API tools faq
paste
paladin316

Loki_e27462c1f63121d12b1159950e279000_exe_2019-07-05_08_30.txt

paladin316
Jul 7th, 2019
2,075
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 83.11 KB | None | 0 0
raw download clone embed print report
  1. * MalFamily: ""
  2.  
  3. * MalScore: 10.0
  4.  
  5. * File Name: "Loki_e27462c1f63121d12b1159950e279000.exe"
  6. * File Size: 737280
  7. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  8. * SHA256: "c68a852844dfc2341879a7bc8a55f373130e61e4316ef17cbf9cd9e355f537ee"
  9. * MD5: "e27462c1f63121d12b1159950e279000"
  10. * SHA1: "af95b412feb38ac6f2a8c8c9bceadd2f48f66555"
  11. * SHA512: "c386cc79a482764d4af79271e42e167d05a7f64cc51a7e54d580cc2cd9362387ff84eb0783bb4826899a839de86b95d8f20fe58e84e883bb5f539ce2f80cf43d"
  12. * CRC32: "BFAE0736"
  13. * SSDEEP: "12288:Arvv7/pm5+g9+NqfHPfUDJA+QSCWXTr4QQNWIYFVMwOA9Fp:6vT2+w+NEHUVFTrYWIYbLp"
  14.  
  15. * Process Execution:
  16. "Loki_e27462c1f63121d12b1159950e279000.exe",
  17. "services.exe",
  18. "sc.exe",
  19. "svchost.exe"
  20.  
  21.  
  22. * Signatures Detected:
  23.  
  24. "Description": "Creates RWX memory",
  25. "Details":
  26.  
  27.  
  28. "Description": "A process attempted to delay the analysis task.",
  29. "Details":
  30.  
  31. "Process": "Loki_e27462c1f63121d12b1159950e279000.exe tried to sleep 1440 seconds, actually delayed analysis time by 0 seconds"
  32.  
  33.  
  34.  
  35.  
  36. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  37. "Details":
  38.  
  39. "post_no_referer": "HTTP traffic contains a POST request with no referer header"
  40.  
  41.  
  42. "http_version_old": "HTTP traffic uses version 1.0"
  43.  
  44.  
  45. "ip_hostname": "HTTP connection was made to an IP address rather than domain name"
  46.  
  47.  
  48. "suspicious_request": "http://54.39.161.153/wp/web/html/upload/log/test/Panel/five/fre.php"
  49.  
  50.  
  51.  
  52.  
  53. "Description": "Performs some HTTP requests",
  54. "Details":
  55.  
  56. "url": "http://54.39.161.153/wp/web/html/upload/log/test/Panel/five/fre.php"
  57.  
  58.  
  59.  
  60.  
  61. "Description": "The binary likely contains encrypted or compressed data.",
  62. "Details":
  63.  
  64. "section": "name: .rsrc, entropy: 7.32, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x00039c00, virtual_size: 0x00039b0c"
  65.  
  66.  
  67.  
  68.  
  69. "Description": "Deletes its original binary from disk",
  70. "Details":
  71.  
  72.  
  73. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  74. "Details":
  75.  
  76. "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 16342991 times"
  77.  
  78.  
  79.  
  80.  
  81. "Description": "Steals private information from local Internet browsers",
  82. "Details":
  83.  
  84. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
  85.  
  86.  
  87.  
  88.  
  89. "Description": "Spoofs its process name and/or associated pathname to appear as a legitimate process",
  90. "Details":
  91.  
  92. "modified_name": "loki_e27462c1f63121d12b1159950e279000.exe",
  93. "modified_path": "C:\\Users\\user\\AppData\\Local\\Temp\\loki_e27462c1f63121d12b1159950e279000.exe",
  94. "original_name": "Loki_e27462c1f63121d12b1159950e279000.exe",
  95. "original_path": "C:\\Users\\user\\AppData\\Local\\Temp\\Loki_e27462c1f63121d12b1159950e279000.exe"
  96.  
  97.  
  98.  
  99.  
  100. "Description": "Creates a hidden or system file",
  101. "Details":
  102.  
  103. "file": "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.exe"
  104.  
  105.  
  106. "file": "C:\\Users\\user\\AppData\\Roaming\\474604"
  107.  
  108.  
  109.  
  110.  
  111. "Description": "File has been identified by 12 Antiviruses on VirusTotal as malicious",
  112. "Details":
  113.  
  114. "FireEye": "Generic.mg.e27462c1f63121d1"
  115.  
  116.  
  117. "Invincea": "heuristic"
  118.  
  119.  
  120. "Symantec": "ML.Attribute.HighConfidence"
  121.  
  122.  
  123. "APEX": "Malicious"
  124.  
  125.  
  126. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  127.  
  128.  
  129. "Rising": "Spyware.Stealer!8.3090/N3#88% (RDM+:cmRtazq7i2HZkiq14JlvaNVJHw7r)"
  130.  
  131.  
  132. "Ikarus": "Trojan-Ransom.GandCrab"
  133.  
  134.  
  135. "Endgame": "malicious (moderate confidence)"
  136.  
  137.  
  138. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  139.  
  140.  
  141. "Cylance": "Unsafe"
  142.  
  143.  
  144. "CrowdStrike": "win/malicious_confidence_90% (D)"
  145.  
  146.  
  147. "Qihoo-360": "HEUR/QVM10.1.4FFD.Malware.Gen"
  148.  
  149.  
  150.  
  151.  
  152. "Description": "Harvests credentials from local FTP client softwares",
  153. "Details":
  154.  
  155. "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\sitemanager.xml"
  156.  
  157.  
  158. "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\recentservers.xml"
  159.  
  160.  
  161. "file": "C:\\Users\\user\\AppData\\Roaming\\Far Manager\\Profile\\PluginsData\\42E4AEB1-A230-44F4-B33C-F195BB654931.db"
  162.  
  163.  
  164. "file": "C:\\Program Files (x86)\\FTPGetter\\Profile\\servers.xml"
  165.  
  166.  
  167. "file": "C:\\Users\\user\\AppData\\Roaming\\FTPGetter\\servers.xml"
  168.  
  169.  
  170. "file": "C:\\Users\\user\\AppData\\Roaming\\Estsoft\\ALFTP\\ESTdb2.dat"
  171.  
  172.  
  173. "key": "HKEY_CURRENT_USER\\Software\\Far\\Plugins\\FTP\\Hosts"
  174.  
  175.  
  176. "key": "HKEY_CURRENT_USER\\Software\\Far2\\Plugins\\FTP\\Hosts"
  177.  
  178.  
  179. "key": "HKEY_CURRENT_USER\\Software\\Ghisler\\Total Commander"
  180.  
  181.  
  182. "key": "HKEY_CURRENT_USER\\Software\\LinasFTP\\Site Manager"
  183.  
  184.  
  185.  
  186.  
  187. "Description": "Harvests information related to installed instant messenger clients",
  188. "Details":
  189.  
  190. "file": "C:\\Users\\user\\AppData\\Roaming\\.purple\\accounts.xml"
  191.  
  192.  
  193.  
  194.  
  195. "Description": "Harvests information related to installed mail clients",
  196. "Details":
  197.  
  198. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook"
  199.  
  200.  
  201. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\0a0d020000000000c000000000000046\\Email"
  202.  
  203.  
  204. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\0a0d020000000000c000000000000046"
  205.  
  206.  
  207. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9234ed9445f8fa418a542f350f18f326"
  208.  
  209.  
  210. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8408552e6dae7d45a0ba01520b6221ff\\Email"
  211.  
  212.  
  213. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9234ed9445f8fa418a542f350f18f326\\Email"
  214.  
  215.  
  216. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
  217.  
  218.  
  219. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
  220.  
  221.  
  222. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\Email"
  223.  
  224.  
  225. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\c02ebc5353d9cd11975200aa004ae40e\\Email"
  226.  
  227.  
  228. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8f92b60606058348930a96946cf329e1\\Email"
  229.  
  230.  
  231. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8408552e6dae7d45a0ba01520b6221ff"
  232.  
  233.  
  234. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2"
  235.  
  236.  
  237. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\240a97d961ed46428e29a3f1f1c23670"
  238.  
  239.  
  240. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\b22783abb139fe46b0aad551d64b60e7\\Email"
  241.  
  242.  
  243. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\c02ebc5353d9cd11975200aa004ae40e"
  244.  
  245.  
  246. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2\\Email"
  247.  
  248.  
  249. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\Email"
  250.  
  251.  
  252. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a\\Email"
  253.  
  254.  
  255. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001\\Email"
  256.  
  257.  
  258. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  259.  
  260.  
  261. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\cb23f8734d88734ca66c47c4527fd259"
  262.  
  263.  
  264. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001"
  265.  
  266.  
  267. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook"
  268.  
  269.  
