Ursnif_2d5c0c3d093d3c7d7a151ce89f187a37_exe_2019-06-25_23_30.json

[*] MalFamily: ""

[*] MalScore: 10.0

[*] File Name: "Ursnif_2d5c0c3d093d3c7d7a151ce89f187a37.exe"
[*] File Size: 288256
[*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
[*] SHA256: "8f61de611942802f8e8ad70953089e4f300377b9b3c7010e45495ac12c90b2b3"
[*] MD5: "2d5c0c3d093d3c7d7a151ce89f187a37"
[*] SHA1: "69733593128c2e84ab9249759e192f91e8728500"
[*] SHA512: "f4d68adf51d41a505027425701bf0baf455ee4e0ad14886e13062e0c37ae00d936be793f76fa2f17a7f69c48b1734ca105668b0a5a5c4d21a66f83fc688912f5"
[*] CRC32: "F0A5419E"
[*] SSDEEP: "6144:QRctoW0jdluW3jlY0yNicLOCg0Qe1rHv0CgnOf:QRRWUiWzlY0AOCgmHKOf"

[*] Process Execution: [
    "Ursnif_2d5c0c3d093d3c7d7a151ce89f187a37.exe",
    "svchost.exe",
    "WmiPrvSE.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "iexplore.exe",
    "svchost.exe"
]

[*] Signatures Detected: [
    {
        "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
        "Details": [
            {
                "IP": "204.79.197.200:80"
            }
        ]
    },
    {
        "Description": "Creates RWX memory",
        "Details": []
    },
    {
        "Description": "A process attempted to delay the analysis task.",
        "Details": [
            {
                "Process": "WmiPrvSE.exe tried to sleep 300 seconds, actually delayed analysis time by 0 seconds"
            },
            {
                "Process": "Ursnif_2d5c0c3d093d3c7d7a151ce89f187a37.exe tried to sleep 552 seconds, actually delayed analysis time by 0 seconds"
            }
        ]
    },
    {
        "Description": "Performs some HTTP requests",
        "Details": [
            {
                "url": "http://www.bing.com/favicon.ico"
            }
        ]
    },
    {
        "Description": "Crashed cuckoomon during analysis.  Report this error to the Github repo.",
        "Details": [
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x1967e in cuckoomon itself while accessing 0x32d0c4 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x19681 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x19681 in cuckoomon itself while accessing 0x32d0c8 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x19684 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x19684 in cuckoomon itself while accessing 0x32d0c0 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x19687 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x19687 in cuckoomon itself while accessing 0x32d0bc from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x19689 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x19699 in cuckoomon itself while accessing 0x32d0cc from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x1969b in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x1969f in cuckoomon itself while accessing 0x32d0d0 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x196a2 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x196aa in cuckoomon itself while accessing 0x32d0d4 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x196ad in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x196bd in cuckoomon itself while accessing 0x32d0d8 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x196c0 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x19bfc in cuckoomon itself while accessing 0x32d0bc from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x19bfe in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x19bfe in cuckoomon itself while accessing 0x32d0c0 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x19c01 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x19c01 in cuckoomon itself while accessing 0x32d0c4 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x19c04 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x19c04 in cuckoomon itself while accessing 0x32d0c8 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x19c07 in cuckoomon itself while accessing 0x0 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x1967e in cuckoomon itself while accessing 0x32d030 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x19681 in cuckoomon itself while accessing 0x32d034 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x19684 in cuckoomon itself while accessing 0x32d02c from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x19687 in cuckoomon itself while accessing 0x32d028 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x19699 in cuckoomon itself while accessing 0x32d048 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x1969f in cuckoomon itself while accessing 0x32d04c from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x196aa in cuckoomon itself while accessing 0x32d050 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x196bd in cuckoomon itself while accessing 0x32d054 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x19bfc in cuckoomon itself while accessing 0x32d028 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x19bfe in cuckoomon itself while accessing 0x32d02c from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x19c01 in cuckoomon itself while accessing 0x32d030 from hook RtlDispatchException"
            },
            {
                "pid": 2208
            },
            {
                "message": "Exception reported at offset 0x19c04 in cuckoomon itself while accessing 0x32d034 from hook RtlDispatchException"
            }
        ]
    },
    {
        "Description": "Creates a hidden or system file",
        "Details": [
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RFc0c3f6.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RFc12494.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RFc18542.TMP"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RFc1e69c.TMP"
            }
        ]
    },
    {
        "Description": "File has been identified by 12 Antiviruses on VirusTotal as malicious",
        "Details": [
            {
                "APEX": "Malicious"
            },
            {
                "Kaspersky": "UDS:DangerousObject.Multi.Generic"
            },
            {
                "McAfee-GW-Edition": "BehavesLike.Win32.MultiPlug.dh"
            },
            {
                "FireEye": "Generic.mg.2d5c0c3d093d3c7d"
            },
            {
                "SentinelOne": "DFI - Suspicious PE"
            },
            {
                "Microsoft": "Trojan:Win32/Gandcrab.AF"
            },
            {
                "Endgame": "malicious (high confidence)"
            },
            {
                "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
            },
            {
                "Acronis": "suspicious"
            },
            {
                "Rising": "Malware.Heuristic.MLite(100%) (AI-LITE:1SM8evQKqQzNyQNPgNW0zQ)"
            },
            {
                "CrowdStrike": "win/malicious_confidence_80% (D)"
            },
            {
                "Qihoo-360": "HEUR/QVM10.1.1C03.Malware.Gen"
            }
        ]
    },
    {
        "Description": "Attempts to modify proxy settings",
        "Details": []
    }
]

[*] Started Service: []

[*] Executed Commands: [
    "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -secured -Embedding",
    "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -Embedding",
    "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:1388 CREDAT:79873",
    "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:2116 CREDAT:79873",
    "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:1776 CREDAT:79873",
    "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" SCODEF:900 CREDAT:79873"
]

[*] Mutexes: [
    "Local\\_!MSFTHISTORY!_",
    "Local\\c:!users!user!appdata!local!microsoft!windows!temporary internet files!content.ie5!",
    "Local\\c:!users!user!appdata!roaming!microsoft!windows!cookies!",
    "Local\\c:!users!user!appdata!local!microsoft!windows!history!history.ie5!",
    "Local\\WininetStartupMutex",
    "Local\\WininetConnectionMutex",
    "Local\\WininetProxyRegistryMutex",
    "Local\\!IETld!Mutex",
    "Local\\!BrowserEmulation!SharedMemory!Mutex",
    "Local\\ZoneAttributeCacheCounterMutex",
    "Local\\ZonesCacheCounterMutex",
    "Local\\ZonesLockedCacheCounterMutex",
    "ConnHashTable<1388>_HashTable_Mutex",
    "Local\\ZonesCounterMutex",
    "Local\\RSS Eventing Connection Database Mutex 0000056c",
    "Local\\Feed Eventing Shared Memory Mutex S-1-5-21-0000000000-0000000000-0000000000-1000",
    "Local\\c:!users!user!appdata!local!microsoft!feeds cache!",
    "Local\\c:!users!user!appdata!roaming!microsoft!windows!privacie!",
    "ConnHashTable<2116>_HashTable_Mutex",
    "Local\\RSS Eventing Connection Database Mutex 00000844",
    "MSIMGSIZECacheMutex",
    "ConnHashTable<1776>_HashTable_Mutex",
    "Local\\RSS Eventing Connection Database Mutex 000006f0",
    "ConnHashTable<900>_HashTable_Mutex",
    "Local\\RSS Eventing Connection Database Mutex 00000384"
]

