Kreytricks / kreytricks

Previously contribution-focused fork, now standalone rolling-release project
https://kreytricks.github.io/
GNU Lesser General Public License v2.1
3 stars 1 forks source link

Experiment: Querry checksum of downloaded files in virustotal #55

Open Kreyren opened 5 years ago

Kreyren commented 5 years ago

Virustotal (https://www.virustotal.com/) has a database of checksums that we may be able to fetch in winetricks to check executables prior to invoking them.

So this basically implements a fast anti-virus in winetricks if it works.

Kreyren commented 5 years ago

Works like a charm we even get a lots of helpful info about the file:

kreyren@dreamon:~$ curl --request GET --url https://www.virustotal.com/api/v3/files/f0696bc98bf69a953554104b22e5a4d610dbfb344654c3e729a2851acc12c24e --header 'x-apikey: 2ad9c6c2d0dc50881aa6f08af9f74696ef1fe9a24ad16e7632a6c241d33d8d94'
{
    "data": {
        "attributes": {
            "authentihash": "f520debee79ac2ebd7a128744fc02d8b5eaf64529477457886b0429f38adb2e9",
            "creation_date": 1550185518,
            "exiftool": {
                "CharacterSet": "Unicode",
                "CodeSize": 2916352,
                "CompanyName": "Blizzard Entertainment",
                "EntryPoint": "0x1385f3",
                "FileDescription": "Battle.net Setup",
                "FileFlagsMask": "0x003f",
                "FileOS": "Win32",
                "FileSubtype": 0,
                "FileType": "Win32 EXE",
                "FileTypeExtension": "exe",
                "FileVersion": "1.16.3.2988",
                "FileVersionNumber": "1.16.3.2988",
                "ImageFileCharacteristics": "Executable, 32-bit",
                "ImageVersion": 0.0,
                "InitializedDataSize": 1975296,
                "InternalName": "Battle.net Setup",
                "LanguageCode": "Neutral",
                "LegalCopyright": "   2005-2019 Blizzard Entertainment Inc.",
                "LinkerVersion": 14.15,
                "MIMEType": "application/octet-stream",
                "MachineType": "Intel 386 or later, and compatibles",
                "OSVersion": 6.0,
                "ObjectFileType": "Executable application",
                "OriginalFileName": "Battle.net-Setup.exe",
                "PEType": "PE32",
                "ProductName": "Battle.net Setup",
                "ProductVersion": "1.16.3.2988",
                "ProductVersionNumber": "1.16.3.2988",
                "Subsystem": "Windows GUI",
                "SubsystemVersion": 6.0,
                "TimeStamp": "2019:02:15 00:05:18+01:00",
                "UninitializedDataSize": 0
            },
            "first_submission_date": 1574705971,
            "last_analysis_date": 1574705971,
            "last_analysis_results": {
                "ALYac": {
                    "category": "undetected",
                    "engine_name": "ALYac",
                    "engine_update": "20191125",
                    "engine_version": "1.1.1.5",
                    "method": "blacklist",
                    "result": null
                },
                "APEX": {
                    "category": "undetected",
                    "engine_name": "APEX",
                    "engine_update": "20191125",
                    "engine_version": "5.89",
                    "method": "blacklist",
                    "result": null
                },
                "AVG": {
                    "category": "undetected",
                    "engine_name": "AVG",
                    "engine_update": "20191125",
                    "engine_version": "18.4.3895.0",
                    "method": "blacklist",
                    "result": null
                },
                "Acronis": {
                    "category": "undetected",
                    "engine_name": "Acronis",
                    "engine_update": "20191122",
                    "engine_version": "1.1.1.58",
                    "method": "blacklist",
                    "result": null
                },
                "Ad-Aware": {
                    "category": "undetected",
                    "engine_name": "Ad-Aware",
                    "engine_update": "20191125",
                    "engine_version": "3.0.5.370",
                    "method": "blacklist",
                    "result": null
                },
                "AegisLab": {
                    "category": "undetected",
                    "engine_name": "AegisLab",
                    "engine_update": "20191125",
                    "engine_version": "4.2",
                    "method": "blacklist",
                    "result": null
                },
                "AhnLab-V3": {
                    "category": "undetected",
                    "engine_name": "AhnLab-V3",
                    "engine_update": "20191125",
                    "engine_version": "3.16.5.25880",
                    "method": "blacklist",
                    "result": null
                },
                "Alibaba": {
                    "category": "undetected",
                    "engine_name": "Alibaba",
                    "engine_update": "20190527",
                    "engine_version": "0.3.0.5",
                    "method": "blacklist",
                    "result": null
                },
                "Arcabit": {
                    "category": "undetected",
                    "engine_name": "Arcabit",
                    "engine_update": "20191125",
                    "engine_version": "1.0.0.865",
                    "method": "blacklist",
                    "result": null
                },
                "Avast": {
                    "category": "undetected",
                    "engine_name": "Avast",
                    "engine_update": "20191125",
                    "engine_version": "18.4.3895.0",
                    "method": "blacklist",
                    "result": null
                },
                "Avast-Mobile": {
                    "category": "undetected",
                    "engine_name": "Avast-Mobile",
                    "engine_update": "20191125",
                    "engine_version": "191125-00",
                    "method": "blacklist",
                    "result": null
                },
                "Avira": {
                    "category": "undetected",
                    "engine_name": "Avira",
                    "engine_update": "20191125",
                    "engine_version": "8.3.3.8",
                    "method": "blacklist",
                    "result": null
                },
                "Baidu": {
                    "category": "undetected",
                    "engine_name": "Baidu",
                    "engine_update": "20190318",
                    "engine_version": "1.0.0.2",
                    "method": "blacklist",
                    "result": null
                },
                "BitDefender": {
                    "category": "undetected",
                    "engine_name": "BitDefender",
                    "engine_update": "20191125",
                    "engine_version": "7.2",
                    "method": "blacklist",
                    "result": null
                },
                "BitDefenderTheta": {
                    "category": "undetected",
                    "engine_name": "BitDefenderTheta",
                    "engine_update": "20191125",
                    "engine_version": "7.2.37796.0",
                    "method": "blacklist",
                    "result": null
                },
                "Bkav": {
                    "category": "timeout",
                    "engine_name": "Bkav",
                    "engine_update": "20191125",
                    "engine_version": "1.3.0.9899",
                    "method": "blacklist",
                    "result": null
                },
                "CAT-QuickHeal": {
                    "category": "undetected",
                    "engine_name": "CAT-QuickHeal",
                    "engine_update": "20191125",
                    "engine_version": "14.00",
                    "method": "blacklist",
                    "result": null
                },
                "CMC": {
                    "category": "undetected",
                    "engine_name": "CMC",
                    "engine_update": "20190321",
                    "engine_version": "1.1.0.977",
                    "method": "blacklist",
                    "result": null
                },
                "ClamAV": {
                    "category": "undetected",
                    "engine_name": "ClamAV",
                    "engine_update": "20191125",
                    "engine_version": "0.102.1.0",
                    "method": "blacklist",
                    "result": null
                },
                "Comodo": {
                    "category": "undetected",
                    "engine_name": "Comodo",
                    "engine_update": "20191125",
                    "engine_version": "31765",
