Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- [*] MalFamily: ""
- [*] MalScore: 3.0
- [*] File Name: "Uninstall.exe"
- [*] File Size: 2659840
- [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
- [*] SHA256: "21dadc9f2a72a973ada4bb03e676be754ff36078db9b8145e4c764feb03c0bc5"
- [*] MD5: "123cea1d58e9e738a2262f6016dcbaf1"
- [*] SHA1: "a705c4703e215b79c862a3a8d40cccd19ede08c2"
- [*] SHA512: "0910fdbc3f7a3c4c7ffae508bb5b871edfa4e4dff2e28861221f29850c02fb1d2fb5ce7b0258718df5eda95ebc548ce9763cc48498d0cf4178ebd674a94fb371"
- [*] CRC32: "42D4A514"
- [*] SSDEEP: "24576:S10wEWBelXV+n1LfQloWBU/k8q3QX1neahruRqFKp7BaSUT0aWM12OWjDcTkWmTa:A/DBelyRaU8gvGzp7sSUTkOW/cT0Trx"
- [*] Process Execution: [
- "Uninstall.exe",
- "Uninstall.exe"
- ]
- [*] Signatures Detected: [
- {
- "Description": "Creates RWX memory",
- "Details": []
- },
- {
- "Description": "Possible date expiration check, exits too soon after checking local time",
- "Details": [
- {
- "process": "Uninstall.exe, PID 1604"
- }
- ]
- },
- {
- "Description": "Checks for the presence of known windows from debuggers and forensic tools",
- "Details": [
- {
- "Window": "TfrmMain"
- }
- ]
- }
- ]
- [*] Started Service: []
- [*] Executed Commands: [
- "C:\\Users\\user\\AppData\\Local\\Temp\\Uninstall.exe -uninstall"
- ]
- [*] Mutexes: [
- "CicLoadWinStaWinSta0",
- "Local\\MSCTF.CtfMonitorInstMutexDefault1"
- ]
- [*] Modified Files: [
- "C:\\Users\\user\\AppData\\Local\\Temp\\Uninstall.exe"
- ]
- [*] Deleted Files: []
- [*] Modified Registry Keys: []
- [*] Deleted Registry Keys: []
- [*] DNS Communications: []
- [*] Domains: []
- [*] Network Communication - ICMP: []
- [*] Network Communication - HTTP: []
- [*] Network Communication - SMTP: []
- [*] Network Communication - Hosts: []
- [*] Network Communication - IRC: []
- [*] Static Analysis: {
- "pe": {
- "peid_signatures": null,
- "imports": [
- {
- "imports": [
- {
- "name": "SysFreeString",
- "address": "0x636ad8"
- },
- {
- "name": "SysReAllocStringLen",
- "address": "0x636adc"
- },
- {
- "name": "SysAllocStringLen",
- "address": "0x636ae0"
- }
- ],
- "dll": "oleaut32.dll"
- },
- {
- "imports": [
- {
- "name": "RegQueryValueExW",
- "address": "0x636ae8"
- },
- {
- "name": "RegOpenKeyExW",
- "address": "0x636aec"
- },
- {
- "name": "RegCloseKey",
- "address": "0x636af0"
- }
- ],
- "dll": "advapi32.dll"
- },
- {
- "imports": [
- {
- "name": "MessageBoxA",
- "address": "0x636af8"
- },
- {
- "name": "CharNextW",
- "address": "0x636afc"
- },
- {
- "name": "LoadStringW",
- "address": "0x636b00"
- }
- ],
- "dll": "user32.dll"
- },
- {
- "imports": [
- {
- "name": "Sleep",
- "address": "0x636b08"
- },
- {
- "name": "VirtualFree",
- "address": "0x636b0c"
- },
- {
- "name": "VirtualAlloc",
- "address": "0x636b10"
- },
- {
- "name": "lstrlenW",
- "address": "0x636b14"
- },
- {
- "name": "VirtualQuery",
- "address": "0x636b18"
- },
- {
- "name": "QueryPerformanceCounter",
- "address": "0x636b1c"
- },
- {
- "name": "GetTickCount",
- "address": "0x636b20"
- },
- {
- "name": "GetSystemInfo",
- "address": "0x636b24"
- },
- {
- "name": "GetVersion",
- "address": "0x636b28"
- },
- {
- "name": "CompareStringW",
- "address": "0x636b2c"
- },
- {
- "name": "IsValidLocale",
- "address": "0x636b30"
- },
- {
- "name": "SetThreadLocale",
- "address": "0x636b34"
- },
- {
- "name": "GetSystemDefaultUILanguage",
- "address": "0x636b38"
- },
- {
- "name": "GetUserDefaultUILanguage",
- "address": "0x636b3c"
- },
- {
- "name": "GetLocaleInfoW",
- "address": "0x636b40"
- },
- {
- "name": "WideCharToMultiByte",
- "address": "0x636b44"
- },
- {
- "name": "MultiByteToWideChar",
- "address": "0x636b48"
- },
- {
- "name": "GetACP",
- "address": "0x636b4c"
- },
- {
- "name": "LoadLibraryExW",
- "address": "0x636b50"
- },
- {
- "name": "GetStartupInfoW",
- "address": "0x636b54"
- },
- {
- "name": "GetProcAddress",
- "address": "0x636b58"
- },
- {
- "name": "GetModuleHandleW",
- "address": "0x636b5c"
- },
- {
- "name": "GetModuleFileNameW",
- "address": "0x636b60"
- },
- {
- "name": "GetCommandLineW",
- "address": "0x636b64"
- },
- {
- "name": "FreeLibrary",
- "address": "0x636b68"
- },
- {
- "name": "GetLastError",
- "address": "0x636b6c"
- },
- {
- "name": "UnhandledExceptionFilter",
- "address": "0x636b70"
- },
- {
- "name": "RtlUnwind",
- "address": "0x636b74"
- },
- {
- "name": "RaiseException",
- "address": "0x636b78"
- },
- {
- "name": "ExitProcess",
- "address": "0x636b7c"
- },
- {
- "name": "ExitThread",
- "address": "0x636b80"
- },
- {
- "name": "SwitchToThread",
- "address": "0x636b84"
- },
- {
- "name": "GetCurrentThreadId",
- "address": "0x636b88"
- },
- {
- "name": "CreateThread",
- "address": "0x636b8c"
- },
- {
- "name": "DeleteCriticalSection",
- "address": "0x636b90"
- },
- {
- "name": "LeaveCriticalSection",
- "address": "0x636b94"
- },
- {
- "name": "EnterCriticalSection",
- "address": "0x636b98"
- },
- {
- "name": "InitializeCriticalSection",
- "address": "0x636b9c"
- },
- {
- "name": "FindFirstFileW",
- "address": "0x636ba0"
- },
- {
- "name": "FindClose",
- "address": "0x636ba4"
- },
- {
- "name": "SetCurrentDirectoryW",
- "address": "0x636ba8"
- },
- {
- "name": "GetCurrentDirectoryW",
- "address": "0x636bac"
- },
- {
- "name": "WriteFile",
- "address": "0x636bb0"
- },
- {
- "name": "GetStdHandle",
- "address": "0x636bb4"
- },
- {
- "name": "CloseHandle",
- "address": "0x636bb8"
- }
- ],
- "dll": "kernel32.dll"
- },
- {
- "imports": [
- {
- "name": "GetProcAddress",
- "address": "0x636bc0"
- },
- {
- "name": "RaiseException",
- "address": "0x636bc4"
- },
- {
- "name": "LoadLibraryA",
- "address": "0x636bc8"
- },
- {
- "name": "GetLastError",
- "address": "0x636bcc"
- },
- {
- "name": "TlsSetValue",
- "address": "0x636bd0"
- },
- {
- "name": "TlsGetValue",
- "address": "0x636bd4"
- },
- {
- "name": "LocalFree",
- "address": "0x636bd8"
- },
- {
- "name": "LocalAlloc",
- "address": "0x636bdc"
- },
- {
- "name": "GetModuleHandleW",
- "address": "0x636be0"
- },
- {
- "name": "FreeLibrary",
- "address": "0x636be4"
- }
- ],
- "dll": "kernel32.dll"
- },
- {
- "imports": [
- {
- "name": "SetClassLongW",
- "address": "0x636bec"
- },
- {
- "name": "GetClassLongW",
- "address": "0x636bf0"
- },
- {
- "name": "SetWindowLongW",
- "address": "0x636bf4"
- },
- {
- "name": "GetWindowLongW",
- "address": "0x636bf8"
- },
- {
- "name": "CreateWindowExW",
- "address": "0x636bfc"
- },
- {
- "name": "WindowFromPoint",
- "address": "0x636c00"
- },
- {
- "name": "WaitMessage",
- "address": "0x636c04"
- },
- {
- "name": "UpdateWindow",
- "address": "0x636c08"
- },
- {
- "name": "UnregisterClassW",
- "address": "0x636c0c"
- },
- {
- "name": "UnhookWindowsHookEx",
- "address": "0x636c10"
- },
- {
- "name": "TranslateMessage",
- "address": "0x636c14"
- },
- {
- "name": "TranslateMDISysAccel",
- "address": "0x636c18"
- },
- {
- "name": "TrackPopupMenu",
- "address": "0x636c1c"
- },
- {
- "name": "SystemParametersInfoW",
- "address": "0x636c20"
- },
- {
- "name": "ShowWindow",
- "address": "0x636c24"
- },
- {
- "name": "ShowScrollBar",
- "address": "0x636c28"
- },
- {
- "name": "ShowOwnedPopups",
- "address": "0x636c2c"
- },
- {
- "name": "ShowCaret",
- "address": "0x636c30"
- },
- {
- "name": "SetWindowRgn",
- "address": "0x636c34"
- },
- {
- "name": "SetWindowsHookExW",
- "address": "0x636c38"
- },
- {
- "name": "SetWindowTextW",
- "address": "0x636c3c"
- },
- {
- "name": "SetWindowPos",
- "address": "0x636c40"
- },
- {
- "name": "SetWindowPlacement",
- "address": "0x636c44"
- },
- {
- "name": "SetTimer",
- "address": "0x636c48"
- },
- {
- "name": "SetScrollRange",
- "address": "0x636c4c"
- },
- {
- "name": "SetScrollPos",
- "address": "0x636c50"
- },
- {
- "name": "SetScrollInfo",
- "address": "0x636c54"
- },
- {
- "name": "SetRect",
- "address": "0x636c58"
- },
- {
- "name": "SetPropW",
- "address": "0x636c5c"
- },
- {
- "name": "SetParent",
- "address": "0x636c60"
- },
- {
- "name": "SetMenuItemInfoW",
- "address": "0x636c64"
- },
- {
- "name": "SetMenu",
- "address": "0x636c68"
- },
- {
- "name": "SetForegroundWindow",
- "address": "0x636c6c"
- },
- {
- "name": "SetFocus",
- "address": "0x636c70"
- },
- {
- "name": "SetCursorPos",
- "address": "0x636c74"
- },
- {
- "name": "SetCursor",
- "address": "0x636c78"
- },
- {
- "name": "SetClipboardData",
- "address": "0x636c7c"
- },
- {
- "name": "SetCapture",
- "address": "0x636c80"
- },
- {
- "name": "SetActiveWindow",
- "address": "0x636c84"
- },
- {
- "name": "SendMessageA",
- "address": "0x636c88"
- },
- {
- "name": "SendMessageW",
- "address": "0x636c8c"
- },
- {
- "name": "ScrollWindow",
- "address": "0x636c90"
- },
- {
- "name": "ScreenToClient",
- "address": "0x636c94"
- },
- {
- "name": "RemovePropW",
- "address": "0x636c98"
- },
- {
- "name": "RemoveMenu",
- "address": "0x636c9c"
- },
- {
- "name": "ReleaseDC",
- "address": "0x636ca0"
- },
- {
- "name": "ReleaseCapture",
- "address": "0x636ca4"
- },
- {
- "name": "RegisterWindowMessageW",
- "address": "0x636ca8"
- },
- {
- "name": "RegisterClipboardFormatW",
- "address": "0x636cac"
- },
- {
- "name": "RegisterClassW",
- "address": "0x636cb0"
- },
- {
- "name": "RedrawWindow",
- "address": "0x636cb4"
- },
- {
- "name": "PostQuitMessage",
- "address": "0x636cb8"
- },
- {
- "name": "PostMessageW",
- "address": "0x636cbc"
- },
- {
- "name": "PeekMessageA",
- "address": "0x636cc0"
- },
- {
- "name": "PeekMessageW",
- "address": "0x636cc4"
- },
- {
- "name": "OpenClipboard",
- "address": "0x636cc8"
- },
- {
- "name": "MsgWaitForMultipleObjectsEx",
- "address": "0x636ccc"
- },
- {
- "name": "MsgWaitForMultipleObjects",
- "address": "0x636cd0"
- },
- {
- "name": "MessageBoxW",
- "address": "0x636cd4"
- },
- {
- "name": "MessageBeep",
- "address": "0x636cd8"
- },
- {
- "name": "MapWindowPoints",
- "address": "0x636cdc"
- },
- {
- "name": "MapVirtualKeyW",
- "address": "0x636ce0"
- },
- {
- "name": "LoadStringW",
- "address": "0x636ce4"
- },
- {
- "name": "LoadKeyboardLayoutW",
- "address": "0x636ce8"
- },
- {
- "name": "LoadIconW",
- "address": "0x636cec"
- },
- {
- "name": "LoadCursorW",
- "address": "0x636cf0"
- },
- {
- "name": "LoadBitmapW",
- "address": "0x636cf4"
- },
- {
- "name": "KillTimer",
- "address": "0x636cf8"
- },
- {
- "name": "IsZoomed",
- "address": "0x636cfc"
- },
- {
- "name": "IsWindowVisible",
- "address": "0x636d00"
- },
- {
- "name": "IsWindowUnicode",
- "address": "0x636d04"
- },
- {
- "name": "IsWindowEnabled",
- "address": "0x636d08"
- },
- {
- "name": "IsWindow",
- "address": "0x636d0c"
- },
- {
- "name": "IsIconic",
- "address": "0x636d10"
- },
- {
- "name": "IsDialogMessageA",
- "address": "0x636d14"
- },
- {
- "name": "IsDialogMessageW",
- "address": "0x636d18"
- },
- {
- "name": "IsChild",
- "address": "0x636d1c"
- },
- {
- "name": "InvalidateRect",
- "address": "0x636d20"
- },
- {
- "name": "InsertMenuItemW",
- "address": "0x636d24"
- },
- {
- "name": "InsertMenuW",
- "address": "0x636d28"
- },
- {
