{
  "modules": [
    {
      "name": "AnyDesk.exe",
      "base": "0x10000",
      "size": 37330944,
      "path": "C:\\Users\\Mes\\Downloads\\AnyDesk.exe"
    },
    {
      "name": "ntdll.dll",
      "base": "0x772a0000",
      "size": 1830912,
      "path": "C:\\WINDOWS\\SYSTEM32\\ntdll.dll"
    },
    {
      "name": "KERNEL32.DLL",
      "base": "0x76090000",
      "size": 983040,
      "path": "C:\\WINDOWS\\System32\\KERNEL32.DLL"
    },
    {
      "name": "KERNELBASE.dll",
      "base": "0x764f0000",
      "size": 2916352,
      "path": "C:\\WINDOWS\\System32\\KERNELBASE.dll"
    },
    {
      "name": "WINMM.dll",
      "base": "0x745d0000",
      "size": 208896,
      "path": "C:\\WINDOWS\\SYSTEM32\\WINMM.dll"
    },
    {
      "name": "ucrtbase.dll",
      "base": "0x76360000",
      "size": 1114112,
      "path": "C:\\WINDOWS\\System32\\ucrtbase.dll"
    },
    {
      "name": "SHLWAPI.dll",
      "base": "0x74ba0000",
      "size": 335872,
      "path": "C:\\WINDOWS\\System32\\SHLWAPI.dll"
    },
    {
      "name": "Windows.Storage.dll",
      "base": "0x75890000",
      "size": 7225344,
      "path": "C:\\WINDOWS\\System32\\Windows.Storage.dll"
    },
    {
      "name": "combase.dll",
      "base": "0x74db0000",
      "size": 2695168,
      "path": "C:\\WINDOWS\\System32\\combase.dll"
    },
    {
      "name": "RPCRT4.dll",
      "base": "0x76f60000",
      "size": 770048,
      "path": "C:\\WINDOWS\\System32\\RPCRT4.dll"
    },
    {
      "name": "msvcp_win.dll",
      "base": "0x77100000",
      "size": 544768,
      "path": "C:\\WINDOWS\\System32\\msvcp_win.dll"
    },
    {
      "name": "advapi32.dll",
      "base": "0x74c00000",
      "size": 544768,
      "path": "C:\\WINDOWS\\System32\\advapi32.dll"
    },
    {
      "name": "msvcrt.dll",
      "base": "0x749f0000",
      "size": 815104,
      "path": "C:\\WINDOWS\\System32\\msvcrt.dll"
    },
    {
      "name": "sechost.dll",
      "base": "0x75130000",
      "size": 536576,
      "path": "C:\\WINDOWS\\System32\\sechost.dll"
    },
    {
      "name": "WS2_32.dll",
      "base": "0x74c90000",
      "size": 397312,
      "path": "C:\\WINDOWS\\System32\\WS2_32.dll"
    },
    {
      "name": "ole32.dll",
      "base": "0x74780000",
      "size": 1380352,
      "path": "C:\\WINDOWS\\System32\\ole32.dll"
    },
    {
      "name": "GDI32.dll",
      "base": "0x77020000",
      "size": 139264,
      "path": "C:\\WINDOWS\\System32\\GDI32.dll"
    },
    {
      "name": "win32u.dll",
      "base": "0x748e0000",
      "size": 106496,
      "path": "C:\\WINDOWS\\System32\\win32u.dll"
    },
    {
      "name": "gdi32full.dll",
      "base": "0x77190000",
      "size": 962560,
      "path": "C:\\WINDOWS\\System32\\gdi32full.dll"
    },
    {
      "name": "USER32.dll",
      "base": "0x76190000",
      "size": 1871872,
      "path": "C:\\WINDOWS\\System32\\USER32.dll"
    },
    {
      "name": "IMM32.DLL",
      "base": "0x74900000",
      "size": 151552,
      "path": "C:\\WINDOWS\\System32\\IMM32.DLL"
    },
    {
      "name": "OLEAUT32.dll",
      "base": "0x74d00000",
      "size": 651264,
      "path": "C:\\WINDOWS\\System32\\OLEAUT32.dll"
    },
    {
      "name": "COMCTL32.dll",
      "base": "0x743a0000",
      "size": 2265088,
      "path": "C:\\WINDOWS\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7922_none_85b5d4f5f7b04a77\\COMCTL32.dll"
    },
    {
      "name": "gdiplus.dll",
      "base": "0x74220000",
      "size": 1556480,
      "path": "C:\\WINDOWS\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.26100.7920_none_b6a0f56b52429103\\gdiplus.dll"
    },
    {
      "name": "SHELL32.dll",
      "base": "0x75250000",
      "size": 6512640,
      "path": "C:\\WINDOWS\\System32\\SHELL32.dll"
    },
    {
      "name": "wintypes.dll",
      "base": "0x74680000",
      "size": 1019904,
      "path": "C:\\WINDOWS\\System32\\wintypes.dll"
    },
    {
      "name": "IPHLPAPI.DLL",
      "base": "0x741f0000",
      "size": 159744,
      "path": "C:\\WINDOWS\\SYSTEM32\\IPHLPAPI.DLL"
    },
    {
      "name": "WINHTTP.dll",
      "base": "0x74100000",
      "size": 921600,
      "path": "C:\\WINDOWS\\SYSTEM32\\WINHTTP.dll"
    },
    {
      "name": "CRYPT32.dll",
      "base": "0x75f80000",
      "size": 1085440,
      "path": "C:\\WINDOWS\\System32\\CRYPT32.dll"
    },
    {
      "name": "Secur32.dll",
      "base": "0x740f0000",
      "size": 40960,
      "path": "C:\\WINDOWS\\SYSTEM32\\Secur32.dll"
    },
    {
      "name": "SSPICLI.DLL",
      "base": "0x740c0000",
      "size": 176128,
      "path": "C:\\WINDOWS\\SYSTEM32\\SSPICLI.DLL"
    },
    {
      "name": "MSIMG32.dll",
      "base": "0x740b0000",
      "size": 24576,
      "path": "C:\\WINDOWS\\SYSTEM32\\MSIMG32.dll"
    },
    {
      "name": "PSAPI.DLL",
      "base": "0x77280000",
      "size": 24576,
      "path": "C:\\WINDOWS\\System32\\PSAPI.DLL"
    },
    {
      "name": "SETUPAPI.dll",
      "base": "0x767c0000",
      "size": 4526080,
      "path": "C:\\WINDOWS\\System32\\SETUPAPI.dll"
    },
    {
      "name": "MPR.dll",
      "base": "0x74090000",
      "size": 102400,
      "path": "C:\\WINDOWS\\SYSTEM32\\MPR.dll"
    },
    {