                    "method": "blacklist",
                    "result": null
                },
                "CrowdStrike": {
                    "category": "undetected",
                    "engine_name": "CrowdStrike",
                    "engine_update": "20190702",
                    "engine_version": "1.0",
                    "method": "blacklist",
                    "result": null
                },
                "Cybereason": {
                    "category": "undetected",
                    "engine_name": "Cybereason",
                    "engine_update": "20190616",
                    "engine_version": "1.2.449",
                    "method": "blacklist",
                    "result": null
                },
                "Cylance": {
                    "category": "undetected",
                    "engine_name": "Cylance",
                    "engine_update": "20191125",
                    "engine_version": "2.3.1.101",
                    "method": "blacklist",
                    "result": null
                },
                "Cyren": {
                    "category": "undetected",
                    "engine_name": "Cyren",
                    "engine_update": "20191125",
                    "engine_version": "6.2.2.2",
                    "method": "blacklist",
                    "result": null
                },
                "DrWeb": {
                    "category": "undetected",
                    "engine_name": "DrWeb",
                    "engine_update": "20191125",
                    "engine_version": "7.0.42.9300",
                    "method": "blacklist",
                    "result": null
                },
                "ESET-NOD32": {
                    "category": "undetected",
                    "engine_name": "ESET-NOD32",
                    "engine_update": "20191125",
                    "engine_version": "20406",
                    "method": "blacklist",
                    "result": null
                },
                "Emsisoft": {
                    "category": "undetected",
                    "engine_name": "Emsisoft",
                    "engine_update": "20191031",
                    "engine_version": "2018.12.0.1641",
                    "method": "blacklist",
                    "result": null
                },
                "Endgame": {
                    "category": "undetected",
                    "engine_name": "Endgame",
                    "engine_update": "20190918",
                    "engine_version": "3.0.15",
                    "method": "blacklist",
                    "result": null
                },
                "F-Prot": {
                    "category": "undetected",
                    "engine_name": "F-Prot",
                    "engine_update": "20191125",
                    "engine_version": "4.7.1.166",
                    "method": "blacklist",
                    "result": null
                },
                "F-Secure": {
                    "category": "undetected",
                    "engine_name": "F-Secure",
                    "engine_update": "20191125",
                    "engine_version": "12.0.86.52",
                    "method": "blacklist",
                    "result": null
                },
                "FireEye": {
                    "category": "undetected",
                    "engine_name": "FireEye",
                    "engine_update": "20191125",
                    "engine_version": "29.7.0.0",
                    "method": "blacklist",
                    "result": null
                },
                "Fortinet": {
                    "category": "undetected",
                    "engine_name": "Fortinet",
                    "engine_update": "20191125",
                    "engine_version": "6.2.137.0",
                    "method": "blacklist",
                    "result": null
                },
                "GData": {
                    "category": "undetected",
                    "engine_name": "GData",
                    "engine_update": "20191125",
                    "engine_version": "A:25.24095B:26.16774",
                    "method": "blacklist",
                    "result": null
                },
                "Ikarus": {
                    "category": "undetected",
                    "engine_name": "Ikarus",
                    "engine_update": "20191125",
                    "engine_version": "0.1.5.2",
                    "method": "blacklist",
                    "result": null
                },
                "Invincea": {
                    "category": "undetected",
                    "engine_name": "Invincea",
                    "engine_update": "20190904",
                    "engine_version": "6.3.6.26157",
                    "method": "blacklist",
                    "result": null
                },
                "Jiangmin": {
                    "category": "undetected",
                    "engine_name": "Jiangmin",
                    "engine_update": "20191125",
                    "engine_version": "16.0.100",
                    "method": "blacklist",
                    "result": null
                },
                "K7AntiVirus": {
                    "category": "undetected",
                    "engine_name": "K7AntiVirus",
                    "engine_update": "20191125",
                    "engine_version": "11.80.32635",
                    "method": "blacklist",
                    "result": null
                },
                "K7GW": {
                    "category": "undetected",
                    "engine_name": "K7GW",
                    "engine_update": "20191125",
                    "engine_version": "11.80.32636",
                    "method": "blacklist",
                    "result": null
                },
                "Kaspersky": {
                    "category": "undetected",
                    "engine_name": "Kaspersky",
                    "engine_update": "20191125",
                    "engine_version": "15.0.1.13",
                    "method": "blacklist",
                    "result": null
                },
                "Kingsoft": {
                    "category": "undetected",
                    "engine_name": "Kingsoft",
                    "engine_update": "20191125",
                    "engine_version": "2013.8.14.323",
                    "method": "blacklist",
                    "result": null
                },
                "MAX": {
                    "category": "undetected",
                    "engine_name": "MAX",
                    "engine_update": "20191125",
                    "engine_version": "2019.9.16.1",
                    "method": "blacklist",
                    "result": null
                },
                "Malwarebytes": {
                    "category": "undetected",
                    "engine_name": "Malwarebytes",
                    "engine_update": "20191125",
                    "engine_version": "2.1.1.1115",
                    "method": "blacklist",
                    "result": null
                },
                "MaxSecure": {
                    "category": "undetected",
                    "engine_name": "MaxSecure",
                    "engine_update": "20191123",
                    "engine_version": "1.0.0.1",
                    "method": "blacklist",
                    "result": null
                },
                "McAfee": {
                    "category": "undetected",
                    "engine_name": "McAfee",
                    "engine_update": "20191125",
                    "engine_version": "6.0.6.653",
                    "method": "blacklist",
                    "result": null
                },
                "McAfee-GW-Edition": {
                    "category": "undetected",
                    "engine_name": "McAfee-GW-Edition",
                    "engine_update": "20191125",
                    "engine_version": "v2017.3010",
                    "method": "blacklist",
                    "result": null
                },
                "MicroWorld-eScan": {
                    "category": "undetected",
                    "engine_name": "MicroWorld-eScan",
                    "engine_update": "20191125",
                    "engine_version": "14.0.297.0",
                    "method": "blacklist",
                    "result": null
                },
                "Microsoft": {
                    "category": "undetected",
                    "engine_name": "Microsoft",
                    "engine_update": "20191125",
                    "engine_version": "1.1.16500.1",
                    "method": "blacklist",
                    "result": null
                },
                "NANO-Antivirus": {
                    "category": "undetected",
                    "engine_name": "NANO-Antivirus",
                    "engine_update": "20191125",
                    "engine_version": "1.0.134.24859",
                    "method": "blacklist",
                    "result": null
