API tools faq
paste
paladin316

Exes_f93f861659353f85bb460998353ad146_exe_2019-07-03_13_30.json

paladin316
Jul 3rd, 2019
2,172
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 97.43 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_f93f861659353f85bb460998353ad146.exe"
  7. [*] File Size: 927744
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "cbbbd4cb30f68ace970d0d7365e44c661e11b33d586083beefb6a4f473370229"
  10. [*] MD5: "f93f861659353f85bb460998353ad146"
  11. [*] SHA1: "722c759a5ce767de507cdba1e0099366b6cc3ce3"
  12. [*] SHA512: "8949f534e4e48bfc341ae9ff465c4c4a30fbe6563679d62afd3d911cec5fa3f5d8fd49b297b9b30a00e6f56c35516141b305e590734c40a929ac949331dcaeaf"
  13. [*] CRC32: "1890A849"
  14. [*] SSDEEP: "12288:DDxkgWi/xpT2QGsdygouzsMLj6G98dlaWleXcGCqkPUuqDN/HA4WU6/GKae:DDmgWOx129tuzsHk8dQWwXe1GDNvz6Y"
  15.  
  16. [*] Process Execution: [
  17. "Exes_f93f861659353f85bb460998353ad146.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  23. "Details": [
  24. {
  25. "IP": "8.8.8.8:53"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "File has been identified by 22 Antiviruses on VirusTotal as malicious",
  31. "Details": [
  32. {
  33. "FireEye": "Generic.mg.f93f861659353f85"
  34. },
  35. {
  36. "Cylance": "Unsafe"
  37. },
  38. {
  39. "K7AntiVirus": "Trojan ( 005514e51 )"
  40. },
  41. {
  42. "NANO-Antivirus": "Trojan.Win32.AveMaria.fsczbi"
  43. },
  44. {
  45. "APEX": "Malicious"
  46. },
  47. {
  48. "Paloalto": "generic.ml"
  49. },
  50. {
  51. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  52. },
  53. {
  54. "DrWeb": "Trojan.PWS.Maria.4"
  55. },
  56. {
  57. "Fortinet": "W32/GenKryptik.DMDB!tr"
  58. },
  59. {
  60. "SentinelOne": "DFI - Malicious PE"
  61. },
  62. {
  63. "Antiy-AVL": "Trojan/Win32.Wacatac"
  64. },
  65. {
  66. "Endgame": "malicious (high confidence)"
  67. },
  68. {
  69. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  70. },
  71. {
  72. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  73. },
  74. {
  75. "Malwarebytes": "Backdoor.AveMaria"
  76. },
  77. {
  78. "ESET-NOD32": "a variant of Win32/GenKryptik.DMDB"
  79. },
  80. {
  81. "Rising": "Spyware.AveMaria!8.108C2 (TFE:dGZlOgW4gtYXgFJJig)"
  82. },
  83. {
  84. "AVG": "Win32:Trojan-gen"
  85. },
  86. {
  87. "Cybereason": "malicious.a5ce76"
  88. },
  89. {
  90. "Avast": "Win32:Trojan-gen"
  91. },
  92. {
  93. "CrowdStrike": "win/malicious_confidence_100% (D)"
  94. },
  95. {
  96. "Qihoo-360": "HEUR/QVM20.1.468D.Malware.Gen"
  97. }
  98. ]
  99. }
  100. ]
  101.  
  102. [*] Started Service: []
  103.  
  104. [*] Executed Commands: []
  105.  
  106. [*] Mutexes: []
  107.  
  108. [*] Modified Files: []
  109.  
  110. [*] Deleted Files: []
  111.  
  112. [*] Modified Registry Keys: []
  113.  
  114. [*] Deleted Registry Keys: []
  115.  
  116. [*] DNS Communications: []
  117.  
  118. [*] Domains: []
  119.  
  120. [*] Network Communication - ICMP: []
  121.  
  122. [*] Network Communication - HTTP: []
  123.  
  124. [*] Network Communication - SMTP: []
  125.  
  126. [*] Network Communication - Hosts: []
  127.  
  128. [*] Network Communication - IRC: []
  129.  
  130. [*] Static Analysis: {
  131. "pe": {
  132. "peid_signatures": null,
  133. "imports": [
  134. {
  135. "imports": [
  136. {
  137. "name": "GetComputerNameExW",
  138. "address": "0x4690b4"
  139. },
  140. {
  141. "name": "GetConsoleCP",
  142. "address": "0x4690b8"
  143. },
  144. {
  145. "name": "GetConsoleMode",
  146. "address": "0x4690bc"
  147. },
  148. {
  149. "name": "GetCurrentDirectoryW",
  150. "address": "0x4690c0"
  151. },
  152. {
  153. "name": "GetCurrentProcessId",
  154. "address": "0x4690c4"
  155. },
  156. {
  157. "name": "GetCurrentThread",
  158. "address": "0x4690c8"
  159. },
  160. {
  161. "name": "GetCurrentThreadId",
  162. "address": "0x4690cc"
  163. },
  164. {
  165. "name": "GetDateFormatW",
  166. "address": "0x4690d0"
  167. },
  168. {
  169. "name": "GetDriveTypeW",
  170. "address": "0x4690d4"
  171. },
  172. {
  173. "name": "GetEnvironmentStringsW",
  174. "address": "0x4690d8"
  175. },
  176. {
  177. "name": "GetExitCodeProcess",
  178. "address": "0x4690dc"
  179. },
  180. {
  181. "name": "GetFileAttributesW",
  182. "address": "0x4690e0"
  183. },
  184. {
  185. "name": "GetFileInformationByHandle",
  186. "address": "0x4690e4"
  187. },
  188. {
  189. "name": "GetFileInformationByHandleEx",
  190. "address": "0x4690e8"
  191. },
  192. {
  193. "name": "GetFileSizeEx",
  194. "address": "0x4690ec"
  195. },
  196. {
  197. "name": "GetFileType",
  198. "address": "0x4690f0"
  199. },
  200. {
  201. "name": "GetFullPathNameW",
  202. "address": "0x4690f4"
  203. },
  204. {
  205. "name": "GetLastError",
  206. "address": "0x4690f8"
  207. },
  208. {
  209. "name": "GetLocalTime",
  210. "address": "0x4690fc"
  211. },
  212. {
  213. "name": "GetLocaleInfoW",
  214. "address": "0x469100"
  215. },
  216. {
  217. "name": "GetLongPathNameW",
  218. "address": "0x469104"
  219. },
  220. {
  221. "name": "GetModuleFileNameW",
  222. "address": "0x469108"
  223. },
  224. {
  225. "name": "GetModuleHandleA",
  226. "address": "0x46910c"
  227. },
  228. {
  229. "name": "GetModuleHandleExW",
  230. "address": "0x469110"
  231. },
  232. {
  233. "name": "GetModuleHandleW",
  234. "address": "0x469114"
  235. },
  236. {
  237. "name": "GetNativeSystemInfo",
  238. "address": "0x469118"
  239. },
  240. {
  241. "name": "GetOEMCP",
  242. "address": "0x46911c"
  243. },
  244. {
  245. "name": "GetProcAddress",
  246. "address": "0x469120"
  247. },
  248. {
  249. "name": "GetProcessHandleCount",
  250. "address": "0x469124"
  251. },
  252. {
  253. "name": "GetProcessHeaps",
  254. "address": "0x469128"
  255. },
  256. {
  257. "name": "GetProcessId",
  258. "address": "0x46912c"
  259. },
  260. {
  261. "name": "GetProcessTimes",
  262. "address": "0x469130"
  263. },
  264. {
  265. "name": "GetQueuedCompletionStatus",
  266. "address": "0x469134"
  267. },
  268. {
  269. "name": "GetStartupInfoW",
  270. "address": "0x469138"
  271. },
  272. {
  273. "name": "GetStdHandle",
  274. "address": "0x46913c"
  275. },
  276. {
  277. "name": "GetStringTypeW",
  278. "address": "0x469140"
  279. },
  280. {
  281. "name": "GetSystemDefaultLCID",
  282. "address": "0x469144"
  283. },
  284. {
  285. "name": "GetSystemDirectoryW",
  286. "address": "0x469148"
  287. },
  288. {
  289. "name": "GetSystemInfo",
  290. "address": "0x46914c"
  291. },
  292. {
  293. "name": "GetSystemTimeAsFileTime",
  294. "address": "0x469150"
  295. },
  296. {
  297. "name": "GetTempPathW",
  298. "address": "0x469154"
  299. },
  300. {
  301. "name": "GetThreadContext",
  302. "address": "0x469158"
  303. },
  304. {
  305. "name": "GetThreadId",
  306. "address": "0x46915c"
  307. },
  308. {
  309. "name": "GetThreadLocale",
  310. "address": "0x469160"
  311. },
  312. {
  313. "name": "GetThreadPriority",
  314. "address": "0x469164"
  315. },
  316. {
  317. "name": "GetTickCount",
  318. "address": "0x469168"
  319. },
  320. {
  321. "name": "GetTimeFormatW",
  322. "address": "0x46916c"
  323. },
  324. {
  325. "name": "GetTimeZoneInformation",
  326. "address": "0x469170"
  327. },
  328. {
  329. "name": "GetUserDefaultLCID",
  330. "address": "0x469174"
  331. },
  332. {
  333. "name": "GetUserDefaultLangID",
  334. "address": "0x469178"
  335. },
  336. {
  337. "name": "GetUserDefaultLocaleName",
  338. "address": "0x46917c"
  339. },
  340. {
  341. "name": "GetVersion",
  342. "address": "0x469180"
  343. },
  344. {
  345. "name": "GetVersionExW",
  346. "address": "0x469184"
  347. },
  348. {
  349. "name": "GetWindowsDirectoryW",
  350. "address": "0x469188"
  351. },
  352. {
  353. "name": "HeapAlloc",
  354. "address": "0x46918c"
  355. },
  356. {
  357. "name": "HeapCreate",
  358. "address": "0x469190"
  359. },
  360. {
  361. "name": "HeapDestroy",
  362. "address": "0x469194"
  363. },
  364. {
  365. "name": "HeapFree",
  366. "address": "0x469198"
  367. },
  368. {
  369. "name": "HeapReAlloc",
  370. "address": "0x46919c"
  371. },
  372. {
  373. "name": "HeapSetInformation",
  374. "address": "0x4691a0"
