Exes_317b06dfe3f8fed1fa1af0aef4c539dd_jpg_2019-06-27_08_30.json

[*] MalFamily: ""

[*] MalScore: 10.0

[*] File Name: "Exes_317b06dfe3f8fed1fa1af0aef4c539dd.jpg"
[*] File Size: 1254664
[*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
[*] SHA256: "33dde2eed8ccb2b74c9d0feaf19c341354e54cb5d2c9e475507ff3fe22240381"
[*] MD5: "317b06dfe3f8fed1fa1af0aef4c539dd"
[*] SHA1: "a0591e325c8cd55aedb75f2f51f16b73f549b552"
[*] SHA512: "6ec26bc121d51671eec6f1f53185faefa9ec479415411365d959b3dffc346ff9d26c65905ef6d04e5093db651ab15aece7ceb6689e7072982d5fe3709f647db4"
[*] CRC32: "CCD89D68"
[*] SSDEEP: "24576:3xQDBHwbrk6VC+bz1CTACJS/jxJxFhv4TFvE9vZXqXse:3x5bR1MqxXFh4TdEVdqJ"

[*] Process Execution: [
    "Exes_317b06dfe3f8fed1fa1af0aef4c539dd.jpg"
]

[*] Signatures Detected: [
    {
        "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
        "Details": [
            {
                "IP": "76.73.17.194:9090"
            }
        ]
    },
    {
        "Description": "Creates RWX memory",
        "Details": []
    },
    {
        "Description": "Starts servers listening on 127.0.0.1:38580",
        "Details": []
    },
    {
        "Description": "Reads data out of its own binary image",
        "Details": [
            {
                "self_read": "process: Exes_317b06dfe3f8fed1fa1af0aef4c539dd.jpg, pid: 1524, offset: 0x00000000, length: 0x00132508"
            }
        ]
    },
    {
        "Description": "The binary likely contains encrypted or compressed data.",
        "Details": [
            {
                "section": "name: .text, entropy: 7.12, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00113000, virtual_size: 0x00112e22"
            }
        ]
    },
    {
        "Description": "Installs Tor on the infected machine",
        "Details": []
    },
    {
        "Description": "Installs itself for autorun at Windows startup",
        "Details": [
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem"
            },
            {
                "data": "\"C:\\ProgramData\\Windows\\csrss.exe\""
            }
        ]
    },
    {
        "Description": "Collects information about installed applications",
        "Details": [
            {
                "Program": "Google Update Helper"
            },
            {
            },
            {
                "Program": "Microsoft Excel MUI  2013"
            },
            {
                "Program": "Microsoft Outlook MUI  2013"
            },
            {
            },
            {
                "Program": "Google Chrome"
            },
            {
                "Program": "Adobe Flash Player 29 NPAPI"
            },
            {
                "Program": "Adobe Flash Player 29 ActiveX"
            },
            {
                "Program": "Microsoft DCF MUI  2013"
            },
            {
                "Program": "Microsoft Access MUI  2013"
            },
            {
                "Program": "Microsoft Office Proofing Tools 2013 - English"
            },
            {
                "Program": "Adobe Acrobat Reader DC"
            },
            {
                "Program": "Microsoft Publisher MUI  2013"
            },
            {
                "Program": "Microsoft Office Shared MUI  2013"
            },
            {
                "Program": "Microsoft Office OSM MUI  2013"
            },
            {
                "Program": "Microsoft InfoPath MUI  2013"
            },
            {
                "Program": "Microsoft Office Shared Setup Metadata MUI  2013"
            },
            {
                "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
            },
            {
                "Program": "Microsoft Word MUI  2013"
            },
            {
                "Program": "Microsoft OneDrive"
            },
            {
                "Program": "Microsoft Groove MUI  2013"
            },
            {
                "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
            },
            {
            },
            {
                "Program": "Microsoft Access Setup Metadata MUI  2013"
            },
            {
                "Program": "Microsoft Office OSM UX MUI  2013"
            },
            {
                "Program": "Java Auto Updater"
            },
            {
                "Program": "Microsoft PowerPoint MUI  2013"
            },
            {
                "Program": "Microsoft Office Professional Plus 2013"
            },
            {
                "Program": "Adobe Refresh Manager"
            },
            {
                "Program": "Microsoft Office Proofing  2013"
            },
            {
                "Program": "Microsoft Lync MUI  2013"
            },
            {
            },
            {
                "Program": "Microsoft OneNote MUI  2013"
            }
        ]
    },
    {
        "Description": "Creates a hidden or system file",
        "Details": [
            {
                "file": "C:\\ProgramData\\Windows\\"
            }
        ]
    },
    {
        "Description": "File has been identified by 54 Antiviruses on VirusTotal as malicious",
        "Details": [
            {
                "MicroWorld-eScan": "Trojan.Agent.DPUC"
            },
            {
                "FireEye": "Generic.mg.317b06dfe3f8fed1"
            },
            {
                "CAT-QuickHeal": "Ransom.Troldesh"
            },
            {
                "McAfee": "Trojan-FQSD!317B06DFE3F8"
            },
            {
                "Cylance": "Unsafe"
            },
            {
                "K7AntiVirus": "Trojan ( 0051d3d01 )"
            },
            {
                "Alibaba": "Trojan:Win32/Fsysna.2cf9b85d"
            },
            {
                "K7GW": "Trojan ( 0051d3d01 )"
            },
            {
                "Cybereason": "malicious.fe3f8f"
            },
            {
                "Arcabit": "Trojan.Agent.DPUC"
            },
            {
                "Invincea": "heuristic"
            },
            {
                "F-Prot": "W32/Emotet.SI.gen!Eldorado"
            },
            {
                "Symantec": "Ransom.Cerber"
            },
            {
                "APEX": "Malicious"
            },
            {
                "Paloalto": "generic.ml"
            },
            {
                "Kaspersky": "HEUR:Trojan.Win32.Generic"
            },
            {
                "BitDefender": "Trojan.Agent.DPUC"
            },
            {
                "NANO-Antivirus": "Trojan.Win32.Encoder.fneexa"
            },
            {
                "AegisLab": "Trojan.Win32.Fsysna.4!c"
            },
            {
                "Tencent": "Win32.Trojan.Falsesign.Lhxb"
            },
            {
                "Ad-Aware": "Trojan.Agent.DPUC"
            },
            {
                "Emsisoft": "Trojan-Ransom.Shade (A)"
            },
            {
                "Comodo": "Malware@#22bufcu7snz36"
            },
            {
                "F-Secure": "Trojan.TR/Crypt.Agent.lsgrm"
            },
            {
                "DrWeb": "Trojan.Encoder.26818"
            },
            {
                "Zillya": "Trojan.Fsysna.Win32.17235"
            },
            {
                "TrendMicro": "Ransom.Win32.SHADE.THBBFAI"
            },
            {
                "McAfee-GW-Edition": "Trojan-FQSD!317B06DFE3F8"
            },
            {
                "Sophos": "Mal/Cerber-AL"
            },
            {
                "SentinelOne": "DFI - Malicious PE"
            },
            {
                "Cyren": "W32/Trojan.TCJH-4817"
            },
            {
                "ESET-NOD32": "a variant of Win32/Kryptik.GPYH"
            },
            {
                "Webroot": "W32.Adware.Gen"
            },
            {
                "Avira": "TR/Crypt.Agent.lsgrm"
            },
            {
                "Antiy-AVL": "Trojan/Win32.Tofsee"
            },
            {
                "Microsoft": "Ransom:Win32/Shade.B!bit"
            },
            {
                "Endgame": "malicious (high confidence)"
            },
            {
                "ViRobot": "Trojan.Win32.Agent.1254664"
            },
            {
                "ZoneAlarm": "HEUR:Trojan.Win32.Generic"
            },
            {
                "GData": "Trojan.Agent.DPUC"
            },
            {
                "AhnLab-V3": "Trojan/Win32.FileCoder.R256262"
            },
            {
                "Acronis": "suspicious"
            },
            {
                "VBA32": "BScope.Malware-Cryptor.Filecoder"
            },
            {
                "ALYac": "Trojan.Ransom.Shade"
            },
            {
                "MAX": "malware (ai score=100)"
            },
            {
                "Panda": "Trj/GdSda.A"
            },
            {
                "TrendMicro-HouseCall": "Ransom.Win32.SHADE.THBBFAI"
            },
            {
                "Yandex": "Trojan.Shade!"
            },
            {
                "Ikarus": "Trojan-Ransom.Crypted007"
            },
            {
                "Fortinet": "W32/Injector.EETM!tr"
            },
            {
                "AVG": "Win32:RansomX-gen [Ransom]"
            },
            {
                "Avast": "Win32:RansomX-gen [Ransom]"
            },
            {
                "CrowdStrike": "win/malicious_confidence_100% (W)"
            },
            {
                "Qihoo-360": "Win32/Trojan.eac"
            }
        ]
    },
    {
        "Description": "Creates a copy of itself",
        "Details": [
            {
                "copy": "C:\\ProgramData\\Windows\\csrss.exe"
            }
        ]
    },
    {
        "Description": "Anomalous binary characteristics",
        "Details": [
            {
                "anomaly": "Actual checksum does not match that reported in PE header"
            }
        ]
    }
]

[*] Started Service: []

[*] Executed Commands: []

[*] Mutexes: []

[*] Modified Files: [
    "\\??\\PIPE\\wkssvc",
    "C:\\ProgramData\\Windows\\csrss.exe",
    "\\??\\PIPE\\srvsvc",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\lock",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state"
]

[*] Deleted Files: [
    "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp"
]

[*] Modified Registry Keys: [
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\System32\\Configuration\\",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xi",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xVersion"
]

[*] Deleted Registry Keys: []

[*] DNS Communications: []

[*] Domains: []

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: []

