "GetLocaleInfoA",
                        "address": "0x5152ec"
                    },
                    {
                        "name": "GetLocalTime",
                        "address": "0x5152f0"
                    },
                    {
                        "name": "GetLastError",
                        "address": "0x5152f4"
                    },
                    {
                        "name": "GetFileType",
                        "address": "0x5152f8"
                    },
                    {
                        "name": "GetExitCodeThread",
                        "address": "0x5152fc"
                    },
                    {
                        "name": "GetEnvironmentStringsW",
                        "address": "0x515300"
                    },
                    {
                        "name": "GetCurrentThreadId",
                        "address": "0x515304"
                    },
                    {
                        "name": "GetCurrentThread",
                        "address": "0x515308"
                    },
                    {
                        "name": "GetCurrentProcessId",
                        "address": "0x51530c"
                    },
                    {
                        "name": "GetCurrentProcess",
                        "address": "0x515310"
                    },
                    {
                        "name": "GetConsoleScreenBufferInfo",
                        "address": "0x515314"
                    },
                    {
                        "name": "GetConsoleOutputCP",
                        "address": "0x515318"
                    },
                    {
                        "name": "GetConsoleMode",
                        "address": "0x51531c"
                    },
                    {
                        "name": "GetConsoleFontSize",
                        "address": "0x515320"
                    },
                    {
                        "name": "GetConsoleCP",
                        "address": "0x515324"
                    },
                    {
                        "name": "GetComputerNameW",
                        "address": "0x515328"
                    },
                    {
                        "name": "GetCommandLineW",
                        "address": "0x51532c"
                    },
                    {
                        "name": "GetCPInfo",
                        "address": "0x515330"
                    },
                    {
                        "name": "GetACP",
                        "address": "0x515334"
                    },
                    {
                        "name": "FreeLibrary",
                        "address": "0x515338"
                    },
                    {
                        "name": "FreeEnvironmentStringsW",
                        "address": "0x51533c"
                    },
                    {
                        "name": "FormatMessageW",
                        "address": "0x515340"
                    },
                    {
                        "name": "FlushFileBuffers",
                        "address": "0x515344"
                    },
                    {
                        "name": "FindResourceW",
                        "address": "0x515348"
                    },
                    {
                        "name": "FindNextFileW",
                        "address": "0x51534c"
                    },
                    {
                        "name": "FindFirstFileW",
                        "address": "0x515350"
                    },
                    {
                        "name": "FindClose",
                        "address": "0x515354"
                    },
                    {
                        "name": "FileTimeToLocalFileTime",
                        "address": "0x515358"
                    },
                    {
                        "name": "FileTimeToDosDateTime",
                        "address": "0x51535c"
                    },
                    {
                        "name": "ExitProcess",
                        "address": "0x515360"
                    },
                    {
                        "name": "EnumResourceLanguagesW",
                        "address": "0x515364"
                    },
                    {
                        "name": "EnterCriticalSection",
                        "address": "0x515368"
                    },
                    {
                        "name": "DeleteCriticalSection",
                        "address": "0x51536c"
                    },
                    {
                        "name": "CreateThread",
                        "address": "0x515370"
                    },
                    {
                        "name": "CreateMutexW",
                        "address": "0x515374"
                    },
                    {
                        "name": "CreateMutexA",
                        "address": "0x515378"
                    },
                    {
                        "name": "CreateFileW",
                        "address": "0x51537c"
                    },
                    {
                        "name": "CreateFileMappingW",
                        "address": "0x515380"
                    },
                    {
                        "name": "CreateFileA",
                        "address": "0x515384"
                    },
                    {
                        "name": "CreateEventW",
                        "address": "0x515388"
                    },
                    {
                        "name": "ConvertDefaultLocale",
                        "address": "0x51538c"
                    },
                    {
                        "name": "SetComputerNameExA",
                        "address": "0x515390"
                    },
                    {
                        "name": "CloseHandle",
                        "address": "0x515394"
                    }
                ],
                "dll": "KERNEL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "LoadCursorFromFileA",
                        "address": "0x51541c"
                    },
                    {
                        "name": "GetClipboardData",
                        "address": "0x515420"
                    },
                    {
                        "name": "InSendMessage",
                        "address": "0x515424"
                    },
                    {
                        "name": "IsMenu",
                        "address": "0x515428"
                    },
                    {
                        "name": "DestroyIcon",
                        "address": "0x51542c"
                    },
                    {
                        "name": "CharLowerW",
                        "address": "0x515430"
                    },
                    {
                        "name": "GetMenuContextHelpId",
                        "address": "0x515434"
                    },
                    {
                        "name": "VkKeyScanA",
                        "address": "0x515438"
                    },
                    {
                        "name": "CountClipboardFormats",
                        "address": "0x51543c"
                    },
                    {
                        "name": "IsCharAlphaA",
                        "address": "0x515440"
                    },
                    {
                        "name": "IsCharAlphaNumericA",
                        "address": "0x515444"
                    },
                    {
                        "name": "GetProcessWindowStation",
                        "address": "0x515448"
                    },
                    {
                        "name": "IsWindowUnicode",
                        "address": "0x51544c"
                    },
                    {
                        "name": "GetKeyboardLayout",
                        "address": "0x515450"
                    },
                    {
                        "name": "VkKeyScanW",
                        "address": "0x515454"
                    },
                    {
                        "name": "GetKBCodePage",
                        "address": "0x515458"
                    },
                    {
                        "name": "GetClipboardOwner",
                        "address": "0x51545c"
                    },
                    {
                        "name": "GetAsyncKeyState",
                        "address": "0x515460"
                    },
                    {
                        "name": "DestroyCursor",
                        "address": "0x515464"
                    },
                    {
                        "name": "CloseClipboard",
                        "address": "0x515468"
                    },
                    {
                        "name": "PaintDesktop",
                        "address": "0x51546c"
                    },
                    {
                        "name": "GetInputState",
                        "address": "0x515470"
                    },
                    {
                        "name": "GetCursor",
                        "address": "0x515474"
                    },
                    {
                        "name": "CharNextW",
                        "address": "0x515478"
                    },
                    {
                        "name": "CloseDesktop",
                        "address": "0x51547c"
                    },
                    {
                        "name": "ReleaseCapture",
                        "address": "0x515480"
                    },
                    {
                        "name": "EnumClipboardFormats",
                        "address": "0x515484"
                    },
                    {
                        "name": "GetWindowContextHelpId",
                        "address": "0x515488"
                    },
                    {
                        "name": "GetWindowTextLengthA",
                        "address": "0x51548c"
                    },
                    {
                        "name": "GetClipboardViewer",
                        "address": "0x515490"
                    },
                    {
                        "name": "GetThreadDesktop",
                        "address": "0x515494"
                    },
                    {
                        "name": "IsCharAlphaW",
                        "address": "0x515498"
                    },
                    {
                        "name": "AnyPopup",
                        "address": "0x51549c"
                    },
                    {
                        "name": "CharUpperW",
                        "address": "0x5154a0"
                    },
                    {
                        "name": "IsCharLowerW",
                        "address": "0x5154a4"
                    },
                    {
                        "name": "IsClipboardFormatAvailable",
                        "address": "0x5154a8"
                    },
                    {
                        "name": "GetQueueStatus",
                        "address": "0x5154ac"
                    },
                    {
                        "name": "CloseWindow",
                        "address": "0x5154b0"
                    },
                    {
                        "name": "GetDialogBaseUnits",
                        "address": "0x5154b4"
                    },
                    {
                        "name": "OemKeyScan",
                        "address": "0x5154b8"
                    },
                    {
                        "name": "CharNextA",
                        "address": "0x5154bc"
                    },
                    {
                        "name": "LoadIconA",
                        "address": "0x5154c0"
                    },
                    {
                        "name": "WindowFromDC",
                        "address": "0x5154c4"
                    },
                    {
                        "name": "WinHelpW",
                        "address": "0x5154c8"
                    },
                    {
                        "name": "ValidateRect",
                        "address": "0x5154cc"
                    },
                    {
                        "name": "UnregisterDeviceNotification",
                        "address": "0x5154d0"
                    },
                    {
                        "name": "UnregisterClassW",
                        "address": "0x5154d4"
                    },
                    {
                        "name": "UnhookWindowsHookEx",
                        "address": "0x5154d8"
                    },
                    {
                        "name": "UnhookWinEvent",
                        "address": "0x5154dc"
                    },
                    {
                        "name": "TranslateMessage",
                        "address": "0x5154e0"
                    },
                    {
                        "name": "TabbedTextOutW",
                        "address": "0x5154e4"
                    },
                    {
                        "name": "SystemParametersInfoA",
                        "address": "0x5154e8"
                    },
                    {
                        "name": "ShowWindow",
                        "address": "0x5154ec"
                    },
                    {
                        "name": "SetWindowsHookExW",
                        "address": "0x5154f0"
                    },
                    {
                        "name": "SetWindowTextW",
                        "address": "0x5154f4"
                    },
                    {
                        "name": "SetWindowPos",
                        "address": "0x5154f8"
                    },
                    {
                        "name": "SetWindowLongW",
                        "address": "0x5154fc"
                    },
                    {
                        "name": "SetPropW",
                        "address": "0x515500"
                    },
                    {
                        "name": "SetMessageQueue",
                        "address": "0x515504"
