API tools faq
paste
paladin316

Exes_f4bcb05ccb8052c8734665bc8c89df71_exe.json

paladin316
Jun 19th, 2019
2,149
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 58.38 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_f4bcb05ccb8052c8734665bc8c89df71.exe"
  7. [*] File Size: 366592
  8. [*] File Type: "MS-DOS executable"
  9. [*] SHA256: "2ded40bc72ed5b0c25be76c27ba7e7a874817490cf93eead75a16aa384605f04"
  10. [*] MD5: "f4bcb05ccb8052c8734665bc8c89df71"
  11. [*] SHA1: "df023b3f369631bd81bdc1973fe10a02dca6997b"
  12. [*] SHA512: "ead1b3fb37e77c5c8aa95484393d640c1b76d5ad6eb3ed9fcf0e6d6c457bef4ac4fe02cde73962c377628c34521ea02a379444c20567acc3e93cb970449ca5cb"
  13. [*] CRC32: "7DB94EDC"
  14. [*] SSDEEP: "6144:GvZzQJVb5p72cHF1ybDFwekh212KhvwIb759QOaBjpaVRPu23E2rJmWjF:GYVOiF1WD7kE1dTYOi8V5u23zmWF"
  15.  
  16. [*] Process Execution: [
  17. "Exes_f4bcb05ccb8052c8734665bc8c89df71.exe",
  18. "SQLIOSIMSE.exe",
  19. "services.exe",
  20. "SQLIOSIMSE.exe",
  21. "SQLIOSIMSE.exe",
  22. "svchost.exe",
  23. "WerFault.exe",
  24. "GoogleUpdate.exe"
  25. ]
  26.  
  27. [*] Signatures Detected: [
  28. {
  29. "Description": "At least one process apparently crashed during execution",
  30. "Details": []
  31. },
  32. {
  33. "Description": "Attempts to connect to a dead IP:Port (2 unique times)",
  34. "Details": [
  35. {
  36. "IP": "172.217.164.195:443"
  37. },
  38. {
  39. "IP": "114.113.151.154:22389"
  40. }
  41. ]
  42. },
  43. {
  44. "Description": "Creates RWX memory",
  45. "Details": []
  46. },
  47. {
  48. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  49. "Details": [
  50. {
  51. "ioc": "http://crl.globalsign.net/root-r2.crl0"
  52. }
  53. ]
  54. },
  55. {
  56. "Description": "Drops a binary and executes it",
  57. "Details": [
  58. {
  59. "binary": "C:\\Program Files (x86)\\Microsoft SQL Server\\SQLIOSIMSE.exe"
  60. }
  61. ]
  62. },
  63. {
  64. "Description": "Performs some HTTP requests",
  65. "Details": [
  66. {
  67. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  68. },
  69. {
  70. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  71. },
  72. {
  73. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  74. }
  75. ]
  76. },
  77. {
  78. "Description": "Unconventionial language used in binary resources: Chinese (Simplified)",
  79. "Details": []
  80. },
  81. {
  82. "Description": "The binary likely contains encrypted or compressed data.",
  83. "Details": [
  84. {
  85. "section": "name: .MPRESS1, entropy: 8.00, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00056200, virtual_size: 0x0005d000"
  86. }
  87. ]
  88. },
  89. {
  90. "Description": "Deletes its original binary from disk",
  91. "Details": []
  92. },
  93. {
  94. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  95. "Details": [
  96. {
  97. "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 12936074 times"
  98. }
  99. ]
  100. },
  101. {
  102. "Description": "Installs itself for autorun at Windows startup",
  103. "Details": [
  104. {
  105. "service name": "Microsoft SQL Server"
  106. },
  107. {
  108. "service path": "C:\\Program Files (x86)\\Microsoft SQL Server\\SQLIOSIMSE.exe"
  109. }
  110. ]
  111. },
  112. {
  113. "Description": "Checks the CPU name from registry, possibly for anti-virtualization",
  114. "Details": []
  115. },
  116. {
  117. "Description": "Checks the system manufacturer, likely for anti-virtualization",
  118. "Details": []
  119. }
  120. ]
  121.  
  122. [*] Started Service: [
  123. "Microsoft SQL Server",
  124. "WerSvc"
  125. ]
  126.  
  127. [*] Executed Commands: [
  128. "C:\\Program Files (x86)\\Microsoft SQL Server\\SQLIOSIMSE.exe ",
  129. "C:\\Program Files (x86)\\Microsoft SQL Server\\SQLIOSIMSE.exe",
  130. "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
  131. "\"C:\\Program Files (x86)\\Google\\Update\\GoogleUpdate.exe\" /svc",
  132. "C:\\Windows\\SysWOW64\\WerFault.exe -u -p 2504 -s 384"
  133. ]
  134.  
  135. [*] Mutexes: [
  136. "Local\\WERReportingForProcess2504",
  137. "Global\\f9173d39-9229-11e9-8b7b-18c08650be99",
  138. "Global\\G{D19BAF17-7C87-467E-8D63-6C4B1C836373}",
  139. "Global\\G{6885AE8E-C070-458d-9711-37B9BEAB65F6}",
  140. "Global\\G{66CC0160-ABB3-4066-AE47-1CA6AD5065C8}",
  141. "Global\\G{0A175FBE-AEEC-4fea-855A-2AA549A88846}"
  142. ]
  143.  
  144. [*] Modified Files: [
  145. "C:\\Program Files (x86)\\Microsoft SQL Server\\SQLIOSIMSE.exe",
  146. "C:\\Windows\\Temp\\WERFBA8.tmp.appcompat.txt",
  147. "C:\\Windows\\Temp\\WER83A6.tmp.WERInternalMetadata.xml",
  148. "C:\\Windows\\Temp\\WER83C6.tmp.hdmp",
  149. "C:\\Windows\\Temp\\WER981A.tmp.mdmp",
  150. "\\??\\PIPE\\wkssvc",
  151. "\\??\\pipe\\GoogleCrashServices\\S-1-5-18"
  152. ]
  153.  
  154. [*] Deleted Files: [
  155. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_f4bcb05ccb8052c8734665bc8c89df71.exe",
  156. "C:\\Windows\\Temp\\WERFBA8.tmp",
  157. "C:\\Windows\\Temp\\WERFBA8.tmp.appcompat.txt",
  158. "C:\\Windows\\Temp\\WER83A6.tmp",
  159. "C:\\Windows\\Temp\\WER83A6.tmp.WERInternalMetadata.xml",
  160. "C:\\Windows\\Temp\\WER83C6.tmp",
  161. "C:\\Windows\\Temp\\WER83C6.tmp.hdmp",
  162. "C:\\Windows\\Temp\\WER981A.tmp",
  163. "C:\\Windows\\Temp\\WER981A.tmp.mdmp",
  164. "C:\\Program Files (x86)\\Google\\Update\\Install\\{A01675F1-1F84-4945-B8A9-4E1FDEB013B2}\\74.0.3729.169_73.0.3683.86_chrome_updater.exe",
  165. "C:\\Program Files (x86)\\Google\\Update\\Install\\{A01675F1-1F84-4945-B8A9-4E1FDEB013B2}"
  166. ]
  167.  
  168. [*] Modified Registry Keys: [
  169. "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Microsoft SQL Server",
  170. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Microsoft SQL Server\\DeleteFiles",
  171. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Microsoft SQL Server\\ConnectGroup",
  172. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Microsoft SQL Server\\Description",
  173. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WerSvc\\Type",
  174. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\BITS\\Start",
  175. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Microsoft SQL Server\\MarkTime",
  176. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Debug",
  177. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\Windows Error Reporting\\Debug\\ExceptionRecord",
  178. "HKEY_LOCAL_MACHINE\\Software\\Google\\Update\\PersistedPings\\{608C9076-4700-4DB8-A701-B28D2B776AF3}",
  179. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\PersistedPings\\{608C9076-4700-4DB8-A701-B28D2B776AF3}\\PersistedPingString",
  180. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\PersistedPings\\{608C9076-4700-4DB8-A701-B28D2B776AF3}\\PersistedPingTime",
  181. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\pv",
  182. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\pv",
  183. "HKEY_LOCAL_MACHINE\\Software\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\CurrentState",
  184. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\CurrentState\\StateValue",
  185. "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000_CLASSES\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  186. "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000\\Software\\Google\\Update\\proxy\\source",
  187. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\RollCallDayStartSec",
  188. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\DayOfLastRollCall",
  189. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\ping_freshness",
  190. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\cohort\\(Default)",
  191. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\cohort\\hint",
  192. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\cohort\\name",
  193. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\LastCheckSuccess",
  194. "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000\\Software\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\dr",
  195. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\ActivePingDayStartSec",
  196. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\RollCallDayStartSec",
  197. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\DayOfLastActivity",
  198. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\DayOfLastRollCall",
  199. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\ping_freshness",
  200. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\cohort\\(Default)",
  201. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\cohort\\hint",
  202. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\cohort\\name",
  203. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\LastCheckSuccess",
  204. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\LastChecked",
  205. "HKEY_LOCAL_MACHINE\\Software\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\CurrentState",
  206. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\CurrentState\\StateValue"
  207. ]
  208.  