      "name": "WINSPOOL.DRV",
      "base": "0x74000000",
      "size": 561152,
      "path": "C:\\WINDOWS\\SYSTEM32\\WINSPOOL.DRV"
    },
    {
      "name": "shcore.dll",
      "base": "0x74ac0000",
      "size": 860160,
      "path": "C:\\WINDOWS\\System32\\shcore.dll"
    },
    {
      "name": "cfgmgr32.dll",
      "base": "0x73fb0000",
      "size": 274432,
      "path": "C:\\WINDOWS\\SYSTEM32\\cfgmgr32.dll"
    },
    {
      "name": "kernel.appcore.dll",
      "base": "0x73f90000",
      "size": 86016,
      "path": "C:\\WINDOWS\\SYSTEM32\\kernel.appcore.dll"
    },
    {
      "name": "bcryptPrimitives.dll",
      "base": "0x750b0000",
      "size": 475136,
      "path": "C:\\WINDOWS\\System32\\bcryptPrimitives.dll"
    },
    {
      "name": "uxtheme.dll",
      "base": "0x73f00000",
      "size": 524288,
      "path": "C:\\WINDOWS\\system32\\uxtheme.dll"
    },
    {
      "name": "profapi.dll",
      "base": "0x73ee0000",
      "size": 118784,
      "path": "C:\\WINDOWS\\SYSTEM32\\profapi.dll"
    },
    {
      "name": "ntmarta.dll",
      "base": "0x73eb0000",
      "size": 167936,
      "path": "C:\\WINDOWS\\SYSTEM32\\ntmarta.dll"
    },
    {
      "name": "MSCTF.dll",
      "base": "0x76e40000",
      "size": 1150976,
      "path": "C:\\WINDOWS\\System32\\MSCTF.dll"
    },
    {
      "name": "WindowsCodecs.dll",
      "base": "0x73cc0000",
      "size": 1961984,
      "path": "C:\\WINDOWS\\SYSTEM32\\WindowsCodecs.dll"
    },
    {
      "name": "clbcatq.dll",
      "base": "0x751c0000",
      "size": 548864,
      "path": "C:\\WINDOWS\\System32\\clbcatq.dll"
    },
    {
      "name": "thumbcache.dll",
      "base": "0x73c60000",
      "size": 335872,
      "path": "C:\\Windows\\System32\\thumbcache.dll"
    },
    {
      "name": "policymanager.dll",
      "base": "0x73bb0000",
      "size": 651264,
      "path": "C:\\WINDOWS\\SYSTEM32\\policymanager.dll"
    },
    {
      "name": "avrt.dll",
      "base": "0x73ba0000",
      "size": 36864,
      "path": "C:\\WINDOWS\\SYSTEM32\\avrt.dll"
    },
    {
      "name": "PROPSYS.dll",
      "base": "0x73ac0000",
      "size": 860160,
      "path": "C:\\WINDOWS\\SYSTEM32\\PROPSYS.dll"
    },
    {
      "name": "LINKINFO.dll",
      "base": "0x73ab0000",
      "size": 45056,
      "path": "C:\\WINDOWS\\SYSTEM32\\LINKINFO.dll"
    },
    {
      "name": "ntshrui.dll",
      "base": "0x73a20000",
      "size": 532480,
      "path": "C:\\WINDOWS\\SYSTEM32\\ntshrui.dll"
    },
    {
      "name": "srvcli.dll",
      "base": "0x739f0000",
      "size": 122880,
      "path": "C:\\WINDOWS\\SYSTEM32\\srvcli.dll"
    },
    {
      "name": "cscapi.dll",
      "base": "0x739d0000",
      "size": 57344,
      "path": "C:\\WINDOWS\\SYSTEM32\\cscapi.dll"
    },
    {
      "name": "bcrypt.dll",
      "base": "0x739b0000",
      "size": 114688,
      "path": "C:\\WINDOWS\\SYSTEM32\\bcrypt.dll"
    },
    {
      "name": "DPAPI.dll",
      "base": "0x739a0000",
      "size": 36864,
      "path": "C:\\WINDOWS\\SYSTEM32\\DPAPI.dll"
    },
    {
      "name": "CRYPTBASE.dll",
      "base": "0x73990000",
      "size": 40960,
      "path": "C:\\WINDOWS\\SYSTEM32\\CRYPTBASE.dll"
    },
    {
      "name": "TextShaping.dll",
      "base": "0x738e0000",
      "size": 675840,
      "path": "C:\\WINDOWS\\SYSTEM32\\TextShaping.dll"
    },
    {
      "name": "dwmapi.dll",
      "base": "0x738b0000",
      "size": 151552,
      "path": "C:\\WINDOWS\\SYSTEM32\\dwmapi.dll"
    },
    {
      "name": "textinputframework.dll",
      "base": "0x737a0000",
      "size": 1060864,
      "path": "C:\\WINDOWS\\SYSTEM32\\textinputframework.dll"
    },
    {
      "name": "CoreMessaging.dll",
      "base": "0x736c0000",
      "size": 905216,
      "path": "C:\\WINDOWS\\SYSTEM32\\CoreMessaging.dll"
    },
    {
      "name": "CoreUIComponents.dll",
      "base": "0x73420000",
      "size": 2695168,
      "path": "C:\\WINDOWS\\SYSTEM32\\CoreUIComponents.dll"
    },
    {
      "name": "explorerframe.dll",
      "base": "0x731f0000",
      "size": 2256896,
      "path": "C:\\WINDOWS\\system32\\explorerframe.dll"
    },
    {
      "name": "dataexchange.dll",
      "base": "0x72c20000",
      "size": 311296,
      "path": "C:\\WINDOWS\\system32\\dataexchange.dll"
    },
    {
      "name": "twinapi.appcore.dll",
      "base": "0x72a30000",
      "size": 1986560,
      "path": "C:\\WINDOWS\\system32\\twinapi.appcore.dll"
    },
    {
      "name": "DNSAPI.dll",
      "base": "0x72d50000",
      "size": 933888,
      "path": "C:\\WINDOWS\\SYSTEM32\\DNSAPI.dll"
    },
    {
      "name": "NSI.dll",
      "base": "0x770f0000",
      "size": 28672,
      "path": "C:\\WINDOWS\\System32\\NSI.dll"
    }
  ],
  "tls_exports": [
    {
      "module": "ntdll.dll",
      "name": "NtReadFile",
      "address": "0x773191b0",
      "type": "function"
    },
    {
      "module": "ntdll.dll",
      "name": "NtReadFileScatter",
      "address": "0x77319450",
      "type": "function"
    },
    {
      "module": "ntdll.dll",
      "name": "NtWriteFile",
      "address": "0x773191d0",
      "type": "function"
    },
    {
      "module": "ntdll.dll",
      "name": "NtWriteFileGather",
