Exes_22103bb79d040cd4abf2b57887cca46f_exe.json

[*] MalFamily: ""

[*] MalScore: 10.0

[*] File Name: "Exes_22103bb79d040cd4abf2b57887cca46f.exe"
[*] File Size: 366080
[*] File Type: "MS-DOS executable"
[*] SHA256: "c98d3a3a2d6e9c9a3f34bca8f6129304d2d54ad21a4d43cce92d4f7fc4dc5b44"
[*] MD5: "22103bb79d040cd4abf2b57887cca46f"
[*] SHA1: "2c201fac76fd221f41c046c893bd2d8f0fba6b1f"
[*] SHA512: "eb09cd4a1c01fefc4ee94b7c58b01eb5689867698ddd81aa54fb5f659a10af2453e0371572f4b17d1b42f73f99ea74fb0cfe9c41d33c6f0ca6b76c933c1c2cd2"
[*] CRC32: "5C32F5B5"
[*] SSDEEP: "6144:cyr1dTjHSzjkA/LHennszCZqBCU2Xzd9g8tClsqNaX4uF4GQDZ+ZJa3I:XrvTjHwPLHkwMhC8tQNHnDoZJa"

[*] Process Execution: [
    "Exes_22103bb79d040cd4abf2b57887cca46f.exe",
    "wscript.exe",
    "wscript.exe",
    "services.exe",
    "svchost.exe",
    "WmiPrvSE.exe",
    "svchost.exe",
    "WMIADAP.exe",
    "msiexec.exe",
    "GoogleUpdate.exe",
    "svchost.exe",
    "taskhost.exe"
]

[*] Signatures Detected: [
    {
        "Description": "Attempts to connect to a dead IP:Port (2 unique times)",
        "Details": [
            {
                "IP": "172.217.164.195:443"
            },
            {
                "IP": "114.113.151.154:9731"
            }
        ]
    },
    {
        "Description": "Creates RWX memory",
        "Details": []
    },
    {
        "Description": "Detected script timer window indicative of sleep style evasion",
        "Details": [
            {
                "Window": "WSH-Timer"
            }
        ]
    },
    {
        "Description": "A process attempted to delay the analysis task.",
        "Details": [
            {
                "Process": "wscript.exe tried to sleep 900 seconds, actually delayed analysis time by 0 seconds"
            },
            {
                "Process": "WmiPrvSE.exe tried to sleep 301 seconds, actually delayed analysis time by 0 seconds"
            }
        ]
    },
    {
        "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
        "Details": [
            {
                "ioc": "http://crl.globalsign.net/root-r2.crl0"
            }
        ]
    },
    {
        "Description": "Expresses interest in specific running processes",
        "Details": [
            {
                "process": "cmd.exe"
            }
        ]
    },
    {
        "Description": "Reads data out of its own binary image",
        "Details": [
            {
                "self_read": "process: wscript.exe, pid: 1120, offset: 0x00000000, length: 0x00000040"
            },
            {
                "self_read": "process: wscript.exe, pid: 1120, offset: 0x000000f0, length: 0x00000018"
            },
            {
                "self_read": "process: wscript.exe, pid: 1120, offset: 0x000001e8, length: 0x00000078"
            },
            {
                "self_read": "process: wscript.exe, pid: 1120, offset: 0x00018000, length: 0x00000020"
            },
            {
                "self_read": "process: wscript.exe, pid: 1120, offset: 0x00018058, length: 0x00000018"
            },
            {
                "self_read": "process: wscript.exe, pid: 1120, offset: 0x000181a8, length: 0x00000018"
            },
            {
                "self_read": "process: wscript.exe, pid: 1120, offset: 0x00018470, length: 0x00000010"
            },
            {
                "self_read": "process: wscript.exe, pid: 1120, offset: 0x00018640, length: 0x00000012"
            },
            {
                "self_read": "process: wscript.exe, pid: 2616, offset: 0x00000000, length: 0x00000040"
            },
            {
                "self_read": "process: wscript.exe, pid: 2616, offset: 0x000000f0, length: 0x00000018"
            },
            {
                "self_read": "process: wscript.exe, pid: 2616, offset: 0x000001e8, length: 0x00000078"
            },
            {
                "self_read": "process: wscript.exe, pid: 2616, offset: 0x00018000, length: 0x00000020"
            },
            {
                "self_read": "process: wscript.exe, pid: 2616, offset: 0x00018058, length: 0x00000018"
            },
            {
                "self_read": "process: wscript.exe, pid: 2616, offset: 0x000181a8, length: 0x00000018"
            },
            {
                "self_read": "process: wscript.exe, pid: 2616, offset: 0x00018470, length: 0x00000010"
            },
            {
                "self_read": "process: wscript.exe, pid: 2616, offset: 0x00018640, length: 0x00000012"
            }
        ]
    },
    {
        "Description": "Performs some HTTP requests",
        "Details": [
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
            },
            {
                "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
            },
            {
                "url": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D"
            },
            {
                "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D"
            },
            {
                "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D"
            },
            {
                "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D"
            },
            {
                "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D"
            },
            {
                "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D"
            },
            {
                "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
            },
            {
                "url": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D"
            },
            {
                "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
            },
            {
                "url": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D"
            },
            {
                "url": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D"
            }
        ]
    },
    {
        "Description": "Unconventionial language used in binary resources: Chinese (Simplified)",
        "Details": []
    },
    {
        "Description": "The binary likely contains encrypted or compressed data.",
        "Details": [
            {
                "section": "name: .MPRESS1, entropy: 8.00, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00053800, virtual_size: 0x00129000"
            }
        ]
    },
    {
        "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
        "Details": [
            {
                "Spam": "services.exe (504) called API GetSystemTimeAsFileTime 4423053 times"
            }
        ]
    },
    {
        "Description": "Installs itself for autorun at Windows startup",
        "Details": [
            {
                "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\ADSL Dial"
            },
            {
                "data": "C:\\Users\\user\\AppData\\Local\\Temp\\\\Exes_22103bb79d040cd4abf2b57887cca46f.exe"
            }
        ]
    },
    {
        "Description": "Creates a hidden or system file",
        "Details": [
            {
                "file": "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_22103bb79d040cd4abf2b57887cca46f.exe"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\Temp\\VBS.vbs"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\Temp\\AutoRunApp.vbs"
            }
        ]
    },
    {
        "Description": "File has been identified by 38 Antiviruses on VirusTotal as malicious",
        "Details": [
            {
                "MicroWorld-eScan": "Application.Agent.HEB"
            },
            {
                "FireEye": "Generic.mg.22103bb79d040cd4"
            },
            {
                "CAT-QuickHeal": "Trojan.Generic.8500"
            },
            {
                "Qihoo-360": "Win32/Trojan.1bb"
            },
            {
                "BitDefender": "Application.Agent.HEB"
            },
            {
                "Invincea": "heuristic"
            },
            {
                "F-Prot": "W32/S-407d1434!Eldorado"
            },
            {
                "Symantec": "ML.Attribute.HighConfidence"
            },
            {
                "APEX": "Malicious"
            },
            {
                "Avast": "Win32:Malware-gen"
            },
            {
                "Kaspersky": "not-a-virus:HEUR:RiskTool.Win32.BitMiner.gen"
            },
            {
                "AegisLab": "Trojan.Win32.Agent.li0G"
            },
            {
                "Rising": "Trojan.Generic!8.C3 (RDM+:cmRtazqA/lR30icgCtDRwEST7Q1f)"
            },
            {
                "Ad-Aware": "Application.Agent.HEB"
            },
            {
                "DrWeb": "Trojan.DownLoader28.52804"
            },
            {
                "TrendMicro": "Coinminer.Win32.MALXMR.SMBM5"
            },
            {
                "Trapmine": "malicious.high.ml.score"
            },
            {
                "CMC": "Virus.Win32.Sality!O"
            },
            {
                "Emsisoft": "Application.Agent.HEB (B)"
            },
            {
                "Cyren": "W32/S-407d1434!Eldorado"
            },
            {
                "Avira": "TR/AD.CoinMiner.gfq"
            },
            {
                "Fortinet": "W32/CoinMiner.BUF!tr"
            },
            {
                "Arcabit": "Application.Agent.HEB"
            },
            {
                "AhnLab-V3": "Malware/Win32.RL_Coinminer.R275703"
            },
            {
                "ZoneAlarm": "not-a-virus:HEUR:RiskTool.Win32.BitMiner.gen"
            },
            {
                "Microsoft": "Trojan:Win32/CoinMiner.RD!bit"
            },
            {
                "ESET-NOD32": "a variant of Win32/Packed.FlyStudio.AA potentially unwanted"
            },
            {
                "Acronis": "suspicious"
            },
            {
                "MAX": "malware (ai score=70)"
            },
            {
                "VBA32": "BScope.Trojan.CMY3U"
            },
            {
                "Cylance": "Unsafe"
            },
            {
                "TrendMicro-HouseCall": "Coinminer.Win32.MALXMR.SMBM5"
            },
            {
                "SentinelOne": "DFI - Malicious PE"
            },
            {
                "GData": "Application.Agent.HEB"
            },
            {
                "AVG": "Win32:Malware-gen"
            },
            {
                "Cybereason": "malicious.c76fd2"
            },
            {
                "Paloalto": "generic.ml"
            },
            {
                "CrowdStrike": "win/malicious_confidence_70% (D)"
            }
        ]
    },
    {
        "Description": "Checks the CPU name from registry, possibly for anti-virtualization",
        "Details": []
    },
    {
        "Description": "Creates a copy of itself",
        "Details": [
            {
                "copy": "C:\\Users\\user\\AppData\\Local\\Temp\\SQLAGENTSNK.exe"
            }
        ]
    },
    {
        "Description": "Empties the Recycle Bin, indicative of ransomware",
        "Details": []
    }
]

[*] Started Service: [
    "msiserver",
    "gupdate"
]

[*] Executed Commands: [
    "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\VBS.vbs\"",
    "C:\\Users\\user\\AppData\\Local\\Temp\\VBS.vbs ",
    "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\AutoRunApp.vbs\"",
    "C:\\Users\\user\\AppData\\Local\\Temp\\AutoRunApp.vbs ",
    "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding",
    "C:\\Windows\\system32\\msiexec.exe /V",
    "\"C:\\Program Files (x86)\\Google\\Update\\GoogleUpdate.exe\" /svc",
    "C:\\Windows\\System32\\svchost.exe -k netsvcs"
]

[*] Mutexes: [
    "Local\\ZoneAttributeCacheCounterMutex",
    "Local\\ZonesCacheCounterMutex",
    "Local\\ZonesLockedCacheCounterMutex",
    "Global\\_MSIExecute",
    "Global\\G{D19BAF17-7C87-467E-8D63-6C4B1C836373}",
    "Global\\G{6885AE8E-C070-458d-9711-37B9BEAB65F6}",
    "Global\\G{66CC0160-ABB3-4066-AE47-1CA6AD5065C8}",
    "Global\\G{0A175FBE-AEEC-4fea-855A-2AA549A88846}",
    "Global\\ADAP_WMI_ENTRY",
    "Global\\RefreshRA_Mutex",
    "Global\\RefreshRA_Mutex_Lib",
    "Global\\RefreshRA_Mutex_Flag"
]