  270. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\cb23f8734d88734ca66c47c4527fd259\\Email"
  271.  
  272.  
  273. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook"
  274.  
  275.  
  276. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\b22783abb139fe46b0aad551d64b60e7"
  277.  
  278.  
  279. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\240a97d961ed46428e29a3f1f1c23670\\Email"
  280.  
  281.  
  282. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604\\Email"
  283.  
  284.  
  285. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\Email"
  286.  
  287.  
  288. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a"
  289.  
  290.  
  291. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8503020000000000c000000000000046"
  292.  
  293.  
  294. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604"
  295.  
  296.  
  297. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8f92b60606058348930a96946cf329e1"
  298.  
  299.  
  300. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8503020000000000c000000000000046\\Email"
  301.  
  302.  
  303.  
  304.  
  305. "Description": "Collects information to fingerprint the system",
  306. "Details":
  307.  
  308.  
  309.  
  310. * Started Service:
  311. "VaultSvc",
  312. "W32Time"
  313.  
  314.  
  315. * Executed Commands:
  316. "C:\\Windows\\system32\\lsass.exe",
  317. "C:\\Windows\\system32\\sc.exe start w32time task_started",
  318. "C:\\Windows\\system32\\svchost.exe -k LocalService"
  319.  
  320.  
  321. * Mutexes:
  322. "6EFA73A4746045B65DEE781E"
  323.  
  324.  
  325. * Modified Files:
  326. "C:\\Users\\user\\AppData\\Local\\Temp\\tmp61B9.tmp",
  327. "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.lck",
  328. "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.exe",
  329. "C:\\Windows\\sysnative\\LogFiles\\Scm\\7bbc503c-5977-4798-a4ae-61483a7e030d",
  330. "C:\\Windows\\sysnative\\LogFiles\\Scm\\afa4ac94-b8b7-4216-a9d0-97ae4def7b11",
  331. "\\??\\PIPE\\lsarpc"
  332.  
  333.  
  334. * Deleted Files:
  335. "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.lck",
  336. "C:\\Users\\user\\AppData\\Local\\Temp\\loki_e27462c1f63121d12b1159950e279000.exe"
  337.  
  338.  
  339. * Modified Registry Keys:
  340. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\Type",
  341. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\TimeProviders\\NtpClient\\SpecialPollTimeRemaining"
  342.  
  343.  
  344. * Deleted Registry Keys:
  345.  
  346. * DNS Communications:
  347.  
  348. * Domains:
  349.  
  350. * Network Communication - ICMP:
  351.  
  352. * Network Communication - HTTP:
  353.  
  354. "count": 2,
  355. "body": "",
  356. "uri": "http://54.39.161.153/wp/web/html/upload/log/test/Panel/five/fre.php",
  357. "user-agent": "Mozilla/4.08 (Charon; Inferno)",
  358. "method": "POST",
  359. "host": "54.39.161.153",
  360. "version": "1.0",
  361. "path": "/wp/web/html/upload/log/test/Panel/five/fre.php",
  362. "data": "POST /wp/web/html/upload/log/test/Panel/five/fre.php HTTP/1.0\r\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\r\nHost: 54.39.161.153\r\nAccept: */*\r\nContent-Type: application/octet-stream\r\nContent-Encoding: binary\r\nContent-Key: B74F6EC6\r\nContent-Length: 176\r\nConnection: close\r\n\r\n",
  363. "port": 80
  364.  
  365.  
  366. "count": 24,
  367. "body": "",
  368. "uri": "http://54.39.161.153/wp/web/html/upload/log/test/Panel/five/fre.php",
  369. "user-agent": "Mozilla/4.08 (Charon; Inferno)",
  370. "method": "POST",
  371. "host": "54.39.161.153",
  372. "version": "1.0",
  373. "path": "/wp/web/html/upload/log/test/Panel/five/fre.php",
  374. "data": "POST /wp/web/html/upload/log/test/Panel/five/fre.php HTTP/1.0\r\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\r\nHost: 54.39.161.153\r\nAccept: */*\r\nContent-Type: application/octet-stream\r\nContent-Encoding: binary\r\nContent-Key: B74F6EC6\r\nContent-Length: 149\r\nConnection: close\r\n\r\n",
  375. "port": 80
  376.  
  377.  
  378.  
  379. * Network Communication - SMTP:
  380.  
  381. * Network Communication - Hosts:
  382.  
  383. * Network Communication - IRC:
  384.  
  385. * Static Analysis:
  386. "pe":
  387. "peid_signatures": null,
  388. "imports":
  389.  
  390. "imports":
  391.  
  392. "name": "LCMapStringW",
  393. "address": "0x4490b0"
  394.  
  395.  
  396. "name": "CompareStringW",
  397. "address": "0x4490b4"
  398.  
  399.  
  400. "name": "FreeEnvironmentStringsW",
  401. "address": "0x4490b8"
  402.  
  403.  
  404. "name": "GetEnvironmentStringsW",
  405. "address": "0x4490bc"
  406.  
  407.  
  408. "name": "GetSystemTimeAsFileTime",
  409. "address": "0x4490c0"
  410.  
  411.  
  412. "name": "GetCurrentProcessId",
  413. "address": "0x4490c4"
  414.  
  415.  
  416. "name": "QueryPerformanceCounter",
  417. "address": "0x4490c8"
  418.  
  419.  
  420. "name": "GetModuleFileNameA",
  421. "address": "0x4490cc"
  422.  
  423.  
  424. "name": "GetProcessHeap",
  425. "address": "0x4490d0"
  426.  
  427.  
  428. "name": "LoadLibraryW",
  429. "address": "0x4490d4"
  430.  
  431.  
  432. "name": "OutputDebugStringW",
  433. "address": "0x4490d8"
  434.  
  435.  
  436. "name": "GetCurrentThreadId",
  437. "address": "0x4490dc"
  438.  
  439.  
  440. "name": "GetCPInfo",
  441. "address": "0x4490e0"
  442.  
  443.  
  444. "name": "GetOEMCP",
  445. "address": "0x4490e4"
  446.  
  447.  
  448. "name": "GetACP",
  449. "address": "0x4490e8"
  450.  
  451.  
  452. "name": "IsValidCodePage",
  453. "address": "0x4490ec"
  454.  
  455.  
  456. "name": "LoadLibraryExW",
  457. "address": "0x4490f0"
  458.  
  459.  
  460. "name": "GetModuleHandleW",
  461. "address": "0x4490f4"
  462.  
  463.  
  464. "name": "GetStartupInfoW",
  465. "address": "0x4490f8"
  466.  
  467.  
  468. "name": "TlsFree",
  469. "address": "0x4490fc"
  470.  
  471.  
  472. "name": "TlsSetValue",
  473. "address": "0x449100"
  474.  
  475.  
  476. "name": "TlsGetValue",
  477. "address": "0x449104"
  478.  
  479.  
  480. "name": "TlsAlloc",
  481. "address": "0x449108"
  482.  
  483.  
  484. "name": "SetStdHandle",
  485. "address": "0x44910c"
  486.  
  487.  
  488. "name": "FlushFileBuffers",
  489. "address": "0x449110"
  490.  
  491.  
  492. "name": "SetFilePointerEx",
  493. "address": "0x449114"
  494.  
  495.  
  496. "name": "HeapReAlloc",
  497. "address": "0x449118"
  498.  
  499.  
  500. "name": "GetStringTypeW",
  501. "address": "0x44911c"
  502.  
  503.  
  504. "name": "CreateFileW",
  505. "address": "0x449120"
  506.  
  507.  
  508. "name": "SetEndOfFile",
  509. "address": "0x449124"
  510.  
  511.  
  512. "name": "ReadConsoleW",
  513. "address": "0x449128"
  514.  
  515.  
  516. "name": "GlobalSize",
  517. "address": "0x44912c"
  518.  
  519.  
  520. "name": "CreateFileA",
  521. "address": "0x449130"
  522.  
  523.  
  524. "name": "CloseHandle",
  525. "address": "0x449134"
  526.  
  527.  
  528. "name": "ReadFile",
  529. "address": "0x449138"
  530.  
  531.  
  532. "name": "GetFileSize",
  533. "address": "0x44913c"
  534.  
  535.  
  536. "name": "GlobalFree",
  537. "address": "0x449140"
  538.  
  539.  
  540. "name": "GlobalUnlock",
  541. "address": "0x449144"
  542.  
  543.  
  544. "name": "GlobalLock",
  545. "address": "0x449148"
  546.  
  547.  
  548. "name": "GlobalAlloc",
  549. "address": "0x44914c"
  550.  
  551.  
  552. "name": "GetModuleHandleA",
  553. "address": "0x449150"
  554.  
  555.  
  556. "name": "CreateToolhelp32Snapshot",
  557. "address": "0x449154"
  558.  
  559.  
  560. "name": "GetConsoleWindow",
  561. "address": "0x449158"
  562.  