                },
                "Paloalto": {
                    "category": "undetected",
                    "engine_name": "Paloalto",
                    "engine_update": "20191125",
                    "engine_version": "1.0",
                    "method": "blacklist",
                    "result": null
                },
                "Panda": {
                    "category": "undetected",
                    "engine_name": "Panda",
                    "engine_update": "20191125",
                    "engine_version": "4.6.4.2",
                    "method": "blacklist",
                    "result": null
                },
                "Qihoo-360": {
                    "category": "undetected",
                    "engine_name": "Qihoo-360",
                    "engine_update": "20191125",
                    "engine_version": "1.0.0.1120",
                    "method": "blacklist",
                    "result": null
                },
                "Rising": {
                    "category": "undetected",
                    "engine_name": "Rising",
                    "engine_update": "20191125",
                    "engine_version": "25.0.0.24",
                    "method": "blacklist",
                    "result": null
                },
                "SUPERAntiSpyware": {
                    "category": "undetected",
                    "engine_name": "SUPERAntiSpyware",
                    "engine_update": "20191122",
                    "engine_version": "5.6.0.1032",
                    "method": "blacklist",
                    "result": null
                },
                "SentinelOne": {
                    "category": "undetected",
                    "engine_name": "SentinelOne",
                    "engine_update": "20191118",
                    "engine_version": "1.11.0.53",
                    "method": "blacklist",
                    "result": null
                },
                "Sophos": {
                    "category": "undetected",
                    "engine_name": "Sophos",
                    "engine_update": "20191125",
                    "engine_version": "4.98.0",
                    "method": "blacklist",
                    "result": null
                },
                "Symantec": {
                    "category": "undetected",
                    "engine_name": "Symantec",
                    "engine_update": "20191125",
                    "engine_version": "1.11.0.0",
                    "method": "blacklist",
                    "result": null
                },
                "SymantecMobileInsight": {
                    "category": "type-unsupported",
                    "engine_name": "SymantecMobileInsight",
                    "engine_update": "20191030",
                    "engine_version": "2.0",
                    "method": "blacklist",
                    "result": null
                },
                "TACHYON": {
                    "category": "undetected",
                    "engine_name": "TACHYON",
                    "engine_update": "20191125",
                    "engine_version": "2019-11-25.02",
                    "method": "blacklist",
                    "result": null
                },
                "Tencent": {
                    "category": "undetected",
                    "engine_name": "Tencent",
                    "engine_update": "20191125",
                    "engine_version": "1.0.0.1",
                    "method": "blacklist",
                    "result": null
                },
                "Trapmine": {
                    "category": "undetected",
                    "engine_name": "Trapmine",
                    "engine_update": "20190826",
                    "engine_version": "3.1.81.800",
                    "method": "blacklist",
                    "result": null
                },
                "TrendMicro": {
                    "category": "undetected",
                    "engine_name": "TrendMicro",
                    "engine_update": "20191125",
                    "engine_version": "11.0.0.1006",
                    "method": "blacklist",
                    "result": null
                },
                "TrendMicro-HouseCall": {
                    "category": "undetected",
                    "engine_name": "TrendMicro-HouseCall",
                    "engine_update": "20191125",
                    "engine_version": "10.0.0.1040",
                    "method": "blacklist",
                    "result": null
                },
                "Trustlook": {
                    "category": "type-unsupported",
                    "engine_name": "Trustlook",
                    "engine_update": "20191125",
                    "engine_version": "1.0",
                    "method": "blacklist",
                    "result": null
                },
                "VBA32": {
                    "category": "undetected",
                    "engine_name": "VBA32",
                    "engine_update": "20191125",
                    "engine_version": "4.2.0",
                    "method": "blacklist",
                    "result": null
                },
                "VIPRE": {
                    "category": "undetected",
                    "engine_name": "VIPRE",
                    "engine_update": "20191125",
                    "engine_version": "79588",
                    "method": "blacklist",
                    "result": null
                },
                "ViRobot": {
                    "category": "undetected",
                    "engine_name": "ViRobot",
                    "engine_update": "20191125",
                    "engine_version": "2014.3.20.0",
                    "method": "blacklist",
                    "result": null
                },
                "Webroot": {
                    "category": "undetected",
                    "engine_name": "Webroot",
                    "engine_update": "20191125",
                    "engine_version": "1.0.0.403",
                    "method": "blacklist",
                    "result": null
                },
                "Yandex": {
                    "category": "undetected",
                    "engine_name": "Yandex",
                    "engine_update": "20191121",
                    "engine_version": "5.5.2.24",
                    "method": "blacklist",
                    "result": null
                },
                "Zillya": {
                    "category": "undetected",
                    "engine_name": "Zillya",
                    "engine_update": "20191125",
                    "engine_version": "2.0.0.3959",
                    "method": "blacklist",
                    "result": null
                },
                "ZoneAlarm": {
                    "category": "undetected",
                    "engine_name": "ZoneAlarm",
                    "engine_update": "20191125",
                    "engine_version": "1.0",
                    "method": "blacklist",
                    "result": null
                },
                "Zoner": {
                    "category": "undetected",
                    "engine_name": "Zoner",
                    "engine_update": "20191125",
                    "engine_version": "1.0.0.1",
                    "method": "blacklist",
                    "result": null
                }
            },
            "last_analysis_stats": {
                "failure": 0,
                "harmless": 0,
                "malicious": 0,
                "suspicious": 0,
                "timeout": 1,
                "type-unsupported": 2,
                "undetected": 68
            },
            "last_modification_date": 1574706128,
            "last_submission_date": 1574705971,
            "magic": "PE32 executable for MS Windows (GUI) Intel 80386 32-bit",
            "md5": "03a751004c1952962ce8c0f38fb622c4",
            "meaningful_name": "Battle.net-Setup.exe",
            "names": [
                "Battle.net-Setup.exe",
                "Battle.net Setup"
            ],
            "pe_info": {
                "entry_point": 1279475,
                "imphash": "f386848a3162c60899249477d9ce1222",
                "imports": {
                    "ADVAPI32.dll": [
                        "CryptDestroyKey",
                        "RegCloseKey",
                        "DuplicateToken",
                        "RegQueryValueExA",
                        "AccessCheck",
                        "CryptSetHashParam",
                        "OpenServiceW",
                        "QueryServiceConfigW",
                        "CryptEncrypt",
                        "LookupPrivilegeValueW",
                        "RegCreateKeyExA",
                        "OpenThreadToken",
                        "CryptHashData",
                        "ConvertSidToStringSidA",
                        "RegQueryValueExW",
                        "CryptImportKey",
                        "CryptCreateHash",