- "name": "HideCaret",
- "address": "0x636d2c"
- },
- {
- "name": "GetWindowThreadProcessId",
- "address": "0x636d30"
- },
- {
- "name": "GetWindowTextW",
- "address": "0x636d34"
- },
- {
- "name": "GetWindowRect",
- "address": "0x636d38"
- },
- {
- "name": "GetWindowPlacement",
- "address": "0x636d3c"
- },
- {
- "name": "GetWindowDC",
- "address": "0x636d40"
- },
- {
- "name": "GetUpdateRect",
- "address": "0x636d44"
- },
- {
- "name": "GetTopWindow",
- "address": "0x636d48"
- },
- {
- "name": "GetSystemMetrics",
- "address": "0x636d4c"
- },
- {
- "name": "GetSystemMenu",
- "address": "0x636d50"
- },
- {
- "name": "GetSysColorBrush",
- "address": "0x636d54"
- },
- {
- "name": "GetSysColor",
- "address": "0x636d58"
- },
- {
- "name": "GetSubMenu",
- "address": "0x636d5c"
- },
- {
- "name": "GetScrollRange",
- "address": "0x636d60"
- },
- {
- "name": "GetScrollPos",
- "address": "0x636d64"
- },
- {
- "name": "GetScrollInfo",
- "address": "0x636d68"
- },
- {
- "name": "GetScrollBarInfo",
- "address": "0x636d6c"
- },
- {
- "name": "GetPropW",
- "address": "0x636d70"
- },
- {
- "name": "GetParent",
- "address": "0x636d74"
- },
- {
- "name": "GetWindow",
- "address": "0x636d78"
- },
- {
- "name": "GetMessagePos",
- "address": "0x636d7c"
- },
- {
- "name": "GetMessageExtraInfo",
- "address": "0x636d80"
- },
- {
- "name": "GetMenuStringW",
- "address": "0x636d84"
- },
- {
- "name": "GetMenuState",
- "address": "0x636d88"
- },
- {
- "name": "GetMenuItemInfoW",
- "address": "0x636d8c"
- },
- {
- "name": "GetMenuItemID",
- "address": "0x636d90"
- },
- {
- "name": "GetMenuItemCount",
- "address": "0x636d94"
- },
- {
- "name": "GetMenu",
- "address": "0x636d98"
- },
- {
- "name": "GetLastActivePopup",
- "address": "0x636d9c"
- },
- {
- "name": "GetKeyboardState",
- "address": "0x636da0"
- },
- {
- "name": "GetKeyboardLayoutNameW",
- "address": "0x636da4"
- },
- {
- "name": "GetKeyboardLayoutList",
- "address": "0x636da8"
- },
- {
- "name": "GetKeyboardLayout",
- "address": "0x636dac"
- },
- {
- "name": "GetKeyState",
- "address": "0x636db0"
- },
- {
- "name": "GetKeyNameTextW",
- "address": "0x636db4"
- },
- {
- "name": "GetIconInfo",
- "address": "0x636db8"
- },
- {
- "name": "GetForegroundWindow",
- "address": "0x636dbc"
- },
- {
- "name": "GetFocus",
- "address": "0x636dc0"
- },
- {
- "name": "GetDlgItem",
- "address": "0x636dc4"
- },
- {
- "name": "GetDlgCtrlID",
- "address": "0x636dc8"
- },
- {
- "name": "GetDesktopWindow",
- "address": "0x636dcc"
- },
- {
- "name": "GetDCEx",
- "address": "0x636dd0"
- },
- {
- "name": "GetDC",
- "address": "0x636dd4"
- },
- {
- "name": "GetCursorPos",
- "address": "0x636dd8"
- },
- {
- "name": "GetCursor",
- "address": "0x636ddc"
- },
- {
- "name": "GetClipboardData",
- "address": "0x636de0"
- },
- {
- "name": "GetClientRect",
- "address": "0x636de4"
- },
- {
- "name": "GetClassNameW",
- "address": "0x636de8"
- },
- {
- "name": "GetClassInfoExW",
- "address": "0x636dec"
- },
- {
- "name": "GetClassInfoW",
- "address": "0x636df0"
- },
- {
- "name": "GetCapture",
- "address": "0x636df4"
- },
- {
- "name": "GetActiveWindow",
- "address": "0x636df8"
- },
- {
- "name": "FrameRect",
- "address": "0x636dfc"
- },
- {
- "name": "FindWindowExW",
- "address": "0x636e00"
- },
- {
- "name": "FindWindowW",
- "address": "0x636e04"
- },
- {
- "name": "FillRect",
- "address": "0x636e08"
- },
- {
- "name": "EnumWindows",
- "address": "0x636e0c"
- },
- {
- "name": "EnumThreadWindows",
- "address": "0x636e10"
- },
- {
- "name": "EnumChildWindows",
- "address": "0x636e14"
- },
- {
- "name": "EndPaint",
- "address": "0x636e18"
- },
- {
- "name": "EndMenu",
- "address": "0x636e1c"
- },
- {
- "name": "EnableWindow",
- "address": "0x636e20"
- },
- {
- "name": "EnableScrollBar",
- "address": "0x636e24"
- },
- {
- "name": "EnableMenuItem",
- "address": "0x636e28"
- },
- {
- "name": "EmptyClipboard",
- "address": "0x636e2c"
- },
- {
- "name": "DrawTextExW",
- "address": "0x636e30"
- },
- {
- "name": "DrawTextW",
- "address": "0x636e34"
- },
- {
- "name": "DrawMenuBar",
- "address": "0x636e38"
- },
- {
- "name": "DrawIconEx",
- "address": "0x636e3c"
- },
- {
- "name": "DrawIcon",
- "address": "0x636e40"
- },
- {
- "name": "DrawFrameControl",
- "address": "0x636e44"
- },
- {
- "name": "DrawFocusRect",
- "address": "0x636e48"
- },
- {
- "name": "DrawEdge",
- "address": "0x636e4c"
- },
- {
- "name": "DispatchMessageA",
- "address": "0x636e50"
- },
- {
- "name": "DispatchMessageW",
- "address": "0x636e54"
- },
- {
- "name": "DestroyWindow",
- "address": "0x636e58"
- },
- {
- "name": "DestroyMenu",
- "address": "0x636e5c"
- },
- {
- "name": "DestroyIcon",
- "address": "0x636e60"
- },
- {
- "name": "DestroyCursor",
- "address": "0x636e64"
- },
- {
- "name": "DeleteMenu",
- "address": "0x636e68"
- },
- {
- "name": "DefWindowProcW",
- "address": "0x636e6c"
- },
- {
- "name": "DefMDIChildProcW",
- "address": "0x636e70"
- },
- {
- "name": "DefFrameProcW",
- "address": "0x636e74"
- },
- {
- "name": "CreatePopupMenu",
- "address": "0x636e78"
- },
- {
- "name": "CreateMenu",
- "address": "0x636e7c"
- },
- {
- "name": "CreateIcon",
- "address": "0x636e80"
- },
- {
- "name": "CreateAcceleratorTableW",
- "address": "0x636e84"
- },
- {
- "name": "CopyImage",
- "address": "0x636e88"
- },
- {
- "name": "CopyIcon",
- "address": "0x636e8c"
- },
- {
- "name": "CloseClipboard",
- "address": "0x636e90"
- },
- {
- "name": "ClientToScreen",
- "address": "0x636e94"
- },
- {
- "name": "CheckMenuItem",
- "address": "0x636e98"
- },
- {
- "name": "CharUpperBuffW",
- "address": "0x636e9c"
- },
- {
- "name": "CharUpperW",
- "address": "0x636ea0"
- },
- {
- "name": "CharNextW",
- "address": "0x636ea4"
- },
- {
- "name": "CharLowerBuffW",
- "address": "0x636ea8"
- },
- {
- "name": "CharLowerW",
- "address": "0x636eac"
- },
- {
- "name": "CallWindowProcW",
- "address": "0x636eb0"
- },
- {
- "name": "CallNextHookEx",
- "address": "0x636eb4"
- },
- {
- "name": "BeginPaint",
- "address": "0x636eb8"
- },
- {
- "name": "AttachThreadInput",
- "address": "0x636ebc"
- },
- {
- "name": "AdjustWindowRectEx",
- "address": "0x636ec0"
- },
- {
- "name": "ActivateKeyboardLayout",
- "address": "0x636ec4"
- }
- ],
- "dll": "user32.dll"
- },
- {
- "imports": [
- {
- "name": "UnrealizeObject",
- "address": "0x636ecc"
- },
- {
- "name": "StretchDIBits",
- "address": "0x636ed0"
- },
- {
- "name": "StretchBlt",
- "address": "0x636ed4"
- },
- {
- "name": "StartPage",
- "address": "0x636ed8"
- },
- {
- "name": "StartDocW",
- "address": "0x636edc"
- },
- {
- "name": "SetWindowOrgEx",
- "address": "0x636ee0"
- },
- {
- "name": "SetWinMetaFileBits",
- "address": "0x636ee4"
- },
- {
- "name": "SetViewportOrgEx",
- "address": "0x636ee8"
- },
- {
- "name": "SetTextColor",
- "address": "0x636eec"
- },
- {
- "name": "SetStretchBltMode",
- "address": "0x636ef0"
- },
- {
- "name": "SetROP2",
- "address": "0x636ef4"
- },
- {
- "name": "SetPixel",
- "address": "0x636ef8"
- },
- {
- "name": "SetMapMode",
- "address": "0x636efc"
- },
- {
- "name": "SetEnhMetaFileBits",
- "address": "0x636f00"
- },
- {
- "name": "SetDIBits",
- "address": "0x636f04"
- },
- {
- "name": "SetDIBColorTable",
- "address": "0x636f08"
- },
- {
- "name": "SetBrushOrgEx",
- "address": "0x636f0c"
- },
- {
- "name": "SetBkMode",
- "address": "0x636f10"
- },
- {
- "name": "SetBkColor",
- "address": "0x636f14"
- },
- {
- "name": "SetAbortProc",
- "address": "0x636f18"
- },
- {
- "name": "SelectPalette",
- "address": "0x636f1c"
- },
- {
- "name": "SelectObject",
- "address": "0x636f20"
- },
- {
- "name": "SelectClipRgn",
- "address": "0x636f24"
- },
- {
- "name": "SaveDC",
- "address": "0x636f28"
- },
- {
- "name": "RoundRect",
- "address": "0x636f2c"
- },
- {
- "name": "RestoreDC",
- "address": "0x636f30"
- },
- {
- "name": "ResizePalette",
- "address": "0x636f34"
- },
- {
- "name": "Rectangle",
- "address": "0x636f38"
- },
- {
- "name": "RectVisible",
- "address": "0x636f3c"
- },
- {
- "name": "RealizePalette",
- "address": "0x636f40"
- },
- {
- "name": "Polyline",
- "address": "0x636f44"
- },
- {
- "name": "Polygon",
- "address": "0x636f48"
- },
- {
- "name": "PolyBezierTo",
- "address": "0x636f4c"
- },
- {
- "name": "PolyBezier",
- "address": "0x636f50"
- },
- {
- "name": "PlayEnhMetaFile",
- "address": "0x636f54"
- },
- {
- "name": "Pie",
- "address": "0x636f58"
- },
- {
- "name": "PatBlt",
- "address": "0x636f5c"
- },
- {
- "name": "OffsetRgn",
- "address": "0x636f60"
- },
- {
- "name": "MoveToEx",
- "address": "0x636f64"
- },
- {
- "name": "MaskBlt",
- "address": "0x636f68"
- },
- {
- "name": "LineTo",
- "address": "0x636f6c"
- },
- {
- "name": "IntersectClipRect",
- "address": "0x636f70"
- },
- {
- "name": "GetWindowOrgEx",
- "address": "0x636f74"
- },
- {
- "name": "GetWinMetaFileBits",
- "address": "0x636f78"
- },
- {
- "name": "GetTextMetricsW",
- "address": "0x636f7c"
- },
- {
- "name": "GetTextExtentPointW",
- "address": "0x636f80"
- },
- {
- "name": "GetTextExtentPoint32W",
- "address": "0x636f84"
- },
- {
- "name": "GetSystemPaletteEntries",
- "address": "0x636f88"
- },
- {
- "name": "GetStockObject",
- "address": "0x636f8c"
- },
- {
- "name": "GetRgnBox",
- "address": "0x636f90"
- },
- {
- "name": "GetPixel",
- "address": "0x636f94"
- },
- {
- "name": "GetPaletteEntries",
- "address": "0x636f98"
- },
- {
- "name": "GetObjectW",
- "address": "0x636f9c"
- },
- {
- "name": "GetNearestPaletteIndex",
- "address": "0x636fa0"
- },
- {
- "name": "GetEnhMetaFilePaletteEntries",
- "address": "0x636fa4"
- },
- {
- "name": "GetEnhMetaFileHeader",
- "address": "0x636fa8"
- },
- {
- "name": "GetEnhMetaFileDescriptionW",
- "address": "0x636fac"
- },
- {
- "name": "GetEnhMetaFileBits",
- "address": "0x636fb0"
- },
- {
- "name": "GetDeviceCaps",
- "address": "0x636fb4"
- },
- {
- "name": "GetDIBits",
- "address": "0x636fb8"
- },
- {
- "name": "GetDIBColorTable",
- "address": "0x636fbc"
- },
- {
- "name": "GetCurrentPositionEx",
- "address": "0x636fc0"
- },
- {
- "name": "GetClipBox",
- "address": "0x636fc4"
- },
- {
- "name": "GetBrushOrgEx",
- "address": "0x636fc8"
- },
- {
- "name": "GetBitmapBits",
- "address": "0x636fcc"
- },
- {
- "name": "GdiFlush",
- "address": "0x636fd0"
- },
- {
- "name": "FrameRgn",
- "address": "0x636fd4"
- },
- {
- "name": "ExtTextOutW",
- "address": "0x636fd8"
- },
- {
- "name": "ExtFloodFill",
- "address": "0x636fdc"
- },
- {
- "name": "ExcludeClipRect",
- "address": "0x636fe0"
- },
- {
- "name": "EnumFontsW",
- "address": "0x636fe4"
- },
- {
- "name": "EnumFontFamiliesExW",
- "address": "0x636fe8"
- },
- {
- "name": "EndPage",
- "address": "0x636fec"
- },
- {
- "name": "EndDoc",
- "address": "0x636ff0"
- },
- {
- "name": "Ellipse",
- "address": "0x636ff4"
- },
- {
- "name": "DeleteObject",
- "address": "0x636ff8"
- },
- {
- "name": "DeleteEnhMetaFile",
- "address": "0x636ffc"
- },
- {
- "name": "DeleteDC",
- "address": "0x637000"
- },
- {
- "name": "CreateSolidBrush",