  375. },
  376. {
  377. "name": "HeapSize",
  378. "address": "0x4691a4"
  379. },
  380. {
  381. "name": "InitOnceExecuteOnce",
  382. "address": "0x4691a8"
  383. },
  384. {
  385. "name": "InitializeCriticalSection",
  386. "address": "0x4691ac"
  387. },
  388. {
  389. "name": "InitializeCriticalSectionAndSpinCount",
  390. "address": "0x4691b0"
  391. },
  392. {
  393. "name": "InitializeSListHead",
  394. "address": "0x4691b4"
  395. },
  396. {
  397. "name": "IsDebuggerPresent",
  398. "address": "0x4691b8"
  399. },
  400. {
  401. "name": "IsProcessorFeaturePresent",
  402. "address": "0x4691bc"
  403. },
  404. {
  405. "name": "IsValidCodePage",
  406. "address": "0x4691c0"
  407. },
  408. {
  409. "name": "IsValidLocale",
  410. "address": "0x4691c4"
  411. },
  412. {
  413. "name": "IsWow64Process",
  414. "address": "0x4691c8"
  415. },
  416. {
  417. "name": "K32GetPerformanceInfo",
  418. "address": "0x4691cc"
  419. },
  420. {
  421. "name": "K32GetProcessMemoryInfo",
  422. "address": "0x4691d0"
  423. },
  424. {
  425. "name": "K32QueryWorkingSetEx",
  426. "address": "0x4691d4"
  427. },
  428. {
  429. "name": "LCMapStringW",
  430. "address": "0x4691d8"
  431. },
  432. {
  433. "name": "LeaveCriticalSection",
  434. "address": "0x4691dc"
  435. },
  436. {
  437. "name": "LoadLibraryExA",
  438. "address": "0x4691e0"
  439. },
  440. {
  441. "name": "LoadLibraryExW",
  442. "address": "0x4691e4"
  443. },
  444. {
  445. "name": "LoadLibraryW",
  446. "address": "0x4691e8"
  447. },
  448. {
  449. "name": "LocalFree",
  450. "address": "0x4691ec"
  451. },
  452. {
  453. "name": "LockFileEx",
  454. "address": "0x4691f0"
  455. },
  456. {
  457. "name": "MapViewOfFile",
  458. "address": "0x4691f4"
  459. },
  460. {
  461. "name": "GetCommandLineA",
  462. "address": "0x4691f8"
  463. },
  464. {
  465. "name": "MultiByteToWideChar",
  466. "address": "0x4691fc"
  467. },
  468. {
  469. "name": "OpenProcess",
  470. "address": "0x469200"
  471. },
  472. {
  473. "name": "OutputDebugStringA",
  474. "address": "0x469204"
  475. },
  476. {
  477. "name": "OutputDebugStringW",
  478. "address": "0x469208"
  479. },
  480. {
  481. "name": "PeekNamedPipe",
  482. "address": "0x46920c"
  483. },
  484. {
  485. "name": "PostQueuedCompletionStatus",
  486. "address": "0x469210"
  487. },
  488. {
  489. "name": "ProcessIdToSessionId",
  490. "address": "0x469214"
  491. },
  492. {
  493. "name": "QueryDosDeviceW",
  494. "address": "0x469218"
  495. },
  496. {
  497. "name": "QueryPerformanceCounter",
  498. "address": "0x46921c"
  499. },
  500. {
  501. "name": "QueryPerformanceFrequency",
  502. "address": "0x469220"
  503. },
  504. {
  505. "name": "QueryThreadCycleTime",
  506. "address": "0x469224"
  507. },
  508. {
  509. "name": "RaiseException",
  510. "address": "0x469228"
  511. },
  512. {
  513. "name": "ReadConsoleW",
  514. "address": "0x46922c"
  515. },
  516. {
  517. "name": "ReadFile",
  518. "address": "0x469230"
  519. },
  520. {
  521. "name": "ReadProcessMemory",
  522. "address": "0x469234"
  523. },
  524. {
  525. "name": "RegisterWaitForSingleObject",
  526. "address": "0x469238"
  527. },
  528. {
  529. "name": "ReleaseSRWLockExclusive",
  530. "address": "0x46923c"
  531. },
  532. {
  533. "name": "ReleaseSemaphore",
  534. "address": "0x469240"
  535. },
  536. {
  537. "name": "RemoveDirectoryW",
  538. "address": "0x469244"
  539. },
  540. {
  541. "name": "ReplaceFileW",
  542. "address": "0x469248"
  543. },
  544. {
  545. "name": "ResetEvent",
  546. "address": "0x46924c"
  547. },
  548. {
  549. "name": "ResumeThread",
  550. "address": "0x469250"
  551. },
  552. {
  553. "name": "RtlCaptureContext",
  554. "address": "0x469254"
  555. },
  556. {
  557. "name": "RtlCaptureStackBackTrace",
  558. "address": "0x469258"
  559. },
  560. {
  561. "name": "RtlUnwind",
  562. "address": "0x46925c"
  563. },
  564. {
  565. "name": "SearchPathW",
  566. "address": "0x469260"
  567. },
  568. {
  569. "name": "SetConsoleCtrlHandler",
  570. "address": "0x469264"
  571. },
  572. {
  573. "name": "SetCurrentDirectoryW",
  574. "address": "0x469268"
  575. },
  576. {
  577. "name": "SetEndOfFile",
  578. "address": "0x46926c"
  579. },
  580. {
  581. "name": "SetEnvironmentVariableW",
  582. "address": "0x469270"
  583. },
  584. {
  585. "name": "SetEvent",
  586. "address": "0x469274"
  587. },
  588. {
  589. "name": "SetFileAttributesW",
  590. "address": "0x469278"
  591. },
  592. {
  593. "name": "SetFilePointerEx",
  594. "address": "0x46927c"
  595. },
  596. {
  597. "name": "SetHandleInformation",
  598. "address": "0x469280"
  599. },
  600. {
  601. "name": "SetInformationJobObject",
  602. "address": "0x469284"
  603. },
  604. {
  605. "name": "SetLastError",
  606. "address": "0x469288"
  607. },
  608. {
  609. "name": "SetNamedPipeHandleState",
  610. "address": "0x46928c"
  611. },
  612. {
  613. "name": "SetProcessShutdownParameters",
  614. "address": "0x469290"
  615. },
  616. {
  617. "name": "SetStdHandle",
  618. "address": "0x469294"
  619. },
  620. {
  621. "name": "SetThreadPriority",
  622. "address": "0x469298"
  623. },
  624. {
  625. "name": "SetUnhandledExceptionFilter",
  626. "address": "0x46929c"
  627. },
  628. {
  629. "name": "SignalObjectAndWait",
  630. "address": "0x4692a0"
  631. },
  632. {
  633. "name": "SleepConditionVariableSRW",
  634. "address": "0x4692a4"
  635. },
  636. {
  637. "name": "SleepEx",
  638. "address": "0x4692a8"
  639. },
  640. {
  641. "name": "SuspendThread",
  642. "address": "0x4692ac"
  643. },
  644. {
  645. "name": "SwitchToThread",
  646. "address": "0x4692b0"
  647. },
  648. {
  649. "name": "SystemTimeToTzSpecificLocalTime",
  650. "address": "0x4692b4"
  651. },
  652. {
  653. "name": "TerminateJobObject",
  654. "address": "0x4692b8"
  655. },
  656. {
  657. "name": "TerminateProcess",
  658. "address": "0x4692bc"
  659. },
  660. {
  661. "name": "TlsAlloc",
  662. "address": "0x4692c0"
  663. },
  664. {
  665. "name": "TlsFree",
  666. "address": "0x4692c4"
  667. },
  668. {
  669. "name": "TlsGetValue",
  670. "address": "0x4692c8"
  671. },
  672. {
  673. "name": "TlsSetValue",
  674. "address": "0x4692cc"
  675. },
  676. {
  677. "name": "TransactNamedPipe",
  678. "address": "0x4692d0"
  679. },
  680. {
  681. "name": "TryAcquireSRWLockExclusive",
  682. "address": "0x4692d4"
  683. },
  684. {
  685. "name": "UnhandledExceptionFilter",
  686. "address": "0x4692d8"
  687. },
  688. {
  689. "name": "UnlockFileEx",
  690. "address": "0x4692dc"
  691. },
  692. {
  693. "name": "UnmapViewOfFile",
  694. "address": "0x4692e0"
  695. },
  696. {
  697. "name": "UnregisterWaitEx",
  698. "address": "0x4692e4"
  699. },
  700. {
  701. "name": "VirtualAllocEx",
  702. "address": "0x4692e8"
  703. },
  704. {
  705. "name": "VirtualFree",
  706. "address": "0x4692ec"
  707. },
  708. {
  709. "name": "VirtualFreeEx",
  710. "address": "0x4692f0"
  711. },
  712. {
  713. "name": "VirtualProtect",
  714. "address": "0x4692f4"
  715. },
  716. {
  717. "name": "VirtualQuery",
  718. "address": "0x4692f8"
  719. },
  720. {
  721. "name": "VirtualQueryEx",
  722. "address": "0x4692fc"
  723. },
  724. {
  725. "name": "WaitForSingleObject",
  726. "address": "0x469300"
  727. },
  728. {
  729. "name": "WaitForSingleObjectEx",
  730. "address": "0x469304"
  731. },
  732. {
  733. "name": "WaitNamedPipeW",
  734. "address": "0x469308"
  735. },
  736. {
  737. "name": "WakeAllConditionVariable",
  738. "address": "0x46930c"
  739. },
  740. {
  741. "name": "WideCharToMultiByte",
  742. "address": "0x469310"
  743. },
  744. {
  745. "name": "Wow64GetThreadContext",
  746. "address": "0x469314"
  747. },
  748. {
  749. "name": "WriteConsoleW",
  750. "address": "0x469318"
  751. },
  752. {
  753. "name": "WriteFile",
  754. "address": "0x46931c"
  755. },
  756. {
  757. "name": "WriteProcessMemory",
  758. "address": "0x469320"
  759. },
  760. {
  761. "name": "lstrlenW",
  762. "address": "0x469324"
  763. },
  764. {
  765. "name": "GetProcessHeap",
  766. "address": "0x469328"
  767. },
  768. {
  769. "name": "FindNextFileA",