[*] Modified Files: [
    "C:\\Users\\user\\AppData\\Local\\Temp\\SQLAGENTSNK.exe",
    "C:\\Users\\user\\AppData\\Local\\Temp\\VBS.vbs",
    "C:\\Users\\user\\AppData\\Local\\Temp\\AutoRunApp.vbs",
    "\\??\\PIPE\\samr",
    "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
    "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
    "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
    "\\??\\WMIDataDevice",
    "C:\\Windows\\sysnative\\LogFiles\\Scm\\5869f1c1-01d7-41f7-84b7-715672259fa8",
    "C:\\Windows\\Installer\\171c1c6.msi",
    "C:\\Windows\\Installer\\171c1c7.msi",
    "\\??\\PIPE\\wkssvc",
    "\\??\\pipe\\GoogleCrashServices\\S-1-5-18",
    "C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat",
    "C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat"
]

[*] Deleted Files: [
    "C:\\Users\\user\\AppData\\Local\\Temp\\AutoRunApp.vbs",
    "C:\\Users\\user\\AppData\\Local\\Temp\\VBS.vbs",
    "C:\\Users\\user\\AppData\\Local\\Temp\\SQLAGENTSAK.exe",
    "C:\\Users\\user\\AppData\\Local\\Temp\\SQLAGENTSAH.exe",
    "C:\\Users\\user\\AppData\\Local\\Temp\\SSQLAGENTSAK.exe",
    "C:\\Users\\user\\AppData\\Local\\TempSQLAGENTSCK.exe",
    "C:\\Users\\user\\AppData\\Local\\TempSQLAGENTSOK.exe",
    "C:\\Users\\user\\AppData\\Local\\TempSQLAGENTSON.exe",
    "C:\\Users\\user\\AppData\\Local\\TempSQLAGENTSOM.exe",
    "C:\\Users\\user\\AppData\\Local\\TempSQLAGENTSIN.exe",
    "C:\\Users\\user\\AppData\\Local\\TempSQLAGENTSIM.exe",
    "C:\\Users\\user\\AppData\\Local\\TempSQLAGENTSIO.exe",
    "C:\\Users\\user\\AppData\\Local\\TempSQLAGENTSCN.exe",
    "C:\\Users\\user\\AppData\\Local\\TempSQLAGENTSCM.exe",
    "C:\\ProgramData\\SQLAGENTSCN.exe",
    "C:\\RECYCLER\\SQLAGENTSCN.exe",
    "C:\\ProgramData\\SQLAGENTSCM.exe",
    "C:\\RECYCLER\\SQLAGENTSCM.exe",
    "C:\\ProgramData\\SQLAGENTSON.exe",
    "C:\\RECYCLER\\SQLAGENTSON.exe",
    "C:\\ProgramData\\SQLAGENTSOM.exe",
    "C:\\RECYCLER\\SQLAGENTSOM.exe",
    "C:\\ProgramData\\SQLAGENTSIN.exe",
    "C:\\ProgramData\\SQLAGENTSIM.exe",
    "C:\\ProgramData\\SQLAGENTSIO.exe",
    "C:\\ProgramData\\SQLAGENTSVN.exe",
    "C:\\ProgramData\\SQLAGENTSVM.exe",
    "C:\\ProgramData\\SQLAGENTSVO.exe",
    "C:\\RECYCLER\\SQLAGENTSIN.exe",
    "C:\\RECYCLER\\SQLAGENTSIM.exe",
    "C:\\RECYCLER\\SQLAGENTSIO.exe",
    "C:\\RECYCLER\\SQLAGENTSVN.exe",
    "C:\\RECYCLER\\SQLAGENTSVM.exe",
    "C:\\RECYCLER\\SQLAGENTSVO.exe",
    "C:\\Users\\user\\AppData\\Local\\Temp\\%ProgramFiles%\\Microsoft SQL Server\\SQLIOSIMSD.exe",
    "C:\\Users\\user\\AppData\\Local\\Temp\\%ProgramFiles%\\Microsoft SQL Server\\sqlbrowsersa.exe",
    "C:\\Users\\user\\AppData\\Local\\Temp\\%ProgramFiles%\\SQLIOSIMS\\SQLIOSIMSA.exe",
    "C:\\Users\\user\\AppData\\Local\\Temp\\%ProgramFiles%\\Microsoft SQL Server\\SQLIOSIMSA.exe",
    "C:\\Program Files\\Microsoft SQL Server\\SQLIOSIMSA.exe",
    "C:\\Program Files (x86)\\Microsoft SQL Server\\sqlbrowsers.exe",
    "C:\\Program Files\\Microsoft SQL Server\\sqlbrowsers.exe",
    "C:\\Program Files (x86)\\Microsoft SQL Server\\SQLIOSIMS",
    "C:\\Program Files\\Microsoft SQL Server\\SQLIOSIMS",
    "C:\\Program Files (x86)\\Microsoft IronPyt\\IronPython.exe",
    "C:\\Program Files (x86)\\Microsoft IronPyt\\IronPython.dll",
    "C:\\Program Files (x86)\\Microsoft Rntel 2.14.2\\Rnaphin.exe",
    "C:\\Users\\user\\AppData\\Local\\Temptaskmgzr.exe",
    "C:\\ProgramData\\taskmgzr.exe",
    "C:\\RECYCLER\\taskmgzr.exe",
    "C:\\Users\\user\\AppData\\Local\\TempTrustedInsteller.exe",
    "C:\\ProgramData\\TrustedInsteller.exe",
    "C:\\Users\\user\\AppData\\Local\\TempMSSQLL.exe",
    "C:\\ProgramData\\MSSQLL.exe",
    "C:\\ProgramData\\369.exe",
    "C:\\Users\\user\\AppData\\Local\\TempTQ.exe",
    "C:\\ProgramData\\TQ.exe",
    "C:\\ProgramData\\dds.exe",
    "C:\\ProgramData\\Xmr.exe",
    "C:\\ProgramData\\ASb1.exe",
    "C:\\ProgramData\\ASb2.exe",
    "C:\\ProgramData\\o6.exe",
    "C:\\ProgramData\\1433xmr.exe",
    "C:\\ProgramData\\xiaomamssql.exe",
    "C:\\Users\\user\\AppData\\Local\\Temp\\SQLAGENTSV.vbs",
    "C:\\Users\\user\\AppData\\Local\\Temp\\SQLAGENTS.vbs",
    "C:\\Users\\user\\AppData\\Local\\Temp\\MicrosoftSQL.vbs",
    "C:\\Users\\user\\AppData\\Roaming\\AutoRunApp.vbs",
    "C:\\Users\\user\\AppData\\Roaming\\VBS.vbs",
    "C:\\Users\\user\\AppData\\Roaming\\SQLAGENTSV.vbs",
    "C:\\Users\\user\\AppData\\Roaming\\SQLAGENTS.vbs",
    "C:\\Users\\user\\AppData\\Roaming\\MicrosoftSQL.vbs",
    "C:\\ProgramData\\winsql.dat",
    "C:\\RECYCLER\\winsql.dat",
    "C:\\Users\\user\\AppData\\Local\\TempSQLAGENTSN.exe",
    "C:\\Users\\user\\AppData\\Local\\Temp\\SQLAGENTSN.exe",
    "C:\\Users\\user\\AppData\\Local\\Temp\\SQLAGENTSI.exe",
    "C:\\Users\\user\\AppData\\Local\\TempSQLAGENTSV.exe",
    "C:\\Users\\user\\AppData\\Local\\TempSQLAGENTSVS.exe",
    "C:\\Users\\user\\AppData\\Local\\TempSQLAGENTSVW.exe",
    "C:\\Users\\user\\AppData\\Local\\TempReportingServicc.exe",
    "C:\\Users\\user\\AppData\\Local\\TempReportingService.exe",
    "C:\\Users\\user\\AppData\\Local\\TempSQLAGENTB.exe",
    "C:\\Users\\user\\AppData\\Local\\TempReportingServicesa.exe",
    "C:\\Users\\user\\AppData\\Local\\Tempreportingservicesservice.exe",
    "C:\\Users\\user\\AppData\\Local\\TempDrvMgr.exe",
    "C:\\Users\\user\\AppData\\Local\\Tempexplorers.exe",
    "C:\\Users\\user\\AppData\\Local\\Tempexplores.exe",
    "C:\\Users\\user\\AppData\\Local\\Tempexplorera.exe",
    "C:\\Users\\user\\AppData\\Local\\Tempmedia.exe",
    "C:\\Users\\user\\AppData\\Local\\Tempmsmdsrv.exe",
    "C:\\Users\\user\\AppData\\Local\\TempSQLAGENTSI.exe",
    "C:\\Users\\user\\AppData\\Local\\TempSQLAGENTSIW.exe",
    "C:\\Users\\user\\AppData\\Local\\TempSQLAGENTSVM.exe",
    "C:\\Users\\user\\AppData\\Local\\TempSQLAGENTSTESA.exe",
    "C:\\Users\\user\\AppData\\Local\\Tempsysermad.exe",
    "C:\\Users\\user\\AppData\\Local\\TempXMRig.exe",
    "C:\\Users\\user\\AppData\\Local\\TempXMR.exe",
    "C:\\Users\\user\\AppData\\Local\\Temptaobao.exe",
    "C:\\Users\\user\\AppData\\Local\\Tempchrom.exe",
    "C:\\Users\\user\\AppData\\Local\\Tempchromes.exe",
    "C:\\Users\\user\\AppData\\Local\\TempMiner.exe",
    "C:\\Users\\user\\AppData\\Local\\Tempm6.exe",
    "C:\\Users\\user\\AppData\\Local\\Tempm7.exe",
    "C:\\Users\\user\\AppData\\Local\\Tempmyssssql.exe",
    "C:\\Users\\user\\AppData\\Local\\Temptaskmgr.exe",
    "C:\\Users\\user\\AppData\\Local\\Tempcpu.exe",
    "C:\\Users\\user\\AppData\\Local\\Tempx6.exe",
    "C:\\Users\\user\\AppData\\Local\\Tempwin64.exe",
    "C:\\Users\\user\\AppData\\Local\\Tempwin32.exe",
    "C:\\Users\\user\\AppData\\Local\\Tempvip.exe",
    "C:\\Users\\user\\AppData\\Local\\Tempvpn.exe",
    "C:\\Users\\user\\AppData\\Local\\Temp370.exe",
    "C:\\Users\\user\\AppData\\Local\\TempaIg.exe",
    "C:\\Users\\user\\AppData\\Local\\Temp\\SQLAGENTSV.exe",
    "C:\\Users\\user\\AppData\\Local\\Temp\\SQLAGENTS.exe",
    "C:\\Users\\user\\AppData\\Local\\Temp\\SQLAGENTSVS.exe",
    "C:\\Users\\user\\AppData\\Local\\Temp\\SQLAGENTC.exe",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CPU_log1.txt",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CPU_log.txt",
    "C:\\Users\\user\\AppData\\Local\\Temp\\SQLAGENTN.exe",
    "C:\\Users\\user\\AppData\\Local\\Temp\\N_log1.txt",
    "C:\\Users\\user\\AppData\\Local\\Temp\\N_log.txt",
    "C:\\Users\\user\\AppData\\Local\\Temp\\SQLAGENTA.exe",
    "C:\\Users\\user\\AppData\\Local\\Temp\\A_log1.txt",
    "C:\\Users\\user\\AppData\\Local\\Temp\\A_log.txt",
    "C:\\Users\\user\\AppData\\Roaming\\SQLAGENTS.exe",
    "C:\\Users\\user\\AppData\\Roaming\\SQLAGENTSV.exe",
    "C:\\Users\\user\\AppData\\Roaming\\SQLAGENTSVS.exe",
    "C:\\Users\\user\\AppData\\Roaming\\SQLAGENTC.exe",
    "C:\\Users\\user\\AppData\\Roaming\\CPU_log1.txt",
    "C:\\Users\\user\\AppData\\Roaming\\CPU_log.txt",
    "C:\\Users\\user\\AppData\\Roaming\\SQLAGENTN.exe",
    "C:\\Users\\user\\AppData\\Roaming\\N_log1.txt",
    "C:\\Users\\user\\AppData\\Roaming\\N_log.txt",
    "C:\\Users\\user\\AppData\\Roaming\\SQLAGENTA.exe",
    "C:\\Users\\user\\AppData\\Roaming\\A_log1.txt",
    "C:\\Users\\user\\AppData\\Roaming\\A_log.txt",
    "C:\\Users\\user\\AppData\\Roaming\\SQLAGENTSI.exe",
    "C:\\Users\\user\\AppData\\Local\\Temp\\SQLAGENTSA.exe",
    "C:\\Users\\user\\AppData\\Roaming\\SQLAGENTSA.exe",
    "C:\\Windows\\Installer\\171c1c6.msi",
    "C:\\Program Files (x86)\\Google\\Update\\Install\\{0E51DEF1-ED79-4FDA-92A7-D7F8B9999365}\\GoogleUpdateSetup.exe",
    "C:\\Program Files (x86)\\Google\\Update\\Install\\{0E51DEF1-ED79-4FDA-92A7-D7F8B9999365}"
]