- "address": "0x637004"
- },
- {
- "name": "CreateRoundRectRgn",
- "address": "0x637008"
- },
- {
- "name": "CreateRectRgn",
- "address": "0x63700c"
- },
- {
- "name": "CreatePenIndirect",
- "address": "0x637010"
- },
- {
- "name": "CreatePalette",
- "address": "0x637014"
- },
- {
- "name": "CreateICW",
- "address": "0x637018"
- },
- {
- "name": "CreateHalftonePalette",
- "address": "0x63701c"
- },
- {
- "name": "CreateFontIndirectW",
- "address": "0x637020"
- },
- {
- "name": "CreateEllipticRgn",
- "address": "0x637024"
- },
- {
- "name": "CreateDIBitmap",
- "address": "0x637028"
- },
- {
- "name": "CreateDIBSection",
- "address": "0x63702c"
- },
- {
- "name": "CreateDCW",
- "address": "0x637030"
- },
- {
- "name": "CreateCompatibleDC",
- "address": "0x637034"
- },
- {
- "name": "CreateCompatibleBitmap",
- "address": "0x637038"
- },
- {
- "name": "CreateBrushIndirect",
- "address": "0x63703c"
- },
- {
- "name": "CreateBitmap",
- "address": "0x637040"
- },
- {
- "name": "CopyEnhMetaFileW",
- "address": "0x637044"
- },
- {
- "name": "Chord",
- "address": "0x637048"
- },
- {
- "name": "BitBlt",
- "address": "0x63704c"
- },
- {
- "name": "ArcTo",
- "address": "0x637050"
- },
- {
- "name": "Arc",
- "address": "0x637054"
- },
- {
- "name": "AngleArc",
- "address": "0x637058"
- },
- {
- "name": "AbortDoc",
- "address": "0x63705c"
- }
- ],
- "dll": "gdi32.dll"
- },
- {
- "imports": [
- {
- "name": "VerQueryValueW",
- "address": "0x637064"
- },
- {
- "name": "GetFileVersionInfoSizeW",
- "address": "0x637068"
- },
- {
- "name": "GetFileVersionInfoW",
- "address": "0x63706c"
- }
- ],
- "dll": "version.dll"
- },
- {
- "imports": [
- {
- "name": "WNetGetConnectionW",
- "address": "0x637074"
- }
- ],
- "dll": "mpr.dll"
- },
- {
- "imports": [
- {
- "name": "WriteFile",
- "address": "0x63707c"
- },
- {
- "name": "WideCharToMultiByte",
- "address": "0x637080"
- },
- {
- "name": "WaitForSingleObject",
- "address": "0x637084"
- },
- {
- "name": "WaitForMultipleObjectsEx",
- "address": "0x637088"
- },
- {
- "name": "VirtualQueryEx",
- "address": "0x63708c"
- },
- {
- "name": "VirtualQuery",
- "address": "0x637090"
- },
- {
- "name": "VirtualProtect",
- "address": "0x637094"
- },
- {
- "name": "VirtualFree",
- "address": "0x637098"
- },
- {
- "name": "VirtualAlloc",
- "address": "0x63709c"
- },
- {
- "name": "VerSetConditionMask",
- "address": "0x6370a0"
- },
- {
- "name": "VerifyVersionInfoW",
- "address": "0x6370a4"
- },
- {
- "name": "TryEnterCriticalSection",
- "address": "0x6370a8"
- },
- {
- "name": "SwitchToThread",
- "address": "0x6370ac"
- },
- {
- "name": "SuspendThread",
- "address": "0x6370b0"
- },
- {
- "name": "Sleep",
- "address": "0x6370b4"
- },
- {
- "name": "SizeofResource",
- "address": "0x6370b8"
- },
- {
- "name": "SetThreadPriority",
- "address": "0x6370bc"
- },
- {
- "name": "SetThreadLocale",
- "address": "0x6370c0"
- },
- {
- "name": "SetLastError",
- "address": "0x6370c4"
- },
- {
- "name": "SetFilePointer",
- "address": "0x6370c8"
- },
- {
- "name": "SetEvent",
- "address": "0x6370cc"
- },
- {
- "name": "SetErrorMode",
- "address": "0x6370d0"
- },
- {
- "name": "SetEndOfFile",
- "address": "0x6370d4"
- },
- {
- "name": "ResumeThread",
- "address": "0x6370d8"
- },
- {
- "name": "ResetEvent",
- "address": "0x6370dc"
- },
- {
- "name": "RemoveDirectoryW",
- "address": "0x6370e0"
- },
- {
- "name": "ReadFile",
- "address": "0x6370e4"
- },
- {
- "name": "RaiseException",
- "address": "0x6370e8"
- },
- {
- "name": "IsDebuggerPresent",
- "address": "0x6370ec"
- },
- {
- "name": "MulDiv",
- "address": "0x6370f0"
- },
- {
- "name": "LockResource",
- "address": "0x6370f4"
- },
- {
- "name": "LocalFree",
- "address": "0x6370f8"
- },
- {
- "name": "LoadResource",
- "address": "0x6370fc"
- },
- {
- "name": "LoadLibraryW",
- "address": "0x637100"
- },
- {
- "name": "LeaveCriticalSection",
- "address": "0x637104"
- },
- {
- "name": "IsValidLocale",
- "address": "0x637108"
- },
- {
- "name": "InitializeCriticalSection",
- "address": "0x63710c"
- },
- {
- "name": "HeapSize",
- "address": "0x637110"
- },
- {
- "name": "HeapFree",
- "address": "0x637114"
- },
- {
- "name": "HeapDestroy",
- "address": "0x637118"
- },
- {
- "name": "HeapCreate",
- "address": "0x63711c"
- },
- {
- "name": "HeapAlloc",
- "address": "0x637120"
- },
- {
- "name": "GlobalUnlock",
- "address": "0x637124"
- },
- {
- "name": "GlobalLock",
- "address": "0x637128"
- },
- {
- "name": "GlobalFree",
- "address": "0x63712c"
- },
- {
- "name": "GlobalFindAtomW",
- "address": "0x637130"
- },
- {
- "name": "GlobalDeleteAtom",
- "address": "0x637134"
- },
- {
- "name": "GlobalAlloc",
- "address": "0x637138"
- },
- {
- "name": "GlobalAddAtomW",
- "address": "0x63713c"
- },
- {
- "name": "GetVolumeInformationW",
- "address": "0x637140"
- },
- {
- "name": "GetVersionExW",
- "address": "0x637144"
- },
- {
- "name": "GetVersion",
- "address": "0x637148"
- },
- {
- "name": "GetTickCount",
- "address": "0x63714c"
- },
- {
- "name": "GetThreadPriority",
- "address": "0x637150"
- },
- {
- "name": "GetThreadLocale",
- "address": "0x637154"
- },
- {
- "name": "GetTempPathW",
- "address": "0x637158"
- },
- {
- "name": "GetSystemTimes",
- "address": "0x63715c"
- },
- {
- "name": "GetStdHandle",
- "address": "0x637160"
- },
- {
- "name": "GetLongPathNameW",
- "address": "0x637164"
- },
- {
- "name": "GetProcAddress",
- "address": "0x637168"
- },
- {
- "name": "GetModuleHandleW",
- "address": "0x63716c"
- },
- {
- "name": "GetModuleFileNameW",
- "address": "0x637170"
- },
- {
- "name": "GetLogicalDrives",
- "address": "0x637174"
- },
- {
- "name": "GetLocaleInfoW",
- "address": "0x637178"
- },
- {
- "name": "GetLocalTime",
- "address": "0x63717c"
- },
- {
- "name": "GetLastError",
- "address": "0x637180"
- },
- {
- "name": "GetFullPathNameW",
- "address": "0x637184"
- },
- {
- "name": "GetFileAttributesW",
- "address": "0x637188"
- },
- {
- "name": "GetExitCodeThread",
- "address": "0x63718c"
- },
- {
- "name": "GetDriveTypeW",
- "address": "0x637190"
- },
- {
- "name": "GetDiskFreeSpaceW",
- "address": "0x637194"
- },
- {
- "name": "GetDateFormatW",
- "address": "0x637198"
- },
- {
- "name": "GetCurrentThreadId",
- "address": "0x63719c"
- },
- {
- "name": "GetCurrentThread",
- "address": "0x6371a0"
- },
- {
- "name": "GetCurrentProcessId",
- "address": "0x6371a4"
- },
- {
- "name": "GetCurrentProcess",
- "address": "0x6371a8"
- },
- {
- "name": "GetCPInfoExW",
- "address": "0x6371ac"
- },
- {
- "name": "GetCPInfo",
- "address": "0x6371b0"
- },
- {
- "name": "GetACP",
- "address": "0x6371b4"
- },
- {
- "name": "FreeResource",
- "address": "0x6371b8"
- },
- {
- "name": "InterlockedExchange",
- "address": "0x6371bc"
- },
- {
- "name": "InterlockedCompareExchange",
- "address": "0x6371c0"
- },
- {
- "name": "FreeLibrary",
- "address": "0x6371c4"
- },
- {
- "name": "FormatMessageW",
- "address": "0x6371c8"
- },
- {
- "name": "FindResourceW",
- "address": "0x6371cc"
- },
- {
- "name": "FindNextFileW",
- "address": "0x6371d0"
- },
- {
- "name": "FindFirstFileW",
- "address": "0x6371d4"
- },
- {
- "name": "FindClose",
- "address": "0x6371d8"
- },
- {
- "name": "FileTimeToLocalFileTime",
- "address": "0x6371dc"
- },
- {
- "name": "FileTimeToDosDateTime",
- "address": "0x6371e0"
- },
- {
- "name": "EnumSystemLocalesW",
- "address": "0x6371e4"
- },
- {
- "name": "EnumResourceNamesW",
- "address": "0x6371e8"
- },
- {
- "name": "EnumCalendarInfoW",
- "address": "0x6371ec"
- },
- {
- "name": "EnterCriticalSection",
- "address": "0x6371f0"
- },
- {
- "name": "DeleteFileW",
- "address": "0x6371f4"
- },
- {
- "name": "DeleteCriticalSection",
- "address": "0x6371f8"
- },
- {
- "name": "CreateThread",
- "address": "0x6371fc"
- },
- {
- "name": "CreateProcessW",
- "address": "0x637200"
- },
- {
- "name": "CreateFileW",
- "address": "0x637204"
- },
- {
- "name": "CreateEventW",
- "address": "0x637208"
- },
- {
- "name": "CreateDirectoryW",
- "address": "0x63720c"
- },
- {
- "name": "CopyFileW",
- "address": "0x637210"
- },
- {
- "name": "CompareStringW",
- "address": "0x637214"
- },
- {
- "name": "CloseHandle",
- "address": "0x637218"
- }
- ],
- "dll": "kernel32.dll"
- },
- {
- "imports": [
- {
- "name": "RegUnLoadKeyW",
- "address": "0x637220"
- },
- {
- "name": "RegSetValueExW",
- "address": "0x637224"
- },
- {
- "name": "RegSaveKeyW",
- "address": "0x637228"
- },
- {
- "name": "RegRestoreKeyW",
- "address": "0x63722c"
- },
- {
- "name": "RegReplaceKeyW",
- "address": "0x637230"
- },
- {
- "name": "RegQueryValueExW",
- "address": "0x637234"
- },
- {
- "name": "RegQueryInfoKeyW",
- "address": "0x637238"
- },
- {
- "name": "RegOpenKeyExW",
- "address": "0x63723c"
- },
- {
- "name": "RegLoadKeyW",
- "address": "0x637240"
- },
- {
- "name": "RegFlushKey",
- "address": "0x637244"
- },
- {
- "name": "RegEnumValueW",
- "address": "0x637248"
- },
- {
- "name": "RegEnumKeyExW",
- "address": "0x63724c"
- },
- {
- "name": "RegDeleteValueW",
- "address": "0x637250"
- },
- {
- "name": "RegDeleteKeyW",
- "address": "0x637254"
- },
- {
- "name": "RegCreateKeyExW",
- "address": "0x637258"
- },
- {
- "name": "RegConnectRegistryW",
- "address": "0x63725c"
- },
- {
- "name": "RegCloseKey",
- "address": "0x637260"
- }
- ],
- "dll": "advapi32.dll"
- },
- {
- "imports": [
- {
- "name": "Sleep",
- "address": "0x637268"
- }
- ],
- "dll": "kernel32.dll"
- },
- {
- "imports": [
- {
- "name": "SafeArrayPtrOfIndex",
- "address": "0x637270"
- },
- {
- "name": "SafeArrayGetUBound",
- "address": "0x637274"
- },
- {
- "name": "SafeArrayGetLBound",
- "address": "0x637278"
- },
- {
- "name": "SafeArrayCreate",
- "address": "0x63727c"
- },
- {
- "name": "VariantChangeType",
- "address": "0x637280"
- },
- {
- "name": "VariantCopy",
- "address": "0x637284"
- },
- {
- "name": "VariantClear",
- "address": "0x637288"
- },
- {
- "name": "VariantInit",
- "address": "0x63728c"
- }
- ],
- "dll": "oleaut32.dll"
- },
- {
- "imports": [
- {
- "name": "GetErrorInfo",
- "address": "0x637294"
- },
- {
- "name": "SysFreeString",
- "address": "0x637298"
- }
- ],
- "dll": "oleaut32.dll"
- },
- {
- "imports": [
- {
- "name": "OleUninitialize",
- "address": "0x6372a0"
- },
- {
- "name": "OleInitialize",
- "address": "0x6372a4"
- },
- {
- "name": "CoTaskMemFree",
- "address": "0x6372a8"
- },
- {
- "name": "CoTaskMemAlloc",
- "address": "0x6372ac"
- },
- {
- "name": "CoCreateInstance",
- "address": "0x6372b0"
- },
- {
- "name": "CoUninitialize",
- "address": "0x6372b4"
- },
- {
- "name": "CoInitialize",
- "address": "0x6372b8"
- },
- {
- "name": "IsEqualGUID",
- "address": "0x6372bc"
- }
- ],
- "dll": "ole32.dll"
- },
- {
- "imports": [
- {
- "name": "InitializeFlatSB",
- "address": "0x6372c4"
- },
- {
- "name": "FlatSB_SetScrollProp",
- "address": "0x6372c8"
- },
- {
- "name": "FlatSB_SetScrollPos",
- "address": "0x6372cc"
- },
- {
- "name": "FlatSB_SetScrollInfo",
- "address": "0x6372d0"
- },
- {
- "name": "FlatSB_GetScrollPos",