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "LockFile",
                        "address": "0x5141d4"
                    },
                    {
                        "name": "LockResource",
                        "address": "0x5141d8"
                    },
                    {
                        "name": "MapViewOfFile",
                        "address": "0x5141dc"
                    },
                    {
                        "name": "MultiByteToWideChar",
                        "address": "0x5141e0"
                    },
                    {
                        "name": "OpenEventA",
                        "address": "0x5141e4"
                    },
                    {
                        "name": "OpenFileMappingA",
                        "address": "0x5141e8"
                    },
                    {
                        "name": "OpenProcess",
                        "address": "0x5141ec"
                    },
                    {
                        "name": "OutputDebugStringA",
                        "address": "0x5141f0"
                    },
                    {
                        "name": "PulseEvent",
                        "address": "0x5141f4"
                    },
                    {
                        "name": "QueryPerformanceCounter",
                        "address": "0x5141f8"
                    },
                    {
                        "name": "RaiseException",
                        "address": "0x5141fc"
                    },
                    {
                        "name": "ReadFile",
                        "address": "0x514200"
                    },
                    {
                        "name": "ReleaseMutex",
                        "address": "0x514204"
                    },
                    {
                        "name": "ResetEvent",
                        "address": "0x514208"
                    },
                    {
                        "name": "RtlUnwind",
                        "address": "0x51420c"
                    },
                    {
                        "name": "SetEndOfFile",
                        "address": "0x514210"
                    },
                    {
                        "name": "SetEnvironmentVariableA",
                        "address": "0x514214"
                    },
                    {
                        "name": "SetEvent",
                        "address": "0x514218"
                    },
                    {
                        "name": "SetFileAttributesA",
                        "address": "0x51421c"
                    },
                    {
                        "name": "SetFilePointer",
                        "address": "0x514220"
                    },
                    {
                        "name": "SetHandleCount",
                        "address": "0x514224"
                    },
                    {
                        "name": "SetLastError",
                        "address": "0x514228"
                    },
                    {
                        "name": "SetStdHandle",
                        "address": "0x51422c"
                    },
                    {
                        "name": "SetThreadIdealProcessor",
                        "address": "0x514230"
                    },
                    {
                        "name": "SetUnhandledExceptionFilter",
                        "address": "0x514234"
                    },
                    {
                        "name": "SizeofResource",
                        "address": "0x514238"
                    },
                    {
                        "name": "Sleep",
                        "address": "0x51423c"
                    },
                    {
                        "name": "TerminateProcess",
                        "address": "0x514240"
                    },
                    {
                        "name": "LocalReAlloc",
                        "address": "0x514244"
                    },
                    {
                        "name": "Thread32Next",
                        "address": "0x514248"
                    },
                    {
                        "name": "TlsAlloc",
                        "address": "0x51424c"
                    },
                    {
                        "name": "TlsFree",
                        "address": "0x514250"
                    },
                    {
                        "name": "TlsGetValue",
                        "address": "0x514254"
                    },
                    {
                        "name": "TlsSetValue",
                        "address": "0x514258"
                    },
                    {
                        "name": "UnhandledExceptionFilter",
                        "address": "0x51425c"
                    },
                    {
                        "name": "UnlockFile",
                        "address": "0x514260"
                    },
                    {
                        "name": "UnmapViewOfFile",
                        "address": "0x514264"
                    },
                    {
                        "name": "VirtualAlloc",
                        "address": "0x514268"
                    },
                    {
                        "name": "VirtualFree",
                        "address": "0x51426c"
                    },
                    {
                        "name": "VirtualProtect",
                        "address": "0x514270"
                    },
                    {
                        "name": "VirtualQuery",
                        "address": "0x514274"
                    },
                    {
                        "name": "WaitForMultipleObjects",
                        "address": "0x514278"
                    },
                    {
                        "name": "WaitForSingleObject",
                        "address": "0x51427c"
                    },
                    {
                        "name": "WideCharToMultiByte",
                        "address": "0x514280"
                    },
                    {
                        "name": "WriteConsoleA",
                        "address": "0x514284"
                    },
                    {
                        "name": "WriteConsoleW",
                        "address": "0x514288"
                    },
                    {
                        "name": "WriteFile",
                        "address": "0x51428c"
                    },
                    {
                        "name": "WriteProfileStringW",
                        "address": "0x514290"
                    },
                    {
                        "name": "lstrcmpA",
                        "address": "0x514294"
                    },
                    {
                        "name": "lstrcmpW",
                        "address": "0x514298"
                    },
                    {
                        "name": "lstrcmpiA",
                        "address": "0x51429c"
                    },
                    {
                        "name": "lstrcpyA",
                        "address": "0x5142a0"
                    },
                    {
                        "name": "lstrcpynA",
                        "address": "0x5142a4"
                    },
                    {
                        "name": "lstrlenA",
                        "address": "0x5142a8"
                    },
                    {
                        "name": "lstrlenW",
                        "address": "0x5142ac"
                    },
                    {
                        "name": "LocalFree",
                        "address": "0x5142b0"
                    },
                    {
                        "name": "LocalAlloc",
                        "address": "0x5142b4"
                    },
                    {
                        "name": "LoadResource",
                        "address": "0x5142b8"
                    },
                    {
                        "name": "LoadLibraryExA",
                        "address": "0x5142bc"
                    },
                    {
                        "name": "LoadLibraryA",
                        "address": "0x5142c0"
                    },
                    {
                        "name": "LeaveCriticalSection",
                        "address": "0x5142c4"
                    },
                    {
                        "name": "LCMapStringW",
                        "address": "0x5142c8"
                    },
                    {
                        "name": "LCMapStringA",
                        "address": "0x5142cc"
                    },
                    {
                        "name": "IsValidLocale",
                        "address": "0x5142d0"
                    },
                    {
                        "name": "IsValidCodePage",
                        "address": "0x5142d4"
                    },
                    {
                        "name": "IsDebuggerPresent",
                        "address": "0x5142d8"
                    },
                    {
                        "name": "IsDBCSLeadByte",
                        "address": "0x5142dc"
                    },
                    {
                        "name": "InterlockedIncrement",
                        "address": "0x5142e0"
                    },
                    {
                        "name": "InterlockedExchange",
                        "address": "0x5142e4"
                    },
                    {
                        "name": "InterlockedDecrement",
                        "address": "0x5142e8"
                    },
                    {
                        "name": "InterlockedCompareExchange",
                        "address": "0x5142ec"
                    },
                    {
                        "name": "InitializeCriticalSectionAndSpinCount",
                        "address": "0x5142f0"
                    },
                    {
                        "name": "InitializeCriticalSection",
                        "address": "0x5142f4"
                    },
                    {
                        "name": "HeapSize",
                        "address": "0x5142f8"
                    },
                    {
                        "name": "HeapReAlloc",
                        "address": "0x5142fc"
                    },
                    {
                        "name": "HeapFree",
                        "address": "0x514300"
                    },
                    {
                        "name": "HeapCreate",
                        "address": "0x514304"
                    },
                    {
                        "name": "HeapAlloc",
                        "address": "0x514308"
                    },
                    {
                        "name": "GlobalUnlock",
                        "address": "0x51430c"
                    },
                    {
                        "name": "GlobalReAlloc",
                        "address": "0x514310"
                    },
                    {
                        "name": "GlobalMemoryStatus",
                        "address": "0x514314"
                    },
                    {
                        "name": "GlobalLock",
                        "address": "0x514318"
                    },
                    {
                        "name": "GlobalHandle",
                        "address": "0x51431c"
                    },
                    {
                        "name": "GlobalGetAtomNameA",
                        "address": "0x514320"
                    },
                    {
                        "name": "GlobalFree",
                        "address": "0x514324"
                    },
                    {
                        "name": "GlobalFlags",
                        "address": "0x514328"
                    },
                    {
                        "name": "GlobalFindAtomA",
                        "address": "0x51432c"
                    },
                    {
                        "name": "GlobalDeleteAtom",
                        "address": "0x514330"
                    },
                    {
                        "name": "GlobalAlloc",
                        "address": "0x514334"
                    },
                    {
                        "name": "GlobalAddAtomA",
                        "address": "0x514338"
                    },
                    {
                        "name": "GetVolumeInformationA",
                        "address": "0x51433c"
                    },
                    {
                        "name": "GetVersionExA",
                        "address": "0x514340"
                    },
                    {
                        "name": "GetUserDefaultLCID",
                        "address": "0x514344"
                    },
                    {
                        "name": "GetTimeZoneInformation",
                        "address": "0x514348"
                    },
                    {
                        "name": "GetTimeFormatA",
                        "address": "0x51434c"
                    },
                    {
                        "name": "GetTickCount",
                        "address": "0x514350"
                    },
                    {
                        "name": "CloseHandle",
                        "address": "0x514354"
                    },
                    {
                        "name": "GetTempPathA",
                        "address": "0x514358"
                    },
                    {
                        "name": "GetTempFileNameA",
                        "address": "0x51435c"
                    },
                    {
                        "name": "GetSystemTimeAsFileTime",
                        "address": "0x514360"
                    },
                    {
                        "name": "GetSystemInfo",
                        "address": "0x514364"
                    },
                    {
                        "name": "GetStringTypeW",
                        "address": "0x514368"
                    },
                    {
                        "name": "GetStringTypeA",
                        "address": "0x51436c"
                    },
                    {
                        "name": "GetStdHandle",
                        "address": "0x514370"
                    },
                    {
                        "name": "GetStartupInfoA",
                        "address": "0x514374"
                    },
                    {
                        "name": "GetShortPathNameA",
                        "address": "0x514378"
                    },
                    {
                        "name": "GetProcessHeap",
                        "address": "0x51437c"
                    },
                    {
                        "name": "GetProcAddress",
                        "address": "0x514380"
                    },
                    {
                        "name": "GetOEMCP",
                        "address": "0x514384"
                    },
                    {
                        "name": "GetModuleHandleW",
                        "address": "0x514388"
                    },
                    {
                        "name": "GetModuleHandleA",
                        "address": "0x51438c"
                    },
                    {
                        "name": "GetModuleFileNameA",
                        "address": "0x514390"
                    },
                    {
                        "name": "GetLocaleInfoW",
                        "address": "0x514394"
                    },
                    {
                        "name": "GetLocaleInfoA",
                        "address": "0x514398"
                    },
                    {
                        "name": "GetLastError",
                        "address": "0x51439c"
                    },
                    {
                        "name": "GetFullPathNameA",
                        "address": "0x5143a0"
                    },
                    {
                        "name": "GetFileType",
                        "address": "0x5143a4"
                    },
                    {
                        "name": "GetFileTime",
                        "address": "0x5143a8"
                    },
                    {
                        "name": "GetFileSizeEx",
                        "address": "0x5143ac"
                    },
                    {
                        "name": "GetFileSize",
                        "address": "0x5143b0"
                    },
                    {
                        "name": "GetFileAttributesExA",
                        "address": "0x5143b4"
                    },
                    {
                        "name": "GetFileAttributesA",
                        "address": "0x5143b8"
                    },
                    {
                        "name": "GetExitCodeThread",
                        "address": "0x5143bc"
                    },
                    {
                        "name": "GetEnvironmentStringsW",
                        "address": "0x5143c0"
                    },
                    {
                        "name": "GetEnvironmentStrings",
                        "address": "0x5143c4"
                    },
                    {
                        "name": "GetDriveTypeW",
                        "address": "0x5143c8"
                    },
                    {
                        "name": "GetDateFormatA",
                        "address": "0x5143cc"
                    },
                    {
                        "name": "GetCurrentThreadId",
                        "address": "0x5143d0"
                    },
                    {
                        "name": "GetCurrentThread",
                        "address": "0x5143d4"
                    },
                    {
                        "name": "GetCurrentProcessId",
                        "address": "0x5143d8"
                    },
                    {
                        "name": "GetCurrentProcess",
                        "address": "0x5143dc"
                    },
                    {
                        "name": "GetConsoleOutputCP",
                        "address": "0x5143e0"
                    },
                    {
                        "name": "GetConsoleMode",
                        "address": "0x5143e4"
                    },
                    {
                        "name": "GetConsoleCP",
                        "address": "0x5143e8"
                    },
                    {
                        "name": "GetCommandLineA",
                        "address": "0x5143ec"
                    },
                    {
                        "name": "GetCommMask",
                        "address": "0x5143f0"
                    },
                    {
                        "name": "GetCommConfig",
                        "address": "0x5143f4"
                    },
                    {
                        "name": "GetCPInfo",
                        "address": "0x5143f8"
                    },
                    {
                        "name": "GetACP",
                        "address": "0x5143fc"
                    },
                    {
                        "name": "FreeLibrary",
                        "address": "0x514400"
                    },
                    {
                        "name": "FreeEnvironmentStringsW",
                        "address": "0x514404"
                    },
                    {
                        "name": "FreeEnvironmentStringsA",
                        "address": "0x514408"
                    },
                    {
                        "name": "FormatMessageA",
                        "address": "0x51440c"
                    },
                    {
                        "name": "FlushFileBuffers",
                        "address": "0x514410"
                    },
                    {
                        "name": "FindResourceA",
                        "address": "0x514414"
                    },
                    {
                        "name": "FindNextChangeNotification",
                        "address": "0x514418"
                    },
                    {
                        "name": "FindFirstFileA",
                        "address": "0x51441c"
                    },
                    {
                        "name": "FindFirstChangeNotificationA",
                        "address": "0x514420"
                    },
                    {
                        "name": "FindCloseChangeNotification",
                        "address": "0x514424"
                    },
                    {
                        "name": "FindClose",
                        "address": "0x514428"
                    },
                    {
                        "name": "FileTimeToSystemTime",
                        "address": "0x51442c"
                    },