  563.  
  564. "name": "UpdateResourceA",
  565. "address": "0x44915c"
  566.  
  567.  
  568. "name": "GetTempPathA",
  569. "address": "0x449160"
  570.  
  571.  
  572. "name": "EnumResourceTypesA",
  573. "address": "0x449164"
  574.  
  575.  
  576. "name": "FindResourceExA",
  577. "address": "0x449168"
  578.  
  579.  
  580. "name": "CreateEventA",
  581. "address": "0x44916c"
  582.  
  583.  
  584. "name": "MulDiv",
  585. "address": "0x449170"
  586.  
  587.  
  588. "name": "SizeofResource",
  589. "address": "0x449174"
  590.  
  591.  
  592. "name": "TerminateProcess",
  593. "address": "0x449178"
  594.  
  595.  
  596. "name": "GetCurrentProcess",
  597. "address": "0x44917c"
  598.  
  599.  
  600. "name": "SetUnhandledExceptionFilter",
  601. "address": "0x449180"
  602.  
  603.  
  604. "name": "UnhandledExceptionFilter",
  605. "address": "0x449184"
  606.  
  607.  
  608. "name": "DeleteCriticalSection",
  609. "address": "0x449188"
  610.  
  611.  
  612. "name": "Sleep",
  613. "address": "0x44918c"
  614.  
  615.  
  616. "name": "LoadResource",
  617. "address": "0x449190"
  618.  
  619.  
  620. "name": "WaitForSingleObject",
  621. "address": "0x449194"
  622.  
  623.  
  624. "name": "SetLastError",
  625. "address": "0x449198"
  626.  
  627.  
  628. "name": "GetLastError",
  629. "address": "0x44919c"
  630.  
  631.  
  632. "name": "VirtualAlloc",
  633. "address": "0x4491a0"
  634.  
  635.  
  636. "name": "LockResource",
  637. "address": "0x4491a4"
  638.  
  639.  
  640. "name": "FreeResource",
  641. "address": "0x4491a8"
  642.  
  643.  
  644. "name": "GetTempFileNameA",
  645. "address": "0x4491ac"
  646.  
  647.  
  648. "name": "InterlockedIncrement",
  649. "address": "0x4491b0"
  650.  
  651.  
  652. "name": "EncodePointer",
  653. "address": "0x4491b4"
  654.  
  655.  
  656. "name": "DecodePointer",
  657. "address": "0x4491b8"
  658.  
  659.  
  660. "name": "InterlockedDecrement",
  661. "address": "0x4491bc"
  662.  
  663.  
  664. "name": "ExitProcess",
  665. "address": "0x4491c0"
  666.  
  667.  
  668. "name": "GetModuleHandleExW",
  669. "address": "0x4491c4"
  670.  
  671.  
  672. "name": "GetProcAddress",
  673. "address": "0x4491c8"
  674.  
  675.  
  676. "name": "AreFileApisANSI",
  677. "address": "0x4491cc"
  678.  
  679.  
  680. "name": "MultiByteToWideChar",
  681. "address": "0x4491d0"
  682.  
  683.  
  684. "name": "RaiseException",
  685. "address": "0x4491d4"
  686.  
  687.  
  688. "name": "RtlUnwind",
  689. "address": "0x4491d8"
  690.  
  691.  
  692. "name": "GetStdHandle",
  693. "address": "0x4491dc"
  694.  
  695.  
  696. "name": "GetFileType",
  697. "address": "0x4491e0"
  698.  
  699.  
  700. "name": "GetModuleFileNameW",
  701. "address": "0x4491e4"
  702.  
  703.  
  704. "name": "WriteConsoleW",
  705. "address": "0x4491e8"
  706.  
  707.  
  708. "name": "GetCommandLineA",
  709. "address": "0x4491ec"
  710.  
  711.  
  712. "name": "WriteFile",
  713. "address": "0x4491f0"
  714.  
  715.  
  716. "name": "IsProcessorFeaturePresent",
  717. "address": "0x4491f4"
  718.  
  719.  
  720. "name": "HeapAlloc",
  721. "address": "0x4491f8"
  722.  
  723.  
  724. "name": "HeapFree",
  725. "address": "0x4491fc"
  726.  
  727.  
  728. "name": "IsDebuggerPresent",
  729. "address": "0x449200"
  730.  
  731.  
  732. "name": "EnterCriticalSection",
  733. "address": "0x449204"
  734.  
  735.  
  736. "name": "LeaveCriticalSection",
  737. "address": "0x449208"
  738.  
  739.  
  740. "name": "InitializeCriticalSectionAndSpinCount",
  741. "address": "0x44920c"
  742.  
  743.  
  744. "name": "WideCharToMultiByte",
  745. "address": "0x449210"
  746.  
  747.  
  748. "name": "GetConsoleCP",
  749. "address": "0x449214"
  750.  
  751.  
  752. "name": "GetConsoleMode",
  753. "address": "0x449218"
  754.  
  755.  
  756. "name": "HeapSize",
  757. "address": "0x44921c"
  758.  
  759.  
  760. "name": "SetEnvironmentVariableA",
  761. "address": "0x449220"
  762.  
  763. ,
  764. "dll": "KERNEL32.dll"
  765.  
  766.  
  767. "imports":
  768.  
  769. "name": "SetMenu",
  770. "address": "0x449234"
  771.  
  772.  
  773. "name": "GetMessageA",
  774. "address": "0x449238"
  775.  
  776.  
  777. "name": "TranslateMessage",
  778. "address": "0x44923c"
  779.  
  780.  
  781. "name": "GetWindowInfo",
  782. "address": "0x449240"
  783.  
  784.  
  785. "name": "SetWindowLongA",
  786. "address": "0x449244"
  787.  
  788.  
  789. "name": "AdjustWindowRectEx",
  790. "address": "0x449248"
  791.  
  792.  
  793. "name": "MoveWindow",
  794. "address": "0x44924c"
  795.  
  796.  
  797. "name": "CreateWindowExA",
  798. "address": "0x449250"
  799.  
  800.  
  801. "name": "LoadImageA",
  802. "address": "0x449254"
  803.  
  804.  
  805. "name": "LoadCursorA",
  806. "address": "0x449258"
  807.  
  808.  
  809. "name": "LoadBitmapA",
  810. "address": "0x44925c"
  811.  
  812.  
  813. "name": "UnhookWindowsHookEx",
  814. "address": "0x449260"
  815.  
  816.  
  817. "name": "GetParent",
  818. "address": "0x449264"
  819.  
  820.  
  821. "name": "GetWindowLongA",
  822. "address": "0x449268"
  823.  
  824.  
  825. "name": "MapWindowPoints",
  826. "address": "0x44926c"
  827.  
  828.  
  829. "name": "GetCursorPos",
  830. "address": "0x449270"
  831.  
  832.  
  833. "name": "MessageBoxA",
  834. "address": "0x449274"
  835.  
  836.  
  837. "name": "GetWindowRect",
  838. "address": "0x449278"
  839.  
  840.  
  841. "name": "EndPaint",
  842. "address": "0x44927c"
  843.  
  844.  
  845. "name": "BeginPaint",
  846. "address": "0x449280"
  847.  
  848.  
  849. "name": "SetForegroundWindow",
  850. "address": "0x449284"
  851.  
  852.  
  853. "name": "DrawTextExW",
  854. "address": "0x449288"
  855.  
  856.  
  857. "name": "DrawTextA",
  858. "address": "0x44928c"
  859.  
  860.  
  861. "name": "DispatchMessageA",
  862. "address": "0x449290"
  863.  
  864.  
  865. "name": "GetSystemMenu",
  866. "address": "0x449294"
  867.  
  868.  
  869. "name": "AppendMenuA",
  870. "address": "0x449298"
  871.  
  872.  
  873. "name": "GetSystemMetrics",
  874. "address": "0x44929c"
  875.  
  876.  
  877. "name": "CreateAcceleratorTableA",
  878. "address": "0x4492a0"
  879.  
  880.  
  881. "name": "GetDlgItem",
  882. "address": "0x4492a4"
  883.  
  884.  
  885. "name": "DestroyWindow",
  886. "address": "0x4492a8"
  887.  
  888.  
  889. "name": "DefWindowProcA",
  890. "address": "0x4492ac"
  891.  
  892.  
  893. "name": "AttachThreadInput",
  894. "address": "0x4492b0"
  895.  
  896.  
  897. "name": "SendMessageA",
  898. "address": "0x4492b4"
  899.  
  900.  
  901. "name": "DrawFrameControl",
  902. "address": "0x4492b8"
  903.  
  904.  
  905. "name": "GetClientRect",
  906. "address": "0x4492bc"
  907.  
  908.  
  909. "name": "InvalidateRect",
  910. "address": "0x4492c0"
  911.  
  912.  