  770. "address": "0x46932c"
  771. },
  772. {
  773. "name": "FindFirstFileExA",
  774. "address": "0x469330"
  775. },
  776. {
  777. "name": "GetModuleFileNameA",
  778. "address": "0x469334"
  779. },
  780. {
  781. "name": "GetCommandLineW",
  782. "address": "0x469338"
  783. },
  784. {
  785. "name": "GetCPInfo",
  786. "address": "0x46933c"
  787. },
  788. {
  789. "name": "GetACP",
  790. "address": "0x469340"
  791. },
  792. {
  793. "name": "FreeLibrary",
  794. "address": "0x469344"
  795. },
  796. {
  797. "name": "FreeEnvironmentStringsW",
  798. "address": "0x469348"
  799. },
  800. {
  801. "name": "FormatMessageA",
  802. "address": "0x46934c"
  803. },
  804. {
  805. "name": "FlushViewOfFile",
  806. "address": "0x469350"
  807. },
  808. {
  809. "name": "FlushFileBuffers",
  810. "address": "0x469354"
  811. },
  812. {
  813. "name": "FindNextFileW",
  814. "address": "0x469358"
  815. },
  816. {
  817. "name": "FindFirstFileExW",
  818. "address": "0x46935c"
  819. },
  820. {
  821. "name": "FindClose",
  822. "address": "0x469360"
  823. },
  824. {
  825. "name": "FileTimeToSystemTime",
  826. "address": "0x469364"
  827. },
  828. {
  829. "name": "ExpandEnvironmentStringsW",
  830. "address": "0x469368"
  831. },
  832. {
  833. "name": "ExitProcess",
  834. "address": "0x46936c"
  835. },
  836. {
  837. "name": "EnumSystemLocalesW",
  838. "address": "0x469370"
  839. },
  840. {
  841. "name": "EnumSystemLocalesEx",
  842. "address": "0x469374"
  843. },
  844. {
  845. "name": "EnterCriticalSection",
  846. "address": "0x469378"
  847. },
  848. {
  849. "name": "EncodePointer",
  850. "address": "0x46937c"
  851. },
  852. {
  853. "name": "DuplicateHandle",
  854. "address": "0x469380"
  855. },
  856. {
  857. "name": "DisconnectNamedPipe",
  858. "address": "0x469384"
  859. },
  860. {
  861. "name": "DeleteFileW",
  862. "address": "0x469388"
  863. },
  864. {
  865. "name": "DeleteCriticalSection",
  866. "address": "0x46938c"
  867. },
  868. {
  869. "name": "DebugBreak",
  870. "address": "0x469390"
  871. },
  872. {
  873. "name": "CreateThread",
  874. "address": "0x469394"
  875. },
  876. {
  877. "name": "CreateSemaphoreW",
  878. "address": "0x469398"
  879. },
  880. {
  881. "name": "CreateProcessW",
  882. "address": "0x46939c"
  883. },
  884. {
  885. "name": "CreateNamedPipeW",
  886. "address": "0x4693a0"
  887. },
  888. {
  889. "name": "CreateMutexW",
  890. "address": "0x4693a4"
  891. },
  892. {
  893. "name": "CreateJobObjectW",
  894. "address": "0x4693a8"
  895. },
  896. {
  897. "name": "CreateIoCompletionPort",
  898. "address": "0x4693ac"
  899. },
  900. {
  901. "name": "CreateFileW",
  902. "address": "0x4693b0"
  903. },
  904. {
  905. "name": "CreateFileMappingW",
  906. "address": "0x4693b4"
  907. },
  908. {
  909. "name": "CreateEventW",
  910. "address": "0x4693b8"
  911. },
  912. {
  913. "name": "CreateDirectoryW",
  914. "address": "0x4693bc"
  915. },
  916. {
  917. "name": "ConnectNamedPipe",
  918. "address": "0x4693c0"
  919. },
  920. {
  921. "name": "CompareStringW",
  922. "address": "0x4693c4"
  923. },
  924. {
  925. "name": "CloseHandle",
  926. "address": "0x4693c8"
  927. },
  928. {
  929. "name": "AssignProcessToJobObject",
  930. "address": "0x4693cc"
  931. },
  932. {
  933. "name": "AcquireSRWLockExclusive",
  934. "address": "0x4693d0"
  935. },
  936. {
  937. "name": "VirtualProtectEx",
  938. "address": "0x4693d4"
  939. },
  940. {
  941. "name": "VirtualAlloc",
  942. "address": "0x4693d8"
  943. },
  944. {
  945. "name": "CreateRemoteThread",
  946. "address": "0x4693dc"
  947. },
  948. {
  949. "name": "GetCurrentProcess",
  950. "address": "0x4693e0"
  951. },
  952. {
  953. "name": "MoveFileW",
  954. "address": "0x4693e4"
  955. },
  956. {
  957. "name": "Sleep",
  958. "address": "0x4693e8"
  959. },
  960. {
  961. "name": "DecodePointer",
  962. "address": "0x4693ec"
  963. }
  964. ],
  965. "dll": "KERNEL32.dll"
  966. },
  967. {
  968. "imports": [
  969. {
  970. "name": "IsWindow",
  971. "address": "0x46940c"
  972. },
  973. {
  974. "name": "GetWindowThreadProcessId",
  975. "address": "0x469410"
  976. },
  977. {
  978. "name": "GetUserObjectInformationW",
  979. "address": "0x469414"
  980. },
  981. {
  982. "name": "GetThreadDesktop",
  983. "address": "0x469418"
  984. },
  985. {
  986. "name": "GetProcessWindowStation",
  987. "address": "0x46941c"
  988. },
  989. {
  990. "name": "GetMessageW",
  991. "address": "0x469420"
  992. },
  993. {
  994. "name": "FindWindowExW",
  995. "address": "0x469424"
  996. },
  997. {
  998. "name": "DispatchMessageW",
  999. "address": "0x469428"
  1000. },
  1001. {
  1002. "name": "DestroyWindow",
  1003. "address": "0x46942c"
  1004. },
  1005. {
  1006. "name": "DefWindowProcW",
  1007. "address": "0x469430"
  1008. },
  1009. {
  1010. "name": "PostMessageW",
  1011. "address": "0x469434"
  1012. },
  1013. {
  1014. "name": "RegisterClassW",
  1015. "address": "0x469438"
  1016. },
  1017. {
  1018. "name": "SendMessageTimeoutW",
  1019. "address": "0x46943c"
  1020. },
  1021. {
  1022. "name": "SetProcessDPIAware",
  1023. "address": "0x469440"
  1024. },
  1025. {
  1026. "name": "SetProcessWindowStation",
  1027. "address": "0x469444"
  1028. },
  1029. {
  1030. "name": "TranslateMessage",
  1031. "address": "0x469448"
  1032. },
  1033. {
  1034. "name": "UnregisterClassW",
  1035. "address": "0x46944c"
  1036. },
  1037. {
  1038. "name": "AllowSetForegroundWindow",
  1039. "address": "0x469450"
  1040. },
  1041. {
  1042. "name": "CloseDesktop",
  1043. "address": "0x469454"
  1044. },
  1045. {
  1046. "name": "CreateWindowExW",
  1047. "address": "0x469458"
  1048. },
  1049. {
  1050. "name": "CloseWindowStation",
  1051. "address": "0x46945c"
  1052. },
  1053. {
  1054. "name": "CreateDesktopW",
  1055. "address": "0x469460"
  1056. },
  1057. {
  1058. "name": "CreateWindowStationW",
  1059. "address": "0x469464"
  1060. }
  1061. ],
  1062. "dll": "USER32.dll"
  1063. },
  1064. {
  1065. "imports": [
  1066. {
  1067. "name": "IsValidSid",
  1068. "address": "0x469000"
  1069. },
  1070. {
  1071. "name": "ImpersonateNamedPipeClient",
  1072. "address": "0x469004"
  1073. },
  1074. {
  1075. "name": "ImpersonateLoggedOnUser",
  1076. "address": "0x469008"
  1077. },
  1078. {
  1079. "name": "GetTokenInformation",
  1080. "address": "0x46900c"
  1081. },
  1082. {
  1083. "name": "GetSidSubAuthority",
  1084. "address": "0x469010"
  1085. },
  1086. {
  1087. "name": "GetSecurityInfo",
  1088. "address": "0x469014"
  1089. },
  1090. {
  1091. "name": "GetSecurityDescriptorSacl",
  1092. "address": "0x469018"
  1093. },
  1094. {
  1095. "name": "GetNamedSecurityInfoW",
  1096. "address": "0x46901c"
  1097. },
  1098. {
  1099. "name": "GetLengthSid",
  1100. "address": "0x469020"
  1101. },
  1102. {
  1103. "name": "GetKernelObjectSecurity",
  1104. "address": "0x469024"
  1105. },
  1106. {
  1107. "name": "GetAce",
  1108. "address": "0x469028"
  1109. },
  1110. {
  1111. "name": "FreeSid",
  1112. "address": "0x46902c"
  1113. },
  1114. {
  1115. "name": "EventWrite",
  1116. "address": "0x469030"
  1117. },
  1118. {
  1119. "name": "EventUnregister",
  1120. "address": "0x469034"
  1121. },
  1122. {
  1123. "name": "EventRegister",
  1124. "address": "0x469038"
  1125. },
  1126. {
  1127. "name": "EqualSid",
  1128. "address": "0x46903c"
  1129. },
  1130. {
  1131. "name": "DuplicateTokenEx",
  1132. "address": "0x469040"
  1133. },
  1134. {
  1135. "name": "DuplicateToken",
  1136. "address": "0x469044"
  1137. },
  1138. {
  1139. "name": "CreateWellKnownSid",
  1140. "address": "0x469048"
  1141. },
  1142. {
  1143. "name": "CreateRestrictedToken",
  1144. "address": "0x46904c"
  1145. },
  1146. {
  1147. "name": "CreateProcessAsUserW",
  1148. "address": "0x469050"
  1149. },
  1150. {
  1151. "name": "CopySid",
  1152. "address": "0x469054"
  1153. },
  1154. {
  1155. "name": "ConvertStringSidToSidW",
  1156. "address": "0x469058"
  1157. },
  1158. {
  1159. "name": "ConvertStringSecurityDescriptorToSecurityDescriptorW",
  1160. "address": "0x46905c"
  1161. },
  1162. {
  1163. "name": "ConvertSidToStringSidW",