- "address": "0x6372d4"
- },
- {
- "name": "FlatSB_GetScrollInfo",
- "address": "0x6372d8"
- },
- {
- "name": "_TrackMouseEvent",
- "address": "0x6372dc"
- },
- {
- "name": "ImageList_GetImageInfo",
- "address": "0x6372e0"
- },
- {
- "name": "ImageList_SetIconSize",
- "address": "0x6372e4"
- },
- {
- "name": "ImageList_GetIconSize",
- "address": "0x6372e8"
- },
- {
- "name": "ImageList_Write",
- "address": "0x6372ec"
- },
- {
- "name": "ImageList_Read",
- "address": "0x6372f0"
- },
- {
- "name": "ImageList_GetDragImage",
- "address": "0x6372f4"
- },
- {
- "name": "ImageList_DragShowNolock",
- "address": "0x6372f8"
- },
- {
- "name": "ImageList_DragMove",
- "address": "0x6372fc"
- },
- {
- "name": "ImageList_DragLeave",
- "address": "0x637300"
- },
- {
- "name": "ImageList_DragEnter",
- "address": "0x637304"
- },
- {
- "name": "ImageList_EndDrag",
- "address": "0x637308"
- },
- {
- "name": "ImageList_BeginDrag",
- "address": "0x63730c"
- },
- {
- "name": "ImageList_Copy",
- "address": "0x637310"
- },
- {
- "name": "ImageList_LoadImageW",
- "address": "0x637314"
- },
- {
- "name": "ImageList_GetIcon",
- "address": "0x637318"
- },
- {
- "name": "ImageList_Remove",
- "address": "0x63731c"
- },
- {
- "name": "ImageList_DrawEx",
- "address": "0x637320"
- },
- {
- "name": "ImageList_Replace",
- "address": "0x637324"
- },
- {
- "name": "ImageList_Draw",
- "address": "0x637328"
- },
- {
- "name": "ImageList_SetOverlayImage",
- "address": "0x63732c"
- },
- {
- "name": "ImageList_GetBkColor",
- "address": "0x637330"
- },
- {
- "name": "ImageList_SetBkColor",
- "address": "0x637334"
- },
- {
- "name": "ImageList_ReplaceIcon",
- "address": "0x637338"
- },
- {
- "name": "ImageList_Add",
- "address": "0x63733c"
- },
- {
- "name": "ImageList_SetImageCount",
- "address": "0x637340"
- },
- {
- "name": "ImageList_GetImageCount",
- "address": "0x637344"
- },
- {
- "name": "ImageList_Destroy",
- "address": "0x637348"
- },
- {
- "name": "ImageList_Create",
- "address": "0x63734c"
- }
- ],
- "dll": "comctl32.dll"
- },
- {
- "imports": [
- {
- "name": "EnumDisplayMonitors",
- "address": "0x637354"
- },
- {
- "name": "GetMonitorInfoW",
- "address": "0x637358"
- },
- {
- "name": "MonitorFromPoint",
- "address": "0x63735c"
- },
- {
- "name": "MonitorFromRect",
- "address": "0x637360"
- },
- {
- "name": "MonitorFromWindow",
- "address": "0x637364"
- }
- ],
- "dll": "user32.dll"
- },
- {
- "imports": [
- {
- "name": "memset",
- "address": "0x63736c"
- },
- {
- "name": "memcpy",
- "address": "0x637370"
- }
- ],
- "dll": "msvcrt.dll"
- },
- {
- "imports": [
- {
- "name": "SHFileOperationW",
- "address": "0x637378"
- },
- {
- "name": "ShellExecuteW",
- "address": "0x63737c"
- },
- {
- "name": "Shell_NotifyIconW",
- "address": "0x637380"
- }
- ],
- "dll": "shell32.dll"
- },
- {
- "imports": [
- {
- "name": "SHGetFolderPathW",
- "address": "0x637388"
- },
- {
- "name": "ILFree",
- "address": "0x63738c"
- },
- {
- "name": "ILCreateFromPathW",
- "address": "0x637390"
- },
- {
- "name": "SHGetPathFromIDListW",
- "address": "0x637394"
- },
- {
- "name": "SHGetMalloc",
- "address": "0x637398"
- },
- {
- "name": "SHGetDesktopFolder",
- "address": "0x63739c"
- },
- {
- "name": "SHBrowseForFolderW",
- "address": "0x6373a0"
- }
- ],
- "dll": "shell32.dll"
- },
- {
- "imports": [
- {
- "name": "GetSaveFileNameW",
- "address": "0x6373a8"
- },
- {
- "name": "GetOpenFileNameW",
- "address": "0x6373ac"
- }
- ],
- "dll": "comdlg32.dll"
- },
- {
- "imports": [
- {
- "name": "OpenPrinterW",
- "address": "0x6373b4"
- },
- {
- "name": "EnumPrintersW",
- "address": "0x6373b8"
- },
- {
- "name": "DocumentPropertiesW",
- "address": "0x6373bc"
- },
- {
- "name": "ClosePrinter",
- "address": "0x6373c0"
- }
- ],
- "dll": "winspool.drv"
- },
- {
- "imports": [
- {
- "name": "GetDefaultPrinterW",
- "address": "0x6373c8"
- }
- ],
- "dll": "winspool.drv"
- }
- ],
- "digital_signers": null,
- "exported_dll_name": "Uninstaller.exe",
- "actual_checksum": "0x002965d4",
- "overlay": null,
- "imagebase": "0x00400000",
- "reported_checksum": "0x00000000",
- "icon_hash": null,
- "entrypoint": "0x0062657c",
- "timestamp": "2017-03-15 16:46:09",
- "osversion": "5.0",
- "sections": [
- {
- "name": ".text",
- "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x00001000",
- "size_of_data": "0x00223e00",
- "entropy": "6.49",
- "raw_address": "0x00000400",
- "virtual_size": "0x00223ca0",
- "characteristics_raw": "0x60000020"
- },
- {
- "name": ".itext",
- "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x00225000",
- "size_of_data": "0x00001600",
- "entropy": "6.30",
- "raw_address": "0x00224200",
- "virtual_size": "0x000015fc",
- "characteristics_raw": "0x60000020"
- },
- {
- "name": ".data",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
- "virtual_address": "0x00227000",
- "size_of_data": "0x00008e00",
- "entropy": "6.16",
- "raw_address": "0x00225800",
- "virtual_size": "0x00008d7c",
- "characteristics_raw": "0xc0000040"
- },
- {
- "name": ".bss",
- "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
- "virtual_address": "0x00230000",
- "size_of_data": "0x00000000",
- "entropy": "0.00",
- "raw_address": "0x00000000",
- "virtual_size": "0x00005bbc",
- "characteristics_raw": "0xc0000000"
- },
- {
- "name": ".idata",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
- "virtual_address": "0x00236000",
- "size_of_data": "0x00003c00",
- "entropy": "5.12",
- "raw_address": "0x0022e600",
- "virtual_size": "0x00003a56",
- "characteristics_raw": "0xc0000040"
- },
- {
- "name": ".didata",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
- "virtual_address": "0x0023a000",
- "size_of_data": "0x00000a00",
- "entropy": "4.24",
- "raw_address": "0x00232200",
- "virtual_size": "0x000009d4",
- "characteristics_raw": "0xc0000040"
- },
- {
- "name": ".edata",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x0023b000",
- "size_of_data": "0x00000200",
- "entropy": "1.14",
- "raw_address": "0x00232c00",
- "virtual_size": "0x00000061",
- "characteristics_raw": "0x40000040"
- },
- {
- "name": ".tls",
- "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
- "virtual_address": "0x0023c000",
- "size_of_data": "0x00000000",
- "entropy": "0.00",
- "raw_address": "0x00000000",
- "virtual_size": "0x00000040",
- "characteristics_raw": "0xc0000000"
- },
- {
- "name": ".rdata",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x0023d000",
- "size_of_data": "0x00000200",
- "entropy": "1.36",
- "raw_address": "0x00232e00",
- "virtual_size": "0x0000005d",
- "characteristics_raw": "0x40000040"
- },
- {
- "name": ".reloc",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x0023e000",
- "size_of_data": "0x00030400",
- "entropy": "6.72",
- "raw_address": "0x00233000",
- "virtual_size": "0x00030234",
- "characteristics_raw": "0x42000040"
- },
- {
- "name": ".rsrc",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x0026f000",
- "size_of_data": "0x00026200",
- "entropy": "5.92",
- "raw_address": "0x00263400",
- "virtual_size": "0x00026200",
- "characteristics_raw": "0x40000040"
- }
- ],
- "resources": [],
- "dirents": [
- {
- "virtual_address": "0x0023b000",
- "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
- "size": "0x00000061"
- },
- {
- "virtual_address": "0x00236000",
- "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
- "size": "0x00003a56"
- },
- {
- "virtual_address": "0x0026f000",
- "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
- "size": "0x00026200"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x0023e000",
- "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
- "size": "0x00030234"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x0023d000",
- "name": "IMAGE_DIRECTORY_ENTRY_TLS",
- "size": "0x00000018"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00236ad8",
- "name": "IMAGE_DIRECTORY_ENTRY_IAT",
- "size": "0x000008f8"
- },
- {
- "virtual_address": "0x0023a000",
- "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
- "size": "0x000009d4"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
- "size": "0x00000000"
- }
- ],
- "exports": [
- {
- "ordinal": 1,
- "name": "TMethodImplementationIntercept",
- "address": "0x45f014"
- }
- ],
- "guest_signers": {},
- "imphash": "f55fe685a87b3eece2fa9b537b6be838",
- "icon_fuzzy": null,
- "icon": null,
- "pdbpath": null,
- "imported_dll_count": 23,
- "versioninfo": []
- }
- }
- [*] Resolved APIs: [
- "kernel32.dll.GetThreadPreferredUILanguages",
- "kernel32.dll.SetThreadPreferredUILanguages",
- "kernel32.dll.GetThreadUILanguage",
- "kernel32.dll.GetNativeSystemInfo",
- "kernel32.dll.GetDiskFreeSpaceExW",
- "kernel32.dll.GetLogicalProcessorInformation",
- "oleaut32.dll.VariantChangeTypeEx",
- "oleaut32.dll.VarNeg",
- "oleaut32.dll.VarNot",
- "oleaut32.dll.VarAdd",
- "oleaut32.dll.VarSub",
- "oleaut32.dll.VarMul",
- "oleaut32.dll.VarDiv",
- "oleaut32.dll.VarIdiv",
- "oleaut32.dll.VarMod",
- "oleaut32.dll.VarAnd",
- "oleaut32.dll.VarOr",
- "oleaut32.dll.VarXor",
- "oleaut32.dll.VarCmp",
- "oleaut32.dll.VarI4FromStr",
- "oleaut32.dll.VarR4FromStr",
- "oleaut32.dll.VarR8FromStr",
- "oleaut32.dll.VarDateFromStr",
- "oleaut32.dll.VarCyFromStr",
- "oleaut32.dll.VarBoolFromStr",
- "oleaut32.dll.VarBstrFromCy",
- "oleaut32.dll.VarBstrFromDate",
- "oleaut32.dll.VarBstrFromBool",
- "kernel32.dll.InitializeConditionVariable",
- "kernel32.dll.WakeConditionVariable",
- "kernel32.dll.WakeAllConditionVariable",
- "kernel32.dll.SleepConditionVariableCS",
- "ole32.dll.CoCreateInstanceEx",
- "ole32.dll.CoInitializeEx",
- "ole32.dll.CoAddRefServerProcess",
- "ole32.dll.CoReleaseServerProcess",
- "ole32.dll.CoResumeClassObjects",
- "ole32.dll.CoSuspendClassObjects",
- "cryptbase.dll.SystemFunction036",
- "dwmapi.dll.DwmIsCompositionEnabled",
- "wtsapi32.dll.WTSRegisterSessionNotification",
- "user32.dll.IsWindow",
- "user32.dll.GetWindowThreadProcessId",
- "winsta.dll.WinStationRegisterConsoleNotification",
- "advapi32.dll.LookupAccountSidW",
- "sechost.dll.LookupAccountSidLocalW",
- "advapi32.dll.CreateWellKnownSid",
- "rpcrt4.dll.RpcStringBindingComposeW",
- "rpcrt4.dll.RpcBindingFromStringBindingW",
- "rpcrt4.dll.RpcStringFreeW",
- "rpcrt4.dll.RpcBindingSetAuthInfoExW",
- "sechost.dll.LookupAccountNameLocalW",
- "rpcrt4.dll.RpcAsyncInitializeHandle",
- "rpcrt4.dll.NdrClientCall2",
- "rpcrt4.dll.NdrAsyncClientCall",
- "uxtheme.dll.BufferedPaintInit",
- "gdi32.dll.GetLayout",
- "gdi32.dll.GdiRealizationInfo",
- "gdi32.dll.FontIsLinked",
- "advapi32.dll.RegOpenKeyExW",
- "advapi32.dll.RegQueryInfoKeyW",
- "gdi32.dll.GetTextFaceAliasW",
- "advapi32.dll.RegEnumValueW",
- "advapi32.dll.RegCloseKey",
- "advapi32.dll.RegQueryValueExW",
- "gdi32.dll.GetFontAssocStatus",
- "advapi32.dll.RegQueryValueExA",
- "advapi32.dll.RegEnumKeyExW",
- "gdi32.dll.GdiIsMetaPrintDC",
- "imm32.dll.ImmIsIME",
- "user32.dll.AnimateWindow",
- "comctl32.dll.InitializeFlatSB",
- "comctl32.dll.UninitializeFlatSB",
- "comctl32.dll.FlatSB_GetScrollProp",