  209. [*] Deleted Registry Keys: [
  210. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Microsoft SQL Server\\DeleteFiles",
  211. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\uid",
  212. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\old-uid",
  213. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\tttoken",
  214. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\UpdateAvailableCount",
  215. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\UpdateAvailableSince",
  216. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\dr",
  217. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\tttoken",
  218. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\UpdateAvailableCount",
  219. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\UpdateAvailableSince"
  220. ]
  221.  
  222. [*] DNS Communications: [
  223. {
  224. "type": "A",
  225. "request": "m.ovvvo.buzz",
  226. "answers": [
  227. {
  228. "data": "114.113.151.154",
  229. "type": "A"
  230. }
  231. ]
  232. }
  233. ]
  234.  
  235. [*] Domains: [
  236. {
  237. "ip": "114.113.151.154",
  238. "domain": "m.ovvvo.buzz"
  239. }
  240. ]
  241.  
  242. [*] Network Communication - ICMP: []
  243.  
  244. [*] Network Communication - HTTP: [
  245. {
  246. "count": 1,
  247. "body": "",
  248. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  249. "user-agent": "Microsoft-CryptoAPI/6.1",
  250. "method": "GET",
  251. "host": "ocsp.digicert.com",
  252. "version": "1.1",
  253. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  254. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 150849\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 10:50:30 GMT\r\nIf-None-Match: \"5ced1276-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  255. "port": 80
  256. },
  257. {
  258. "count": 1,
  259. "body": "",
  260. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  261. "user-agent": "Microsoft-CryptoAPI/6.1",
  262. "method": "GET",
  263. "host": "ocsp.digicert.com",
  264. "version": "1.1",
  265. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  266. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nCache-Control: max-age = 135176\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 05:30:18 GMT\r\nIf-None-Match: \"5cecc76a-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  267. "port": 80
  268. },
  269. {
  270. "count": 1,
  271. "body": "",
  272. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  273. "user-agent": "Microsoft-CryptoAPI/6.1",
  274. "method": "GET",
  275. "host": "ocsp.digicert.com",
  276. "version": "1.1",
  277. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  278. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 168744\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 15:00:08 GMT\r\nIf-None-Match: \"5ced4cf8-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  279. "port": 80
  280. }
  281. ]
  282.  
  283. [*] Network Communication - SMTP: []
  284.  
  285. [*] Network Communication - Hosts: []
  286.  
  287. [*] Network Communication - IRC: []
  288.  
  289. [*] Static Analysis: {
  290. "pe": {
  291. "peid_signatures": null,
  292. "imports": [
  293. {
  294. "imports": [
  295. {
  296. "name": "GetModuleHandleA",
  297. "address": "0x45e0a0"
  298. },
  299. {
  300. "name": "GetProcAddress",
  301. "address": "0x45e0a4"
  302. }
  303. ],
  304. "dll": "KERNEL32.DLL"
  305. },
  306. {
  307. "imports": [
  308. {
  309. "name": null,
  310. "address": "0x45e0ac"
  311. }
  312. ],
  313. "dll": "MFC42.DLL"
  314. },
  315. {
  316. "imports": [
  317. {
  318. "name": "free",
  319. "address": "0x45e0b4"
  320. }
  321. ],
  322. "dll": "MSVCRT.dll"
  323. },
  324. {
  325. "imports": [
  326. {
  327. "name": "IsIconic",
  328. "address": "0x45e0bc"
  329. }
  330. ],
  331. "dll": "USER32.dll"
  332. },
  333. {
  334. "imports": [
  335. {
  336. "name": "BitBlt",
  337. "address": "0x45e0c4"
  338. }
  339. ],
  340. "dll": "GDI32.dll"
  341. },
  342. {
  343. "imports": [
  344. {
  345. "name": "SHGetMalloc",
  346. "address": "0x45e0cc"
  347. }
  348. ],
  349. "dll": "SHELL32.dll"
  350. },
  351. {
  352. "imports": [
  353. {
  354. "name": "ImageList_Draw",
  355. "address": "0x45e0d4"
  356. }
  357. ],
  358. "dll": "COMCTL32.dll"
  359. }
  360. ],
  361. "digital_signers": null,
  362. "exported_dll_name": null,
  363. "actual_checksum": "0x0005d1f9",
  364. "overlay": null,
  365. "imagebase": "0x00400000",
  366. "reported_checksum": "0x00000000",
  367. "icon_hash": null,
  368. "entrypoint": "0x0045e196",
  369. "timestamp": "2018-06-21 07:27:22",
  370. "osversion": "4.0",
  371. "sections": [
  372. {
  373. "name": ".MPRESS1",
  374. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  375. "virtual_address": "0x00001000",
  376. "size_of_data": "0x00056200",
  377. "entropy": "8.00",
  378. "raw_address": "0x00000200",
  379. "virtual_size": "0x0005d000",
  380. "characteristics_raw": "0xe00000e0"
  381. },
  382. {
  383. "name": ".MPRESS2",
  384. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  385. "virtual_address": "0x0005e000",
  386. "size_of_data": "0x00000600",
  387. "entropy": "5.51",
  388. "raw_address": "0x00056400",
  389. "virtual_size": "0x00000445",
  390. "characteristics_raw": "0xe00000e0"
  391. },
  392. {
  393. "name": ".rsrc",
  394. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  395. "virtual_address": "0x0005f000",
  396. "size_of_data": "0x00002e00",
  397. "entropy": "5.20",
  398. "raw_address": "0x00056a00",
  399. "virtual_size": "0x00002c44",
  400. "characteristics_raw": "0xc0000040"
  401. }
  402. ],
  403. "resources": [
  404. {
  405. "name": "RT_STRING",
  406. "language": "LANG_CHINESE",
  407. "filetype": null,
  408. "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
  409. "entropy": "0.00",
  410. "offset": "0x0005d528",
  411. "size": "0x00000042"
  412. }
  413. ],
  414. "dirents": [
  415. {
  416. "virtual_address": "0x00000000",
  417. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  418. "size": "0x00000000"
  419. },
  420. {
  421. "virtual_address": "0x0005e000",
  422. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  423. "size": "0x00000198"
  424. },
  425. {
  426. "virtual_address": "0x0005f000",
  427. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  428. "size": "0x00002c44"
  429. },
  430. {
  431. "virtual_address": "0x00000000",
  432. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  433. "size": "0x00000000"
  434. },
  435. {
  436. "virtual_address": "0x00000000",
  437. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  438. "size": "0x00000000"
  439. },
  440. {
  441. "virtual_address": "0x00000000",
  442. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  443. "size": "0x00000000"
  444. },
  445. {
  446. "virtual_address": "0x00000000",
  447. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  448. "size": "0x00000000"
  449. },
  450. {
  451. "virtual_address": "0x00000000",
  452. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  453. "size": "0x00000000"
  454. },
  455. {
  456. "virtual_address": "0x00000000",
  457. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  458. "size": "0x00000000"
  459. },
  460. {
  461. "virtual_address": "0x00000000",
  462. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  463. "size": "0x00000000"
  464. },
  465. {
  466. "virtual_address": "0x00000000",
  467. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  468. "size": "0x00000000"
  469. },
  470. {
  471. "virtual_address": "0x00000000",
  472. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  473. "size": "0x00000000"
  474. },
  475. {
  476. "virtual_address": "0x0005e0a0",
  477. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  478. "size": "0x00000038"
  479. },
  480. {
  481. "virtual_address": "0x00000000",
  482. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  483. "size": "0x00000000"
  484. },
  485. {
  486. "virtual_address": "0x00000000",
  487. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  488. "size": "0x00000000"
  489. },
  490. {
  491. "virtual_address": "0x00000000",
  492. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  493. "size": "0x00000000"
  494. }
  495. ],
  496. "exports": [],
  497. "guest_signers": {},
  498. "imphash": "f197229d03f2fb47bd50b959b5bc269c",
  499. "icon_fuzzy": null,
  500. "icon": null,
  501. "pdbpath": null,
  502. "imported_dll_count": 7,
  503. "versioninfo": []
  504. }
  505. }
  506.  