                        "CloseServiceHandle",
                        "GetFileSecurityW",
                        "ConvertStringSecurityDescriptorToSecurityDescriptorW",
                        "OpenProcessToken",
                        "DeregisterEventSource",
                        "GetUserNameW",
                        "RegGetValueW",
                        "RegisterEventSourceA",
                        "RegOpenKeyExA",
                        "GetTokenInformation",
                        "DuplicateTokenEx",
                        "CryptReleaseContext",
                        "CryptAcquireContextA",
                        "GetNamedSecurityInfoW",
                        "CryptGenRandom",
                        "CryptAcquireContextW",
                        "CryptDecrypt",
                        "CryptGetProvParam",
                        "CryptDestroyHash",
                        "MapGenericMask",
                        "AdjustTokenPrivileges",
                        "CryptGetUserKey",
                        "SetEntriesInAclW",
                        "RegSetValueExW",
                        "ConvertSecurityDescriptorToStringSecurityDescriptorW",
                        "CryptGetHashParam",
                        "OpenSCManagerW",
                        "CryptExportKey",
                        "AllocateAndInitializeSid",
                        "RegSetValueExA",
                        "CryptEnumProvidersA",
                        "RegDeleteValueA",
                        "ReportEventA",
                        "SetNamedSecurityInfoW",
                        "CryptSignHashA",
                        "BuildTrusteeWithSidW"
                    ],
                    "CRYPT32.dll": [
                        "CertEnumCertificatesInStore",
                        "CertGetNameStringA",
                        "CryptStringToBinaryA",
                        "CertGetCertificateContextProperty",
                        "CertFreeCertificateChainEngine",
                        "CertFreeCertificateContext",
                        "CertCloseStore",
                        "CryptQueryObject",
                        "CertDuplicateCertificateContext",
                        "CertAddCertificateContextToStore",
                        "CertFindCertificateInStore",
                        "CertFreeCertificateChain",
                        "CryptMsgClose",
                        "CertGetCertificateChain",
                        "CertCreateCertificateChainEngine",
                        "CertOpenStore",
                        "CertGetNameStringW",
                        "CryptMsgGetParam"
                    ],
                    "GDI32.dll": [
                        "SetMapMode",
                        "DeleteDC",
                        "SelectObject",
                        "SetLayout",
                        "EnumFontFamiliesExW",
                        "AddFontMemResourceEx",
                        "SetTextAlign",
                        "GetObjectW",
                        "SetBkMode",
                        "SetBkColor",
                        "CreateDIBSection",
                        "CreateCompatibleDC",
                        "DeleteObject",
                        "CreateFontW",
                        "SetTextColor",
                        "GetLayout"
                    ],
                    "KERNEL32.dll": [
                        "CreateFiberEx",
                        "GetStdHandle",
                        "GetDriveTypeW",
                        "TerminateProcess",
                        "VerifyVersionInfoA",
                        "InterlockedPopEntrySList",
                        "DeactivateActCtx",
                        "WaitForSingleObject",
                        "LockResource",
                        "Thread32Next",
                        "SignalObjectAndWait",
                        "ReleaseSRWLockExclusive",
                        "CreateTimerQueue",
                        "GetFileAttributesW",
                        "GetFileSize",
                        "SystemTimeToTzSpecificLocalTime",
                        "GetProcessId",
                        "DeleteCriticalSection",
                        "GetCurrentProcess",
                        "GetConsoleMode",
                        "LocalAlloc",
                        "UnhandledExceptionFilter",
                        "SetFilePointer",
                        "ExpandEnvironmentStringsA",
                        "ReleaseMutex",
                        "FreeEnvironmentStringsW",
                        "InitializeSListHead",
                        "GetThreadContext",
                        "GetLocaleInfoW",
                        "SetStdHandle",
                        "GetFileTime",
                        "GetTempPathA",
                        "GetCPInfo",
                        "GetDiskFreeSpaceW",
                        "WriteFile",
                        "DeleteFiber",
                        "GetSystemTimeAsFileTime",
                        "SetThreadAffinityMask",
                        "GetThreadTimes",
                        "Thread32First",
                        "HeapReAlloc",
                        "GetStringTypeW",
                        "GetThreadPriority",
                        "SetEvent",
                        "LocalFree",
                        "ResumeThread",
                        "FreeLibraryAndExitThread",
                        "InitializeCriticalSection",
                        "OutputDebugStringW",
                        "FindClose",
                        "TlsGetValue",
                        "FormatMessageA",
                        "GetFullPathNameW",
                        "EncodePointer",
                        "OutputDebugStringA",
                        "GetEnvironmentVariableW",
                        "SetLastError",
                        "PeekNamedPipe",
                        "DeviceIoControl",
                        "GetUserDefaultLangID",
                        "LoadResource",
                        "GetModuleFileNameW",
                        "TryEnterCriticalSection",
                        "IsDebuggerPresent",
                        "ExitProcess",
                        "GetModuleFileNameA",
                        "InitializeCriticalSectionEx",
                        "VerSetConditionMask",
                        "CreateActCtxW",
                        "SetConsoleCtrlHandler",
                        "ActivateActCtx",
                        "EnumSystemLocalesW",
                        "LoadLibraryExW",
                        "MultiByteToWideChar",
                        "VerifyVersionInfoW",
                        "SetFilePointerEx",
                        "DeleteTimerQueueTimer",
                        "SwitchToFiber",
                        "MoveFileW",
                        "CreateMutexA",
                        "RegisterWaitForSingleObject",
                        "SetFileAttributesW",
                        "CreateThread",
                        "MoveFileExW",
                        "InterlockedFlushSList",
                        "GetExitCodeThread",
                        "SetNamedPipeHandleState",
                        "SetUnhandledExceptionFilter",
                        "Module32NextW",
                        "IsProcessorFeaturePresent",
                        "GetSystemDirectoryA",
                        "DecodePointer",
                        "SetEnvironmentVariableA",
                        "ReadConsoleA",
                        "GlobalMemoryStatus",
                        "ConvertThreadToFiber",
                        "GetModuleHandleExW",
                        "SetCurrentDirectoryW",
                        "VirtualQuery",
                        "GetDiskFreeSpaceExW",
                        "CreateEventW",
                        "SetEndOfFile",
                        "SetWaitableTimer",
                        "GetProcAddress",
                        "SleepEx",
                        "WriteConsoleW",
                        "CreateToolhelp32Snapshot",
                        "AreFileApisANSI",
                        "InitializeCriticalSectionAndSpinCount",
                        "HeapFree",
                        "EnterCriticalSection",
                        "Process32First",
                        "LoadLibraryW",
                        "OpenThread",
                        "GetComputerNameW",
                        "GetVersionExW",
                        "GetExitCodeProcess",
                        "QueryPerformanceCounter",
                        "GetTickCount",
                        "IsBadWritePtr",
                        "TlsAlloc",
                        "VirtualProtect",
                        "FlushFileBuffers",
                        "LoadLibraryA",
                        "DeleteFileA",
                        "RtlUnwind",
                        "ExitThread",
                        "FreeLibrary",
                        "ConvertFiberToThread",