[*] Modified Registry Keys: [
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\ADSL Dial",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2E\\52C64B7E\\LanguageList",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2E\\52C64B7E\\@C:\\Windows\\System32\\wshext.dll,-4511",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.vbs\\OpenWithProgids\\VBSFile",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
    "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\gupdate\\Type",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\BITS\\Start",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\BITS\\Type",
    "HKEY_LOCAL_MACHINE\\Software\\Google\\Update\\PersistedPings\\{72A4FE13-CD1B-4612-BBEA-653465C8EAF1}",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\PersistedPings\\{72A4FE13-CD1B-4612-BBEA-653465C8EAF1}\\PersistedPingString",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\PersistedPings\\{72A4FE13-CD1B-4612-BBEA-653465C8EAF1}\\PersistedPingTime",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\pv",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\pv",
    "HKEY_LOCAL_MACHINE\\Software\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\CurrentState",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\CurrentState\\StateValue",
    "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000_CLASSES\\Local Settings\\MuiCache\\2E\\52C64B7E\\LanguageList",
    "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000\\Software\\Google\\Update\\proxy\\source",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\RollCallDayStartSec",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\DayOfLastRollCall",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\ping_freshness",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\cohort\\(Default)",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\cohort\\hint",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\cohort\\name",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\LastCheckSuccess",
    "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000\\Software\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\dr",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\ActivePingDayStartSec",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\RollCallDayStartSec",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\DayOfLastActivity",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\DayOfLastRollCall",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\ping_freshness",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\cohort\\(Default)",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\cohort\\hint",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\cohort\\name",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\UpdateAvailableCount",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\UpdateAvailableSince",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\LastChecked",
    "HKEY_LOCAL_MACHINE\\Software\\Google\\Update\\PersistedPings\\{79CEAECB-EF39-4414-9096-C0405627D58E}",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\PersistedPings\\{79CEAECB-EF39-4414-9096-C0405627D58E}\\PersistedPingString",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\PersistedPings\\{79CEAECB-EF39-4414-9096-C0405627D58E}\\PersistedPingTime",
    "HKEY_LOCAL_MACHINE\\Software\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\CurrentState",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\CurrentState\\DownloadTimeRemainingMs",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\CurrentState\\DownloadProgressPercent",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\CurrentState\\StateValue",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\BITS\\Performance\\PerfMMFileName",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BackupRestore\\FilesNotToBackup\\BITS_LOG",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BackupRestore\\FilesNotToBackup\\BITS_BAK"
]

[*] Deleted Registry Keys: [
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\uid",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\old-uid",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\tttoken",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\UpdateAvailableCount",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\UpdateAvailableSince",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\dr",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\tttoken"
]

[*] DNS Communications: [
    {
        "type": "A",
        "request": "x.ovvvo.buzz",
        "answers": [
            {
                "data": "114.113.151.154",
                "type": "A"
            }
        ]
    }
]

[*] Domains: [
    {
        "ip": "114.113.151.154",
        "domain": "x.ovvvo.buzz"
    }
]

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: [
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 128165\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:02:13 GMT\r\nIf-None-Match: \"5c961235-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 143038\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 15:00:07 GMT\r\nIf-None-Match: \"5c9649f7-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.pki.goog",
        "version": "1.1",
        "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
        "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nCache-Control: max-age = 89056\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 18:30:24 GMT\r\nIf-None-Match: \"5c9529c0-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "crl.microsoft.com",
        "version": "1.1",
        "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
        "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Feb 2019 02:02:49 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.comodoca.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D HTTP/1.1\r\nCache-Control: max-age = 94804\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.pki.goog",
        "version": "1.1",
        "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
        "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D HTTP/1.1\r\nCache-Control: max-age = 108232\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 23:50:01 GMT\r\nIf-None-Match: \"5c9574a9-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "www.download.windowsupdate.com",
        "version": "1.1",
        "path": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
        "data": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Feb 2019 16:53:13 GMT\r\nIf-None-Match: \"80e22c19cfcad41:0\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: www.download.windowsupdate.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "crl.microsoft.com",
        "version": "1.1",
        "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
        "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D HTTP/1.1\r\nCache-Control: max-age = 93156\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 04:40:45 GMT\r\nIf-None-Match: \"5c8c7e4d-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1\r\nCache-Control: max-age = 149079\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:10:47 GMT\r\nIf-None-Match: \"5c961437-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D HTTP/1.1\r\nCache-Control: max-age = 148251\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 18:10:24 GMT\r\nIf-None-Match: \"5c8d3c10-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.pki.goog",
        "version": "1.1",
        "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
        "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.pki.goog",
        "version": "1.1",
        "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
        "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D HTTP/1.1\r\nCache-Control: max-age = 126990\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 10:41:16 GMT\r\nIf-None-Match: \"5c960d4c-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.pki.goog",
        "version": "1.1",
        "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
        "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.msocsp.com",
        "version": "1.1",
        "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
        "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.thawte.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D HTTP/1.1\r\nCache-Control: max-age = 320712\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 20 Mar 2019 11:42:01 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.thawte.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.usertrust.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "th.symcd.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D HTTP/1.1\r\nCache-Control: max-age = 386377\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 21 Mar 2019 05:58:32 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: th.symcd.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1\r\nCache-Control: max-age = 142986\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 07:40:28 GMT\r\nIf-None-Match: \"5cece5ec-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D HTTP/1.1\r\nCache-Control: max-age = 161796\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 13:00:33 GMT\r\nIf-None-Match: \"5ced30f1-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.pki.goog",
        "version": "1.1",
        "path": "/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
        "data": "GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "crl.microsoft.com",
        "version": "1.1",
        "path": "/pki/crl/products/microsoftrootcert.crl",
        "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
        "port": 80
    }
]

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "GetModuleHandleA",
                        "address": "0x52a104"
                    },
                    {
                        "name": "GetProcAddress",
                        "address": "0x52a108"
                    }
                ],
                "dll": "KERNEL32.DLL"
            },
            {
                "imports": [
                    {
                        "name": "GetDC",
                        "address": "0x52a110"
                    }
                ],
                "dll": "USER32.dll"
            },
            {
                "imports": [
                    {
                        "name": "PatBlt",
                        "address": "0x52a118"
                    }
                ],
                "dll": "GDI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "waveOutOpen",
                        "address": "0x52a120"
                    }
                ],
                "dll": "WINMM.dll"
            },
            {
                "imports": [
                    {
                        "name": "ClosePrinter",
                        "address": "0x52a128"
                    }
                ],
                "dll": "WINSPOOL.DRV"
            },
            {
                "imports": [
                    {
                        "name": "RegCloseKey",
                        "address": "0x52a130"
                    }
                ],
                "dll": "ADVAPI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "ShellExecuteA",
                        "address": "0x52a138"
                    }
                ],
                "dll": "SHELL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "OleRun",
                        "address": "0x52a140"
                    }
                ],
                "dll": "ole32.dll"
            },
            {
                "imports": [
                    {
                        "name": "VariantCopy",
                        "address": "0x52a148"
                    }
                ],
                "dll": "OLEAUT32.dll"
            },
            {
                "imports": [
                    {
                        "name": null,
                        "address": "0x52a150"
                    }
                ],
                "dll": "COMCTL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "sendto",
                        "address": "0x52a158"
                    }
                ],
                "dll": "WS2_32.dll"
            },
            {
                "imports": [
                    {
                        "name": "ChooseColorA",
                        "address": "0x52a160"
                    }
                ],
                "dll": "comdlg32.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x000642ad",
        "overlay": null,
        "imagebase": "0x00400000",
        "reported_checksum": "0x00000000",
        "icon_hash": null,
        "entrypoint": "0x0052a28a",
        "timestamp": "2019-06-12 07:09:07",
        "osversion": "4.0",
        "sections": [
            {
                "name": ".MPRESS1",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x00001000",
                "size_of_data": "0x00053800",
                "entropy": "8.00",
                "raw_address": "0x00000200",
                "virtual_size": "0x00129000",
                "characteristics_raw": "0xe00000e0"
            },
            {
                "name": ".MPRESS2",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x0012a000",
                "size_of_data": "0x00000e00",
                "entropy": "6.01",
                "raw_address": "0x00053a00",
                "virtual_size": "0x00000df4",
                "characteristics_raw": "0xe00000e0"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x0012b000",
                "size_of_data": "0x00004e00",
                "entropy": "5.58",
                "raw_address": "0x00054800",
                "virtual_size": "0x00004d00",
                "characteristics_raw": "0xc0000040"
            }
        ],
        "resources": [
            {
                "name": "TEXTINCLUDE",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00121de8",
                "size": "0x00000151"
            },
            {
                "name": "TEXTINCLUDE",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00121de8",
                "size": "0x00000151"
            },
            {
                "name": "TEXTINCLUDE",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00121de8",
                "size": "0x00000151"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_BITMAP",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00123274",
                "size": "0x00000144"
            },
            {
                "name": "RT_BITMAP",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00123274",
                "size": "0x00000144"
            },
            {
                "name": "RT_MENU",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00126e7c",
                "size": "0x00000284"
            },
            {
                "name": "RT_MENU",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00126e7c",
                "size": "0x00000284"
            },
            {
                "name": "RT_DIALOG",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x001282e8",
                "size": "0x00000034"
            },
            {
                "name": "RT_DIALOG",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x001282e8",
                "size": "0x00000034"
            },
            {
                "name": "RT_DIALOG",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x001282e8",
                "size": "0x00000034"
            },
            {
                "name": "RT_DIALOG",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x001282e8",
                "size": "0x00000034"
            },
            {
                "name": "RT_DIALOG",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x001282e8",
                "size": "0x00000034"
            },
            {
                "name": "RT_DIALOG",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x001282e8",
                "size": "0x00000034"
            },
            {
                "name": "RT_DIALOG",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x001282e8",
                "size": "0x00000034"
            },
            {
                "name": "RT_DIALOG",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x001282e8",
                "size": "0x00000034"
            },
            {
                "name": "RT_DIALOG",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x001282e8",
                "size": "0x00000034"
            },
            {
                "name": "RT_DIALOG",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x001282e8",
                "size": "0x00000034"
            },
            {
                "name": "RT_DIALOG",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x001282e8",
                "size": "0x00000034"
            },
            {
                "name": "RT_STRING",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128bd8",
                "size": "0x00000024"
            },
            {
                "name": "RT_STRING",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128bd8",
                "size": "0x00000024"
            },
            {
                "name": "RT_STRING",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128bd8",
                "size": "0x00000024"
            },
            {
                "name": "RT_STRING",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128bd8",
                "size": "0x00000024"
            },
            {
                "name": "RT_STRING",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128bd8",
                "size": "0x00000024"
            },
            {
                "name": "RT_STRING",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128bd8",
                "size": "0x00000024"
            },
            {
                "name": "RT_STRING",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128bd8",
                "size": "0x00000024"
            },
            {
                "name": "RT_STRING",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128bd8",
                "size": "0x00000024"
            },
            {
                "name": "RT_STRING",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128bd8",
                "size": "0x00000024"
            },
            {
                "name": "RT_STRING",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128bd8",
                "size": "0x00000024"
            },
            {
                "name": "RT_STRING",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128bd8",
                "size": "0x00000024"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            }
        ],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x0012a000",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x0000028c"
            },
            {
                "virtual_address": "0x0012b000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x00004d00"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x0012a104",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000060"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "aae73b7675bdc323442f02d62bb383ce",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 12,
        "versioninfo": []
    }
}