[*] Modified Files: [
    "\\??\\PIPE\\samr",
    "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
    "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
    "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{79AA43FF-979B-11E9-8070-18C086CD4729}.dat",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~DF8C8D32D03B9078A9.TMP",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{79AA4400-979B-11E9-8070-18C086CD4729}.dat",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~DF3142E8BA6F9F88B7.TMP",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\favicon[1].ico",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\favicon[2].ico",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\favicon[3].ico",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\favicon[4].ico",
    "\\??\\pipe\\MsFteWds",
    "\\??\\PIPE\\srvsvc",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\YTSQNO18PUEP8WJEJKL7.temp",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RFc0c3f6.TMP",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\dnserror[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\ErrorPageTemplate[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\ErrorPageTemplate[2]",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\errorPageStrings[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\httpErrorPagesScripts[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\httpErrorPagesScripts[2]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\background_gradient[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\noConnect[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\down[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\down[2]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\favcenter[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\tools[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{88F51943-979B-11E9-8070-18C086CD4729}.dat",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~DF39E511A7A965E82E.TMP",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{88F51944-979B-11E9-8070-18C086CD4729}.dat",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~DFDFE5D9621CEE816E.TMP",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\favicon[1].ico",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\favicon[2].ico",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\TPS90482GXGSZXTNEZR5.temp",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RFc12494.TMP",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\dnserror[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\ErrorPageTemplate[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\errorPageStrings[2]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\httpErrorPagesScripts[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\background_gradient[2]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\noConnect[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\down[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\favcenter[2]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\tools[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{97CB1B4D-979B-11E9-8070-18C086CD4729}.dat",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~DFDFB64751E6CE3CF2.TMP",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{97CB1B4E-979B-11E9-8070-18C086CD4729}.dat",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~DF925ED448C8116316.TMP",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\favicon[1].ico",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\favicon[2].ico",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\favicon[3].ico",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\favicon[4].ico",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\EVQSQ5LCDRVNM07V1I3R.temp",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RFc18542.TMP",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\dnserror[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\ErrorPageTemplate[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\errorPageStrings[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\httpErrorPagesScripts[2]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\background_gradient[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\noConnect[2]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\favcenter[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\tools[2]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{A68945D3-979B-11E9-8070-18C086CD4729}.dat",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~DF88DDAEB186C30E07.TMP",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{A68945D4-979B-11E9-8070-18C086CD4729}.dat",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~DF4C965CB0190396BA.TMP",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\favicon[1].ico",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\098KWK0HWVLRG55UXMVD.temp",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RFc1e69c.TMP",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\ErrorPageTemplate[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\errorPageStrings[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\httpErrorPagesScripts[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\noConnect[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\down[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\tools[1]"
]

[*] Deleted Files: [
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RFc0c3f6.TMP",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{79AA4400-979B-11E9-8070-18C086CD4729}.dat",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{79AA43FF-979B-11E9-8070-18C086CD4729}.dat",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\dnserror[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\ErrorPageTemplate[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\errorPageStrings[2]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\httpErrorPagesScripts[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\background_gradient[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\noConnect[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\down[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\favcenter[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\tools[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\favicon[3].png",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RFc12494.TMP",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{88F51944-979B-11E9-8070-18C086CD4729}.dat",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{88F51943-979B-11E9-8070-18C086CD4729}.dat",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\dnserror[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\ErrorPageTemplate[2]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\errorPageStrings[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\httpErrorPagesScripts[2]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\background_gradient[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\noConnect[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\down[2]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\favcenter[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\tools[1]",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RFc18542.TMP",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{97CB1B4E-979B-11E9-8070-18C086CD4729}.dat",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{97CB1B4D-979B-11E9-8070-18C086CD4729}.dat",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\dnserror[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\ErrorPageTemplate[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\errorPageStrings[2]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\httpErrorPagesScripts[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\background_gradient[2]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\down[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\favcenter[2]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\tools[1]",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RFc1e69c.TMP",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{A68945D4-979B-11E9-8070-18C086CD4729}.dat",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{A68945D3-979B-11E9-8070-18C086CD4729}.dat",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\dnserror[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\ErrorPageTemplate[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\errorPageStrings[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\httpErrorPagesScripts[2]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\noConnect[2]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\background_gradient[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\favcenter[1]",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\tools[2]"
]

[*] Modified Registry Keys: [
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
    "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider",
    "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000\\Software\\Microsoft\\Internet Explorer\\Main\\IE10RunOnceLastShown",
    "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000\\Software\\Microsoft\\Internet Explorer\\Main\\IE10RunOnceLastShown_TIMESTAMP",
    "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000\\Software\\Microsoft\\Internet Explorer\\Main\\IE8RunOnceLastShown",
    "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000\\Software\\Microsoft\\Internet Explorer\\Main\\IE8RunOnceLastShown_TIMESTAMP",
    "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000\\Software\\Microsoft\\Internet Explorer\\Main\\Check_Associations",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Settings\\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\\VerCache",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Settings\\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\\VerCache",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Settings\\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}\\VerCache",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\CompatibilityFlags",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\SecuritySafe",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyEnable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\SavedLegacySettings",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\{79AA43FF-979B-11E9-8070-18C086CD4729}",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\{2670000A-7350-4F3C-8081-5663EE0C6C49}\\iexplore\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\{2670000A-7350-4F3C-8081-5663EE0C6C49}\\iexplore\\Count",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\{2670000A-7350-4F3C-8081-5663EE0C6C49}\\iexplore\\Time",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\\iexplore\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\\iexplore\\Count",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\\iexplore\\Time",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\\iexplore\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\\iexplore\\Count",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\\iexplore\\Time",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FullScreen",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder\\Favorites\\Links\\Order",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\\iexplore\\LoadTime",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\\iexplore\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\\iexplore\\Count",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\\iexplore\\Time",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\\iexplore\\LoadTime",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}\\iexplore\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}\\iexplore\\Count",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}\\iexplore\\Time",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}\\iexplore\\LoadTime",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\{88F51943-979B-11E9-8070-18C086CD4729}",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\{97CB1B4D-979B-11E9-8070-18C086CD4729}",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\{A68945D3-979B-11E9-8070-18C086CD4729}"
]

[*] Deleted Registry Keys: [
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyOverride",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\{79AA43FF-979B-11E9-8070-18C086CD4729}",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LowRegistry\\AddToFavoritesInitialSelection",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LowRegistry\\AddToFeedsInitialSelection",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\{88F51943-979B-11E9-8070-18C086CD4729}",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\{97CB1B4D-979B-11E9-8070-18C086CD4729}",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery\\AdminActive\\{A68945D3-979B-11E9-8070-18C086CD4729}"
]

[*] DNS Communications: [
    {
        "type": "A",
        "request": "www.bing.com",
        "answers": [
            {
                "data": "dual-a-0001.a-msedge.net",
                "type": "CNAME"
            },
            {
                "data": "a-0001.a-afdentry.net.trafficmanager.net",
                "type": "CNAME"
            },
            {
                "data": "204.79.197.200",
                "type": "A"
            },
            {
                "data": "13.107.21.200",
                "type": "A"
            }
        ]
    },
    {
        "type": "A",
        "request": "velooiisd.club",
        "answers": [
            {
                "data": "",
                "type": "NXDOMAIN"
            }
        ]
    }
]

[*] Domains: [
    {
        "ip": "13.107.21.200",
        "domain": "www.bing.com"
    },
    {
        "ip": "",
        "domain": "velooiisd.club"
    }
]

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: [
    {
        "count": 4,
        "body": "",
        "uri": "http://www.bing.com/favicon.ico",
        "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
        "method": "GET",
        "host": "www.bing.com",
        "version": "1.1",
        "path": "/favicon.ico",
        "data": "GET /favicon.ico HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: www.bing.com\r\nConnection: Keep-Alive\r\nCookie: MUID=055643067C21678412144E247D39664A; SRCHD=AF=NOFORM; SRCHUID=V=2&GUID=5262DC06BBB54635AC9D8A0AD382875E&dmnchg=1; SRCHUSR=DOB=20190317\r\n\r\n",
        "port": 80
    }
]