                    },
                    {
                        "name": "SetMenuItemBitmaps",
                        "address": "0x515508"
                    },
                    {
                        "name": "SetMenu",
                        "address": "0x51550c"
                    },
                    {
                        "name": "SetForegroundWindow",
                        "address": "0x515510"
                    },
                    {
                        "name": "SetCursor",
                        "address": "0x515514"
                    },
                    {
                        "name": "SendMessageW",
                        "address": "0x515518"
                    },
                    {
                        "name": "SendMessageA",
                        "address": "0x51551c"
                    },
                    {
                        "name": "RemovePropW",
                        "address": "0x515520"
                    },
                    {
                        "name": "ReleaseDC",
                        "address": "0x515524"
                    },
                    {
                        "name": "RegisterWindowMessageW",
                        "address": "0x515528"
                    },
                    {
                        "name": "RegisterClassW",
                        "address": "0x51552c"
                    },
                    {
                        "name": "PtInRect",
                        "address": "0x515530"
                    },
                    {
                        "name": "PostThreadMessageA",
                        "address": "0x515534"
                    },
                    {
                        "name": "PostQuitMessage",
                        "address": "0x515538"
                    },
                    {
                        "name": "PostMessageW",
                        "address": "0x51553c"
                    },
                    {
                        "name": "PeekMessageW",
                        "address": "0x515540"
                    },
                    {
                        "name": "NotifyWinEvent",
                        "address": "0x515544"
                    },
                    {
                        "name": "MsgWaitForMultipleObjectsEx",
                        "address": "0x515548"
                    },
                    {
                        "name": "ModifyMenuW",
                        "address": "0x51554c"
                    },
                    {
                        "name": "MessageBoxW",
                        "address": "0x515550"
                    },
                    {
                        "name": "MessageBoxA",
                        "address": "0x515554"
                    },
                    {
                        "name": "MapWindowPoints",
                        "address": "0x515558"
                    },
                    {
                        "name": "LoadStringW",
                        "address": "0x51555c"
                    },
                    {
                        "name": "LoadMenuW",
                        "address": "0x515560"
                    },
                    {
                        "name": "LoadIconW",
                        "address": "0x515564"
                    },
                    {
                        "name": "LoadCursorW",
                        "address": "0x515568"
                    },
                    {
                        "name": "LoadBitmapW",
                        "address": "0x51556c"
                    },
                    {
                        "name": "IsWindowVisible",
                        "address": "0x515570"
                    },
                    {
                        "name": "IsWindowEnabled",
                        "address": "0x515574"
                    },
                    {
                        "name": "IsWindow",
                        "address": "0x515578"
                    },
                    {
                        "name": "IsIconic",
                        "address": "0x51557c"
                    },
                    {
                        "name": "GrayStringW",
                        "address": "0x515580"
                    },
                    {
                        "name": "GetWindowThreadProcessId",
                        "address": "0x515584"
                    },
                    {
                        "name": "GetWindowTextW",
                        "address": "0x515588"
                    },
                    {
                        "name": "GetWindowRect",
                        "address": "0x51558c"
                    },
                    {
                        "name": "GetWindowPlacement",
                        "address": "0x515590"
                    },
                    {
                        "name": "GetWindowLongW",
                        "address": "0x515594"
                    },
                    {
                        "name": "GetWindow",
                        "address": "0x515598"
                    },
                    {
                        "name": "GetTopWindow",
                        "address": "0x51559c"
                    },
                    {
                        "name": "GetSystemMetrics",
                        "address": "0x5155a0"
                    },
                    {
                        "name": "GetSysColor",
                        "address": "0x5155a4"
                    },
                    {
                        "name": "GetSubMenu",
                        "address": "0x5155a8"
                    },
                    {
                        "name": "GetScrollPos",
                        "address": "0x5155ac"
                    },
                    {
                        "name": "GetPropW",
                        "address": "0x5155b0"
                    },
                    {
                        "name": "GetParent",
                        "address": "0x5155b4"
                    },
                    {
                        "name": "GetMessageW",
                        "address": "0x5155b8"
                    },
                    {
                        "name": "GetMessageTime",
                        "address": "0x5155bc"
                    },
                    {
                        "name": "GetMessagePos",
                        "address": "0x5155c0"
                    },
                    {
                        "name": "GetMessageExtraInfo",
                        "address": "0x5155c4"
                    },
                    {
                        "name": "GetMenuState",
                        "address": "0x5155c8"
                    },
                    {
                        "name": "GetMenuItemID",
                        "address": "0x5155cc"
                    },
                    {
                        "name": "GetMenuItemCount",
                        "address": "0x5155d0"
                    },
                    {
                        "name": "GetMenuCheckMarkDimensions",
                        "address": "0x5155d4"
                    },
                    {
                        "name": "GetMenu",
                        "address": "0x5155d8"
                    },
                    {
                        "name": "GetLastActivePopup",
                        "address": "0x5155dc"
                    },
                    {
                        "name": "GetKeyState",
                        "address": "0x5155e0"
                    },
                    {
                        "name": "GetForegroundWindow",
                        "address": "0x5155e4"
                    },
                    {
                        "name": "GetFocus",
                        "address": "0x5155e8"
                    },
                    {
                        "name": "GetDlgItem",
                        "address": "0x5155ec"
                    },
                    {
                        "name": "GetDlgCtrlID",
                        "address": "0x5155f0"
                    },
                    {
                        "name": "GetDC",
                        "address": "0x5155f4"
                    },
                    {
                        "name": "GetCursorPos",
                        "address": "0x5155f8"
                    },
                    {
                        "name": "GetClientRect",
                        "address": "0x5155fc"
                    },
                    {
                        "name": "GetClassNameW",
                        "address": "0x515600"
                    },
                    {
                        "name": "GetClassLongW",
                        "address": "0x515604"
                    },
                    {
                        "name": "GetClassInfoW",
                        "address": "0x515608"
                    },
                    {
                        "name": "GetClassInfoExW",
                        "address": "0x51560c"
                    },
                    {
                        "name": "GetCapture",
                        "address": "0x515610"
                    },
                    {
                        "name": "GetActiveWindow",
                        "address": "0x515614"
                    },
                    {
                        "name": "EnableWindow",
                        "address": "0x515618"
                    },
                    {
                        "name": "EnableMenuItem",
                        "address": "0x51561c"
                    },
                    {
                        "name": "EmptyClipboard",
                        "address": "0x515620"
                    },
                    {
                        "name": "DrawTextW",
                        "address": "0x515624"
                    },
                    {
                        "name": "DrawTextExW",
                        "address": "0x515628"
                    },
                    {
                        "name": "DispatchMessageW",
                        "address": "0x51562c"
                    },
                    {
                        "name": "DestroyWindow",
                        "address": "0x515630"
                    },
                    {
                        "name": "DestroyMenu",
                        "address": "0x515634"
                    },
                    {
                        "name": "DefWindowProcW",
                        "address": "0x515638"
                    },
                    {
                        "name": "DefWindowProcA",
                        "address": "0x51563c"
                    },
                    {
                        "name": "DdeQueryConvInfo",
                        "address": "0x515640"
                    },
                    {
                        "name": "CreateWindowExW",
                        "address": "0x515644"
                    },
                    {
                        "name": "CreateDialogParamW",
                        "address": "0x515648"
                    },
                    {
                        "name": "CopyRect",
                        "address": "0x51564c"
                    },
                    {
                        "name": "ClientToScreen",
                        "address": "0x515650"
                    },
                    {
                        "name": "CheckMenuItem",
                        "address": "0x515654"
                    },
                    {
                        "name": "CharToOemW",
                        "address": "0x515658"
                    },
                    {
                        "name": "CharLowerA",
                        "address": "0x51565c"
                    },
                    {
                        "name": "CallWindowProcW",
                        "address": "0x515660"
                    },
                    {
                        "name": "CallNextHookEx",
                        "address": "0x515664"
                    },
                    {
                        "name": "AdjustWindowRectEx",
                        "address": "0x515668"
                    },
                    {
                        "name": "GetSysColorBrush",
                        "address": "0x51566c"
                    }
                ],
                "dll": "USER32.dll"
            },
            {
                "imports": [
                    {
                        "name": "GetObjectType",
                        "address": "0x515038"
                    },
                    {
                        "name": "GetColorSpace",
                        "address": "0x51503c"
                    },
                    {
                        "name": "AddFontResourceW",
                        "address": "0x515040"
                    },
                    {
                        "name": "GetPolyFillMode",
                        "address": "0x515044"
                    },
                    {
                        "name": "GetGraphicsMode",
                        "address": "0x515048"
                    },
                    {
                        "name": "AbortPath",
                        "address": "0x51504c"
                    },
                    {
                        "name": "DeleteColorSpace",
                        "address": "0x515050"
                    },
                    {
                        "name": "GetSystemPaletteUse",
                        "address": "0x515054"
                    },
                    {
                        "name": "UnrealizeObject",
                        "address": "0x515058"
                    },
                    {
                        "name": "StartDocW",
                        "address": "0x51505c"
                    },
                    {
                        "name": "GetDCPenColor",
                        "address": "0x515060"
                    },
                    {
                        "name": "UpdateColors",
                        "address": "0x515064"
                    },