[*] Resolved APIs: [
    "kernel32.dll.VirtualProtect",
    "kernel32.dll.SetEndOfFile",
    "kernel32.dll.UnlockFile",
    "kernel32.dll.LockFile",
    "kernel32.dll.FlushFileBuffers",
    "kernel32.dll.SetFilePointer",
    "kernel32.dll.DuplicateHandle",
    "kernel32.dll.lstrcpynA",
    "kernel32.dll.SetLastError",
    "kernel32.dll.FileTimeToLocalFileTime",
    "kernel32.dll.FileTimeToSystemTime",
    "kernel32.dll.InterlockedDecrement",
    "kernel32.dll.LocalFree",
    "kernel32.dll.WideCharToMultiByte",
    "kernel32.dll.MultiByteToWideChar",
    "kernel32.dll.GetCurrentProcess",
    "kernel32.dll.SetSystemPowerState",
    "kernel32.dll.GetWindowsDirectoryA",
    "kernel32.dll.GetSystemDirectoryA",
    "kernel32.dll.TerminateThread",
    "kernel32.dll.CreateSemaphoreA",
    "kernel32.dll.ResumeThread",
    "kernel32.dll.ReleaseSemaphore",
    "kernel32.dll.EnterCriticalSection",
    "kernel32.dll.LeaveCriticalSection",
    "kernel32.dll.GetProfileStringA",
    "kernel32.dll.SetStdHandle",
    "kernel32.dll.IsBadCodePtr",
    "kernel32.dll.IsBadReadPtr",
    "kernel32.dll.CompareStringW",
    "kernel32.dll.CompareStringA",
    "kernel32.dll.SetUnhandledExceptionFilter",
    "kernel32.dll.GetStringTypeW",
    "kernel32.dll.GetStringTypeA",
    "kernel32.dll.IsBadWritePtr",
    "kernel32.dll.VirtualAlloc",
    "kernel32.dll.LCMapStringW",
    "kernel32.dll.LCMapStringA",
    "kernel32.dll.SetEnvironmentVariableA",
    "kernel32.dll.VirtualFree",
    "kernel32.dll.HeapCreate",
    "kernel32.dll.HeapDestroy",
    "kernel32.dll.GetEnvironmentVariableA",
    "kernel32.dll.GetFileType",
    "kernel32.dll.GetStdHandle",
    "kernel32.dll.SetHandleCount",
    "kernel32.dll.GetEnvironmentStringsW",
    "kernel32.dll.GetEnvironmentStrings",
    "kernel32.dll.FreeEnvironmentStringsW",
    "kernel32.dll.FreeEnvironmentStringsA",
    "kernel32.dll.UnhandledExceptionFilter",
    "kernel32.dll.GetACP",
    "kernel32.dll.HeapSize",
    "kernel32.dll.RaiseException",
    "kernel32.dll.WriteFile",
    "kernel32.dll.WaitForMultipleObjects",
    "kernel32.dll.CreateFileA",
    "kernel32.dll.SetEvent",
    "kernel32.dll.FindResourceA",
    "kernel32.dll.LoadResource",
    "kernel32.dll.LockResource",
    "kernel32.dll.ReadFile",
    "kernel32.dll.lstrlenW",
    "kernel32.dll.RemoveDirectoryA",
    "kernel32.dll.GetModuleFileNameA",
    "kernel32.dll.GetCurrentThreadId",
    "kernel32.dll.ExitProcess",
    "kernel32.dll.GlobalSize",
    "kernel32.dll.GlobalFree",
    "kernel32.dll.DeleteCriticalSection",
    "kernel32.dll.InitializeCriticalSection",
    "kernel32.dll.lstrcatA",
    "kernel32.dll.lstrlenA",
    "kernel32.dll.WinExec",
    "kernel32.dll.lstrcpyA",
    "kernel32.dll.FindNextFileA",
    "kernel32.dll.GlobalReAlloc",
    "kernel32.dll.HeapFree",
    "kernel32.dll.HeapReAlloc",
    "kernel32.dll.GetProcessHeap",
    "kernel32.dll.HeapAlloc",
    "kernel32.dll.GetUserDefaultLCID",
    "kernel32.dll.GetFullPathNameA",
    "kernel32.dll.FreeLibrary",
    "kernel32.dll.LoadLibraryA",
    "kernel32.dll.GetLastError",
    "kernel32.dll.GetVersionExA",
    "kernel32.dll.WritePrivateProfileStringA",
    "kernel32.dll.CreateThread",
    "kernel32.dll.CreateEventA",
    "kernel32.dll.Sleep",
    "kernel32.dll.ExpandEnvironmentStringsA",
    "kernel32.dll.GlobalAlloc",
    "kernel32.dll.GlobalLock",
    "kernel32.dll.GlobalUnlock",
    "kernel32.dll.GetTempPathA",
    "kernel32.dll.FindFirstFileA",
    "kernel32.dll.FindClose",
    "kernel32.dll.SetFileAttributesA",
    "kernel32.dll.GetFileAttributesA",
    "kernel32.dll.DeleteFileA",
    "kernel32.dll.GetLocalTime",
    "kernel32.dll.GetSystemTime",
    "kernel32.dll.GetTimeZoneInformation",
    "kernel32.dll.TerminateProcess",
    "kernel32.dll.RtlUnwind",
    "kernel32.dll.GetStartupInfoA",
    "kernel32.dll.GetOEMCP",
    "kernel32.dll.GetCPInfo",
    "kernel32.dll.GetProcessVersion",
    "kernel32.dll.SetErrorMode",
    "kernel32.dll.GlobalFlags",
    "kernel32.dll.GetCurrentThread",
    "kernel32.dll.GetFileTime",
    "kernel32.dll.GetFileSize",
    "kernel32.dll.TlsGetValue",
    "kernel32.dll.LocalReAlloc",
    "kernel32.dll.TlsSetValue",
    "kernel32.dll.TlsFree",
    "kernel32.dll.GlobalHandle",
    "kernel32.dll.TlsAlloc",
    "kernel32.dll.LocalAlloc",
    "kernel32.dll.lstrcmpA",
    "kernel32.dll.CopyFileA",
    "kernel32.dll.SetCurrentDirectoryA",
    "kernel32.dll.GetVolumeInformationA",
    "kernel32.dll.GetModuleHandleA",
    "kernel32.dll.GetProcAddress",
    "kernel32.dll.MulDiv",
    "kernel32.dll.GetCommandLineA",
    "kernel32.dll.GetTickCount",
    "kernel32.dll.CreateProcessA",
    "kernel32.dll.WaitForSingleObject",
    "kernel32.dll.CloseHandle",
    "kernel32.dll.lstrcmpiA",
    "kernel32.dll.GlobalDeleteAtom",
    "kernel32.dll.GlobalFindAtomA",
    "kernel32.dll.GlobalAddAtomA",
    "kernel32.dll.GetVersion",
    "kernel32.dll.GlobalGetAtomNameA",
    "kernel32.dll.InterlockedIncrement",
    "user32.dll.WaitForInputIdle",
    "user32.dll.wsprintfA",
    "user32.dll.CloseClipboard",
    "user32.dll.GetClipboardData",
    "user32.dll.OpenClipboard",
    "user32.dll.SetClipboardData",
    "user32.dll.EmptyClipboard",
    "user32.dll.GetSystemMetrics",
    "user32.dll.GetCursorPos",
    "user32.dll.MessageBoxA",
    "user32.dll.SetWindowPos",
    "user32.dll.SendMessageA",
    "user32.dll.DestroyCursor",
    "user32.dll.SetParent",
    "user32.dll.IsWindow",
    "user32.dll.PostMessageA",
    "user32.dll.GetTopWindow",
    "user32.dll.GetParent",
    "user32.dll.GetFocus",
    "user32.dll.GetClientRect",
    "user32.dll.InvalidateRect",
    "user32.dll.ValidateRect",
    "user32.dll.UpdateWindow",
    "user32.dll.EqualRect",
    "user32.dll.GetWindowRect",
    "user32.dll.SetForegroundWindow",
    "user32.dll.DestroyMenu",
    "user32.dll.IsChild",
    "user32.dll.ReleaseDC",
    "user32.dll.IsRectEmpty",
    "user32.dll.FillRect",
    "user32.dll.GetDC",
    "user32.dll.SetCursor",
    "user32.dll.LoadCursorA",
    "user32.dll.SetCursorPos",
    "user32.dll.SetActiveWindow",
    "user32.dll.GetSysColor",
    "user32.dll.SetWindowLongA",
    "user32.dll.GetWindowLongA",
    "user32.dll.RedrawWindow",
    "user32.dll.EnableWindow",
    "user32.dll.IsWindowVisible",
    "user32.dll.OffsetRect",
    "user32.dll.PtInRect",
    "user32.dll.DestroyIcon",
    "user32.dll.IntersectRect",
    "user32.dll.InflateRect",
    "user32.dll.SetRect",
    "user32.dll.SetScrollPos",
    "user32.dll.SetScrollRange",
    "user32.dll.GetScrollRange",
    "user32.dll.SetCapture",
    "user32.dll.GetCapture",
    "user32.dll.ReleaseCapture",
    "user32.dll.SetTimer",
    "user32.dll.KillTimer",
    "user32.dll.WinHelpA",
    "user32.dll.LoadBitmapA",
    "user32.dll.CopyRect",
    "user32.dll.ChildWindowFromPointEx",
    "user32.dll.ScreenToClient",
    "user32.dll.ExitWindowsEx",
    "user32.dll.GetForegroundWindow",
    "user32.dll.LoadIconA",
    "user32.dll.TranslateMessage",
    "user32.dll.DrawFrameControl",
    "user32.dll.DrawEdge",
    "user32.dll.DrawFocusRect",
    "user32.dll.WindowFromPoint",
    "user32.dll.GetMessageA",
    "user32.dll.DispatchMessageA",
    "user32.dll.SetRectEmpty",
    "user32.dll.RegisterClipboardFormatA",
    "user32.dll.CreateIconFromResourceEx",
    "user32.dll.CreateIconFromResource",
    "user32.dll.DrawIconEx",
    "user32.dll.CreatePopupMenu",
    "user32.dll.AppendMenuA",
    "user32.dll.ModifyMenuA",
    "user32.dll.CreateMenu",
    "user32.dll.CreateAcceleratorTableA",
    "user32.dll.GetDlgCtrlID",
    "user32.dll.GetSubMenu",
    "user32.dll.EnableMenuItem",
    "user32.dll.ClientToScreen",
    "user32.dll.EnumDisplaySettingsA",
    "user32.dll.LoadImageA",
    "user32.dll.SystemParametersInfoA",
    "user32.dll.ShowWindow",
    "user32.dll.IsWindowEnabled",
    "user32.dll.TranslateAcceleratorA",
    "user32.dll.GetKeyState",
    "user32.dll.CopyAcceleratorTableA",
    "user32.dll.PostQuitMessage",
    "user32.dll.IsZoomed",
    "user32.dll.GetWindowTextA",
    "user32.dll.GetWindowTextLengthA",
    "user32.dll.CharUpperA",
    "user32.dll.GetWindowDC",
    "user32.dll.BeginPaint",
    "user32.dll.EndPaint",
    "user32.dll.TabbedTextOutA",
    "user32.dll.DrawTextA",
    "user32.dll.GrayStringA",
    "user32.dll.GetDlgItem",
    "user32.dll.DestroyWindow",
    "user32.dll.CreateDialogIndirectParamA",
    "user32.dll.EndDialog",
    "user32.dll.GetNextDlgTabItem",
    "user32.dll.GetWindowPlacement",
    "user32.dll.RegisterWindowMessageA",
    "user32.dll.GetLastActivePopup",
    "user32.dll.GetMessageTime",
    "user32.dll.RemovePropA",