  507. [*] Resolved APIs: [
  508. "kernel32.dll.VirtualProtect",
  509. "mfc42.dll.#5261",
  510. "mfc42.dll.#2446",
  511. "mfc42.dll.#2124",
  512. "mfc42.dll.#5277",
  513. "mfc42.dll.#2982",
  514. "mfc42.dll.#3147",
  515. "mfc42.dll.#3259",
  516. "mfc42.dll.#4465",
  517. "mfc42.dll.#3136",
  518. "mfc42.dll.#3262",
  519. "mfc42.dll.#2985",
  520. "mfc42.dll.#3081",
  521. "mfc42.dll.#2976",
  522. "mfc42.dll.#3830",
  523. "mfc42.dll.#3831",
  524. "mfc42.dll.#3825",
  525. "mfc42.dll.#3079",
  526. "mfc42.dll.#4080",
  527. "mfc42.dll.#4627",
  528. "mfc42.dll.#4425",
  529. "mfc42.dll.#3597",
  530. "mfc42.dll.#641",
  531. "mfc42.dll.#1641",
  532. "mfc42.dll.#324",
  533. "mfc42.dll.#825",
  534. "mfc42.dll.#3626",
  535. "mfc42.dll.#3663",
  536. "mfc42.dll.#2414",
  537. "mfc42.dll.#4234",
  538. "mfc42.dll.#3920",
  539. "mfc42.dll.#5875",
  540. "mfc42.dll.#3089",
  541. "mfc42.dll.#4476",
  542. "mfc42.dll.#6055",
  543. "mfc42.dll.#1776",
  544. "mfc42.dll.#4406",
  545. "mfc42.dll.#5290",
  546. "mfc42.dll.#4424",
  547. "mfc42.dll.#3729",
  548. "mfc42.dll.#4299",
  549. "mfc42.dll.#6215",
  550. "mfc42.dll.#2380",
  551. "mfc42.dll.#2864",
  552. "mfc42.dll.#2582",
  553. "mfc42.dll.#4402",
  554. "mfc42.dll.#3370",
  555. "mfc42.dll.#3640",
  556. "mfc42.dll.#693",
  557. "mfc42.dll.#567",
  558. "mfc42.dll.#2302",
  559. "mfc42.dll.#3996",
  560. "mfc42.dll.#800",
  561. "mfc42.dll.#860",
  562. "mfc42.dll.#540",
  563. "mfc42.dll.#3619",
  564. "mfc42.dll.#1727",
  565. "mfc42.dll.#4267",
  566. "mfc42.dll.#4284",
  567. "mfc42.dll.#2379",
  568. "mfc42.dll.#537",
  569. "mfc42.dll.#2862",
  570. "mfc42.dll.#2754",
  571. "mfc42.dll.#2859",
  572. "mfc42.dll.#4673",
  573. "mfc42.dll.#4274",
  574. "mfc42.dll.#6375",
  575. "mfc42.dll.#4486",
  576. "mfc42.dll.#2554",
  577. "mfc42.dll.#2512",
  578. "mfc42.dll.#5731",
  579. "mfc42.dll.#3922",
  580. "mfc42.dll.#1089",
  581. "mfc42.dll.#5199",
  582. "mfc42.dll.#2396",
  583. "mfc42.dll.#3346",
  584. "mfc42.dll.#5300",
  585. "mfc42.dll.#5302",
  586. "mfc42.dll.#2725",
  587. "mfc42.dll.#4079",
  588. "mfc42.dll.#4698",
  589. "mfc42.dll.#5307",
  590. "mfc42.dll.#5289",
  591. "mfc42.dll.#5714",
  592. "mfc42.dll.#4622",
  593. "mfc42.dll.#3738",
  594. "mfc42.dll.#561",
  595. "mfc42.dll.#815",
  596. "mfc42.dll.#686",
  597. "mfc42.dll.#2621",
  598. "mfc42.dll.#1134",
  599. "mfc42.dll.#1146",
  600. "mfc42.dll.#1168",
  601. "mfc42.dll.#384",
  602. "mfc42.dll.#2086",
  603. "mfc42.dll.#823",
  604. "mfc42.dll.#6785",
  605. "mfc42.dll.#2096",
  606. "mfc42.dll.#4160",
  607. "mfc42.dll.#2863",
  608. "mfc42.dll.#755",
  609. "mfc42.dll.#470",
  610. "mfc42.dll.#3571",
  611. "mfc42.dll.#3874",
  612. "mfc42.dll.#5785",
  613. "mfc42.dll.#1640",
  614. "mfc42.dll.#323",
  615. "mfc42.dll.#5787",
  616. "mfc42.dll.#283",
  617. "mfc42.dll.#1200",
  618. "mfc42.dll.#6880",
  619. "mfc42.dll.#5065",
  620. "mfc42.dll.#3749",
  621. "mfc42.dll.#6376",
  622. "mfc42.dll.#2055",
  623. "mfc42.dll.#2648",
  624. "mfc42.dll.#4441",
  625. "mfc42.dll.#4837",
  626. "mfc42.dll.#3798",
  627. "mfc42.dll.#5280",
  628. "mfc42.dll.#4353",
  629. "mfc42.dll.#6374",
  630. "mfc42.dll.#5163",
  631. "mfc42.dll.#2385",
  632. "mfc42.dll.#5241",
  633. "mfc42.dll.#4407",
  634. "mfc42.dll.#1775",
  635. "mfc42.dll.#4078",
  636. "mfc42.dll.#6052",
  637. "mfc42.dll.#2514",
  638. "mfc42.dll.#4710",
  639. "mfc42.dll.#4998",
  640. "mfc42.dll.#4853",
  641. "mfc42.dll.#4376",
  642. "mfc42.dll.#5265",
  643. "mfc42.dll.#804",
  644. "mfc42.dll.#3573",
  645. "msvcrt.dll._controlfp",
  646. "msvcrt.dll._except_handler3",
  647. "msvcrt.dll.__set_app_type",
  648. "msvcrt.dll.__p__fmode",
  649. "msvcrt.dll.__p__commode",
  650. "msvcrt.dll.__CxxFrameHandler",
  651. "msvcrt.dll.realloc",
  652. "msvcrt.dll.free",
  653. "msvcrt.dll.__dllonexit",
  654. "msvcrt.dll._onexit",
  655. "msvcrt.dll._exit",
  656. "msvcrt.dll._XcptFilter",
  657. "msvcrt.dll.exit",
  658. "msvcrt.dll._acmdln",
  659. "msvcrt.dll.__getmainargs",
  660. "msvcrt.dll._initterm",
  661. "msvcrt.dll.__setusermatherr",
  662. "msvcrt.dll._adjust_fdiv",
  663. "msvcrt.dll._stricmp",
  664. "kernel32.dll.GetStartupInfoA",
  665. "kernel32.dll.GetModuleHandleA",
  666. "kernel32.dll.FreeLibrary",
  667. "kernel32.dll.HeapFree",
  668. "kernel32.dll.IsBadReadPtr",
  669. "kernel32.dll.HeapAlloc",
  670. "kernel32.dll.GetProcessHeap",
  671. "kernel32.dll.VirtualAlloc",
  672. "kernel32.dll.VirtualFree",
  673. "kernel32.dll.LoadLibraryA",
  674. "kernel32.dll.GetProcAddress",
  675. "user32.dll.IsIconic",
  676. "user32.dll.LoadBitmapA",
  677. "user32.dll.GetWindowRect",
  678. "user32.dll.IsZoomed",
  679. "user32.dll.PtInRect",
  680. "user32.dll.DrawIcon",
  681. "user32.dll.OffsetRect",
  682. "user32.dll.AppendMenuA",
  683. "user32.dll.LoadIconA",
  684. "user32.dll.InvalidateRect",
  685. "user32.dll.CopyRect",
  686. "user32.dll.GetSystemMetrics",
  687. "user32.dll.GetParent",
  688. "user32.dll.IsWindow",
  689. "user32.dll.GetWindowDC",
  690. "user32.dll.GetSystemMenu",
  691. "user32.dll.ReleaseDC",
  692. "user32.dll.SendMessageA",
  693. "user32.dll.GetClientRect",
  694. "user32.dll.FillRect",
  695. "user32.dll.EnableWindow",
  696. "user32.dll.DrawIconEx",
  697. "gdi32.dll.CreateCompatibleDC",
  698. "gdi32.dll.BitBlt",
  699. "gdi32.dll.GetTextColor",
  700. "gdi32.dll.CreateFontA",
  701. "gdi32.dll.GetObjectA",
  702. "gdi32.dll.GetTextExtentPoint32A",
  703. "gdi32.dll.CreateSolidBrush",
  704. "shell32.dll.SHBrowseForFolderA",
  705. "shell32.dll.SHGetPathFromIDListA",
  706. "shell32.dll.SHGetMalloc",
  707. "comctl32.dll.ImageList_ReplaceIcon",
  708. "comctl32.dll.ImageList_GetImageInfo",
  709. "comctl32.dll.ImageList_Draw",
  710. "advapi32.dll.FreeSid",
  711. "imagehlp.dll.MakeSureDirectoryPathExists",
  712. "iphlpapi.dll.GetIfTable",
  713. "mfc42.dll.#2919",
  714. "mprapi.dll.MprConfigServerConnect",
  715. "msvcp60.dll.?_Xlen@std@@YAXXZ",
  716. "netapi32.dll.NetUserAdd",
  717. "ole32.dll.CoInitialize",
  718. "oleaut32.dll.#6",
  719. "psapi.dll.EnumProcessModules",
  720. "shell32.dll.ShellExecuteA",
  721. "shlwapi.dll.PathGetArgsA",
  722. "user32.dll.GetDC",
  723. "userenv.dll.GetProfilesDirectoryA",
  724. "version.dll.VerQueryValueA",
  725. "wininet.dll.InternetOpenA",
  726. "winmm.dll.mixerOpen",
  727. "ws2_32.dll.#12",
  728. "wtsapi32.dll.WTSFreeMemory",
  729. "kernel32.dll.GetSystemInfo",