                    {
                        "name": "FileTimeToLocalFileTime",
                        "address": "0x514430"
                    },
                    {
                        "name": "FileTimeToDosDateTime",
                        "address": "0x514434"
                    },
                    {
                        "name": "ExitThread",
                        "address": "0x514438"
                    },
                    {
                        "name": "ExitProcess",
                        "address": "0x51443c"
                    },
                    {
                        "name": "EnumSystemLocalesA",
                        "address": "0x514440"
                    },
                    {
                        "name": "EnterCriticalSection",
                        "address": "0x514444"
                    },
                    {
                        "name": "DuplicateHandle",
                        "address": "0x514448"
                    },
                    {
                        "name": "DeleteFileA",
                        "address": "0x51444c"
                    },
                    {
                        "name": "DeleteCriticalSection",
                        "address": "0x514450"
                    },
                    {
                        "name": "CreateThread",
                        "address": "0x514454"
                    },
                    {
                        "name": "CreateProcessA",
                        "address": "0x514458"
                    },
                    {
                        "name": "CreateMutexA",
                        "address": "0x51445c"
                    },
                    {
                        "name": "CreateMailslotA",
                        "address": "0x514460"
                    },
                    {
                        "name": "CreateFileMappingA",
                        "address": "0x514464"
                    },
                    {
                        "name": "CreateFileA",
                        "address": "0x514468"
                    },
                    {
                        "name": "CreateEventA",
                        "address": "0x51446c"
                    },
                    {
                        "name": "CreateDirectoryA",
                        "address": "0x514470"
                    },
                    {
                        "name": "CopyFileA",
                        "address": "0x514474"
                    },
                    {
                        "name": "CompareStringW",
                        "address": "0x514478"
                    },
                    {
                        "name": "CompareStringA",
                        "address": "0x51447c"
                    },
                    {
                        "name": "TerminateThread",
                        "address": "0x514480"
                    }
                ],
                "dll": "KERNEL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "ReleaseCapture",
                        "address": "0x514488"
                    },
                    {
                        "name": "EnumClipboardFormats",
                        "address": "0x51448c"
                    },
                    {
                        "name": "GetWindowContextHelpId",
                        "address": "0x514490"
                    },
                    {
                        "name": "GetWindowTextLengthA",
                        "address": "0x514494"
                    },
                    {
                        "name": "GetClipboardViewer",
                        "address": "0x514498"
                    },
                    {
                        "name": "GetThreadDesktop",
                        "address": "0x51449c"
                    },
                    {
                        "name": "IsCharAlphaW",
                        "address": "0x5144a0"
                    },
                    {
                        "name": "AnyPopup",
                        "address": "0x5144a4"
                    },
                    {
                        "name": "CharUpperW",
                        "address": "0x5144a8"
                    },
                    {
                        "name": "IsCharLowerW",
                        "address": "0x5144ac"
                    },
                    {
                        "name": "IsClipboardFormatAvailable",
                        "address": "0x5144b0"
                    },
                    {
                        "name": "GetQueueStatus",
                        "address": "0x5144b4"
                    },
                    {
                        "name": "CloseWindow",
                        "address": "0x5144b8"
                    },
                    {
                        "name": "GetDialogBaseUnits",
                        "address": "0x5144bc"
                    },
                    {
                        "name": "OemKeyScan",
                        "address": "0x5144c0"
                    },
                    {
                        "name": "GetKeyboardType",
                        "address": "0x5144c4"
                    },
                    {
                        "name": "GetDesktopWindow",
                        "address": "0x5144c8"
                    },
                    {
                        "name": "CharLowerA",
                        "address": "0x5144cc"
                    },
                    {
                        "name": "GetClipboardSequenceNumber",
                        "address": "0x5144d0"
                    },
                    {
                        "name": "GetCaretBlinkTime",
                        "address": "0x5144d4"
                    },
                    {
                        "name": "GetWindowTextLengthW",
                        "address": "0x5144d8"
                    },
                    {
                        "name": "CloseDesktop",
                        "address": "0x5144dc"
                    },
                    {
                        "name": "GetCursor",
                        "address": "0x5144e0"
                    },
                    {
                        "name": "GetInputState",
                        "address": "0x5144e4"
                    },
                    {
                        "name": "PaintDesktop",
                        "address": "0x5144e8"
                    },
                    {
                        "name": "CloseClipboard",
                        "address": "0x5144ec"
                    },
                    {
                        "name": "DestroyCursor",
                        "address": "0x5144f0"
                    },
                    {
                        "name": "GetAsyncKeyState",
                        "address": "0x5144f4"
                    },
                    {
                        "name": "GetClipboardOwner",
                        "address": "0x5144f8"
                    },
                    {
                        "name": "GetKBCodePage",
                        "address": "0x5144fc"
                    },
                    {
                        "name": "GetActiveWindow",
                        "address": "0x514500"
                    },
                    {
                        "name": "VkKeyScanW",
                        "address": "0x514504"
                    },
                    {
                        "name": "GetKeyboardLayout",
                        "address": "0x514508"
                    },
                    {
                        "name": "IsWindowUnicode",
                        "address": "0x51450c"
                    },
                    {
                        "name": "GetProcessWindowStation",
                        "address": "0x514510"
                    },
                    {
                        "name": "IsCharAlphaNumericA",
                        "address": "0x514514"
                    },
                    {
                        "name": "IsCharAlphaA",
                        "address": "0x514518"
                    },
                    {
                        "name": "CountClipboardFormats",
                        "address": "0x51451c"
                    },
                    {
                        "name": "VkKeyScanA",
                        "address": "0x514520"
                    },
                    {
                        "name": "GetMenuContextHelpId",
                        "address": "0x514524"
                    },
                    {
                        "name": "CharLowerW",
                        "address": "0x514528"
                    },
                    {
                        "name": "DestroyIcon",
                        "address": "0x51452c"
                    },
                    {
                        "name": "IsMenu",
                        "address": "0x514530"
                    },
                    {
                        "name": "InSendMessage",
                        "address": "0x514534"
                    },
                    {
                        "name": "GetClipboardData",
                        "address": "0x514538"
                    },
                    {
                        "name": "LoadCursorFromFileA",
                        "address": "0x51453c"
                    },
                    {
                        "name": "WindowFromDC",
                        "address": "0x514540"
                    },
                    {
                        "name": "wvsprintfA",
                        "address": "0x514544"
                    },
                    {
                        "name": "wsprintfA",
                        "address": "0x514548"
                    },
                    {
                        "name": "WinHelpA",
                        "address": "0x51454c"
                    },
                    {
                        "name": "ValidateRect",
                        "address": "0x514550"
                    },
                    {
                        "name": "UnhookWindowsHookEx",
                        "address": "0x514554"
                    },
                    {
                        "name": "TabbedTextOutA",
                        "address": "0x514558"
                    },
                    {
                        "name": "SystemParametersInfoA",
                        "address": "0x51455c"
                    },
                    {
                        "name": "SetWindowsHookExA",
                        "address": "0x514560"
                    },
                    {
                        "name": "SetWindowTextA",
                        "address": "0x514564"
                    },
                    {
                        "name": "SetWindowPos",
                        "address": "0x514568"
                    },
                    {
                        "name": "SetWindowLongA",
                        "address": "0x51456c"
                    },
                    {
                        "name": "SetTimer",
                        "address": "0x514570"
                    },
                    {
                        "name": "SetPropA",
                        "address": "0x514574"
                    },
                    {
                        "name": "SetMenuItemBitmaps",
                        "address": "0x514578"
                    },
                    {
                        "name": "SetMenu",
                        "address": "0x51457c"
                    },
                    {
                        "name": "SetForegroundWindow",
                        "address": "0x514580"
                    },
                    {
                        "name": "SendMessageA",
                        "address": "0x514584"
                    },
                    {
                        "name": "RemovePropA",
                        "address": "0x514588"
                    },
                    {
                        "name": "ReleaseDC",
                        "address": "0x51458c"
                    },
                    {
                        "name": "RegisterWindowMessageA",
                        "address": "0x514590"
                    },
                    {
                        "name": "RegisterClassA",
                        "address": "0x514594"
                    },
                    {
                        "name": "PtInRect",
                        "address": "0x514598"
                    },
                    {
                        "name": "PostThreadMessageA",
                        "address": "0x51459c"
                    },
                    {
                        "name": "PostQuitMessage",
                        "address": "0x5145a0"
                    },
                    {
                        "name": "PostMessageA",
                        "address": "0x5145a4"
                    },
                    {
                        "name": "PeekMessageA",
                        "address": "0x5145a8"
                    },
                    {
                        "name": "ModifyMenuA",
                        "address": "0x5145ac"
                    },
                    {
                        "name": "MessageBoxA",
                        "address": "0x5145b0"
                    },
                    {
                        "name": "MapWindowPoints",
                        "address": "0x5145b4"
                    },
                    {
                        "name": "LoadStringA",
                        "address": "0x5145b8"
                    },
                    {
                        "name": "LoadIconA",
                        "address": "0x5145bc"
                    },
                    {
                        "name": "LoadCursorA",
                        "address": "0x5145c0"
                    },
                    {
                        "name": "LoadBitmapA",
                        "address": "0x5145c4"
                    },
                    {
                        "name": "KillTimer",
                        "address": "0x5145c8"
                    },
                    {
                        "name": "IsWindowEnabled",
                        "address": "0x5145cc"
                    },
                    {
                        "name": "IsWindow",
                        "address": "0x5145d0"
                    },
                    {
                        "name": "IsIconic",
                        "address": "0x5145d4"
                    },
                    {
                        "name": "GrayStringA",
                        "address": "0x5145d8"
                    },
                    {
                        "name": "GetWindowThreadProcessId",
                        "address": "0x5145dc"
                    },
                    {
                        "name": "GetWindowTextA",
                        "address": "0x5145e0"
                    },
                    {
                        "name": "GetWindowRect",
                        "address": "0x5145e4"
                    },
                    {
                        "name": "GetWindowPlacement",
                        "address": "0x5145e8"
                    },
                    {
                        "name": "GetWindowLongA",
                        "address": "0x5145ec"
                    },
                    {
                        "name": "GetWindow",
                        "address": "0x5145f0"
                    },
                    {
                        "name": "GetTopWindow",
                        "address": "0x5145f4"
                    },
                    {
                        "name": "GetSystemMetrics",
                        "address": "0x5145f8"
                    },
                    {
                        "name": "GetSysColorBrush",
                        "address": "0x5145fc"
                    },
                    {
                        "name": "GetSysColor",
                        "address": "0x514600"
                    },
                    {
                        "name": "GetSubMenu",
                        "address": "0x514604"
                    },
                    {
                        "name": "GetParent",
                        "address": "0x514608"
                    },
                    {
                        "name": "GetMessageTime",
                        "address": "0x51460c"
                    },
                    {
                        "name": "GetMessagePos",
                        "address": "0x514610"
                    },
                    {
                        "name": "GetMessageA",
                        "address": "0x514614"
                    },
                    {
                        "name": "GetMenuState",
                        "address": "0x514618"
                    },
                    {
                        "name": "GetMenuItemID",
                        "address": "0x51461c"
                    },
                    {
                        "name": "GetMenuItemCount",
                        "address": "0x514620"
                    },
                    {
                        "name": "GetMenuInfo",
                        "address": "0x514624"
                    },
                    {
                        "name": "GetMenuCheckMarkDimensions",
                        "address": "0x514628"
                    },
                    {
                        "name": "GetMenu",
                        "address": "0x51462c"
                    },
                    {
                        "name": "GetLastActivePopup",
                        "address": "0x514630"
                    },
                    {
                        "name": "GetKeyState",
                        "address": "0x514634"
                    },
                    {
                        "name": "GetForegroundWindow",
                        "address": "0x514638"
                    },
                    {
                        "name": "GetFocus",
                        "address": "0x51463c"
                    },
                    {
                        "name": "GetDlgItem",
                        "address": "0x514640"
                    },
                    {
                        "name": "GetDlgCtrlID",
                        "address": "0x514644"
                    },
                    {
                        "name": "GetDC",
                        "address": "0x514648"
                    },
                    {
                        "name": "GetClientRect",
                        "address": "0x51464c"
                    },
                    {
                        "name": "GetClassNameA",
                        "address": "0x514650"
                    },
                    {
                        "name": "GetClassLongA",
                        "address": "0x514654"
                    },
                    {
                        "name": "GetClassInfoExA",
                        "address": "0x514658"
                    },
                    {
                        "name": "GetClassInfoA",
                        "address": "0x51465c"
                    },
                    {
                        "name": "GetCapture",
                        "address": "0x514660"
                    },
                    {
                        "name": "EnableWindow",
                        "address": "0x514664"
                    },
                    {
                        "name": "EnableMenuItem",
                        "address": "0x514668"
                    },
                    {
                        "name": "DrawTextExA",
                        "address": "0x51466c"
                    },
                    {
                        "name": "DrawTextA",
                        "address": "0x514670"
                    },
                    {
                        "name": "DispatchMessageA",
                        "address": "0x514674"
                    },
                    {
                        "name": "DestroyWindow",
                        "address": "0x514678"
                    },
                    {
                        "name": "DestroyMenu",
                        "address": "0x51467c"
                    },
                    {
                        "name": "DefWindowProcA",
                        "address": "0x514680"
                    },
                    {
                        "name": "CreateWindowExA",
                        "address": "0x514684"
                    },
                    {
                        "name": "CopyRect",
                        "address": "0x514688"
                    },
                    {
                        "name": "ClientToScreen",
                        "address": "0x51468c"
                    },
                    {
                        "name": "CheckMenuItem",