                    {
                        "name": "CreatePatternBrush",
                        "address": "0x515068"
                    },
                    {
                        "name": "StrokePath",
                        "address": "0x51506c"
                    },
                    {
                        "name": "CreateHalftonePalette",
                        "address": "0x515070"
                    },
                    {
                        "name": "GdiFlush",
                        "address": "0x515074"
                    },
                    {
                        "name": "GetBkColor",
                        "address": "0x515078"
                    },
                    {
                        "name": "GetLayout",
                        "address": "0x51507c"
                    },
                    {
                        "name": "AbortDoc",
                        "address": "0x515080"
                    },
                    {
                        "name": "GdiGetBatchLimit",
                        "address": "0x515084"
                    },
                    {
                        "name": "FlattenPath",
                        "address": "0x515088"
                    },
                    {
                        "name": "CreateSolidBrush",
                        "address": "0x51508c"
                    },
                    {
                        "name": "SwapBuffers",
                        "address": "0x515090"
                    },
                    {
                        "name": "GetTextCharset",
                        "address": "0x515094"
                    },
                    {
                        "name": "XLATEOBJ_cGetPalette",
                        "address": "0x515098"
                    },
                    {
                        "name": "XFORMOBJ_iGetXform",
                        "address": "0x51509c"
                    },
                    {
                        "name": "CreateCompatibleDC",
                        "address": "0x5150a0"
                    },
                    {
                        "name": "CopyMetaFileW",
                        "address": "0x5150a4"
                    },
                    {
                        "name": "SetWindowExtEx",
                        "address": "0x5150a8"
                    },
                    {
                        "name": "SetViewportOrgEx",
                        "address": "0x5150ac"
                    },
                    {
                        "name": "SetViewportExtEx",
                        "address": "0x5150b0"
                    },
                    {
                        "name": "SetTextColor",
                        "address": "0x5150b4"
                    },
                    {
                        "name": "SetMapMode",
                        "address": "0x5150b8"
                    },
                    {
                        "name": "SetBkColor",
                        "address": "0x5150bc"
                    },
                    {
                        "name": "SelectObject",
                        "address": "0x5150c0"
                    },
                    {
                        "name": "ScaleWindowExtEx",
                        "address": "0x5150c4"
                    },
                    {
                        "name": "ScaleViewportExtEx",
                        "address": "0x5150c8"
                    },
                    {
                        "name": "SaveDC",
                        "address": "0x5150cc"
                    },
                    {
                        "name": "RestoreDC",
                        "address": "0x5150d0"
                    },
                    {
                        "name": "RectVisible",
                        "address": "0x5150d4"
                    },
                    {
                        "name": "PtVisible",
                        "address": "0x5150d8"
                    },
                    {
                        "name": "OffsetViewportOrgEx",
                        "address": "0x5150dc"
                    },
                    {
                        "name": "GetTextColor",
                        "address": "0x5150e0"
                    },
                    {
                        "name": "GetStockObject",
                        "address": "0x5150e4"
                    },
                    {
                        "name": "GetICMProfileW",
                        "address": "0x5150e8"
                    },
                    {
                        "name": "GetDeviceCaps",
                        "address": "0x5150ec"
                    },
                    {
                        "name": "GetClipBox",
                        "address": "0x5150f0"
                    },
                    {
                        "name": "GetCharABCWidthsA",
                        "address": "0x5150f4"
                    },
                    {
                        "name": "GdiStartDocEMF",
                        "address": "0x5150f8"
                    },
                    {
                        "name": "GdiDllInitialize",
                        "address": "0x5150fc"
                    },
                    {
                        "name": "ExtTextOutW",
                        "address": "0x515100"
                    },
                    {
                        "name": "Escape",
                        "address": "0x515104"
                    },
                    {
                        "name": "EngReleaseSemaphore",
                        "address": "0x515108"
                    },
                    {
                        "name": "EngQueryLocalTime",
                        "address": "0x51510c"
                    },
                    {
                        "name": "EngLoadModule",
                        "address": "0x515110"
                    },
                    {
                        "name": "DeleteObject",
                        "address": "0x515114"
                    },
                    {
                        "name": "DeleteDC",
                        "address": "0x515118"
                    },
                    {
                        "name": "DPtoLP",
                        "address": "0x51511c"
                    },
                    {
                        "name": "CreateBitmap",
                        "address": "0x515120"
                    },
                    {
                        "name": "TextOutW",
                        "address": "0x515124"
                    }
                ],
                "dll": "GDI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "RegSetValueExA",
                        "address": "0x515000"
                    },
                    {
                        "name": "RegQueryValueW",
                        "address": "0x515004"
                    },
                    {
                        "name": "RegQueryValueExW",
                        "address": "0x515008"
                    },
                    {
                        "name": "RegQueryValueExA",
                        "address": "0x51500c"
                    },
                    {
                        "name": "RegOpenKeyW",
                        "address": "0x515010"
                    },
                    {
                        "name": "RegOpenKeyExW",
                        "address": "0x515014"
                    },
                    {
                        "name": "RegOpenKeyExA",
                        "address": "0x515018"
                    },
                    {
                        "name": "RegEnumKeyW",
                        "address": "0x51501c"
                    },
                    {
                        "name": "RegDeleteKeyW",
                        "address": "0x515020"
                    },
                    {
                        "name": "RegCreateKeyExW",
                        "address": "0x515024"
                    },
                    {
                        "name": "RegCreateKeyExA",
                        "address": "0x515028"
                    },
                    {
                        "name": "RegCloseKey",
                        "address": "0x51502c"
                    },
                    {
                        "name": "RegSetValueExW",
                        "address": "0x515030"
                    }
                ],
                "dll": "ADVAPI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "ShellExecuteEx",
                        "address": "0x51539c"
                    },
                    {
                        "name": "ShellExecuteA",
                        "address": "0x5153a0"
                    },
                    {
                        "name": "SHLoadNonloadedIconOverlayIdentifiers",
                        "address": "0x5153a4"
                    },
                    {
                        "name": "SHIsFileAvailableOffline",
                        "address": "0x5153a8"
                    },
                    {
                        "name": "SHInvokePrinterCommandW",
                        "address": "0x5153ac"
                    },
                    {
                        "name": "SHInvokePrinterCommandA",
                        "address": "0x5153b0"
                    },
                    {
                        "name": "SHGetSpecialFolderPathW",
                        "address": "0x5153b4"
                    },
                    {
                        "name": "SHGetSpecialFolderPathA",
                        "address": "0x5153b8"
                    },
                    {
                        "name": "SHGetDesktopFolder",
                        "address": "0x5153bc"
                    },
                    {
                        "name": "SHGetDataFromIDListA",
                        "address": "0x5153c0"
                    },
                    {
                        "name": "SHFormatDrive",
                        "address": "0x5153c4"
                    },
                    {
                        "name": "SHFileOperationA",
                        "address": "0x5153c8"
                    },
                    {
                        "name": "SHFileOperation",
                        "address": "0x5153cc"
                    },
                    {
                        "name": "SHEmptyRecycleBinA",
                        "address": "0x5153d0"
                    },
                    {
                        "name": "SHCreateDirectoryExA",
                        "address": "0x5153d4"
                    },
                    {
                        "name": "SHBrowseForFolderA",
                        "address": "0x5153d8"
                    },
                    {
                        "name": "SHBindToParent",
                        "address": "0x5153dc"
                    },
                    {
                        "name": "ExtractIconW",
                        "address": "0x5153e0"
                    },
                    {
                        "name": "DragQueryPoint",
                        "address": "0x5153e4"
                    },
                    {
                        "name": "DragQueryFileAorW",
                        "address": "0x5153e8"
                    },
                    {
                        "name": "DragQueryFileA",
                        "address": "0x5153ec"
                    },
                    {
                        "name": "DoEnvironmentSubstW",
                        "address": "0x5153f0"
                    },
                    {
                        "name": "CommandLineToArgvW",
                        "address": "0x5153f4"
                    }
                ],
                "dll": "SHELL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "PathFindFileNameW",
                        "address": "0x5153fc"
                    },
                    {
                        "name": "StrChrIW",
                        "address": "0x515400"
                    },
                    {
                        "name": "StrChrW",
                        "address": "0x515404"
                    },
                    {
                        "name": "StrCmpNIW",
                        "address": "0x515408"
                    },
                    {
                        "name": "StrRChrIA",
                        "address": "0x51540c"
                    },
                    {
                        "name": "StrRChrW",
                        "address": "0x515410"
                    },
                    {
                        "name": "PathFindExtensionW",
                        "address": "0x515414"
                    }
                ],
                "dll": "SHLWAPI.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x00132250",
        "overlay": {
            "size": "0x00000d08",
            "offset": "0x00131400"
        },
        "imagebase": "0x00400000",
        "reported_checksum": "0x0013c235",
        "icon_hash": null,
        "entrypoint": "0x00513420",
        "timestamp": "2019-02-25 14:01:54",
        "osversion": "5.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x00113200",
                "entropy": "7.12",
                "raw_address": "0x00000400",
                "virtual_size": "0x0011311c",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rdata",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00115000",
                "size_of_data": "0x00003200",
                "entropy": "5.60",
                "raw_address": "0x00113600",
                "virtual_size": "0x000030da",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x00119000",
                "size_of_data": "0x00000200",
                "entropy": "4.11",
                "raw_address": "0x00116800",
                "virtual_size": "0x00000358",
                "characteristics_raw": "0xc0000040"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x0011a000",
                "size_of_data": "0x0001aa00",
                "entropy": "6.49",
                "raw_address": "0x00116a00",
                "virtual_size": "0x000ed9e0",