  730. "kernel32.dll.GetExitCodeThread",
  731. "kernel32.dll.IsWow64Process",
  732. "kernel32.dll.GlobalAlloc",
  733. "kernel32.dll.GetComputerNameA",
  734. "kernel32.dll.GetSystemTimes",
  735. "kernel32.dll.GetPrivateProfileStringA",
  736. "kernel32.dll.lstrcmpA",
  737. "kernel32.dll.GetPrivateProfileSectionNamesA",
  738. "kernel32.dll.WaitForMultipleObjects",
  739. "kernel32.dll.PeekNamedPipe",
  740. "kernel32.dll.TerminateThread",
  741. "kernel32.dll.DisconnectNamedPipe",
  742. "kernel32.dll.DeviceIoControl",
  743. "kernel32.dll.GetVersion",
  744. "kernel32.dll.ExitProcess",
  745. "kernel32.dll.WinExec",
  746. "kernel32.dll.SetFileAttributesA",
  747. "kernel32.dll.GetSystemDirectoryA",
  748. "kernel32.dll.GlobalSize",
  749. "kernel32.dll.GlobalLock",
  750. "kernel32.dll.GlobalUnlock",
  751. "kernel32.dll.GetFileInformationByHandle",
  752. "kernel32.dll.UnmapViewOfFile",
  753. "kernel32.dll.CreateFileMappingA",
  754. "kernel32.dll.MapViewOfFile",
  755. "kernel32.dll.TerminateProcess",
  756. "kernel32.dll.FileTimeToSystemTime",
  757. "kernel32.dll.LoadLibraryW",
  758. "kernel32.dll.CreatePipe",
  759. "kernel32.dll.CreateProcessA",
  760. "kernel32.dll.GetExitCodeProcess",
  761. "kernel32.dll.GetVersionExA",
  762. "kernel32.dll.ReadProcessMemory",
  763. "kernel32.dll.lstrcmpiA",
  764. "kernel32.dll.RemoveDirectoryA",
  765. "kernel32.dll.MoveFileA",
  766. "kernel32.dll.FindFirstFileA",
  767. "kernel32.dll.FindNextFileA",
  768. "kernel32.dll.CreateThread",
  769. "kernel32.dll.Sleep",
  770. "kernel32.dll.CloseHandle",
  771. "kernel32.dll.WaitForSingleObject",
  772. "kernel32.dll.LocalFree",
  773. "kernel32.dll.LocalAlloc",
  774. "kernel32.dll.LocalReAlloc",
  775. "kernel32.dll.LocalSize",
  776. "kernel32.dll.lstrlenA",
  777. "kernel32.dll.InitializeCriticalSection",
  778. "kernel32.dll.DeleteCriticalSection",
  779. "kernel32.dll.LeaveCriticalSection",
  780. "kernel32.dll.EnterCriticalSection",
  781. "kernel32.dll.CreateEventA",
  782. "kernel32.dll.SetEvent",
  783. "kernel32.dll.WideCharToMultiByte",
  784. "kernel32.dll.GetLocalTime",
  785. "kernel32.dll.ResetEvent",
  786. "kernel32.dll.InterlockedExchange",
  787. "kernel32.dll.Process32Next",
  788. "kernel32.dll.OpenProcess",
  789. "kernel32.dll.Process32First",
  790. "kernel32.dll.CreateToolhelp32Snapshot",
  791. "kernel32.dll.GetTickCount",
  792. "kernel32.dll.GetDiskFreeSpaceExA",
  793. "kernel32.dll.GetDriveTypeA",
  794. "kernel32.dll.GlobalMemoryStatusEx",
  795. "kernel32.dll.lstrcpyA",
  796. "kernel32.dll.MultiByteToWideChar",
  797. "kernel32.dll.ReadFile",
  798. "kernel32.dll.CreateFileA",
  799. "kernel32.dll.OpenEventA",
  800. "kernel32.dll.GetCurrentProcess",
  801. "kernel32.dll.DuplicateHandle",
  802. "kernel32.dll.GetLastError",
  803. "kernel32.dll.WTSGetActiveConsoleSessionId",
  804. "kernel32.dll.DeleteFileA",
  805. "kernel32.dll.lstrcatA",
  806. "kernel32.dll.GetWindowsDirectoryA",
  807. "kernel32.dll.GetModuleFileNameA",
  808. "kernel32.dll.WriteFile",
  809. "kernel32.dll.GetFileSize",
  810. "kernel32.dll.SetFilePointer",
  811. "kernel32.dll.CopyFileA",
  812. "kernel32.dll.ExpandEnvironmentStringsA",
  813. "kernel32.dll.GetCurrentThreadId",
  814. "kernel32.dll.CreateDirectoryA",
  815. "kernel32.dll.GetFileAttributesA",
  816. "kernel32.dll.GetVolumeInformationA",
  817. "kernel32.dll.GetLogicalDriveStringsA",
  818. "kernel32.dll.FindClose",
  819. "advapi32.dll.LsaOpenPolicy",
  820. "advapi32.dll.LsaRetrievePrivateData",
  821. "advapi32.dll.LsaClose",
  822. "advapi32.dll.LookupAccountNameA",
  823. "advapi32.dll.IsValidSid",
  824. "advapi32.dll.GetSidIdentifierAuthority",
  825. "advapi32.dll.GetSidSubAuthorityCount",
  826. "advapi32.dll.GetSidSubAuthority",
  827. "advapi32.dll.RegCreateKeyA",
  828. "advapi32.dll.EnumServicesStatusA",
  829. "advapi32.dll.QueryServiceConfigA",
  830. "advapi32.dll.ControlService",
  831. "advapi32.dll.DeleteService",
  832. "advapi32.dll.QueryServiceStatus",
  833. "advapi32.dll.ChangeServiceConfigA",
  834. "advapi32.dll.RegQueryInfoKeyA",
  835. "advapi32.dll.RegCreateKeyExA",
  836. "advapi32.dll.RegDeleteKeyA",
  837. "advapi32.dll.InitializeSecurityDescriptor",
  838. "advapi32.dll.AllocateAndInitializeSid",
  839. "advapi32.dll.GetLengthSid",
  840. "advapi32.dll.InitializeAcl",
  841. "advapi32.dll.AddAccessAllowedAce",
  842. "advapi32.dll.SetSecurityDescriptorDacl",
  843. "advapi32.dll.RegQueryValueA",
  844. "advapi32.dll.RegEnumKeyExA",
  845. "advapi32.dll.RegQueryValueExA",
  846. "advapi32.dll.OpenSCManagerA",
  847. "advapi32.dll.CreateServiceA",
  848. "advapi32.dll.LockServiceDatabase",
  849. "advapi32.dll.ChangeServiceConfig2A",
  850. "advapi32.dll.UnlockServiceDatabase",
  851. "advapi32.dll.StartServiceA",
  852. "advapi32.dll.OpenServiceA",
  853. "advapi32.dll.RegOpenKeyA",
  854. "advapi32.dll.RegSetValueExA",
  855. "advapi32.dll.CloseServiceHandle",
  856. "advapi32.dll.StartServiceCtrlDispatcherA",
  857. "advapi32.dll.DuplicateTokenEx",
  858. "advapi32.dll.SetTokenInformation",
  859. "advapi32.dll.CreateProcessAsUserA",
  860. "advapi32.dll.OpenProcessToken",
  861. "advapi32.dll.LookupPrivilegeValueA",
  862. "advapi32.dll.AdjustTokenPrivileges",
  863. "advapi32.dll.RegDeleteValueA",
  864. "advapi32.dll.RegOpenKeyExA",
  865. "advapi32.dll.RegEnumValueA",
  866. "advapi32.dll.RegCloseKey",
  867. "advapi32.dll.ClearEventLogA",
  868. "advapi32.dll.GetTokenInformation",
  869. "advapi32.dll.OpenEventLogA",
  870. "advapi32.dll.ReadEventLogA",
  871. "advapi32.dll.LookupAccountSidA",
  872. "advapi32.dll.CloseEventLog",
  873. "gdi32.dll.CreateDIBSection",
  874. "gdi32.dll.SelectObject",
  875. "gdi32.dll.DeleteObject",
  876. "gdi32.dll.DeleteDC",
  877. "gdi32.dll.GetDIBits",
  878. "gdi32.dll.CreateCompatibleBitmap",
  879. "iphlpapi.dll.GetInterfaceInfo",
  880. "iphlpapi.dll.GetAdaptersInfo",
  881. "mfc42.dll.#539",
  882. "mfc42.dll.#6394",
  883. "mfc42.dll.#5450",
  884. "mfc42.dll.#6383",
  885. "mfc42.dll.#5440",
  886. "mfc42.dll.#6283",
  887. "mfc42.dll.#2784",
  888. "mfc42.dll.#6662",
  889. "mfc42.dll.#4278",
  890. "mfc42.dll.#2763",
  891. "mfc42.dll.#6282",
  892. "mfc42.dll.#6876",
  893. "mfc42.dll.#6874",
  894. "mfc42.dll.#6930",
  895. "mfc42.dll.#3010",
  896. "mfc42.dll.#533",
  897. "mfc42.dll.#5194",
  898. "mfc42.dll.#5778",
  899. "mfc42.dll.#5465",
  900. "mfc42.dll.#798",
  901. "mfc42.dll.#940",