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "lstrlenA",
                        "address": "0x425000"
                    },
                    {
                        "name": "DebugActiveProcessStop",
                        "address": "0x425004"
                    },
                    {
                        "name": "GetTickCount",
                        "address": "0x425008"
                    },
                    {
                        "name": "GetNumberFormatA",
                        "address": "0x42500c"
                    },
                    {
                        "name": "GetBinaryTypeW",
                        "address": "0x425010"
                    },
                    {
                        "name": "GetLastError",
                        "address": "0x425014"
                    },
                    {
                        "name": "PeekConsoleInputW",
                        "address": "0x425018"
                    },
                    {
                        "name": "GetNumaHighestNodeNumber",
                        "address": "0x42501c"
                    },
                    {
                        "name": "LocalAlloc",
                        "address": "0x425020"
                    },
                    {
                        "name": "VirtualProtect",
                        "address": "0x425024"
                    },
                    {
                        "name": "CreateToolhelp32Snapshot",
                        "address": "0x425028"
                    },
                    {
                        "name": "DuplicateHandle",
                        "address": "0x42502c"
                    },
                    {
                        "name": "EncodePointer",
                        "address": "0x425030"
                    },
                    {
                        "name": "DecodePointer",
                        "address": "0x425034"
                    },
                    {
                        "name": "GetCommandLineW",
                        "address": "0x425038"
                    },
                    {
                        "name": "RaiseException",
                        "address": "0x42503c"
                    },
                    {
                        "name": "RtlUnwind",
                        "address": "0x425040"
                    },
                    {
                        "name": "IsDebuggerPresent",
                        "address": "0x425044"
                    },
                    {
                        "name": "IsProcessorFeaturePresent",
                        "address": "0x425048"
                    },
                    {
                        "name": "EnterCriticalSection",
                        "address": "0x42504c"
                    },
                    {
                        "name": "LeaveCriticalSection",
                        "address": "0x425050"
                    },
                    {
                        "name": "FlushFileBuffers",
                        "address": "0x425054"
                    },
                    {
                        "name": "WriteFile",
                        "address": "0x425058"
                    },
                    {
                        "name": "WideCharToMultiByte",
                        "address": "0x42505c"
                    },
                    {
                        "name": "GetConsoleCP",
                        "address": "0x425060"
                    },
                    {
                        "name": "GetConsoleMode",
                        "address": "0x425064"
                    },
                    {
                        "name": "DeleteCriticalSection",
                        "address": "0x425068"
                    },
                    {
                        "name": "FatalAppExitA",
                        "address": "0x42506c"
                    },
                    {
                        "name": "ExitProcess",
                        "address": "0x425070"
                    },
                    {
                        "name": "GetModuleHandleExW",
                        "address": "0x425074"
                    },
                    {
                        "name": "GetProcAddress",
                        "address": "0x425078"
                    },
                    {
                        "name": "AreFileApisANSI",
                        "address": "0x42507c"
                    },
                    {
                        "name": "MultiByteToWideChar",
                        "address": "0x425080"
                    },
                    {
                        "name": "HeapSize",
                        "address": "0x425084"
                    },
                    {
                        "name": "ReadFile",
                        "address": "0x425088"
                    },
                    {
                        "name": "ReadConsoleW",
                        "address": "0x42508c"
                    },
                    {
                        "name": "HeapFree",
                        "address": "0x425090"
                    },
                    {
                        "name": "HeapAlloc",
                        "address": "0x425094"
                    },
                    {
                        "name": "SetLastError",
                        "address": "0x425098"
                    },
                    {
                        "name": "GetCurrentThread",
                        "address": "0x42509c"
                    },
                    {
                        "name": "GetCurrentThreadId",
                        "address": "0x4250a0"
                    },
                    {
                        "name": "GetProcessHeap",
                        "address": "0x4250a4"
                    },
                    {
                        "name": "GetStdHandle",
                        "address": "0x4250a8"
                    },
                    {
                        "name": "GetFileType",
                        "address": "0x4250ac"
                    },
                    {
                        "name": "GetStartupInfoW",
                        "address": "0x4250b0"
                    },
                    {
                        "name": "GetModuleFileNameW",
                        "address": "0x4250b4"
                    },
                    {
                        "name": "QueryPerformanceCounter",
                        "address": "0x4250b8"
                    },
                    {
                        "name": "GetCurrentProcessId",
                        "address": "0x4250bc"
                    },
                    {
                        "name": "GetSystemTimeAsFileTime",
                        "address": "0x4250c0"
                    },
                    {
                        "name": "GetEnvironmentStringsW",
                        "address": "0x4250c4"
                    },
                    {
                        "name": "FreeEnvironmentStringsW",
                        "address": "0x4250c8"
                    },
                    {
                        "name": "UnhandledExceptionFilter",
                        "address": "0x4250cc"
                    },
                    {
                        "name": "SetUnhandledExceptionFilter",
                        "address": "0x4250d0"
                    },
                    {
                        "name": "InitializeCriticalSectionAndSpinCount",
                        "address": "0x4250d4"
                    },
                    {
                        "name": "CreateEventW",
                        "address": "0x4250d8"
                    },
                    {
                        "name": "Sleep",
                        "address": "0x4250dc"
                    },
                    {
                        "name": "GetCurrentProcess",
                        "address": "0x4250e0"
                    },
                    {
                        "name": "TerminateProcess",
                        "address": "0x4250e4"
                    },
                    {
                        "name": "TlsAlloc",
                        "address": "0x4250e8"
                    },
                    {
                        "name": "TlsGetValue",
                        "address": "0x4250ec"
                    },
                    {
                        "name": "TlsSetValue",
                        "address": "0x4250f0"
                    },
                    {
                        "name": "TlsFree",
                        "address": "0x4250f4"
                    },
                    {
                        "name": "GetModuleHandleW",
                        "address": "0x4250f8"
                    },
                    {
                        "name": "CreateSemaphoreW",
                        "address": "0x4250fc"
                    },
                    {
                        "name": "SetStdHandle",
                        "address": "0x425100"
                    },
                    {
                        "name": "SetFilePointerEx",
                        "address": "0x425104"
                    },
                    {
                        "name": "WriteConsoleW",
                        "address": "0x425108"
                    },
                    {
                        "name": "SetConsoleCtrlHandler",
                        "address": "0x42510c"
                    },
                    {
                        "name": "FreeLibrary",
                        "address": "0x425110"
                    },
                    {
                        "name": "LoadLibraryExW",
                        "address": "0x425114"
                    },
                    {
                        "name": "IsValidCodePage",
                        "address": "0x425118"
                    },
                    {
                        "name": "GetACP",
                        "address": "0x42511c"
                    },
                    {
                        "name": "GetOEMCP",
                        "address": "0x425120"
                    },
                    {
                        "name": "GetCPInfo",
                        "address": "0x425124"
                    },
                    {
                        "name": "HeapReAlloc",
                        "address": "0x425128"
                    },
                    {
                        "name": "GetDateFormatW",
                        "address": "0x42512c"
                    },
                    {
                        "name": "GetTimeFormatW",
                        "address": "0x425130"
                    },
                    {
                        "name": "CompareStringW",
                        "address": "0x425134"
                    },
                    {
                        "name": "LCMapStringW",
                        "address": "0x425138"
                    },
                    {
                        "name": "GetLocaleInfoW",
                        "address": "0x42513c"
                    },
                    {
                        "name": "IsValidLocale",
                        "address": "0x425140"
                    },
                    {
                        "name": "GetUserDefaultLCID",
                        "address": "0x425144"
                    },
                    {
                        "name": "EnumSystemLocalesW",
                        "address": "0x425148"
                    },
                    {
                        "name": "OutputDebugStringW",
                        "address": "0x42514c"
                    },
                    {
                        "name": "GetStringTypeW",
                        "address": "0x425150"
                    },
                    {
                        "name": "CreateFileW",
                        "address": "0x425154"
                    },
                    {
                        "name": "CloseHandle",
                        "address": "0x425158"
                    }
                ],
                "dll": "KERNEL32.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x0004f44a",
        "overlay": null,
        "imagebase": "0x00400000",
        "reported_checksum": "0x0004f44a",
        "icon_hash": null,
        "entrypoint": "0x00403d1a",
        "timestamp": "2018-08-29 16:33:01",
        "osversion": "5.1",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x00023800",
                "entropy": "6.67",
                "raw_address": "0x00000400",
                "virtual_size": "0x0002372d",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rdata",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00025000",
                "size_of_data": "0x0001c200",
                "entropy": "6.43",
                "raw_address": "0x00023c00",
                "virtual_size": "0x0001c138",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x00042000",
                "size_of_data": "0x00001e00",
                "entropy": "3.08",
                "raw_address": "0x0003fe00",
                "virtual_size": "0x04e5ebec",
                "characteristics_raw": "0xc0000040"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x04ea1000",
                "size_of_data": "0x00002800",
                "entropy": "4.75",
                "raw_address": "0x00041c00",
                "virtual_size": "0x00002660",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".reloc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x04ea4000",
                "size_of_data": "0x00002200",
                "entropy": "6.51",
                "raw_address": "0x00044400",
                "virtual_size": "0x00002034",
                "characteristics_raw": "0x42000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00040958",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x00000028"
            },
            {
                "virtual_address": "0x04ea1000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x00002660"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x04ea4000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00002034"
            },
            {
                "virtual_address": "0x000251c0",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000038"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00025000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000160"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "b8eb963f1b0540e4925f622d0a8adba1",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": "C:\\tasani100_zebarogomomibogehuc\\cas40_hujugibulokone gelugivipanasa.pdb",
        "imported_dll_count": 1,
        "versioninfo": []
    }
}