  1164. "address": "0x469060"
  1165. },
  1166. {
  1167. "name": "AccessCheck",
  1168. "address": "0x469064"
  1169. },
  1170. {
  1171. "name": "LookupPrivilegeValueW",
  1172. "address": "0x469068"
  1173. },
  1174. {
  1175. "name": "MapGenericMask",
  1176. "address": "0x46906c"
  1177. },
  1178. {
  1179. "name": "OpenProcessToken",
  1180. "address": "0x469070"
  1181. },
  1182. {
  1183. "name": "RegCloseKey",
  1184. "address": "0x469074"
  1185. },
  1186. {
  1187. "name": "RegCreateKeyExW",
  1188. "address": "0x469078"
  1189. },
  1190. {
  1191. "name": "RegDeleteValueW",
  1192. "address": "0x46907c"
  1193. },
  1194. {
  1195. "name": "RegDisablePredefinedCache",
  1196. "address": "0x469080"
  1197. },
  1198. {
  1199. "name": "RegOpenKeyExW",
  1200. "address": "0x469084"
  1201. },
  1202. {
  1203. "name": "RegQueryValueExW",
  1204. "address": "0x469088"
  1205. },
  1206. {
  1207. "name": "RegSetValueExW",
  1208. "address": "0x46908c"
  1209. },
  1210. {
  1211. "name": "RevertToSelf",
  1212. "address": "0x469090"
  1213. },
  1214. {
  1215. "name": "SetEntriesInAclW",
  1216. "address": "0x469094"
  1217. },
  1218. {
  1219. "name": "SetKernelObjectSecurity",
  1220. "address": "0x469098"
  1221. },
  1222. {
  1223. "name": "SetSecurityInfo",
  1224. "address": "0x46909c"
  1225. },
  1226. {
  1227. "name": "SetThreadToken",
  1228. "address": "0x4690a0"
  1229. },
  1230. {
  1231. "name": "SetTokenInformation",
  1232. "address": "0x4690a4"
  1233. },
  1234. {
  1235. "name": "SystemFunction036",
  1236. "address": "0x4690a8"
  1237. },
  1238. {
  1239. "name": "InitializeSid",
  1240. "address": "0x4690ac"
  1241. }
  1242. ],
  1243. "dll": "ADVAPI32.dll"
  1244. },
  1245. {
  1246. "imports": [
  1247. {
  1248. "name": "SHGetFolderPathW",
  1249. "address": "0x4693f4"
  1250. },
  1251. {
  1252. "name": "SHGetKnownFolderPath",
  1253. "address": "0x4693f8"
  1254. },
  1255. {
  1256. "name": "CommandLineToArgvW",
  1257. "address": "0x4693fc"
  1258. }
  1259. ],
  1260. "dll": "SHELL32.dll"
  1261. },
  1262. {
  1263. "imports": [
  1264. {
  1265. "name": "PathMatchSpecW",
  1266. "address": "0x469404"
  1267. }
  1268. ],
  1269. "dll": "SHLWAPI.dll"
  1270. },
  1271. {
  1272. "imports": [
  1273. {
  1274. "name": "CreateEnvironmentBlock",
  1275. "address": "0x46946c"
  1276. },
  1277. {
  1278. "name": "DestroyEnvironmentBlock",
  1279. "address": "0x469470"
  1280. }
  1281. ],
  1282. "dll": "USERENV.dll"
  1283. },
  1284. {
  1285. "imports": [
  1286. {
  1287. "name": "GetFileVersionInfoW",
  1288. "address": "0x469478"
  1289. },
  1290. {
  1291. "name": "VerQueryValueW",
  1292. "address": "0x46947c"
  1293. },
  1294. {
  1295. "name": "GetFileVersionInfoSizeW",
  1296. "address": "0x469480"
  1297. }
  1298. ],
  1299. "dll": "VERSION.dll"
  1300. },
  1301. {
  1302. "imports": [
  1303. {
  1304. "name": "timeGetTime",
  1305. "address": "0x469488"
  1306. }
  1307. ],
  1308. "dll": "WINMM.dll"
  1309. },
  1310. {
  1311. "imports": [
  1312. {
  1313. "name": "socket",
  1314. "address": "0x469490"
  1315. },
  1316. {
  1317. "name": "inet_addr",
  1318. "address": "0x469494"
  1319. },
  1320. {
  1321. "name": "htons",
  1322. "address": "0x469498"
  1323. },
  1324. {
  1325. "name": "connect",
  1326. "address": "0x46949c"
  1327. },
  1328. {
  1329. "name": "WSAStartup",
  1330. "address": "0x4694a0"
  1331. }
  1332. ],
  1333. "dll": "WS2_32.dll"
  1334. }
  1335. ],
  1336. "digital_signers": null,
  1337. "exported_dll_name": null,
  1338. "actual_checksum": "0x000f23ba",
  1339. "overlay": null,
  1340. "imagebase": "0x00400000",
  1341. "reported_checksum": "0x00000000",
  1342. "icon_hash": null,
  1343. "entrypoint": "0x0045935e",
  1344. "timestamp": "2019-06-30 15:25:01",
  1345. "osversion": "6.0",
  1346. "sections": [
  1347. {
  1348. "name": ".text",
  1349. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1350. "virtual_address": "0x00001000",
  1351. "size_of_data": "0x00067800",
  1352. "entropy": "5.97",
  1353. "raw_address": "0x00000400",
  1354. "virtual_size": "0x000676eb",
  1355. "characteristics_raw": "0x60000020"
  1356. },
  1357. {
  1358. "name": ".rdata",
  1359. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1360. "virtual_address": "0x00069000",
  1361. "size_of_data": "0x00008c00",
  1362. "entropy": "5.59",
  1363. "raw_address": "0x00067c00",
  1364. "virtual_size": "0x00008bd2",
  1365. "characteristics_raw": "0x40000040"
  1366. },
  1367. {
  1368. "name": ".data",
  1369. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1370. "virtual_address": "0x00072000",
  1371. "size_of_data": "0x00041c00",
  1372. "entropy": "6.11",
  1373. "raw_address": "0x00070800",
  1374. "virtual_size": "0x00042f5c",
  1375. "characteristics_raw": "0xc0000040"
  1376. },
  1377. {
  1378. "name": ".rsrc",
  1379. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1380. "virtual_address": "0x000b5000",
  1381. "size_of_data": "0x00027a00",
  1382. "entropy": "1.97",
  1383. "raw_address": "0x000b2400",
  1384. "virtual_size": "0x000278cc",
  1385. "characteristics_raw": "0x40000040"
  1386. },
  1387. {
  1388. "name": ".reloc",
  1389. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1390. "virtual_address": "0x000dd000",
  1391. "size_of_data": "0x00008a00",
  1392. "entropy": "6.68",
  1393. "raw_address": "0x000d9e00",
  1394. "virtual_size": "0x00008980",
  1395. "characteristics_raw": "0x42000040"
  1396. }
  1397. ],
  1398. "resources": [],
  1399. "dirents": [
  1400. {
  1401. "virtual_address": "0x00000000",
  1402. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1403. "size": "0x00000000"
  1404. },
  1405. {
  1406. "virtual_address": "0x0006ffe4",
  1407. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1408. "size": "0x000000c8"
  1409. },
  1410. {
  1411. "virtual_address": "0x000b5000",
  1412. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1413. "size": "0x000278cc"
  1414. },
  1415. {
  1416. "virtual_address": "0x00000000",
  1417. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1418. "size": "0x00000000"
  1419. },
  1420. {
  1421. "virtual_address": "0x00000000",
  1422. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1423. "size": "0x00000000"
  1424. },
  1425. {
  1426. "virtual_address": "0x000dd000",
  1427. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1428. "size": "0x00008980"
  1429. },
  1430. {
  1431. "virtual_address": "0x0006f8a0",
  1432. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1433. "size": "0x0000001c"
  1434. },
  1435. {
  1436. "virtual_address": "0x00000000",
  1437. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1438. "size": "0x00000000"
  1439. },
  1440. {
  1441. "virtual_address": "0x00000000",
  1442. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1443. "size": "0x00000000"
  1444. },
  1445. {
  1446. "virtual_address": "0x00000000",
  1447. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1448. "size": "0x00000000"
  1449. },
  1450. {
  1451. "virtual_address": "0x0006f8c0",
  1452. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1453. "size": "0x00000040"
  1454. },
  1455. {
  1456. "virtual_address": "0x00000000",
  1457. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1458. "size": "0x00000000"
  1459. },
  1460. {
  1461. "virtual_address": "0x00069000",
  1462. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1463. "size": "0x000004a8"
  1464. },
  1465. {
  1466. "virtual_address": "0x00000000",
  1467. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1468. "size": "0x00000000"
  1469. },
  1470. {
  1471. "virtual_address": "0x00000000",
  1472. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1473. "size": "0x00000000"
  1474. },
  1475. {
  1476. "virtual_address": "0x00000000",
  1477. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1478. "size": "0x00000000"
  1479. }
  1480. ],
  1481. "exports": [],
  1482. "guest_signers": {},
  1483. "imphash": "15b133786871268d5024b183862641d5",
  1484. "icon_fuzzy": null,
  1485. "icon": null,
  1486. "pdbpath": null,
  1487. "imported_dll_count": 9,
  1488. "versioninfo": []
  1489. }
  1490. }
  1491.  