  902. "mfc42.dll.#547",
  903. "mfc42.dll.#2820",
  904. "mfc42.dll.#536",
  905. "mfc42.dll.#6648",
  906. "mfc42.dll.#2824",
  907. "mfc42.dll.#6143",
  908. "mfc42.dll.#356",
  909. "mfc42.dll.#922",
  910. "mfc42.dll.#2770",
  911. "mfc42.dll.#2781",
  912. "mfc42.dll.#4058",
  913. "mfc42.dll.#3178",
  914. "mfc42.dll.#1980",
  915. "mfc42.dll.#4215",
  916. "mfc42.dll.#3181",
  917. "mfc42.dll.#6883",
  918. "mfc42.dll.#668",
  919. "mfc42.dll.#2614",
  920. "mfc42.dll.#3811",
  921. "mfc42.dll.#801",
  922. "mfc42.dll.#541",
  923. "mfc42.dll.#941",
  924. "mfc42.dll.#924",
  925. "mfc42.dll.#2915",
  926. "mfc42.dll.#2818",
  927. "mfc42.dll.#5710",
  928. "mfc42.dll.#939",
  929. "mfc42.dll.#535",
  930. "mfc42.dll.#858",
  931. "mfc42.dll.#4129",
  932. "mfc42.dll.#2764",
  933. "mfc42.dll.#6877",
  934. "mfc42.dll.#5572",
  935. "mprapi.dll.MprConfigGetFriendlyName",
  936. "msvcp60.dll.??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  937. "msvcp60.dll.?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB",
  938. "msvcp60.dll.?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z",
  939. "msvcp60.dll.?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z",
  940. "msvcp60.dll.?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z",
  941. "msvcp60.dll.?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB",
  942. "msvcp60.dll.?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z",
  943. "msvcp60.dll.?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z",
  944. "msvcp60.dll.?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z",
  945. "msvcp60.dll.?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z",
  946. "msvcp60.dll.?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ",
  947. "msvcp60.dll.?_Xran@std@@YAXXZ",
  948. "msvcp60.dll.?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z",
  949. "msvcp60.dll.?_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ",
  950. "msvcp60.dll.?assign@?$char_traits@D@std@@SAXAADABD@Z",
  951. "msvcp60.dll.?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z",
  952. "msvcp60.dll.??1_Winit@std@@QAE@XZ",
  953. "msvcp60.dll.??0_Winit@std@@QAE@XZ",
  954. "msvcp60.dll.??1Init@ios_base@std@@QAE@XZ",
  955. "msvcp60.dll.??0Init@ios_base@std@@QAE@XZ",
  956. "msvcrt.dll._splitpath",
  957. "msvcrt.dll.??3@YAXPAX@Z",
  958. "msvcrt.dll.??2@YAPAXI@Z",
  959. "msvcrt.dll.malloc",
  960. "msvcrt.dll.memmove",
  961. "msvcrt.dll.ceil",
  962. "msvcrt.dll._ftol",
  963. "msvcrt.dll.strstr",
  964. "msvcrt.dll._purecall",
  965. "msvcrt.dll.sprintf",
  966. "msvcrt.dll.sscanf",
  967. "msvcrt.dll.toupper",
  968. "msvcrt.dll.atoi",
  969. "msvcrt.dll.rand",
  970. "msvcrt.dll.strncmp",
  971. "msvcrt.dll._mbscmp",
  972. "msvcrt.dll.vsprintf",
  973. "msvcrt.dll._CIacos",
  974. "msvcrt.dll.printf",
  975. "msvcrt.dll._CIpow",
  976. "msvcrt.dll._wcsupr",
  977. "msvcrt.dll._strnicmp",
  978. "msvcrt.dll.calloc",
  979. "msvcrt.dll.wcstombs",
  980. "msvcrt.dll._beginthreadex",
  981. "msvcrt.dll.localtime",
  982. "msvcrt.dll.wcscpy",
  983. "msvcrt.dll.mbstowcs",
  984. "msvcrt.dll.fwrite",
  985. "msvcrt.dll.strrchr",
  986. "msvcrt.dll.strchr",
  987. "msvcrt.dll._local_unwind2",
  988. "msvcrt.dll._mbsstr",
  989. "msvcrt.dll.wcsstr",
  990. "msvcrt.dll._mbslwr",
  991. "msvcrt.dll.wcscmp",
  992. "msvcrt.dll.fopen",
  993. "msvcrt.dll.fseek",
  994. "msvcrt.dll.ftell",
  995. "msvcrt.dll.fread",
  996. "msvcrt.dll.fclose",
  997. "msvcrt.dll.strncpy",
  998. "netapi32.dll.NetUserSetInfo",
  999. "netapi32.dll.NetUserGetInfo",
  1000. "netapi32.dll.NetUserDel",
  1001. "netapi32.dll.NetUserGetLocalGroups",
  1002. "netapi32.dll.NetLocalGroupAddMembers",
  1003. "netapi32.dll.NetApiBufferFree",
  1004. "netapi32.dll.NetUserEnum",
  1005. "ole32.dll.CoUninitialize",
  1006. "ole32.dll.CoTaskMemFree",
  1007. "ole32.dll.CoCreateInstance",
  1008. "psapi.dll.GetModuleFileNameExA",
  1009. "psapi.dll.GetProcessImageFileNameA",
  1010. "shell32.dll.SHGetFileInfoA",
  1011. "shell32.dll.SHGetSpecialFolderPathA",
  1012. "shlwapi.dll.PathRemoveArgsA",
  1013. "shlwapi.dll.PathUnquoteSpacesA",
  1014. "shlwapi.dll.PathIsDirectoryA",
  1015. "user32.dll.OpenDesktopA",
  1016. "user32.dll.GetThreadDesktop",
  1017. "user32.dll.GetUserObjectInformationA",
  1018. "user32.dll.OpenInputDesktop",
  1019. "user32.dll.SetThreadDesktop",
  1020. "user32.dll.CloseDesktop",
  1021. "user32.dll.PostMessageA",
  1022. "user32.dll.IsWindowVisible",
  1023. "user32.dll.GetCursorPos",
  1024. "user32.dll.GetCursorInfo",
  1025. "user32.dll.GetDesktopWindow",
  1026. "user32.dll.SetRect",
  1027. "user32.dll.OpenClipboard",
  1028. "user32.dll.GetClipboardData",
  1029. "user32.dll.CloseClipboard",
  1030. "user32.dll.mouse_event",
  1031. "user32.dll.SetCursorPos",
  1032. "user32.dll.WindowFromPoint",
  1033. "user32.dll.SetCapture",
  1034. "user32.dll.MapVirtualKeyA",
  1035. "user32.dll.keybd_event",
  1036. "user32.dll.SystemParametersInfoA",
  1037. "user32.dll.BlockInput",
  1038. "user32.dll.DestroyCursor",
  1039. "user32.dll.LoadCursorA",
  1040. "user32.dll.UnhookWindowsHookEx",
  1041. "user32.dll.SetWindowsHookExA",
  1042. "user32.dll.CallNextHookEx",
  1043. "user32.dll.GetKeyState",
  1044. "user32.dll.EndDialog",
  1045. "user32.dll.GetDlgItem",
  1046. "user32.dll.SetDlgItemTextA",
  1047. "user32.dll.GetDlgItemTextA",
  1048. "user32.dll.ExitWindowsEx",
  1049. "user32.dll.EnumWindows",
  1050. "user32.dll.GetWindowTextA",
  1051. "user32.dll.MessageBoxA",
  1052. "user32.dll.CharNextA",
  1053. "user32.dll.GetForegroundWindow",
  1054. "user32.dll.MoveWindow",
  1055. "user32.dll.FindWindowA",
  1056. "user32.dll.SetWindowTextA",
  1057. "user32.dll.DispatchMessageA",
  1058. "user32.dll.TranslateMessage",
  1059. "user32.dll.GetMessageA",
  1060. "user32.dll.SetWindowPos",
  1061. "user32.dll.ShowWindow",
  1062. "user32.dll.UpdateWindow",
  1063. "user32.dll.CreateDialogParamA",
  1064. "user32.dll.SwapMouseButton",
  1065. "user32.dll.PostThreadMessageA",
  1066. "user32.dll.wsprintfA",
  1067. "user32.dll.GetInputState",
  1068. "userenv.dll.CreateEnvironmentBlock",
  1069. "version.dll.GetFileVersionInfoA",
  1070. "version.dll.GetFileVersionInfoSizeA",
  1071. "wininet.dll.InternetOpenUrlA",
  1072. "wininet.dll.InternetCloseHandle",
  1073. "wininet.dll.InternetReadFile",
  1074. "winmm.dll.mixerGetDevCapsA",
  1075. "winmm.dll.mixerGetNumDevs",
  1076. "winmm.dll.waveInGetDevCapsA",