- "comctl32.dll.FlatSB_SetScrollProp",
- "comctl32.dll.FlatSB_EnableScrollBar",
- "comctl32.dll.FlatSB_ShowScrollBar",
- "comctl32.dll.FlatSB_GetScrollRange",
- "comctl32.dll.FlatSB_GetScrollInfo",
- "comctl32.dll.FlatSB_GetScrollPos",
- "comctl32.dll.FlatSB_SetScrollPos",
- "comctl32.dll.FlatSB_SetScrollInfo",
- "comctl32.dll.FlatSB_SetScrollRange",
- "user32.dll.SetLayeredWindowAttributes",
- "kernel32.dll.SortGetHandle",
- "kernel32.dll.SortCloseHandle",
- "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
- "setupapi.dll.CM_Get_Device_Interface_List_ExW",
- "comctl32.dll.#386",
- "uxtheme.dll.OpenThemeData",
- "uxtheme.dll.CloseThemeData",
- "uxtheme.dll.DrawThemeBackground",
- "uxtheme.dll.DrawThemeText",
- "uxtheme.dll.GetThemeBackgroundContentRect",
- "uxtheme.dll.GetThemeBackgroundExtent",
- "uxtheme.dll.GetThemePartSize",
- "uxtheme.dll.GetThemeTextExtent",
- "uxtheme.dll.GetThemeTextMetrics",
- "uxtheme.dll.GetThemeBackgroundRegion",
- "uxtheme.dll.HitTestThemeBackground",
- "uxtheme.dll.DrawThemeEdge",
- "uxtheme.dll.DrawThemeIcon",
- "uxtheme.dll.IsThemePartDefined",
- "uxtheme.dll.IsThemeBackgroundPartiallyTransparent",
- "uxtheme.dll.GetThemeColor",
- "uxtheme.dll.GetThemeMetric",
- "uxtheme.dll.GetThemeString",
- "uxtheme.dll.GetThemeBool",
- "uxtheme.dll.GetThemeInt",
- "uxtheme.dll.GetThemeEnumValue",
- "uxtheme.dll.GetThemePosition",
- "uxtheme.dll.GetThemeFont",
- "uxtheme.dll.GetThemeRect",
- "uxtheme.dll.GetThemeMargins",
- "uxtheme.dll.GetThemeIntList",
- "uxtheme.dll.GetThemePropertyOrigin",
- "uxtheme.dll.SetWindowTheme",
- "uxtheme.dll.GetThemeFilename",
- "uxtheme.dll.GetThemeSysColor",
- "uxtheme.dll.GetThemeSysColorBrush",
- "uxtheme.dll.GetThemeSysBool",
- "uxtheme.dll.GetThemeSysSize",
- "uxtheme.dll.GetThemeSysFont",
- "uxtheme.dll.GetThemeSysString",
- "uxtheme.dll.GetThemeSysInt",
- "uxtheme.dll.IsThemeActive",
- "uxtheme.dll.IsAppThemed",
- "uxtheme.dll.GetWindowTheme",
- "uxtheme.dll.EnableThemeDialogTexture",
- "uxtheme.dll.IsThemeDialogTextureEnabled",
- "uxtheme.dll.GetThemeAppProperties",
- "uxtheme.dll.SetThemeAppProperties",
- "uxtheme.dll.GetCurrentThemeName",
- "uxtheme.dll.GetThemeDocumentationProperty",
- "uxtheme.dll.DrawThemeParentBackground",
- "uxtheme.dll.EnableTheming",
- "uxtheme.dll.DrawThemeTextEx",
- "gdi32.dll.GetTextExtentExPointWPri",
- "comctl32.dll.HIMAGELIST_QueryInterface",
- "comctl32.dll.DrawShadowText",
- "comctl32.dll.DrawSizeBox",
- "comctl32.dll.DrawScrollBar",
- "comctl32.dll.SizeBoxHwnd",
- "comctl32.dll.ScrollBar_MouseMove",
- "comctl32.dll.ScrollBar_Menu",
- "comctl32.dll.HandleScrollCmd",
- "comctl32.dll.DetachScrollBars",
- "comctl32.dll.AttachScrollBars",
- "comctl32.dll.CCSetScrollInfo",
- "comctl32.dll.CCGetScrollInfo",
- "comctl32.dll.CCEnableScrollBar",
- "comctl32.dll.QuerySystemGestureStatus",
- "uxtheme.dll.#49",
- "comctl32.dll.RegisterClassNameW",
- "ole32.dll.OleInitialize",
- "ole32.dll.OleUninitialize",
- "ole32.dll.RegisterDragDrop",
- "ole32.dll.RevokeDragDrop",
- "ole32.dll.CoUninitialize",
- "ole32.dll.CoRegisterInitializeSpy",
- "ole32.dll.CoRevokeInitializeSpy",
- "imm32.dll.ImmAssociateContext",
- "uxtheme.dll.BufferedPaintRenderAnimation",
- "uxtheme.dll.GetThemeTransitionDuration",
- "uxtheme.dll.BeginBufferedAnimation",
- "uxtheme.dll.DrawThemeParentBackgroundEx",
- "uxtheme.dll.EndBufferedAnimation",
- "user32.dll.WINNLSEnableIME",
- "uxtheme.dll.BufferedPaintStopAllAnimations",
- "uxtheme.dll.BufferedPaintUnInit",
- "wtsapi32.dll.WTSUnRegisterSessionNotification",
- "winsta.dll.WinStationUnRegisterConsoleNotification",
- "rpcrt4.dll.RpcAsyncGetCallStatus",
- "rpcrt4.dll.RpcAsyncCancelCall",
- "rpcrt4.dll.RpcAsyncCompleteCall",
- "rpcrt4.dll.RpcBindingFree",
- "comctl32.dll.#388",
- "oleaut32.dll.#500",
- "advapi32.dll.UnregisterTraceGuids",
- "comctl32.dll.#321",
- "uxtheme.dll.BeginBufferedPaint",
- "uxtheme.dll.EndBufferedPaint",
- "imm32.dll.ImmGetContext",
- "imm32.dll.ImmLockIMC",
- "imm32.dll.ImmUnlockIMC",
- "imm32.dll.ImmReleaseContext",
- "imm32.dll.ImmSetCompositionFontW",
- "imm32.dll.ImmGetCompositionWindow",
- "imm32.dll.ImmSetCompositionWindow"
- ]
- [*] Static Analysis: {
- "pe": {
- "peid_signatures": null,
- "imports": [
- {
- "imports": [
- {
- "name": "SysFreeString",
- "address": "0x636ad8"
- },
- {
- "name": "SysReAllocStringLen",
- "address": "0x636adc"
- },
- {
- "name": "SysAllocStringLen",
- "address": "0x636ae0"
- }
- ],
- "dll": "oleaut32.dll"
- },
- {
- "imports": [
- {
- "name": "RegQueryValueExW",
- "address": "0x636ae8"
- },
- {
- "name": "RegOpenKeyExW",
- "address": "0x636aec"
- },
- {
- "name": "RegCloseKey",
- "address": "0x636af0"
- }
- ],
- "dll": "advapi32.dll"
- },
- {
- "imports": [
- {
- "name": "MessageBoxA",
- "address": "0x636af8"
- },
- {
- "name": "CharNextW",
- "address": "0x636afc"
- },
- {
- "name": "LoadStringW",
- "address": "0x636b00"
- }
- ],
- "dll": "user32.dll"
- },
- {
- "imports": [
- {
- "name": "Sleep",
- "address": "0x636b08"
- },
- {
- "name": "VirtualFree",
- "address": "0x636b0c"
- },
- {
- "name": "VirtualAlloc",
- "address": "0x636b10"
- },
- {
- "name": "lstrlenW",
- "address": "0x636b14"
- },
- {
- "name": "VirtualQuery",
- "address": "0x636b18"
- },
- {
- "name": "QueryPerformanceCounter",
- "address": "0x636b1c"
- },
- {
- "name": "GetTickCount",
- "address": "0x636b20"
- },
- {
- "name": "GetSystemInfo",
- "address": "0x636b24"
- },
- {
- "name": "GetVersion",
- "address": "0x636b28"
- },
- {
- "name": "CompareStringW",
- "address": "0x636b2c"
- },
- {
- "name": "IsValidLocale",
- "address": "0x636b30"
- },
- {
- "name": "SetThreadLocale",
- "address": "0x636b34"
- },
- {
- "name": "GetSystemDefaultUILanguage",
- "address": "0x636b38"
- },
- {
- "name": "GetUserDefaultUILanguage",
- "address": "0x636b3c"
- },
- {
- "name": "GetLocaleInfoW",
- "address": "0x636b40"
- },
- {
- "name": "WideCharToMultiByte",
- "address": "0x636b44"
- },
- {
- "name": "MultiByteToWideChar",
- "address": "0x636b48"
- },
- {
- "name": "GetACP",
- "address": "0x636b4c"
- },
- {
- "name": "LoadLibraryExW",
- "address": "0x636b50"
- },
- {
- "name": "GetStartupInfoW",
- "address": "0x636b54"
- },
- {
- "name": "GetProcAddress",
- "address": "0x636b58"
- },
- {
- "name": "GetModuleHandleW",
- "address": "0x636b5c"
- },
- {
- "name": "GetModuleFileNameW",
- "address": "0x636b60"
- },
- {
- "name": "GetCommandLineW",
- "address": "0x636b64"
- },
- {
- "name": "FreeLibrary",
- "address": "0x636b68"
- },
- {
- "name": "GetLastError",
- "address": "0x636b6c"
- },
- {
- "name": "UnhandledExceptionFilter",
- "address": "0x636b70"
- },
- {
- "name": "RtlUnwind",
- "address": "0x636b74"
- },
- {
- "name": "RaiseException",
- "address": "0x636b78"
- },
- {
- "name": "ExitProcess",
- "address": "0x636b7c"
- },
- {
- "name": "ExitThread",
- "address": "0x636b80"
- },
- {
- "name": "SwitchToThread",
- "address": "0x636b84"
- },
- {
- "name": "GetCurrentThreadId",
- "address": "0x636b88"
- },
- {
- "name": "CreateThread",
- "address": "0x636b8c"
- },
- {
- "name": "DeleteCriticalSection",
- "address": "0x636b90"
- },
- {
- "name": "LeaveCriticalSection",
- "address": "0x636b94"
- },
- {
- "name": "EnterCriticalSection",
- "address": "0x636b98"
- },
- {
- "name": "InitializeCriticalSection",
- "address": "0x636b9c"
- },
- {
- "name": "FindFirstFileW",
- "address": "0x636ba0"
- },
- {
- "name": "FindClose",
- "address": "0x636ba4"
- },
- {
- "name": "SetCurrentDirectoryW",
- "address": "0x636ba8"
- },
- {
- "name": "GetCurrentDirectoryW",
- "address": "0x636bac"
- },
- {
- "name": "WriteFile",
- "address": "0x636bb0"
- },
- {
- "name": "GetStdHandle",
- "address": "0x636bb4"
- },
- {
- "name": "CloseHandle",
- "address": "0x636bb8"
- }
- ],
- "dll": "kernel32.dll"
- },
- {
- "imports": [
- {
- "name": "GetProcAddress",
- "address": "0x636bc0"
- },
- {
- "name": "RaiseException",
- "address": "0x636bc4"
- },
- {
- "name": "LoadLibraryA",
- "address": "0x636bc8"
- },
- {
- "name": "GetLastError",
- "address": "0x636bcc"
- },
- {
- "name": "TlsSetValue",
- "address": "0x636bd0"
- },
- {
- "name": "TlsGetValue",
- "address": "0x636bd4"
- },
- {
- "name": "LocalFree",
- "address": "0x636bd8"
- },
- {
- "name": "LocalAlloc",
- "address": "0x636bdc"
- },
- {
- "name": "GetModuleHandleW",
- "address": "0x636be0"
- },
- {
- "name": "FreeLibrary",
- "address": "0x636be4"
- }
- ],
- "dll": "kernel32.dll"
- },
- {
- "imports": [
- {
- "name": "SetClassLongW",
- "address": "0x636bec"
- },
- {
- "name": "GetClassLongW",
- "address": "0x636bf0"
- },
- {
- "name": "SetWindowLongW",
- "address": "0x636bf4"
- },
- {
- "name": "GetWindowLongW",
- "address": "0x636bf8"
- },
- {
- "name": "CreateWindowExW",
- "address": "0x636bfc"
- },
- {
- "name": "WindowFromPoint",
- "address": "0x636c00"
- },
- {
- "name": "WaitMessage",
- "address": "0x636c04"
- },
- {
- "name": "UpdateWindow",
- "address": "0x636c08"
- },
- {
- "name": "UnregisterClassW",
- "address": "0x636c0c"
- },
- {
- "name": "UnhookWindowsHookEx",
- "address": "0x636c10"
- },
- {
- "name": "TranslateMessage",
- "address": "0x636c14"
- },
- {
- "name": "TranslateMDISysAccel",
- "address": "0x636c18"
- },
- {
- "name": "TrackPopupMenu",
- "address": "0x636c1c"
- },
- {
- "name": "SystemParametersInfoW",
- "address": "0x636c20"
- },
- {
- "name": "ShowWindow",
- "address": "0x636c24"
- },
- {
- "name": "ShowScrollBar",
- "address": "0x636c28"
- },
- {
- "name": "ShowOwnedPopups",
- "address": "0x636c2c"
- },
- {
- "name": "ShowCaret",
- "address": "0x636c30"
- },
- {
- "name": "SetWindowRgn",
- "address": "0x636c34"
- },
- {
- "name": "SetWindowsHookExW",
- "address": "0x636c38"
- },
- {
- "name": "SetWindowTextW",
- "address": "0x636c3c"
- },
- {
- "name": "SetWindowPos",
- "address": "0x636c40"
- },
- {
- "name": "SetWindowPlacement",
- "address": "0x636c44"
- },
- {
- "name": "SetTimer",
- "address": "0x636c48"
- },
- {
- "name": "SetScrollRange",
- "address": "0x636c4c"
- },
- {
- "name": "SetScrollPos",
- "address": "0x636c50"
- },
- {
- "name": "SetScrollInfo",
- "address": "0x636c54"
- },
- {
- "name": "SetRect",
- "address": "0x636c58"
- },
- {
- "name": "SetPropW",
- "address": "0x636c5c"
- },
- {
- "name": "SetParent",
- "address": "0x636c60"
- },
- {
- "name": "SetMenuItemInfoW",
- "address": "0x636c64"
- },
- {
- "name": "SetMenu",
- "address": "0x636c68"
- },
- {
- "name": "SetForegroundWindow",
- "address": "0x636c6c"
- },
- {
- "name": "SetFocus",
- "address": "0x636c70"
- },
- {
- "name": "SetCursorPos",
- "address": "0x636c74"
- },
- {
- "name": "SetCursor",
- "address": "0x636c78"
- },
- {
- "name": "SetClipboardData",
- "address": "0x636c7c"
- },
- {
- "name": "SetCapture",
- "address": "0x636c80"
- },
- {
- "name": "SetActiveWindow",
- "address": "0x636c84"
- },
- {
- "name": "SendMessageA",
- "address": "0x636c88"
- },
- {
- "name": "SendMessageW",
- "address": "0x636c8c"
- },
- {