                "characteristics_raw": "0x40000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00115d70",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x0000008c"
            },
            {
                "virtual_address": "0x0011a000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x0001a9e0"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00131400",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000d08"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00115000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000674"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "a61f41c9eaa90bb5e3d5a206b2275e3c",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 6,
        "versioninfo": []
    }
}

[*] Resolved APIs: [
    "kernel32.dll.VirtualAlloc",
    "kernel32.dll.LoadLibraryExA",
    "kernel32.dll.GetProcAddress",
    "kernel32.dll.SetFilePointer",
    "kernel32.dll.lstrlenA",
    "kernel32.dll.lstrcatA",
    "kernel32.dll.VirtualProtect",
    "kernel32.dll.UnmapViewOfFile",
    "kernel32.dll.GetModuleHandleA",
    "kernel32.dll.WriteFile",
    "kernel32.dll.CloseHandle",
    "kernel32.dll.VirtualFree",
    "kernel32.dll.GetTempPathA",
    "kernel32.dll.CreateFileA",
    "kernel32.dll.LoadLibraryA",
    "kernel32.dll.ExitProcess",
    "advapi32.dll.RegCloseKey",
    "oleaut32.dll.#6",
    "shell32.dll.SHGetMalloc",
    "user32.dll.CharUpperA",
    "ws2_32.dll.#1",
    "kernel32.dll.Sleep",
    "kernel32.dll.GetSystemTimeAsFileTime",
    "kernel32.dll.HeapFree",
    "kernel32.dll.HeapAlloc",
    "kernel32.dll.GetProcessHeap",
    "kernel32.dll.OpenProcess",
    "kernel32.dll.CreatePipe",
    "kernel32.dll.CreateProcessA",
    "kernel32.dll.GetExitCodeProcess",
    "kernel32.dll.SetHandleInformation",
    "kernel32.dll.PeekNamedPipe",
    "kernel32.dll.LocalFree",
    "kernel32.dll.GlobalMemoryStatusEx",
    "kernel32.dll.CreateFileMappingA",
    "kernel32.dll.InitializeCriticalSection",
    "kernel32.dll.InterlockedDecrement",
    "kernel32.dll.ReadFile",
    "kernel32.dll.CreateFileW",
    "kernel32.dll.GetLastError",
    "kernel32.dll.TerminateProcess",
    "kernel32.dll.GetCurrentProcess",
    "kernel32.dll.UnhandledExceptionFilter",
    "kernel32.dll.SetUnhandledExceptionFilter",
    "kernel32.dll.IsDebuggerPresent",
    "kernel32.dll.GetCommandLineA",
    "kernel32.dll.GetStartupInfoA",
    "kernel32.dll.RaiseException",
    "kernel32.dll.RtlUnwind",
    "kernel32.dll.GetModuleHandleW",
    "kernel32.dll.TlsGetValue",
    "kernel32.dll.TlsAlloc",
    "kernel32.dll.TlsSetValue",
    "kernel32.dll.TlsFree",
    "kernel32.dll.InterlockedIncrement",
    "kernel32.dll.SetLastError",
    "kernel32.dll.GetCurrentThreadId",
    "kernel32.dll.HeapSize",
    "kernel32.dll.GetStdHandle",
    "kernel32.dll.GetModuleFileNameA",
    "kernel32.dll.FreeEnvironmentStringsA",
    "kernel32.dll.GetEnvironmentStrings",
    "kernel32.dll.FreeEnvironmentStringsW",
    "kernel32.dll.WideCharToMultiByte",
    "kernel32.dll.GetEnvironmentStringsW",
    "kernel32.dll.SetHandleCount",
    "kernel32.dll.GetFileType",
    "kernel32.dll.DeleteCriticalSection",
    "kernel32.dll.HeapCreate",
    "kernel32.dll.QueryPerformanceCounter",
    "kernel32.dll.GetTickCount",
    "kernel32.dll.GetCurrentProcessId",
    "kernel32.dll.SetEvent",
    "kernel32.dll.GetACP",
    "kernel32.dll.DeleteFileA",
    "kernel32.dll.IsValidCodePage",
    "kernel32.dll.EnterCriticalSection",
    "kernel32.dll.LeaveCriticalSection",
    "kernel32.dll.GetConsoleCP",
    "kernel32.dll.GetConsoleMode",
    "kernel32.dll.FlushFileBuffers",
    "kernel32.dll.MultiByteToWideChar",
    "kernel32.dll.LCMapStringA",
    "kernel32.dll.LCMapStringW",
    "kernel32.dll.HeapReAlloc",
    "kernel32.dll.SetConsoleCtrlHandler",
    "kernel32.dll.FreeLibrary",
    "kernel32.dll.InitializeCriticalSectionAndSpinCount",
    "kernel32.dll.GetLocaleInfoA",
    "kernel32.dll.GetStringTypeA",
    "kernel32.dll.GetStringTypeW",
    "kernel32.dll.GetTimeFormatA",
    "kernel32.dll.GetDateFormatA",
    "kernel32.dll.SetStdHandle",
    "kernel32.dll.WriteConsoleA",
    "kernel32.dll.GetConsoleOutputCP",
    "kernel32.dll.WriteConsoleW",
    "kernel32.dll.GetTimeZoneInformation",
    "kernel32.dll.SetEndOfFile",
    "kernel32.dll.CompareStringA",
    "kernel32.dll.CompareStringW",
    "kernel32.dll.SetEnvironmentVariableA",
    "kernel32.dll.GetSystemInfo",
    "kernel32.dll.OpenEventA",
    "kernel32.dll.ResetEvent",
    "kernel32.dll.ResumeThread",
    "kernel32.dll.SystemTimeToFileTime",
    "kernel32.dll.WaitForMultipleObjects",
    "kernel32.dll.SetWaitableTimer",
    "kernel32.dll.CreateWaitableTimerA",
    "kernel32.dll.GetVersion",
    "kernel32.dll.GlobalMemoryStatus",
    "kernel32.dll.GetVersionExA",
    "kernel32.dll.FlushConsoleInputBuffer",
    "kernel32.dll.VerSetConditionMask",
    "kernel32.dll.SleepEx",
    "kernel32.dll.VerifyVersionInfoA",
    "kernel32.dll.ExpandEnvironmentStringsA",
    "kernel32.dll.FormatMessageA",
    "kernel32.dll.MapViewOfFile",
    "kernel32.dll.GetFileSize",
    "kernel32.dll.CreateIoCompletionPort",
    "kernel32.dll.PostQueuedCompletionStatus",
    "kernel32.dll.ReleaseSemaphore",
    "kernel32.dll.CreateSemaphoreA",
    "kernel32.dll.GetQueuedCompletionStatus",
    "kernel32.dll.GetFileInformationByHandle",
    "kernel32.dll.MoveFileA",
    "kernel32.dll.LockFile",
    "kernel32.dll.UnlockFile",
    "kernel32.dll.GetModuleFileNameW",
    "kernel32.dll.LoadLibraryW",
    "kernel32.dll.CreateDirectoryA",
    "kernel32.dll.GetOEMCP",
    "kernel32.dll.WaitForSingleObject",
    "kernel32.dll.GetCPInfo",
    "kernel32.dll.CreateEventA",
    "kernel32.dll.GetSystemDirectoryA",
    "kernel32.dll.GetCurrentDirectoryA",
    "kernel32.dll.GetFullPathNameA",
    "kernel32.dll.FindFirstFileA",
    "kernel32.dll.GetDriveTypeA",
    "kernel32.dll.FileTimeToLocalFileTime",
    "kernel32.dll.FileTimeToSystemTime",
    "kernel32.dll.FindClose",
    "kernel32.dll.SetConsoleMode",
    "kernel32.dll.ReadConsoleInputA",
    "kernel32.dll.CreateThread",
    "kernel32.dll.ExitThread",
    "kernel32.dll.VirtualQuery",
    "advapi32.dll.DeregisterEventSource",
    "advapi32.dll.RegisterEventSourceA",
    "advapi32.dll.ReportEventA",
    "advapi32.dll.RegQueryValueExA",
    "advapi32.dll.RegOpenKeyExA",
    "advapi32.dll.CryptAcquireContextA",
    "advapi32.dll.CryptGenRandom",
    "oleaut32.dll.#9",
    "oleaut32.dll.#2",
    "shell32.dll.SHGetSpecialFolderLocation",
    "shell32.dll.SHGetSpecialFolderPathA",
    "shell32.dll.SHGetPathFromIDListA",
    "user32.dll.MessageBoxA",
    "user32.dll.CharLowerW",
    "user32.dll.GetUserObjectInformationW",
    "user32.dll.GetDesktopWindow",
    "user32.dll.GetProcessWindowStation",
    "user32.dll.CharUpperW",
    "ws2_32.dll.freeaddrinfo",
    "ws2_32.dll.getaddrinfo",
    "ws2_32.dll.#17",
    "ws2_32.dll.#55",
    "ws2_32.dll.#54",
    "ws2_32.dll.#13",
    "ws2_32.dll.#8",
    "ws2_32.dll.#14",
    "ws2_32.dll.#57",
    "ws2_32.dll.#52",
    "ws2_32.dll.#10",
    "ws2_32.dll.#19",
    "ws2_32.dll.#18",
    "ws2_32.dll.#151",
    "ws2_32.dll.#5",
    "ws2_32.dll.WSAIoctl",
    "ws2_32.dll.#4",
    "ws2_32.dll.#111",
    "ws2_32.dll.#9",
    "ws2_32.dll.#15",
    "ws2_32.dll.#20",
    "ws2_32.dll.#22",
    "ws2_32.dll.#6",
    "ws2_32.dll.#21",
    "ws2_32.dll.#16",
    "ws2_32.dll.#2",
    "ws2_32.dll.#23",
    "ws2_32.dll.#112",
    "ws2_32.dll.#3",
    "ws2_32.dll.#7",
    "ws2_32.dll.#115",
    "ws2_32.dll.#116",
    "kernel32.dll.FlsAlloc",
    "kernel32.dll.FlsGetValue",
    "kernel32.dll.FlsSetValue",
    "kernel32.dll.FlsFree",
    "kernel32.dll.IsProcessorFeaturePresent",
    "kernel32.dll.GetComputerNameW",
    "kernel32.dll.GetLogicalDriveStringsW",
    "kernel32.dll.GetVolumeInformationW",
    "kernel32.dll.GetDriveTypeW",
    "kernel32.dll.GetSystemDirectoryW",
    "kernel32.dll.GetWindowsDirectoryA",
    "kernel32.dll.GetWindowsDirectoryW",
    "kernel32.dll.GetTempPathW",
    "kernel32.dll.FindFirstFileW",
    "kernel32.dll.FindNextFileW",
    "kernel32.dll.SetFileAttributesW",
    "kernel32.dll.GetFileAttributesW",
    "kernel32.dll.MoveFileW",
    "kernel32.dll.CreateDirectoryW",
    "kernel32.dll.DeleteFileW",
    "kernel32.dll.CopyFileW",
    "kernel32.dll.DeviceIoControl",
    "kernel32.dll.GetShortPathNameW",
    "kernel32.dll.GetVersionExW",
    "kernel32.dll.SetErrorMode",
    "kernel32.dll.CreateProcessW",
    "kernel32.dll.Wow64DisableWow64FsRedirection",
    "kernel32.dll.Wow64RevertWow64FsRedirection",
    "advapi32.dll.RegOpenKeyExW",
    "advapi32.dll.RegQueryValueExW",
    "advapi32.dll.RegSetValueExW",
    "advapi32.dll.RegCreateKeyExW",
    "advapi32.dll.RegDeleteValueW",
    "advapi32.dll.RegEnumKeyW",
    "advapi32.dll.RegQueryInfoKeyW",
    "advapi32.dll.GetUserNameW",
    "shell32.dll.SHGetFolderPathW",
    "shell32.dll.ShellExecuteW",
    "shell32.dll.SHGetKnownFolderPath",
    "ole32.dll.CoInitializeEx",
    "ole32.dll.CoUninitialize",
    "ole32.dll.CoCreateInstance",
    "ole32.dll.CoInitializeSecurity",
    "ole32.dll.CoSetProxyBlanket",
    "ole32.dll.CoTaskMemFree",
    "oleaut32.dll.VariantClear",
    "user32.dll.GetWindowRect",
    "user32.dll.GetDC",
    "user32.dll.DrawTextW",
    "user32.dll.SystemParametersInfoW",
    "user32.dll.GetForegroundWindow",
    "gdi32.dll.CreateCompatibleDC",
    "gdi32.dll.CreateCompatibleBitmap",
    "gdi32.dll.SelectObject",
    "gdi32.dll.DeleteObject",
    "gdi32.dll.DeleteDC",
    "gdi32.dll.CreateBrushIndirect",
    "gdi32.dll.SetTextColor",
    "gdi32.dll.SetBkColor",
    "gdi32.dll.GetCurrentObject",
    "gdi32.dll.GetObjectA",
    "gdi32.dll.CreateFontIndirectA",
    "gdi32.dll.CreateDIBSection",
    "gdi32.dll.BitBlt",
    "gdi32.dll.ExtFloodFill",
    "netapi32.dll.NetServerGetInfo",
    "netapi32.dll.NetApiBufferFree",
    "netapi32.dll.NetWkstaGetInfo",
    "kernel32.dll.SetProcessDEPPolicy",
    "netapi32.dll.NetStatisticsGet",
    "advapi32.dll.CryptAcquireContextW",
    "advapi32.dll.CryptReleaseContext",
    "cryptsp.dll.CryptAcquireContextW",
    "cryptsp.dll.CryptGenRandom",
    "cryptsp.dll.CryptReleaseContext",
    "user32.dll.GetCursorInfo",
    "user32.dll.GetQueueStatus",
    "kernel32.dll.CreateToolhelp32Snapshot",
    "kernel32.dll.Heap32First",
    "kernel32.dll.Heap32Next",
    "kernel32.dll.Heap32ListFirst",
    "kernel32.dll.Heap32ListNext",
    "kernel32.dll.Process32First",
    "kernel32.dll.Process32Next",
    "kernel32.dll.Thread32First",
    "kernel32.dll.Thread32Next",
    "kernel32.dll.Module32First",
    "kernel32.dll.Module32Next",
    "cryptsp.dll.CryptAcquireContextA",
    "cryptbase.dll.SystemFunction036",
    "uxtheme.dll.ThemeInitApiHook",
    "user32.dll.IsProcessDPIAware",
    "ole32.dll.CreateBindCtx",
    "ole32.dll.CoTaskMemAlloc",
    "ole32.dll.CoGetApartmentType",
    "ole32.dll.CoRegisterInitializeSpy",
    "comctl32.dll.#236",
    "ole32.dll.CoGetMalloc",
    "comctl32.dll.#320",
    "comctl32.dll.#324",
    "comctl32.dll.#323",
    "comctl32.dll.#328",
    "comctl32.dll.#334",
    "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
    "setupapi.dll.CM_Get_Device_Interface_List_ExW",
    "comctl32.dll.#332",
    "comctl32.dll.#386",
    "advapi32.dll.InitializeSecurityDescriptor",
    "advapi32.dll.SetEntriesInAclW",
    "ntmarta.dll.GetMartaExtensionInterface",
    "advapi32.dll.SetSecurityDescriptorDacl",
    "advapi32.dll.IsTextUnicode",
    "comctl32.dll.#338",
    "comctl32.dll.#339",
    "shell32.dll.#102",
    "ole32.dll.CoRevokeInitializeSpy",
    "comctl32.dll.#388",
    "ole32.dll.NdrOleInitializeExtension",
    "ole32.dll.CoGetClassObject",
    "ole32.dll.CoGetMarshalSizeMax",
    "ole32.dll.CoMarshalInterface",
    "ole32.dll.CoUnmarshalInterface",
    "ole32.dll.StringFromIID",
    "ole32.dll.CoGetPSClsid",
    "ole32.dll.CoReleaseMarshalData",
    "ole32.dll.DcomChannelSetHResult",
    "oleaut32.dll.#500",
    "iphlpapi.dll.GetAdaptersAddresses",
    "sechost.dll.LookupAccountNameLocalW",
    "advapi32.dll.LookupAccountSidW",
    "sechost.dll.LookupAccountSidLocalW",
    "kernel32.dll.SetThreadUILanguage",
    "kernel32.dll.SortGetHandle",
    "kernel32.dll.SortCloseHandle",
    "kernel32.dll.CopyFileExW",
    "kernel32.dll.SetConsoleInputExeNameW",
    "ntdll.dll.NtQueryInformationProcess"
]

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "GlobalUnlock",
                        "address": "0x51512c"
                    },
                    {
                        "name": "Heap32ListNext",
                        "address": "0x515130"
                    },
                    {
                        "name": "HeapAlloc",
                        "address": "0x515134"
                    },
                    {
                        "name": "HeapCreate",
                        "address": "0x515138"
                    },
                    {
                        "name": "HeapFree",
                        "address": "0x51513c"
                    },
                    {
                        "name": "HeapReAlloc",
                        "address": "0x515140"
                    },
                    {
                        "name": "HeapSize",
                        "address": "0x515144"
                    },
                    {
                        "name": "HeapValidate",
                        "address": "0x515148"
                    },
                    {
                        "name": "InitializeCriticalSection",
                        "address": "0x51514c"
                    },
                    {
                        "name": "InitializeCriticalSectionAndSpinCount",
                        "address": "0x515150"
                    },
                    {
                        "name": "InterlockedDecrement",
                        "address": "0x515154"
                    },
                    {
                        "name": "InterlockedExchange",
                        "address": "0x515158"
                    },
                    {
                        "name": "InterlockedIncrement",
                        "address": "0x51515c"
                    },
                    {
                        "name": "IsDebuggerPresent",
                        "address": "0x515160"
                    },
                    {
                        "name": "IsValidCodePage",
                        "address": "0x515164"
                    },