  1077. "winmm.dll.mixerSetControlDetails",
  1078. "winmm.dll.mixerGetLineInfoA",
  1079. "winmm.dll.waveOutOpen",
  1080. "winmm.dll.waveOutClose",
  1081. "winmm.dll.waveOutWrite",
  1082. "winmm.dll.waveOutPrepareHeader",
  1083. "winmm.dll.mixerGetLineControlsA",
  1084. "winmm.dll.mixerGetControlDetailsA",
  1085. "winmm.dll.mixerClose",
  1086. "winmm.dll.PlaySoundA",
  1087. "winmm.dll.waveInReset",
  1088. "winmm.dll.waveInOpen",
  1089. "winmm.dll.waveInClose",
  1090. "winmm.dll.waveInAddBuffer",
  1091. "winmm.dll.waveInPrepareHeader",
  1092. "winmm.dll.waveInUnprepareHeader",
  1093. "winmm.dll.waveOutUnprepareHeader",
  1094. "winmm.dll.mciSendStringA",
  1095. "winmm.dll.waveInGetNumDevs",
  1096. "winmm.dll.waveInStart",
  1097. "ws2_32.dll.#6",
  1098. "ws2_32.dll.#15",
  1099. "ws2_32.dll.#11",
  1100. "ws2_32.dll.#20",
  1101. "ws2_32.dll.#8",
  1102. "ws2_32.dll.WSASocketA",
  1103. "ws2_32.dll.#111",
  1104. "ws2_32.dll.#115",
  1105. "ws2_32.dll.#116",
  1106. "ws2_32.dll.WSAIoctl",
  1107. "ws2_32.dll.#21",
  1108. "ws2_32.dll.#4",
  1109. "ws2_32.dll.#9",
  1110. "ws2_32.dll.#57",
  1111. "ws2_32.dll.#52",
  1112. "ws2_32.dll.#23",
  1113. "ws2_32.dll.#18",
  1114. "ws2_32.dll.#19",
  1115. "ws2_32.dll.#3",
  1116. "ws2_32.dll.#16",
  1117. "wtsapi32.dll.WTSQueryUserToken",
  1118. "wtsapi32.dll.WTSEnumerateSessionsA",
  1119. "wtsapi32.dll.WTSQuerySessionInformationA",
  1120. "kernel32.dll.SortGetHandle",
  1121. "kernel32.dll.SortCloseHandle",
  1122. "dbghelp.dll.MakeSureDirectoryPathExists",
  1123. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  1124. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  1125. "comctl32.dll.#386",
  1126. "advapi32.dll.UnregisterTraceGuids",
  1127. "oleaut32.dll.#9",
  1128. "comctl32.dll.#321",
  1129. "winsta.dll.WinStationQueryInformationW",
  1130. "advapi32.dll.LookupAccountSidW",
  1131. "sechost.dll.LookupAccountSidLocalW",
  1132. "advapi32.dll.CreateWellKnownSid",
  1133. "rpcrt4.dll.RpcStringBindingComposeW",
  1134. "rpcrt4.dll.RpcBindingFromStringBindingW",
  1135. "rpcrt4.dll.RpcStringFreeW",
  1136. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  1137. "sechost.dll.LookupAccountNameLocalW",
  1138. "rpcrt4.dll.NdrClientCall2",
  1139. "rpcrt4.dll.RpcBindingFree",
  1140. "sechost.dll.ConvertSidToStringSidW",
  1141. "sspicli.dll.GetUserNameExW",
  1142. "wersvc.dll.ServiceMain",
  1143. "wersvc.dll.SvchostPushServiceGlobals",
  1144. "advapi32.dll.RegGetValueW",
  1145. "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  1146. "faultrep.dll.WerpInitiateCrashReporting",
  1147. "wer.dll.WerpCreateMachineStore",
  1148. "shell32.dll.SHGetFolderPathEx",
  1149. "ole32.dll.StringFromGUID2",
  1150. "profapi.dll.#104",
  1151. "userenv.dll.DestroyEnvironmentBlock",
  1152. "imm32.dll.ImmDisableIME",
  1153. "psapi.dll.GetModuleFileNameExW",
  1154. "version.dll.GetFileVersionInfoSizeW",
  1155. "version.dll.GetFileVersionInfoW",
  1156. "version.dll.VerQueryValueW",
  1157. "wer.dll.WerpCreateIntegratorReportId",
  1158. "wer.dll.WerReportCreate",
  1159. "wer.dll.WerpSetIntegratorReportId",
  1160. "wer.dll.WerReportSetParameter",
  1161. "dbgeng.dll.DebugCreate",
  1162. "ntdll.dll.CsrGetProcessId",
  1163. "ntdll.dll.DbgBreakPoint",
  1164. "ntdll.dll.DbgPrint",
  1165. "ntdll.dll.DbgPrompt",
  1166. "ntdll.dll.DbgUiConvertStateChangeStructure",
  1167. "ntdll.dll.DbgUiGetThreadDebugObject",
  1168. "ntdll.dll.DbgUiIssueRemoteBreakin",
  1169. "ntdll.dll.DbgUiSetThreadDebugObject",
  1170. "ntdll.dll.NtAllocateVirtualMemory",
  1171. "ntdll.dll.NtClose",
  1172. "ntdll.dll.NtCreateDebugObject",
  1173. "ntdll.dll.NtCreateFile",
  1174. "ntdll.dll.NtDebugActiveProcess",
  1175. "ntdll.dll.NtDebugContinue",
  1176. "ntdll.dll.NtFreeVirtualMemory",
  1177. "ntdll.dll.NtOpenProcess",
  1178. "ntdll.dll.NtOpenThread",
  1179. "ntdll.dll.NtQueryInformationProcess",
  1180. "ntdll.dll.NtQueryInformationThread",
  1181. "ntdll.dll.NtQueryMutant",
  1182. "ntdll.dll.NtQueryObject",
  1183. "ntdll.dll.NtQuerySystemInformation",
  1184. "ntdll.dll.NtRemoveProcessDebug",
  1185. "ntdll.dll.NtResumeThread",
  1186. "ntdll.dll.NtSetInformationDebugObject",
  1187. "ntdll.dll.NtSetInformationProcess",
  1188. "ntdll.dll.NtSystemDebugControl",
  1189. "ntdll.dll.NtWaitForDebugEvent",
  1190. "ntdll.dll.RtlAnsiStringToUnicodeString",
  1191. "ntdll.dll.RtlCreateProcessParameters",
  1192. "ntdll.dll.RtlCreateUserProcess",
  1193. "ntdll.dll.RtlDestroyProcessParameters",
  1194. "ntdll.dll.RtlDosPathNameToNtPathName_U",
  1195. "ntdll.dll.RtlFindMessage",
  1196. "ntdll.dll.RtlFreeHeap",
  1197. "ntdll.dll.RtlFreeUnicodeString",
  1198. "ntdll.dll.RtlGetUnloadEventTrace",
  1199. "ntdll.dll.RtlGetUnloadEventTraceEx",
  1200. "ntdll.dll.RtlInitAnsiString",
  1201. "ntdll.dll.RtlInitUnicodeString",
  1202. "ntdll.dll.RtlTryEnterCriticalSection",
  1203. "ntdll.dll.RtlUnicodeStringToAnsiString",
  1204. "ntdll.dll.NtOpenProcessToken",
  1205. "ntdll.dll.NtOpenThreadToken",
  1206. "ntdll.dll.NtQueryInformationToken",
  1207. "kernel32.dll.CloseProfileUserMapping",
  1208. "kernel32.dll.DebugActiveProcessStop",
  1209. "kernel32.dll.DebugBreak",
  1210. "kernel32.dll.DebugBreakProcess",
  1211. "kernel32.dll.DebugSetProcessKillOnExit",
  1212. "kernel32.dll.Module32First",
  1213. "kernel32.dll.Module32FirstW",
  1214. "kernel32.dll.Module32Next",
  1215. "kernel32.dll.Module32NextW",
  1216. "kernel32.dll.OpenThread",
  1217. "kernel32.dll.Process32FirstW",
  1218. "kernel32.dll.Process32NextW",
  1219. "kernel32.dll.ProcessIdToSessionId",
  1220. "kernel32.dll.SetProcessShutdownParameters",
  1221. "kernel32.dll.Thread32First",
  1222. "kernel32.dll.Thread32Next",
  1223. "kernel32.dll.GetTimeZoneInformation",
  1224. "kernel32.dll.Wow64GetThreadSelectorEntry",
  1225. "advapi32.dll.CreateServiceW",
  1226. "advapi32.dll.EnumServicesStatusExA",
  1227. "advapi32.dll.EnumServicesStatusExW",
  1228. "advapi32.dll.GetEventLogInformation",
  1229. "advapi32.dll.OpenSCManagerW",
  1230. "advapi32.dll.OpenServiceW",
  1231. "advapi32.dll.StartServiceW",
  1232. "version.dll.GetFileVersionInfoSizeExW",
  1233. "version.dll.GetFileVersionInfoExW",
  1234. "dbghelp.dll.WinDbgExtensionDllInit",
  1235. "dbghelp.dll.ExtensionApiVersion",
  1236. "wer.dll.WerpSetDynamicParameter",
  1237. "wer.dll.WerReportAddDump",
  1238. "wer.dll.WerpSetCallBack",
  1239. "wer.dll.WerReportSetUIOption",
  1240. "wer.dll.WerpAddRegisteredDataToReport",