                        "address": "0x514690"
                    },
                    {
                        "name": "CharUpperA",
                        "address": "0x514694"
                    },
                    {
                        "name": "CharNextW",
                        "address": "0x514698"
                    },
                    {
                        "name": "CharNextA",
                        "address": "0x51469c"
                    },
                    {
                        "name": "CallWindowProcA",
                        "address": "0x5146a0"
                    },
                    {
                        "name": "CallNextHookEx",
                        "address": "0x5146a4"
                    },
                    {
                        "name": "AdjustWindowRectEx",
                        "address": "0x5146a8"
                    },
                    {
                        "name": "GetPropA",
                        "address": "0x5146ac"
                    }
                ],
                "dll": "USER32.dll"
            },
            {
                "imports": [
                    {
                        "name": "SetPixel",
                        "address": "0x5140ac"
                    },
                    {
                        "name": "cGetTTFFromFOT",
                        "address": "0x5140b0"
                    },
                    {
                        "name": "GetTextCharset",
                        "address": "0x5140b4"
                    },
                    {
                        "name": "SwapBuffers",
                        "address": "0x5140b8"
                    },
                    {
                        "name": "DeleteObject",
                        "address": "0x5140bc"
                    },
                    {
                        "name": "CreateSolidBrush",
                        "address": "0x5140c0"
                    },
                    {
                        "name": "SaveDC",
                        "address": "0x5140c4"
                    },
                    {
                        "name": "FlattenPath",
                        "address": "0x5140c8"
                    },
                    {
                        "name": "GdiGetBatchLimit",
                        "address": "0x5140cc"
                    },
                    {
                        "name": "AbortDoc",
                        "address": "0x5140d0"
                    },
                    {
                        "name": "GetStockObject",
                        "address": "0x5140d4"
                    },
                    {
                        "name": "GetLayout",
                        "address": "0x5140d8"
                    },
                    {
                        "name": "GetBkColor",
                        "address": "0x5140dc"
                    },
                    {
                        "name": "GdiFlush",
                        "address": "0x5140e0"
                    },
                    {
                        "name": "CreateHalftonePalette",
                        "address": "0x5140e4"
                    },
                    {
                        "name": "SetMetaRgn",
                        "address": "0x5140e8"
                    },
                    {
                        "name": "GetObjectType",
                        "address": "0x5140ec"
                    },
                    {
                        "name": "GetTextColor",
                        "address": "0x5140f0"
                    },
                    {
                        "name": "GetColorSpace",
                        "address": "0x5140f4"
                    },
                    {
                        "name": "GetPolyFillMode",
                        "address": "0x5140f8"
                    },
                    {
                        "name": "GetGraphicsMode",
                        "address": "0x5140fc"
                    },
                    {
                        "name": "AbortPath",
                        "address": "0x514100"
                    },
                    {
                        "name": "DeleteColorSpace",
                        "address": "0x514104"
                    },
                    {
                        "name": "CreateCompatibleDC",
                        "address": "0x514108"
                    },
                    {
                        "name": "UnrealizeObject",
                        "address": "0x51410c"
                    },
                    {
                        "name": "UpdateColors",
                        "address": "0x514110"
                    },
                    {
                        "name": "CreatePatternBrush",
                        "address": "0x514114"
                    },
                    {
                        "name": "StrokePath",
                        "address": "0x514118"
                    },
                    {
                        "name": "GetTextCharacterExtra",
                        "address": "0x51411c"
                    },
                    {
                        "name": "EndPage",
                        "address": "0x514120"
                    },
                    {
                        "name": "SetGraphicsMode",
                        "address": "0x514124"
                    },
                    {
                        "name": "SelectObject",
                        "address": "0x514128"
                    },
                    {
                        "name": "RemoveFontResourceW",
                        "address": "0x51412c"
                    },
                    {
                        "name": "RemoveFontResourceExA",
                        "address": "0x514130"
                    },
                    {
                        "name": "PolyPolyline",
                        "address": "0x514134"
                    },
                    {
                        "name": "PolyPatBlt",
                        "address": "0x514138"
                    },
                    {
                        "name": "PATHOBJ_vGetBounds",
                        "address": "0x51413c"
                    },
                    {
                        "name": "LPtoDP",
                        "address": "0x514140"
                    },
                    {
                        "name": "GetTextFaceAliasW",
                        "address": "0x514144"
                    },
                    {
                        "name": "GetTextExtentExPointI",
                        "address": "0x514148"
                    },
                    {
                        "name": "GetNearestColor",
                        "address": "0x51414c"
                    },
                    {
                        "name": "GetMiterLimit",
                        "address": "0x514150"
                    },
                    {
                        "name": "GetGlyphOutlineW",
                        "address": "0x514154"
                    },
                    {
                        "name": "GetFontUnicodeRanges",
                        "address": "0x514158"
                    },
                    {
                        "name": "GetDCPenColor",
                        "address": "0x51415c"
                    },
                    {
                        "name": "GetCurrentPositionEx",
                        "address": "0x514160"
                    },
                    {
                        "name": "GetCharWidthFloatW",
                        "address": "0x514164"
                    },
                    {
                        "name": "GetCharABCWidthsA",
                        "address": "0x514168"
                    },
                    {
                        "name": "GdiStartPageEMF",
                        "address": "0x51416c"
                    },
                    {
                        "name": "GdiSetServerAttr",
                        "address": "0x514170"
                    },
                    {
                        "name": "GdiReleaseDC",
                        "address": "0x514174"
                    },
                    {
                        "name": "GdiGetLocalBrush",
                        "address": "0x514178"
                    },
                    {
                        "name": "GdiGetDC",
                        "address": "0x51417c"
                    },
                    {
                        "name": "GdiGetCodePage",
                        "address": "0x514180"
                    },
                    {
                        "name": "GdiEntry4",
                        "address": "0x514184"
                    },
                    {
                        "name": "GdiEndDocEMF",
                        "address": "0x514188"
                    },
                    {
                        "name": "GdiCreateLocalMetaFilePict",
                        "address": "0x51418c"
                    },
                    {
                        "name": "GdiConvertPalette",
                        "address": "0x514190"
                    },
                    {
                        "name": "GdiArtificialDecrementDriver",
                        "address": "0x514194"
                    },
                    {
                        "name": "GdiAddGlsRecord",
                        "address": "0x514198"
                    },
                    {
                        "name": "FontIsLinked",
                        "address": "0x51419c"
                    },
                    {
                        "name": "Escape",
                        "address": "0x5141a0"
                    },
                    {
                        "name": "EnumFontsA",
                        "address": "0x5141a4"
                    },
                    {
                        "name": "EnumFontFamiliesA",
                        "address": "0x5141a8"
                    },
                    {
                        "name": "EngWideCharToMultiByte",
                        "address": "0x5141ac"
                    },
                    {
                        "name": "EngUnlockSurface",
                        "address": "0x5141b0"
                    },
                    {
                        "name": "EngFreeModule",
                        "address": "0x5141b4"
                    },
                    {
                        "name": "EngDeletePath",
                        "address": "0x5141b8"
                    },
                    {
                        "name": "CreateRectRgn",
                        "address": "0x5141bc"
                    },
                    {
                        "name": "CreateColorSpaceW",
                        "address": "0x5141c0"
                    },
                    {
                        "name": "CloseEnhMetaFile",
                        "address": "0x5141c4"
                    },
                    {
                        "name": "GetSystemPaletteUse",
                        "address": "0x5141c8"
                    },
                    {
                        "name": "AddFontResourceW",
                        "address": "0x5141cc"
                    }
                ],
                "dll": "GDI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "StartServiceCtrlDispatcherA",
                        "address": "0x514000"
                    },
                    {
                        "name": "SetServiceStatus",
                        "address": "0x514004"
                    },
                    {
                        "name": "SetSecurityDescriptorOwner",
                        "address": "0x514008"
                    },
                    {
                        "name": "SetSecurityDescriptorGroup",
                        "address": "0x51400c"
                    },
                    {
                        "name": "SetSecurityDescriptorDacl",
                        "address": "0x514010"
                    },
                    {
                        "name": "RevertToSelf",
                        "address": "0x514014"
                    },
                    {
                        "name": "ReportEventA",
                        "address": "0x514018"
                    },
                    {
                        "name": "RegisterServiceCtrlHandlerA",
                        "address": "0x51401c"
                    },
                    {
                        "name": "RegisterEventSourceA",
                        "address": "0x514020"
                    },
                    {
                        "name": "RegSetValueExA",
                        "address": "0x514024"
                    },
                    {
                        "name": "RegQueryValueExA",
                        "address": "0x514028"
                    },
                    {
                        "name": "RegQueryInfoKeyA",
                        "address": "0x51402c"
                    },
                    {
                        "name": "RegOpenKeyExA",
                        "address": "0x514030"
                    },
                    {
                        "name": "RegEnumValueA",
                        "address": "0x514034"
                    },
                    {
                        "name": "RegEnumKeyExA",
                        "address": "0x514038"
                    },
                    {
                        "name": "RegDeleteValueA",
                        "address": "0x51403c"
                    },
                    {
                        "name": "RegDeleteKeyA",
                        "address": "0x514040"
                    },
                    {
                        "name": "RegCreateKeyExA",
                        "address": "0x514044"
                    },
                    {
                        "name": "RegCloseKey",
                        "address": "0x514048"
                    },
                    {
                        "name": "OpenThreadToken",
                        "address": "0x51404c"
                    },
                    {
                        "name": "OpenServiceA",
                        "address": "0x514050"
                    },
                    {
                        "name": "OpenSCManagerA",
                        "address": "0x514054"
                    },
                    {
                        "name": "OpenProcessToken",
                        "address": "0x514058"
                    },
                    {
                        "name": "LookupAccountNameA",
                        "address": "0x51405c"
                    },
                    {
                        "name": "IsValidSid",
                        "address": "0x514060"
                    },
                    {
                        "name": "InitializeSecurityDescriptor",
                        "address": "0x514064"
                    },
                    {
                        "name": "InitializeAcl",
                        "address": "0x514068"
                    },
                    {
                        "name": "ImpersonateLoggedOnUser",
                        "address": "0x51406c"
                    },
                    {
                        "name": "GetUserNameA",
                        "address": "0x514070"
                    },
                    {
                        "name": "GetTokenInformation",
                        "address": "0x514074"
                    },
                    {
                        "name": "GetLengthSid",
                        "address": "0x514078"
                    },
                    {
                        "name": "DuplicateTokenEx",
                        "address": "0x51407c"
                    },
                    {
                        "name": "DeregisterEventSource",
                        "address": "0x514080"
                    },
                    {
                        "name": "DeleteService",
                        "address": "0x514084"
                    },
                    {
                        "name": "CreateServiceA",
                        "address": "0x514088"
                    },
                    {
                        "name": "CreateProcessAsUserA",
                        "address": "0x51408c"
                    },
                    {
                        "name": "CopySid",
                        "address": "0x514090"
                    },
                    {
                        "name": "ControlService",
                        "address": "0x514094"
                    },
                    {
                        "name": "CloseServiceHandle",
                        "address": "0x514098"
                    },
                    {
                        "name": "AddAccessDeniedAce",
                        "address": "0x51409c"
                    },
                    {
                        "name": "AddAccessAllowedAce",
                        "address": "0x5140a0"
                    },
                    {
                        "name": "RegOpenKeyExW",
                        "address": "0x5140a4"
                    }
                ],
                "dll": "ADVAPI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "CoCreateFreeThreadedMarshaler",
                        "address": "0x5146b4"
                    },
                    {
                        "name": "CoCreateInstance",
                        "address": "0x5146b8"
                    },
                    {
                        "name": "CoInitialize",
                        "address": "0x5146bc"
                    },
                    {
                        "name": "CoInitializeSecurity",
                        "address": "0x5146c0"
                    },
                    {
                        "name": "CoRegisterClassObject",
                        "address": "0x5146c4"
                    },
                    {
                        "name": "CoRevokeClassObject",
                        "address": "0x5146c8"
                    },
                    {
                        "name": "CoTaskMemAlloc",
                        "address": "0x5146cc"
                    },
                    {
                        "name": "CoTaskMemFree",
                        "address": "0x5146d0"
                    },
                    {
                        "name": "CoTaskMemRealloc",
                        "address": "0x5146d4"
                    },
                    {
                        "name": "CoUninitialize",
                        "address": "0x5146d8"
                    },
                    {
                        "name": "StringFromGUID2",
                        "address": "0x5146dc"
                    }
                ],
                "dll": "ole32.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x0013b92e",
        "overlay": {
            "size": "0x00000d08",
            "offset": "0x00131800"
        },
        "imagebase": "0x00400000",
        "reported_checksum": "0x00133914",
        "icon_hash": null,
        "entrypoint": "0x00512a90",
        "timestamp": "2019-02-18 04:15:13",
        "osversion": "5.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x00113000",
                "entropy": "7.12",
                "raw_address": "0x00000400",
                "virtual_size": "0x00112e22",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rdata",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00114000",
                "size_of_data": "0x00003600",
                "entropy": "5.57",
                "raw_address": "0x00113400",
                "virtual_size": "0x00003474",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x00118000",
                "size_of_data": "0x00000200",
                "entropy": "2.07",
                "raw_address": "0x00116a00",
                "virtual_size": "0x00000278",
                "characteristics_raw": "0xc0000040"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00119000",
                "size_of_data": "0x0001ac00",
                "entropy": "5.81",
                "raw_address": "0x00116c00",
                "virtual_size": "0x000eeb10",
                "characteristics_raw": "0x40000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00114e3c",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x00000078"
            },
            {
                "virtual_address": "0x00119000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x0001ab10"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00131800",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000d08"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00114000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x000006e4"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "250fa6b5a110a6fd38cdd8f3e98b86de",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 5,
        "versioninfo": []
    }
}