[*] Resolved APIs: [
    "kernel32.dll.FlsAlloc",
    "kernel32.dll.FlsFree",
    "kernel32.dll.FlsGetValue",
    "kernel32.dll.FlsSetValue",
    "kernel32.dll.InitializeCriticalSectionEx",
    "kernel32.dll.CreateEventExW",
    "kernel32.dll.CreateSemaphoreExW",
    "kernel32.dll.SetThreadStackGuarantee",
    "kernel32.dll.CreateThreadpoolTimer",
    "kernel32.dll.SetThreadpoolTimer",
    "kernel32.dll.WaitForThreadpoolTimerCallbacks",
    "kernel32.dll.CloseThreadpoolTimer",
    "kernel32.dll.CreateThreadpoolWait",
    "kernel32.dll.SetThreadpoolWait",
    "kernel32.dll.CloseThreadpoolWait",
    "kernel32.dll.FlushProcessWriteBuffers",
    "kernel32.dll.FreeLibraryWhenCallbackReturns",
    "kernel32.dll.GetCurrentProcessorNumber",
    "kernel32.dll.GetLogicalProcessorInformation",
    "kernel32.dll.CreateSymbolicLinkW",
    "kernel32.dll.EnumSystemLocalesEx",
    "kernel32.dll.CompareStringEx",
    "kernel32.dll.GetDateFormatEx",
    "kernel32.dll.GetLocaleInfoEx",
    "kernel32.dll.GetTimeFormatEx",
    "kernel32.dll.GetUserDefaultLocaleName",
    "kernel32.dll.IsValidLocaleName",
    "kernel32.dll.LCMapStringEx",
    "kernel32.dll.GetTickCount64",
    "kernel32.dll.GlobalAlloc",
    "kernel32.dll.GetLastError",
    "kernel32.dll.Sleep",
    "kernel32.dll.CreateToolhelp32Snapshot",
    "kernel32.dll.Module32First",
    "kernel32.dll.CloseHandle",
    "kernel32.dll.LoadLibraryA",
    "kernel32.dll.VirtualAlloc",
    "kernel32.dll.VirtualProtect",
    "kernel32.dll.VirtualFree",
    "kernel32.dll.GetVersionExA",
    "kernel32.dll.TerminateProcess",
    "kernel32.dll.ExitProcess",
    "kernel32.dll.SetErrorMode",
    "kernel32.dll.GetModuleHandleA",
    "kernel32.dll.GetCommandLineW",
    "kernel32.dll.HeapDestroy",
    "kernel32.dll.HeapCreate",
    "kernel32.dll.AddVectoredExceptionHandler",
    "kernel32.dll.RemoveVectoredExceptionHandler",
    "kernel32.dll.lstrlenW",
    "kernel32.dll.MapViewOfFile",
    "kernel32.dll.UnmapViewOfFile",
    "kernel32.dll.GetCurrentProcessId",
    "kernel32.dll.lstrcpyW",
    "kernel32.dll.HeapAlloc",
    "kernel32.dll.HeapFree",
    "kernel32.dll.CreateFileMappingW",
    "kernel32.dll.TlsGetValue",
    "kernel32.dll.GetModuleFileNameW",
    "kernel32.dll.OpenProcess",
    "kernel32.dll.GetVersion",
    "kernel32.dll.CreateEventA",
    "kernel32.dll.GetLongPathNameW",
    "kernel32.dll.lstrlenA",
    "kernel32.dll.GetProcAddress",
    "kernel32.dll.DeleteCriticalSection",
    "kernel32.dll.InitializeCriticalSection",
    "kernel32.dll.TlsAlloc",
    "kernel32.dll.TlsSetValue",
    "kernel32.dll.TlsFree",
    "kernel32.dll.LeaveCriticalSection",
    "kernel32.dll.EnterCriticalSection",
    "user32.dll.wsprintfW",
    "ntdll.dll.memcpy",
    "ntdll.dll.memset",
    "msvcr100.dll.atexit",
    "ntdll.dll.ZwQueryInformationToken",
    "ntdll.dll.wcstombs",
    "ntdll.dll.ZwOpenProcessToken",
    "ntdll.dll.ZwOpenProcess",
    "ntdll.dll.ZwClose",
    "ntdll.dll.strcpy",
    "ntdll.dll.mbstowcs",
    "ntdll.dll._snprintf",
    "ntdll.dll.sprintf",
    "ntdll.dll._aulldiv",
    "ntdll.dll._allmul",
    "ntdll.dll.RtlUnwind",
    "ntdll.dll.NtQueryVirtualMemory",
    "kernel32.dll.InterlockedExchange",
    "kernel32.dll.LocalAlloc",
    "kernel32.dll.InterlockedIncrement",
    "kernel32.dll.InterlockedDecrement",
    "kernel32.dll.SetEvent",
    "kernel32.dll.GetTickCount",
    "kernel32.dll.WaitForSingleObject",
    "kernel32.dll.SleepEx",
    "kernel32.dll.CreateWaitableTimerA",
    "kernel32.dll.lstrcpyA",
    "kernel32.dll.GetSystemTimeAsFileTime",
    "kernel32.dll.SetWaitableTimer",
    "kernel32.dll.WaitForMultipleObjects",
    "kernel32.dll.OpenFileMappingW",
    "kernel32.dll.lstrcmpW",
    "kernel32.dll.ResetEvent",
    "kernel32.dll.GetComputerNameW",
    "kernel32.dll.FreeLibrary",
    "kernel32.dll.GetFileTime",
    "kernel32.dll.FindNextFileA",
    "kernel32.dll.CompareFileTime",
    "kernel32.dll.FindClose",
    "kernel32.dll.QueryPerformanceCounter",
    "kernel32.dll.CreateFileA",
    "kernel32.dll.lstrcatA",
    "kernel32.dll.QueryPerformanceFrequency",
    "kernel32.dll.lstrcmpA",
    "kernel32.dll.ExpandEnvironmentStringsA",
    "kernel32.dll.FindFirstFileA",
    "kernel32.dll.RaiseException",
    "oleaut32.dll.#2",
    "oleaut32.dll.#16",
    "oleaut32.dll.#15",
    "oleaut32.dll.#6",
    "kernel32.dll.IsWow64Process",
    "ole32.dll.CoInitializeEx",
    "cryptbase.dll.SystemFunction036",
    "uxtheme.dll.ThemeInitApiHook",
    "user32.dll.IsProcessDPIAware",
    "user32.dll.wsprintfA",
    "advapi32.dll.GetUserNameW",
    "shlwapi.dll.StrToIntExA",
    "shlwapi.dll.StrChrA",
    "shlwapi.dll.StrTrimA",
    "ole32.dll.CoCreateInstance",
    "kernel32.dll.GetThreadPreferredUILanguages",
    "kernel32.dll.SetThreadPreferredUILanguages",
    "kernel32.dll.LocaleNameToLCID",
    "kernel32.dll.LCIDToLocaleName",
    "kernel32.dll.GetSystemDefaultLocaleName",
    "ole32.dll.CoSetProxyBlanket",
    "oleaut32.dll.#283",
    "oleaut32.dll.#284",
    "kernel32.dll.RegOpenKeyExW",
    "oleaut32.dll.BSTR_UserSize",
    "oleaut32.dll.BSTR_UserMarshal",
    "oleaut32.dll.BSTR_UserUnmarshal",
    "oleaut32.dll.BSTR_UserFree",
    "oleaut32.dll.VARIANT_UserSize",
    "oleaut32.dll.VARIANT_UserMarshal",
    "oleaut32.dll.VARIANT_UserUnmarshal",
    "oleaut32.dll.VARIANT_UserFree",
    "oleaut32.dll.LPSAFEARRAY_UserSize",
    "oleaut32.dll.LPSAFEARRAY_UserMarshal",
    "oleaut32.dll.LPSAFEARRAY_UserUnmarshal",
    "oleaut32.dll.LPSAFEARRAY_UserFree",
    "shlwapi.dll.StrStrIW",
    "ole32.dll.CoGetClassObject",
    "ole32.dll.CoGetMarshalSizeMax",
    "ole32.dll.CoMarshalInterface",
    "ole32.dll.CoUnmarshalInterface",
    "ole32.dll.StringFromIID",
    "ole32.dll.CoGetPSClsid",
    "ole32.dll.CoTaskMemAlloc",
    "ole32.dll.CoTaskMemFree",
    "ole32.dll.CoReleaseMarshalData",
    "ole32.dll.DcomChannelSetHResult",
    "vssapi.dll.CreateWriter",
    "advapi32.dll.LookupAccountNameW",
    "sechost.dll.LookupAccountNameLocalW",
    "advapi32.dll.LookupAccountSidW",
    "samcli.dll.NetLocalGroupGetMembers",
    "samlib.dll.SamConnect",
    "rpcrt4.dll.NdrClientCall3",
    "rpcrt4.dll.RpcStringBindingComposeW",