  1492. [*] Resolved APIs: [
  1493. "kernel32.dll.InitializeCriticalSectionEx",
  1494. "kernel32.dll.FlsAlloc",
  1495. "kernel32.dll.FlsSetValue",
  1496. "kernel32.dll.FlsGetValue",
  1497. "kernel32.dll.LCMapStringEx"
  1498. ]
  1499.  
  1500. [*] Static Analysis: {
  1501. "pe": {
  1502. "peid_signatures": null,
  1503. "imports": [
  1504. {
  1505. "imports": [
  1506. {
  1507. "name": "GetComputerNameExW",
  1508. "address": "0x4690b4"
  1509. },
  1510. {
  1511. "name": "GetConsoleCP",
  1512. "address": "0x4690b8"
  1513. },
  1514. {
  1515. "name": "GetConsoleMode",
  1516. "address": "0x4690bc"
  1517. },
  1518. {
  1519. "name": "GetCurrentDirectoryW",
  1520. "address": "0x4690c0"
  1521. },
  1522. {
  1523. "name": "GetCurrentProcessId",
  1524. "address": "0x4690c4"
  1525. },
  1526. {
  1527. "name": "GetCurrentThread",
  1528. "address": "0x4690c8"
  1529. },
  1530. {
  1531. "name": "GetCurrentThreadId",
  1532. "address": "0x4690cc"
  1533. },
  1534. {
  1535. "name": "GetDateFormatW",
  1536. "address": "0x4690d0"
  1537. },
  1538. {
  1539. "name": "GetDriveTypeW",
  1540. "address": "0x4690d4"
  1541. },
  1542. {
  1543. "name": "GetEnvironmentStringsW",
  1544. "address": "0x4690d8"
  1545. },
  1546. {
  1547. "name": "GetExitCodeProcess",
  1548. "address": "0x4690dc"
  1549. },
  1550. {
  1551. "name": "GetFileAttributesW",
  1552. "address": "0x4690e0"
  1553. },
  1554. {
  1555. "name": "GetFileInformationByHandle",
  1556. "address": "0x4690e4"
  1557. },
  1558. {
  1559. "name": "GetFileInformationByHandleEx",
  1560. "address": "0x4690e8"
  1561. },
  1562. {
  1563. "name": "GetFileSizeEx",
  1564. "address": "0x4690ec"
  1565. },
  1566. {
  1567. "name": "GetFileType",
  1568. "address": "0x4690f0"
  1569. },
  1570. {
  1571. "name": "GetFullPathNameW",
  1572. "address": "0x4690f4"
  1573. },
  1574. {
  1575. "name": "GetLastError",
  1576. "address": "0x4690f8"
  1577. },
  1578. {
  1579. "name": "GetLocalTime",
  1580. "address": "0x4690fc"
  1581. },
  1582. {
  1583. "name": "GetLocaleInfoW",
  1584. "address": "0x469100"
  1585. },
  1586. {
  1587. "name": "GetLongPathNameW",
  1588. "address": "0x469104"
  1589. },
  1590. {
  1591. "name": "GetModuleFileNameW",
  1592. "address": "0x469108"
  1593. },
  1594. {
  1595. "name": "GetModuleHandleA",
  1596. "address": "0x46910c"
  1597. },
  1598. {
  1599. "name": "GetModuleHandleExW",
  1600. "address": "0x469110"
  1601. },
  1602. {
  1603. "name": "GetModuleHandleW",
  1604. "address": "0x469114"
  1605. },
  1606. {
  1607. "name": "GetNativeSystemInfo",
  1608. "address": "0x469118"
  1609. },
  1610. {
  1611. "name": "GetOEMCP",
  1612. "address": "0x46911c"
  1613. },
  1614. {
  1615. "name": "GetProcAddress",
  1616. "address": "0x469120"
  1617. },
  1618. {
  1619. "name": "GetProcessHandleCount",
  1620. "address": "0x469124"
  1621. },
  1622. {
  1623. "name": "GetProcessHeaps",
  1624. "address": "0x469128"
  1625. },
  1626. {
  1627. "name": "GetProcessId",
  1628. "address": "0x46912c"
  1629. },
  1630. {
  1631. "name": "GetProcessTimes",
  1632. "address": "0x469130"
  1633. },
  1634. {
  1635. "name": "GetQueuedCompletionStatus",
  1636. "address": "0x469134"
  1637. },
  1638. {
  1639. "name": "GetStartupInfoW",
  1640. "address": "0x469138"
  1641. },
  1642. {
  1643. "name": "GetStdHandle",
  1644. "address": "0x46913c"
  1645. },
  1646. {
  1647. "name": "GetStringTypeW",
  1648. "address": "0x469140"
  1649. },
  1650. {
  1651. "name": "GetSystemDefaultLCID",
  1652. "address": "0x469144"
  1653. },
  1654. {
  1655. "name": "GetSystemDirectoryW",
  1656. "address": "0x469148"
  1657. },
  1658. {
  1659. "name": "GetSystemInfo",
  1660. "address": "0x46914c"
  1661. },
  1662. {
  1663. "name": "GetSystemTimeAsFileTime",
  1664. "address": "0x469150"
  1665. },
  1666. {
  1667. "name": "GetTempPathW",
  1668. "address": "0x469154"
  1669. },
  1670. {
  1671. "name": "GetThreadContext",
  1672. "address": "0x469158"
  1673. },
  1674. {
  1675. "name": "GetThreadId",
  1676. "address": "0x46915c"
  1677. },
  1678. {
  1679. "name": "GetThreadLocale",
  1680. "address": "0x469160"
  1681. },
  1682. {
  1683. "name": "GetThreadPriority",
  1684. "address": "0x469164"
  1685. },
  1686. {
  1687. "name": "GetTickCount",
  1688. "address": "0x469168"
  1689. },
  1690. {
  1691. "name": "GetTimeFormatW",
  1692. "address": "0x46916c"
  1693. },
  1694. {
  1695. "name": "GetTimeZoneInformation",
  1696. "address": "0x469170"
  1697. },
  1698. {
  1699. "name": "GetUserDefaultLCID",
  1700. "address": "0x469174"
  1701. },
  1702. {
  1703. "name": "GetUserDefaultLangID",
  1704. "address": "0x469178"
  1705. },
  1706. {
  1707. "name": "GetUserDefaultLocaleName",
  1708. "address": "0x46917c"
  1709. },
  1710. {
  1711. "name": "GetVersion",
  1712. "address": "0x469180"
  1713. },
  1714. {
  1715. "name": "GetVersionExW",
  1716. "address": "0x469184"
  1717. },
  1718. {
  1719. "name": "GetWindowsDirectoryW",
  1720. "address": "0x469188"
  1721. },
  1722. {
  1723. "name": "HeapAlloc",
  1724. "address": "0x46918c"
  1725. },
  1726. {
  1727. "name": "HeapCreate",
  1728. "address": "0x469190"
  1729. },
  1730. {
  1731. "name": "HeapDestroy",
  1732. "address": "0x469194"
  1733. },
  1734. {
  1735. "name": "HeapFree",
  1736. "address": "0x469198"
  1737. },
  1738. {
  1739. "name": "HeapReAlloc",
  1740. "address": "0x46919c"
  1741. },
  1742. {
  1743. "name": "HeapSetInformation",
  1744. "address": "0x4691a0"
  1745. },
  1746. {
  1747. "name": "HeapSize",
  1748. "address": "0x4691a4"
  1749. },
  1750. {
  1751. "name": "InitOnceExecuteOnce",
  1752. "address": "0x4691a8"
  1753. },
  1754. {
  1755. "name": "InitializeCriticalSection",
  1756. "address": "0x4691ac"
  1757. },
  1758. {
  1759. "name": "InitializeCriticalSectionAndSpinCount",
  1760. "address": "0x4691b0"
  1761. },
  1762. {
  1763. "name": "InitializeSListHead",
  1764. "address": "0x4691b4"
  1765. },
  1766. {
  1767. "name": "IsDebuggerPresent",
  1768. "address": "0x4691b8"
  1769. },
  1770. {
  1771. "name": "IsProcessorFeaturePresent",
  1772. "address": "0x4691bc"
  1773. },
  1774. {
  1775. "name": "IsValidCodePage",
  1776. "address": "0x4691c0"
  1777. },
  1778. {
  1779. "name": "IsValidLocale",
  1780. "address": "0x4691c4"
  1781. },
  1782. {
  1783. "name": "IsWow64Process",
  1784. "address": "0x4691c8"
  1785. },
  1786. {
  1787. "name": "K32GetPerformanceInfo",
  1788. "address": "0x4691cc"
  1789. },
  1790. {
  1791. "name": "K32GetProcessMemoryInfo",
  1792. "address": "0x4691d0"
  1793. },
  1794. {
  1795. "name": "K32QueryWorkingSetEx",
  1796. "address": "0x4691d4"
  1797. },
  1798. {
  1799. "name": "LCMapStringW",
  1800. "address": "0x4691d8"
  1801. },
  1802. {
  1803. "name": "LeaveCriticalSection",
  1804. "address": "0x4691dc"
  1805. },
  1806. {
  1807. "name": "LoadLibraryExA",
  1808. "address": "0x4691e0"
  1809. },
  1810. {
  1811. "name": "LoadLibraryExW",
  1812. "address": "0x4691e4"
  1813. },
  1814. {
  1815. "name": "LoadLibraryW",
  1816. "address": "0x4691e8"
  1817. },
  1818. {
  1819. "name": "LocalFree",
  1820. "address": "0x4691ec"
  1821. },
  1822. {
  1823. "name": "LockFileEx",
  1824. "address": "0x4691f0"
  1825. },
  1826. {
  1827. "name": "MapViewOfFile",
  1828. "address": "0x4691f4"
  1829. },
  1830. {
  1831. "name": "GetCommandLineA",
  1832. "address": "0x4691f8"
  1833. },
  1834. {
  1835. "name": "MultiByteToWideChar",
  1836. "address": "0x4691fc"
  1837. },
  1838. {
  1839. "name": "OpenProcess",
  1840. "address": "0x469200"
  1841. },
  1842. {
  1843. "name": "OutputDebugStringA",
  1844. "address": "0x469204"