[*] Resolved APIs: [
    "kernel32.dll.VirtualAlloc",
    "kernel32.dll.LoadLibraryExA",
    "kernel32.dll.GetProcAddress",
    "kernel32.dll.SetFilePointer",
    "kernel32.dll.lstrlenA",
    "kernel32.dll.lstrcatA",
    "kernel32.dll.VirtualProtect",
    "kernel32.dll.UnmapViewOfFile",
    "kernel32.dll.GetModuleHandleA",
    "kernel32.dll.WriteFile",
    "kernel32.dll.CloseHandle",
    "kernel32.dll.VirtualFree",
    "kernel32.dll.GetTempPathA",
    "kernel32.dll.CreateFileA",
    "kernel32.dll.LoadLibraryA",
    "kernel32.dll.ExitProcess",
    "advapi32.dll.RegCloseKey",
    "oleaut32.dll.#6",
    "shell32.dll.SHGetMalloc",
    "user32.dll.CharUpperA",
    "ws2_32.dll.#1",
    "kernel32.dll.Sleep",
    "kernel32.dll.GetSystemTimeAsFileTime",
    "kernel32.dll.HeapFree",
    "kernel32.dll.HeapAlloc",
    "kernel32.dll.GetProcessHeap",
    "kernel32.dll.OpenProcess",
    "kernel32.dll.CreatePipe",
    "kernel32.dll.CreateProcessA",
    "kernel32.dll.GetExitCodeProcess",
    "kernel32.dll.SetHandleInformation",
    "kernel32.dll.PeekNamedPipe",
    "kernel32.dll.LocalFree",
    "kernel32.dll.GlobalMemoryStatusEx",
    "kernel32.dll.CreateFileMappingA",
    "kernel32.dll.InitializeCriticalSection",
    "kernel32.dll.InterlockedDecrement",
    "kernel32.dll.ReadFile",
    "kernel32.dll.CreateFileW",
    "kernel32.dll.GetLastError",
    "kernel32.dll.TerminateProcess",
    "kernel32.dll.GetCurrentProcess",
    "kernel32.dll.UnhandledExceptionFilter",
    "kernel32.dll.SetUnhandledExceptionFilter",
    "kernel32.dll.IsDebuggerPresent",
    "kernel32.dll.GetCommandLineA",
    "kernel32.dll.GetStartupInfoA",
    "kernel32.dll.RaiseException",
    "kernel32.dll.RtlUnwind",
    "kernel32.dll.GetModuleHandleW",
    "kernel32.dll.TlsGetValue",
    "kernel32.dll.TlsAlloc",
    "kernel32.dll.TlsSetValue",
    "kernel32.dll.TlsFree",
    "kernel32.dll.InterlockedIncrement",
    "kernel32.dll.SetLastError",
    "kernel32.dll.GetCurrentThreadId",
    "kernel32.dll.HeapSize",
    "kernel32.dll.GetStdHandle",
    "kernel32.dll.GetModuleFileNameA",
    "kernel32.dll.FreeEnvironmentStringsA",
    "kernel32.dll.GetEnvironmentStrings",
    "kernel32.dll.FreeEnvironmentStringsW",
    "kernel32.dll.WideCharToMultiByte",
    "kernel32.dll.GetEnvironmentStringsW",
    "kernel32.dll.SetHandleCount",
    "kernel32.dll.GetFileType",
    "kernel32.dll.DeleteCriticalSection",
    "kernel32.dll.HeapCreate",
    "kernel32.dll.QueryPerformanceCounter",
    "kernel32.dll.GetTickCount",
    "kernel32.dll.GetCurrentProcessId",
    "kernel32.dll.SetEvent",
    "kernel32.dll.GetACP",
    "kernel32.dll.DeleteFileA",
    "kernel32.dll.IsValidCodePage",
    "kernel32.dll.EnterCriticalSection",
    "kernel32.dll.LeaveCriticalSection",
    "kernel32.dll.GetConsoleCP",
    "kernel32.dll.GetConsoleMode",
    "kernel32.dll.FlushFileBuffers",
    "kernel32.dll.MultiByteToWideChar",
    "kernel32.dll.LCMapStringA",
    "kernel32.dll.LCMapStringW",
    "kernel32.dll.HeapReAlloc",
    "kernel32.dll.SetConsoleCtrlHandler",
    "kernel32.dll.FreeLibrary",
    "kernel32.dll.InitializeCriticalSectionAndSpinCount",
    "kernel32.dll.GetLocaleInfoA",
    "kernel32.dll.GetStringTypeA",
    "kernel32.dll.GetStringTypeW",
    "kernel32.dll.GetTimeFormatA",
    "kernel32.dll.GetDateFormatA",
    "kernel32.dll.SetStdHandle",
    "kernel32.dll.WriteConsoleA",
    "kernel32.dll.GetConsoleOutputCP",
    "kernel32.dll.WriteConsoleW",
    "kernel32.dll.GetTimeZoneInformation",
    "kernel32.dll.SetEndOfFile",
    "kernel32.dll.CompareStringA",
    "kernel32.dll.CompareStringW",
    "kernel32.dll.SetEnvironmentVariableA",
    "kernel32.dll.GetSystemInfo",
    "kernel32.dll.OpenEventA",
    "kernel32.dll.ResetEvent",
    "kernel32.dll.ResumeThread",
    "kernel32.dll.SystemTimeToFileTime",
    "kernel32.dll.WaitForMultipleObjects",
    "kernel32.dll.SetWaitableTimer",
    "kernel32.dll.CreateWaitableTimerA",
    "kernel32.dll.GetVersion",
    "kernel32.dll.GlobalMemoryStatus",
    "kernel32.dll.GetVersionExA",
    "kernel32.dll.FlushConsoleInputBuffer",
    "kernel32.dll.VerSetConditionMask",
    "kernel32.dll.SleepEx",
    "kernel32.dll.VerifyVersionInfoA",
    "kernel32.dll.ExpandEnvironmentStringsA",
    "kernel32.dll.FormatMessageA",
    "kernel32.dll.MapViewOfFile",
    "kernel32.dll.GetFileSize",
    "kernel32.dll.CreateIoCompletionPort",
    "kernel32.dll.PostQueuedCompletionStatus",
    "kernel32.dll.ReleaseSemaphore",
    "kernel32.dll.CreateSemaphoreA",
    "kernel32.dll.GetQueuedCompletionStatus",
    "kernel32.dll.GetFileInformationByHandle",
    "kernel32.dll.MoveFileA",
    "kernel32.dll.LockFile",
    "kernel32.dll.UnlockFile",
    "kernel32.dll.GetModuleFileNameW",
    "kernel32.dll.LoadLibraryW",
    "kernel32.dll.CreateDirectoryA",
    "kernel32.dll.GetOEMCP",
    "kernel32.dll.WaitForSingleObject",
    "kernel32.dll.GetCPInfo",
    "kernel32.dll.CreateEventA",
    "kernel32.dll.GetSystemDirectoryA",
    "kernel32.dll.GetCurrentDirectoryA",
    "kernel32.dll.GetFullPathNameA",
    "kernel32.dll.FindFirstFileA",
    "kernel32.dll.GetDriveTypeA",
    "kernel32.dll.FileTimeToLocalFileTime",
    "kernel32.dll.FileTimeToSystemTime",
    "kernel32.dll.FindClose",
    "kernel32.dll.SetConsoleMode",
    "kernel32.dll.ReadConsoleInputA",
    "kernel32.dll.CreateThread",
    "kernel32.dll.ExitThread",
    "kernel32.dll.VirtualQuery",
    "advapi32.dll.DeregisterEventSource",
    "advapi32.dll.RegisterEventSourceA",
    "advapi32.dll.ReportEventA",
    "advapi32.dll.RegQueryValueExA",
    "advapi32.dll.RegOpenKeyExA",
    "advapi32.dll.CryptAcquireContextA",
    "advapi32.dll.CryptGenRandom",
    "oleaut32.dll.#9",
    "oleaut32.dll.#2",
    "shell32.dll.SHGetSpecialFolderLocation",
    "shell32.dll.SHGetSpecialFolderPathA",
    "shell32.dll.SHGetPathFromIDListA",
    "user32.dll.MessageBoxA",
    "user32.dll.CharLowerW",
    "user32.dll.GetUserObjectInformationW",
    "user32.dll.GetDesktopWindow",
    "user32.dll.GetProcessWindowStation",
    "user32.dll.CharUpperW",
    "ws2_32.dll.freeaddrinfo",
    "ws2_32.dll.getaddrinfo",
    "ws2_32.dll.#17",
    "ws2_32.dll.#55",
    "ws2_32.dll.#54",
    "ws2_32.dll.#13",
    "ws2_32.dll.#8",
    "ws2_32.dll.#14",
    "ws2_32.dll.#57",
    "ws2_32.dll.#52",
    "ws2_32.dll.#10",
    "ws2_32.dll.#19",
    "ws2_32.dll.#18",
    "ws2_32.dll.#151",
    "ws2_32.dll.#5",
    "ws2_32.dll.WSAIoctl",
    "ws2_32.dll.#4",
    "ws2_32.dll.#111",
    "ws2_32.dll.#9",
    "ws2_32.dll.#15",
    "ws2_32.dll.#20",
    "ws2_32.dll.#22",
    "ws2_32.dll.#6",
    "ws2_32.dll.#21",
    "ws2_32.dll.#16",
    "ws2_32.dll.#2",
    "ws2_32.dll.#23",
    "ws2_32.dll.#112",
    "ws2_32.dll.#3",
    "ws2_32.dll.#7",
    "ws2_32.dll.#115",
    "ws2_32.dll.#116",
    "kernel32.dll.FlsAlloc",
    "kernel32.dll.FlsGetValue",
    "kernel32.dll.FlsSetValue",
    "kernel32.dll.FlsFree",
    "kernel32.dll.IsProcessorFeaturePresent",
    "kernel32.dll.GetComputerNameW",
    "kernel32.dll.GetLogicalDriveStringsW",
    "kernel32.dll.GetVolumeInformationW",
    "kernel32.dll.GetDriveTypeW",
    "kernel32.dll.GetSystemDirectoryW",
    "kernel32.dll.GetWindowsDirectoryA",
    "kernel32.dll.GetWindowsDirectoryW",
    "kernel32.dll.GetTempPathW",
    "kernel32.dll.FindFirstFileW",
    "kernel32.dll.FindNextFileW",
    "kernel32.dll.SetFileAttributesW",
    "kernel32.dll.GetFileAttributesW",
    "kernel32.dll.MoveFileW",
    "kernel32.dll.CreateDirectoryW",
    "kernel32.dll.DeleteFileW",
    "kernel32.dll.CopyFileW",
    "kernel32.dll.DeviceIoControl",
    "kernel32.dll.GetShortPathNameW",
    "kernel32.dll.GetVersionExW",
    "kernel32.dll.SetErrorMode",
    "kernel32.dll.CreateProcessW",
    "kernel32.dll.Wow64DisableWow64FsRedirection",
    "kernel32.dll.Wow64RevertWow64FsRedirection",
    "advapi32.dll.RegOpenKeyExW",
    "advapi32.dll.RegQueryValueExW",
    "advapi32.dll.RegSetValueExW",
    "advapi32.dll.RegCreateKeyExW",
    "advapi32.dll.RegDeleteValueW",
    "advapi32.dll.RegEnumKeyW",
    "advapi32.dll.RegQueryInfoKeyW",
    "advapi32.dll.GetUserNameW",
    "shell32.dll.SHGetFolderPathW",
    "shell32.dll.ShellExecuteW",
    "shell32.dll.SHGetKnownFolderPath",
    "ole32.dll.CoInitializeEx",
    "ole32.dll.CoUninitialize",
    "ole32.dll.CoCreateInstance",
    "ole32.dll.CoInitializeSecurity",
    "ole32.dll.CoSetProxyBlanket",
    "ole32.dll.CoTaskMemFree",
    "oleaut32.dll.VariantClear",
    "user32.dll.GetWindowRect",
    "user32.dll.GetDC",
    "user32.dll.DrawTextW",
    "user32.dll.SystemParametersInfoW",
    "user32.dll.GetForegroundWindow",
    "gdi32.dll.CreateCompatibleDC",
    "gdi32.dll.CreateCompatibleBitmap",
    "gdi32.dll.SelectObject",
    "gdi32.dll.DeleteObject",
    "gdi32.dll.DeleteDC",
    "gdi32.dll.CreateBrushIndirect",
    "gdi32.dll.SetTextColor",
    "gdi32.dll.SetBkColor",
    "gdi32.dll.GetCurrentObject",
    "gdi32.dll.GetObjectA",
    "gdi32.dll.CreateFontIndirectA",
    "gdi32.dll.CreateDIBSection",
    "gdi32.dll.BitBlt",
    "gdi32.dll.ExtFloodFill",
    "netapi32.dll.NetServerGetInfo",
    "netapi32.dll.NetApiBufferFree",
    "netapi32.dll.NetWkstaGetInfo",
    "kernel32.dll.SetProcessDEPPolicy",
    "netapi32.dll.NetStatisticsGet",
    "advapi32.dll.CryptAcquireContextW",
    "advapi32.dll.CryptReleaseContext",
    "cryptsp.dll.CryptAcquireContextW",
    "cryptsp.dll.CryptGenRandom",
    "cryptsp.dll.CryptReleaseContext",
    "user32.dll.GetCursorInfo",
    "user32.dll.GetQueueStatus",
    "kernel32.dll.CreateToolhelp32Snapshot",
    "kernel32.dll.Heap32First",
    "kernel32.dll.Heap32Next",
    "kernel32.dll.Heap32ListFirst",
    "kernel32.dll.Heap32ListNext",
    "kernel32.dll.Process32First",
    "kernel32.dll.Process32Next",
    "kernel32.dll.Thread32First",
    "kernel32.dll.Thread32Next",
    "kernel32.dll.Module32First",
    "kernel32.dll.Module32Next",
    "cryptsp.dll.CryptAcquireContextA",
    "cryptbase.dll.SystemFunction036",
    "uxtheme.dll.ThemeInitApiHook",
    "user32.dll.IsProcessDPIAware",
    "ole32.dll.CreateBindCtx",
    "ole32.dll.CoTaskMemAlloc",
    "ole32.dll.CoGetApartmentType",
    "ole32.dll.CoRegisterInitializeSpy",
    "comctl32.dll.#236",
    "ole32.dll.CoGetMalloc",
    "comctl32.dll.#320",
    "comctl32.dll.#324",
    "comctl32.dll.#323",
    "comctl32.dll.#328",
    "comctl32.dll.#334",
    "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
    "setupapi.dll.CM_Get_Device_Interface_List_ExW",
    "advapi32.dll.InitializeSecurityDescriptor",
    "advapi32.dll.SetEntriesInAclW",
    "ntmarta.dll.GetMartaExtensionInterface",
    "advapi32.dll.SetSecurityDescriptorDacl",
    "comctl32.dll.#332",
    "advapi32.dll.IsTextUnicode",
    "comctl32.dll.#338",
    "comctl32.dll.#339",
    "shell32.dll.#102",
    "comctl32.dll.#386",
    "ole32.dll.CoRevokeInitializeSpy",
    "comctl32.dll.#388",
    "ole32.dll.NdrOleInitializeExtension",
    "ole32.dll.CoGetClassObject",
    "ole32.dll.CoGetMarshalSizeMax",
    "ole32.dll.CoMarshalInterface",
    "ole32.dll.CoUnmarshalInterface",
    "ole32.dll.StringFromIID",
    "ole32.dll.CoGetPSClsid",
    "ole32.dll.CoReleaseMarshalData",
    "ole32.dll.DcomChannelSetHResult",
    "oleaut32.dll.#500"
]