- "name": "ScrollWindow",
- "address": "0x636c90"
- },
- {
- "name": "ScreenToClient",
- "address": "0x636c94"
- },
- {
- "name": "RemovePropW",
- "address": "0x636c98"
- },
- {
- "name": "RemoveMenu",
- "address": "0x636c9c"
- },
- {
- "name": "ReleaseDC",
- "address": "0x636ca0"
- },
- {
- "name": "ReleaseCapture",
- "address": "0x636ca4"
- },
- {
- "name": "RegisterWindowMessageW",
- "address": "0x636ca8"
- },
- {
- "name": "RegisterClipboardFormatW",
- "address": "0x636cac"
- },
- {
- "name": "RegisterClassW",
- "address": "0x636cb0"
- },
- {
- "name": "RedrawWindow",
- "address": "0x636cb4"
- },
- {
- "name": "PostQuitMessage",
- "address": "0x636cb8"
- },
- {
- "name": "PostMessageW",
- "address": "0x636cbc"
- },
- {
- "name": "PeekMessageA",
- "address": "0x636cc0"
- },
- {
- "name": "PeekMessageW",
- "address": "0x636cc4"
- },
- {
- "name": "OpenClipboard",
- "address": "0x636cc8"
- },
- {
- "name": "MsgWaitForMultipleObjectsEx",
- "address": "0x636ccc"
- },
- {
- "name": "MsgWaitForMultipleObjects",
- "address": "0x636cd0"
- },
- {
- "name": "MessageBoxW",
- "address": "0x636cd4"
- },
- {
- "name": "MessageBeep",
- "address": "0x636cd8"
- },
- {
- "name": "MapWindowPoints",
- "address": "0x636cdc"
- },
- {
- "name": "MapVirtualKeyW",
- "address": "0x636ce0"
- },
- {
- "name": "LoadStringW",
- "address": "0x636ce4"
- },
- {
- "name": "LoadKeyboardLayoutW",
- "address": "0x636ce8"
- },
- {
- "name": "LoadIconW",
- "address": "0x636cec"
- },
- {
- "name": "LoadCursorW",
- "address": "0x636cf0"
- },
- {
- "name": "LoadBitmapW",
- "address": "0x636cf4"
- },
- {
- "name": "KillTimer",
- "address": "0x636cf8"
- },
- {
- "name": "IsZoomed",
- "address": "0x636cfc"
- },
- {
- "name": "IsWindowVisible",
- "address": "0x636d00"
- },
- {
- "name": "IsWindowUnicode",
- "address": "0x636d04"
- },
- {
- "name": "IsWindowEnabled",
- "address": "0x636d08"
- },
- {
- "name": "IsWindow",
- "address": "0x636d0c"
- },
- {
- "name": "IsIconic",
- "address": "0x636d10"
- },
- {
- "name": "IsDialogMessageA",
- "address": "0x636d14"
- },
- {
- "name": "IsDialogMessageW",
- "address": "0x636d18"
- },
- {
- "name": "IsChild",
- "address": "0x636d1c"
- },
- {
- "name": "InvalidateRect",
- "address": "0x636d20"
- },
- {
- "name": "InsertMenuItemW",
- "address": "0x636d24"
- },
- {
- "name": "InsertMenuW",
- "address": "0x636d28"
- },
- {
- "name": "HideCaret",
- "address": "0x636d2c"
- },
- {
- "name": "GetWindowThreadProcessId",
- "address": "0x636d30"
- },
- {
- "name": "GetWindowTextW",
- "address": "0x636d34"
- },
- {
- "name": "GetWindowRect",
- "address": "0x636d38"
- },
- {
- "name": "GetWindowPlacement",
- "address": "0x636d3c"
- },
- {
- "name": "GetWindowDC",
- "address": "0x636d40"
- },
- {
- "name": "GetUpdateRect",
- "address": "0x636d44"
- },
- {
- "name": "GetTopWindow",
- "address": "0x636d48"
- },
- {
- "name": "GetSystemMetrics",
- "address": "0x636d4c"
- },
- {
- "name": "GetSystemMenu",
- "address": "0x636d50"
- },
- {
- "name": "GetSysColorBrush",
- "address": "0x636d54"
- },
- {
- "name": "GetSysColor",
- "address": "0x636d58"
- },
- {
- "name": "GetSubMenu",
- "address": "0x636d5c"
- },
- {
- "name": "GetScrollRange",
- "address": "0x636d60"
- },
- {
- "name": "GetScrollPos",
- "address": "0x636d64"
- },
- {
- "name": "GetScrollInfo",
- "address": "0x636d68"
- },
- {
- "name": "GetScrollBarInfo",
- "address": "0x636d6c"
- },
- {
- "name": "GetPropW",
- "address": "0x636d70"
- },
- {
- "name": "GetParent",
- "address": "0x636d74"
- },
- {
- "name": "GetWindow",
- "address": "0x636d78"
- },
- {
- "name": "GetMessagePos",
- "address": "0x636d7c"
- },
- {
- "name": "GetMessageExtraInfo",
- "address": "0x636d80"
- },
- {
- "name": "GetMenuStringW",
- "address": "0x636d84"
- },
- {
- "name": "GetMenuState",
- "address": "0x636d88"
- },
- {
- "name": "GetMenuItemInfoW",
- "address": "0x636d8c"
- },
- {
- "name": "GetMenuItemID",
- "address": "0x636d90"
- },
- {
- "name": "GetMenuItemCount",
- "address": "0x636d94"
- },
- {
- "name": "GetMenu",
- "address": "0x636d98"
- },
- {
- "name": "GetLastActivePopup",
- "address": "0x636d9c"
- },
- {
- "name": "GetKeyboardState",
- "address": "0x636da0"
- },
- {
- "name": "GetKeyboardLayoutNameW",
- "address": "0x636da4"
- },
- {
- "name": "GetKeyboardLayoutList",
- "address": "0x636da8"
- },
- {
- "name": "GetKeyboardLayout",
- "address": "0x636dac"
- },
- {
- "name": "GetKeyState",
- "address": "0x636db0"
- },
- {
- "name": "GetKeyNameTextW",
- "address": "0x636db4"
- },
- {
- "name": "GetIconInfo",
- "address": "0x636db8"
- },
- {
- "name": "GetForegroundWindow",
- "address": "0x636dbc"
- },
- {
- "name": "GetFocus",
- "address": "0x636dc0"
- },
- {
- "name": "GetDlgItem",
- "address": "0x636dc4"
- },
- {
- "name": "GetDlgCtrlID",
- "address": "0x636dc8"
- },
- {
- "name": "GetDesktopWindow",
- "address": "0x636dcc"
- },
- {
- "name": "GetDCEx",
- "address": "0x636dd0"
- },
- {
- "name": "GetDC",
- "address": "0x636dd4"
- },
- {
- "name": "GetCursorPos",
- "address": "0x636dd8"
- },
- {
- "name": "GetCursor",
- "address": "0x636ddc"
- },
- {
- "name": "GetClipboardData",
- "address": "0x636de0"
- },
- {
- "name": "GetClientRect",
- "address": "0x636de4"
- },
- {
- "name": "GetClassNameW",
- "address": "0x636de8"
- },
- {
- "name": "GetClassInfoExW",
- "address": "0x636dec"
- },
- {
- "name": "GetClassInfoW",
- "address": "0x636df0"
- },
- {
- "name": "GetCapture",
- "address": "0x636df4"
- },
- {
- "name": "GetActiveWindow",
- "address": "0x636df8"
- },
- {
- "name": "FrameRect",
- "address": "0x636dfc"
- },
- {
- "name": "FindWindowExW",
- "address": "0x636e00"
- },
- {
- "name": "FindWindowW",
- "address": "0x636e04"
- },
- {
- "name": "FillRect",
- "address": "0x636e08"
- },
- {
- "name": "EnumWindows",
- "address": "0x636e0c"
- },
- {
- "name": "EnumThreadWindows",
- "address": "0x636e10"
- },
- {
- "name": "EnumChildWindows",
- "address": "0x636e14"
- },
- {
- "name": "EndPaint",
- "address": "0x636e18"
- },
- {
- "name": "EndMenu",
- "address": "0x636e1c"
- },
- {
- "name": "EnableWindow",
- "address": "0x636e20"
- },
- {
- "name": "EnableScrollBar",
- "address": "0x636e24"
- },
- {
- "name": "EnableMenuItem",
- "address": "0x636e28"
- },
- {
- "name": "EmptyClipboard",
- "address": "0x636e2c"
- },
- {
- "name": "DrawTextExW",
- "address": "0x636e30"
- },
- {
- "name": "DrawTextW",
- "address": "0x636e34"
- },
- {
- "name": "DrawMenuBar",
- "address": "0x636e38"
- },
- {
- "name": "DrawIconEx",
- "address": "0x636e3c"
- },
- {
- "name": "DrawIcon",
- "address": "0x636e40"
- },
- {
- "name": "DrawFrameControl",
- "address": "0x636e44"
- },
- {
- "name": "DrawFocusRect",
- "address": "0x636e48"
- },
- {
- "name": "DrawEdge",
- "address": "0x636e4c"
- },
- {
- "name": "DispatchMessageA",
- "address": "0x636e50"
- },
- {
- "name": "DispatchMessageW",
- "address": "0x636e54"
- },
- {
- "name": "DestroyWindow",
- "address": "0x636e58"
- },
- {
- "name": "DestroyMenu",
- "address": "0x636e5c"
- },
- {
- "name": "DestroyIcon",
- "address": "0x636e60"
- },
- {
- "name": "DestroyCursor",
- "address": "0x636e64"
- },
- {
- "name": "DeleteMenu",
- "address": "0x636e68"
- },
- {
- "name": "DefWindowProcW",
- "address": "0x636e6c"
- },
- {
- "name": "DefMDIChildProcW",
- "address": "0x636e70"
- },
- {
- "name": "DefFrameProcW",
- "address": "0x636e74"
- },
- {
- "name": "CreatePopupMenu",
- "address": "0x636e78"
- },
- {
- "name": "CreateMenu",
- "address": "0x636e7c"
- },
- {
- "name": "CreateIcon",
- "address": "0x636e80"
- },
- {
- "name": "CreateAcceleratorTableW",
- "address": "0x636e84"
- },
- {
- "name": "CopyImage",
- "address": "0x636e88"
- },
- {
- "name": "CopyIcon",
- "address": "0x636e8c"
- },
- {
- "name": "CloseClipboard",
- "address": "0x636e90"
- },
- {
- "name": "ClientToScreen",
- "address": "0x636e94"
- },
- {
- "name": "CheckMenuItem",
- "address": "0x636e98"
- },
- {
- "name": "CharUpperBuffW",
- "address": "0x636e9c"
- },
- {
- "name": "CharUpperW",
- "address": "0x636ea0"
- },
- {
- "name": "CharNextW",
- "address": "0x636ea4"
- },
- {
- "name": "CharLowerBuffW",
- "address": "0x636ea8"
- },
- {
- "name": "CharLowerW",
- "address": "0x636eac"
- },
- {
- "name": "CallWindowProcW",
- "address": "0x636eb0"
- },
- {
- "name": "CallNextHookEx",
- "address": "0x636eb4"
- },
- {
- "name": "BeginPaint",
- "address": "0x636eb8"
- },
- {
- "name": "AttachThreadInput",
- "address": "0x636ebc"
- },
- {
- "name": "AdjustWindowRectEx",
- "address": "0x636ec0"
- },
- {
- "name": "ActivateKeyboardLayout",
- "address": "0x636ec4"
- }
- ],
- "dll": "user32.dll"
- },
- {
- "imports": [
- {
- "name": "UnrealizeObject",
- "address": "0x636ecc"
- },
- {
- "name": "StretchDIBits",
- "address": "0x636ed0"
- },
- {
- "name": "StretchBlt",
- "address": "0x636ed4"
- },
- {
- "name": "StartPage",
- "address": "0x636ed8"
- },
- {
- "name": "StartDocW",
- "address": "0x636edc"
- },
- {
- "name": "SetWindowOrgEx",
- "address": "0x636ee0"
- },
- {
- "name": "SetWinMetaFileBits",
- "address": "0x636ee4"
- },
- {
- "name": "SetViewportOrgEx",
- "address": "0x636ee8"
- },
- {
- "name": "SetTextColor",
- "address": "0x636eec"
- },
- {
- "name": "SetStretchBltMode",
- "address": "0x636ef0"
- },
- {
- "name": "SetROP2",
- "address": "0x636ef4"
- },
- {
- "name": "SetPixel",
- "address": "0x636ef8"
- },
- {
- "name": "SetMapMode",
- "address": "0x636efc"
- },
- {
- "name": "SetEnhMetaFileBits",
- "address": "0x636f00"
- },
- {
- "name": "SetDIBits",
- "address": "0x636f04"
- },
- {
- "name": "SetDIBColorTable",
- "address": "0x636f08"
- },
- {
- "name": "SetBrushOrgEx",
- "address": "0x636f0c"
- },
- {
- "name": "SetBkMode",
- "address": "0x636f10"
- },
- {
- "name": "SetBkColor",
- "address": "0x636f14"
- },
- {
- "name": "SetAbortProc",
- "address": "0x636f18"
- },
- {
- "name": "SelectPalette",
- "address": "0x636f1c"
- },
- {
- "name": "SelectObject",
- "address": "0x636f20"
- },
- {
- "name": "SelectClipRgn",
- "address": "0x636f24"
- },
- {
- "name": "SaveDC",
- "address": "0x636f28"
- },
- {
- "name": "RoundRect",
- "address": "0x636f2c"
- },
- {
- "name": "RestoreDC",
- "address": "0x636f30"
- },
- {
- "name": "ResizePalette",
- "address": "0x636f34"
- },
- {
- "name": "Rectangle",
- "address": "0x636f38"
- },
- {
- "name": "RectVisible",
- "address": "0x636f3c"
- },
- {
- "name": "RealizePalette",
- "address": "0x636f40"
- },
- {
- "name": "Polyline",
- "address": "0x636f44"
- },
- {
- "name": "Polygon",
- "address": "0x636f48"
- },
- {
- "name": "PolyBezierTo",
- "address": "0x636f4c"
- },
- {
- "name": "PolyBezier",
- "address": "0x636f50"
- },
- {
- "name": "PlayEnhMetaFile",
- "address": "0x636f54"
- },
- {
- "name": "Pie",
- "address": "0x636f58"
- },
- {
- "name": "PatBlt",
- "address": "0x636f5c"
- },
- {
- "name": "OffsetRgn",
- "address": "0x636f60"
- },
- {
- "name": "MoveToEx",
- "address": "0x636f64"
- },
- {
- "name": "MaskBlt",
- "address": "0x636f68"
- },
- {