  1241. "wer.dll.WerReportSubmit",
  1242. "advapi32.dll.RegOpenKeyExW",
  1243. "user32.dll.LoadStringW",
  1244. "advapi32.dll.RegQueryValueExW",
  1245. "advapi32.dll.CheckTokenMembership",
  1246. "user32.dll.GetProcessWindowStation",
  1247. "user32.dll.GetUserObjectInformationW",
  1248. "sensapi.dll.IsNetworkAlive",
  1249. "user32.dll.CharUpperW",
  1250. "wer.dll.WerpAddAppCompatData",
  1251. "apphelp.dll.SdbGetFileAttributes",
  1252. "apphelp.dll.SdbFormatAttribute",
  1253. "apphelp.dll.SdbFreeFileAttributes",
  1254. "cryptsp.dll.CryptAcquireContextW",
  1255. "cryptsp.dll.CryptCreateHash",
  1256. "cryptsp.dll.CryptHashData",
  1257. "cryptsp.dll.CryptGetHashParam",
  1258. "cryptsp.dll.CryptDestroyHash",
  1259. "cryptsp.dll.CryptReleaseContext",
  1260. "dbghelp.dll.MiniDumpWriteDump",
  1261. "kernel32.dll.GetLongPathNameA",
  1262. "kernel32.dll.GetLongPathNameW",
  1263. "kernel32.dll.GetProcessTimes",
  1264. "powrprof.dll.CallNtPowerInformation",
  1265. "verifier.dll.VerifierEnumerateResource",
  1266. "ntdll.dll.NtSuspendProcess",
  1267. "ntdll.dll.NtResumeProcess",
  1268. "kernel32.dll.FlsAlloc",
  1269. "kernel32.dll.FlsSetValue",
  1270. "kernel32.dll.FlsGetValue",
  1271. "kernel32.dll.LCMapStringEx",
  1272. "kernel32.dll.InitializeCriticalSectionEx",
  1273. "kernel32.dll.FlsFree",
  1274. "kernel32.dll.InitOnceExecuteOnce",
  1275. "kernel32.dll.CreateEventExW",
  1276. "kernel32.dll.CreateSemaphoreW",
  1277. "kernel32.dll.CreateSemaphoreExW",
  1278. "kernel32.dll.CreateThreadpoolTimer",
  1279. "kernel32.dll.SetThreadpoolTimer",
  1280. "kernel32.dll.WaitForThreadpoolTimerCallbacks",
  1281. "kernel32.dll.CloseThreadpoolTimer",
  1282. "kernel32.dll.CreateThreadpoolWait",
  1283. "kernel32.dll.SetThreadpoolWait",
  1284. "kernel32.dll.CloseThreadpoolWait",
  1285. "kernel32.dll.FlushProcessWriteBuffers",
  1286. "kernel32.dll.FreeLibraryWhenCallbackReturns",
  1287. "kernel32.dll.GetCurrentProcessorNumber",
  1288. "kernel32.dll.CreateSymbolicLinkW",
  1289. "kernel32.dll.GetTickCount64",
  1290. "kernel32.dll.GetFileInformationByHandleEx",
  1291. "kernel32.dll.SetFileInformationByHandle",
  1292. "kernel32.dll.InitializeConditionVariable",
  1293. "kernel32.dll.WakeConditionVariable",
  1294. "kernel32.dll.WakeAllConditionVariable",
  1295. "kernel32.dll.SleepConditionVariableCS",
  1296. "kernel32.dll.InitializeSRWLock",
  1297. "kernel32.dll.AcquireSRWLockExclusive",
  1298. "kernel32.dll.TryAcquireSRWLockExclusive",
  1299. "kernel32.dll.ReleaseSRWLockExclusive",
  1300. "kernel32.dll.SleepConditionVariableSRW",
  1301. "kernel32.dll.CreateThreadpoolWork",
  1302. "kernel32.dll.SubmitThreadpoolWork",
  1303. "kernel32.dll.CloseThreadpoolWork",
  1304. "kernel32.dll.CompareStringEx",
  1305. "kernel32.dll.GetLocaleInfoEx",
  1306. "goopdate.dll.DllEntry",
  1307. "kernel32.dll.RtlCaptureStackBackTrace",
  1308. "wkscli.dll.NetWkstaGetInfo",
  1309. "cscapi.dll.CscNetApiGetInterface",
  1310. "ntmarta.dll.GetMartaExtensionInterface",
  1311. "kernel32.dll.CreateMutexExW",
  1312. "rpcrt4.dll.UuidCreate",
  1313. "cryptbase.dll.SystemFunction036",
  1314. "cryptsp.dll.CryptGenRandom",
  1315. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  1316. "ole32.dll.CoGetClassObject",
  1317. "ole32.dll.CoGetMarshalSizeMax",
  1318. "ole32.dll.CoMarshalInterface",
  1319. "ole32.dll.CoUnmarshalInterface",
  1320. "ole32.dll.StringFromIID",
  1321. "ole32.dll.CoGetPSClsid",
  1322. "ole32.dll.CoTaskMemAlloc",
  1323. "ole32.dll.CoReleaseMarshalData",
  1324. "ole32.dll.DcomChannelSetHResult",
  1325. "psmachine.dll.DllGetClassObject",
  1326. "psmachine.dll.DllCanUnloadNow",
  1327. "advapi32.dll.RegOpenKeyW",
  1328. "ntdll.dll.RtlGetVersion",
  1329. "kernel32.dll.GetNativeSystemInfo",
  1330. "winhttp.dll.WinHttpAddRequestHeaders",
  1331. "winhttp.dll.WinHttpCheckPlatform",
  1332. "winhttp.dll.WinHttpCloseHandle",
  1333. "winhttp.dll.WinHttpConnect",
  1334. "winhttp.dll.WinHttpCrackUrl",
  1335. "winhttp.dll.WinHttpCreateUrl",
  1336. "winhttp.dll.WinHttpDetectAutoProxyConfigUrl",
  1337. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  1338. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  1339. "winhttp.dll.WinHttpGetProxyForUrl",
  1340. "winhttp.dll.WinHttpOpen",
  1341. "winhttp.dll.WinHttpOpenRequest",
  1342. "winhttp.dll.WinHttpQueryAuthSchemes",
  1343. "winhttp.dll.WinHttpQueryDataAvailable",
  1344. "winhttp.dll.WinHttpQueryHeaders",
  1345. "winhttp.dll.WinHttpQueryOption",
  1346. "winhttp.dll.WinHttpReadData",
  1347. "winhttp.dll.WinHttpReceiveResponse",
  1348. "winhttp.dll.WinHttpSendRequest",
  1349. "winhttp.dll.WinHttpSetDefaultProxyConfiguration",
  1350. "winhttp.dll.WinHttpSetCredentials",
  1351. "winhttp.dll.WinHttpSetOption",
  1352. "winhttp.dll.WinHttpSetStatusCallback",
  1353. "winhttp.dll.WinHttpSetTimeouts",
  1354. "winhttp.dll.WinHttpWriteData",
  1355. "shlwapi.dll.StrCmpNW",
  1356. "shlwapi.dll.#153",
  1357. "ws2_32.dll.GetAddrInfoW",
  1358. "ws2_32.dll.WSASocketW",
  1359. "ws2_32.dll.#2",
  1360. "ws2_32.dll.FreeAddrInfoW",
  1361. "ws2_32.dll.#5",
  1362. "schannel.dll.SpUserModeInitialize",
  1363. "advapi32.dll.RegCreateKeyExW",
  1364. "ws2_32.dll.WSASend",
  1365. "ws2_32.dll.WSARecv",
  1366. "advapi32.dll.RevertToSelf",
  1367. "secur32.dll.FreeContextBuffer",
  1368. "ncrypt.dll.SslOpenProvider",
  1369. "ncrypt.dll.GetSChannelInterface",
  1370. "bcryptprimitives.dll.GetHashInterface",
  1371. "ncrypt.dll.SslIncrementProviderReferenceCount",
  1372. "ncrypt.dll.SslImportKey",
  1373. "bcryptprimitives.dll.GetCipherInterface",
  1374. "ncrypt.dll.SslLookupCipherSuiteInfo",
  1375. "ncrypt.dll.BCryptOpenAlgorithmProvider",
  1376. "ncrypt.dll.BCryptGetProperty",
  1377. "ncrypt.dll.BCryptCreateHash",
  1378. "ncrypt.dll.BCryptHashData",
  1379. "ncrypt.dll.BCryptFinishHash",
  1380. "ncrypt.dll.BCryptDestroyHash",
  1381. "crypt32.dll.CertGetCertificateChain",
  1382. "userenv.dll.GetUserProfileDirectoryW",
  1383. "sechost.dll.ConvertStringSidToSidW",
  1384. "userenv.dll.RegisterGPNotification",
  1385. "gpapi.dll.RegisterGPNotificationInternal",
  1386. "sechost.dll.OpenSCManagerW",
  1387. "sechost.dll.OpenServiceW",
  1388. "sechost.dll.CloseServiceHandle",
  1389. "sechost.dll.QueryServiceConfigW",
  1390. "winsta.dll.WinStationRegisterNotificationEvent",
  1391. "rpcrt4.dll.RpcAsyncInitializeHandle",
  1392. "rpcrt4.dll.NdrAsyncClientCall",