                    {
                        "name": "LCMapStringA",
                        "address": "0x515168"
                    },
                    {
                        "name": "LCMapStringW",
                        "address": "0x51516c"
                    },
                    {
                        "name": "LeaveCriticalSection",
                        "address": "0x515170"
                    },
                    {
                        "name": "LoadLibraryA",
                        "address": "0x515174"
                    },
                    {
                        "name": "LoadLibraryW",
                        "address": "0x515178"
                    },
                    {
                        "name": "LoadResource",
                        "address": "0x51517c"
                    },
                    {
                        "name": "LocalAlloc",
                        "address": "0x515180"
                    },
                    {
                        "name": "LocalFree",
                        "address": "0x515184"
                    },
                    {
                        "name": "LocalReAlloc",
                        "address": "0x515188"
                    },
                    {
                        "name": "LocalSize",
                        "address": "0x51518c"
                    },
                    {
                        "name": "LockResource",
                        "address": "0x515190"
                    },
                    {
                        "name": "MapViewOfFile",
                        "address": "0x515194"
                    },
                    {
                        "name": "MultiByteToWideChar",
                        "address": "0x515198"
                    },
                    {
                        "name": "OpenEventW",
                        "address": "0x51519c"
                    },
                    {
                        "name": "OpenMutexW",
                        "address": "0x5151a0"
                    },
                    {
                        "name": "OpenSemaphoreA",
                        "address": "0x5151a4"
                    },
                    {
                        "name": "OpenThread",
                        "address": "0x5151a8"
                    },
                    {
                        "name": "OutputDebugStringA",
                        "address": "0x5151ac"
                    },
                    {
                        "name": "QueryPerformanceCounter",
                        "address": "0x5151b0"
                    },
                    {
                        "name": "RaiseException",
                        "address": "0x5151b4"
                    },
                    {
                        "name": "ReadConsoleW",
                        "address": "0x5151b8"
                    },
                    {
                        "name": "ReadFile",
                        "address": "0x5151bc"
                    },
                    {
                        "name": "ReleaseMutex",
                        "address": "0x5151c0"
                    },
                    {
                        "name": "ReplaceFileA",
                        "address": "0x5151c4"
                    },
                    {
                        "name": "RtlUnwind",
                        "address": "0x5151c8"
                    },
                    {
                        "name": "GlobalReAlloc",
                        "address": "0x5151cc"
                    },
                    {
                        "name": "SetConsoleCtrlHandler",
                        "address": "0x5151d0"
                    },
                    {
                        "name": "SetConsoleMode",
                        "address": "0x5151d4"
                    },
                    {
                        "name": "SetConsoleOutputCP",
                        "address": "0x5151d8"
                    },
                    {
                        "name": "SetConsoleTextAttribute",
                        "address": "0x5151dc"
                    },
                    {
                        "name": "SetErrorMode",
                        "address": "0x5151e0"
                    },
                    {
                        "name": "SetEvent",
                        "address": "0x5151e4"
                    },
                    {
                        "name": "SetFilePointer",
                        "address": "0x5151e8"
                    },
                    {
                        "name": "SetHandleCount",
                        "address": "0x5151ec"
                    },
                    {
                        "name": "SetLastError",
                        "address": "0x5151f0"
                    },
                    {
                        "name": "SetStdHandle",
                        "address": "0x5151f4"
                    },
                    {
                        "name": "SetThreadLocale",
                        "address": "0x5151f8"
                    },
                    {
                        "name": "SetUnhandledExceptionFilter",
                        "address": "0x5151fc"
                    },
                    {
                        "name": "SetVolumeMountPointW",
                        "address": "0x515200"
                    },
                    {
                        "name": "SizeofResource",
                        "address": "0x515204"
                    },
                    {
                        "name": "Sleep",
                        "address": "0x515208"
                    },
                    {
                        "name": "SystemTimeToFileTime",
                        "address": "0x51520c"
                    },
                    {
                        "name": "TerminateProcess",
                        "address": "0x515210"
                    },
                    {
                        "name": "TerminateThread",
                        "address": "0x515214"
                    },
                    {
                        "name": "TlsAlloc",
                        "address": "0x515218"
                    },
                    {
                        "name": "TlsFree",
                        "address": "0x51521c"
                    },
                    {
                        "name": "TlsGetValue",
                        "address": "0x515220"
                    },
                    {
                        "name": "TlsSetValue",
                        "address": "0x515224"
                    },
                    {
                        "name": "UnhandledExceptionFilter",
                        "address": "0x515228"
                    },
                    {
                        "name": "UnmapViewOfFile",
                        "address": "0x51522c"
                    },
                    {
                        "name": "VerLanguageNameA",
                        "address": "0x515230"
                    },
                    {
                        "name": "VirtualAlloc",
                        "address": "0x515234"
                    },
                    {
                        "name": "VirtualFree",
                        "address": "0x515238"
                    },
                    {
                        "name": "WaitForMultipleObjects",
                        "address": "0x51523c"
                    },
                    {
                        "name": "WaitForSingleObject",
                        "address": "0x515240"
                    },
                    {
                        "name": "WideCharToMultiByte",
                        "address": "0x515244"
                    },
                    {
                        "name": "WriteConsoleA",
                        "address": "0x515248"
                    },
                    {
                        "name": "WriteConsoleW",
                        "address": "0x51524c"
                    },
                    {
                        "name": "WriteFile",
                        "address": "0x515250"
                    },
                    {
                        "name": "WritePrivateProfileStringW",
                        "address": "0x515254"
                    },
                    {
                        "name": "_lwrite",
                        "address": "0x515258"
                    },
                    {
                        "name": "lstrcmpA",
                        "address": "0x51525c"
                    },
                    {
                        "name": "lstrcmpW",
                        "address": "0x515260"
                    },
                    {
                        "name": "lstrlenA",
                        "address": "0x515264"
                    },
                    {
                        "name": "lstrlenW",
                        "address": "0x515268"
                    },
                    {
                        "name": "GlobalLock",
                        "address": "0x51526c"
                    },
                    {
                        "name": "GlobalHandle",
                        "address": "0x515270"
                    },
                    {
                        "name": "GlobalFree",
                        "address": "0x515274"
                    },
                    {
                        "name": "GlobalFlags",
                        "address": "0x515278"
                    },
                    {
                        "name": "GlobalFindAtomW",
                        "address": "0x51527c"
                    },
                    {
                        "name": "GlobalDeleteAtom",
                        "address": "0x515280"
                    },
                    {
                        "name": "GlobalAlloc",
                        "address": "0x515284"
                    },
                    {
                        "name": "GlobalAddAtomW",
                        "address": "0x515288"
                    },
                    {
                        "name": "GetVersionExW",
                        "address": "0x51528c"
                    },
                    {
                        "name": "GetVersionExA",
                        "address": "0x515290"
                    },
                    {
                        "name": "GetUserDefaultUILanguage",
                        "address": "0x515294"
                    },
                    {
                        "name": "GetTickCount",
                        "address": "0x515298"
                    },
                    {
                        "name": "GetThreadPriority",
                        "address": "0x51529c"
                    },
                    {
                        "name": "GetThreadLocale",
                        "address": "0x5152a0"
                    },
                    {
                        "name": "GetSystemTimeAsFileTime",
                        "address": "0x5152a4"
                    },
                    {
                        "name": "GetSystemDefaultLCID",
                        "address": "0x5152a8"
                    },
                    {
                        "name": "GetStringTypeW",
                        "address": "0x5152ac"
                    },
                    {
                        "name": "GetStringTypeExW",
                        "address": "0x5152b0"
                    },
                    {
                        "name": "GetStringTypeA",
                        "address": "0x5152b4"
                    },
                    {
                        "name": "GetStdHandle",
                        "address": "0x5152b8"
                    },
                    {
                        "name": "GetStartupInfoW",
                        "address": "0x5152bc"
                    },
                    {
                        "name": "GetStartupInfoA",
                        "address": "0x5152c0"
                    },
                    {
                        "name": "GetShortPathNameW",
                        "address": "0x5152c4"
                    },
                    {
                        "name": "GetProcessHeaps",
                        "address": "0x5152c8"
                    },
                    {
                        "name": "GetProcessHeap",
                        "address": "0x5152cc"
                    },
                    {
                        "name": "GetProcAddress",
                        "address": "0x5152d0"
                    },
                    {
                        "name": "GetOEMCP",
                        "address": "0x5152d4"
                    },
                    {
                        "name": "GetModuleHandleW",
                        "address": "0x5152d8"
                    },
                    {
                        "name": "GetModuleHandleA",
                        "address": "0x5152dc"
                    },
                    {
                        "name": "GetModuleFileNameW",
                        "address": "0x5152e0"
                    },
                    {
                        "name": "GetModuleFileNameA",
                        "address": "0x5152e4"
                    },
                    {
                        "name": "GetLocaleInfoW",
                        "address": "0x5152e8"
                    },
                    {
                        "name": "GetLocaleInfoA",
                        "address": "0x5152ec"
                    },
                    {
                        "name": "GetLocalTime",
                        "address": "0x5152f0"
                    },
                    {
                        "name": "GetLastError",
                        "address": "0x5152f4"
                    },
                    {
                        "name": "GetFileType",
                        "address": "0x5152f8"
                    },
                    {
                        "name": "GetExitCodeThread",
                        "address": "0x5152fc"
                    },
                    {
                        "name": "GetEnvironmentStringsW",