    "rpcrt4.dll.RpcBindingFromStringBindingW",
    "rpcrt4.dll.RpcStringFreeW",
    "rpcrt4.dll.RpcBindingFree",
    "samlib.dll.SamOpenDomain",
    "samlib.dll.SamLookupNamesInDomain",
    "samlib.dll.SamOpenAlias",
    "samlib.dll.SamFreeMemory",
    "samlib.dll.SamCloseHandle",
    "samlib.dll.SamGetMembersInAlias",
    "netutils.dll.NetApiBufferFree",
    "ole32.dll.CoCreateGuid",
    "ole32.dll.StringFromCLSID",
    "oleaut32.dll.#4",
    "oleaut32.dll.#7",
    "propsys.dll.VariantToPropVariant",
    "wbemcore.dll.Reinitialize",
    "wbemsvc.dll.DllGetClassObject",
    "wbemsvc.dll.DllCanUnloadNow",
    "authz.dll.AuthzInitializeContextFromToken",
    "authz.dll.AuthzInitializeObjectAccessAuditEvent2",
    "authz.dll.AuthzAccessCheck",
    "authz.dll.AuthzFreeAuditEvent",
    "authz.dll.AuthzFreeContext",
    "authz.dll.AuthzInitializeResourceManager",
    "authz.dll.AuthzFreeResourceManager",
    "rpcrt4.dll.RpcBindingCreateW",
    "rpcrt4.dll.RpcBindingBind",
    "rpcrt4.dll.I_RpcMapWin32Status",
    "advapi32.dll.EventRegister",
    "advapi32.dll.EventUnregister",
    "advapi32.dll.EventWrite",
    "kernel32.dll.RegCloseKey",
    "kernel32.dll.RegSetValueExW",
    "kernel32.dll.RegQueryValueExW",
    "wmisvc.dll.IsImproperShutdownDetected",
    "wevtapi.dll.EvtRender",
    "wevtapi.dll.EvtNext",
    "wevtapi.dll.EvtClose",
    "wevtapi.dll.EvtQuery",
    "wevtapi.dll.EvtCreateRenderContext",
    "rpcrt4.dll.RpcBindingSetAuthInfoExW",
    "rpcrt4.dll.RpcBindingSetOption",
    "ole32.dll.CoCreateFreeThreadedMarshaler",
    "ole32.dll.CreateStreamOnHGlobal",
    "advapi32.dll.RegCreateKeyExW",
    "advapi32.dll.RegSetValueExW",
    "cryptsp.dll.CryptAcquireContextW",
    "cryptsp.dll.CryptGenRandom",
    "cryptsp.dll.CryptReleaseContext",
    "kernelbase.dll.InitializeAcl",
    "kernelbase.dll.AddAce",
    "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
    "kernel32.dll.IsThreadAFiber",
    "kernel32.dll.OpenProcessToken",
    "kernelbase.dll.GetTokenInformation",
    "kernelbase.dll.DuplicateTokenEx",
    "kernelbase.dll.AdjustTokenPrivileges",
    "sechost.dll.LookupAccountSidLocalW",
    "kernelbase.dll.AllocateAndInitializeSid",
    "kernelbase.dll.CheckTokenMembership",
    "kernel32.dll.SetThreadToken",
    "oleaut32.dll.#285",
    "advapi32.dll.RegOpenKeyW",
    "oleaut32.dll.#12",
    "oleaut32.dll.#286",
    "ole32.dll.CLSIDFromString",
    "oleaut32.dll.#17",
    "oleaut32.dll.#20",
    "oleaut32.dll.#19",
    "oleaut32.dll.#25",
    "ole32.dll.CoRevertToSelf",
    "advapi32.dll.LogonUserExExW",
    "sspicli.dll.LogonUserExExW",
    "authz.dll.AuthzInitializeContextFromSid",
    "ole32.dll.CoGetCallContext",
    "ole32.dll.CoImpersonateClient",
    "advapi32.dll.OpenThreadToken",
    "oleaut32.dll.#8",
    "oleaut32.dll.#9",
    "ole32.dll.CoSwitchCallContext",
    "oleaut32.dll.#500",
    "ole32.dll.CoUninitialize",
    "kernel32.dll.SortGetHandle",
    "kernel32.dll.SortCloseHandle",
    "ntmarta.dll.GetMartaExtensionInterface",
    "sechost.dll.ConvertSidToStringSidW",
    "kernel32.dll.InitializeSRWLock",
    "kernel32.dll.AcquireSRWLockExclusive",
    "kernel32.dll.AcquireSRWLockShared",
    "kernel32.dll.ReleaseSRWLockExclusive",
    "kernel32.dll.ReleaseSRWLockShared",
    "kernel32.dll.SetProcessDEPPolicy",
    "user32.dll.SetProcessDPIAware",
    "shell32.dll.SetCurrentProcessExplicitAppUserModelID",
    "user32.dll.GetShellWindow",
    "user32.dll.GetWindowThreadProcessId",
    "ieframe.dll.#250",
    "wininet.dll.InternetQueryOptionW",
    "advapi32.dll.EventActivityIdControl",
    "advapi32.dll.EventWriteTransfer",
    "kernel32.dll.SetFileInformationByHandle",
    "shell32.dll.SHGetFolderPathW",
    "kernel32.dll.GetModuleHandleW",
    "advapi32.dll.AddMandatoryAce",
    "ws2_32.dll.accept",
    "ws2_32.dll.bind",
    "ws2_32.dll.closesocket",
    "ws2_32.dll.connect",
    "ws2_32.dll.getpeername",
    "ws2_32.dll.getsockname",
    "ws2_32.dll.getsockopt",
    "ws2_32.dll.ntohl",
    "ws2_32.dll.htonl",
    "ws2_32.dll.htons",
    "ws2_32.dll.inet_addr",
    "ws2_32.dll.inet_ntoa",
    "ws2_32.dll.ioctlsocket",
    "ws2_32.dll.listen",
    "ws2_32.dll.ntohs",
    "ws2_32.dll.recv",
    "ws2_32.dll.recvfrom",
    "ws2_32.dll.select",
    "ws2_32.dll.send",
    "ws2_32.dll.sendto",
    "ws2_32.dll.setsockopt",
    "ws2_32.dll.shutdown",
    "ws2_32.dll.socket",
    "ws2_32.dll.gethostbyname",
    "ws2_32.dll.gethostname",
    "ws2_32.dll.WSAIoctl",
    "ws2_32.dll.WSAGetLastError",
    "ws2_32.dll.WSASetLastError",
    "ws2_32.dll.WSAStartup",
    "ws2_32.dll.WSACleanup",
    "ws2_32.dll.__WSAFDIsSet",
    "ws2_32.dll.getaddrinfo",
    "ws2_32.dll.freeaddrinfo",
    "ws2_32.dll.getnameinfo",
    "ws2_32.dll.WSALookupServiceBeginW",
    "ws2_32.dll.WSALookupServiceNextW",
    "ws2_32.dll.WSALookupServiceEnd",
    "ws2_32.dll.WSANSPIoctl",
    "ws2_32.dll.WSAStringToAddressA",
    "ws2_32.dll.WSAStringToAddressW",
    "ws2_32.dll.WSAAddressToStringA",
    "dnsapi.dll.DnsGetProxyInformation",
    "dnsapi.dll.DnsFreeProxyName",
    "iphlpapi.dll.GetIpForwardTable2",
    "iphlpapi.dll.FreeMibTable",
    "iphlpapi.dll.GetIfEntry2",
    "iphlpapi.dll.ConvertInterfaceGuidToLuid",
    "iphlpapi.dll.ResolveIpNetEntry2",
    "iphlpapi.dll.GetIpNetEntry2",
    "shlwapi.dll.#260",
    "ws2_32.dll.#115",
    "urlmon.dll.CreateUri",
    "version.dll.GetFileVersionInfoSizeW",
    "version.dll.GetFileVersionInfoW",
    "version.dll.VerQueryValueW",
    "comctl32.dll.PropertySheetW",
    "comctl32.dll.PropertySheetA",
    "comdlg32.dll.PageSetupDlgW",
    "comdlg32.dll.PrintDlgW",
    "ws2_32.dll.GetAddrInfoW",
    "urlmon.dll.#101",
    "urlmon.dll.#400",
    "advapi32.dll.TraceMessage",
    "advapi32.dll.TraceMessageVa",
    "sqmapi.dll.SqmGetSession",
    "sqmapi.dll.SqmEndSession",
    "sqmapi.dll.SqmStartSession",
    "sqmapi.dll.SqmStartUpload",
    "sqmapi.dll.SqmWaitForUploadComplete",
    "sqmapi.dll.SqmSet",
    "sqmapi.dll.SqmSetBool",
    "sqmapi.dll.SqmSetBits",
    "sqmapi.dll.SqmSetString",
    "sqmapi.dll.SqmIncrement",
    "sqmapi.dll.SqmSetIfMax",
    "sqmapi.dll.SqmSetIfMin",