- "name": "LineTo",
- "address": "0x636f6c"
- },
- {
- "name": "IntersectClipRect",
- "address": "0x636f70"
- },
- {
- "name": "GetWindowOrgEx",
- "address": "0x636f74"
- },
- {
- "name": "GetWinMetaFileBits",
- "address": "0x636f78"
- },
- {
- "name": "GetTextMetricsW",
- "address": "0x636f7c"
- },
- {
- "name": "GetTextExtentPointW",
- "address": "0x636f80"
- },
- {
- "name": "GetTextExtentPoint32W",
- "address": "0x636f84"
- },
- {
- "name": "GetSystemPaletteEntries",
- "address": "0x636f88"
- },
- {
- "name": "GetStockObject",
- "address": "0x636f8c"
- },
- {
- "name": "GetRgnBox",
- "address": "0x636f90"
- },
- {
- "name": "GetPixel",
- "address": "0x636f94"
- },
- {
- "name": "GetPaletteEntries",
- "address": "0x636f98"
- },
- {
- "name": "GetObjectW",
- "address": "0x636f9c"
- },
- {
- "name": "GetNearestPaletteIndex",
- "address": "0x636fa0"
- },
- {
- "name": "GetEnhMetaFilePaletteEntries",
- "address": "0x636fa4"
- },
- {
- "name": "GetEnhMetaFileHeader",
- "address": "0x636fa8"
- },
- {
- "name": "GetEnhMetaFileDescriptionW",
- "address": "0x636fac"
- },
- {
- "name": "GetEnhMetaFileBits",
- "address": "0x636fb0"
- },
- {
- "name": "GetDeviceCaps",
- "address": "0x636fb4"
- },
- {
- "name": "GetDIBits",
- "address": "0x636fb8"
- },
- {
- "name": "GetDIBColorTable",
- "address": "0x636fbc"
- },
- {
- "name": "GetCurrentPositionEx",
- "address": "0x636fc0"
- },
- {
- "name": "GetClipBox",
- "address": "0x636fc4"
- },
- {
- "name": "GetBrushOrgEx",
- "address": "0x636fc8"
- },
- {
- "name": "GetBitmapBits",
- "address": "0x636fcc"
- },
- {
- "name": "GdiFlush",
- "address": "0x636fd0"
- },
- {
- "name": "FrameRgn",
- "address": "0x636fd4"
- },
- {
- "name": "ExtTextOutW",
- "address": "0x636fd8"
- },
- {
- "name": "ExtFloodFill",
- "address": "0x636fdc"
- },
- {
- "name": "ExcludeClipRect",
- "address": "0x636fe0"
- },
- {
- "name": "EnumFontsW",
- "address": "0x636fe4"
- },
- {
- "name": "EnumFontFamiliesExW",
- "address": "0x636fe8"
- },
- {
- "name": "EndPage",
- "address": "0x636fec"
- },
- {
- "name": "EndDoc",
- "address": "0x636ff0"
- },
- {
- "name": "Ellipse",
- "address": "0x636ff4"
- },
- {
- "name": "DeleteObject",
- "address": "0x636ff8"
- },
- {
- "name": "DeleteEnhMetaFile",
- "address": "0x636ffc"
- },
- {
- "name": "DeleteDC",
- "address": "0x637000"
- },
- {
- "name": "CreateSolidBrush",
- "address": "0x637004"
- },
- {
- "name": "CreateRoundRectRgn",
- "address": "0x637008"
- },
- {
- "name": "CreateRectRgn",
- "address": "0x63700c"
- },
- {
- "name": "CreatePenIndirect",
- "address": "0x637010"
- },
- {
- "name": "CreatePalette",
- "address": "0x637014"
- },
- {
- "name": "CreateICW",
- "address": "0x637018"
- },
- {
- "name": "CreateHalftonePalette",
- "address": "0x63701c"
- },
- {
- "name": "CreateFontIndirectW",
- "address": "0x637020"
- },
- {
- "name": "CreateEllipticRgn",
- "address": "0x637024"
- },
- {
- "name": "CreateDIBitmap",
- "address": "0x637028"
- },
- {
- "name": "CreateDIBSection",
- "address": "0x63702c"
- },
- {
- "name": "CreateDCW",
- "address": "0x637030"
- },
- {
- "name": "CreateCompatibleDC",
- "address": "0x637034"
- },
- {
- "name": "CreateCompatibleBitmap",
- "address": "0x637038"
- },
- {
- "name": "CreateBrushIndirect",
- "address": "0x63703c"
- },
- {
- "name": "CreateBitmap",
- "address": "0x637040"
- },
- {
- "name": "CopyEnhMetaFileW",
- "address": "0x637044"
- },
- {
- "name": "Chord",
- "address": "0x637048"
- },
- {
- "name": "BitBlt",
- "address": "0x63704c"
- },
- {
- "name": "ArcTo",
- "address": "0x637050"
- },
- {
- "name": "Arc",
- "address": "0x637054"
- },
- {
- "name": "AngleArc",
- "address": "0x637058"
- },
- {
- "name": "AbortDoc",
- "address": "0x63705c"
- }
- ],
- "dll": "gdi32.dll"
- },
- {
- "imports": [
- {
- "name": "VerQueryValueW",
- "address": "0x637064"
- },
- {
- "name": "GetFileVersionInfoSizeW",
- "address": "0x637068"
- },
- {
- "name": "GetFileVersionInfoW",
- "address": "0x63706c"
- }
- ],
- "dll": "version.dll"
- },
- {
- "imports": [
- {
- "name": "WNetGetConnectionW",
- "address": "0x637074"
- }
- ],
- "dll": "mpr.dll"
- },
- {
- "imports": [
- {
- "name": "WriteFile",
- "address": "0x63707c"
- },
- {
- "name": "WideCharToMultiByte",
- "address": "0x637080"
- },
- {
- "name": "WaitForSingleObject",
- "address": "0x637084"
- },
- {
- "name": "WaitForMultipleObjectsEx",
- "address": "0x637088"
- },
- {
- "name": "VirtualQueryEx",
- "address": "0x63708c"
- },
- {
- "name": "VirtualQuery",
- "address": "0x637090"
- },
- {
- "name": "VirtualProtect",
- "address": "0x637094"
- },
- {
- "name": "VirtualFree",
- "address": "0x637098"
- },
- {
- "name": "VirtualAlloc",
- "address": "0x63709c"
- },
- {
- "name": "VerSetConditionMask",
- "address": "0x6370a0"
- },
- {
- "name": "VerifyVersionInfoW",
- "address": "0x6370a4"
- },
- {
- "name": "TryEnterCriticalSection",
- "address": "0x6370a8"
- },
- {
- "name": "SwitchToThread",
- "address": "0x6370ac"
- },
- {
- "name": "SuspendThread",
- "address": "0x6370b0"
- },
- {
- "name": "Sleep",
- "address": "0x6370b4"
- },
- {
- "name": "SizeofResource",
- "address": "0x6370b8"
- },
- {
- "name": "SetThreadPriority",
- "address": "0x6370bc"
- },
- {
- "name": "SetThreadLocale",
- "address": "0x6370c0"
- },
- {
- "name": "SetLastError",
- "address": "0x6370c4"
- },
- {
- "name": "SetFilePointer",
- "address": "0x6370c8"
- },
- {
- "name": "SetEvent",
- "address": "0x6370cc"
- },
- {
- "name": "SetErrorMode",
- "address": "0x6370d0"
- },
- {
- "name": "SetEndOfFile",
- "address": "0x6370d4"
- },
- {
- "name": "ResumeThread",
- "address": "0x6370d8"
- },
- {
- "name": "ResetEvent",
- "address": "0x6370dc"
- },
- {
- "name": "RemoveDirectoryW",
- "address": "0x6370e0"
- },
- {
- "name": "ReadFile",
- "address": "0x6370e4"
- },
- {
- "name": "RaiseException",
- "address": "0x6370e8"
- },
- {
- "name": "IsDebuggerPresent",
- "address": "0x6370ec"
- },
- {
- "name": "MulDiv",
- "address": "0x6370f0"
- },
- {
- "name": "LockResource",
- "address": "0x6370f4"
- },
- {
- "name": "LocalFree",
- "address": "0x6370f8"
- },
- {
- "name": "LoadResource",
- "address": "0x6370fc"
- },
- {
- "name": "LoadLibraryW",
- "address": "0x637100"
- },
- {
- "name": "LeaveCriticalSection",
- "address": "0x637104"
- },
- {
- "name": "IsValidLocale",
- "address": "0x637108"
- },
- {
- "name": "InitializeCriticalSection",
- "address": "0x63710c"
- },
- {
- "name": "HeapSize",
- "address": "0x637110"
- },
- {
- "name": "HeapFree",
- "address": "0x637114"
- },
- {
- "name": "HeapDestroy",
- "address": "0x637118"
- },
- {
- "name": "HeapCreate",
- "address": "0x63711c"
- },
- {
- "name": "HeapAlloc",
- "address": "0x637120"
- },
- {
- "name": "GlobalUnlock",
- "address": "0x637124"
- },
- {
- "name": "GlobalLock",
- "address": "0x637128"
- },
- {
- "name": "GlobalFree",
- "address": "0x63712c"
- },
- {
- "name": "GlobalFindAtomW",
- "address": "0x637130"
- },
- {
- "name": "GlobalDeleteAtom",
- "address": "0x637134"
- },
- {
- "name": "GlobalAlloc",
- "address": "0x637138"
- },
- {
- "name": "GlobalAddAtomW",
- "address": "0x63713c"
- },
- {
- "name": "GetVolumeInformationW",
- "address": "0x637140"
- },
- {
- "name": "GetVersionExW",
- "address": "0x637144"
- },
- {
- "name": "GetVersion",
- "address": "0x637148"
- },
- {
- "name": "GetTickCount",
- "address": "0x63714c"
- },
- {
- "name": "GetThreadPriority",
- "address": "0x637150"
- },
- {
- "name": "GetThreadLocale",
- "address": "0x637154"
- },
- {
- "name": "GetTempPathW",
- "address": "0x637158"
- },
- {
- "name": "GetSystemTimes",
- "address": "0x63715c"
- },
- {
- "name": "GetStdHandle",
- "address": "0x637160"
- },
- {
- "name": "GetLongPathNameW",
- "address": "0x637164"
- },
- {
- "name": "GetProcAddress",
- "address": "0x637168"
- },
- {
- "name": "GetModuleHandleW",
- "address": "0x63716c"
- },
- {
- "name": "GetModuleFileNameW",
- "address": "0x637170"
- },
- {
- "name": "GetLogicalDrives",
- "address": "0x637174"
- },
- {
- "name": "GetLocaleInfoW",
- "address": "0x637178"
- },
- {
- "name": "GetLocalTime",
- "address": "0x63717c"
- },
- {
- "name": "GetLastError",
- "address": "0x637180"
- },
- {
- "name": "GetFullPathNameW",
- "address": "0x637184"
- },
- {
- "name": "GetFileAttributesW",
- "address": "0x637188"
- },
- {
- "name": "GetExitCodeThread",
- "address": "0x63718c"
- },
- {
- "name": "GetDriveTypeW",
- "address": "0x637190"
- },
- {
- "name": "GetDiskFreeSpaceW",
- "address": "0x637194"
- },
- {
- "name": "GetDateFormatW",
- "address": "0x637198"
- },
- {
- "name": "GetCurrentThreadId",
- "address": "0x63719c"
- },
- {
- "name": "GetCurrentThread",
- "address": "0x6371a0"
- },
- {
- "name": "GetCurrentProcessId",
- "address": "0x6371a4"
- },
- {
- "name": "GetCurrentProcess",
- "address": "0x6371a8"
- },
- {
- "name": "GetCPInfoExW",
- "address": "0x6371ac"
- },
- {
- "name": "GetCPInfo",
- "address": "0x6371b0"
- },
- {
- "name": "GetACP",
- "address": "0x6371b4"
- },
- {
- "name": "FreeResource",
- "address": "0x6371b8"
- },
- {
- "name": "InterlockedExchange",
- "address": "0x6371bc"
- },
- {
- "name": "InterlockedCompareExchange",
- "address": "0x6371c0"
- },
- {
- "name": "FreeLibrary",
- "address": "0x6371c4"
- },
- {
- "name": "FormatMessageW",
- "address": "0x6371c8"
- },
- {
- "name": "FindResourceW",
- "address": "0x6371cc"
- },
- {
- "name": "FindNextFileW",
- "address": "0x6371d0"
- },
- {
- "name": "FindFirstFileW",
- "address": "0x6371d4"
- },
- {
- "name": "FindClose",
- "address": "0x6371d8"
- },
- {
- "name": "FileTimeToLocalFileTime",
- "address": "0x6371dc"
- },
- {
- "name": "FileTimeToDosDateTime",
- "address": "0x6371e0"
- },
- {
- "name": "EnumSystemLocalesW",
- "address": "0x6371e4"
- },
- {
- "name": "EnumResourceNamesW",
- "address": "0x6371e8"
- },
- {
- "name": "EnumCalendarInfoW",
- "address": "0x6371ec"
- },
- {
- "name": "EnterCriticalSection",
- "address": "0x6371f0"
- },
- {
- "name": "DeleteFileW",
- "address": "0x6371f4"
- },
- {
- "name": "DeleteCriticalSection",
- "address": "0x6371f8"
- },
- {
- "name": "CreateThread",
- "address": "0x6371fc"
- },
- {
- "name": "CreateProcessW",
- "address": "0x637200"
- },
- {
- "name": "CreateFileW",
- "address": "0x637204"
- },
- {
- "name": "CreateEventW",
- "address": "0x637208"
- },
- {
- "name": "CreateDirectoryW",
- "address": "0x63720c"
- },
- {
- "name": "CopyFileW",
- "address": "0x637210"
- },
- {
- "name": "CompareStringW",
- "address": "0x637214"
- },
- {
- "name": "CloseHandle",
- "address": "0x637218"
- }
- ],
- "dll": "kernel32.dll"
- },
- {
- "imports": [
- {
- "name": "RegUnLoadKeyW",
- "address": "0x637220"
- },
- {
- "name": "RegSetValueExW",
- "address": "0x637224"
- },
- {
- "name": "RegSaveKeyW",
- "address": "0x637228"
- },
- {
- "name": "RegRestoreKeyW",
- "address": "0x63722c"
- },
- {
- "name": "RegReplaceKeyW",
- "address": "0x637230"
- },
- {
- "name": "RegQueryValueExW",
- "address": "0x637234"
- },
- {
- "name": "RegQueryInfoKeyW",