                        "AcquireSRWLockExclusive",
                        "OpenProcess",
                        "GetModuleHandleW",
                        "SetFileValidData",
                        "GetDateFormatW",
                        "GetStartupInfoW",
                        "CreateDirectoryW",
                        "DeleteFileW",
                        "GetUserDefaultLCID",
                        "GetProcessHeap",
                        "QueryDepthSList",
                        "GetTimeFormatW",
                        "GetFileSizeEx",
                        "RemoveDirectoryW",
                        "GetFileInformationByHandle",
                        "FindNextFileW",
                        "ResetEvent",
                        "CreateTimerQueueTimer",
                        "CreateWaitableTimerA",
                        "FindFirstFileW",
                        "IsValidLocale",
                        "DuplicateHandle",
                        "FindFirstFileExW",
                        "WaitForMultipleObjects",
                        "GetProcessAffinityMask",
                        "GetTimeZoneInformation",
                        "CreateFileW",
                        "CreateEventA",
                        "Process32Next",
                        "GetFileType",
                        "TlsSetValue",
                        "CreateFileA",
                        "HeapAlloc",
                        "LeaveCriticalSection",
                        "GetLastError",
                        "IsValidCodePage",
                        "InterlockedPushEntrySList",
                        "SystemTimeToFileTime",
                        "LCMapStringW",
                        "GetShortPathNameW",
                        "GetSystemInfo",
                        "GetCompressedFileSizeW",
                        "GlobalFree",
                        "GetConsoleCP",
                        "UnregisterWaitEx",
                        "CompareStringW",
                        "GetVolumeInformationW",
                        "GetEnvironmentStringsW",
                        "QueryPerformanceFrequency",
                        "WaitForSingleObjectEx",
                        "lstrlenW",
                        "CreateFiber",
                        "Module32FirstW",
                        "SwitchToThread",
                        "SizeofResource",
                        "GetCurrentDirectoryW",
                        "GetCurrentProcessId",
                        "WaitNamedPipeW",
                        "ChangeTimerQueueTimer",
                        "SetFileTime",
                        "GetCommandLineW",
                        "WideCharToMultiByte",
                        "HeapSize",
                        "RaiseException",
                        "GetCommandLineA",
                        "GetCurrentThread",
                        "GetTickCount64",
                        "SuspendThread",
                        "ReadConsoleW",
                        "ReleaseSemaphore",
                        "TlsFree",
                        "GetModuleHandleA",
                        "VirtualUnlock",
                        "FileTimeToSystemTime",
                        "ReadFile",
                        "RtlCaptureContext",
                        "CloseHandle",
                        "lstrcpynA",
                        "GetACP",
                        "GetCurrentThreadId",
                        "GetFileAttributesExW",
                        "GetLogicalProcessorInformation",
                        "GetNumaHighestNodeNumber",
                        "GetLocalTime",
                        "UnregisterWait",
                        "SetConsoleMode",
                        "FindResourceW",
                        "VirtualFree",
                        "Sleep",
                        "IsBadReadPtr",
                        "IsBadStringPtrA",
                        "SetThreadPriority",
                        "OpenEventA",
                        "VirtualAlloc",
                        "GetOEMCP"
                    ],
                    "MSIMG32.dll": [
                        "AlphaBlend"
                    ],
                    "OLEAUT32.dll": [
                        "VariantClear"
                    ],
                    "RPCRT4.dll": [
                        "UuidToStringA",
                        "RpcStringFreeA",
                        "UuidCreate"
                    ],
                    "SHELL32.dll": [
                        "SHGetFolderPathW",
                        "ShellExecuteExA",
                        "SHBrowseForFolderW",
                        "SHGetPathFromIDListW",
                        "ShellExecuteExW",
                        "SHGetMalloc",
                        "CommandLineToArgvW",
                        "FindExecutableA"
                    ],
                    "USER32.dll": [
                        "GetUserObjectInformationW",
                        "EndPaint",
                        "IsIconic",
                        "BeginPaint",
                        "DefWindowProcW",
                        "TrackMouseEvent",
                        "PostQuitMessage",
                        "GetShellWindow",
                        "ShowWindow",
                        "SetWindowPos",
                        "GetWindowThreadProcessId",
                        "CharLowerA",
                        "SetWindowLongW",
                        "MessageBoxW",
                        "PeekMessageW",
                        "GetWindowRect",
                        "RegisterClassExW",
                        "SetCapture",
                        "ReleaseCapture",
                        "MessageBoxA",
                        "GetWindowDC",
                        "AdjustWindowRectEx",
                        "TranslateMessage",
                        "GetProcessWindowStation",
                        "DispatchMessageW",
                        "GetCursorPos",
                        "ReleaseDC",
                        "UpdateLayeredWindow",
                        "SendMessageW",
                        "GetSystemMetrics",
                        "GetForegroundWindow",
                        "SetWindowTextW",
                        "AllowSetForegroundWindow",
                        "DrawTextW",
                        "GetDC",
                        "InvalidateRect",
                        "SetTimer",
                        "GetActiveWindow",
                        "GetDesktopWindow",
                        "LoadCursorW",
                        "LoadIconW",
                        "CreateWindowExW",
                        "GetWindowLongW",
                        "DestroyWindow"
                    ],
                    "VERSION.dll": [
                        "VerQueryValueW",
                        "GetFileVersionInfoW",
                        "GetFileVersionInfoSizeW"
                    ],
                    "WINHTTP.dll": [
                        "WinHttpOpen",
                        "WinHttpGetIEProxyConfigForCurrentUser",
                        "WinHttpCloseHandle",
                        "WinHttpGetProxyForUrl"
                    ],
                    "WININET.dll": [
                        "InternetConnectA",
                        "HttpSendRequestA",
                        "InternetReadFileExA",
                        "InternetSetOptionA",
                        "HttpOpenRequestA",
                        "InternetCloseHandle",
                        "InternetOpenA",
                        "InternetSetCookieW",
                        "InternetSetStatusCallbackA",
                        "HttpQueryInfoA",
                        "InternetCrackUrlA"
                    ],
                    "WINTRUST.dll": [
                        "WinVerifyTrust"
                    ],
                    "WS2_32.dll": [
                        "getaddrinfo",
                        "htonl",
                        "getsockname",
                        "accept",
                        "ioctlsocket",
                        "WSAStartup",
                        "freeaddrinfo",
                        "connect",
                        "shutdown",
                        "htons",
                        "WSASetLastError",
                        "select",
                        "gethostname",
                        "getsockopt",
                        "closesocket",
                        "ntohl",
                        "send",
                        "ntohs",
                        "WSAGetLastError",
                        "listen",
                        "__WSAFDIsSet",
                        "WSACleanup",
                        "getpeername",
                        "recv",
                        "WSAIoctl",
                        "setsockopt",
                        "socket",
                        "bind",
                        "recvfrom",
                        "sendto"