  913. "name": "ReleaseDC",
  914. "address": "0x4492c4"
  915.  
  916.  
  917. "name": "GetDC",
  918. "address": "0x4492c8"
  919.  
  920.  
  921. "name": "UpdateWindow",
  922. "address": "0x4492cc"
  923.  
  924.  
  925. "name": "KillTimer",
  926. "address": "0x4492d0"
  927.  
  928.  
  929. "name": "SetTimer",
  930. "address": "0x4492d4"
  931.  
  932.  
  933. "name": "GetKeyState",
  934. "address": "0x4492d8"
  935.  
  936.  
  937. "name": "SetFocus",
  938. "address": "0x4492dc"
  939.  
  940.  
  941. "name": "SetWindowPos",
  942. "address": "0x4492e0"
  943.  
  944.  
  945. "name": "ShowWindow",
  946. "address": "0x4492e4"
  947.  
  948.  
  949. "name": "RegisterClassA",
  950. "address": "0x4492e8"
  951.  
  952.  
  953. "name": "PostQuitMessage",
  954. "address": "0x4492ec"
  955.  
  956. ,
  957. "dll": "USER32.dll"
  958.  
  959.  
  960. "imports":
  961.  
  962. "name": "SetWindowExtEx",
  963. "address": "0x449034"
  964.  
  965.  
  966. "name": "TextOutA",
  967. "address": "0x449038"
  968.  
  969.  
  970. "name": "MoveToEx",
  971. "address": "0x44903c"
  972.  
  973.  
  974. "name": "GetObjectA",
  975. "address": "0x449040"
  976.  
  977.  
  978. "name": "BeginPath",
  979. "address": "0x449044"
  980.  
  981.  
  982. "name": "GetTextMetricsA",
  983. "address": "0x449048"
  984.  
  985.  
  986. "name": "SetTextJustification",
  987. "address": "0x44904c"
  988.  
  989.  
  990. "name": "SetTextColor",
  991. "address": "0x449050"
  992.  
  993.  
  994. "name": "SetPixel",
  995. "address": "0x449054"
  996.  
  997.  
  998. "name": "SetMapMode",
  999. "address": "0x449058"
  1000.  
  1001.  
  1002. "name": "SetBkMode",
  1003. "address": "0x44905c"
  1004.  
  1005.  
  1006. "name": "SetBkColor",
  1007. "address": "0x449060"
  1008.  
  1009.  
  1010. "name": "Rectangle",
  1011. "address": "0x449064"
  1012.  
  1013.  
  1014. "name": "LineDDA",
  1015. "address": "0x449068"
  1016.  
  1017.  
  1018. "name": "GetMapMode",
  1019. "address": "0x44906c"
  1020.  
  1021.  
  1022. "name": "GetCurrentObject",
  1023. "address": "0x449070"
  1024.  
  1025.  
  1026. "name": "GetROP2",
  1027. "address": "0x449074"
  1028.  
  1029.  
  1030. "name": "CreateSolidBrush",
  1031. "address": "0x449078"
  1032.  
  1033.  
  1034. "name": "CreatePatternBrush",
  1035. "address": "0x44907c"
  1036.  
  1037.  
  1038. "name": "CreatePen",
  1039. "address": "0x449080"
  1040.  
  1041.  
  1042. "name": "CreateFontA",
  1043. "address": "0x449084"
  1044.  
  1045.  
  1046. "name": "CreateFontIndirectA",
  1047. "address": "0x449088"
  1048.  
  1049.  
  1050. "name": "CreateEllipticRgn",
  1051. "address": "0x44908c"
  1052.  
  1053.  
  1054. "name": "SelectObject",
  1055. "address": "0x449090"
  1056.  
  1057.  
  1058. "name": "DeleteObject",
  1059. "address": "0x449094"
  1060.  
  1061.  
  1062. "name": "DeleteDC",
  1063. "address": "0x449098"
  1064.  
  1065.  
  1066. "name": "CreateCompatibleDC",
  1067. "address": "0x44909c"
  1068.  
  1069.  
  1070. "name": "CreateCompatibleBitmap",
  1071. "address": "0x4490a0"
  1072.  
  1073.  
  1074. "name": "BitBlt",
  1075. "address": "0x4490a4"
  1076.  
  1077.  
  1078. "name": "GetDeviceCaps",
  1079. "address": "0x4490a8"
  1080.  
  1081. ,
  1082. "dll": "GDI32.dll"
  1083.  
  1084.  
  1085. "imports":
  1086.  
  1087. "name": "CryptReleaseContext",
  1088. "address": "0x449000"
  1089.  
  1090.  
  1091. "name": "CryptGetProvParam",
  1092. "address": "0x449004"
  1093.  
  1094.  
  1095. "name": "CryptAcquireContextA",
  1096. "address": "0x449008"
  1097.  
  1098. ,
  1099. "dll": "ADVAPI32.dll"
  1100.  
  1101.  
  1102. "imports":
  1103.  
  1104. "name": "CoInitialize",
  1105. "address": "0x4492f4"
  1106.  
  1107.  
  1108. "name": "CoUninitialize",
  1109. "address": "0x4492f8"
  1110.  
  1111.  
  1112. "name": "CreateStreamOnHGlobal",
  1113. "address": "0x4492fc"
  1114.  
  1115. ,
  1116. "dll": "ole32.dll"
  1117.  
  1118.  
  1119. "imports":
  1120.  
  1121. "name": "OleLoadPicture",
  1122. "address": "0x449228"
  1123.  
  1124.  
  1125. "name": "OleSavePictureFile",
  1126. "address": "0x44922c"
  1127.  
  1128. ,
  1129. "dll": "OLEAUT32.dll"
  1130.  
  1131.  
  1132. "imports":
  1133.  
  1134. "name": "CertGetNameStringA",
  1135. "address": "0x44901c"
  1136.  
  1137. ,
  1138. "dll": "CRYPT32.dll"
  1139.  
  1140.  
  1141. "imports":
  1142.  
  1143. "name": "ImageList_Create",
  1144. "address": "0x449010"
  1145.  
  1146.  
  1147. "name": null,
  1148. "address": "0x449014"
  1149.  
  1150. ,
  1151. "dll": "COMCTL32.dll"
  1152.  
  1153.  
  1154. "imports":
  1155.  
  1156. "name": "GetWindowRegionData",
  1157. "address": "0x449024"
  1158.  
  1159.  
  1160. "name": "GetDCRegionData",
  1161. "address": "0x449028"
  1162.  
  1163.  
  1164. "name": "DCISetSrcDestClip",
  1165. "address": "0x44902c"
  1166.  
  1167. ,
  1168. "dll": "DCIMAN32.dll"
  1169.  
  1170. ,
  1171. "digital_signers": null,
  1172. "exported_dll_name": null,
  1173. "actual_checksum": "0x000c3853",
  1174. "overlay": null,
  1175. "imagebase": "0x00400000",
  1176. "reported_checksum": "0x000c3853",
  1177. "icon_hash": null,
  1178. "entrypoint": "0x00408297",
  1179. "timestamp": "2019-07-04 21:07:05",
  1180. "osversion": "6.0",
  1181. "sections":
  1182.  
  1183. "name": ".text",
  1184. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1185. "virtual_address": "0x00001000",
  1186. "size_of_data": "0x00047a00",
  1187. "entropy": "6.68",
  1188. "raw_address": "0x00000400",
  1189. "virtual_size": "0x00047895",
  1190. "characteristics_raw": "0x60000020"
  1191.  
  1192.  
  1193. "name": ".rdata",
  1194. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1195. "virtual_address": "0x00049000",
  1196. "size_of_data": "0x00030a00",
  1197. "entropy": "4.70",
  1198. "raw_address": "0x00047e00",
  1199. "virtual_size": "0x00030922",
  1200. "characteristics_raw": "0x40000040"
  1201.  
  1202.  
  1203. "name": ".data",
  1204. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1205. "virtual_address": "0x0007a000",
  1206. "size_of_data": "0x00001c00",
  1207. "entropy": "4.54",
  1208. "raw_address": "0x00078800",
  1209. "virtual_size": "0x000049f8",
  1210. "characteristics_raw": "0xc0000040"
  1211.  
  1212.  
  1213. "name": ".rsrc",
  1214. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1215. "virtual_address": "0x0007f000",
  1216. "size_of_data": "0x00039c00",
  1217. "entropy": "7.32",
  1218. "raw_address": "0x0007a400",
  1219. "virtual_size": "0x00039b0c",
  1220. "characteristics_raw": "0x40000040"
  1221.  
  1222. ,
  1223. "resources": ,
  1224. "dirents":
  1225.  
  1226. "virtual_address": "0x00000000",
  1227. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1228. "size": "0x00000000"
  1229.  
  1230.  
  1231. "virtual_address": "0x000788a4",
  1232. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1233. "size": "0x000000c8"
  1234.  