    "user32.dll.CallWindowProcA",
    "user32.dll.GetPropA",
    "user32.dll.UnhookWindowsHookEx",
    "user32.dll.SetPropA",
    "user32.dll.GetClassLongA",
    "user32.dll.CallNextHookEx",
    "user32.dll.SetWindowsHookExA",
    "user32.dll.CreateWindowExA",
    "user32.dll.GetMenuItemID",
    "user32.dll.GetMenuItemCount",
    "user32.dll.RegisterClassA",
    "user32.dll.GetScrollPos",
    "user32.dll.UnregisterClassA",
    "user32.dll.AdjustWindowRectEx",
    "user32.dll.MapWindowPoints",
    "user32.dll.SendDlgItemMessageA",
    "user32.dll.ScrollWindowEx",
    "user32.dll.IsDialogMessageA",
    "user32.dll.SetWindowTextA",
    "user32.dll.MoveWindow",
    "user32.dll.CheckMenuItem",
    "user32.dll.SetMenuItemBitmaps",
    "user32.dll.GetMenuState",
    "user32.dll.GetMenuCheckMarkDimensions",
    "user32.dll.GetClassNameA",
    "user32.dll.GetDesktopWindow",
    "user32.dll.LoadStringA",
    "user32.dll.GetSysColorBrush",
    "user32.dll.GetClassInfoA",
    "user32.dll.DefWindowProcA",
    "user32.dll.GetMenu",
    "user32.dll.SetMenu",
    "user32.dll.PeekMessageA",
    "user32.dll.IsIconic",
    "user32.dll.SetFocus",
    "user32.dll.GetActiveWindow",
    "user32.dll.GetWindow",
    "user32.dll.DestroyAcceleratorTable",
    "user32.dll.SetWindowRgn",
    "user32.dll.GetMessagePos",
    "gdi32.dll.CreateDIBitmap",
    "gdi32.dll.GetSystemPaletteEntries",
    "gdi32.dll.CreatePalette",
    "gdi32.dll.StretchBlt",
    "gdi32.dll.SelectPalette",
    "gdi32.dll.RealizePalette",
    "gdi32.dll.GetDIBits",
    "gdi32.dll.GetWindowExtEx",
    "gdi32.dll.GetViewportOrgEx",
    "gdi32.dll.GetWindowOrgEx",
    "gdi32.dll.BeginPath",
    "gdi32.dll.EndPath",
    "gdi32.dll.PathToRegion",
    "gdi32.dll.CreateEllipticRgn",
    "gdi32.dll.CreateRoundRectRgn",
    "gdi32.dll.GetTextColor",
    "gdi32.dll.GetBkMode",
    "gdi32.dll.GetBkColor",
    "gdi32.dll.GetROP2",
    "gdi32.dll.GetStretchBltMode",
    "gdi32.dll.GetPolyFillMode",
    "gdi32.dll.CreateCompatibleBitmap",
    "gdi32.dll.CreateDCA",
    "gdi32.dll.CreateBitmap",
    "gdi32.dll.SelectObject",
    "gdi32.dll.CreatePen",
    "gdi32.dll.PatBlt",
    "gdi32.dll.CombineRgn",
    "gdi32.dll.CreateRectRgn",
    "gdi32.dll.FillRgn",
    "gdi32.dll.CreateSolidBrush",
    "gdi32.dll.CreateFontIndirectA",
    "gdi32.dll.GetStockObject",
    "gdi32.dll.GetObjectA",
    "gdi32.dll.EndPage",
    "gdi32.dll.EndDoc",
    "gdi32.dll.DeleteDC",
    "gdi32.dll.DeleteObject",
    "gdi32.dll.StartPage",
    "gdi32.dll.BitBlt",
    "gdi32.dll.CreateCompatibleDC",
    "gdi32.dll.Ellipse",
    "gdi32.dll.Rectangle",
    "gdi32.dll.LPtoDP",
    "gdi32.dll.DPtoLP",
    "gdi32.dll.GetCurrentObject",
    "gdi32.dll.RoundRect",
    "gdi32.dll.GetTextExtentPoint32A",
    "gdi32.dll.GetDeviceCaps",
    "gdi32.dll.SaveDC",
    "gdi32.dll.RestoreDC",
    "gdi32.dll.SetBkMode",
    "gdi32.dll.SetPolyFillMode",
    "gdi32.dll.SetROP2",
    "gdi32.dll.SetTextColor",
    "gdi32.dll.SetMapMode",
    "gdi32.dll.SetViewportOrgEx",
    "gdi32.dll.OffsetViewportOrgEx",
    "gdi32.dll.SetViewportExtEx",
    "gdi32.dll.ScaleViewportExtEx",
    "gdi32.dll.SetWindowOrgEx",
    "gdi32.dll.SetWindowExtEx",
    "gdi32.dll.ScaleWindowExtEx",
    "gdi32.dll.GetClipBox",
    "gdi32.dll.ExcludeClipRect",
    "gdi32.dll.MoveToEx",
    "gdi32.dll.LineTo",
    "gdi32.dll.ExtSelectClipRgn",
    "gdi32.dll.GetViewportExtEx",
    "gdi32.dll.SelectClipRgn",
    "gdi32.dll.CreatePolygonRgn",
    "gdi32.dll.GetClipRgn",
    "gdi32.dll.SetStretchBltMode",
    "gdi32.dll.CreateRectRgnIndirect",
    "gdi32.dll.SetBkColor",
    "gdi32.dll.StartDocA",
    "gdi32.dll.GetTextMetricsA",
    "gdi32.dll.Escape",
    "gdi32.dll.ExtTextOutA",
    "gdi32.dll.TextOutA",
    "gdi32.dll.RectVisible",
    "gdi32.dll.PtVisible",
    "winmm.dll.midiStreamRestart",
    "winmm.dll.midiStreamClose",
    "winmm.dll.midiOutReset",
    "winmm.dll.midiStreamStop",
    "winmm.dll.midiStreamOut",
    "winmm.dll.midiOutPrepareHeader",
    "winmm.dll.midiStreamProperty",
    "winmm.dll.midiStreamOpen",
    "winmm.dll.midiOutUnprepareHeader",
    "winmm.dll.waveOutOpen",
    "winmm.dll.waveOutGetNumDevs",
    "winmm.dll.waveOutClose",
    "winmm.dll.waveOutReset",
    "winmm.dll.waveOutPause",
    "winmm.dll.waveOutWrite",
    "winmm.dll.waveOutPrepareHeader",
    "winmm.dll.waveOutUnprepareHeader",
    "winspool.drv.ClosePrinter",
    "winspool.drv.DocumentPropertiesA",
    "winspool.drv.OpenPrinterA",
    "advapi32.dll.RegCloseKey",
    "advapi32.dll.RegQueryValueExA",
    "advapi32.dll.OpenProcessToken",
    "advapi32.dll.LookupPrivilegeValueA",
    "advapi32.dll.AdjustTokenPrivileges",
    "advapi32.dll.RegQueryValueA",
    "advapi32.dll.RegCreateKeyA",
    "advapi32.dll.RegSetValueExA",
    "advapi32.dll.RegOpenKeyExA",
    "advapi32.dll.RegCreateKeyExA",
    "shell32.dll.ShellExecuteA",
    "shell32.dll.Shell_NotifyIconA",
    "shell32.dll.SHGetSpecialFolderPathA",
    "ole32.dll.CLSIDFromProgID",
    "ole32.dll.OleInitialize",
    "ole32.dll.OleUninitialize",
    "ole32.dll.CLSIDFromString",
    "ole32.dll.CoCreateInstance",
    "ole32.dll.OleRun",
    "oleaut32.dll.#10",
    "oleaut32.dll.#9",
    "oleaut32.dll.#12",
    "oleaut32.dll.#19",
    "oleaut32.dll.#20",
    "oleaut32.dll.#17",
    "oleaut32.dll.#24",
    "oleaut32.dll.#23",
    "oleaut32.dll.#25",
    "oleaut32.dll.#11",
    "oleaut32.dll.#8",
    "oleaut32.dll.#2",
    "oleaut32.dll.#16",
    "oleaut32.dll.#15",
    "oleaut32.dll.#26",
    "oleaut32.dll.#163",
    "oleaut32.dll.#165",
    "oleaut32.dll.#161",
    "oleaut32.dll.#186",
    "comctl32.dll.ImageList_Destroy",
    "comctl32.dll.#17",
    "ws2_32.dll.#20",
    "ws2_32.dll.#17",
    "ws2_32.dll.#10",
    "ws2_32.dll.#4",
    "ws2_32.dll.#16",
    "ws2_32.dll.#13",
    "ws2_32.dll.#5",
    "ws2_32.dll.#1",
    "ws2_32.dll.#151",
    "ws2_32.dll.#15",
    "ws2_32.dll.#6",
    "ws2_32.dll.#23",
    "ws2_32.dll.#57",
    "ws2_32.dll.#11",
    "ws2_32.dll.#8",
    "ws2_32.dll.#2",
    "ws2_32.dll.#9",
    "ws2_32.dll.#101",
    "ws2_32.dll.#3",
    "ws2_32.dll.#19",
    "ws2_32.dll.#18",
    "ws2_32.dll.#116",
    "ws2_32.dll.#115",
    "ws2_32.dll.#52",
    "ws2_32.dll.#12",
    "comdlg32.dll.GetSaveFileNameA",
    "comdlg32.dll.GetOpenFileNameA",
    "comdlg32.dll.ChooseColorA",
    "comdlg32.dll.GetFileTitleA",
    "kernel32.dll.IsProcessorFeaturePresent",
    "cryptbase.dll.SystemFunction036",
    "dwmapi.dll.DwmIsCompositionEnabled",
    "user32.dll.OpenWindowStationA",
    "user32.dll.SetProcessWindowStation",
    "kernel32.dll.VirtualQueryEx",
    "msvcrt.dll.free",
    "ws2_32.dll.#21",
    "kernel32.dll.GetQueuedCompletionStatus",
    "kernel32.dll.PostQueuedCompletionStatus",
    "kernel32.dll.GetSystemInfo",
    "kernel32.dll.CreateIoCompletionPort",
    "kernel32.dll.CreateEventW",
    "msvcrt.dll.memcpy",
    "msvcrt.dll._adjust_fdiv",
    "msvcrt.dll.malloc",
    "msvcrt.dll._initterm",
    "msvcrt.dll.memmove",
    "msvcrt.dll._beginthreadex",
    "msvcrt.dll.memset",
    "msvcrt.dll.??2@YAPAXI@Z",
    "ws2_32.dll.WSAIoctl",
    "ws2_32.dll.WSARecv",
    "ws2_32.dll.#111",
    "ws2_32.dll.WSASend",
    "ws2_32.dll.#22",
    "ws2_32.dll.WSASocketW",
    "comctl32.dll.InitCommonControls",
    "gdiplus.dll.GdiplusStartup",
    "user32.dll.GetWindowInfo",
    "user32.dll.GetAncestor",
    "user32.dll.GetMonitorInfoA",
    "user32.dll.EnumDisplayMonitors",
    "user32.dll.EnumDisplayDevicesA",
    "gdi32.dll.ExtTextOutW",
    "gdi32.dll.GdiIsMetaPrintDC",
    "kernel32.dll.OpenEventA",
    "kernel32.dll.CreateWaitableTimerA",
    "kernel32.dll.SetWaitableTimer",
    "user32.dll.MsgWaitForMultipleObjects",
    "kernel32.dll.CreateToolhelp32Snapshot",
    "kernel32.dll.Process32First",
    "kernel32.dll.Process32Next",
    "kernel32.dll.OpenProcess",
    "sxs.dll.SxsOleAut32RedirectTypeLibrary",
    "advapi32.dll.RegOpenKeyW",
    "advapi32.dll.RegEnumKeyW",
    "advapi32.dll.RegQueryValueW",
    "sxs.dll.SxsOleAut32MapConfiguredClsidToReferenceClsid",
    "oleaut32.dll.#6",
    "kernel32.dll.GetThreadPreferredUILanguages",
    "kernel32.dll.SetThreadPreferredUILanguages",
    "kernel32.dll.LocaleNameToLCID",
    "kernel32.dll.GetLocaleInfoEx",
    "kernel32.dll.LCIDToLocaleName",
    "kernel32.dll.GetSystemDefaultLocaleName",
    "oleaut32.dll.#283",
    "oleaut32.dll.#284",
    "kernel32.dll.IsWow64Process",
    "ntdll.dll.RtlGetNtVersionNumbers",
    "ole32.dll.CoUninitialize",
    "ntdll.dll.EtwUnregisterTraceGuids",
    "oleaut32.dll.#500",
    "ole32.dll.CoInitializeEx",
    "ole32.dll.CoInitializeSecurity",
    "ole32.dll.IIDFromString",