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "LockFile",
                        "address": "0x5141d4"
                    },
                    {
                        "name": "LockResource",
                        "address": "0x5141d8"
                    },
                    {
                        "name": "MapViewOfFile",
                        "address": "0x5141dc"
                    },
                    {
                        "name": "MultiByteToWideChar",
                        "address": "0x5141e0"
                    },
                    {
                        "name": "OpenEventA",
                        "address": "0x5141e4"
                    },
                    {
                        "name": "OpenFileMappingA",
                        "address": "0x5141e8"
                    },
                    {
                        "name": "OpenProcess",
                        "address": "0x5141ec"
                    },
                    {
                        "name": "OutputDebugStringA",
                        "address": "0x5141f0"
                    },
                    {
                        "name": "PulseEvent",
                        "address": "0x5141f4"
                    },
                    {
                        "name": "QueryPerformanceCounter",
                        "address": "0x5141f8"
                    },
                    {
                        "name": "RaiseException",
                        "address": "0x5141fc"
                    },
                    {
                        "name": "ReadFile",
                        "address": "0x514200"
                    },
                    {
                        "name": "ReleaseMutex",
                        "address": "0x514204"
                    },
                    {
                        "name": "ResetEvent",
                        "address": "0x514208"
                    },
                    {
                        "name": "RtlUnwind",
                        "address": "0x51420c"
                    },
                    {
                        "name": "SetEndOfFile",
                        "address": "0x514210"
                    },
                    {
                        "name": "SetEnvironmentVariableA",
                        "address": "0x514214"
                    },
                    {
                        "name": "SetEvent",
                        "address": "0x514218"
                    },
                    {
                        "name": "SetFileAttributesA",
                        "address": "0x51421c"
                    },
                    {
                        "name": "SetFilePointer",
                        "address": "0x514220"
                    },
                    {
                        "name": "SetHandleCount",
                        "address": "0x514224"
                    },
                    {
                        "name": "SetLastError",
                        "address": "0x514228"
                    },
                    {
                        "name": "SetStdHandle",
                        "address": "0x51422c"
                    },
                    {
                        "name": "SetThreadIdealProcessor",
                        "address": "0x514230"
                    },
                    {
                        "name": "SetUnhandledExceptionFilter",
                        "address": "0x514234"
                    },
                    {
                        "name": "SizeofResource",
                        "address": "0x514238"
                    },
                    {
                        "name": "Sleep",
                        "address": "0x51423c"
                    },
                    {
                        "name": "TerminateProcess",
                        "address": "0x514240"
                    },
                    {
                        "name": "LocalReAlloc",
                        "address": "0x514244"
                    },
                    {
                        "name": "Thread32Next",
                        "address": "0x514248"
                    },
                    {
                        "name": "TlsAlloc",
                        "address": "0x51424c"
                    },
                    {
                        "name": "TlsFree",
                        "address": "0x514250"
                    },
                    {
                        "name": "TlsGetValue",
                        "address": "0x514254"
                    },
                    {
                        "name": "TlsSetValue",
                        "address": "0x514258"
                    },
                    {
                        "name": "UnhandledExceptionFilter",
                        "address": "0x51425c"
                    },
                    {
                        "name": "UnlockFile",
                        "address": "0x514260"
                    },
                    {
                        "name": "UnmapViewOfFile",
                        "address": "0x514264"
                    },
                    {
                        "name": "VirtualAlloc",
                        "address": "0x514268"
                    },
                    {
                        "name": "VirtualFree",
                        "address": "0x51426c"
                    },
                    {
                        "name": "VirtualProtect",
                        "address": "0x514270"
                    },
                    {
                        "name": "VirtualQuery",
                        "address": "0x514274"
                    },
                    {
                        "name": "WaitForMultipleObjects",
                        "address": "0x514278"
                    },
                    {
                        "name": "WaitForSingleObject",
                        "address": "0x51427c"
                    },
                    {
                        "name": "WideCharToMultiByte",
                        "address": "0x514280"
                    },
                    {
                        "name": "WriteConsoleA",
                        "address": "0x514284"
                    },
                    {
                        "name": "WriteConsoleW",
                        "address": "0x514288"
                    },
                    {
                        "name": "WriteFile",
                        "address": "0x51428c"
                    },
                    {
                        "name": "WriteProfileStringW",
                        "address": "0x514290"
                    },
                    {
                        "name": "lstrcmpA",
                        "address": "0x514294"
                    },
                    {
                        "name": "lstrcmpW",
                        "address": "0x514298"
                    },
                    {
                        "name": "lstrcmpiA",
                        "address": "0x51429c"
                    },
                    {
                        "name": "lstrcpyA",
                        "address": "0x5142a0"
                    },
                    {
                        "name": "lstrcpynA",
                        "address": "0x5142a4"
                    },
                    {
                        "name": "lstrlenA",
                        "address": "0x5142a8"
                    },
                    {
                        "name": "lstrlenW",
                        "address": "0x5142ac"
                    },
                    {
                        "name": "LocalFree",
                        "address": "0x5142b0"
                    },
                    {
                        "name": "LocalAlloc",
                        "address": "0x5142b4"
                    },
                    {
                        "name": "LoadResource",
                        "address": "0x5142b8"
                    },
                    {
                        "name": "LoadLibraryExA",
                        "address": "0x5142bc"
                    },
                    {
                        "name": "LoadLibraryA",
                        "address": "0x5142c0"
                    },
                    {
                        "name": "LeaveCriticalSection",
                        "address": "0x5142c4"
                    },
                    {
                        "name": "LCMapStringW",
                        "address": "0x5142c8"
                    },
                    {
                        "name": "LCMapStringA",
                        "address": "0x5142cc"
                    },
                    {
                        "name": "IsValidLocale",
                        "address": "0x5142d0"
                    },
                    {
                        "name": "IsValidCodePage",
                        "address": "0x5142d4"
                    },
                    {
                        "name": "IsDebuggerPresent",
                        "address": "0x5142d8"
                    },
                    {
                        "name": "IsDBCSLeadByte",
                        "address": "0x5142dc"
                    },
                    {
                        "name": "InterlockedIncrement",
                        "address": "0x5142e0"
                    },
                    {
                        "name": "InterlockedExchange",
                        "address": "0x5142e4"
                    },
                    {
                        "name": "InterlockedDecrement",
                        "address": "0x5142e8"
                    },
                    {
                        "name": "InterlockedCompareExchange",
                        "address": "0x5142ec"
                    },
                    {
                        "name": "InitializeCriticalSectionAndSpinCount",
                        "address": "0x5142f0"
                    },
                    {
                        "name": "InitializeCriticalSection",
                        "address": "0x5142f4"
                    },
                    {
                        "name": "HeapSize",
                        "address": "0x5142f8"
                    },
                    {
                        "name": "HeapReAlloc",
                        "address": "0x5142fc"
                    },
                    {
                        "name": "HeapFree",
                        "address": "0x514300"
                    },
                    {
                        "name": "HeapCreate",
                        "address": "0x514304"
                    },
                    {
                        "name": "HeapAlloc",
                        "address": "0x514308"
                    },
                    {
                        "name": "GlobalUnlock",
                        "address": "0x51430c"
                    },
                    {
                        "name": "GlobalReAlloc",
                        "address": "0x514310"
                    },
                    {
                        "name": "GlobalMemoryStatus",
                        "address": "0x514314"
                    },
                    {
                        "name": "GlobalLock",
                        "address": "0x514318"
                    },
                    {
                        "name": "GlobalHandle",
                        "address": "0x51431c"
                    },
                    {
                        "name": "GlobalGetAtomNameA",
                        "address": "0x514320"
                    },
                    {
                        "name": "GlobalFree",
                        "address": "0x514324"
                    },
                    {
                        "name": "GlobalFlags",
                        "address": "0x514328"
                    },
                    {
                        "name": "GlobalFindAtomA",
                        "address": "0x51432c"
                    },
                    {
                        "name": "GlobalDeleteAtom",
                        "address": "0x514330"
                    },
                    {
                        "name": "GlobalAlloc",
                        "address": "0x514334"
                    },
                    {
                        "name": "GlobalAddAtomA",
                        "address": "0x514338"
                    },
                    {
                        "name": "GetVolumeInformationA",
                        "address": "0x51433c"
                    },
                    {
                        "name": "GetVersionExA",
                        "address": "0x514340"
                    },
                    {
                        "name": "GetUserDefaultLCID",
                        "address": "0x514344"
                    },
                    {
                        "name": "GetTimeZoneInformation",
                        "address": "0x514348"
                    },
                    {
                        "name": "GetTimeFormatA",
                        "address": "0x51434c"
                    },
                    {
                        "name": "GetTickCount",
                        "address": "0x514350"
                    },
                    {
                        "name": "CloseHandle",
                        "address": "0x514354"
                    },
                    {
                        "name": "GetTempPathA",
                        "address": "0x514358"
                    },
                    {
                        "name": "GetTempFileNameA",
                        "address": "0x51435c"
                    },
                    {
                        "name": "GetSystemTimeAsFileTime",
                        "address": "0x514360"
                    },
                    {
                        "name": "GetSystemInfo",
                        "address": "0x514364"
                    },
                    {
                        "name": "GetStringTypeW",
                        "address": "0x514368"
                    },
                    {
                        "name": "GetStringTypeA",
                        "address": "0x51436c"
                    },
                    {
                        "name": "GetStdHandle",
                        "address": "0x514370"
                    },
                    {
                        "name": "GetStartupInfoA",
                        "address": "0x514374"
                    },
                    {
                        "name": "GetShortPathNameA",
                        "address": "0x514378"
                    },
                    {
                        "name": "GetProcessHeap",
                        "address": "0x51437c"
                    },
                    {
                        "name": "GetProcAddress",
                        "address": "0x514380"
                    },
                    {
                        "name": "GetOEMCP",
                        "address": "0x514384"
                    },
                    {
                        "name": "GetModuleHandleW",
                        "address": "0x514388"
                    },
                    {
                        "name": "GetModuleHandleA",
                        "address": "0x51438c"
                    },
                    {
                        "name": "GetModuleFileNameA",
                        "address": "0x514390"
                    },
                    {
                        "name": "GetLocaleInfoW",
                        "address": "0x514394"
                    },
                    {
                        "name": "GetLocaleInfoA",
                        "address": "0x514398"
                    },
                    {
                        "name": "GetLastError",
                        "address": "0x51439c"
                    },
                    {
                        "name": "GetFullPathNameA",
                        "address": "0x5143a0"
                    },
                    {
                        "name": "GetFileType",
                        "address": "0x5143a4"
                    },
                    {
                        "name": "GetFileTime",
                        "address": "0x5143a8"
                    },
                    {
                        "name": "GetFileSizeEx",
                        "address": "0x5143ac"
                    },
                    {
                        "name": "GetFileSize",
                        "address": "0x5143b0"
                    },
                    {
                        "name": "GetFileAttributesExA",
                        "address": "0x5143b4"
                    },
                    {
                        "name": "GetFileAttributesA",
                        "address": "0x5143b8"
                    },
                    {
                        "name": "GetExitCodeThread",
                        "address": "0x5143bc"
                    },
                    {
                        "name": "GetEnvironmentStringsW",
                        "address": "0x5143c0"
                    },
                    {
                        "name": "GetEnvironmentStrings",
                        "address": "0x5143c4"
                    },
                    {
                        "name": "GetDriveTypeW",
                        "address": "0x5143c8"
                    },
                    {
                        "name": "GetDateFormatA",
                        "address": "0x5143cc"
                    },
                    {
                        "name": "GetCurrentThreadId",
                        "address": "0x5143d0"
                    },
                    {
                        "name": "GetCurrentThread",
                        "address": "0x5143d4"
                    },
                    {
                        "name": "GetCurrentProcessId",
                        "address": "0x5143d8"
                    },
                    {
                        "name": "GetCurrentProcess",
                        "address": "0x5143dc"
                    },
                    {
                        "name": "GetConsoleOutputCP",
                        "address": "0x5143e0"
                    },
                    {
                        "name": "GetConsoleMode",
                        "address": "0x5143e4"
                    },
                    {
                        "name": "GetConsoleCP",
                        "address": "0x5143e8"
                    },
                    {
                        "name": "GetCommandLineA",
                        "address": "0x5143ec"
                    },
                    {
                        "name": "GetCommMask",
                        "address": "0x5143f0"
                    },
                    {
                        "name": "GetCommConfig",
                        "address": "0x5143f4"
                    },
                    {
                        "name": "GetCPInfo",
                        "address": "0x5143f8"
                    },
                    {
                        "name": "GetACP",
                        "address": "0x5143fc"
                    },
                    {
                        "name": "FreeLibrary",
                        "address": "0x514400"
                    },
                    {
                        "name": "FreeEnvironmentStringsW",
                        "address": "0x514404"
                    },
                    {
                        "name": "FreeEnvironmentStringsA",
                        "address": "0x514408"
                    },
                    {
                        "name": "FormatMessageA",
                        "address": "0x51440c"
                    },
                    {
                        "name": "FlushFileBuffers",
                        "address": "0x514410"
                    },
                    {
                        "name": "FindResourceA",
                        "address": "0x514414"
                    },
                    {
                        "name": "FindNextChangeNotification",
                        "address": "0x514418"
                    },
                    {
                        "name": "FindFirstFileA",
                        "address": "0x51441c"
                    },
                    {
                        "name": "FindFirstChangeNotificationA",
                        "address": "0x514420"
                    },
                    {
                        "name": "FindCloseChangeNotification",
                        "address": "0x514424"
                    },
                    {
                        "name": "FindClose",
                        "address": "0x514428"
                    },
                    {
                        "name": "FileTimeToSystemTime",
                        "address": "0x51442c"
                    },
                    {