    "sqmapi.dll.SqmAddToAverage",
    "sqmapi.dll.SqmAddToStreamDWord",
    "sqmapi.dll.SqmAddToStreamString",
    "sqmapi.dll.SqmSetAppId",
    "sqmapi.dll.SqmSetAppVersion",
    "sqmapi.dll.SqmSetMachineId",
    "sqmapi.dll.SqmSetUserId",
    "sqmapi.dll.SqmCreateNewId",
    "sqmapi.dll.SqmReadSharedMachineId",
    "sqmapi.dll.SqmReadSharedUserId",
    "sqmapi.dll.SqmWriteSharedMachineId",
    "sqmapi.dll.SqmWriteSharedUserId",
    "sqmapi.dll.SqmIsWindowsOptedIn",
    "urlmon.dll.#442",
    "kernel32.dll.WerRegisterMemoryBlock",
    "kernel32.dll.WerUnregisterMemoryBlock",
    "user32.dll.RegisterWindowMessageW",
    "rpcrt4.dll.UuidCreateSequential",
    "rpcrt4.dll.RpcServerUseProtseqW",
    "rpcrt4.dll.RpcServerRegisterIfEx",
    "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
    "rpcrt4.dll.RpcServerInqBindings",
    "rpcrt4.dll.RpcEpRegisterW",
    "rpcrt4.dll.RpcServerListen",
    "ntdll.dll.NtQuerySystemInformation",
    "user32.dll.RegisterClassExW",
    "user32.dll.CreateWindowExW",
    "user32.dll.DefWindowProcW",
    "user32.dll.SetWindowLongW",
    "dwmapi.dll.DwmIsCompositionEnabled",
    "urlmon.dll.#416",
    "kernel32.dll.RegisterApplicationRestart",
    "shell32.dll.#165",
    "ws2_32.dll.FreeAddrInfoW",
    "urlmon.dll.CoInternetCreateZoneManager",
    "user32.dll.AllowSetForegroundWindow",
    "wininet.dll.InternetInitializeAutoProxyDll",
    "rasapi32.dll.RasEnumEntriesW",
    "rasapi32.dll.RasConnectionNotificationW",
    "rtutils.dll.TraceRegisterExA",
    "rtutils.dll.TracePrintfExA",
    "profapi.dll.#104",
    "shlwapi.dll.PathCanonicalizeW",
    "shlwapi.dll.PathRemoveFileSpecW",
    "shlwapi.dll.PathFindFileNameW",
    "sensapi.dll.IsNetworkAlive",
    "rpcrt4.dll.NdrClientCall2",
    "sechost.dll.NotifyServiceStatusChangeA",
    "nlaapi.dll.NSPStartup",
    "iphlpapi.dll.GetAdapterIndex",
    "user32.dll.PostThreadMessageW",
    "comctl32.dll.LoadIconWithScaleDown",
    "ieui.dll.InitGadgets",
    "ieproxy.dll.DllGetClassObject",
    "ieproxy.dll.DllCanUnloadNow",
    "user32.dll.MsgWaitForMultipleObjectsEx",
    "gdi32.dll.GetLayout",
    "gdi32.dll.GdiRealizationInfo",
    "gdi32.dll.FontIsLinked",
    "advapi32.dll.RegOpenKeyExW",
    "advapi32.dll.RegQueryInfoKeyW",
    "gdi32.dll.GetTextFaceAliasW",
    "advapi32.dll.RegEnumValueW",
    "advapi32.dll.RegCloseKey",
    "advapi32.dll.RegQueryValueExW",
    "gdi32.dll.GetFontAssocStatus",
    "advapi32.dll.RegQueryValueExA",
    "advapi32.dll.RegEnumKeyExW",
    "gdi32.dll.GdiIsMetaPrintDC",
    "uxtheme.dll.OpenThemeData",
    "uxtheme.dll.GetThemeMargins",
    "uxtheme.dll.GetThemePartSize",
    "uxtheme.dll.GetThemeTextMetrics",
    "uxtheme.dll.GetThemeBool",
    "comctl32.dll.#410",
    "comctl32.dll.#413",
    "uxtheme.dll.IsAppThemed",
    "uxtheme.dll.GetThemeBackgroundExtent",
    "comctl32.dll.ImageList_LoadImageW",
    "comctl32.dll.ImageList_GetIconSize",
    "uxtheme.dll.GetThemeFont",
    "uxtheme.dll.IsCompositionActive",
    "uxtheme.dll.SetWindowTheme",
    "comctl32.dll.ImageList_Create",
    "comctl32.dll.ImageList_ReplaceIcon",
    "oleaut32.dll.#10",
    "comctl32.dll.ImageList_AddMasked",
    "uxtheme.dll.IsThemePartDefined",
    "uxtheme.dll.GetThemeColor",
    "imm32.dll.ImmIsIME",
    "urlmon.dll.CoInternetCreateSecurityManager",
    "msctf.dll.SetInputScopes2",
    "uxtheme.dll.CloseThemeData",
    "uxtheme.dll.GetThemeBackgroundContentRect",
    "uxtheme.dll.GetThemeTextExtent",
    "uxtheme.dll.EnableThemeDialogTexture",
    "urlmon.dll.#408",
    "uxtheme.dll.IsThemeActive",
    "ole32.dll.CreateBindCtx",
    "ole32.dll.CoGetApartmentType",
    "ole32.dll.CoRegisterInitializeSpy",
    "ieui.dll.CreateGadget",
    "ieui.dll.SetGadgetMessageFilter",
    "ieui.dll.SetGadgetStyle",
    "ieui.dll.SetGadgetRootInfo",
    "comctl32.dll.#236",
    "ole32.dll.CoGetMalloc",
    "comctl32.dll.#320",
    "uxtheme.dll.GetThemeAppProperties",
    "xmllite.dll.CreateXmlReader",
    "xmllite.dll.CreateXmlReaderInputWithEncodingName",
    "comctl32.dll.#324",
    "comctl32.dll.#323",
    "comctl32.dll.#328",
    "comctl32.dll.#334",
    "advapi32.dll.RegEnumKeyW",
    "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
    "advapi32.dll.InitializeSecurityDescriptor",
    "advapi32.dll.SetEntriesInAclW",
    "advapi32.dll.SetSecurityDescriptorDacl",
    "ieui.dll.FindStdColor",
    "advapi32.dll.IsTextUnicode",
    "comctl32.dll.#332",
    "comctl32.dll.#338",
    "ieui.dll.InvalidateGadget",
    "ieui.dll.SetGadgetParent",
    "setupapi.dll.CM_Get_Device_Interface_List_ExW",
    "comctl32.dll.#339",
    "shell32.dll.#102",
    "ieui.dll.GetGadgetTicket",
    "ieui.dll.SetGadgetRect",
    "urlmon.dll.#103",
    "urlmon.dll.#105",
    "kernel32.dll.GetThreadUILanguage",
    "propsys.dll.PSCreateMemoryPropertyStore",
    "propsys.dll.PSPropertyBag_WriteStr",
    "ole32.dll.PropVariantClear",
    "propsys.dll.PSPropertyBag_WriteGUID",
    "propsys.dll.PSPropertyBag_ReadGUID",
    "comctl32.dll.#386",
    "comctl32.dll.ImageList_Read",
    "comctl32.dll.ImageList_GetImageCount",
    "ole32.dll.CoRevokeInitializeSpy",
    "comctl32.dll.#388",
    "shell32.dll.SHGetInstanceExplorer",
    "wininet.dll.InternetSetOptionW",
    "user32.dll.PeekMessageW",
    "user32.dll.TranslateMessage",
    "rpcrt4.dll.RpcBindingToStringBindingW",
    "rpcrt4.dll.RpcStringBindingParseW",
    "rpcrt4.dll.I_RpcBindingInqLocalClientPID",
    "rpcrt4.dll.RpcServerInqCallAttributesW",
    "rpcrt4.dll.RpcImpersonateClient",
    "rpcrt4.dll.RpcRevertToSelf",
    "rpcrt4.dll.NdrServerCall2",
    "rpcrt4.dll.RpcBindingInqObject",
    "user32.dll.PostMessageW",
    "oleaut32.dll.DllGetClassObject",
    "oleaut32.dll.DllCanUnloadNow",
    "sxs.dll.SxsOleAut32MapIIDToProxyStubCLSID",
    "advapi32.dll.RegQueryValueW",
    "sxs.dll.SxsOleAut32MapIIDToTLBPath",
    "sxs.dll.SxsOleAut32MapConfiguredClsidToReferenceClsid",
    "sxs.dll.SxsOleAut32RedirectTypeLibrary",
    "ieui.dll.PeekMessageExW",
    "ole32.dll.CoInitialize",
    "ole32.dll.RegisterDragDrop",
    "msfeeds.dll.MsfeedsCreateInstance",
    "shell32.dll.SHGetSpecialFolderPathW",
    "shell32.dll.#66",