                        "address": "0x515300"
                    },
                    {
                        "name": "GetCurrentThreadId",
                        "address": "0x515304"
                    },
                    {
                        "name": "GetCurrentThread",
                        "address": "0x515308"
                    },
                    {
                        "name": "GetCurrentProcessId",
                        "address": "0x51530c"
                    },
                    {
                        "name": "GetCurrentProcess",
                        "address": "0x515310"
                    },
                    {
                        "name": "GetConsoleScreenBufferInfo",
                        "address": "0x515314"
                    },
                    {
                        "name": "GetConsoleOutputCP",
                        "address": "0x515318"
                    },
                    {
                        "name": "GetConsoleMode",
                        "address": "0x51531c"
                    },
                    {
                        "name": "GetConsoleFontSize",
                        "address": "0x515320"
                    },
                    {
                        "name": "GetConsoleCP",
                        "address": "0x515324"
                    },
                    {
                        "name": "GetComputerNameW",
                        "address": "0x515328"
                    },
                    {
                        "name": "GetCommandLineW",
                        "address": "0x51532c"
                    },
                    {
                        "name": "GetCPInfo",
                        "address": "0x515330"
                    },
                    {
                        "name": "GetACP",
                        "address": "0x515334"
                    },
                    {
                        "name": "FreeLibrary",
                        "address": "0x515338"
                    },
                    {
                        "name": "FreeEnvironmentStringsW",
                        "address": "0x51533c"
                    },
                    {
                        "name": "FormatMessageW",
                        "address": "0x515340"
                    },
                    {
                        "name": "FlushFileBuffers",
                        "address": "0x515344"
                    },
                    {
                        "name": "FindResourceW",
                        "address": "0x515348"
                    },
                    {
                        "name": "FindNextFileW",
                        "address": "0x51534c"
                    },
                    {
                        "name": "FindFirstFileW",
                        "address": "0x515350"
                    },
                    {
                        "name": "FindClose",
                        "address": "0x515354"
                    },
                    {
                        "name": "FileTimeToLocalFileTime",
                        "address": "0x515358"
                    },
                    {
                        "name": "FileTimeToDosDateTime",
                        "address": "0x51535c"
                    },
                    {
                        "name": "ExitProcess",
                        "address": "0x515360"
                    },
                    {
                        "name": "EnumResourceLanguagesW",
                        "address": "0x515364"
                    },
                    {
                        "name": "EnterCriticalSection",
                        "address": "0x515368"
                    },
                    {
                        "name": "DeleteCriticalSection",
                        "address": "0x51536c"
                    },
                    {
                        "name": "CreateThread",
                        "address": "0x515370"
                    },
                    {
                        "name": "CreateMutexW",
                        "address": "0x515374"
                    },
                    {
                        "name": "CreateMutexA",
                        "address": "0x515378"
                    },
                    {
                        "name": "CreateFileW",
                        "address": "0x51537c"
                    },
                    {
                        "name": "CreateFileMappingW",
                        "address": "0x515380"
                    },
                    {
                        "name": "CreateFileA",
                        "address": "0x515384"
                    },
                    {
                        "name": "CreateEventW",
                        "address": "0x515388"
                    },
                    {
                        "name": "ConvertDefaultLocale",
                        "address": "0x51538c"
                    },
                    {
                        "name": "SetComputerNameExA",
                        "address": "0x515390"
                    },
                    {
                        "name": "CloseHandle",
                        "address": "0x515394"
                    }
                ],
                "dll": "KERNEL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "LoadCursorFromFileA",
                        "address": "0x51541c"
                    },
                    {
                        "name": "GetClipboardData",
                        "address": "0x515420"
                    },
                    {
                        "name": "InSendMessage",
                        "address": "0x515424"
                    },
                    {
                        "name": "IsMenu",
                        "address": "0x515428"
                    },
                    {
                        "name": "DestroyIcon",
                        "address": "0x51542c"
                    },
                    {
                        "name": "CharLowerW",
                        "address": "0x515430"
                    },
                    {
                        "name": "GetMenuContextHelpId",
                        "address": "0x515434"
                    },
                    {
                        "name": "VkKeyScanA",
                        "address": "0x515438"
                    },
                    {
                        "name": "CountClipboardFormats",
                        "address": "0x51543c"
                    },
                    {
                        "name": "IsCharAlphaA",
                        "address": "0x515440"
                    },
                    {
                        "name": "IsCharAlphaNumericA",
                        "address": "0x515444"
                    },
                    {
                        "name": "GetProcessWindowStation",
                        "address": "0x515448"
                    },
                    {
                        "name": "IsWindowUnicode",
                        "address": "0x51544c"
                    },
                    {
                        "name": "GetKeyboardLayout",
                        "address": "0x515450"
                    },
                    {
                        "name": "VkKeyScanW",
                        "address": "0x515454"
                    },
                    {
                        "name": "GetKBCodePage",
                        "address": "0x515458"
                    },
                    {
                        "name": "GetClipboardOwner",
                        "address": "0x51545c"
                    },
                    {
                        "name": "GetAsyncKeyState",
                        "address": "0x515460"
                    },
                    {
                        "name": "DestroyCursor",
                        "address": "0x515464"
                    },
                    {
                        "name": "CloseClipboard",
                        "address": "0x515468"
                    },
                    {
                        "name": "PaintDesktop",
                        "address": "0x51546c"
                    },
                    {
                        "name": "GetInputState",
                        "address": "0x515470"
                    },
                    {
                        "name": "GetCursor",
                        "address": "0x515474"
                    },
                    {
                        "name": "CharNextW",
                        "address": "0x515478"
                    },
                    {
                        "name": "CloseDesktop",
                        "address": "0x51547c"
                    },
                    {
                        "name": "ReleaseCapture",
                        "address": "0x515480"
                    },
                    {
                        "name": "EnumClipboardFormats",
                        "address": "0x515484"
                    },
                    {
                        "name": "GetWindowContextHelpId",
                        "address": "0x515488"
                    },
                    {
                        "name": "GetWindowTextLengthA",
                        "address": "0x51548c"
                    },
                    {
                        "name": "GetClipboardViewer",
                        "address": "0x515490"
                    },
                    {
                        "name": "GetThreadDesktop",
                        "address": "0x515494"
                    },
                    {
                        "name": "IsCharAlphaW",
                        "address": "0x515498"
                    },
                    {
                        "name": "AnyPopup",
                        "address": "0x51549c"
                    },
                    {
                        "name": "CharUpperW",
                        "address": "0x5154a0"
                    },
                    {
                        "name": "IsCharLowerW",
                        "address": "0x5154a4"
                    },
                    {
                        "name": "IsClipboardFormatAvailable",
                        "address": "0x5154a8"
                    },
                    {
                        "name": "GetQueueStatus",
                        "address": "0x5154ac"
                    },
                    {
                        "name": "CloseWindow",
                        "address": "0x5154b0"
                    },
                    {
                        "name": "GetDialogBaseUnits",
                        "address": "0x5154b4"
                    },
                    {
                        "name": "OemKeyScan",
                        "address": "0x5154b8"
                    },
                    {
                        "name": "CharNextA",
                        "address": "0x5154bc"
                    },
                    {
                        "name": "LoadIconA",
                        "address": "0x5154c0"
                    },
                    {
                        "name": "WindowFromDC",
                        "address": "0x5154c4"
                    },
                    {
                        "name": "WinHelpW",
                        "address": "0x5154c8"
                    },
                    {
                        "name": "ValidateRect",
                        "address": "0x5154cc"
                    },
                    {
                        "name": "UnregisterDeviceNotification",
                        "address": "0x5154d0"
                    },
                    {
                        "name": "UnregisterClassW",
                        "address": "0x5154d4"
                    },
                    {
                        "name": "UnhookWindowsHookEx",
                        "address": "0x5154d8"
                    },
                    {
                        "name": "UnhookWinEvent",
                        "address": "0x5154dc"
                    },
                    {
                        "name": "TranslateMessage",
                        "address": "0x5154e0"
                    },
                    {
                        "name": "TabbedTextOutW",
                        "address": "0x5154e4"
                    },
                    {
                        "name": "SystemParametersInfoA",
                        "address": "0x5154e8"
                    },
                    {
                        "name": "ShowWindow",
                        "address": "0x5154ec"
                    },
                    {
                        "name": "SetWindowsHookExW",
                        "address": "0x5154f0"
                    },
                    {
                        "name": "SetWindowTextW",
                        "address": "0x5154f4"
                    },
                    {
                        "name": "SetWindowPos",
                        "address": "0x5154f8"
                    },
                    {
                        "name": "SetWindowLongW",
                        "address": "0x5154fc"
                    },
                    {
                        "name": "SetPropW",
                        "address": "0x515500"
                    },
                    {
                        "name": "SetMessageQueue",
                        "address": "0x515504"
                    },
                    {
                        "name": "SetMenuItemBitmaps",
                        "address": "0x515508"
                    },
                    {
                        "name": "SetMenu",
                        "address": "0x51550c"
                    },
                    {
                        "name": "SetForegroundWindow",
                        "address": "0x515510"
                    },
                    {
                        "name": "SetCursor",
                        "address": "0x515514"
                    },
                    {
                        "name": "SendMessageW",
                        "address": "0x515518"
                    },