                    ],
                    "ole32.dll": [
                        "CoTaskMemFree",
                        "CoCreateInstance"
                    ]
                },
                "machine_type": 332,
                "overlay": {
                    "chi2": 400545.46875,
                    "entropy": 5.426848411560059,
                    "filetype": "data",
                    "md5": "8b94c478dcb5bc068bb7d3497fa120e2",
                    "offset": 4892672,
                    "size": 10224
                },
                "resource_details": [
                    {
                        "chi2": 499077.46875,
                        "entropy": 6.821178436279297,
                        "filetype": "font/ttf",
                        "lang": "NEUTRAL",
                        "sha256": "2a00bef556be50a2d6aa77ad6a301068dad178e11237f90d1f26ca2d05f65746",
                        "type": "FONT"
                    },
                    {
                        "chi2": 9780.15625,
                        "entropy": 4.850625038146973,
                        "filetype": "ASCII text",
                        "lang": "NEUTRAL",
                        "sha256": "2075b7b30304308870c976231b17e73285ba43a47acd3d28a51481e3eb5d2832",
                        "type": "JSON"
                    },
                    {
                        "chi2": 16393.736328125,
                        "entropy": 4.974742412567139,
                        "filetype": "ASCII text",
                        "lang": "NEUTRAL",
                        "sha256": "350cf6ea1ab84cf8d55a7d72a83621a09f9010a1e4042fa44eb1c087a7f87d62",
                        "type": "JSON"
                    },
                    {
                        "chi2": 15070.0576171875,
                        "entropy": 4.976926326751709,
                        "filetype": "ASCII text",
                        "lang": "NEUTRAL",
                        "sha256": "c1351b0f1af3f07cdd92d5443f1490676e38973c480c09e704011858e59f3824",
                        "type": "JSON"
                    },
                    {
                        "chi2": 14118.9677734375,
                        "entropy": 4.86093807220459,
                        "filetype": "ASCII text",
                        "lang": "NEUTRAL",
                        "sha256": "9444283817d90e76c257b98af5b2dbcba5404c7a344ddba176171857282a0a97",
                        "type": "JSON"
                    },
                    {
                        "chi2": 28396.759765625,
                        "entropy": 4.97757625579834,
                        "filetype": "ASCII text",
                        "lang": "NEUTRAL",
                        "sha256": "62d5dcd1d961101e977342ec76edd6d6313fa70ae007ab10568b3a4fb34560f1",
                        "type": "JSON"
                    },
                    {
                        "chi2": 4454.36767578125,
                        "entropy": 4.897160053253174,
                        "filetype": "ASCII text",
                        "lang": "NEUTRAL",
                        "sha256": "9b89d541cb4df9f4589d9da03d2a146d6aafd7641bdc415f2007d919a32434c2",
                        "type": "JSON"
                    },
                    {
                        "chi2": 2576.44677734375,
                        "entropy": 7.959446907043457,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "6228da3e47704bf66e3d5d28601e0891b96049a913882447067bd9b0d0a52608",
                        "type": "PNG"
                    },
                    {
                        "chi2": 630.5415649414062,
                        "entropy": 7.982231616973877,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "ba3e3004449702b02e7a95abd7b0a20fc7e31f6cbf8739a8f40693e727e13384",
                        "type": "PNG"
                    },
                    {
                        "chi2": 1774.1646728515625,
                        "entropy": 7.993820667266846,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "56321daad1250d39226ecd46d5345b11e47f8fb6b9954c5b6cfe4ec93293bdc0",
                        "type": "PNG"
                    },
                    {
                        "chi2": 4042.30126953125,
                        "entropy": 6.163387775421143,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "05ea10194afdb38e028d8e835533ab12aa3d3efc9905d3043cc0aa6f13529642",
                        "type": "PNG"
                    },
                    {
                        "chi2": 3476.529052734375,
                        "entropy": 6.669460296630859,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "6ef744ed712e50d93f1f5a3a54dac24c4b0c90ab36bc0c70d291d19c37e560bf",
                        "type": "PNG"
                    },
                    {
                        "chi2": 3349.603759765625,
                        "entropy": 6.754802227020264,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "7bfb185f0eda3eabd466ee997acc43e5d498cb97533399ce63a8643ce3254f69",
                        "type": "PNG"
                    },
                    {
                        "chi2": 3101.17529296875,
                        "entropy": 6.887676239013672,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "a954f56a1e98be33cbc1aa353d8ae206310493e4e64c55eff9dd78115a0e338a",
                        "type": "PNG"
                    },
                    {
                        "chi2": 3125.84912109375,
                        "entropy": 6.895979881286621,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "33ca2b924d0258a01b018aa1326410481ffcd2692f766b8ec32244ef687feace",
                        "type": "PNG"
                    },
                    {
                        "chi2": 3249.62255859375,
                        "entropy": 6.883048057556152,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "fb122c6a5454eff35d566431d7d893d94406fc3efc4dd4bd1cd8aad97086360f",
                        "type": "PNG"
                    },
                    {
                        "chi2": 909.68359375,
                        "entropy": 6.634492874145508,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "6dfad246aa23ab0914cbd8c08bdeb5b393921c153608a5e2b25a83598088fa10",
                        "type": "PNG"
                    },
                    {
                        "chi2": 754.6452026367188,
                        "entropy": 7.002194404602051,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "42bd94d379e2a79a3b5a8b01ce0b0e834aeb7d5fa6a60b2ec581ce812df081f2",
                        "type": "PNG"
                    },
                    {
                        "chi2": 3925.111572265625,
                        "entropy": 6.301149368286133,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "f716394fb6e931823177a874de2ee3aa5d42fa24e5c5f0cade1ae39f3cf2ed18",
                        "type": "PNG"
                    },
                    {
                        "chi2": 4050.904541015625,
                        "entropy": 6.283083438873291,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "8f6661aa8d3c850431f863fca4d355ea32646ed0c6176f2ae92fd161b758fb8b",
                        "type": "PNG"
                    },
                    {
                        "chi2": 4064.69921875,
                        "entropy": 6.424304485321045,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "0f5b706d8e41b3e0c5840e3d33aa92489b1e1c92f5888a0bdae0f7d95d742ed4",
                        "type": "PNG"
                    },
                    {
                        "chi2": 4410.1923828125,
                        "entropy": 6.07090425491333,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "d27fc090d7200704e87d364fcb97578bdde414ca7291b5a24be23f363d75512b",
                        "type": "PNG"
                    },
                    {
                        "chi2": 4274.2197265625,
                        "entropy": 6.233514785766602,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "ffab18a851cc551c56f15b6e183a2439276d89c582d673cb87b271e6d8c0b3e4",
                        "type": "PNG"
                    },
                    {
                        "chi2": 4689.98828125,
                        "entropy": 5.911078453063965,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "f830d9cbb5290441203cfa19de16b5f6f502d1f04bda2e8e6486496d45a57ecf",
                        "type": "PNG"
                    },
                    {
                        "chi2": 3814.478515625,
                        "entropy": 6.435084342956543,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "39cf8017a27f526abee2c4e1d69a11b4da66b193444a8757f12bbf0f3cbdef9d",
                        "type": "PNG"
                    },
                    {
                        "chi2": 536.4672241210938,
                        "entropy": 7.610865116119385,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "2025eb111ef74c1810850206fa480cc7bff9c99ade04d9c70aaddee7ef9e7df2",
                        "type": "PNG"