  1235.  
  1236. "virtual_address": "0x0007f000",
  1237. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1238. "size": "0x00039b0c"
  1239.  
  1240.  
  1241. "virtual_address": "0x00000000",
  1242. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1243. "size": "0x00000000"
  1244.  
  1245.  
  1246. "virtual_address": "0x00000000",
  1247. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1248. "size": "0x00000000"
  1249.  
  1250.  
  1251. "virtual_address": "0x00000000",
  1252. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1253. "size": "0x00000000"
  1254.  
  1255.  
  1256. "virtual_address": "0x00049360",
  1257. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1258. "size": "0x00000038"
  1259.  
  1260.  
  1261. "virtual_address": "0x00000000",
  1262. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1263. "size": "0x00000000"
  1264.  
  1265.  
  1266. "virtual_address": "0x00000000",
  1267. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1268. "size": "0x00000000"
  1269.  
  1270.  
  1271. "virtual_address": "0x00000000",
  1272. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1273. "size": "0x00000000"
  1274.  
  1275.  
  1276. "virtual_address": "0x00077c00",
  1277. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1278. "size": "0x00000040"
  1279.  
  1280.  
  1281. "virtual_address": "0x00000000",
  1282. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1283. "size": "0x00000000"
  1284.  
  1285.  
  1286. "virtual_address": "0x00049000",
  1287. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1288. "size": "0x00000304"
  1289.  
  1290.  
  1291. "virtual_address": "0x00000000",
  1292. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1293. "size": "0x00000000"
  1294.  
  1295.  
  1296. "virtual_address": "0x00000000",
  1297. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1298. "size": "0x00000000"
  1299.  
  1300.  
  1301. "virtual_address": "0x00000000",
  1302. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1303. "size": "0x00000000"
  1304.  
  1305. ,
  1306. "exports": ,
  1307. "guest_signers":
  1308. "imphash": "8b6d3d6285ec33cbfedbed016e4280f6",
  1309. "icon_fuzzy": null,
  1310. "icon": null,
  1311. "pdbpath": "C:\\Ins\\ad\\IFRA\\Release\\black.pdb",
  1312. "imported_dll_count": 9,
  1313. "versioninfo":
  1314.  
  1315.  
  1316.  
  1317. * Resolved APIs:
  1318. "kernel32.dll.FlsAlloc",
  1319. "kernel32.dll.FlsFree",
  1320. "kernel32.dll.FlsGetValue",
  1321. "kernel32.dll.FlsSetValue",
  1322. "kernel32.dll.InitializeCriticalSectionEx",
  1323. "kernel32.dll.CreateSemaphoreExW",
  1324. "kernel32.dll.SetThreadStackGuarantee",
  1325. "kernel32.dll.CreateThreadpoolTimer",
  1326. "kernel32.dll.SetThreadpoolTimer",
  1327. "kernel32.dll.WaitForThreadpoolTimerCallbacks",
  1328. "kernel32.dll.CloseThreadpoolTimer",
  1329. "kernel32.dll.CreateThreadpoolWait",
  1330. "kernel32.dll.SetThreadpoolWait",
  1331. "kernel32.dll.CloseThreadpoolWait",
  1332. "kernel32.dll.FlushProcessWriteBuffers",
  1333. "kernel32.dll.FreeLibraryWhenCallbackReturns",
  1334. "kernel32.dll.GetCurrentProcessorNumber",
  1335. "kernel32.dll.GetLogicalProcessorInformation",
  1336. "kernel32.dll.CreateSymbolicLinkW",
  1337. "kernel32.dll.EnumSystemLocalesEx",
  1338. "kernel32.dll.CompareStringEx",
  1339. "kernel32.dll.GetDateFormatEx",
  1340. "kernel32.dll.GetLocaleInfoEx",
  1341. "kernel32.dll.GetTimeFormatEx",
  1342. "kernel32.dll.GetUserDefaultLocaleName",
  1343. "kernel32.dll.IsValidLocaleName",
  1344. "kernel32.dll.LCMapStringEx",
  1345. "cryptbase.dll.SystemFunction036",
  1346. "uxtheme.dll.ThemeInitApiHook",
  1347. "user32.dll.IsProcessDPIAware",
  1348. "dwmapi.dll.DwmIsCompositionEnabled",
  1349. "gdi32.dll.GetLayout",
  1350. "gdi32.dll.GdiRealizationInfo",
  1351. "gdi32.dll.FontIsLinked",
  1352. "advapi32.dll.RegOpenKeyExW",
  1353. "advapi32.dll.RegQueryInfoKeyW",
  1354. "gdi32.dll.GetTextFaceAliasW",
  1355. "advapi32.dll.RegEnumValueW",
  1356. "advapi32.dll.RegCloseKey",
  1357. "advapi32.dll.RegQueryValueExW",
  1358. "gdi32.dll.GetFontAssocStatus",
  1359. "advapi32.dll.RegQueryValueExA",
  1360. "advapi32.dll.RegEnumKeyExW",
  1361. "cryptsp.dll.CryptAcquireContextA",
  1362. "ws2_32.dll.getaddrinfo",
  1363. "ws2_32.dll.freeaddrinfo",
  1364. "ws2_32.dll.#3",
  1365. "ws2_32.dll.#115",
  1366. "ws2_32.dll.#23",
  1367. "ws2_32.dll.#19",
  1368. "ws2_32.dll.#16",
  1369. "ws2_32.dll.#4",
  1370. "kernel32.dll.GetProcessHeap",
  1371. "kernel32.dll.HeapFree",
  1372. "kernel32.dll.HeapAlloc",
  1373. "kernel32.dll.SetLastError",
  1374. "kernel32.dll.GetLastError",
  1375. "ole32.dll.CoCreateInstance",
  1376. "ole32.dll.CoInitialize",
  1377. "ole32.dll.CoUninitialize",
  1378. "oleaut32.dll.#8",
  1379. "oleaut32.dll.#6",
  1380. "oleaut32.dll.#2",
  1381. "cryptsp.dll.CryptAcquireContextW",
  1382. "cryptsp.dll.CryptCreateHash",
  1383. "cryptsp.dll.CryptHashData",
  1384. "cryptsp.dll.CryptGetHashParam",
  1385. "cryptsp.dll.CryptDestroyHash",
  1386. "cryptsp.dll.CryptReleaseContext",
  1387. "vaultcli.dll.VaultEnumerateItems",
  1388. "vaultcli.dll.VaultEnumerateVaults",
  1389. "vaultcli.dll.VaultFree",
  1390. "vaultcli.dll.VaultGetItem",
  1391. "vaultcli.dll.VaultOpenVault",
  1392. "vaultcli.dll.VaultCloseVault",
  1393. "sechost.dll.LookupAccountSidLocalW",
  1394. "netapi32.dll.NetUserGetInfo",
  1395. "cryptsp.dll.CryptImportKey",
  1396. "cryptsp.dll.CryptSetKeyParam",
  1397. "cryptsp.dll.CryptDecrypt",
  1398. "cryptsp.dll.CryptDestroyKey",
  1399. "ole32.dll.CoInitializeEx",
  1400. "ole32.dll.CoInitializeSecurity",
  1401. "sechost.dll.LookupAccountNameLocalW",
  1402. "advapi32.dll.LookupAccountSidW",
  1403. "kernel32.dll.SortGetHandle",
  1404. "kernel32.dll.SortCloseHandle",
  1405. "w32time.dll.SvchostEntry_W32Time",
  1406. "w32time.dll.SvchostPushServiceGlobals",
  1407. "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  1408. "ws2_32.dll.WSASocketW",
  1409. "ws2_32.dll.WSAIoctl",
  1410. "ws2_32.dll.#111",
  1411. "userenv.dll.RegisterGPNotification",
  1412. "gpapi.dll.RegisterGPNotificationInternal",
  1413. "sechost.dll.OpenSCManagerW",
  1414. "sechost.dll.OpenServiceW",
  1415. "sechost.dll.CloseServiceHandle",
  1416. "sechost.dll.QueryServiceConfigW",
  1417. "dsrole.dll.DsRoleGetPrimaryDomainInformation",
  1418. "dsrole.dll.DsRoleFreeMemory",
  1419. "sspicli.dll.LsaRegisterPolicyChangeNotification",
  1420. "w32time.dll.TimeProvClose",
  1421. "w32time.dll.TimeProvCommand",
  1422. "w32time.dll.TimeProvOpen",
  1423. "ws2_32.dll.#21",
  1424. "ws2_32.dll.#2",
  1425. "ws2_32.dll.WSAEventSelect",
  1426. "vmictimeprovider.dll.TimeProvClose",
  1427. "vmictimeprovider.dll.TimeProvCommand",
  1428. "vmictimeprovider.dll.TimeProvOpen",
  1429. "advapi32.dll.EventRegister",
  1430. "advapi32.dll.EventEnabled",
  1431. "advapi32.dll.EventWrite",
  1432. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  1433. "ws2_32.dll.GetAddrInfoW",
  1434. "ws2_32.dll.FreeAddrInfoW",
  1435. "ws2_32.dll.WSAAddressToStringW",
  1436. "ws2_32.dll.#116",
  1437. "advapi32.dll.EventUnregister",
  1438. "sspicli.dll.LsaUnregisterPolicyChangeNotification",
  1439. "userenv.dll.UnregisterGPNotification",
  1440. "gpapi.dll.UnregisterGPNotificationInternal"
  1441.  