                    {
                        "name": "SendMessageA",
                        "address": "0x51551c"
                    },
                    {
                        "name": "RemovePropW",
                        "address": "0x515520"
                    },
                    {
                        "name": "ReleaseDC",
                        "address": "0x515524"
                    },
                    {
                        "name": "RegisterWindowMessageW",
                        "address": "0x515528"
                    },
                    {
                        "name": "RegisterClassW",
                        "address": "0x51552c"
                    },
                    {
                        "name": "PtInRect",
                        "address": "0x515530"
                    },
                    {
                        "name": "PostThreadMessageA",
                        "address": "0x515534"
                    },
                    {
                        "name": "PostQuitMessage",
                        "address": "0x515538"
                    },
                    {
                        "name": "PostMessageW",
                        "address": "0x51553c"
                    },
                    {
                        "name": "PeekMessageW",
                        "address": "0x515540"
                    },
                    {
                        "name": "NotifyWinEvent",
                        "address": "0x515544"
                    },
                    {
                        "name": "MsgWaitForMultipleObjectsEx",
                        "address": "0x515548"
                    },
                    {
                        "name": "ModifyMenuW",
                        "address": "0x51554c"
                    },
                    {
                        "name": "MessageBoxW",
                        "address": "0x515550"
                    },
                    {
                        "name": "MessageBoxA",
                        "address": "0x515554"
                    },
                    {
                        "name": "MapWindowPoints",
                        "address": "0x515558"
                    },
                    {
                        "name": "LoadStringW",
                        "address": "0x51555c"
                    },
                    {
                        "name": "LoadMenuW",
                        "address": "0x515560"
                    },
                    {
                        "name": "LoadIconW",
                        "address": "0x515564"
                    },
                    {
                        "name": "LoadCursorW",
                        "address": "0x515568"
                    },
                    {
                        "name": "LoadBitmapW",
                        "address": "0x51556c"
                    },
                    {
                        "name": "IsWindowVisible",
                        "address": "0x515570"
                    },
                    {
                        "name": "IsWindowEnabled",
                        "address": "0x515574"
                    },
                    {
                        "name": "IsWindow",
                        "address": "0x515578"
                    },
                    {
                        "name": "IsIconic",
                        "address": "0x51557c"
                    },
                    {
                        "name": "GrayStringW",
                        "address": "0x515580"
                    },
                    {
                        "name": "GetWindowThreadProcessId",
                        "address": "0x515584"
                    },
                    {
                        "name": "GetWindowTextW",
                        "address": "0x515588"
                    },
                    {
                        "name": "GetWindowRect",
                        "address": "0x51558c"
                    },
                    {
                        "name": "GetWindowPlacement",
                        "address": "0x515590"
                    },
                    {
                        "name": "GetWindowLongW",
                        "address": "0x515594"
                    },
                    {
                        "name": "GetWindow",
                        "address": "0x515598"
                    },
                    {
                        "name": "GetTopWindow",
                        "address": "0x51559c"
                    },
                    {
                        "name": "GetSystemMetrics",
                        "address": "0x5155a0"
                    },
                    {
                        "name": "GetSysColor",
                        "address": "0x5155a4"
                    },
                    {
                        "name": "GetSubMenu",
                        "address": "0x5155a8"
                    },
                    {
                        "name": "GetScrollPos",
                        "address": "0x5155ac"
                    },
                    {
                        "name": "GetPropW",
                        "address": "0x5155b0"
                    },
                    {
                        "name": "GetParent",
                        "address": "0x5155b4"
                    },
                    {
                        "name": "GetMessageW",
                        "address": "0x5155b8"
                    },
                    {
                        "name": "GetMessageTime",
                        "address": "0x5155bc"
                    },
                    {
                        "name": "GetMessagePos",
                        "address": "0x5155c0"
                    },
                    {
                        "name": "GetMessageExtraInfo",
                        "address": "0x5155c4"
                    },
                    {
                        "name": "GetMenuState",
                        "address": "0x5155c8"
                    },
                    {
                        "name": "GetMenuItemID",
                        "address": "0x5155cc"
                    },
                    {
                        "name": "GetMenuItemCount",
                        "address": "0x5155d0"
                    },
                    {
                        "name": "GetMenuCheckMarkDimensions",
                        "address": "0x5155d4"
                    },
                    {
                        "name": "GetMenu",
                        "address": "0x5155d8"
                    },
                    {
                        "name": "GetLastActivePopup",
                        "address": "0x5155dc"
                    },
                    {
                        "name": "GetKeyState",
                        "address": "0x5155e0"
                    },
                    {
                        "name": "GetForegroundWindow",
                        "address": "0x5155e4"
                    },
                    {
                        "name": "GetFocus",
                        "address": "0x5155e8"
                    },
                    {
                        "name": "GetDlgItem",
                        "address": "0x5155ec"
                    },
                    {
                        "name": "GetDlgCtrlID",
                        "address": "0x5155f0"
                    },
                    {
                        "name": "GetDC",
                        "address": "0x5155f4"
                    },
                    {
                        "name": "GetCursorPos",
                        "address": "0x5155f8"
                    },
                    {
                        "name": "GetClientRect",
                        "address": "0x5155fc"
                    },
                    {
                        "name": "GetClassNameW",
                        "address": "0x515600"
                    },
                    {
                        "name": "GetClassLongW",
                        "address": "0x515604"
                    },
                    {
                        "name": "GetClassInfoW",
                        "address": "0x515608"
                    },
                    {
                        "name": "GetClassInfoExW",
                        "address": "0x51560c"
                    },
                    {
                        "name": "GetCapture",
                        "address": "0x515610"
                    },
                    {
                        "name": "GetActiveWindow",
                        "address": "0x515614"
                    },
                    {
                        "name": "EnableWindow",
                        "address": "0x515618"
                    },
                    {
                        "name": "EnableMenuItem",
                        "address": "0x51561c"
                    },
                    {
                        "name": "EmptyClipboard",
                        "address": "0x515620"
                    },
                    {
                        "name": "DrawTextW",
                        "address": "0x515624"
                    },
                    {
                        "name": "DrawTextExW",
                        "address": "0x515628"
                    },
                    {
                        "name": "DispatchMessageW",
                        "address": "0x51562c"
                    },
                    {
                        "name": "DestroyWindow",
                        "address": "0x515630"
                    },
                    {
                        "name": "DestroyMenu",
                        "address": "0x515634"
                    },
                    {
                        "name": "DefWindowProcW",
                        "address": "0x515638"
                    },
                    {
                        "name": "DefWindowProcA",
                        "address": "0x51563c"
                    },
                    {
                        "name": "DdeQueryConvInfo",
                        "address": "0x515640"
                    },
                    {
                        "name": "CreateWindowExW",
                        "address": "0x515644"
                    },
                    {
                        "name": "CreateDialogParamW",
                        "address": "0x515648"
                    },
                    {
                        "name": "CopyRect",
                        "address": "0x51564c"
                    },
                    {
                        "name": "ClientToScreen",
                        "address": "0x515650"
                    },
                    {
                        "name": "CheckMenuItem",
                        "address": "0x515654"
                    },
                    {
                        "name": "CharToOemW",
                        "address": "0x515658"
                    },
                    {
                        "name": "CharLowerA",
                        "address": "0x51565c"
                    },
                    {
                        "name": "CallWindowProcW",
                        "address": "0x515660"
                    },
                    {
                        "name": "CallNextHookEx",
                        "address": "0x515664"
                    },
                    {
                        "name": "AdjustWindowRectEx",
                        "address": "0x515668"
                    },
                    {
                        "name": "GetSysColorBrush",
                        "address": "0x51566c"
                    }
                ],
                "dll": "USER32.dll"
            },
            {
                "imports": [
                    {
                        "name": "GetObjectType",
                        "address": "0x515038"
                    },
                    {
                        "name": "GetColorSpace",
                        "address": "0x51503c"
                    },
                    {
                        "name": "AddFontResourceW",
                        "address": "0x515040"
                    },
                    {
                        "name": "GetPolyFillMode",
                        "address": "0x515044"
                    },
                    {
                        "name": "GetGraphicsMode",
                        "address": "0x515048"
                    },
                    {
                        "name": "AbortPath",
                        "address": "0x51504c"
                    },
                    {
                        "name": "DeleteColorSpace",
                        "address": "0x515050"
                    },
                    {
                        "name": "GetSystemPaletteUse",
                        "address": "0x515054"
                    },
                    {
                        "name": "UnrealizeObject",
                        "address": "0x515058"
                    },
                    {
                        "name": "StartDocW",
                        "address": "0x51505c"
                    },
                    {
                        "name": "GetDCPenColor",
                        "address": "0x515060"
                    },
                    {
                        "name": "UpdateColors",
                        "address": "0x515064"
                    },
                    {
                        "name": "CreatePatternBrush",
                        "address": "0x515068"
                    },
                    {
                        "name": "StrokePath",
                        "address": "0x51506c"
                    },
                    {
                        "name": "CreateHalftonePalette",
                        "address": "0x515070"
                    },
                    {
                        "name": "GdiFlush",
                        "address": "0x515074"
                    },
                    {
                        "name": "GetBkColor",
                        "address": "0x515078"
                    },
                    {