    "oleaut32.dll.SysAllocString",
    "ole32.dll.CoSetProxyBlanket",
    "kernel32.dll.GetSystemWow64DirectoryA",
    "kernel32.dll.lstrcpyn",
    "ole32.dll.CreateBindCtx",
    "ole32.dll.CoTaskMemAlloc",
    "propsys.dll.PSCreateMemoryPropertyStore",
    "propsys.dll.PSPropertyBag_WriteDWORD",
    "ole32.dll.CoGetApartmentType",
    "ole32.dll.CoRegisterInitializeSpy",
    "ole32.dll.CoTaskMemFree",
    "comctl32.dll.#236",
    "ole32.dll.CoGetMalloc",
    "propsys.dll.PSPropertyBag_ReadDWORD",
    "comctl32.dll.#320",
    "comctl32.dll.#324",
    "comctl32.dll.#323",
    "propsys.dll.PSPropertyBag_ReadGUID",
    "apphelp.dll.ApphelpCheckShellObject",
    "comctl32.dll.#328",
    "comctl32.dll.#334",
    "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
    "advapi32.dll.InitializeSecurityDescriptor",
    "advapi32.dll.SetEntriesInAclW",
    "ntmarta.dll.GetMartaExtensionInterface",
    "advapi32.dll.SetSecurityDescriptorDacl",
    "advapi32.dll.IsTextUnicode",
    "comctl32.dll.#332",
    "comctl32.dll.#338",
    "comctl32.dll.#339",
    "shell32.dll.#102",
    "propsys.dll.PSPropertyBag_ReadStrAlloc",
    "setupapi.dll.CM_Get_Device_Interface_List_ExW",
    "comctl32.dll.#386",
    "sechost.dll.ConvertSidToStringSidW",
    "profapi.dll.#104",
    "ole32.dll.PropVariantClear",
    "comctl32.dll.#327",
    "ole32.dll.ReleaseStgMedium",
    "propsys.dll.#430",
    "advapi32.dll.RegOpenKeyExW",
    "advapi32.dll.RegGetValueW",
    "ole32.dll.CoTaskMemRealloc",
    "propsys.dll.InitPropVariantFromStringAsVector",
    "propsys.dll.PSCoerceToCanonicalValue",
    "propsys.dll.PropVariantToStringAlloc",
    "shell32.dll.#66",
    "ntdll.dll.RtlDllShutdownInProgress",
    "comctl32.dll.#329",
    "ole32.dll.CoGetCallContext",
    "netutils.dll.NetApiBufferFree",
    "propsys.dll.PSLookupPropertyHandlerCLSID",
    "propsys.dll.PSCreatePropertyStoreFromObject",
    "propsys.dll.#417",
    "propsys.dll.PropVariantToGUID",
    "comctl32.dll.#388",
    "comctl32.dll.#321",
    "ole32.dll.CoAllowSetForegroundWindow",
    "kernel32.dll.InitializeSRWLock",
    "kernel32.dll.AcquireSRWLockExclusive",
    "kernel32.dll.AcquireSRWLockShared",
    "kernel32.dll.ReleaseSRWLockExclusive",
    "kernel32.dll.ReleaseSRWLockShared",
    "shell32.dll.SHGetFolderPathW",
    "advapi32.dll.SaferGetPolicyInformation",
    "ole32.dll.CoRevokeInitializeSpy",
    "shlwapi.dll.PathFindFileNameA",
    "shlwapi.dll.PathFindExtensionA",
    "kernel32.dll.GetShortPathNameA",
    "propsys.dll.PSPropertyBag_ReadBSTR",
    "comctl32.dll.#400",
    "comctl32.dll.#403",
    "comctl32.dll.#152",
    "ole32.dll.CoGetClassObject",
    "ole32.dll.CoGetMarshalSizeMax",
    "ole32.dll.CoMarshalInterface",
    "ole32.dll.CoUnmarshalInterface",
    "ole32.dll.StringFromIID",
    "ole32.dll.CoGetPSClsid",
    "ole32.dll.CoReleaseMarshalData",
    "ole32.dll.DcomChannelSetHResult",
    "vssapi.dll.CreateWriter",
    "advapi32.dll.LookupAccountNameW",
    "sechost.dll.LookupAccountNameLocalW",
    "advapi32.dll.LookupAccountSidW",
    "samcli.dll.NetLocalGroupGetMembers",
    "samlib.dll.SamConnect",
    "rpcrt4.dll.NdrClientCall3",
    "rpcrt4.dll.RpcStringBindingComposeW",
    "rpcrt4.dll.RpcBindingFromStringBindingW",
    "rpcrt4.dll.RpcStringFreeW",
    "rpcrt4.dll.RpcBindingFree",
    "samlib.dll.SamOpenDomain",
    "samlib.dll.SamLookupNamesInDomain",
    "samlib.dll.SamOpenAlias",
    "samlib.dll.SamFreeMemory",
    "samlib.dll.SamCloseHandle",
    "samlib.dll.SamGetMembersInAlias",
    "ole32.dll.CoCreateGuid",
    "ole32.dll.StringFromCLSID",
    "oleaut32.dll.#4",
    "oleaut32.dll.#7",
    "propsys.dll.VariantToPropVariant",
    "wbemcore.dll.Reinitialize",
    "wbemsvc.dll.DllGetClassObject",
    "wbemsvc.dll.DllCanUnloadNow",
    "authz.dll.AuthzInitializeContextFromToken",
    "authz.dll.AuthzInitializeObjectAccessAuditEvent2",
    "authz.dll.AuthzAccessCheck",
    "authz.dll.AuthzFreeAuditEvent",
    "authz.dll.AuthzFreeContext",
    "authz.dll.AuthzInitializeResourceManager",
    "authz.dll.AuthzFreeResourceManager",
    "rpcrt4.dll.RpcBindingCreateW",
    "rpcrt4.dll.RpcBindingBind",
    "rpcrt4.dll.I_RpcMapWin32Status",
    "advapi32.dll.EventRegister",
    "advapi32.dll.EventUnregister",
    "advapi32.dll.EventWrite",
    "kernel32.dll.RegCloseKey",
    "kernel32.dll.RegSetValueExW",
    "kernel32.dll.RegOpenKeyExW",
    "kernel32.dll.RegQueryValueExW",
    "wmisvc.dll.IsImproperShutdownDetected",
    "wevtapi.dll.EvtRender",
    "wevtapi.dll.EvtNext",
    "wevtapi.dll.EvtClose",
    "wevtapi.dll.EvtQuery",
    "wevtapi.dll.EvtCreateRenderContext",
    "rpcrt4.dll.RpcBindingSetAuthInfoExW",
    "rpcrt4.dll.RpcBindingSetOption",
    "ole32.dll.CoCreateFreeThreadedMarshaler",
    "ole32.dll.CreateStreamOnHGlobal",
    "advapi32.dll.RegCreateKeyExW",
    "advapi32.dll.RegSetValueExW",
    "cryptsp.dll.CryptAcquireContextW",
    "cryptsp.dll.CryptGenRandom",
    "cryptsp.dll.CryptReleaseContext",
    "kernelbase.dll.InitializeAcl",
    "kernelbase.dll.AddAce",
    "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
    "kernel32.dll.IsThreadAFiber",
    "kernel32.dll.OpenProcessToken",
    "kernelbase.dll.GetTokenInformation",
    "kernelbase.dll.DuplicateTokenEx",
    "kernelbase.dll.AdjustTokenPrivileges",
    "sechost.dll.LookupAccountSidLocalW",
    "kernelbase.dll.AllocateAndInitializeSid",
    "kernelbase.dll.CheckTokenMembership",
    "oleaut32.dll.#285",
    "oleaut32.dll.#286",
    "kernel32.dll.SetThreadToken",
    "ole32.dll.CoRevertToSelf",
    "advapi32.dll.LogonUserExExW",
    "sspicli.dll.LogonUserExExW",
    "authz.dll.AuthzInitializeContextFromSid",
    "ole32.dll.CoImpersonateClient",
    "advapi32.dll.OpenThreadToken",
    "ole32.dll.CoSwitchCallContext",
    "oleaut32.dll.#287",
    "oleaut32.dll.#288",
    "oleaut32.dll.#289",
    "kernel32.dll.SortGetHandle",
    "kernel32.dll.SortCloseHandle",
    "fastprox.dll.DllGetClassObject",
    "fastprox.dll.DllCanUnloadNow",
    "oleaut32.dll.#290",
    "devobj.dll.DevObjCreateDeviceInfoList",
    "devobj.dll.DevObjGetClassDevs",
    "devobj.dll.DevObjEnumDeviceInfo",
    "devobj.dll.DevObjDestroyDeviceInfoList",
    "setupapi.dll.CM_Open_DevNode_Key_Ex",
    "devobj.dll.DevObjGetDeviceProperty",
    "cfgmgr32.dll.CM_Connect_MachineA",
    "cfgmgr32.dll.CM_Disconnect_Machine",
    "cfgmgr32.dll.CM_Locate_DevNodeW",
    "cfgmgr32.dll.CM_Get_DevNode_Registry_PropertyW",
    "cfgmgr32.dll.CM_Get_Child",
    "cfgmgr32.dll.CM_Get_Sibling",
    "cfgmgr32.dll.CM_Get_DevNode_Status",
    "cfgmgr32.dll.CM_Get_First_Log_Conf",
    "cfgmgr32.dll.CM_Get_Next_Res_Des",
    "cfgmgr32.dll.CM_Get_Res_Des_Data",
    "cfgmgr32.dll.CM_Get_Res_Des_Data_Size",
    "cfgmgr32.dll.CM_Free_Log_Conf_Handle",
    "cfgmgr32.dll.CM_Free_Res_Des_Handle",
    "cfgmgr32.dll.CM_Get_Device_IDA",
    "cfgmgr32.dll.CM_Get_Device_ID_Size",
    "cfgmgr32.dll.CM_Get_Parent",
    "user32.dll.MonitorFromWindow",
    "user32.dll.MonitorFromRect",
    "user32.dll.MonitorFromPoint",
    "user32.dll.EnumDisplayDevicesW",
    "user32.dll.GetMonitorInfoW",
    "dxgi.dll.DXGIReportAdapterConfiguration",
    "setupapi.dll.SetupDiGetClassDevsW",
    "setupapi.dll.SetupDiEnumDeviceInterfaces",
    "setupapi.dll.SetupDiGetDeviceInterfaceDetailW",
    "setupapi.dll.SetupDiDestroyDeviceInfoList",
    "gdi32.dll.D3DKMTOpenAdapterFromDeviceName",
    "gdi32.dll.D3DKMTQueryAdapterInfo",
    "gdi32.dll.D3DKMTGetDisplayModeList",
    "gdi32.dll.D3DKMTCloseAdapter",
    "wintrust.dll.WinVerifyTrust",
    "wmi.dll.WmiQueryAllDataW",
    "wmi.dll.WmiQuerySingleInstanceW",
    "wmi.dll.WmiSetSingleItemW",
    "wmi.dll.WmiSetSingleInstanceW",
    "wmi.dll.WmiExecuteMethodW",
    "wmi.dll.WmiNotificationRegistrationW",
    "wmi.dll.WmiMofEnumerateResourcesW",
    "wmi.dll.WmiFileHandleToInstanceNameW",
    "wmi.dll.WmiDevInstToInstanceNameW",
    "wmi.dll.WmiQueryGuidInformation",
    "wmi.dll.WmiOpenBlock",
    "wmi.dll.WmiCloseBlock",
    "wmi.dll.WmiFreeBuffer",
    "wmi.dll.WmiEnumerateGuids",
    "ntdll.dll.RtlInitUnicodeString",
    "ntdll.dll.RtlFreeUnicodeString",
    "ntdll.dll.NtSetSystemEnvironmentValue",
    "ntdll.dll.NtQuerySystemEnvironmentValue",
    "ntdll.dll.NtCreateFile",
    "ntdll.dll.NtQuerySystemInformation",
    "ntdll.dll.NtQueryDirectoryObject",
    "ntdll.dll.NtQueryObject",
    "ntdll.dll.NtOpenDirectoryObject",
    "ntdll.dll.NtQueryInformationProcess",
    "ntdll.dll.NtQueryInformationToken",
    "ntdll.dll.NtOpenFile",
    "ntdll.dll.NtClose",
    "ntdll.dll.NtFsControlFile",
    "ntdll.dll.NtQueryVolumeInformationFile",