                    },
                    {
                        "chi2": 4476.20947265625,
                        "entropy": 5.8463664054870605,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "ef51e04f312c10a800d3759f29f4e02bb0afdde2a7e747cd55c50c7eb6e06b5d",
                        "type": "PNG"
                    },
                    {
                        "chi2": 3474.26220703125,
                        "entropy": 6.657578468322754,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "3bbb7b60dd3abd625897c0981b544c7bf2548d4f18f6986df6a21c0864f58cef",
                        "type": "PNG"
                    },
                    {
                        "chi2": 1216.1697998046875,
                        "entropy": 7.851156234741211,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "7f5b6b5a7aa12b0041175d0aca9b7133c0df372577044ae8ccd780a913e7b62d",
                        "type": "PNG"
                    },
                    {
                        "chi2": 2053.398681640625,
                        "entropy": 7.535712718963623,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "41c6b6195b7842e0b22177f9e665551f92e156efd6bdbfc9c97c9f85de580bb8",
                        "type": "PNG"
                    },
                    {
                        "chi2": 2346.846923828125,
                        "entropy": 7.344842910766602,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "e2a78f400570065ce16769f9666794606e35e4f1b71f2704baf4b23dff19363a",
                        "type": "PNG"
                    },
                    {
                        "chi2": 981.5252685546875,
                        "entropy": 7.865232467651367,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "45d5d7ba31135659bbaf7f6f78cc5b2506b980eb2950e2477bea9fc6804e6973",
                        "type": "PNG"
                    },
                    {
                        "chi2": 1982.2357177734375,
                        "entropy": 7.523314476013184,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "9cc5eeb8fbfe19b516c273deeec28e787e42d525f0e011cb25fbabbdb527a968",
                        "type": "PNG"
                    },
                    {
                        "chi2": 3472.30810546875,
                        "entropy": 6.673733234405518,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "13d84af1627af54cdffecf34392d44f3c3d32493d8803199a276c2d68aa59ee1",
                        "type": "PNG"
                    },
                    {
                        "chi2": 2858.023193359375,
                        "entropy": 7.052192211151123,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "3b93b842b51aa0bc7163da55afd8ce63fc455c6a6d75242e14792118c5c488d6",
                        "type": "PNG"
                    },
                    {
                        "chi2": 84024.484375,
                        "entropy": 6.254825115203857,
                        "filetype": "data",
                        "lang": "NEUTRAL",
                        "sha256": "83fd6a0d795d27649f7ab4894f96d25b0e88cb425cbbc2024ae5ca646734c7f2",
                        "type": "STRINGS"
                    },
                    {
                        "chi2": 7617527.5,
                        "entropy": 2.4116599559783936,
                        "filetype": "data",
                        "lang": "NEUTRAL",
                        "sha256": "cced8681ccc95051d4cb873b2c58c69aee57cf9fb452a3a10118ec49b0bf2961",
                        "type": "RT_ICON"
                    },
                    {
                        "chi2": 84345.4140625,
                        "entropy": 3.4780242443084717,
                        "filetype": "data",
                        "lang": "NEUTRAL",
                        "sha256": "ba0bf3725fe6de9ad4cdfdfccbac91612ec022e1678e7e9d1a6caabc2bd12576",
                        "type": "RT_ICON"
                    },
                    {
                        "chi2": 170222.671875,
                        "entropy": 3.340118169784546,
                        "filetype": "data",
                        "lang": "NEUTRAL",
                        "sha256": "595f72f00d4d3b99f152293a05732b1756fc5f9968958e29bc5ad8f11f141cea",
                        "type": "RT_ICON"
                    },
                    {
                        "chi2": 933.6068115234375,
                        "entropy": 7.96925163269043,
                        "filetype": "image/x-png",
                        "lang": "NEUTRAL",
                        "sha256": "44af8a64f0745a00118f0f9e2d7ccfac8ab10a492e25b49beb47dad9e3e8f462",
                        "type": "RT_ICON"
                    },
                    {
                        "chi2": 326438.34375,
                        "entropy": 3.240429639816284,
                        "filetype": "data",
                        "lang": "NEUTRAL",
                        "sha256": "b05b142e244e8975698a97240431f8a5c0ff64f5df98eee2414bc71d739478bb",
                        "type": "RT_ICON"
                    },
                    {
                        "chi2": 878903.5,
                        "entropy": 2.9002370834350586,
                        "filetype": "data",
                        "lang": "NEUTRAL",
                        "sha256": "f6c8ebc2e1dedee1d9fda6ff4727a62d4b30f3eeace8a33eac379620a969bc4d",
                        "type": "RT_ICON"
                    },
                    {
                        "chi2": 1851371.625,
                        "entropy": 2.4544758796691895,
                        "filetype": "data",
                        "lang": "NEUTRAL",
                        "sha256": "8bd9b41951188ec0e1f9104fe3dc0fc96b8d5bb5ac824ae74d5959686c08fe22",
                        "type": "RT_ICON"
                    },
                    {
                        "chi2": 7649.84521484375,
                        "entropy": 2.919022560119629,
                        "filetype": "data",
                        "lang": "NEUTRAL",
                        "sha256": "c1bd526685b51753016929963a42624f5f04d3c8cb14f731c1695a0a44b3b703",
                        "type": "RT_GROUP_ICON"
                    },
                    {
                        "chi2": 65265.76171875,
                        "entropy": 3.4021029472351074,
                        "filetype": "data",
                        "lang": "NEUTRAL",
                        "sha256": "ebbfe0d4affcd9b04609cce6617aca2f7cf2cc81d1b9f158528456f9a6737629",
                        "type": "RT_VERSION"
                    },
                    {
                        "chi2": 11601.1318359375,
                        "entropy": 5.231886863708496,
                        "filetype": "ASCII text",
                        "lang": "ENGLISH US",
                        "sha256": "476c581e20a45055ac2da6dfa1d0bfc660e793295dc7b10b7a7b202c2882b73d",
                        "type": "RT_MANIFEST"
                    }
                ],
                "resource_langs": {
                    "ENGLISH US": 1,
                    "NEUTRAL": 45
                },
                "resource_types": {
                    "FONT": 1,
                    "JSON": 6,
                    "PNG": 28,
                    "RT_GROUP_ICON": 1,
                    "RT_ICON": 7,
                    "RT_MANIFEST": 1,
                    "RT_VERSION": 1,
                    "STRINGS": 1
                },
                "sections": [
                    {
                        "entropy": 6.7,
                        "md5": "84645d32630567fd9815d6086df0c297",
                        "name": ".text",
                        "raw_size": 2916352,
                        "virtual_address": 4096,
                        "virtual_size": 2916172
                    },
                    {
                        "entropy": 6.07,
                        "md5": "36b0c153aabc4656bbcfafdea737a2b6",
                        "name": ".rdata",
                        "raw_size": 1166848,
                        "virtual_address": 2920448,
                        "virtual_size": 1166534
                    },
                    {
                        "entropy": 5.08,
                        "md5": "697e6958d228f505915a91a6fd11cf6d",
                        "name": ".data",
                        "raw_size": 108544,
                        "virtual_address": 4087808,
                        "virtual_size": 487796
                    },
                    {
                        "entropy": 7.22,
                        "md5": "5853e95bc7e6a73e24a63026f194fa0e",
                        "name": ".rsrc",
                        "raw_size": 540672,
                        "virtual_address": 4579328,
                        "virtual_size": 540264
                    },
                    {
                        "entropy": 6.62,
                        "md5": "07449426cd5c953ac9432745b7cba1c7",
                        "name": ".reloc",
                        "raw_size": 159232,