  1442.  
  1443. * Static Analysis:
  1444. "pe":
  1445. "peid_signatures": null,
  1446. "imports":
  1447.  
  1448. "imports":
  1449.  
  1450. "name": "LCMapStringW",
  1451. "address": "0x4490b0"
  1452.  
  1453.  
  1454. "name": "CompareStringW",
  1455. "address": "0x4490b4"
  1456.  
  1457.  
  1458. "name": "FreeEnvironmentStringsW",
  1459. "address": "0x4490b8"
  1460.  
  1461.  
  1462. "name": "GetEnvironmentStringsW",
  1463. "address": "0x4490bc"
  1464.  
  1465.  
  1466. "name": "GetSystemTimeAsFileTime",
  1467. "address": "0x4490c0"
  1468.  
  1469.  
  1470. "name": "GetCurrentProcessId",
  1471. "address": "0x4490c4"
  1472.  
  1473.  
  1474. "name": "QueryPerformanceCounter",
  1475. "address": "0x4490c8"
  1476.  
  1477.  
  1478. "name": "GetModuleFileNameA",
  1479. "address": "0x4490cc"
  1480.  
  1481.  
  1482. "name": "GetProcessHeap",
  1483. "address": "0x4490d0"
  1484.  
  1485.  
  1486. "name": "LoadLibraryW",
  1487. "address": "0x4490d4"
  1488.  
  1489.  
  1490. "name": "OutputDebugStringW",
  1491. "address": "0x4490d8"
  1492.  
  1493.  
  1494. "name": "GetCurrentThreadId",
  1495. "address": "0x4490dc"
  1496.  
  1497.  
  1498. "name": "GetCPInfo",
  1499. "address": "0x4490e0"
  1500.  
  1501.  
  1502. "name": "GetOEMCP",
  1503. "address": "0x4490e4"
  1504.  
  1505.  
  1506. "name": "GetACP",
  1507. "address": "0x4490e8"
  1508.  
  1509.  
  1510. "name": "IsValidCodePage",
  1511. "address": "0x4490ec"
  1512.  
  1513.  
  1514. "name": "LoadLibraryExW",
  1515. "address": "0x4490f0"
  1516.  
  1517.  
  1518. "name": "GetModuleHandleW",
  1519. "address": "0x4490f4"
  1520.  
  1521.  
  1522. "name": "GetStartupInfoW",
  1523. "address": "0x4490f8"
  1524.  
  1525.  
  1526. "name": "TlsFree",
  1527. "address": "0x4490fc"
  1528.  
  1529.  
  1530. "name": "TlsSetValue",
  1531. "address": "0x449100"
  1532.  
  1533.  
  1534. "name": "TlsGetValue",
  1535. "address": "0x449104"
  1536.  
  1537.  
  1538. "name": "TlsAlloc",
  1539. "address": "0x449108"
  1540.  
  1541.  
  1542. "name": "SetStdHandle",
  1543. "address": "0x44910c"
  1544.  
  1545.  
  1546. "name": "FlushFileBuffers",
  1547. "address": "0x449110"
  1548.  
  1549.  
  1550. "name": "SetFilePointerEx",
  1551. "address": "0x449114"
  1552.  
  1553.  
  1554. "name": "HeapReAlloc",
  1555. "address": "0x449118"
  1556.  
  1557.  
  1558. "name": "GetStringTypeW",
  1559. "address": "0x44911c"
  1560.  
  1561.  
  1562. "name": "CreateFileW",
  1563. "address": "0x449120"
  1564.  
  1565.  
  1566. "name": "SetEndOfFile",
  1567. "address": "0x449124"
  1568.  
  1569.  
  1570. "name": "ReadConsoleW",
  1571. "address": "0x449128"
  1572.  
  1573.  
  1574. "name": "GlobalSize",
  1575. "address": "0x44912c"
  1576.  
  1577.  
  1578. "name": "CreateFileA",
  1579. "address": "0x449130"
  1580.  
  1581.  
  1582. "name": "CloseHandle",
  1583. "address": "0x449134"
  1584.  
  1585.  
  1586. "name": "ReadFile",
  1587. "address": "0x449138"
  1588.  
  1589.  
  1590. "name": "GetFileSize",
  1591. "address": "0x44913c"
  1592.  
  1593.  
  1594. "name": "GlobalFree",
  1595. "address": "0x449140"
  1596.  
  1597.  
  1598. "name": "GlobalUnlock",
  1599. "address": "0x449144"
  1600.  
  1601.  
  1602. "name": "GlobalLock",
  1603. "address": "0x449148"
  1604.  
  1605.  
  1606. "name": "GlobalAlloc",
  1607. "address": "0x44914c"
  1608.  
  1609.  
  1610. "name": "GetModuleHandleA",
  1611. "address": "0x449150"
  1612.  
  1613.  
  1614. "name": "CreateToolhelp32Snapshot",
  1615. "address": "0x449154"
  1616.  
  1617.  
  1618. "name": "GetConsoleWindow",
  1619. "address": "0x449158"
  1620.  
  1621.  
  1622. "name": "UpdateResourceA",
  1623. "address": "0x44915c"
  1624.  
  1625.  
  1626. "name": "GetTempPathA",
  1627. "address": "0x449160"
  1628.  
  1629.  
  1630. "name": "EnumResourceTypesA",
  1631. "address": "0x449164"
  1632.  
  1633.  
  1634. "name": "FindResourceExA",
  1635. "address": "0x449168"
  1636.  
  1637.  
  1638. "name": "CreateEventA",
  1639. "address": "0x44916c"
  1640.  
  1641.  
  1642. "name": "MulDiv",
  1643. "address": "0x449170"
  1644.  
  1645.  
  1646. "name": "SizeofResource",
  1647. "address": "0x449174"
  1648.  
  1649.  
  1650. "name": "TerminateProcess",
  1651. "address": "0x449178"
  1652.  
  1653.  
  1654. "name": "GetCurrentProcess",
  1655. "address": "0x44917c"
  1656.  
  1657.  
  1658. "name": "SetUnhandledExceptionFilter",
  1659. "address": "0x449180"
  1660.  
  1661.  
  1662. "name": "UnhandledExceptionFilter",
  1663. "address": "0x449184"
  1664.  
  1665.  
  1666. "name": "DeleteCriticalSection",
  1667. "address": "0x449188"
  1668.  
  1669.  
  1670. "name": "Sleep",
  1671. "address": "0x44918c"
  1672.  
  1673.  
  1674. "name": "LoadResource",
  1675. "address": "0x449190"
  1676.  
  1677.  
  1678. "name": "WaitForSingleObject",
  1679. "address": "0x449194"
  1680.  
  1681.  
  1682. "name": "SetLastError",
  1683. "address": "0x449198"
  1684.  
  1685.  
  1686. "name": "GetLastError",
  1687. "address": "0x44919c"
  1688.  
  1689.  
  1690. "name": "VirtualAlloc",
  1691. "address": "0x4491a0"
  1692.  
  1693.  
  1694. "name": "LockResource",
  1695. "address": "0x4491a4"
  1696.  
  1697.  
  1698. "name": "FreeResource",
  1699. "address": "0x4491a8"
  1700.  
  1701.  
  1702. "name": "GetTempFileNameA",
  1703. "address": "0x4491ac"
  1704.  
  1705.  
  1706. "name": "InterlockedIncrement",
  1707. "address": "0x4491b0"
  1708.  
  1709.  
  1710. "name": "EncodePointer",
  1711. "address": "0x4491b4"
  1712.  
  1713.  
  1714. "name": "DecodePointer",
  1715. "address": "0x4491b8"
  1716.  
  1717.  
  1718. "name": "InterlockedDecrement",
  1719. "address": "0x4491bc"
  1720.  
  1721.  
  1722. "name": "ExitProcess",
  1723. "address": "0x4491c0"
  1724.  
  1725.  
  1726. "name": "GetModuleHandleExW",
  1727. "address": "0x4491c4"
  1728.  
  1729.  
  1730. "name": "GetProcAddress",
  1731. "address": "0x4491c8"
  1732.  
  1733.  
  1734. "name": "AreFileApisANSI",
  1735. "address": "0x4491cc"
  1736.  
  1737.  