                        "name": "FileTimeToLocalFileTime",
                        "address": "0x514430"
                    },
                    {
                        "name": "FileTimeToDosDateTime",
                        "address": "0x514434"
                    },
                    {
                        "name": "ExitThread",
                        "address": "0x514438"
                    },
                    {
                        "name": "ExitProcess",
                        "address": "0x51443c"
                    },
                    {
                        "name": "EnumSystemLocalesA",
                        "address": "0x514440"
                    },
                    {
                        "name": "EnterCriticalSection",
                        "address": "0x514444"
                    },
                    {
                        "name": "DuplicateHandle",
                        "address": "0x514448"
                    },
                    {
                        "name": "DeleteFileA",
                        "address": "0x51444c"
                    },
                    {
                        "name": "DeleteCriticalSection",
                        "address": "0x514450"
                    },
                    {
                        "name": "CreateThread",
                        "address": "0x514454"
                    },
                    {
                        "name": "CreateProcessA",
                        "address": "0x514458"
                    },
                    {
                        "name": "CreateMutexA",
                        "address": "0x51445c"
                    },
                    {
                        "name": "CreateMailslotA",
                        "address": "0x514460"
                    },
                    {
                        "name": "CreateFileMappingA",
                        "address": "0x514464"
                    },
                    {
                        "name": "CreateFileA",
                        "address": "0x514468"
                    },
                    {
                        "name": "CreateEventA",
                        "address": "0x51446c"
                    },
                    {
                        "name": "CreateDirectoryA",
                        "address": "0x514470"
                    },
                    {
                        "name": "CopyFileA",
                        "address": "0x514474"
                    },
                    {
                        "name": "CompareStringW",
                        "address": "0x514478"
                    },
                    {
                        "name": "CompareStringA",
                        "address": "0x51447c"
                    },
                    {
                        "name": "TerminateThread",
                        "address": "0x514480"
                    }
                ],
                "dll": "KERNEL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "ReleaseCapture",
                        "address": "0x514488"
                    },
                    {
                        "name": "EnumClipboardFormats",
                        "address": "0x51448c"
                    },
                    {
                        "name": "GetWindowContextHelpId",
                        "address": "0x514490"
                    },
                    {
                        "name": "GetWindowTextLengthA",
                        "address": "0x514494"
                    },
                    {
                        "name": "GetClipboardViewer",
                        "address": "0x514498"
                    },
                    {
                        "name": "GetThreadDesktop",
                        "address": "0x51449c"
                    },
                    {
                        "name": "IsCharAlphaW",
                        "address": "0x5144a0"
                    },
                    {
                        "name": "AnyPopup",
                        "address": "0x5144a4"
                    },
                    {
                        "name": "CharUpperW",
                        "address": "0x5144a8"
                    },
                    {
                        "name": "IsCharLowerW",
                        "address": "0x5144ac"
                    },
                    {
                        "name": "IsClipboardFormatAvailable",
                        "address": "0x5144b0"
                    },
                    {
                        "name": "GetQueueStatus",
                        "address": "0x5144b4"
                    },
                    {
                        "name": "CloseWindow",
                        "address": "0x5144b8"
                    },
                    {
                        "name": "GetDialogBaseUnits",
                        "address": "0x5144bc"
                    },
                    {
                        "name": "OemKeyScan",
                        "address": "0x5144c0"
                    },
                    {
                        "name": "GetKeyboardType",
                        "address": "0x5144c4"
                    },
                    {
                        "name": "GetDesktopWindow",
                        "address": "0x5144c8"
                    },
                    {
                        "name": "CharLowerA",
                        "address": "0x5144cc"
                    },
                    {
                        "name": "GetClipboardSequenceNumber",
                        "address": "0x5144d0"
                    },
                    {
                        "name": "GetCaretBlinkTime",
                        "address": "0x5144d4"
                    },
                    {
                        "name": "GetWindowTextLengthW",
                        "address": "0x5144d8"
                    },
                    {
                        "name": "CloseDesktop",
                        "address": "0x5144dc"
                    },
                    {
                        "name": "GetCursor",
                        "address": "0x5144e0"
                    },
                    {
                        "name": "GetInputState",
                        "address": "0x5144e4"
                    },
                    {
                        "name": "PaintDesktop",
                        "address": "0x5144e8"
                    },
                    {
                        "name": "CloseClipboard",
                        "address": "0x5144ec"
                    },
                    {
                        "name": "DestroyCursor",
                        "address": "0x5144f0"
                    },
                    {
                        "name": "GetAsyncKeyState",
                        "address": "0x5144f4"
                    },
                    {
                        "name": "GetClipboardOwner",
                        "address": "0x5144f8"
                    },
                    {
                        "name": "GetKBCodePage",
                        "address": "0x5144fc"
                    },
                    {
                        "name": "GetActiveWindow",
                        "address": "0x514500"
                    },
                    {
                        "name": "VkKeyScanW",
                        "address": "0x514504"
                    },
                    {
                        "name": "GetKeyboardLayout",
                        "address": "0x514508"
                    },
                    {
                        "name": "IsWindowUnicode",
                        "address": "0x51450c"
                    },
                    {
                        "name": "GetProcessWindowStation",
                        "address": "0x514510"
                    },
                    {
                        "name": "IsCharAlphaNumericA",
                        "address": "0x514514"
                    },
                    {
                        "name": "IsCharAlphaA",
                        "address": "0x514518"
                    },
                    {
                        "name": "CountClipboardFormats",
                        "address": "0x51451c"
                    },
                    {
                        "name": "VkKeyScanA",
                        "address": "0x514520"
                    },
                    {
                        "name": "GetMenuContextHelpId",
                        "address": "0x514524"
                    },
                    {
                        "name": "CharLowerW",
                        "address": "0x514528"
                    },
                    {
                        "name": "DestroyIcon",
                        "address": "0x51452c"
                    },
                    {
                        "name": "IsMenu",
                        "address": "0x514530"
                    },
                    {
                        "name": "InSendMessage",
                        "address": "0x514534"
                    },
                    {
                        "name": "GetClipboardData",
                        "address": "0x514538"
                    },
                    {
                        "name": "LoadCursorFromFileA",
                        "address": "0x51453c"
                    },
                    {
                        "name": "WindowFromDC",
                        "address": "0x514540"
                    },
                    {
                        "name": "wvsprintfA",
                        "address": "0x514544"
                    },
                    {
                        "name": "wsprintfA",
                        "address": "0x514548"
                    },
                    {
                        "name": "WinHelpA",
                        "address": "0x51454c"
                    },
                    {
                        "name": "ValidateRect",
                        "address": "0x514550"
                    },
                    {
                        "name": "UnhookWindowsHookEx",
                        "address": "0x514554"
                    },
                    {
                        "name": "TabbedTextOutA",
                        "address": "0x514558"
                    },
                    {
                        "name": "SystemParametersInfoA",
                        "address": "0x51455c"
                    },
                    {
                        "name": "SetWindowsHookExA",
                        "address": "0x514560"
                    },
                    {
                        "name": "SetWindowTextA",
                        "address": "0x514564"
                    },
                    {
                        "name": "SetWindowPos",
                        "address": "0x514568"
                    },
                    {
                        "name": "SetWindowLongA",
                        "address": "0x51456c"
                    },
                    {
                        "name": "SetTimer",
                        "address": "0x514570"
                    },
                    {
                        "name": "SetPropA",
                        "address": "0x514574"
                    },
                    {
                        "name": "SetMenuItemBitmaps",
                        "address": "0x514578"
                    },
                    {
                        "name": "SetMenu",
                        "address": "0x51457c"
                    },
                    {
                        "name": "SetForegroundWindow",
                        "address": "0x514580"
                    },
                    {
                        "name": "SendMessageA",
                        "address": "0x514584"
                    },
                    {
                        "name": "RemovePropA",
                        "address": "0x514588"
                    },
                    {
                        "name": "ReleaseDC",
                        "address": "0x51458c"
                    },
                    {
                        "name": "RegisterWindowMessageA",
                        "address": "0x514590"
                    },
                    {
                        "name": "RegisterClassA",
                        "address": "0x514594"
                    },
                    {
                        "name": "PtInRect",
                        "address": "0x514598"
                    },
                    {
                        "name": "PostThreadMessageA",
                        "address": "0x51459c"
                    },
                    {
                        "name": "PostQuitMessage",
                        "address": "0x5145a0"
                    },
                    {
                        "name": "PostMessageA",
                        "address": "0x5145a4"
                    },
                    {
                        "name": "PeekMessageA",
                        "address": "0x5145a8"
                    },
                    {
                        "name": "ModifyMenuA",
                        "address": "0x5145ac"
                    },
                    {
                        "name": "MessageBoxA",
                        "address": "0x5145b0"
                    },
                    {
                        "name": "MapWindowPoints",
                        "address": "0x5145b4"
                    },
                    {
                        "name": "LoadStringA",
                        "address": "0x5145b8"
                    },
                    {
                        "name": "LoadIconA",
                        "address": "0x5145bc"
                    },
                    {
                        "name": "LoadCursorA",
                        "address": "0x5145c0"
                    },
                    {
                        "name": "LoadBitmapA",
                        "address": "0x5145c4"
                    },
                    {
                        "name": "KillTimer",
                        "address": "0x5145c8"
                    },
                    {
                        "name": "IsWindowEnabled",
                        "address": "0x5145cc"
                    },
                    {
                        "name": "IsWindow",
                        "address": "0x5145d0"
                    },
                    {
                        "name": "IsIconic",
                        "address": "0x5145d4"
                    },
                    {
                        "name": "GrayStringA",
                        "address": "0x5145d8"
                    },
                    {
                        "name": "GetWindowThreadProcessId",
                        "address": "0x5145dc"
                    },
                    {
                        "name": "GetWindowTextA",
                        "address": "0x5145e0"
                    },
                    {
                        "name": "GetWindowRect",
                        "address": "0x5145e4"
                    },
                    {
                        "name": "GetWindowPlacement",
                        "address": "0x5145e8"
                    },
                    {
                        "name": "GetWindowLongA",
                        "address": "0x5145ec"
                    },
                    {
                        "name": "GetWindow",
                        "address": "0x5145f0"
                    },
                    {
                        "name": "GetTopWindow",
                        "address": "0x5145f4"
                    },
                    {
                        "name": "GetSystemMetrics",
                        "address": "0x5145f8"
                    },
                    {
                        "name": "GetSysColorBrush",
                        "address": "0x5145fc"
                    },
                    {
                        "name": "GetSysColor",
                        "address": "0x514600"
                    },
                    {
                        "name": "GetSubMenu",
                        "address": "0x514604"
                    },
                    {
                        "name": "GetParent",
                        "address": "0x514608"
                    },
                    {
                        "name": "GetMessageTime",
                        "address": "0x51460c"
                    },
                    {
                        "name": "GetMessagePos",
                        "address": "0x514610"
                    },
                    {
                        "name": "GetMessageA",
                        "address": "0x514614"
                    },
                    {
                        "name": "GetMenuState",
                        "address": "0x514618"
                    },
                    {
                        "name": "GetMenuItemID",
                        "address": "0x51461c"
                    },
                    {
                        "name": "GetMenuItemCount",
                        "address": "0x514620"
                    },
                    {
                        "name": "GetMenuInfo",
                        "address": "0x514624"
                    },
                    {
                        "name": "GetMenuCheckMarkDimensions",
                        "address": "0x514628"
                    },
                    {
                        "name": "GetMenu",
                        "address": "0x51462c"
                    },
                    {
                        "name": "GetLastActivePopup",
                        "address": "0x514630"
                    },
                    {
                        "name": "GetKeyState",
                        "address": "0x514634"
                    },
                    {
                        "name": "GetForegroundWindow",
                        "address": "0x514638"
                    },
                    {
                        "name": "GetFocus",
                        "address": "0x51463c"
                    },
                    {
                        "name": "GetDlgItem",
                        "address": "0x514640"
                    },
                    {
                        "name": "GetDlgCtrlID",
                        "address": "0x514644"
                    },
                    {
                        "name": "GetDC",
                        "address": "0x514648"
                    },
                    {
                        "name": "GetClientRect",
                        "address": "0x51464c"
                    },
                    {
                        "name": "GetClassNameA",
                        "address": "0x514650"
                    },
                    {
                        "name": "GetClassLongA",
                        "address": "0x514654"
                    },
                    {
                        "name": "GetClassInfoExA",
                        "address": "0x514658"
                    },
                    {
                        "name": "GetClassInfoA",
                        "address": "0x51465c"
                    },
                    {
                        "name": "GetCapture",
                        "address": "0x514660"
                    },
                    {
                        "name": "EnableWindow",
                        "address": "0x514664"
                    },
                    {
                        "name": "EnableMenuItem",
                        "address": "0x514668"
                    },
                    {
                        "name": "DrawTextExA",
                        "address": "0x51466c"
                    },
                    {
                        "name": "DrawTextA",
                        "address": "0x514670"
                    },
                    {
                        "name": "DispatchMessageA",
                        "address": "0x514674"
                    },
                    {
                        "name": "DestroyWindow",
                        "address": "0x514678"
                    },
                    {
                        "name": "DestroyMenu",
                        "address": "0x51467c"
                    },
                    {
                        "name": "DefWindowProcA",
                        "address": "0x514680"
                    },
                    {
                        "name": "CreateWindowExA",
                        "address": "0x514684"
                    },
                    {
                        "name": "CopyRect",
                        "address": "0x514688"
                    },
                    {
                        "name": "ClientToScreen",
                        "address": "0x51468c"
                    },
                    {
                        "name": "CheckMenuItem",
                        "address": "0x514690"