    "shell32.dll.SHCreateDirectoryExW",
    "wininet.dll.FindFirstUrlCacheContainerW",
    "wininet.dll.FindNextUrlCacheContainerW",
    "wininet.dll.FindCloseUrlCache",
    "user32.dll.GetWindowLongW",
    "user32.dll.IsWindow",
    "user32.dll.SendMessageW",
    "propsys.dll.PSStringFromPropertyKey",
    "propsys.dll.PSGetPropertyDescription",
    "propsys.dll.PropVariantToString",
    "propsys.dll.InitPropVariantFromStringAsVector",
    "propsys.dll.PSCoerceToCanonicalValue",
    "urlmon.dll.#458",
    "shell32.dll.SHGetKnownFolderPath",
    "urlmon.dll.URLDownloadToFileW",
    "ieui.dll.WaitMessageEx",
    "urlmon.dll.CoInternetIsFeatureEnabledForUrl",
    "oleaut32.dll.#23",
    "oleaut32.dll.#22",
    "urlmon.dll.#441",
    "urlmon.dll.#395",
    "urlmon.dll.#351",
    "mlang.dll.#112",
    "wininet.dll.GetUrlCacheEntryInfoA",
    "wininet.dll.GetUrlCacheEntryInfoExW",
    "wininet.dll.GetUrlCacheEntryInfoExA",
    "uxtheme.dll.BufferedPaintInit",
    "uxtheme.dll.BeginBufferedPaint",
    "uxtheme.dll.DrawThemeParentBackgroundEx",
    "uxtheme.dll.DrawThemeParentBackground",
    "uxtheme.dll.IsThemeBackgroundPartiallyTransparent",
    "uxtheme.dll.DrawThemeBackground",
    "uxtheme.dll.EndBufferedPaint",
    "usp10.dll.ScriptIsComplex",
    "urlmon.dll.#420",
    "user32.dll.DispatchMessageW",
    "ieui.dll.DUserPostEvent",
    "ieui.dll.DeleteHandle",
    "comctl32.dll.#412",
    "uxtheme.dll.BufferedPaintUnInit",
    "ieui.dll.DUserFlushMessages",
    "ieui.dll.DUserFlushDeferredMessages",
    "comctl32.dll.ImageList_Destroy",
    "ole32.dll.RevokeDragDrop",
    "ieui.dll.DisableContainerHwnd",
    "ole32.dll.CoWaitForMultipleHandles",
    "urlmon.dll.#412",
    "urlmon.dll.#414",
    "ntdll.dll.RtlDllShutdownInProgress",
    "comctl32.dll.#329",
    "linkinfo.dll.IsValidLinkInfo",
    "propsys.dll.#417",
    "propsys.dll.PSGetNameFromPropertyKey",
    "propsys.dll.InitVariantFromBuffer",
    "propsys.dll.PropVariantToGUID",
    "apphelp.dll.ApphelpCheckShellObject",
    "user32.dll.DestroyWindow",
    "comctl32.dll.#326",
    "advapi32.dll.OpenProcessToken",
    "propsys.dll.PSGetPropertyDescriptionByName",
    "user32.dll.PostQuitMessage",
    "urlmon.dll.#325",
    "sechost.dll.ConvertStringSidToSidW",
    "samcli.dll.NetUserGetLocalGroups",
    "samlib.dll.SamEnumerateDomainsInSamServer",
    "samlib.dll.SamLookupDomainInSamServer",
    "advapi32.dll.LsaOpenPolicy",
    "advapi32.dll.LsaLookupNames2",
    "advapi32.dll.LsaClose",
    "advapi32.dll.LsaFreeMemory",
    "samlib.dll.SamGetAliasMembership",
    "samlib.dll.SamLookupIdsInDomain",
    "linkinfo.dll.CreateLinkInfoW",
    "user32.dll.IsCharAlphaW",
    "user32.dll.CharPrevW",
    "ntshrui.dll.GetNetResourceFromLocalPathW",
    "srvcli.dll.NetShareEnum",
    "cscapi.dll.CscNetApiGetInterface",
    "slc.dll.SLGetWindowsInformationDWORD",
    "linkinfo.dll.DestroyLinkInfo",
    "propsys.dll.PropVariantToBoolean",
    "urlmon.dll.#364",
    "shell32.dll.SHCreateShellItemArrayFromIDLists",
    "ole32.dll.CoTaskMemRealloc",
    "shell32.dll.SHAssocEnumHandlersForProtocolByApplication",
    "urlmon.dll.#397",
    "urlmon.dll.#398",
    "propsys.dll.PSPropertyBag_ReadBOOL",
    "advapi32.dll.GetSecurityInfo",
    "advapi32.dll.SetSecurityInfo",
    "advapi32.dll.GetSecurityDescriptorControl",
    "comctl32.dll.#321",
    "urlmon.dll.#456",
    "urlmon.dll.#451",
    "user32.dll.UnregisterClassW",
    "rpcrt4.dll.RpcEpUnregister",
    "rpcrt4.dll.RpcBindingVectorFree",
    "rpcrt4.dll.RpcServerUnregisterIf",
    "urlmon.dll.#401",
    "ws2_32.dll.#116",
    "advapi32.dll.UnregisterTraceGuids",
    "ieframe.dll.#251",
    "kernel32.dll.WerSetFlags",
    "ieshims.dll.IEShims_Initialize",
    "user32.dll.SetWindowsHookExW",
    "user32.dll.FindWindowExA",
    "kernel32.dll.CreateProcessW",
    "kernel32.dll.CreateProcessA",
    "advapi32.dll.RegQueryValueA",
    "ntdll.dll.LdrRegisterDllNotification",
    "ole32.dll.NdrOleInitializeExtension",
    "shell32.dll.SHChangeNotifyRegisterThread",
    "comctl32.dll.#4",
    "comctl32.dll.ImageList_Add",
    "wininet.dll.InternetQueryOptionA",
    "gdi32.dll.GetTextExtentExPointWPri",
    "urlmon.dll.#104",
    "user32.dll.LoadCursorW",
    "user32.dll.GetClassInfoExW",
    "kernel32.dll.QueryActCtxW",
    "kernel32.dll.ActivateActCtx",
    "kernel32.dll.FindActCtxSectionStringW",
    "kernel32.dll.DeactivateActCtx",
    "user32.dll.CallWindowProcW",
    "user32.dll.ChangeWindowMessageFilter",
    "dwmapi.dll.DwmSetWindowAttribute",
    "urlmon.dll.#111",
    "wininet.dll.GetUrlCacheEntryInfoW",
    "shlwapi.dll.AssocQueryStringW",
    "propsys.dll.#430",
    "advapi32.dll.RegGetValueW",
    "propsys.dll.PropVariantToStringAlloc",
    "oleaut32.dll.#11",
    "ieshims.dll.IEShims_SetRedirectRegistryForThread",
    "comctl32.dll.#8",
    "uxtheme.dll.GetThemeInt",
    "urlmon.dll.CreateURLMonikerEx",
    "urlmon.dll.CreateAsyncBindCtxEx",
    "urlmon.dll.RegisterBindStatusCallback",
    "urlmon.dll.CreateFormatEnumerator",
    "urlmon.dll.UrlMkGetSessionOption",
    "rasadhlp.dll.WSAttemptAutodialAddr",
    "rasadhlp.dll.WSAttemptAutodialName",
    "rasadhlp.dll.WSNoteSuccessfulHostentLookup",
    "mlang.dll.#121",
    "urlmon.dll.#444",
    "urlmon.dll.#445",
    "dwmapi.dll.DwmInvalidateIconicBitmaps",
    "urlmon.dll.RevokeBindStatusCallback",
    "urlmon.dll.CreateIUriBuilder",
    "urlmon.dll.#330",
    "urlmon.dll.RegisterFormatEnumerator",
    "oleaut32.dll.#201",
    "oleaut32.dll.#3",
    "wininet.dll.CreateUrlCacheEntryA",
    "wininet.dll.CommitUrlCacheEntryA",
    "urlmon.dll.CoInternetIsFeatureEnabled",
    "ieframe.dll.#302",
    "wininet.dll.CreateUrlCacheContainerW",
    "oleaut32.dll.VariantClear",
    "urlmon.dll.IntlPercentEncodeNormalize",
    "shlwapi.dll.PathGetDriveNumberW",
    "urlmon.dll.#335",
    "ole32.dll.CoGetObjectContext",
    "uxtheme.dll.#61",
    "imgutil.dll.DecodeImage",
    "oleaut32.dll.#147",
    "ieshims.dll.IEShims_GetOriginatingThreadId",
    "user32.dll.UnregisterClassA",
    "ieshims.dll.IEShims_Uninitialize",
    "ntdll.dll.LdrUnregisterDllNotification",
    "sechost.dll.OpenSCManagerA"
]