  1738. "name": "MultiByteToWideChar",
  1739. "address": "0x4491d0"
  1740.  
  1741.  
  1742. "name": "RaiseException",
  1743. "address": "0x4491d4"
  1744.  
  1745.  
  1746. "name": "RtlUnwind",
  1747. "address": "0x4491d8"
  1748.  
  1749.  
  1750. "name": "GetStdHandle",
  1751. "address": "0x4491dc"
  1752.  
  1753.  
  1754. "name": "GetFileType",
  1755. "address": "0x4491e0"
  1756.  
  1757.  
  1758. "name": "GetModuleFileNameW",
  1759. "address": "0x4491e4"
  1760.  
  1761.  
  1762. "name": "WriteConsoleW",
  1763. "address": "0x4491e8"
  1764.  
  1765.  
  1766. "name": "GetCommandLineA",
  1767. "address": "0x4491ec"
  1768.  
  1769.  
  1770. "name": "WriteFile",
  1771. "address": "0x4491f0"
  1772.  
  1773.  
  1774. "name": "IsProcessorFeaturePresent",
  1775. "address": "0x4491f4"
  1776.  
  1777.  
  1778. "name": "HeapAlloc",
  1779. "address": "0x4491f8"
  1780.  
  1781.  
  1782. "name": "HeapFree",
  1783. "address": "0x4491fc"
  1784.  
  1785.  
  1786. "name": "IsDebuggerPresent",
  1787. "address": "0x449200"
  1788.  
  1789.  
  1790. "name": "EnterCriticalSection",
  1791. "address": "0x449204"
  1792.  
  1793.  
  1794. "name": "LeaveCriticalSection",
  1795. "address": "0x449208"
  1796.  
  1797.  
  1798. "name": "InitializeCriticalSectionAndSpinCount",
  1799. "address": "0x44920c"
  1800.  
  1801.  
  1802. "name": "WideCharToMultiByte",
  1803. "address": "0x449210"
  1804.  
  1805.  
  1806. "name": "GetConsoleCP",
  1807. "address": "0x449214"
  1808.  
  1809.  
  1810. "name": "GetConsoleMode",
  1811. "address": "0x449218"
  1812.  
  1813.  
  1814. "name": "HeapSize",
  1815. "address": "0x44921c"
  1816.  
  1817.  
  1818. "name": "SetEnvironmentVariableA",
  1819. "address": "0x449220"
  1820.  
  1821. ,
  1822. "dll": "KERNEL32.dll"
  1823.  
  1824.  
  1825. "imports":
  1826.  
  1827. "name": "SetMenu",
  1828. "address": "0x449234"
  1829.  
  1830.  
  1831. "name": "GetMessageA",
  1832. "address": "0x449238"
  1833.  
  1834.  
  1835. "name": "TranslateMessage",
  1836. "address": "0x44923c"
  1837.  
  1838.  
  1839. "name": "GetWindowInfo",
  1840. "address": "0x449240"
  1841.  
  1842.  
  1843. "name": "SetWindowLongA",
  1844. "address": "0x449244"
  1845.  
  1846.  
  1847. "name": "AdjustWindowRectEx",
  1848. "address": "0x449248"
  1849.  
  1850.  
  1851. "name": "MoveWindow",
  1852. "address": "0x44924c"
  1853.  
  1854.  
  1855. "name": "CreateWindowExA",
  1856. "address": "0x449250"
  1857.  
  1858.  
  1859. "name": "LoadImageA",
  1860. "address": "0x449254"
  1861.  
  1862.  
  1863. "name": "LoadCursorA",
  1864. "address": "0x449258"
  1865.  
  1866.  
  1867. "name": "LoadBitmapA",
  1868. "address": "0x44925c"
  1869.  
  1870.  
  1871. "name": "UnhookWindowsHookEx",
  1872. "address": "0x449260"
  1873.  
  1874.  
  1875. "name": "GetParent",
  1876. "address": "0x449264"
  1877.  
  1878.  
  1879. "name": "GetWindowLongA",
  1880. "address": "0x449268"
  1881.  
  1882.  
  1883. "name": "MapWindowPoints",
  1884. "address": "0x44926c"
  1885.  
  1886.  
  1887. "name": "GetCursorPos",
  1888. "address": "0x449270"
  1889.  
  1890.  
  1891. "name": "MessageBoxA",
  1892. "address": "0x449274"
  1893.  
  1894.  
  1895. "name": "GetWindowRect",
  1896. "address": "0x449278"
  1897.  
  1898.  
  1899. "name": "EndPaint",
  1900. "address": "0x44927c"
  1901.  
  1902.  
  1903. "name": "BeginPaint",
  1904. "address": "0x449280"
  1905.  
  1906.  
  1907. "name": "SetForegroundWindow",
  1908. "address": "0x449284"
  1909.  
  1910.  
  1911. "name": "DrawTextExW",
  1912. "address": "0x449288"
  1913.  
  1914.  
  1915. "name": "DrawTextA",
  1916. "address": "0x44928c"
  1917.  
  1918.  
  1919. "name": "DispatchMessageA",
  1920. "address": "0x449290"
  1921.  
  1922.  
  1923. "name": "GetSystemMenu",
  1924. "address": "0x449294"
  1925.  
  1926.  
  1927. "name": "AppendMenuA",
  1928. "address": "0x449298"
  1929.  
  1930.  
  1931. "name": "GetSystemMetrics",
  1932. "address": "0x44929c"
  1933.  
  1934.  
  1935. "name": "CreateAcceleratorTableA",
  1936. "address": "0x4492a0"
  1937.  
  1938.  
  1939. "name": "GetDlgItem",
  1940. "address": "0x4492a4"
  1941.  
  1942.  
  1943. "name": "DestroyWindow",
  1944. "address": "0x4492a8"
  1945.  
  1946.  
  1947. "name": "DefWindowProcA",
  1948. "address": "0x4492ac"
  1949.  
  1950.  
  1951. "name": "AttachThreadInput",
  1952. "address": "0x4492b0"
  1953.  
  1954.  
  1955. "name": "SendMessageA",
  1956. "address": "0x4492b4"
  1957.  
  1958.  
  1959. "name": "DrawFrameControl",
  1960. "address": "0x4492b8"
  1961.  
  1962.  
  1963. "name": "GetClientRect",
  1964. "address": "0x4492bc"
  1965.  
  1966.  
  1967. "name": "InvalidateRect",
  1968. "address": "0x4492c0"
  1969.  
  1970.  
  1971. "name": "ReleaseDC",
  1972. "address": "0x4492c4"
  1973.  
  1974.  
  1975. "name": "GetDC",
  1976. "address": "0x4492c8"
  1977.  
  1978.  
  1979. "name": "UpdateWindow",
  1980. "address": "0x4492cc"
  1981.  
  1982.  
  1983. "name": "KillTimer",
  1984. "address": "0x4492d0"
  1985.  
  1986.  
  1987. "name": "SetTimer",
  1988. "address": "0x4492d4"
  1989.  
  1990.  
  1991. "name": "GetKeyState",
  1992. "address": "0x4492d8"
  1993.  
  1994.  
  1995. "name": "SetFocus",
  1996. "address": "0x4492dc"
  1997.  
  1998.  
  1999. "name": "SetWindowPos",
  2000. "address": "0x4492e0"
  2001.  
  2002.  
  2003. "name": "ShowWindow",
  2004. "address": "0x4492e4"
  2005.  
  2006.  
  2007. "name": "RegisterClassA",
  2008. "address": "0x4492e8"
  2009.  
  2010.  
  2011. "name": "PostQuitMessage",
  2012. "address": "0x4492ec"
  2013.  
  2014. ,
  2015. "dll": "USER32.dll"
  2016.  
  2017.  
  2018. "imports":
  2019.  
  2020. "name": "SetWindowExtEx",
  2021. "address": "0x449034"
  2022.  
  2023.  
  2024. "name": "TextOutA",
  2025. "address": "0x449038"
  2026.  
  2027.  
  2028. "name": "MoveToEx",
  2029. "address": "0x44903c"
  2030.  
  2031.  
  2032. "name": "GetObjectA",
  2033. "address": "0x449040"
  2034.  
  2035.  
  2036. "name": "BeginPath",
  2037. "address": "0x449044"
  2038.  
  2039.  
  2040. "name": "GetTextMetricsA",
  2041. "address": "0x449048"
  2042.  
  2043.  
  2044. "name": "SetTextJustification",
  2045. "address": "0x44904c"
  2046.  
  2047.  
  2048. "name": "SetTextColor",
  2049. "address": "0x449050"
  2050.  
  2051.  
  2052. "name": "SetPixel",
  2053. "address": "0x449054"
  2054.  
  2055.  
  2056. "name": "SetMapMode",
  2057. "address": "0x449058"
  2058.  
  2059.  
  2060. "name": "SetBkMode",
  2061. "address": "0x44905c"
  2062.  