      "address": "0x77319320",
      "type": "function"
    },
    {
      "module": "ntdll.dll",
      "name": "RtlDisownModuleHeapAllocation",
      "address": "0x77312520",
      "type": "function"
    },
    {
      "module": "ntdll.dll",
      "name": "ZwReadFile",
      "address": "0x773191b0",
      "type": "function"
    },
    {
      "module": "ntdll.dll",
      "name": "ZwReadFileScatter",
      "address": "0x77319450",
      "type": "function"
    },
    {
      "module": "ntdll.dll",
      "name": "ZwWriteFile",
      "address": "0x773191d0",
      "type": "function"
    },
    {
      "module": "ntdll.dll",
      "name": "ZwWriteFileGather",
      "address": "0x77319320",
      "type": "function"
    },
    {
      "module": "KERNEL32.DLL",
      "name": "CopyFileW",
      "address": "0x760af130",
      "type": "function"
    },
    {
      "module": "KERNEL32.DLL",
      "name": "CreateDirectoryW",
      "address": "0x760ae9c0",
      "type": "function"
    },
    {
      "module": "KERNEL32.DLL",
      "name": "CreateFileA",
      "address": "0x760ae9f0",
      "type": "function"
    },
    {
      "module": "KERNEL32.DLL",
      "name": "CreateFileW",
      "address": "0x760aea00",
      "type": "function"
    },
    {
      "module": "KERNEL32.DLL",
      "name": "HeapFree",
      "address": "0x760a41b0",
      "type": "function"
    },
    {
      "module": "KERNEL32.DLL",
      "name": "LZCreateFileW",
      "address": "0x760c34e0",
      "type": "function"
    },
    {
      "module": "KERNEL32.DLL",
      "name": "MoveFileExW",
      "address": "0x760c1b60",
      "type": "function"
    },
    {
      "module": "KERNEL32.DLL",
      "name": "MoveFileW",
      "address": "0x760f0160",
      "type": "function"
    },
    {
      "module": "KERNEL32.DLL",
      "name": "MoveFileWithProgressA",
      "address": "0x760f0190",
      "type": "function"
    },
    {
      "module": "KERNEL32.DLL",
      "name": "MoveFileWithProgressW",
      "address": "0x760c1b80",
      "type": "function"
    },
    {
      "module": "KERNEL32.DLL",
      "name": "ReadFile",
      "address": "0x760aedc0",
      "type": "function"
    },
    {
      "module": "KERNEL32.DLL",
      "name": "ReadFileEx",
      "address": "0x760aedd0",
      "type": "function"
    },
    {
      "module": "KERNEL32.DLL",
      "name": "ReadFileScatter",
      "address": "0x760aede0",
      "type": "function"
    },
    {
      "module": "KERNEL32.DLL",
      "name": "RemoveDirectoryW",
      "address": "0x760aee20",
      "type": "function"
    },
    {
      "module": "KERNEL32.DLL",
      "name": "VirtualAlloc",
      "address": "0x760a65f0",
      "type": "function"
    },
    {
      "module": "KERNEL32.DLL",
      "name": "VirtualAllocEx",
      "address": "0x760c2df0",
      "type": "function"
    },
    {
      "module": "KERNEL32.DLL",
      "name": "VirtualAllocExNuma",
      "address": "0x760c2dd0",
      "type": "function"
    },
    {
      "module": "KERNEL32.DLL",
      "name": "VirtualFree",
      "address": "0x760a5010",
      "type": "function"
    },
    {
      "module": "KERNEL32.DLL",
      "name": "VirtualFreeEx",
      "address": "0x760c2e10",
      "type": "function"
    },
    {
      "module": "KERNEL32.DLL",
      "name": "WriteFile",
      "address": "0x760aeed0",
      "type": "function"
    },
    {
      "module": "KERNEL32.DLL",
      "name": "WriteFileEx",
      "address": "0x760aeee0",
      "type": "function"
    },
    {
      "module": "KERNEL32.DLL",
      "name": "WriteFileGather",
      "address": "0x760aeef0",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "AppPolicyGetCreateFileAccess",
      "address": "0x76709fa0",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "BuildIoRingReadFile",
      "address": "0x766717e0",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "BuildIoRingReadFileScatter",
      "address": "0x766718d0",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "BuildIoRingWriteFile",
      "address": "0x76671ae0",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "BuildIoRingWriteFileGather",
      "address": "0x76671bf0",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "CopyFileW",
      "address": "0x766d6be0",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "CreateDirectoryW",
      "address": "0x76625d40",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "CreateFileA",
      "address": "0x76655b20",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "CreateFileW",
      "address": "0x76636c70",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "MoveFileExW",
      "address": "0x766d82c0",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "MoveFileWithProgressTransactedW",
      "address": "0x766d8300",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "MoveFileWithProgressW",
      "address": "0x766d8cc0",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "ReadFile",
      "address": "0x766481a0",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "ReadFileEx",
      "address": "0x7672df40",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "ReadFileScatter",
      "address": "0x7672dff0",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "RemoveDirectoryW",