  1393. "cryptsp.dll.CryptAcquireContextA",
  1394. "cryptsp.dll.CryptVerifySignatureA",
  1395. "cryptsp.dll.CryptDestroyKey",
  1396. "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
  1397. "ncrypt.dll.BCryptImportKeyPair",
  1398. "ncrypt.dll.BCryptVerifySignature",
  1399. "ncrypt.dll.BCryptDestroyKey",
  1400. "crypt32.dll.CertVerifyCertificateChainPolicy",
  1401. "crypt32.dll.CertFreeCertificateChain",
  1402. "crypt32.dll.CertDuplicateCertificateContext",
  1403. "ncrypt.dll.SslEncryptPacket",
  1404. "ncrypt.dll.SslDecryptPacket",
  1405. "rpcrt4.dll.I_RpcExceptionFilter",
  1406. "psapi.dll.GetProcessImageFileNameW",
  1407. "oleaut32.dll.#500",
  1408. "crypt32.dll.CertFreeCertificateContext",
  1409. "ncrypt.dll.SslFreeObject"
  1410. ]
  1411.  
  1412. [*] Static Analysis: {
  1413. "pe": {
  1414. "peid_signatures": null,
  1415. "imports": [
  1416. {
  1417. "imports": [
  1418. {
  1419. "name": "GetModuleHandleA",
  1420. "address": "0x45e0a0"
  1421. },
  1422. {
  1423. "name": "GetProcAddress",
  1424. "address": "0x45e0a4"
  1425. }
  1426. ],
  1427. "dll": "KERNEL32.DLL"
  1428. },
  1429. {
  1430. "imports": [
  1431. {
  1432. "name": null,
  1433. "address": "0x45e0ac"
  1434. }
  1435. ],
  1436. "dll": "MFC42.DLL"
  1437. },
  1438. {
  1439. "imports": [
  1440. {
  1441. "name": "free",
  1442. "address": "0x45e0b4"
  1443. }
  1444. ],
  1445. "dll": "MSVCRT.dll"
  1446. },
  1447. {
  1448. "imports": [
  1449. {
  1450. "name": "IsIconic",
  1451. "address": "0x45e0bc"
  1452. }
  1453. ],
  1454. "dll": "USER32.dll"
  1455. },
  1456. {
  1457. "imports": [
  1458. {
  1459. "name": "BitBlt",
  1460. "address": "0x45e0c4"
  1461. }
  1462. ],
  1463. "dll": "GDI32.dll"
  1464. },
  1465. {
  1466. "imports": [
  1467. {
  1468. "name": "SHGetMalloc",
  1469. "address": "0x45e0cc"
  1470. }
  1471. ],
  1472. "dll": "SHELL32.dll"
  1473. },
  1474. {
  1475. "imports": [
  1476. {
  1477. "name": "ImageList_Draw",
  1478. "address": "0x45e0d4"
  1479. }
  1480. ],
  1481. "dll": "COMCTL32.dll"
  1482. }
  1483. ],
  1484. "digital_signers": null,
  1485. "exported_dll_name": null,
  1486. "actual_checksum": "0x0005d1f9",
  1487. "overlay": null,
  1488. "imagebase": "0x00400000",
  1489. "reported_checksum": "0x00000000",
  1490. "icon_hash": null,
  1491. "entrypoint": "0x0045e196",
  1492. "timestamp": "2018-06-21 07:27:22",
  1493. "osversion": "4.0",
  1494. "sections": [
  1495. {
  1496. "name": ".MPRESS1",
  1497. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1498. "virtual_address": "0x00001000",
  1499. "size_of_data": "0x00056200",
  1500. "entropy": "8.00",
  1501. "raw_address": "0x00000200",
  1502. "virtual_size": "0x0005d000",
  1503. "characteristics_raw": "0xe00000e0"
  1504. },
  1505. {
  1506. "name": ".MPRESS2",
  1507. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1508. "virtual_address": "0x0005e000",
  1509. "size_of_data": "0x00000600",
  1510. "entropy": "5.51",
  1511. "raw_address": "0x00056400",
  1512. "virtual_size": "0x00000445",
  1513. "characteristics_raw": "0xe00000e0"
  1514. },
  1515. {
  1516. "name": ".rsrc",
  1517. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1518. "virtual_address": "0x0005f000",
  1519. "size_of_data": "0x00002e00",
  1520. "entropy": "5.20",
  1521. "raw_address": "0x00056a00",
  1522. "virtual_size": "0x00002c44",
  1523. "characteristics_raw": "0xc0000040"
  1524. }
  1525. ],
  1526. "resources": [
  1527. {
  1528. "name": "RT_STRING",
  1529. "language": "LANG_CHINESE",
  1530. "filetype": null,
  1531. "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
  1532. "entropy": "0.00",
  1533. "offset": "0x0005d528",
  1534. "size": "0x00000042"
  1535. }
  1536. ],
  1537. "dirents": [
  1538. {
  1539. "virtual_address": "0x00000000",
  1540. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1541. "size": "0x00000000"
  1542. },
  1543. {
  1544. "virtual_address": "0x0005e000",
  1545. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1546. "size": "0x00000198"
  1547. },
  1548. {
  1549. "virtual_address": "0x0005f000",
  1550. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1551. "size": "0x00002c44"
  1552. },
  1553. {
  1554. "virtual_address": "0x00000000",
  1555. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1556. "size": "0x00000000"
  1557. },
  1558. {
  1559. "virtual_address": "0x00000000",
  1560. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1561. "size": "0x00000000"
  1562. },
  1563. {
  1564. "virtual_address": "0x00000000",
  1565. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1566. "size": "0x00000000"
  1567. },
  1568. {
  1569. "virtual_address": "0x00000000",
  1570. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1571. "size": "0x00000000"
  1572. },
  1573. {
  1574. "virtual_address": "0x00000000",
  1575. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1576. "size": "0x00000000"
  1577. },
  1578. {
  1579. "virtual_address": "0x00000000",
  1580. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1581. "size": "0x00000000"
  1582. },
  1583. {
  1584. "virtual_address": "0x00000000",
  1585. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1586. "size": "0x00000000"
  1587. },
  1588. {
  1589. "virtual_address": "0x00000000",
  1590. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1591. "size": "0x00000000"
  1592. },
  1593. {
  1594. "virtual_address": "0x00000000",
  1595. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1596. "size": "0x00000000"
  1597. },
  1598. {
  1599. "virtual_address": "0x0005e0a0",
  1600. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1601. "size": "0x00000038"
  1602. },
  1603. {
  1604. "virtual_address": "0x00000000",
  1605. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1606. "size": "0x00000000"
  1607. },
  1608. {
  1609. "virtual_address": "0x00000000",
  1610. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1611. "size": "0x00000000"
  1612. },
  1613. {
  1614. "virtual_address": "0x00000000",
  1615. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1616. "size": "0x00000000"
  1617. }
  1618. ],
  1619. "exports": [],
  1620. "guest_signers": {},
  1621. "imphash": "f197229d03f2fb47bd50b959b5bc269c",
  1622. "icon_fuzzy": null,
  1623. "icon": null,
  1624. "pdbpath": null,
  1625. "imported_dll_count": 7,
  1626. "versioninfo": []
  1627. }
  1628. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!