- "address": "0x637238"
- },
- {
- "name": "RegOpenKeyExW",
- "address": "0x63723c"
- },
- {
- "name": "RegLoadKeyW",
- "address": "0x637240"
- },
- {
- "name": "RegFlushKey",
- "address": "0x637244"
- },
- {
- "name": "RegEnumValueW",
- "address": "0x637248"
- },
- {
- "name": "RegEnumKeyExW",
- "address": "0x63724c"
- },
- {
- "name": "RegDeleteValueW",
- "address": "0x637250"
- },
- {
- "name": "RegDeleteKeyW",
- "address": "0x637254"
- },
- {
- "name": "RegCreateKeyExW",
- "address": "0x637258"
- },
- {
- "name": "RegConnectRegistryW",
- "address": "0x63725c"
- },
- {
- "name": "RegCloseKey",
- "address": "0x637260"
- }
- ],
- "dll": "advapi32.dll"
- },
- {
- "imports": [
- {
- "name": "Sleep",
- "address": "0x637268"
- }
- ],
- "dll": "kernel32.dll"
- },
- {
- "imports": [
- {
- "name": "SafeArrayPtrOfIndex",
- "address": "0x637270"
- },
- {
- "name": "SafeArrayGetUBound",
- "address": "0x637274"
- },
- {
- "name": "SafeArrayGetLBound",
- "address": "0x637278"
- },
- {
- "name": "SafeArrayCreate",
- "address": "0x63727c"
- },
- {
- "name": "VariantChangeType",
- "address": "0x637280"
- },
- {
- "name": "VariantCopy",
- "address": "0x637284"
- },
- {
- "name": "VariantClear",
- "address": "0x637288"
- },
- {
- "name": "VariantInit",
- "address": "0x63728c"
- }
- ],
- "dll": "oleaut32.dll"
- },
- {
- "imports": [
- {
- "name": "GetErrorInfo",
- "address": "0x637294"
- },
- {
- "name": "SysFreeString",
- "address": "0x637298"
- }
- ],
- "dll": "oleaut32.dll"
- },
- {
- "imports": [
- {
- "name": "OleUninitialize",
- "address": "0x6372a0"
- },
- {
- "name": "OleInitialize",
- "address": "0x6372a4"
- },
- {
- "name": "CoTaskMemFree",
- "address": "0x6372a8"
- },
- {
- "name": "CoTaskMemAlloc",
- "address": "0x6372ac"
- },
- {
- "name": "CoCreateInstance",
- "address": "0x6372b0"
- },
- {
- "name": "CoUninitialize",
- "address": "0x6372b4"
- },
- {
- "name": "CoInitialize",
- "address": "0x6372b8"
- },
- {
- "name": "IsEqualGUID",
- "address": "0x6372bc"
- }
- ],
- "dll": "ole32.dll"
- },
- {
- "imports": [
- {
- "name": "InitializeFlatSB",
- "address": "0x6372c4"
- },
- {
- "name": "FlatSB_SetScrollProp",
- "address": "0x6372c8"
- },
- {
- "name": "FlatSB_SetScrollPos",
- "address": "0x6372cc"
- },
- {
- "name": "FlatSB_SetScrollInfo",
- "address": "0x6372d0"
- },
- {
- "name": "FlatSB_GetScrollPos",
- "address": "0x6372d4"
- },
- {
- "name": "FlatSB_GetScrollInfo",
- "address": "0x6372d8"
- },
- {
- "name": "_TrackMouseEvent",
- "address": "0x6372dc"
- },
- {
- "name": "ImageList_GetImageInfo",
- "address": "0x6372e0"
- },
- {
- "name": "ImageList_SetIconSize",
- "address": "0x6372e4"
- },
- {
- "name": "ImageList_GetIconSize",
- "address": "0x6372e8"
- },
- {
- "name": "ImageList_Write",
- "address": "0x6372ec"
- },
- {
- "name": "ImageList_Read",
- "address": "0x6372f0"
- },
- {
- "name": "ImageList_GetDragImage",
- "address": "0x6372f4"
- },
- {
- "name": "ImageList_DragShowNolock",
- "address": "0x6372f8"
- },
- {
- "name": "ImageList_DragMove",
- "address": "0x6372fc"
- },
- {
- "name": "ImageList_DragLeave",
- "address": "0x637300"
- },
- {
- "name": "ImageList_DragEnter",
- "address": "0x637304"
- },
- {
- "name": "ImageList_EndDrag",
- "address": "0x637308"
- },
- {
- "name": "ImageList_BeginDrag",
- "address": "0x63730c"
- },
- {
- "name": "ImageList_Copy",
- "address": "0x637310"
- },
- {
- "name": "ImageList_LoadImageW",
- "address": "0x637314"
- },
- {
- "name": "ImageList_GetIcon",
- "address": "0x637318"
- },
- {
- "name": "ImageList_Remove",
- "address": "0x63731c"
- },
- {
- "name": "ImageList_DrawEx",
- "address": "0x637320"
- },
- {
- "name": "ImageList_Replace",
- "address": "0x637324"
- },
- {
- "name": "ImageList_Draw",
- "address": "0x637328"
- },
- {
- "name": "ImageList_SetOverlayImage",
- "address": "0x63732c"
- },
- {
- "name": "ImageList_GetBkColor",
- "address": "0x637330"
- },
- {
- "name": "ImageList_SetBkColor",
- "address": "0x637334"
- },
- {
- "name": "ImageList_ReplaceIcon",
- "address": "0x637338"
- },
- {
- "name": "ImageList_Add",
- "address": "0x63733c"
- },
- {
- "name": "ImageList_SetImageCount",
- "address": "0x637340"
- },
- {
- "name": "ImageList_GetImageCount",
- "address": "0x637344"
- },
- {
- "name": "ImageList_Destroy",
- "address": "0x637348"
- },
- {
- "name": "ImageList_Create",
- "address": "0x63734c"
- }
- ],
- "dll": "comctl32.dll"
- },
- {
- "imports": [
- {
- "name": "EnumDisplayMonitors",
- "address": "0x637354"
- },
- {
- "name": "GetMonitorInfoW",
- "address": "0x637358"
- },
- {
- "name": "MonitorFromPoint",
- "address": "0x63735c"
- },
- {
- "name": "MonitorFromRect",
- "address": "0x637360"
- },
- {
- "name": "MonitorFromWindow",
- "address": "0x637364"
- }
- ],
- "dll": "user32.dll"
- },
- {
- "imports": [
- {
- "name": "memset",
- "address": "0x63736c"
- },
- {
- "name": "memcpy",
- "address": "0x637370"
- }
- ],
- "dll": "msvcrt.dll"
- },
- {
- "imports": [
- {
- "name": "SHFileOperationW",
- "address": "0x637378"
- },
- {
- "name": "ShellExecuteW",
- "address": "0x63737c"
- },
- {
- "name": "Shell_NotifyIconW",
- "address": "0x637380"
- }
- ],
- "dll": "shell32.dll"
- },
- {
- "imports": [
- {
- "name": "SHGetFolderPathW",
- "address": "0x637388"
- },
- {
- "name": "ILFree",
- "address": "0x63738c"
- },
- {
- "name": "ILCreateFromPathW",
- "address": "0x637390"
- },
- {
- "name": "SHGetPathFromIDListW",
- "address": "0x637394"
- },
- {
- "name": "SHGetMalloc",
- "address": "0x637398"
- },
- {
- "name": "SHGetDesktopFolder",
- "address": "0x63739c"
- },
- {
- "name": "SHBrowseForFolderW",
- "address": "0x6373a0"
- }
- ],
- "dll": "shell32.dll"
- },
- {
- "imports": [
- {
- "name": "GetSaveFileNameW",
- "address": "0x6373a8"
- },
- {
- "name": "GetOpenFileNameW",
- "address": "0x6373ac"
- }
- ],
- "dll": "comdlg32.dll"
- },
- {
- "imports": [
- {
- "name": "OpenPrinterW",
- "address": "0x6373b4"
- },
- {
- "name": "EnumPrintersW",
- "address": "0x6373b8"
- },
- {
- "name": "DocumentPropertiesW",
- "address": "0x6373bc"
- },
- {
- "name": "ClosePrinter",
- "address": "0x6373c0"
- }
- ],
- "dll": "winspool.drv"
- },
- {
- "imports": [
- {
- "name": "GetDefaultPrinterW",
- "address": "0x6373c8"
- }
- ],
- "dll": "winspool.drv"
- }
- ],
- "digital_signers": null,
- "exported_dll_name": "Uninstaller.exe",
- "actual_checksum": "0x002965d4",
- "overlay": null,
- "imagebase": "0x00400000",
- "reported_checksum": "0x00000000",
- "icon_hash": null,
- "entrypoint": "0x0062657c",
- "timestamp": "2017-03-15 16:46:09",
- "osversion": "5.0",
- "sections": [
- {
- "name": ".text",
- "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x00001000",
- "size_of_data": "0x00223e00",
- "entropy": "6.49",
- "raw_address": "0x00000400",
- "virtual_size": "0x00223ca0",
- "characteristics_raw": "0x60000020"
- },
- {
- "name": ".itext",
- "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x00225000",
- "size_of_data": "0x00001600",
- "entropy": "6.30",
- "raw_address": "0x00224200",
- "virtual_size": "0x000015fc",
- "characteristics_raw": "0x60000020"
- },
- {
- "name": ".data",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
- "virtual_address": "0x00227000",
- "size_of_data": "0x00008e00",
- "entropy": "6.16",
- "raw_address": "0x00225800",
- "virtual_size": "0x00008d7c",
- "characteristics_raw": "0xc0000040"
- },
- {
- "name": ".bss",
- "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
- "virtual_address": "0x00230000",
- "size_of_data": "0x00000000",
- "entropy": "0.00",
- "raw_address": "0x00000000",
- "virtual_size": "0x00005bbc",
- "characteristics_raw": "0xc0000000"
- },
- {
- "name": ".idata",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
- "virtual_address": "0x00236000",
- "size_of_data": "0x00003c00",
- "entropy": "5.12",
- "raw_address": "0x0022e600",
- "virtual_size": "0x00003a56",
- "characteristics_raw": "0xc0000040"
- },
- {
- "name": ".didata",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
- "virtual_address": "0x0023a000",
- "size_of_data": "0x00000a00",
- "entropy": "4.24",
- "raw_address": "0x00232200",
- "virtual_size": "0x000009d4",
- "characteristics_raw": "0xc0000040"
- },
- {
- "name": ".edata",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x0023b000",
- "size_of_data": "0x00000200",
- "entropy": "1.14",
- "raw_address": "0x00232c00",
- "virtual_size": "0x00000061",
- "characteristics_raw": "0x40000040"
- },
- {
- "name": ".tls",
- "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
- "virtual_address": "0x0023c000",
- "size_of_data": "0x00000000",
- "entropy": "0.00",
- "raw_address": "0x00000000",
- "virtual_size": "0x00000040",
- "characteristics_raw": "0xc0000000"
- },
- {
- "name": ".rdata",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x0023d000",
- "size_of_data": "0x00000200",
- "entropy": "1.36",
- "raw_address": "0x00232e00",
- "virtual_size": "0x0000005d",
- "characteristics_raw": "0x40000040"
- },
- {
- "name": ".reloc",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x0023e000",
- "size_of_data": "0x00030400",
- "entropy": "6.72",
- "raw_address": "0x00233000",
- "virtual_size": "0x00030234",
- "characteristics_raw": "0x42000040"
- },
- {
- "name": ".rsrc",
- "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
- "virtual_address": "0x0026f000",
- "size_of_data": "0x00026200",
- "entropy": "5.92",
- "raw_address": "0x00263400",
- "virtual_size": "0x00026200",
- "characteristics_raw": "0x40000040"
- }
- ],
- "resources": [],
- "dirents": [
- {
- "virtual_address": "0x0023b000",
- "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
- "size": "0x00000061"
- },
- {
- "virtual_address": "0x00236000",
- "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
- "size": "0x00003a56"
- },
- {
- "virtual_address": "0x0026f000",
- "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
- "size": "0x00026200"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x0023e000",
- "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
- "size": "0x00030234"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x0023d000",
- "name": "IMAGE_DIRECTORY_ENTRY_TLS",
- "size": "0x00000018"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00236ad8",
- "name": "IMAGE_DIRECTORY_ENTRY_IAT",
- "size": "0x000008f8"
- },
- {
- "virtual_address": "0x0023a000",
- "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
- "size": "0x000009d4"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
- "size": "0x00000000"
- },
- {
- "virtual_address": "0x00000000",
- "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
- "size": "0x00000000"
- }
- ],
- "exports": [
- {
- "ordinal": 1,
- "name": "TMethodImplementationIntercept",
- "address": "0x45f014"
- }
- ],
- "guest_signers": {},
- "imphash": "f55fe685a87b3eece2fa9b537b6be838",
- "icon_fuzzy": null,
- "icon": null,
- "pdbpath": null,
- "imported_dll_count": 23,
- "versioninfo": []
- }
- }
Advertisement
Add Comment
Please, Sign In to add comment