      "address": "0x76733b60",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "VirtualAlloc",
      "address": "0x766253f0",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "VirtualAlloc2",
      "address": "0x7672a630",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "VirtualAlloc2FromApp",
      "address": "0x7672a6c0",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "VirtualAllocEx",
      "address": "0x76625450",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "VirtualAllocExNuma",
      "address": "0x76625480",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "VirtualAllocFromApp",
      "address": "0x7672a6f0",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "VirtualFree",
      "address": "0x76646540",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "VirtualFreeEx",
      "address": "0x7672a730",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "WriteFile",
      "address": "0x76648d50",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "WriteFileEx",
      "address": "0x7672e260",
      "type": "function"
    },
    {
      "module": "KERNELBASE.dll",
      "name": "WriteFileGather",
      "address": "0x7672e310",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_aligned_free",
      "address": "0x763cb980",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_aligned_malloc",
      "address": "0x763cb9a0",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_aligned_offset_malloc",
      "address": "0x763cbbc0",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_aligned_offset_realloc",
      "address": "0x7640cbf0",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_aligned_offset_recalloc",
      "address": "0x7640ce50",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_aligned_realloc",
      "address": "0x763cba10",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_aligned_recalloc",
      "address": "0x7640d110",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_calloc_base",
      "address": "0x763a2540",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_free_base",
      "address": "0x763900b0",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_free_locale",
      "address": "0x763a51b0",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_getdiskfree",
      "address": "0x764465d0",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_malloc_base",
      "address": "0x7638df10",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_o__aligned_free",
      "address": "0x763dfd10",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_o__aligned_malloc",
      "address": "0x763cb390",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_o__aligned_offset_malloc",
      "address": "0x763e7440",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_o__aligned_offset_realloc",
      "address": "0x76402120",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_o__aligned_offset_recalloc",
      "address": "0x76402150",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_o__aligned_realloc",
      "address": "0x76402180",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_o__aligned_recalloc",
      "address": "0x764021b0",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_o__calloc_base",
      "address": "0x763cb370",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_o__free_base",
      "address": "0x763dbf90",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_o__free_locale",
      "address": "0x76402ed0",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_o__getdiskfree",
      "address": "0x764033f0",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_o__malloc_base",
      "address": "0x763dcc70",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_o__realloc_base",
      "address": "0x763d9f70",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_o__recalloc",
      "address": "0x763cd630",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_o_calloc",
      "address": "0x763cb3b0",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_o_free",
      "address": "0x763c72c0",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_o_malloc",
      "address": "0x763c7c10",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_o_realloc",
      "address": "0x763d9f90",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_realloc_base",
      "address": "0x763c1900",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "_recalloc",
      "address": "0x763c1620",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "calloc",
      "address": "0x763cb450",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "free",
      "address": "0x76390080",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "malloc",
      "address": "0x76390100",
      "type": "function"
    },
    {
      "module": "ucrtbase.dll",
      "name": "realloc",
      "address": "0x763ce5b0",
      "type": "function"
    },
    {
      "module": "combase.dll",
      "name": "WindowsPreallocateStringBuffer",
      "address": "0x74e47d80",
      "type": "function"
    },
    {
      "module": "msvcp_win.dll",
      "name": "__std_calloc_crt",
      "address": "0x771225e0",
      "type": "function"
    },
    {