    "advapi32.dll.LookupPrivilegeValueW",
    "winbrand.dll.BrandingLoadString",
    "uxtheme.dll.ThemeInitApiHook",
    "user32.dll.IsProcessDPIAware",
    "kernel32.dll.HeapSetInformation",
    "advapi32.dll.SaferIdentifyLevel",
    "advapi32.dll.SaferComputeTokenFromLevel",
    "advapi32.dll.SaferCloseLevel",
    "ole32.dll.MkParseDisplayName",
    "ole32.dll.BindMoniker",
    "lpk.dll.LpkEditControl",
    "comctl32.dll.InitCommonControlsEx",
    "advapi32.dll.CheckTokenMembership",
    "kernel32.dll.GetSystemWindowsDirectoryW",
    "kernel32.dll.CreateWaitableTimerW",
    "ole32.dll.CLSIDFromOle1Class",
    "clbcatq.dll.GetCatalogObject",
    "clbcatq.dll.GetCatalogObject2",
    "ole32.dll.NdrOleInitializeExtension",
    "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
    "msi.dll.QueryInstanceCount",
    "kernel32.dll.CancelWaitableTimer",
    "msi.dll.DllGetClassObject",
    "msi.dll.DllCanUnloadNow",
    "rpcrt4.dll.I_RpcBindingInqLocalClientPID",
    "userenv.dll.CreateEnvironmentBlock",
    "userenv.dll.DestroyEnvironmentBlock",
    "ntdll.dll.WinSqmIsOptedIn",
    "kernel32.dll.WTSGetActiveConsoleSessionId",
    "ole32.dll.CoInitialize",
    "netapi32.dll.NetGetJoinInformation",
    "netapi32.dll.NetApiBufferFree",
    "shlwapi.dll.UrlIsW",
    "ole32.dll.StgOpenStorage",
    "kernel32.dll.GetFileAttributesExW",
    "advapi32.dll.CreateWellKnownSid",
    "advapi32.dll.SaferCreateLevel",
    "apphelp.dll.SdbInitDatabase",
    "apphelp.dll.SdbFindFirstMsiPackage_Str",
    "apphelp.dll.SdbReleaseDatabase",
    "version.dll.GetFileVersionInfoSizeW",
    "version.dll.GetFileVersionInfoW",
    "version.dll.VerQueryValueW",
    "mscoree.dll.GetCORSystemDirectory",
    "advapi32.dll.RegQueryInfoKeyW",
    "advapi32.dll.RegEnumKeyExW",
    "advapi32.dll.RegEnumValueW",
    "advapi32.dll.RegQueryValueExW",
    "kernel32.dll.SetThreadExecutionState",
    "sfc.dll.SfcIsKeyProtected",
    "kernel32.dll.FlsAlloc",
    "kernel32.dll.FlsSetValue",
    "kernel32.dll.FlsGetValue",
    "kernel32.dll.LCMapStringEx",
    "kernel32.dll.InitializeCriticalSectionEx",
    "kernel32.dll.FlsFree",
    "kernel32.dll.InitOnceExecuteOnce",
    "kernel32.dll.CreateEventExW",
    "kernel32.dll.CreateSemaphoreW",
    "kernel32.dll.CreateSemaphoreExW",
    "kernel32.dll.CreateThreadpoolTimer",
    "kernel32.dll.SetThreadpoolTimer",
    "kernel32.dll.WaitForThreadpoolTimerCallbacks",
    "kernel32.dll.CloseThreadpoolTimer",
    "kernel32.dll.CreateThreadpoolWait",
    "kernel32.dll.SetThreadpoolWait",
    "kernel32.dll.CloseThreadpoolWait",
    "kernel32.dll.FlushProcessWriteBuffers",
    "kernel32.dll.FreeLibraryWhenCallbackReturns",
    "kernel32.dll.GetCurrentProcessorNumber",
    "kernel32.dll.CreateSymbolicLinkW",
    "kernel32.dll.GetTickCount64",
    "kernel32.dll.GetFileInformationByHandleEx",
    "kernel32.dll.SetFileInformationByHandle",
    "kernel32.dll.InitializeConditionVariable",
    "kernel32.dll.WakeConditionVariable",
    "kernel32.dll.WakeAllConditionVariable",
    "kernel32.dll.SleepConditionVariableCS",
    "kernel32.dll.TryAcquireSRWLockExclusive",
    "kernel32.dll.SleepConditionVariableSRW",
    "kernel32.dll.CreateThreadpoolWork",
    "kernel32.dll.SubmitThreadpoolWork",
    "kernel32.dll.CloseThreadpoolWork",
    "kernel32.dll.CompareStringEx",
    "goopdate.dll.DllEntry",
    "kernel32.dll.RtlCaptureStackBackTrace",
    "wkscli.dll.NetWkstaGetInfo",
    "cscapi.dll.CscNetApiGetInterface",
    "kernel32.dll.CreateMutexExW",
    "dbghelp.dll.MiniDumpWriteDump",
    "rpcrt4.dll.UuidCreate",
    "psmachine.dll.DllGetClassObject",
    "psmachine.dll.DllCanUnloadNow",
    "ntdll.dll.RtlGetVersion",
    "kernel32.dll.GetNativeSystemInfo",
    "winhttp.dll.WinHttpAddRequestHeaders",
    "winhttp.dll.WinHttpCheckPlatform",
    "winhttp.dll.WinHttpCloseHandle",
    "winhttp.dll.WinHttpConnect",
    "winhttp.dll.WinHttpCrackUrl",
    "winhttp.dll.WinHttpCreateUrl",
    "winhttp.dll.WinHttpDetectAutoProxyConfigUrl",
    "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
    "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
    "winhttp.dll.WinHttpGetProxyForUrl",
    "winhttp.dll.WinHttpOpen",
    "winhttp.dll.WinHttpOpenRequest",
    "winhttp.dll.WinHttpQueryAuthSchemes",
    "winhttp.dll.WinHttpQueryDataAvailable",
    "winhttp.dll.WinHttpQueryHeaders",
    "winhttp.dll.WinHttpQueryOption",
    "winhttp.dll.WinHttpReadData",
    "winhttp.dll.WinHttpReceiveResponse",
    "winhttp.dll.WinHttpSendRequest",
    "winhttp.dll.WinHttpSetDefaultProxyConfiguration",
    "winhttp.dll.WinHttpSetCredentials",
    "winhttp.dll.WinHttpSetOption",
    "winhttp.dll.WinHttpSetStatusCallback",
    "winhttp.dll.WinHttpSetTimeouts",
    "winhttp.dll.WinHttpWriteData",
    "shlwapi.dll.StrCmpNW",
    "shlwapi.dll.#153",
    "ws2_32.dll.GetAddrInfoW",
    "ws2_32.dll.FreeAddrInfoW",
    "schannel.dll.SpUserModeInitialize",
    "advapi32.dll.RevertToSelf",
    "secur32.dll.FreeContextBuffer",
    "ncrypt.dll.SslOpenProvider",
    "ncrypt.dll.GetSChannelInterface",
    "bcryptprimitives.dll.GetHashInterface",
    "ncrypt.dll.SslIncrementProviderReferenceCount",
    "ncrypt.dll.SslImportKey",
    "bcryptprimitives.dll.GetCipherInterface",
    "ncrypt.dll.SslLookupCipherSuiteInfo",
    "user32.dll.LoadStringW",
    "ncrypt.dll.BCryptOpenAlgorithmProvider",
    "ncrypt.dll.BCryptGetProperty",
    "ncrypt.dll.BCryptCreateHash",
    "ncrypt.dll.BCryptHashData",
    "ncrypt.dll.BCryptFinishHash",
    "ncrypt.dll.BCryptDestroyHash",
    "crypt32.dll.CertGetCertificateChain",
    "userenv.dll.GetUserProfileDirectoryW",
    "sechost.dll.ConvertStringSidToSidW",
    "userenv.dll.RegisterGPNotification",
    "gpapi.dll.RegisterGPNotificationInternal",
    "sechost.dll.OpenSCManagerW",
    "sechost.dll.OpenServiceW",
    "sechost.dll.CloseServiceHandle",
    "sechost.dll.QueryServiceConfigW",
    "winsta.dll.WinStationRegisterNotificationEvent",
    "rpcrt4.dll.RpcAsyncInitializeHandle",
    "rpcrt4.dll.NdrClientCall2",
    "rpcrt4.dll.NdrAsyncClientCall",
    "cryptsp.dll.CryptAcquireContextA",
    "cryptsp.dll.CryptCreateHash",
    "cryptsp.dll.CryptHashData",
    "cryptsp.dll.CryptVerifySignatureA",
    "cryptsp.dll.CryptDestroyKey",
    "cryptsp.dll.CryptDestroyHash",
    "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
    "ncrypt.dll.BCryptImportKeyPair",
    "ncrypt.dll.BCryptVerifySignature",
    "ncrypt.dll.BCryptDestroyKey",
    "crypt32.dll.CertVerifyCertificateChainPolicy",
    "crypt32.dll.CertFreeCertificateChain",
    "crypt32.dll.CertDuplicateCertificateContext",
    "ncrypt.dll.SslEncryptPacket",
    "ncrypt.dll.SslDecryptPacket",
    "winsta.dll.WinStationEnumerateW",
    "rpcrt4.dll.I_RpcExceptionFilter",
    "winsta.dll.WinStationFreeMemory",
    "winsta.dll.WinStationQueryInformationW",
    "bitsprx4.dll.DllGetClassObject",
    "bitsprx4.dll.DllCanUnloadNow",
    "qmgr.dll.ServiceMain",
    "bitsigd.dll.InitializeEx",
    "upnp.dll.DllGetClassObject",
    "upnp.dll.DllCanUnloadNow",
    "rpcrt4.dll.RpcStringBindingComposeA",
    "rpcrt4.dll.RpcBindingFromStringBindingA",
    "rpcrt4.dll.RpcStringFreeA",
    "oleaut32.dll.DllGetClassObject",
    "oleaut32.dll.DllCanUnloadNow",
    "sxs.dll.SxsOleAut32MapIIDToProxyStubCLSID",
    "oleaut32.dll.BSTR_UserSize",
    "oleaut32.dll.BSTR_UserMarshal",
    "oleaut32.dll.BSTR_UserUnmarshal",
    "oleaut32.dll.BSTR_UserFree",
    "oleaut32.dll.VARIANT_UserSize",
    "oleaut32.dll.VARIANT_UserMarshal",
    "oleaut32.dll.VARIANT_UserUnmarshal",
    "oleaut32.dll.VARIANT_UserFree",
    "oleaut32.dll.LPSAFEARRAY_UserSize",
    "oleaut32.dll.LPSAFEARRAY_UserMarshal",
    "oleaut32.dll.LPSAFEARRAY_UserUnmarshal",
    "oleaut32.dll.LPSAFEARRAY_UserFree",
    "advapi32.dll.LogonUserW",
    "wtsapi32.dll.WTSQueryUserToken",
    "wtsapi32.dll.WTSEnumerateSessionsW",
    "wtsapi32.dll.WTSFreeMemory",
    "advapi32.dll.QueryAllTracesW",
    "samlib.dll.SamEnumerateDomainsInSamServer",
    "samlib.dll.SamLookupDomainInSamServer",
    "ole32.dll.CoRegisterClassObject",
    "iphlpapi.dll.GetAdaptersAddresses",
    "rpcrt4.dll.UuidFromStringW",
    "radarrs.dll.WdiDiagnosticModuleMain",
    "radarrs.dll.WdiHandleInstance",
    "radarrs.dll.WdiGetDiagnosticModuleInterfaceVersion",
    "advapi32.dll.DuplicateToken",
    "advapi32.dll.AllocateAndInitializeSid",
    "advapi32.dll.FreeSid",
    "advapi32.dll.RegisterEventSourceW",
    "advapi32.dll.ReportEventW",
    "advapi32.dll.DeregisterEventSource",
    "psapi.dll.EnumProcesses",
    "psapi.dll.EnumProcessModules",
    "psapi.dll.GetModuleBaseNameW"
]