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "lstrlenA",
                        "address": "0x425000"
                    },
                    {
                        "name": "DebugActiveProcessStop",
                        "address": "0x425004"
                    },
                    {
                        "name": "GetTickCount",
                        "address": "0x425008"
                    },
                    {
                        "name": "GetNumberFormatA",
                        "address": "0x42500c"
                    },
                    {
                        "name": "GetBinaryTypeW",
                        "address": "0x425010"
                    },
                    {
                        "name": "GetLastError",
                        "address": "0x425014"
                    },
                    {
                        "name": "PeekConsoleInputW",
                        "address": "0x425018"
                    },
                    {
                        "name": "GetNumaHighestNodeNumber",
                        "address": "0x42501c"
                    },
                    {
                        "name": "LocalAlloc",
                        "address": "0x425020"
                    },
                    {
                        "name": "VirtualProtect",
                        "address": "0x425024"
                    },
                    {
                        "name": "CreateToolhelp32Snapshot",
                        "address": "0x425028"
                    },
                    {
                        "name": "DuplicateHandle",
                        "address": "0x42502c"
                    },
                    {
                        "name": "EncodePointer",
                        "address": "0x425030"
                    },
                    {
                        "name": "DecodePointer",
                        "address": "0x425034"
                    },
                    {
                        "name": "GetCommandLineW",
                        "address": "0x425038"
                    },
                    {
                        "name": "RaiseException",
                        "address": "0x42503c"
                    },
                    {
                        "name": "RtlUnwind",
                        "address": "0x425040"
                    },
                    {
                        "name": "IsDebuggerPresent",
                        "address": "0x425044"
                    },
                    {
                        "name": "IsProcessorFeaturePresent",
                        "address": "0x425048"
                    },
                    {
                        "name": "EnterCriticalSection",
                        "address": "0x42504c"
                    },
                    {
                        "name": "LeaveCriticalSection",
                        "address": "0x425050"
                    },
                    {
                        "name": "FlushFileBuffers",
                        "address": "0x425054"
                    },
                    {
                        "name": "WriteFile",
                        "address": "0x425058"
                    },
                    {
                        "name": "WideCharToMultiByte",
                        "address": "0x42505c"
                    },
                    {
                        "name": "GetConsoleCP",
                        "address": "0x425060"
                    },
                    {
                        "name": "GetConsoleMode",
                        "address": "0x425064"
                    },
                    {
                        "name": "DeleteCriticalSection",
                        "address": "0x425068"
                    },
                    {
                        "name": "FatalAppExitA",
                        "address": "0x42506c"
                    },
                    {
                        "name": "ExitProcess",
                        "address": "0x425070"
                    },
                    {
                        "name": "GetModuleHandleExW",
                        "address": "0x425074"
                    },
                    {
                        "name": "GetProcAddress",
                        "address": "0x425078"
                    },
                    {
                        "name": "AreFileApisANSI",
                        "address": "0x42507c"
                    },
                    {
                        "name": "MultiByteToWideChar",
                        "address": "0x425080"
                    },
                    {
                        "name": "HeapSize",
                        "address": "0x425084"
                    },
                    {
                        "name": "ReadFile",
                        "address": "0x425088"
                    },
                    {
                        "name": "ReadConsoleW",
                        "address": "0x42508c"
                    },
                    {
                        "name": "HeapFree",
                        "address": "0x425090"
                    },
                    {
                        "name": "HeapAlloc",
                        "address": "0x425094"
                    },
                    {
                        "name": "SetLastError",
                        "address": "0x425098"
                    },
                    {
                        "name": "GetCurrentThread",
                        "address": "0x42509c"
                    },
                    {
                        "name": "GetCurrentThreadId",
                        "address": "0x4250a0"
                    },
                    {
                        "name": "GetProcessHeap",
                        "address": "0x4250a4"
                    },
                    {
                        "name": "GetStdHandle",
                        "address": "0x4250a8"
                    },
                    {
                        "name": "GetFileType",
                        "address": "0x4250ac"
                    },
                    {
                        "name": "GetStartupInfoW",
                        "address": "0x4250b0"
                    },
                    {
                        "name": "GetModuleFileNameW",
                        "address": "0x4250b4"
                    },
                    {
                        "name": "QueryPerformanceCounter",
                        "address": "0x4250b8"
                    },
                    {
                        "name": "GetCurrentProcessId",
                        "address": "0x4250bc"
                    },
                    {
                        "name": "GetSystemTimeAsFileTime",
                        "address": "0x4250c0"
                    },
                    {
                        "name": "GetEnvironmentStringsW",
                        "address": "0x4250c4"
                    },
                    {
                        "name": "FreeEnvironmentStringsW",
                        "address": "0x4250c8"
                    },
                    {
                        "name": "UnhandledExceptionFilter",
                        "address": "0x4250cc"
                    },
                    {
                        "name": "SetUnhandledExceptionFilter",
                        "address": "0x4250d0"
                    },
                    {
                        "name": "InitializeCriticalSectionAndSpinCount",
                        "address": "0x4250d4"
                    },
                    {
                        "name": "CreateEventW",
                        "address": "0x4250d8"
                    },
                    {
                        "name": "Sleep",
                        "address": "0x4250dc"
                    },
                    {
                        "name": "GetCurrentProcess",
                        "address": "0x4250e0"
                    },
                    {
                        "name": "TerminateProcess",
                        "address": "0x4250e4"
                    },
                    {
                        "name": "TlsAlloc",
                        "address": "0x4250e8"
                    },
                    {
                        "name": "TlsGetValue",
                        "address": "0x4250ec"
                    },
                    {
                        "name": "TlsSetValue",
                        "address": "0x4250f0"
                    },
                    {
                        "name": "TlsFree",
                        "address": "0x4250f4"
                    },
                    {
                        "name": "GetModuleHandleW",
                        "address": "0x4250f8"
                    },
                    {
                        "name": "CreateSemaphoreW",
                        "address": "0x4250fc"
                    },
                    {
                        "name": "SetStdHandle",
                        "address": "0x425100"
                    },
                    {
                        "name": "SetFilePointerEx",
                        "address": "0x425104"
                    },
                    {
                        "name": "WriteConsoleW",
                        "address": "0x425108"
                    },
                    {
                        "name": "SetConsoleCtrlHandler",
                        "address": "0x42510c"
                    },
                    {
                        "name": "FreeLibrary",
                        "address": "0x425110"
                    },
                    {
                        "name": "LoadLibraryExW",
                        "address": "0x425114"
                    },
                    {
                        "name": "IsValidCodePage",
                        "address": "0x425118"
                    },
                    {
                        "name": "GetACP",
                        "address": "0x42511c"
                    },
                    {
                        "name": "GetOEMCP",
                        "address": "0x425120"
                    },
                    {
                        "name": "GetCPInfo",
                        "address": "0x425124"
                    },
                    {
                        "name": "HeapReAlloc",
                        "address": "0x425128"
                    },
                    {
                        "name": "GetDateFormatW",
                        "address": "0x42512c"
                    },
                    {
                        "name": "GetTimeFormatW",
                        "address": "0x425130"
                    },
                    {
                        "name": "CompareStringW",
                        "address": "0x425134"
                    },
                    {
                        "name": "LCMapStringW",
                        "address": "0x425138"
                    },
                    {
                        "name": "GetLocaleInfoW",
                        "address": "0x42513c"
                    },
                    {
                        "name": "IsValidLocale",
                        "address": "0x425140"
                    },
                    {
                        "name": "GetUserDefaultLCID",
                        "address": "0x425144"
                    },
                    {
                        "name": "EnumSystemLocalesW",
                        "address": "0x425148"
                    },
                    {
                        "name": "OutputDebugStringW",
                        "address": "0x42514c"
                    },
                    {
                        "name": "GetStringTypeW",
                        "address": "0x425150"
                    },
                    {
                        "name": "CreateFileW",
                        "address": "0x425154"
                    },
                    {
                        "name": "CloseHandle",
                        "address": "0x425158"
                    }
                ],
                "dll": "KERNEL32.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x0004f44a",
        "overlay": null,
        "imagebase": "0x00400000",
        "reported_checksum": "0x0004f44a",
        "icon_hash": null,
        "entrypoint": "0x00403d1a",
        "timestamp": "2018-08-29 16:33:01",
        "osversion": "5.1",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x00023800",
                "entropy": "6.67",
                "raw_address": "0x00000400",
                "virtual_size": "0x0002372d",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rdata",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00025000",
                "size_of_data": "0x0001c200",
                "entropy": "6.43",
                "raw_address": "0x00023c00",
                "virtual_size": "0x0001c138",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x00042000",
                "size_of_data": "0x00001e00",
                "entropy": "3.08",
                "raw_address": "0x0003fe00",
                "virtual_size": "0x04e5ebec",
                "characteristics_raw": "0xc0000040"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x04ea1000",
                "size_of_data": "0x00002800",
                "entropy": "4.75",
                "raw_address": "0x00041c00",
                "virtual_size": "0x00002660",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".reloc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x04ea4000",
                "size_of_data": "0x00002200",
                "entropy": "6.51",
                "raw_address": "0x00044400",
                "virtual_size": "0x00002034",
                "characteristics_raw": "0x42000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00040958",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x00000028"
            },
            {
                "virtual_address": "0x04ea1000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x00002660"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x04ea4000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00002034"
            },
            {
                "virtual_address": "0x000251c0",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000038"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00025000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000160"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "b8eb963f1b0540e4925f622d0a8adba1",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": "C:\\tasani100_zebarogomomibogehuc\\cas40_hujugibulokone gelugivipanasa.pdb",
        "imported_dll_count": 1,
        "versioninfo": []
    }
}