      "module": "msvcp_win.dll",
      "name": "__std_free_crt",
      "address": "0x77122600",
      "type": "function"
    },
    {
      "module": "advapi32.dll",
      "name": "CryptDecrypt",
      "address": "0x74c28c90",
      "type": "function"
    },
    {
      "module": "advapi32.dll",
      "name": "CryptEncrypt",
      "address": "0x74c3e270",
      "type": "function"
    },
    {
      "module": "advapi32.dll",
      "name": "MIDL_user_free_Ext",
      "address": "0x74c3f9b0",
      "type": "function"
    },
    {
      "module": "msvcrt.dll",
      "name": "__freefls@4",
      "address": "0x74a58680",
      "type": "function"
    },
    {
      "module": "msvcrt.dll",
      "name": "_aligned_free",
      "address": "0x74a36230",
      "type": "function"
    },
    {
      "module": "msvcrt.dll",
      "name": "_aligned_free_dbg",
      "address": "0x74a466d0",
      "type": "function"
    },
    {
      "module": "msvcrt.dll",
      "name": "_aligned_malloc",
      "address": "0x74a36250",
      "type": "function"
    },
    {
      "module": "msvcrt.dll",
      "name": "_aligned_malloc_dbg",
      "address": "0x74a36250",
      "type": "function"
    },
    {
      "module": "msvcrt.dll",
      "name": "_aligned_offset_malloc",
      "address": "0x74a36270",
      "type": "function"
    },
    {
      "module": "msvcrt.dll",
      "name": "_aligned_offset_malloc_dbg",
      "address": "0x74a466e0",
      "type": "function"
    },
    {
      "module": "msvcrt.dll",
      "name": "_aligned_offset_realloc",
      "address": "0x74a36330",
      "type": "function"
    },
    {
      "module": "msvcrt.dll",
      "name": "_aligned_offset_realloc_dbg",
      "address": "0x74a46700",
      "type": "function"
    },
    {
      "module": "msvcrt.dll",
      "name": "_aligned_realloc",
      "address": "0x74a364c0",
      "type": "function"
    },
    {
      "module": "msvcrt.dll",
      "name": "_aligned_realloc_dbg",
      "address": "0x74a364c0",
      "type": "function"
    },
    {
      "module": "msvcrt.dll",
      "name": "_calloc_dbg",
      "address": "0x74a46730",
      "type": "function"
    },
    {
      "module": "msvcrt.dll",
      "name": "_free_dbg",
      "address": "0x74a46770",
      "type": "function"
    },
    {
      "module": "msvcrt.dll",
      "name": "_free_locale",
      "address": "0x74a47640",
      "type": "function"
    },
    {
      "module": "msvcrt.dll",
      "name": "_freea",
      "address": "0x74a3aba0",
      "type": "function"
    },
    {
      "module": "msvcrt.dll",
      "name": "_freea_s",
      "address": "0x74a3aba0",
      "type": "function"
    },
    {
      "module": "msvcrt.dll",
      "name": "_getdiskfree",
      "address": "0x74a253d0",
      "type": "function"
    },
    {
      "module": "msvcrt.dll",
      "name": "_malloc_dbg",
      "address": "0x74a46790",
      "type": "function"
    },
    {
      "module": "msvcrt.dll",
      "name": "_realloc_dbg",
      "address": "0x74a467d0",
      "type": "function"
    },
    {
      "module": "msvcrt.dll",
      "name": "calloc",
      "address": "0x74a387f0",
      "type": "function"
    },
    {
      "module": "msvcrt.dll",
      "name": "free",
      "address": "0x74a38840",
      "type": "function"
    },
    {
      "module": "msvcrt.dll",
      "name": "malloc",
      "address": "0x74a38a30",
      "type": "function"
    },
    {
      "module": "msvcrt.dll",
      "name": "realloc",
      "address": "0x74a38b20",
      "type": "function"
    },
    {
      "module": "WS2_32.dll",
      "name": "WSARecv",
      "address": "0x74ca0b90",
      "type": "function"
    },
    {
      "module": "WS2_32.dll",
      "name": "WSARecvDisconnect",
      "address": "0x74cbf230",
      "type": "function"
    },
    {
      "module": "WS2_32.dll",
      "name": "WSARecvFrom",
      "address": "0x74caace0",
      "type": "function"
    },
    {
      "module": "WS2_32.dll",
      "name": "WSASend",
      "address": "0x74ca01e0",
      "type": "function"
    },
    {
      "module": "WS2_32.dll",
      "name": "WSASendDisconnect",
      "address": "0x74cc0fe0",
      "type": "function"
    },
    {
      "module": "WS2_32.dll",
      "name": "WSASendMsg",
      "address": "0x74c9f610",
      "type": "function"
    },
    {
      "module": "WS2_32.dll",
      "name": "WSASendTo",
      "address": "0x74cc10a0",
      "type": "function"
    },
    {
      "module": "WS2_32.dll",
      "name": "freeaddrinfo",
      "address": "0x74c952d0",
      "type": "function"
    },
    {
      "module": "WS2_32.dll",
      "name": "recv",
      "address": "0x74ca6380",
      "type": "function"
    },
    {
      "module": "WS2_32.dll",
      "name": "recvfrom",
      "address": "0x74caaba0",
      "type": "function"
    },
    {
      "module": "WS2_32.dll",
      "name": "recvfrom",
      "address": "0x74caaba0",
      "type": "function"
    },
    {
      "module": "WS2_32.dll",
      "name": "send",
      "address": "0x74ca6c30",
      "type": "function"
    },
    {
      "module": "WS2_32.dll",
      "name": "sendto",
      "address": "0x74caa3f0",
      "type": "function"
    },
    {
      "module": "WS2_32.dll",