  1845. },
  1846. {
  1847. "name": "OutputDebugStringW",
  1848. "address": "0x469208"
  1849. },
  1850. {
  1851. "name": "PeekNamedPipe",
  1852. "address": "0x46920c"
  1853. },
  1854. {
  1855. "name": "PostQueuedCompletionStatus",
  1856. "address": "0x469210"
  1857. },
  1858. {
  1859. "name": "ProcessIdToSessionId",
  1860. "address": "0x469214"
  1861. },
  1862. {
  1863. "name": "QueryDosDeviceW",
  1864. "address": "0x469218"
  1865. },
  1866. {
  1867. "name": "QueryPerformanceCounter",
  1868. "address": "0x46921c"
  1869. },
  1870. {
  1871. "name": "QueryPerformanceFrequency",
  1872. "address": "0x469220"
  1873. },
  1874. {
  1875. "name": "QueryThreadCycleTime",
  1876. "address": "0x469224"
  1877. },
  1878. {
  1879. "name": "RaiseException",
  1880. "address": "0x469228"
  1881. },
  1882. {
  1883. "name": "ReadConsoleW",
  1884. "address": "0x46922c"
  1885. },
  1886. {
  1887. "name": "ReadFile",
  1888. "address": "0x469230"
  1889. },
  1890. {
  1891. "name": "ReadProcessMemory",
  1892. "address": "0x469234"
  1893. },
  1894. {
  1895. "name": "RegisterWaitForSingleObject",
  1896. "address": "0x469238"
  1897. },
  1898. {
  1899. "name": "ReleaseSRWLockExclusive",
  1900. "address": "0x46923c"
  1901. },
  1902. {
  1903. "name": "ReleaseSemaphore",
  1904. "address": "0x469240"
  1905. },
  1906. {
  1907. "name": "RemoveDirectoryW",
  1908. "address": "0x469244"
  1909. },
  1910. {
  1911. "name": "ReplaceFileW",
  1912. "address": "0x469248"
  1913. },
  1914. {
  1915. "name": "ResetEvent",
  1916. "address": "0x46924c"
  1917. },
  1918. {
  1919. "name": "ResumeThread",
  1920. "address": "0x469250"
  1921. },
  1922. {
  1923. "name": "RtlCaptureContext",
  1924. "address": "0x469254"
  1925. },
  1926. {
  1927. "name": "RtlCaptureStackBackTrace",
  1928. "address": "0x469258"
  1929. },
  1930. {
  1931. "name": "RtlUnwind",
  1932. "address": "0x46925c"
  1933. },
  1934. {
  1935. "name": "SearchPathW",
  1936. "address": "0x469260"
  1937. },
  1938. {
  1939. "name": "SetConsoleCtrlHandler",
  1940. "address": "0x469264"
  1941. },
  1942. {
  1943. "name": "SetCurrentDirectoryW",
  1944. "address": "0x469268"
  1945. },
  1946. {
  1947. "name": "SetEndOfFile",
  1948. "address": "0x46926c"
  1949. },
  1950. {
  1951. "name": "SetEnvironmentVariableW",
  1952. "address": "0x469270"
  1953. },
  1954. {
  1955. "name": "SetEvent",
  1956. "address": "0x469274"
  1957. },
  1958. {
  1959. "name": "SetFileAttributesW",
  1960. "address": "0x469278"
  1961. },
  1962. {
  1963. "name": "SetFilePointerEx",
  1964. "address": "0x46927c"
  1965. },
  1966. {
  1967. "name": "SetHandleInformation",
  1968. "address": "0x469280"
  1969. },
  1970. {
  1971. "name": "SetInformationJobObject",
  1972. "address": "0x469284"
  1973. },
  1974. {
  1975. "name": "SetLastError",
  1976. "address": "0x469288"
  1977. },
  1978. {
  1979. "name": "SetNamedPipeHandleState",
  1980. "address": "0x46928c"
  1981. },
  1982. {
  1983. "name": "SetProcessShutdownParameters",
  1984. "address": "0x469290"
  1985. },
  1986. {
  1987. "name": "SetStdHandle",
  1988. "address": "0x469294"
  1989. },
  1990. {
  1991. "name": "SetThreadPriority",
  1992. "address": "0x469298"
  1993. },
  1994. {
  1995. "name": "SetUnhandledExceptionFilter",
  1996. "address": "0x46929c"
  1997. },
  1998. {
  1999. "name": "SignalObjectAndWait",
  2000. "address": "0x4692a0"
  2001. },
  2002. {
  2003. "name": "SleepConditionVariableSRW",
  2004. "address": "0x4692a4"
  2005. },
  2006. {
  2007. "name": "SleepEx",
  2008. "address": "0x4692a8"
  2009. },
  2010. {
  2011. "name": "SuspendThread",
  2012. "address": "0x4692ac"
  2013. },
  2014. {
  2015. "name": "SwitchToThread",
  2016. "address": "0x4692b0"
  2017. },
  2018. {
  2019. "name": "SystemTimeToTzSpecificLocalTime",
  2020. "address": "0x4692b4"
  2021. },
  2022. {
  2023. "name": "TerminateJobObject",
  2024. "address": "0x4692b8"
  2025. },
  2026. {
  2027. "name": "TerminateProcess",
  2028. "address": "0x4692bc"
  2029. },
  2030. {
  2031. "name": "TlsAlloc",
  2032. "address": "0x4692c0"
  2033. },
  2034. {
  2035. "name": "TlsFree",
  2036. "address": "0x4692c4"
  2037. },
  2038. {
  2039. "name": "TlsGetValue",
  2040. "address": "0x4692c8"
  2041. },
  2042. {
  2043. "name": "TlsSetValue",
  2044. "address": "0x4692cc"
  2045. },
  2046. {
  2047. "name": "TransactNamedPipe",
  2048. "address": "0x4692d0"
  2049. },
  2050. {
  2051. "name": "TryAcquireSRWLockExclusive",
  2052. "address": "0x4692d4"
  2053. },
  2054. {
  2055. "name": "UnhandledExceptionFilter",
  2056. "address": "0x4692d8"
  2057. },
  2058. {
  2059. "name": "UnlockFileEx",
  2060. "address": "0x4692dc"
  2061. },
  2062. {
  2063. "name": "UnmapViewOfFile",
  2064. "address": "0x4692e0"
  2065. },
  2066. {
  2067. "name": "UnregisterWaitEx",
  2068. "address": "0x4692e4"
  2069. },
  2070. {
  2071. "name": "VirtualAllocEx",
  2072. "address": "0x4692e8"
  2073. },
  2074. {
  2075. "name": "VirtualFree",
  2076. "address": "0x4692ec"
  2077. },
  2078. {
  2079. "name": "VirtualFreeEx",
  2080. "address": "0x4692f0"
  2081. },
  2082. {
  2083. "name": "VirtualProtect",
  2084. "address": "0x4692f4"
  2085. },
  2086. {
  2087. "name": "VirtualQuery",
  2088. "address": "0x4692f8"
  2089. },
  2090. {
  2091. "name": "VirtualQueryEx",
  2092. "address": "0x4692fc"
  2093. },
  2094. {
  2095. "name": "WaitForSingleObject",
  2096. "address": "0x469300"
  2097. },
  2098. {
  2099. "name": "WaitForSingleObjectEx",
  2100. "address": "0x469304"
  2101. },
  2102. {
  2103. "name": "WaitNamedPipeW",
  2104. "address": "0x469308"
  2105. },
  2106. {
  2107. "name": "WakeAllConditionVariable",
  2108. "address": "0x46930c"
  2109. },
  2110. {
  2111. "name": "WideCharToMultiByte",
  2112. "address": "0x469310"
  2113. },
  2114. {
  2115. "name": "Wow64GetThreadContext",
  2116. "address": "0x469314"
  2117. },
  2118. {
  2119. "name": "WriteConsoleW",
  2120. "address": "0x469318"
  2121. },
  2122. {
  2123. "name": "WriteFile",
  2124. "address": "0x46931c"
  2125. },
  2126. {
  2127. "name": "WriteProcessMemory",
  2128. "address": "0x469320"
  2129. },
  2130. {
  2131. "name": "lstrlenW",
  2132. "address": "0x469324"
  2133. },
  2134. {
  2135. "name": "GetProcessHeap",
  2136. "address": "0x469328"
  2137. },
  2138. {
  2139. "name": "FindNextFileA",
  2140. "address": "0x46932c"
  2141. },
  2142. {
  2143. "name": "FindFirstFileExA",
  2144. "address": "0x469330"
  2145. },
  2146. {
  2147. "name": "GetModuleFileNameA",
  2148. "address": "0x469334"
  2149. },
  2150. {
  2151. "name": "GetCommandLineW",
  2152. "address": "0x469338"
  2153. },
  2154. {
  2155. "name": "GetCPInfo",
  2156. "address": "0x46933c"
  2157. },
  2158. {
  2159. "name": "GetACP",
  2160. "address": "0x469340"
  2161. },
  2162. {
  2163. "name": "FreeLibrary",
  2164. "address": "0x469344"
  2165. },
  2166. {
  2167. "name": "FreeEnvironmentStringsW",
  2168. "address": "0x469348"
  2169. },
  2170. {
  2171. "name": "FormatMessageA",
  2172. "address": "0x46934c"
  2173. },
  2174. {
  2175. "name": "FlushViewOfFile",
  2176. "address": "0x469350"
  2177. },
  2178. {
  2179. "name": "FlushFileBuffers",
  2180. "address": "0x469354"
  2181. },
  2182. {
  2183. "name": "FindNextFileW",
  2184. "address": "0x469358"
  2185. },
  2186. {
  2187. "name": "FindFirstFileExW",
  2188. "address": "0x46935c"
  2189. },
  2190. {
  2191. "name": "FindClose",
  2192. "address": "0x469360"
  2193. },
  2194. {
  2195. "name": "FileTimeToSystemTime",
  2196. "address": "0x469364"
  2197. },
  2198. {
  2199. "name": "ExpandEnvironmentStringsW",
  2200. "address": "0x469368"