                        "name": "GetLayout",
                        "address": "0x51507c"
                    },
                    {
                        "name": "AbortDoc",
                        "address": "0x515080"
                    },
                    {
                        "name": "GdiGetBatchLimit",
                        "address": "0x515084"
                    },
                    {
                        "name": "FlattenPath",
                        "address": "0x515088"
                    },
                    {
                        "name": "CreateSolidBrush",
                        "address": "0x51508c"
                    },
                    {
                        "name": "SwapBuffers",
                        "address": "0x515090"
                    },
                    {
                        "name": "GetTextCharset",
                        "address": "0x515094"
                    },
                    {
                        "name": "XLATEOBJ_cGetPalette",
                        "address": "0x515098"
                    },
                    {
                        "name": "XFORMOBJ_iGetXform",
                        "address": "0x51509c"
                    },
                    {
                        "name": "CreateCompatibleDC",
                        "address": "0x5150a0"
                    },
                    {
                        "name": "CopyMetaFileW",
                        "address": "0x5150a4"
                    },
                    {
                        "name": "SetWindowExtEx",
                        "address": "0x5150a8"
                    },
                    {
                        "name": "SetViewportOrgEx",
                        "address": "0x5150ac"
                    },
                    {
                        "name": "SetViewportExtEx",
                        "address": "0x5150b0"
                    },
                    {
                        "name": "SetTextColor",
                        "address": "0x5150b4"
                    },
                    {
                        "name": "SetMapMode",
                        "address": "0x5150b8"
                    },
                    {
                        "name": "SetBkColor",
                        "address": "0x5150bc"
                    },
                    {
                        "name": "SelectObject",
                        "address": "0x5150c0"
                    },
                    {
                        "name": "ScaleWindowExtEx",
                        "address": "0x5150c4"
                    },
                    {
                        "name": "ScaleViewportExtEx",
                        "address": "0x5150c8"
                    },
                    {
                        "name": "SaveDC",
                        "address": "0x5150cc"
                    },
                    {
                        "name": "RestoreDC",
                        "address": "0x5150d0"
                    },
                    {
                        "name": "RectVisible",
                        "address": "0x5150d4"
                    },
                    {
                        "name": "PtVisible",
                        "address": "0x5150d8"
                    },
                    {
                        "name": "OffsetViewportOrgEx",
                        "address": "0x5150dc"
                    },
                    {
                        "name": "GetTextColor",
                        "address": "0x5150e0"
                    },
                    {
                        "name": "GetStockObject",
                        "address": "0x5150e4"
                    },
                    {
                        "name": "GetICMProfileW",
                        "address": "0x5150e8"
                    },
                    {
                        "name": "GetDeviceCaps",
                        "address": "0x5150ec"
                    },
                    {
                        "name": "GetClipBox",
                        "address": "0x5150f0"
                    },
                    {
                        "name": "GetCharABCWidthsA",
                        "address": "0x5150f4"
                    },
                    {
                        "name": "GdiStartDocEMF",
                        "address": "0x5150f8"
                    },
                    {
                        "name": "GdiDllInitialize",
                        "address": "0x5150fc"
                    },
                    {
                        "name": "ExtTextOutW",
                        "address": "0x515100"
                    },
                    {
                        "name": "Escape",
                        "address": "0x515104"
                    },
                    {
                        "name": "EngReleaseSemaphore",
                        "address": "0x515108"
                    },
                    {
                        "name": "EngQueryLocalTime",
                        "address": "0x51510c"
                    },
                    {
                        "name": "EngLoadModule",
                        "address": "0x515110"
                    },
                    {
                        "name": "DeleteObject",
                        "address": "0x515114"
                    },
                    {
                        "name": "DeleteDC",
                        "address": "0x515118"
                    },
                    {
                        "name": "DPtoLP",
                        "address": "0x51511c"
                    },
                    {
                        "name": "CreateBitmap",
                        "address": "0x515120"
                    },
                    {
                        "name": "TextOutW",
                        "address": "0x515124"
                    }
                ],
                "dll": "GDI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "RegSetValueExA",
                        "address": "0x515000"
                    },
                    {
                        "name": "RegQueryValueW",
                        "address": "0x515004"
                    },
                    {
                        "name": "RegQueryValueExW",
                        "address": "0x515008"
                    },
                    {
                        "name": "RegQueryValueExA",
                        "address": "0x51500c"
                    },
                    {
                        "name": "RegOpenKeyW",
                        "address": "0x515010"
                    },
                    {
                        "name": "RegOpenKeyExW",
                        "address": "0x515014"
                    },
                    {
                        "name": "RegOpenKeyExA",
                        "address": "0x515018"
                    },
                    {
                        "name": "RegEnumKeyW",
                        "address": "0x51501c"
                    },
                    {
                        "name": "RegDeleteKeyW",
                        "address": "0x515020"
                    },
                    {
                        "name": "RegCreateKeyExW",
                        "address": "0x515024"
                    },
                    {
                        "name": "RegCreateKeyExA",
                        "address": "0x515028"
                    },
                    {
                        "name": "RegCloseKey",
                        "address": "0x51502c"
                    },
                    {
                        "name": "RegSetValueExW",
                        "address": "0x515030"
                    }
                ],
                "dll": "ADVAPI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "ShellExecuteEx",
                        "address": "0x51539c"
                    },
                    {
                        "name": "ShellExecuteA",
                        "address": "0x5153a0"
                    },
                    {
                        "name": "SHLoadNonloadedIconOverlayIdentifiers",
                        "address": "0x5153a4"
                    },
                    {
                        "name": "SHIsFileAvailableOffline",
                        "address": "0x5153a8"
                    },
                    {
                        "name": "SHInvokePrinterCommandW",
                        "address": "0x5153ac"
                    },
                    {
                        "name": "SHInvokePrinterCommandA",
                        "address": "0x5153b0"
                    },
                    {
                        "name": "SHGetSpecialFolderPathW",
                        "address": "0x5153b4"
                    },
                    {
                        "name": "SHGetSpecialFolderPathA",
                        "address": "0x5153b8"
                    },
                    {
                        "name": "SHGetDesktopFolder",
                        "address": "0x5153bc"
                    },
                    {
                        "name": "SHGetDataFromIDListA",
                        "address": "0x5153c0"
                    },
                    {
                        "name": "SHFormatDrive",
                        "address": "0x5153c4"
                    },
                    {
                        "name": "SHFileOperationA",
                        "address": "0x5153c8"
                    },
                    {
                        "name": "SHFileOperation",
                        "address": "0x5153cc"
                    },
                    {
                        "name": "SHEmptyRecycleBinA",
                        "address": "0x5153d0"
                    },
                    {
                        "name": "SHCreateDirectoryExA",
                        "address": "0x5153d4"
                    },
                    {
                        "name": "SHBrowseForFolderA",
                        "address": "0x5153d8"
                    },
                    {
                        "name": "SHBindToParent",
                        "address": "0x5153dc"
                    },
                    {
                        "name": "ExtractIconW",
                        "address": "0x5153e0"
                    },
                    {
                        "name": "DragQueryPoint",
                        "address": "0x5153e4"
                    },
                    {
                        "name": "DragQueryFileAorW",
                        "address": "0x5153e8"
                    },
                    {
                        "name": "DragQueryFileA",
                        "address": "0x5153ec"
                    },
                    {
                        "name": "DoEnvironmentSubstW",
                        "address": "0x5153f0"
                    },
                    {
                        "name": "CommandLineToArgvW",
                        "address": "0x5153f4"
                    }
                ],
                "dll": "SHELL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "PathFindFileNameW",
                        "address": "0x5153fc"
                    },
                    {
                        "name": "StrChrIW",
                        "address": "0x515400"
                    },
                    {
                        "name": "StrChrW",
                        "address": "0x515404"
                    },
                    {
                        "name": "StrCmpNIW",
                        "address": "0x515408"
                    },
                    {
                        "name": "StrRChrIA",
                        "address": "0x51540c"
                    },
                    {
                        "name": "StrRChrW",
                        "address": "0x515410"
                    },
                    {
                        "name": "PathFindExtensionW",
                        "address": "0x515414"
                    }
                ],
                "dll": "SHLWAPI.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x00132250",
        "overlay": {
            "size": "0x00000d08",
            "offset": "0x00131400"
        },
        "imagebase": "0x00400000",
        "reported_checksum": "0x0013c235",
        "icon_hash": null,
        "entrypoint": "0x00513420",
        "timestamp": "2019-02-25 14:01:54",
        "osversion": "5.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x00113200",
                "entropy": "7.12",
                "raw_address": "0x00000400",
                "virtual_size": "0x0011311c",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rdata",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00115000",
                "size_of_data": "0x00003200",
                "entropy": "5.60",
                "raw_address": "0x00113600",
                "virtual_size": "0x000030da",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x00119000",
                "size_of_data": "0x00000200",
                "entropy": "4.11",
                "raw_address": "0x00116800",
                "virtual_size": "0x00000358",
                "characteristics_raw": "0xc0000040"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x0011a000",
                "size_of_data": "0x0001aa00",
                "entropy": "6.49",
                "raw_address": "0x00116a00",
                "virtual_size": "0x000ed9e0",
                "characteristics_raw": "0x40000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00115d70",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x0000008c"
            },
            {
                "virtual_address": "0x0011a000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x0001a9e0"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00131400",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000d08"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00115000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000674"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "a61f41c9eaa90bb5e3d5a206b2275e3c",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 6,
        "versioninfo": []
    }
}