      "name": "sendto",
      "address": "0x74caa3f0",
      "type": "function"
    },
    {
      "module": "GDI32.dll",
      "name": "CreateBitmap",
      "address": "0x77024870",
      "type": "function"
    },
    {
      "module": "GDI32.dll",
      "name": "CreateBitmapFromDxSurface",
      "address": "0x77024cf0",
      "type": "function"
    },
    {
      "module": "GDI32.dll",
      "name": "CreateBitmapFromDxSurface2",
      "address": "0x77024ce0",
      "type": "function"
    },
    {
      "module": "GDI32.dll",
      "name": "CreateBitmapIndirect",
      "address": "0x7702a7b0",
      "type": "function"
    },
    {
      "module": "GDI32.dll",
      "name": "CreateCompatibleBitmap",
      "address": "0x77024ac0",
      "type": "function"
    },
    {
      "module": "GDI32.dll",
      "name": "CreateDIBSection",
      "address": "0x7702a850",
      "type": "function"
    },
    {
      "module": "GDI32.dll",
      "name": "EngCreateBitmap",
      "address": "0x77027220",
      "type": "function"
    },
    {
      "module": "GDI32.dll",
      "name": "GetDIBits",
      "address": "0x770247b0",
      "type": "function"
    },
    {
      "module": "GDI32.dll",
      "name": "SetDIBits",
      "address": "0x7702c150",
      "type": "function"
    },
    {
      "module": "GDI32.dll",
      "name": "SetDIBitsToDevice",
      "address": "0x770298d0",
      "type": "function"
    },
    {
      "module": "win32u.dll",
      "name": "NtGdiCreateBitmap",
      "address": "0x748e17d0",
      "type": "function"
    },
    {
      "module": "win32u.dll",
      "name": "NtGdiCreateBitmapFromDxSurface",
      "address": "0x748e2b20",
      "type": "function"
    },
    {
      "module": "win32u.dll",
      "name": "NtGdiCreateBitmapFromDxSurface2",
      "address": "0x748e2b30",
      "type": "function"
    },
    {
      "module": "win32u.dll",
      "name": "NtGdiCreateCompatibleBitmap",
      "address": "0x748e15d0",
      "type": "function"
    },
    {
      "module": "win32u.dll",
      "name": "NtGdiCreateDIBSection",
      "address": "0x748e1a90",
      "type": "function"
    },
    {
      "module": "win32u.dll",
      "name": "NtGdiEngCreateBitmap",
      "address": "0x748e3990",
      "type": "function"
    },
    {
      "module": "win32u.dll",
      "name": "NtGdiGetDIBitsInternal",
      "address": "0x748e1940",
      "type": "function"
    },
    {
      "module": "win32u.dll",
      "name": "NtGdiSetDIBitsToDeviceInternal",
      "address": "0x748e13c0",
      "type": "function"
    },
    {
      "module": "win32u.dll",
      "name": "NtRIMGetDevicePreparsedDataLockfree",
      "address": "0x748e4950",
      "type": "function"
    },
    {
      "module": "win32u.dll",
      "name": "NtRIMGetDevicePropertiesLockfree",
      "address": "0x748e4970",
      "type": "function"
    },
    {
      "module": "win32u.dll",
      "name": "NtUserCloseClipboard",
      "address": "0x748e1d30",
      "type": "function"
    },
    {
      "module": "win32u.dll",
      "name": "NtUserEmptyClipboard",
      "address": "0x748e1fb0",
      "type": "function"
    },
    {
      "module": "win32u.dll",
      "name": "NtUserGetClipboardData",
      "address": "0x748e1fc0",
      "type": "function"
    },
    {
      "module": "win32u.dll",
      "name": "NtUserGetOpenClipboardWindow",
      "address": "0x748e1dc0",
      "type": "function"
    },
    {
      "module": "win32u.dll",
      "name": "NtUserOpenClipboard",
      "address": "0x748e1d40",
      "type": "function"
    },
    {
      "module": "win32u.dll",
      "name": "NtUserSetClipboardData",
      "address": "0x748e1d50",
      "type": "function"
    },
    {
      "module": "gdi32full.dll",
      "name": "CreateBitmap",
      "address": "0x771d0c50",
      "type": "function"
    },
    {
      "module": "gdi32full.dll",
      "name": "CreateBitmapIndirect",
      "address": "0x771f4b40",
      "type": "function"
    },
    {
      "module": "gdi32full.dll",
      "name": "CreateCompatibleBitmap",
      "address": "0x771d0930",
      "type": "function"
    },
    {
      "module": "gdi32full.dll",
      "name": "CreateDIBSection",
      "address": "0x771f4c80",
      "type": "function"
    },
    {
      "module": "gdi32full.dll",
      "name": "EngCreateBitmap",
      "address": "0x771e7b20",
      "type": "function"
    },
    {
      "module": "gdi32full.dll",
      "name": "GetDIBits",
      "address": "0x771d03f0",
      "type": "function"
    },
    {
      "module": "gdi32full.dll",
      "name": "NtGdiCreateBitmap",
      "address": "0x771d6510",
      "type": "function"
    },
    {
      "module": "gdi32full.dll",
      "name": "NtGdiCreateBitmapFromDxSurface",
      "address": "0x771d6530",
      "type": "function"
    },
    {
      "module": "gdi32full.dll",
      "name": "NtGdiCreateBitmapFromDxSurface2",
      "address": "0x771d6520",
      "type": "function"
    },
    {
      "module": "gdi32full.dll",
      "name": "NtGdiCreateCompatibleBitmap",
      "address": "0x771d6570",
      "type": "function"
    },
    {
      "module": "gdi32full.dll",
      "name": "NtGdiCreateDIBSection",
      "address": "0x771d65a0",