  2201. },
  2202. {
  2203. "name": "ExitProcess",
  2204. "address": "0x46936c"
  2205. },
  2206. {
  2207. "name": "EnumSystemLocalesW",
  2208. "address": "0x469370"
  2209. },
  2210. {
  2211. "name": "EnumSystemLocalesEx",
  2212. "address": "0x469374"
  2213. },
  2214. {
  2215. "name": "EnterCriticalSection",
  2216. "address": "0x469378"
  2217. },
  2218. {
  2219. "name": "EncodePointer",
  2220. "address": "0x46937c"
  2221. },
  2222. {
  2223. "name": "DuplicateHandle",
  2224. "address": "0x469380"
  2225. },
  2226. {
  2227. "name": "DisconnectNamedPipe",
  2228. "address": "0x469384"
  2229. },
  2230. {
  2231. "name": "DeleteFileW",
  2232. "address": "0x469388"
  2233. },
  2234. {
  2235. "name": "DeleteCriticalSection",
  2236. "address": "0x46938c"
  2237. },
  2238. {
  2239. "name": "DebugBreak",
  2240. "address": "0x469390"
  2241. },
  2242. {
  2243. "name": "CreateThread",
  2244. "address": "0x469394"
  2245. },
  2246. {
  2247. "name": "CreateSemaphoreW",
  2248. "address": "0x469398"
  2249. },
  2250. {
  2251. "name": "CreateProcessW",
  2252. "address": "0x46939c"
  2253. },
  2254. {
  2255. "name": "CreateNamedPipeW",
  2256. "address": "0x4693a0"
  2257. },
  2258. {
  2259. "name": "CreateMutexW",
  2260. "address": "0x4693a4"
  2261. },
  2262. {
  2263. "name": "CreateJobObjectW",
  2264. "address": "0x4693a8"
  2265. },
  2266. {
  2267. "name": "CreateIoCompletionPort",
  2268. "address": "0x4693ac"
  2269. },
  2270. {
  2271. "name": "CreateFileW",
  2272. "address": "0x4693b0"
  2273. },
  2274. {
  2275. "name": "CreateFileMappingW",
  2276. "address": "0x4693b4"
  2277. },
  2278. {
  2279. "name": "CreateEventW",
  2280. "address": "0x4693b8"
  2281. },
  2282. {
  2283. "name": "CreateDirectoryW",
  2284. "address": "0x4693bc"
  2285. },
  2286. {
  2287. "name": "ConnectNamedPipe",
  2288. "address": "0x4693c0"
  2289. },
  2290. {
  2291. "name": "CompareStringW",
  2292. "address": "0x4693c4"
  2293. },
  2294. {
  2295. "name": "CloseHandle",
  2296. "address": "0x4693c8"
  2297. },
  2298. {
  2299. "name": "AssignProcessToJobObject",
  2300. "address": "0x4693cc"
  2301. },
  2302. {
  2303. "name": "AcquireSRWLockExclusive",
  2304. "address": "0x4693d0"
  2305. },
  2306. {
  2307. "name": "VirtualProtectEx",
  2308. "address": "0x4693d4"
  2309. },
  2310. {
  2311. "name": "VirtualAlloc",
  2312. "address": "0x4693d8"
  2313. },
  2314. {
  2315. "name": "CreateRemoteThread",
  2316. "address": "0x4693dc"
  2317. },
  2318. {
  2319. "name": "GetCurrentProcess",
  2320. "address": "0x4693e0"
  2321. },
  2322. {
  2323. "name": "MoveFileW",
  2324. "address": "0x4693e4"
  2325. },
  2326. {
  2327. "name": "Sleep",
  2328. "address": "0x4693e8"
  2329. },
  2330. {
  2331. "name": "DecodePointer",
  2332. "address": "0x4693ec"
  2333. }
  2334. ],
  2335. "dll": "KERNEL32.dll"
  2336. },
  2337. {
  2338. "imports": [
  2339. {
  2340. "name": "IsWindow",
  2341. "address": "0x46940c"
  2342. },
  2343. {
  2344. "name": "GetWindowThreadProcessId",
  2345. "address": "0x469410"
  2346. },
  2347. {
  2348. "name": "GetUserObjectInformationW",
  2349. "address": "0x469414"
  2350. },
  2351. {
  2352. "name": "GetThreadDesktop",
  2353. "address": "0x469418"
  2354. },
  2355. {
  2356. "name": "GetProcessWindowStation",
  2357. "address": "0x46941c"
  2358. },
  2359. {
  2360. "name": "GetMessageW",
  2361. "address": "0x469420"
  2362. },
  2363. {
  2364. "name": "FindWindowExW",
  2365. "address": "0x469424"
  2366. },
  2367. {
  2368. "name": "DispatchMessageW",
  2369. "address": "0x469428"
  2370. },
  2371. {
  2372. "name": "DestroyWindow",
  2373. "address": "0x46942c"
  2374. },
  2375. {
  2376. "name": "DefWindowProcW",
  2377. "address": "0x469430"
  2378. },
  2379. {
  2380. "name": "PostMessageW",
  2381. "address": "0x469434"
  2382. },
  2383. {
  2384. "name": "RegisterClassW",
  2385. "address": "0x469438"
  2386. },
  2387. {
  2388. "name": "SendMessageTimeoutW",
  2389. "address": "0x46943c"
  2390. },
  2391. {
  2392. "name": "SetProcessDPIAware",
  2393. "address": "0x469440"
  2394. },
  2395. {
  2396. "name": "SetProcessWindowStation",
  2397. "address": "0x469444"
  2398. },
  2399. {
  2400. "name": "TranslateMessage",
  2401. "address": "0x469448"
  2402. },
  2403. {
  2404. "name": "UnregisterClassW",
  2405. "address": "0x46944c"
  2406. },
  2407. {
  2408. "name": "AllowSetForegroundWindow",
  2409. "address": "0x469450"
  2410. },
  2411. {
  2412. "name": "CloseDesktop",
  2413. "address": "0x469454"
  2414. },
  2415. {
  2416. "name": "CreateWindowExW",
  2417. "address": "0x469458"
  2418. },
  2419. {
  2420. "name": "CloseWindowStation",
  2421. "address": "0x46945c"
  2422. },
  2423. {
  2424. "name": "CreateDesktopW",
  2425. "address": "0x469460"
  2426. },
  2427. {
  2428. "name": "CreateWindowStationW",
  2429. "address": "0x469464"
  2430. }
  2431. ],
  2432. "dll": "USER32.dll"
  2433. },
  2434. {
  2435. "imports": [
  2436. {
  2437. "name": "IsValidSid",
  2438. "address": "0x469000"
  2439. },
  2440. {
  2441. "name": "ImpersonateNamedPipeClient",
  2442. "address": "0x469004"
  2443. },
  2444. {
  2445. "name": "ImpersonateLoggedOnUser",
  2446. "address": "0x469008"
  2447. },
  2448. {
  2449. "name": "GetTokenInformation",
  2450. "address": "0x46900c"
  2451. },
  2452. {
  2453. "name": "GetSidSubAuthority",
  2454. "address": "0x469010"
  2455. },
  2456. {
  2457. "name": "GetSecurityInfo",
  2458. "address": "0x469014"
  2459. },
  2460. {
  2461. "name": "GetSecurityDescriptorSacl",
  2462. "address": "0x469018"
  2463. },
  2464. {
  2465. "name": "GetNamedSecurityInfoW",
  2466. "address": "0x46901c"
  2467. },
  2468. {
  2469. "name": "GetLengthSid",
  2470. "address": "0x469020"
  2471. },
  2472. {
  2473. "name": "GetKernelObjectSecurity",
  2474. "address": "0x469024"
  2475. },
  2476. {
  2477. "name": "GetAce",
  2478. "address": "0x469028"
  2479. },
  2480. {
  2481. "name": "FreeSid",
  2482. "address": "0x46902c"
  2483. },
  2484. {
  2485. "name": "EventWrite",
  2486. "address": "0x469030"
  2487. },
  2488. {
  2489. "name": "EventUnregister",
  2490. "address": "0x469034"
  2491. },
  2492. {
  2493. "name": "EventRegister",
  2494. "address": "0x469038"
  2495. },
  2496. {
  2497. "name": "EqualSid",
  2498. "address": "0x46903c"
  2499. },
  2500. {
  2501. "name": "DuplicateTokenEx",
  2502. "address": "0x469040"
  2503. },
  2504. {
  2505. "name": "DuplicateToken",
  2506. "address": "0x469044"
  2507. },
  2508. {
  2509. "name": "CreateWellKnownSid",
  2510. "address": "0x469048"
  2511. },
  2512. {
  2513. "name": "CreateRestrictedToken",
  2514. "address": "0x46904c"
  2515. },
  2516. {
  2517. "name": "CreateProcessAsUserW",
  2518. "address": "0x469050"
  2519. },
  2520. {
  2521. "name": "CopySid",
  2522. "address": "0x469054"
  2523. },
  2524. {
  2525. "name": "ConvertStringSidToSidW",
  2526. "address": "0x469058"
  2527. },
  2528. {
  2529. "name": "ConvertStringSecurityDescriptorToSecurityDescriptorW",
  2530. "address": "0x46905c"
  2531. },
  2532. {
  2533. "name": "ConvertSidToStringSidW",
  2534. "address": "0x469060"
  2535. },
  2536. {
  2537. "name": "AccessCheck",
  2538. "address": "0x469064"
  2539. },
  2540. {
  2541. "name": "LookupPrivilegeValueW",
  2542. "address": "0x469068"
  2543. },
  2544. {
  2545. "name": "MapGenericMask",
  2546. "address": "0x46906c"
  2547. },
  2548. {
  2549. "name": "OpenProcessToken",
  2550. "address": "0x469070"
  2551. },
  2552. {
  2553. "name": "RegCloseKey",
  2554. "address": "0x469074"
  2555. },
  2556. {
  2557. "name": "RegCreateKeyExW",
  2558. "address": "0x469078"
  2559. },