  2063.  
  2064. "name": "SetBkColor",
  2065. "address": "0x449060"
  2066.  
  2067.  
  2068. "name": "Rectangle",
  2069. "address": "0x449064"
  2070.  
  2071.  
  2072. "name": "LineDDA",
  2073. "address": "0x449068"
  2074.  
  2075.  
  2076. "name": "GetMapMode",
  2077. "address": "0x44906c"
  2078.  
  2079.  
  2080. "name": "GetCurrentObject",
  2081. "address": "0x449070"
  2082.  
  2083.  
  2084. "name": "GetROP2",
  2085. "address": "0x449074"
  2086.  
  2087.  
  2088. "name": "CreateSolidBrush",
  2089. "address": "0x449078"
  2090.  
  2091.  
  2092. "name": "CreatePatternBrush",
  2093. "address": "0x44907c"
  2094.  
  2095.  
  2096. "name": "CreatePen",
  2097. "address": "0x449080"
  2098.  
  2099.  
  2100. "name": "CreateFontA",
  2101. "address": "0x449084"
  2102.  
  2103.  
  2104. "name": "CreateFontIndirectA",
  2105. "address": "0x449088"
  2106.  
  2107.  
  2108. "name": "CreateEllipticRgn",
  2109. "address": "0x44908c"
  2110.  
  2111.  
  2112. "name": "SelectObject",
  2113. "address": "0x449090"
  2114.  
  2115.  
  2116. "name": "DeleteObject",
  2117. "address": "0x449094"
  2118.  
  2119.  
  2120. "name": "DeleteDC",
  2121. "address": "0x449098"
  2122.  
  2123.  
  2124. "name": "CreateCompatibleDC",
  2125. "address": "0x44909c"
  2126.  
  2127.  
  2128. "name": "CreateCompatibleBitmap",
  2129. "address": "0x4490a0"
  2130.  
  2131.  
  2132. "name": "BitBlt",
  2133. "address": "0x4490a4"
  2134.  
  2135.  
  2136. "name": "GetDeviceCaps",
  2137. "address": "0x4490a8"
  2138.  
  2139. ,
  2140. "dll": "GDI32.dll"
  2141.  
  2142.  
  2143. "imports":
  2144.  
  2145. "name": "CryptReleaseContext",
  2146. "address": "0x449000"
  2147.  
  2148.  
  2149. "name": "CryptGetProvParam",
  2150. "address": "0x449004"
  2151.  
  2152.  
  2153. "name": "CryptAcquireContextA",
  2154. "address": "0x449008"
  2155.  
  2156. ,
  2157. "dll": "ADVAPI32.dll"
  2158.  
  2159.  
  2160. "imports":
  2161.  
  2162. "name": "CoInitialize",
  2163. "address": "0x4492f4"
  2164.  
  2165.  
  2166. "name": "CoUninitialize",
  2167. "address": "0x4492f8"
  2168.  
  2169.  
  2170. "name": "CreateStreamOnHGlobal",
  2171. "address": "0x4492fc"
  2172.  
  2173. ,
  2174. "dll": "ole32.dll"
  2175.  
  2176.  
  2177. "imports":
  2178.  
  2179. "name": "OleLoadPicture",
  2180. "address": "0x449228"
  2181.  
  2182.  
  2183. "name": "OleSavePictureFile",
  2184. "address": "0x44922c"
  2185.  
  2186. ,
  2187. "dll": "OLEAUT32.dll"
  2188.  
  2189.  
  2190. "imports":
  2191.  
  2192. "name": "CertGetNameStringA",
  2193. "address": "0x44901c"
  2194.  
  2195. ,
  2196. "dll": "CRYPT32.dll"
  2197.  
  2198.  
  2199. "imports":
  2200.  
  2201. "name": "ImageList_Create",
  2202. "address": "0x449010"
  2203.  
  2204.  
  2205. "name": null,
  2206. "address": "0x449014"
  2207.  
  2208. ,
  2209. "dll": "COMCTL32.dll"
  2210.  
  2211.  
  2212. "imports":
  2213.  
  2214. "name": "GetWindowRegionData",
  2215. "address": "0x449024"
  2216.  
  2217.  
  2218. "name": "GetDCRegionData",
  2219. "address": "0x449028"
  2220.  
  2221.  
  2222. "name": "DCISetSrcDestClip",
  2223. "address": "0x44902c"
  2224.  
  2225. ,
  2226. "dll": "DCIMAN32.dll"
  2227.  
  2228. ,
  2229. "digital_signers": null,
  2230. "exported_dll_name": null,
  2231. "actual_checksum": "0x000c3853",
  2232. "overlay": null,
  2233. "imagebase": "0x00400000",
  2234. "reported_checksum": "0x000c3853",
  2235. "icon_hash": null,
  2236. "entrypoint": "0x00408297",
  2237. "timestamp": "2019-07-04 21:07:05",
  2238. "osversion": "6.0",
  2239. "sections":
  2240.  
  2241. "name": ".text",
  2242. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  2243. "virtual_address": "0x00001000",
  2244. "size_of_data": "0x00047a00",
  2245. "entropy": "6.68",
  2246. "raw_address": "0x00000400",
  2247. "virtual_size": "0x00047895",
  2248. "characteristics_raw": "0x60000020"
  2249.  
  2250.  
  2251. "name": ".rdata",
  2252. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2253. "virtual_address": "0x00049000",
  2254. "size_of_data": "0x00030a00",
  2255. "entropy": "4.70",
  2256. "raw_address": "0x00047e00",
  2257. "virtual_size": "0x00030922",
  2258. "characteristics_raw": "0x40000040"
  2259.  
  2260.  
  2261. "name": ".data",
  2262. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2263. "virtual_address": "0x0007a000",
  2264. "size_of_data": "0x00001c00",
  2265. "entropy": "4.54",
  2266. "raw_address": "0x00078800",
  2267. "virtual_size": "0x000049f8",
  2268. "characteristics_raw": "0xc0000040"
  2269.  
  2270.  
  2271. "name": ".rsrc",
  2272. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2273. "virtual_address": "0x0007f000",
  2274. "size_of_data": "0x00039c00",
  2275. "entropy": "7.32",
  2276. "raw_address": "0x0007a400",
  2277. "virtual_size": "0x00039b0c",
  2278. "characteristics_raw": "0x40000040"
  2279.  
  2280. ,
  2281. "resources": ,
  2282. "dirents":
  2283.  
  2284. "virtual_address": "0x00000000",
  2285. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  2286. "size": "0x00000000"
  2287.  
  2288.  
  2289. "virtual_address": "0x000788a4",
  2290. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  2291. "size": "0x000000c8"
  2292.  
  2293.  
  2294. "virtual_address": "0x0007f000",
  2295. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  2296. "size": "0x00039b0c"
  2297.  
  2298.  
  2299. "virtual_address": "0x00000000",
  2300. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  2301. "size": "0x00000000"
  2302.  
  2303.  
  2304. "virtual_address": "0x00000000",
  2305. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  2306. "size": "0x00000000"
  2307.  
  2308.  
  2309. "virtual_address": "0x00000000",
  2310. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  2311. "size": "0x00000000"
  2312.  
  2313.  
  2314. "virtual_address": "0x00049360",
  2315. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  2316. "size": "0x00000038"
  2317.  
  2318.  
  2319. "virtual_address": "0x00000000",
  2320. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  2321. "size": "0x00000000"
  2322.  
  2323.  
  2324. "virtual_address": "0x00000000",
  2325. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  2326. "size": "0x00000000"
  2327.  
  2328.  
  2329. "virtual_address": "0x00000000",
  2330. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  2331. "size": "0x00000000"
  2332.  
  2333.  
  2334. "virtual_address": "0x00077c00",
  2335. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  2336. "size": "0x00000040"
  2337.  
  2338.  
  2339. "virtual_address": "0x00000000",
  2340. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  2341. "size": "0x00000000"
  2342.  
  2343.  
  2344. "virtual_address": "0x00049000",
  2345. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  2346. "size": "0x00000304"
  2347.  
  2348.  
  2349. "virtual_address": "0x00000000",
  2350. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  2351. "size": "0x00000000"
  2352.  
  2353.  
  2354. "virtual_address": "0x00000000",
  2355. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  2356. "size": "0x00000000"
  2357.  
  2358.  
  2359. "virtual_address": "0x00000000",
  2360. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  2361. "size": "0x00000000"
  2362.  
  2363. ,
  2364. "exports": ,
  2365. "guest_signers":
  2366. "imphash": "8b6d3d6285ec33cbfedbed016e4280f6",
  2367. "icon_fuzzy": null,
  2368. "icon": null,
  2369. "pdbpath": "C:\\Ins\\ad\\IFRA\\Release\\black.pdb",
  2370. "imported_dll_count": 9,
  2371. "versioninfo":
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!