      "type": "function"
    },
    {
      "module": "gdi32full.dll",
      "name": "NtGdiGetDIBitsInternal",
      "address": "0x771d6d20",
      "type": "function"
    },
    {
      "module": "gdi32full.dll",
      "name": "NtGdiSetDIBitsToDeviceInternal",
      "address": "0x771d7510",
      "type": "function"
    },
    {
      "module": "gdi32full.dll",
      "name": "SetDIBits",
      "address": "0x771f51a0",
      "type": "function"
    },
    {
      "module": "gdi32full.dll",
      "name": "SetDIBitsToDevice",
      "address": "0x771f52e0",
      "type": "function"
    },
    {
      "module": "USER32.dll",
      "name": "CloseClipboard",
      "address": "0x76231a90",
      "type": "function"
    },
    {
      "module": "USER32.dll",
      "name": "EmptyClipboard",
      "address": "0x76231b00",
      "type": "function"
    },
    {
      "module": "USER32.dll",
      "name": "GetClipboardData",
      "address": "0x76236c80",
      "type": "function"
    },
    {
      "module": "USER32.dll",
      "name": "GetOpenClipboardWindow",
      "address": "0x761c9440",
      "type": "function"
    },
    {
      "module": "USER32.dll",
      "name": "OpenClipboard",
      "address": "0x76222eb0",
      "type": "function"
    },
    {
      "module": "USER32.dll",
      "name": "RIMGetDevicePreparsedDataLockfree",
      "address": "0x761ca730",
      "type": "function"
    },
    {
      "module": "USER32.dll",
      "name": "RIMGetDevicePropertiesLockfree",
      "address": "0x761ca750",
      "type": "function"
    },
    {
      "module": "USER32.dll",
      "name": "SetClipboardData",
      "address": "0x76238210",
      "type": "function"
    },
    {
      "module": "gdiplus.dll",
      "name": "GdipCreateBitmapFromDirectDrawSurface",
      "address": "0x742c27c0",
      "type": "function"
    },
    {
      "module": "gdiplus.dll",
      "name": "GdipCreateBitmapFromFile",
      "address": "0x74278920",
      "type": "function"
    },
    {
      "module": "gdiplus.dll",
      "name": "GdipCreateBitmapFromFileICM",
      "address": "0x742c2880",
      "type": "function"
    },
    {
      "module": "gdiplus.dll",
      "name": "GdipCreateBitmapFromGdiDib",
      "address": "0x74243520",
      "type": "function"
    },
    {
      "module": "gdiplus.dll",
      "name": "GdipCreateBitmapFromGraphics",
      "address": "0x7428f6f0",
      "type": "function"
    },
    {
      "module": "gdiplus.dll",
      "name": "GdipCreateBitmapFromHBITMAP",
      "address": "0x7426b090",
      "type": "function"
    },
    {
      "module": "gdiplus.dll",
      "name": "GdipCreateBitmapFromHICON",
      "address": "0x7428f2a0",
      "type": "function"
    },
    {
      "module": "gdiplus.dll",
      "name": "GdipCreateBitmapFromResource",
      "address": "0x7428ecb0",
      "type": "function"
    },
    {
      "module": "gdiplus.dll",
      "name": "GdipCreateBitmapFromScan0",
      "address": "0x74255d50",
      "type": "function"
    },
    {
      "module": "gdiplus.dll",
      "name": "GdipCreateBitmapFromStream",
      "address": "0x74296c60",
      "type": "function"
    },
    {
      "module": "gdiplus.dll",
      "name": "GdipCreateBitmapFromStreamICM",
      "address": "0x742c29f0",
      "type": "function"
    },
    {
      "module": "CRYPT32.dll",
      "name": "CryptDecryptAndVerifyMessageSignature",
      "address": "0x7600a9c0",
      "type": "function"
    },
    {
      "module": "CRYPT32.dll",
      "name": "CryptDecryptMessage",
      "address": "0x7600aac0",
      "type": "function"
    },
    {
      "module": "CRYPT32.dll",
      "name": "CryptDecryptMessage",
      "address": "0x7600aac0",
      "type": "function"
    },
    {
      "module": "CRYPT32.dll",
      "name": "CryptEncryptMessage",
      "address": "0x7600ab00",
      "type": "function"
    },
    {
      "module": "CRYPT32.dll",
      "name": "CryptEncryptMessage",
      "address": "0x7600ab00",
      "type": "function"
    },
    {
      "module": "CRYPT32.dll",
      "name": "CryptSignAndEncryptMessage",
      "address": "0x7600ae80",
      "type": "function"
    },
    {
      "module": "SSPICLI.DLL",
      "name": "DecryptMessage",
      "address": "0x740dec80",
      "type": "function"
    },
    {
      "module": "SSPICLI.DLL",
      "name": "EncryptMessage",
      "address": "0x740dec20",
      "type": "function"
    },
    {
      "module": "SETUPAPI.dll",
      "name": "SetupDecompressOrCopyFileW",
      "address": "0x76823630",
      "type": "function"
    },
    {
      "module": "kernel.appcore.dll",
      "name": "AppPolicyGetCreateFileAccess",
      "address": "0x73f93890",
      "type": "function"
    },
    {
      "module": "WindowsCodecs.dll",
      "name": "IWICImagingFactory_CreateBitmapClipper_Proxy",
      "address": "0x73e0da40",
      "type": "function"
    },
    {
      "module": "WindowsCodecs.dll",
      "name": "IWICImagingFactory_CreateBitmapFlipRotator_Proxy",
      "address": "0x73e0da80",
      "type": "function"
    },
    {
      "module": "WindowsCodecs.dll",
      "name": "IWICImagingFactory_CreateBitmapFromHBITMAP_Proxy",
      "address": "0x73e0dac0",