  2560. {
  2561. "name": "RegDeleteValueW",
  2562. "address": "0x46907c"
  2563. },
  2564. {
  2565. "name": "RegDisablePredefinedCache",
  2566. "address": "0x469080"
  2567. },
  2568. {
  2569. "name": "RegOpenKeyExW",
  2570. "address": "0x469084"
  2571. },
  2572. {
  2573. "name": "RegQueryValueExW",
  2574. "address": "0x469088"
  2575. },
  2576. {
  2577. "name": "RegSetValueExW",
  2578. "address": "0x46908c"
  2579. },
  2580. {
  2581. "name": "RevertToSelf",
  2582. "address": "0x469090"
  2583. },
  2584. {
  2585. "name": "SetEntriesInAclW",
  2586. "address": "0x469094"
  2587. },
  2588. {
  2589. "name": "SetKernelObjectSecurity",
  2590. "address": "0x469098"
  2591. },
  2592. {
  2593. "name": "SetSecurityInfo",
  2594. "address": "0x46909c"
  2595. },
  2596. {
  2597. "name": "SetThreadToken",
  2598. "address": "0x4690a0"
  2599. },
  2600. {
  2601. "name": "SetTokenInformation",
  2602. "address": "0x4690a4"
  2603. },
  2604. {
  2605. "name": "SystemFunction036",
  2606. "address": "0x4690a8"
  2607. },
  2608. {
  2609. "name": "InitializeSid",
  2610. "address": "0x4690ac"
  2611. }
  2612. ],
  2613. "dll": "ADVAPI32.dll"
  2614. },
  2615. {
  2616. "imports": [
  2617. {
  2618. "name": "SHGetFolderPathW",
  2619. "address": "0x4693f4"
  2620. },
  2621. {
  2622. "name": "SHGetKnownFolderPath",
  2623. "address": "0x4693f8"
  2624. },
  2625. {
  2626. "name": "CommandLineToArgvW",
  2627. "address": "0x4693fc"
  2628. }
  2629. ],
  2630. "dll": "SHELL32.dll"
  2631. },
  2632. {
  2633. "imports": [
  2634. {
  2635. "name": "PathMatchSpecW",
  2636. "address": "0x469404"
  2637. }
  2638. ],
  2639. "dll": "SHLWAPI.dll"
  2640. },
  2641. {
  2642. "imports": [
  2643. {
  2644. "name": "CreateEnvironmentBlock",
  2645. "address": "0x46946c"
  2646. },
  2647. {
  2648. "name": "DestroyEnvironmentBlock",
  2649. "address": "0x469470"
  2650. }
  2651. ],
  2652. "dll": "USERENV.dll"
  2653. },
  2654. {
  2655. "imports": [
  2656. {
  2657. "name": "GetFileVersionInfoW",
  2658. "address": "0x469478"
  2659. },
  2660. {
  2661. "name": "VerQueryValueW",
  2662. "address": "0x46947c"
  2663. },
  2664. {
  2665. "name": "GetFileVersionInfoSizeW",
  2666. "address": "0x469480"
  2667. }
  2668. ],
  2669. "dll": "VERSION.dll"
  2670. },
  2671. {
  2672. "imports": [
  2673. {
  2674. "name": "timeGetTime",
  2675. "address": "0x469488"
  2676. }
  2677. ],
  2678. "dll": "WINMM.dll"
  2679. },
  2680. {
  2681. "imports": [
  2682. {
  2683. "name": "socket",
  2684. "address": "0x469490"
  2685. },
  2686. {
  2687. "name": "inet_addr",
  2688. "address": "0x469494"
  2689. },
  2690. {
  2691. "name": "htons",
  2692. "address": "0x469498"
  2693. },
  2694. {
  2695. "name": "connect",
  2696. "address": "0x46949c"
  2697. },
  2698. {
  2699. "name": "WSAStartup",
  2700. "address": "0x4694a0"
  2701. }
  2702. ],
  2703. "dll": "WS2_32.dll"
  2704. }
  2705. ],
  2706. "digital_signers": null,
  2707. "exported_dll_name": null,
  2708. "actual_checksum": "0x000f23ba",
  2709. "overlay": null,
  2710. "imagebase": "0x00400000",
  2711. "reported_checksum": "0x00000000",
  2712. "icon_hash": null,
  2713. "entrypoint": "0x0045935e",
  2714. "timestamp": "2019-06-30 15:25:01",
  2715. "osversion": "6.0",
  2716. "sections": [
  2717. {
  2718. "name": ".text",
  2719. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  2720. "virtual_address": "0x00001000",
  2721. "size_of_data": "0x00067800",
  2722. "entropy": "5.97",
  2723. "raw_address": "0x00000400",
  2724. "virtual_size": "0x000676eb",
  2725. "characteristics_raw": "0x60000020"
  2726. },
  2727. {
  2728. "name": ".rdata",
  2729. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2730. "virtual_address": "0x00069000",
  2731. "size_of_data": "0x00008c00",
  2732. "entropy": "5.59",
  2733. "raw_address": "0x00067c00",
  2734. "virtual_size": "0x00008bd2",
  2735. "characteristics_raw": "0x40000040"
  2736. },
  2737. {
  2738. "name": ".data",
  2739. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2740. "virtual_address": "0x00072000",
  2741. "size_of_data": "0x00041c00",
  2742. "entropy": "6.11",
  2743. "raw_address": "0x00070800",
  2744. "virtual_size": "0x00042f5c",
  2745. "characteristics_raw": "0xc0000040"
  2746. },
  2747. {
  2748. "name": ".rsrc",
  2749. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2750. "virtual_address": "0x000b5000",
  2751. "size_of_data": "0x00027a00",
  2752. "entropy": "1.97",
  2753. "raw_address": "0x000b2400",
  2754. "virtual_size": "0x000278cc",
  2755. "characteristics_raw": "0x40000040"
  2756. },
  2757. {
  2758. "name": ".reloc",
  2759. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  2760. "virtual_address": "0x000dd000",
  2761. "size_of_data": "0x00008a00",
  2762. "entropy": "6.68",
  2763. "raw_address": "0x000d9e00",
  2764. "virtual_size": "0x00008980",
  2765. "characteristics_raw": "0x42000040"
  2766. }
  2767. ],
  2768. "resources": [],
  2769. "dirents": [
  2770. {
  2771. "virtual_address": "0x00000000",
  2772. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  2773. "size": "0x00000000"
  2774. },
  2775. {
  2776. "virtual_address": "0x0006ffe4",
  2777. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  2778. "size": "0x000000c8"
  2779. },
  2780. {
  2781. "virtual_address": "0x000b5000",
  2782. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  2783. "size": "0x000278cc"
  2784. },
  2785. {
  2786. "virtual_address": "0x00000000",
  2787. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  2788. "size": "0x00000000"
  2789. },
  2790. {
  2791. "virtual_address": "0x00000000",
  2792. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  2793. "size": "0x00000000"
  2794. },
  2795. {
  2796. "virtual_address": "0x000dd000",
  2797. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  2798. "size": "0x00008980"
  2799. },
  2800. {
  2801. "virtual_address": "0x0006f8a0",
  2802. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  2803. "size": "0x0000001c"
  2804. },
  2805. {
  2806. "virtual_address": "0x00000000",
  2807. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  2808. "size": "0x00000000"
  2809. },
  2810. {
  2811. "virtual_address": "0x00000000",
  2812. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  2813. "size": "0x00000000"
  2814. },
  2815. {
  2816. "virtual_address": "0x00000000",
  2817. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  2818. "size": "0x00000000"
  2819. },
  2820. {
  2821. "virtual_address": "0x0006f8c0",
  2822. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  2823. "size": "0x00000040"
  2824. },
  2825. {
  2826. "virtual_address": "0x00000000",
  2827. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  2828. "size": "0x00000000"
  2829. },
  2830. {
  2831. "virtual_address": "0x00069000",
  2832. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  2833. "size": "0x000004a8"
  2834. },
  2835. {
  2836. "virtual_address": "0x00000000",
  2837. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  2838. "size": "0x00000000"
  2839. },
  2840. {
  2841. "virtual_address": "0x00000000",
  2842. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  2843. "size": "0x00000000"
  2844. },
  2845. {
  2846. "virtual_address": "0x00000000",
  2847. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  2848. "size": "0x00000000"
  2849. }
  2850. ],
  2851. "exports": [],
  2852. "guest_signers": {},
  2853. "imphash": "15b133786871268d5024b183862641d5",
  2854. "icon_fuzzy": null,
  2855. "icon": null,
  2856. "pdbpath": null,
  2857. "imported_dll_count": 9,
  2858. "versioninfo": []
  2859. }
  2860. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!