                    },
                    {
                        "name": "CharUpperA",
                        "address": "0x514694"
                    },
                    {
                        "name": "CharNextW",
                        "address": "0x514698"
                    },
                    {
                        "name": "CharNextA",
                        "address": "0x51469c"
                    },
                    {
                        "name": "CallWindowProcA",
                        "address": "0x5146a0"
                    },
                    {
                        "name": "CallNextHookEx",
                        "address": "0x5146a4"
                    },
                    {
                        "name": "AdjustWindowRectEx",
                        "address": "0x5146a8"
                    },
                    {
                        "name": "GetPropA",
                        "address": "0x5146ac"
                    }
                ],
                "dll": "USER32.dll"
            },
            {
                "imports": [
                    {
                        "name": "SetPixel",
                        "address": "0x5140ac"
                    },
                    {
                        "name": "cGetTTFFromFOT",
                        "address": "0x5140b0"
                    },
                    {
                        "name": "GetTextCharset",
                        "address": "0x5140b4"
                    },
                    {
                        "name": "SwapBuffers",
                        "address": "0x5140b8"
                    },
                    {
                        "name": "DeleteObject",
                        "address": "0x5140bc"
                    },
                    {
                        "name": "CreateSolidBrush",
                        "address": "0x5140c0"
                    },
                    {
                        "name": "SaveDC",
                        "address": "0x5140c4"
                    },
                    {
                        "name": "FlattenPath",
                        "address": "0x5140c8"
                    },
                    {
                        "name": "GdiGetBatchLimit",
                        "address": "0x5140cc"
                    },
                    {
                        "name": "AbortDoc",
                        "address": "0x5140d0"
                    },
                    {
                        "name": "GetStockObject",
                        "address": "0x5140d4"
                    },
                    {
                        "name": "GetLayout",
                        "address": "0x5140d8"
                    },
                    {
                        "name": "GetBkColor",
                        "address": "0x5140dc"
                    },
                    {
                        "name": "GdiFlush",
                        "address": "0x5140e0"
                    },
                    {
                        "name": "CreateHalftonePalette",
                        "address": "0x5140e4"
                    },
                    {
                        "name": "SetMetaRgn",
                        "address": "0x5140e8"
                    },
                    {
                        "name": "GetObjectType",
                        "address": "0x5140ec"
                    },
                    {
                        "name": "GetTextColor",
                        "address": "0x5140f0"
                    },
                    {
                        "name": "GetColorSpace",
                        "address": "0x5140f4"
                    },
                    {
                        "name": "GetPolyFillMode",
                        "address": "0x5140f8"
                    },
                    {
                        "name": "GetGraphicsMode",
                        "address": "0x5140fc"
                    },
                    {
                        "name": "AbortPath",
                        "address": "0x514100"
                    },
                    {
                        "name": "DeleteColorSpace",
                        "address": "0x514104"
                    },
                    {
                        "name": "CreateCompatibleDC",
                        "address": "0x514108"
                    },
                    {
                        "name": "UnrealizeObject",
                        "address": "0x51410c"
                    },
                    {
                        "name": "UpdateColors",
                        "address": "0x514110"
                    },
                    {
                        "name": "CreatePatternBrush",
                        "address": "0x514114"
                    },
                    {
                        "name": "StrokePath",
                        "address": "0x514118"
                    },
                    {
                        "name": "GetTextCharacterExtra",
                        "address": "0x51411c"
                    },
                    {
                        "name": "EndPage",
                        "address": "0x514120"
                    },
                    {
                        "name": "SetGraphicsMode",
                        "address": "0x514124"
                    },
                    {
                        "name": "SelectObject",
                        "address": "0x514128"
                    },
                    {
                        "name": "RemoveFontResourceW",
                        "address": "0x51412c"
                    },
                    {
                        "name": "RemoveFontResourceExA",
                        "address": "0x514130"
                    },
                    {
                        "name": "PolyPolyline",
                        "address": "0x514134"
                    },
                    {
                        "name": "PolyPatBlt",
                        "address": "0x514138"
                    },
                    {
                        "name": "PATHOBJ_vGetBounds",
                        "address": "0x51413c"
                    },
                    {
                        "name": "LPtoDP",
                        "address": "0x514140"
                    },
                    {
                        "name": "GetTextFaceAliasW",
                        "address": "0x514144"
                    },
                    {
                        "name": "GetTextExtentExPointI",
                        "address": "0x514148"
                    },
                    {
                        "name": "GetNearestColor",
                        "address": "0x51414c"
                    },
                    {
                        "name": "GetMiterLimit",
                        "address": "0x514150"
                    },
                    {
                        "name": "GetGlyphOutlineW",
                        "address": "0x514154"
                    },
                    {
                        "name": "GetFontUnicodeRanges",
                        "address": "0x514158"
                    },
                    {
                        "name": "GetDCPenColor",
                        "address": "0x51415c"
                    },
                    {
                        "name": "GetCurrentPositionEx",
                        "address": "0x514160"
                    },
                    {
                        "name": "GetCharWidthFloatW",
                        "address": "0x514164"
                    },
                    {
                        "name": "GetCharABCWidthsA",
                        "address": "0x514168"
                    },
                    {
                        "name": "GdiStartPageEMF",
                        "address": "0x51416c"
                    },
                    {
                        "name": "GdiSetServerAttr",
                        "address": "0x514170"
                    },
                    {
                        "name": "GdiReleaseDC",
                        "address": "0x514174"
                    },
                    {
                        "name": "GdiGetLocalBrush",
                        "address": "0x514178"
                    },
                    {
                        "name": "GdiGetDC",
                        "address": "0x51417c"
                    },
                    {
                        "name": "GdiGetCodePage",
                        "address": "0x514180"
                    },
                    {
                        "name": "GdiEntry4",
                        "address": "0x514184"
                    },
                    {
                        "name": "GdiEndDocEMF",
                        "address": "0x514188"
                    },
                    {
                        "name": "GdiCreateLocalMetaFilePict",
                        "address": "0x51418c"
                    },
                    {
                        "name": "GdiConvertPalette",
                        "address": "0x514190"
                    },
                    {
                        "name": "GdiArtificialDecrementDriver",
                        "address": "0x514194"
                    },
                    {
                        "name": "GdiAddGlsRecord",
                        "address": "0x514198"
                    },
                    {
                        "name": "FontIsLinked",
                        "address": "0x51419c"
                    },
                    {
                        "name": "Escape",
                        "address": "0x5141a0"
                    },
                    {
                        "name": "EnumFontsA",
                        "address": "0x5141a4"
                    },
                    {
                        "name": "EnumFontFamiliesA",
                        "address": "0x5141a8"
                    },
                    {
                        "name": "EngWideCharToMultiByte",
                        "address": "0x5141ac"
                    },
                    {
                        "name": "EngUnlockSurface",
                        "address": "0x5141b0"
                    },
                    {
                        "name": "EngFreeModule",
                        "address": "0x5141b4"
                    },
                    {
                        "name": "EngDeletePath",
                        "address": "0x5141b8"
                    },
                    {
                        "name": "CreateRectRgn",
                        "address": "0x5141bc"
                    },
                    {
                        "name": "CreateColorSpaceW",
                        "address": "0x5141c0"
                    },
                    {
                        "name": "CloseEnhMetaFile",
                        "address": "0x5141c4"
                    },
                    {
                        "name": "GetSystemPaletteUse",
                        "address": "0x5141c8"
                    },
                    {
                        "name": "AddFontResourceW",
                        "address": "0x5141cc"
                    }
                ],
                "dll": "GDI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "StartServiceCtrlDispatcherA",
                        "address": "0x514000"
                    },
                    {
                        "name": "SetServiceStatus",
                        "address": "0x514004"
                    },
                    {
                        "name": "SetSecurityDescriptorOwner",
                        "address": "0x514008"
                    },
                    {
                        "name": "SetSecurityDescriptorGroup",
                        "address": "0x51400c"
                    },
                    {
                        "name": "SetSecurityDescriptorDacl",
                        "address": "0x514010"
                    },
                    {
                        "name": "RevertToSelf",
                        "address": "0x514014"
                    },
                    {
                        "name": "ReportEventA",
                        "address": "0x514018"
                    },
                    {
                        "name": "RegisterServiceCtrlHandlerA",
                        "address": "0x51401c"
                    },
                    {
                        "name": "RegisterEventSourceA",
                        "address": "0x514020"
                    },
                    {
                        "name": "RegSetValueExA",
                        "address": "0x514024"
                    },
                    {
                        "name": "RegQueryValueExA",
                        "address": "0x514028"
                    },
                    {
                        "name": "RegQueryInfoKeyA",
                        "address": "0x51402c"
                    },
                    {
                        "name": "RegOpenKeyExA",
                        "address": "0x514030"
                    },
                    {
                        "name": "RegEnumValueA",
                        "address": "0x514034"
                    },
                    {
                        "name": "RegEnumKeyExA",
                        "address": "0x514038"
                    },
                    {
                        "name": "RegDeleteValueA",
                        "address": "0x51403c"
                    },
                    {
                        "name": "RegDeleteKeyA",
                        "address": "0x514040"
                    },
                    {
                        "name": "RegCreateKeyExA",
                        "address": "0x514044"
                    },
                    {
                        "name": "RegCloseKey",
                        "address": "0x514048"
                    },
                    {
                        "name": "OpenThreadToken",
                        "address": "0x51404c"
                    },
                    {
                        "name": "OpenServiceA",
                        "address": "0x514050"
                    },
                    {
                        "name": "OpenSCManagerA",
                        "address": "0x514054"
                    },
                    {
                        "name": "OpenProcessToken",
                        "address": "0x514058"
                    },
                    {
                        "name": "LookupAccountNameA",
                        "address": "0x51405c"
                    },
                    {
                        "name": "IsValidSid",
                        "address": "0x514060"
                    },
                    {
                        "name": "InitializeSecurityDescriptor",
                        "address": "0x514064"
                    },
                    {
                        "name": "InitializeAcl",
                        "address": "0x514068"
                    },
                    {
                        "name": "ImpersonateLoggedOnUser",
                        "address": "0x51406c"
                    },
                    {
                        "name": "GetUserNameA",
                        "address": "0x514070"
                    },
                    {
                        "name": "GetTokenInformation",
                        "address": "0x514074"
                    },
                    {
                        "name": "GetLengthSid",
                        "address": "0x514078"
                    },
                    {
                        "name": "DuplicateTokenEx",
                        "address": "0x51407c"
                    },
                    {
                        "name": "DeregisterEventSource",
                        "address": "0x514080"
                    },
                    {
                        "name": "DeleteService",
                        "address": "0x514084"
                    },
                    {
                        "name": "CreateServiceA",
                        "address": "0x514088"
                    },
                    {
                        "name": "CreateProcessAsUserA",
                        "address": "0x51408c"
                    },
                    {
                        "name": "CopySid",
                        "address": "0x514090"
                    },
                    {
                        "name": "ControlService",
                        "address": "0x514094"
                    },
                    {
                        "name": "CloseServiceHandle",
                        "address": "0x514098"
                    },
                    {
                        "name": "AddAccessDeniedAce",
                        "address": "0x51409c"
                    },
                    {
                        "name": "AddAccessAllowedAce",
                        "address": "0x5140a0"
                    },
                    {
                        "name": "RegOpenKeyExW",
                        "address": "0x5140a4"
                    }
                ],
                "dll": "ADVAPI32.dll"
            },
            {
                "imports": [
                    {
                        "name": "CoCreateFreeThreadedMarshaler",
                        "address": "0x5146b4"
                    },
                    {
                        "name": "CoCreateInstance",
                        "address": "0x5146b8"
                    },
                    {
                        "name": "CoInitialize",
                        "address": "0x5146bc"
                    },
                    {
                        "name": "CoInitializeSecurity",
                        "address": "0x5146c0"
                    },
                    {
                        "name": "CoRegisterClassObject",
                        "address": "0x5146c4"
                    },
                    {
                        "name": "CoRevokeClassObject",
                        "address": "0x5146c8"
                    },
                    {
                        "name": "CoTaskMemAlloc",
                        "address": "0x5146cc"
                    },
                    {
                        "name": "CoTaskMemFree",
                        "address": "0x5146d0"
                    },
                    {
                        "name": "CoTaskMemRealloc",
                        "address": "0x5146d4"
                    },
                    {
                        "name": "CoUninitialize",
                        "address": "0x5146d8"
                    },
                    {
                        "name": "StringFromGUID2",
                        "address": "0x5146dc"
                    }
                ],
                "dll": "ole32.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x0013b92e",
        "overlay": {
            "size": "0x00000d08",
            "offset": "0x00131800"
        },
        "imagebase": "0x00400000",
        "reported_checksum": "0x00133914",
        "icon_hash": null,
        "entrypoint": "0x00512a90",
        "timestamp": "2019-02-18 04:15:13",
        "osversion": "5.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x00113000",
                "entropy": "7.12",
                "raw_address": "0x00000400",
                "virtual_size": "0x00112e22",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rdata",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00114000",
                "size_of_data": "0x00003600",
                "entropy": "5.57",
                "raw_address": "0x00113400",
                "virtual_size": "0x00003474",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x00118000",
                "size_of_data": "0x00000200",
                "entropy": "2.07",
                "raw_address": "0x00116a00",
                "virtual_size": "0x00000278",
                "characteristics_raw": "0xc0000040"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00119000",
                "size_of_data": "0x0001ac00",
                "entropy": "5.81",
                "raw_address": "0x00116c00",
                "virtual_size": "0x000eeb10",
                "characteristics_raw": "0x40000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00114e3c",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x00000078"
            },
            {
                "virtual_address": "0x00119000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x0001ab10"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00131800",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000d08"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00114000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x000006e4"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "250fa6b5a110a6fd38cdd8f3e98b86de",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 5,
        "versioninfo": []
    }
}