      "type": "function"
    },
    {
      "module": "WindowsCodecs.dll",
      "name": "IWICImagingFactory_CreateBitmapFromHICON_Proxy",
      "address": "0x73e0db00",
      "type": "function"
    },
    {
      "module": "WindowsCodecs.dll",
      "name": "IWICImagingFactory_CreateBitmapFromMemory_Proxy",
      "address": "0x73e0db40",
      "type": "function"
    },
    {
      "module": "WindowsCodecs.dll",
      "name": "IWICImagingFactory_CreateBitmapFromSource_Proxy",
      "address": "0x73e0db90",
      "type": "function"
    },
    {
      "module": "WindowsCodecs.dll",
      "name": "IWICImagingFactory_CreateBitmapScaler_Proxy",
      "address": "0x73e0dbd0",
      "type": "function"
    },
    {
      "module": "WindowsCodecs.dll",
      "name": "IWICImagingFactory_CreateBitmap_Proxy",
      "address": "0x73e0dc10",
      "type": "function"
    },
    {
      "module": "WindowsCodecs.dll",
      "name": "WICCreateBitmapFromSection",
      "address": "0x73e0e0e0",
      "type": "function"
    },
    {
      "module": "WindowsCodecs.dll",
      "name": "WICCreateBitmapFromSectionEx",
      "address": "0x73e0e110",
      "type": "function"
    },
    {
      "module": "bcrypt.dll",
      "name": "BCryptDecrypt",
      "address": "0x739b6d10",
      "type": "function"
    },
    {
      "module": "bcrypt.dll",
      "name": "BCryptDecrypt",
      "address": "0x739b6d10",
      "type": "function"
    },
    {
      "module": "bcrypt.dll",
      "name": "BCryptEncrypt",
      "address": "0x739b6a30",
      "type": "function"
    },
    {
      "module": "bcrypt.dll",
      "name": "BCryptEncrypt",
      "address": "0x739b6a30",
      "type": "function"
    }
  ],
  "strings": [
    {
      "pattern": "file_transfer",
      "count": 602,
      "first_addr": "0x1159cf9",
      "context": "ccept.connected.file_transfer=Connected..ad.accept.connected.fil"
    },
    {
      "pattern": "clipboard",
      "count": 641,
      "first_addr": "0x115977f",
      "context": ".ad.accept.auth.clipboard=Allow to use clipboard..ad.accept.auth"
    },
    {
      "pattern": "Clipboard",
      "count": 143,
      "first_addr": "0x117a14e",
      "context": ".perm.clipboard=Clipboard..ad.status.sess.remote.perm.clipboard_"
    },
    {
      "pattern": "identity",
      "count": 73,
      "first_addr": "0xf41014",
      "context": "time_hint...psk_identity....psk_identity_hint...tlsext_hostname."
    },
    {
      "pattern": "Identity",
      "count": 11,
      "first_addr": "0xf4dbe7",
      "context": ".id-aca-chargingIdentity.id-aca-accessIdentity...id-aca-authenti"
    },
    {
      "pattern": "user_image",
      "count": 63,
      "first_addr": "0x10d0827",
      "context": "ettings.general.user_image.title=User Image..at.settings.general"
    },
    {
      "pattern": "avatar",
      "count": 2,
      "first_addr": "0x18a18a8",
      "context": "........meeting_avatar.png..meeting_avatar_thumb.png........ ..."
    },
    {
      "pattern": "codec",
      "count": 1,
      "first_addr": "0x1858cd1",
      "context": "art....lossless_codec..report_kbd_focus....reset_vp_resolution.s"
    },
    {
      "pattern": "Codec",
      "count": 1,
      "first_addr": "0x189e6ac",
      "context": "ion mismatch....Codec does not implement requested capability..."
    },
    {
      "pattern": "bitmap",
      "count": 5,
      "first_addr": "0x184f405",
      "context": "ould not create bitmap (%i)........Could not create bitmap from "
    },
    {
      "pattern": "Bitmap",
      "count": 12,
      "first_addr": "0x18c68ae",
      "context": "..MFGetStrideForBitmapInfoHeader..size....en-GB...es-ES...de-DE."
    },
    {
      "pattern": "PNG",
      "count": 560,
      "first_addr": "0xbef255",
      "context": "....D$8.....D$ .PNG.D$$....u..D$H..D$P.D$DSU.l$TV.t$T..t$\\W.~..."
    },
    {
      "pattern": "validate_path",
      "count": 1,
      "first_addr": "0xf6277d",
      "context": "rBlocks....addr_validate_path_internal.ASIdentifiers...rdi.asnum"
    },
    {
      "pattern": "ad.security",
      "count": 408,
      "first_addr": "0x1673f9a",
      "context": "_capture=false..ad.security.connect.send_user_list=0..ad.securit"
    },
    {
      "pattern": "TLS",
      "count": 240,
      "first_addr": "0xf3a039",
      "context": "_void_function.DTLSv1..DTLSv1.2....TLSv1...TLSv1.1.TLSv1.2.TLSv1"
    },
    {
      "pattern": "handshake",
      "count": 73,
      "first_addr": "0xf39ff7",
      "context": "_and_alg.SSL_do_handshake....ssl_undefined_function..ssl_undefin"
    },
    {
      "pattern": "Handshake",
      "count": 2,
      "first_addr": "0xf42317",
      "context": "ssl3.RequirePostHandshake....RequestPostHandshake....Once....Req"
    }
  ],
  "tls_indicators": [
    {
      "name": "SSPICLI.DLL",
      "base": "0x740c0000",
      "size": 176128,
      "path": "C:\\WINDOWS\\SYSTEM32\\SSPICLI.DLL"
    },
    {
      "name": "bcryptPrimitives.dll",
      "base": "0x750b0000",
      "size": 475136,
      "path": "C:\\WINDOWS\\System32\\bcryptPrimitives.dll"
    },
    {
      "name": "bcrypt.dll",
      "base": "0x739b0000",
      "size": 114688,
      "path": "C:\\WINDOWS\\SYSTEM32\\bcrypt.dll"
    }
  ]
}