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "GetModuleHandleA",
                        "address": "0x52a104"
                    },
                    {
                        "name": "GetProcAddress",
                        "address": "0x52a108"
                    }
                ],
                "dll": "KERNEL32.DLL"
            },
            {
                "imports": [
                    {
                        "name": "GetDC",
                        "address": "0x52a110"
                    }
                ],
                "dll": "USER32.dll"
            },
            {
                "imports": [
                    {
                        "name": "PatBlt",
                        "address": "0x52a118"
                    }
                ],
                "dll": "GDI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "waveOutOpen",
                        "address": "0x52a120"
                    }
                ],
                "dll": "WINMM.dll"
            },
            {
                "imports": [
                    {
                        "name": "ClosePrinter",
                        "address": "0x52a128"
                    }
                ],
                "dll": "WINSPOOL.DRV"
            },
            {
                "imports": [
                    {
                        "name": "RegCloseKey",
                        "address": "0x52a130"
                    }
                ],
                "dll": "ADVAPI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "ShellExecuteA",
                        "address": "0x52a138"
                    }
                ],
                "dll": "SHELL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "OleRun",
                        "address": "0x52a140"
                    }
                ],
                "dll": "ole32.dll"
            },
            {
                "imports": [
                    {
                        "name": "VariantCopy",
                        "address": "0x52a148"
                    }
                ],
                "dll": "OLEAUT32.dll"
            },
            {
                "imports": [
                    {
                        "name": null,
                        "address": "0x52a150"
                    }
                ],
                "dll": "COMCTL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "sendto",
                        "address": "0x52a158"
                    }
                ],
                "dll": "WS2_32.dll"
            },
            {
                "imports": [
                    {
                        "name": "ChooseColorA",
                        "address": "0x52a160"
                    }
                ],
                "dll": "comdlg32.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x000642ad",
        "overlay": null,
        "imagebase": "0x00400000",
        "reported_checksum": "0x00000000",
        "icon_hash": null,
        "entrypoint": "0x0052a28a",
        "timestamp": "2019-06-12 07:09:07",
        "osversion": "4.0",
        "sections": [
            {
                "name": ".MPRESS1",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x00001000",
                "size_of_data": "0x00053800",
                "entropy": "8.00",
                "raw_address": "0x00000200",
                "virtual_size": "0x00129000",
                "characteristics_raw": "0xe00000e0"
            },
            {
                "name": ".MPRESS2",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x0012a000",
                "size_of_data": "0x00000e00",
                "entropy": "6.01",
                "raw_address": "0x00053a00",
                "virtual_size": "0x00000df4",
                "characteristics_raw": "0xe00000e0"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x0012b000",
                "size_of_data": "0x00004e00",
                "entropy": "5.58",
                "raw_address": "0x00054800",
                "virtual_size": "0x00004d00",
                "characteristics_raw": "0xc0000040"
            }
        ],
        "resources": [
            {
                "name": "TEXTINCLUDE",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00121de8",
                "size": "0x00000151"
            },
            {
                "name": "TEXTINCLUDE",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00121de8",
                "size": "0x00000151"
            },
            {
                "name": "TEXTINCLUDE",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00121de8",
                "size": "0x00000151"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x0012308c",
                "size": "0x00000130"
            },
            {
                "name": "RT_BITMAP",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00123274",
                "size": "0x00000144"
            },
            {
                "name": "RT_BITMAP",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00123274",
                "size": "0x00000144"
            },
            {
                "name": "RT_MENU",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00126e7c",
                "size": "0x00000284"
            },
            {
                "name": "RT_MENU",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00126e7c",
                "size": "0x00000284"
            },
            {
                "name": "RT_DIALOG",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x001282e8",
                "size": "0x00000034"
            },
            {
                "name": "RT_DIALOG",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x001282e8",
                "size": "0x00000034"
            },
            {
                "name": "RT_DIALOG",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x001282e8",
                "size": "0x00000034"
            },
            {
                "name": "RT_DIALOG",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x001282e8",
                "size": "0x00000034"
            },
            {
                "name": "RT_DIALOG",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x001282e8",
                "size": "0x00000034"
            },
            {
                "name": "RT_DIALOG",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x001282e8",
                "size": "0x00000034"
            },
            {
                "name": "RT_DIALOG",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x001282e8",
                "size": "0x00000034"
            },
            {
                "name": "RT_DIALOG",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x001282e8",
                "size": "0x00000034"
            },
            {
                "name": "RT_DIALOG",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x001282e8",
                "size": "0x00000034"
            },
            {
                "name": "RT_DIALOG",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x001282e8",
                "size": "0x00000034"
            },
            {
                "name": "RT_DIALOG",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x001282e8",
                "size": "0x00000034"
            },
            {
                "name": "RT_STRING",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128bd8",
                "size": "0x00000024"
            },
            {
                "name": "RT_STRING",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128bd8",
                "size": "0x00000024"
            },
            {
                "name": "RT_STRING",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128bd8",
                "size": "0x00000024"
            },
            {
                "name": "RT_STRING",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128bd8",
                "size": "0x00000024"
            },
            {
                "name": "RT_STRING",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128bd8",
                "size": "0x00000024"
            },
            {
                "name": "RT_STRING",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128bd8",
                "size": "0x00000024"
            },
            {
                "name": "RT_STRING",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128bd8",
                "size": "0x00000024"
            },
            {
                "name": "RT_STRING",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128bd8",
                "size": "0x00000024"
            },
            {
                "name": "RT_STRING",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128bd8",
                "size": "0x00000024"
            },
            {
                "name": "RT_STRING",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128bd8",
                "size": "0x00000024"
            },
            {
                "name": "RT_STRING",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128bd8",
                "size": "0x00000024"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            },
            {
                "name": "RT_GROUP_CURSOR",
                "language": "LANG_CHINESE",
                "filetype": null,
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "entropy": "0.00",
                "offset": "0x00128d24",
                "size": "0x00000014"
            }
        ],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x0012a000",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x0000028c"
            },
            {
                "virtual_address": "0x0012b000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x00004d00"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x0012a104",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000060"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "aae73b7675bdc323442f02d62bb383ce",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 12,
        "versioninfo": []
    }
}