                        "virtual_address": 5120000,
                        "virtual_size": 158732
                    }
                ],
                "timestamp": 1550185518
            },
            "reputation": 0,
            "sha1": "ec59db5a866bf77662680f091979d1f60a8e960b",
            "sha256": "f0696bc98bf69a953554104b22e5a4d610dbfb344654c3e729a2851acc12c24e",
            "signature_info": {
                "copyright": "\u00a9 2005-2019 Blizzard Entertainment Inc.",
                "counter signers": "Symantec Time Stamping Services Signer - G4; Symantec Time Stamping Services CA - G2; Thawte Timestamping CA",
                "counter signers details": [
                    {
                        "algorithm": "sha1RSA",
                        "cert issuer": "Symantec Time Stamping Services CA - G2",
                        "name": "Symantec Time Stamping Services Signer - G4",
                        "serial number": "0E CF F4 38 C8 FE BF 35 6E 04 D8 6A 98 1B 1A 50",
                        "status": "Valid",
                        "thumbprint": "65439929B67973EB192D6FF243E6767ADF0834E4",
                        "valid from": "12:00 AM 10/18/2012",
                        "valid to": "11:59 PM 12/29/2020",
                        "valid usage": "Timestamp Signing"
                    },
                    {
                        "algorithm": "sha1RSA",
                        "cert issuer": "Thawte Timestamping CA",
                        "name": "Symantec Time Stamping Services CA - G2",
                        "serial number": "7E 93 EB FB 7C C6 4E 59 EA 4B 9A 77 D4 06 FC 3B",
                        "status": "Valid",
                        "thumbprint": "6C07453FFDDA08B83707C09B82FB3D15F35336B1",
                        "valid from": "12:00 AM 12/21/2012",
                        "valid to": "11:59 PM 12/30/2020",
                        "valid usage": "Timestamp Signing"
                    },
                    {
                        "algorithm": "md5RSA",
                        "cert issuer": "Thawte Timestamping CA",
                        "name": "Thawte Timestamping CA",
                        "serial number": "00",
                        "status": "Valid",
                        "thumbprint": "BE36A4562FB2EE05DBB3D32323ADF445084ED656",
                        "valid from": "12:00 AM 01/01/1997",
                        "valid to": "11:59 PM 12/31/2020",
                        "valid usage": "Timestamp Signing"
                    }
                ],
                "description": "Battle.net Setup",
                "file version": "1.16.3.2988",
                "internal name": "Battle.net Setup",
                "original name": "Battle.net-Setup.exe",
                "product": "Battle.net Setup",
                "signers": "Blizzard Entertainment, Inc.; DigiCert SHA2 Assured ID Code Signing CA; DigiCert",
                "signers details": [
                    {
                        "algorithm": "sha256RSA",
                        "cert issuer": "DigiCert SHA2 Assured ID Code Signing CA",
                        "name": "Blizzard Entertainment, Inc.",
                        "serial number": "04 43 B5 67 BF FB AA 3B C0 83 FE 45 A4 6D D0 41",
                        "status": "Valid",
                        "thumbprint": "D3722C638DB40E9045B4380348D6AE8AE0A417D8",
                        "valid from": "12:00 AM 01/18/2018",
                        "valid to": "12:00 PM 01/22/2021",
                        "valid usage": "Code Signing"
                    },
                    {
                        "algorithm": "sha256RSA",
                        "cert issuer": "DigiCert Assured ID Root CA",
                        "name": "DigiCert SHA2 Assured ID Code Signing CA",
                        "serial number": "04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08",
                        "status": "Valid",
                        "thumbprint": "92C1588E85AF2201CE7915E8538B492F605B80C6",
                        "valid from": "12:00 PM 10/22/2013",
                        "valid to": "12:00 PM 10/22/2028",
                        "valid usage": "Code Signing"
                    },
                    {
                        "algorithm": "sha1RSA",
                        "cert issuer": "DigiCert Assured ID Root CA",
                        "name": "DigiCert",
                        "serial number": "0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39",
                        "status": "Valid",
                        "thumbprint": "0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43",
                        "valid from": "12:00 AM 11/10/2006",
                        "valid to": "12:00 AM 11/10/2031",
                        "valid usage": "Server Auth, Client Auth, Email Protection, Code Signing, Timestamp Signing"
                    }
                ],
                "signing date": "12:06 AM 2/15/2019",
                "verified": "Signed",
                "x509": [
                    {
                        "algorithm": "sha1RSA",
                        "cert issuer": "Thawte Timestamping CA",
                        "name": "Symantec Time Stamping Services CA - G2",
                        "serial number": "7E 93 EB FB 7C C6 4E 59 EA 4B 9A 77 D4 06 FC 3B",
                        "thumbprint": "6C07453FFDDA08B83707C09B82FB3D15F35336B1",
                        "valid from": "12:00 AM 12/21/2012",
                        "valid to": "11:59 PM 12/30/2020",
                        "valid_usage": "Timestamp Signing"
                    },
                    {
                        "algorithm": "sha1RSA",
                        "cert issuer": "Symantec Time Stamping Services CA - G2",
                        "name": "Symantec Time Stamping Services Signer - G4",
                        "serial number": "EC FF 43 8C 8F EB F3 56 E0 4D 86 A9 81 B1 A5 0",
                        "thumbprint": "65439929B67973EB192D6FF243E6767ADF0834E4",
                        "valid from": "12:00 AM 10/18/2012",
                        "valid to": "11:59 PM 12/29/2020",
                        "valid_usage": "ff"
                    },
                    {
                        "algorithm": "sha256RSA",
                        "cert issuer": "DigiCert Assured ID Root CA",
                        "name": "DigiCert SHA2 Assured ID Code Signing CA",
                        "serial number": "40 91 81 B5 FD 5B B6 67 55 34 3B 56 F9 55 00 8",
                        "thumbprint": "92C1588E85AF2201CE7915E8538B492F605B80C6",
                        "valid from": "12:00 PM 10/22/2013",
                        "valid to": "12:00 PM 10/22/2028",
                        "valid_usage": "Code Signing"
                    },
                    {
                        "algorithm": "sha256RSA",
                        "cert issuer": "DigiCert SHA2 Assured ID Code Signing CA",
                        "name": "Blizzard Entertainment, Inc.",
                        "serial number": "44 3B 56 7B FF BA A3 BC 08 3F E4 5A 46 DD 04 1",
                        "thumbprint": "D3722C638DB40E9045B4380348D6AE8AE0A417D8",
                        "valid from": "12:00 AM 1/18/2018",
                        "valid to": "12:00 PM 1/22/2021",
                        "valid_usage": "Code Signing"
                    }
                ]
            },
            "size": 4902896,
            "ssdeep": "98304:zhd3ga/+fpF5bAeDlMcXVFmpJE5qZ03wRtX:zhdv+f5bRmP4q2wtX",
            "tags": [
                "peexe",
                "signed",
                "overlay",
                "detect-debug-environment",
                "runtime-modules"
            ],
            "times_submitted": 1,
            "total_votes": {
                "harmless": 0,
                "malicious": 0
            },
            "trid": [
                {
                    "file_type": "Windows Control Panel Item (generic)",
                    "probability": 76.6
                },
                {
                    "file_type": "Win64 Executable (generic)",
                    "probability": 10.7
                },
                {
                    "file_type": "Obfuscated subsetted Font",
                    "probability": 8.5
                },
                {
                    "file_type": "Win32 Executable (generic)",
                    "probability": 1.7
                },
                {
                    "file_type": "OS/2 Executable (generic)",
                    "probability": 0.7
                }
            ],
            "type_description": "Win32 EXE",
            "type_tag": "peexe",
            "unique_sources": 1,
            "vhash": "046056656d55756352z1211ze8z2011z31z82z2c030b001e7z"
        },
        "id": "f0696bc98bf69a953554104b22e5a4d610dbfb344654c3e729a2851acc12c24e",
        "links": {
            "self": "https://www.virustotal.com/api/v3/files/f0696bc98bf69a953554104b22e5a4d610dbfb344654c3e729a2851acc12c24e"
        },
        "type": "file"
    }