API tools faq
paste
paladin316

rst_exe_2019-06-26_05_30.json

paladin316
Jun 26th, 2019
2,874
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 66.25 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "rst.exe"
  7. [*] File Size: 344064
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "7d9ec662e3a2a8d0f3e2b4e15cb5a9ad178993fefe4069fb129525c8a30c96d4"
  10. [*] MD5: "f0e006ce95b08a78a86c76344c9ac52f"
  11. [*] SHA1: "1698859ed180dac2465bf65c16cd69d6c5a8355e"
  12. [*] SHA512: "b6db71d61adafb306c83d2f209b483f4eb4e63554fb5b2f2077318c0679fa9005e9d66b92fb411152ef312815e4ab83d1a5782c0b2bee8cd205c4eb5ff2a3aa0"
  13. [*] CRC32: "ADEBE7BE"
  14. [*] SSDEEP: "6144:m8Y5+t42g3Ylic00IEANOsgoElx+6E+pFE5EI3DlzLQcOL7:UE4TC00IEnhH5E+pFE5EIzd/O"
  15.  
  16. [*] Process Execution: [
  17. "rst.exe",
  18. "cmd.exe",
  19. "powershell.exe",
  20. "cmd.exe",
  21. "sc.exe",
  22. "cmd.exe",
  23. "sc.exe",
  24. "cmd.exe",
  25. "sc.exe",
  26. "cmd.exe",
  27. "sc.exe",
  28. "cmd.exe",
  29. "powershell.exe",
  30. "svchost.exe",
  31. "services.exe",
  32. "lsass.exe",
  33. "taskhost.exe",
  34. "svchost.exe",
  35. "WerFault.exe"
  36. ]
  37.  
  38. [*] Signatures Detected: [
  39. {
  40. "Description": "At least one process apparently crashed during execution",
  41. "Details": []
  42. },
  43. {
  44. "Description": "Creates RWX memory",
  45. "Details": []
  46. },
  47. {
  48. "Description": "Possible date expiration check, exits too soon after checking local time",
  49. "Details": [
  50. {
  51. "process": "cmd.exe, PID 2140"
  52. }
  53. ]
  54. },
  55. {
  56. "Description": "A process created a hidden window",
  57. "Details": [
  58. {
  59. "Process": "rst.exe -> cmd"
  60. },
  61. {
  62. "Process": "rst.exe -> cmd"
  63. },
  64. {
  65. "Process": "rst.exe -> cmd"
  66. }
  67. ]
  68. },
  69. {
  70. "Description": "Attempts to stop active services",
  71. "Details": [
  72. {
  73. "servicename": "WinDefend"
  74. }
  75. ]
  76. },
  77. {
  78. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  79. "Details": [
  80. {
  81. "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 7533566 times"
  82. }
  83. ]
  84. },
  85. {
  86. "Description": "Spoofs its process name and/or associated pathname to appear as a legitimate process",
  87. "Details": [
  88. {
  89. "modified_name": "svchost.exe",
  90. "modified_path": "C:\\Users\\user\\AppData\\Local\\Temp\\rst.exe",
  91. "original_name": "svchost.exe",
  92. "original_path": "C:\\Windows\\system32\\svchost.exe"
  93. }
  94. ]
  95. },
  96. {
  97. "Description": "Creates a hidden or system file",
  98. "Details": [
  99. {
  100. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1031560.TMP"
  101. }
  102. ]
  103. },
  104. {
  105. "Description": "File has been identified by 11 Antiviruses on VirusTotal as malicious",
  106. "Details": [
  107. {
  108. "APEX": "Malicious"
  109. },
  110. {
  111. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  112. },
  113. {
  114. "Endgame": "malicious (high confidence)"
  115. },
  116. {
  117. "McAfee-GW-Edition": "BehavesLike.Win32.PWSZbot.fh"
  118. },
  119. {
  120. "FireEye": "Generic.mg.f0e006ce95b08a78"
  121. },
  122. {
  123. "Webroot": "W32.Trojan.Gen"
  124. },
  125. {
  126. "Microsoft": "Trojan:Win32/MereTam.A"
  127. },
  128. {
  129. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  130. },
  131. {
  132. "AVG": "Win32:Malware-gen"
  133. },
  134. {
  135. "Avast": "Win32:Malware-gen"
  136. },
  137. {
  138. "Qihoo-360": "QVM41.1.Malware.Gen"
  139. }
  140. ]
  141. },
  142. {
  143. "Description": "Checks the system manufacturer, likely for anti-virtualization",
  144. "Details": []
  145. },
  146. {
  147. "Description": "Attempts to disable Windows Defender",
  148. "Details": []
  149. }
  150. ]
  151.  
  152. [*] Started Service: [
  153. "KeyIso",
  154. "WerSvc"
  155. ]
  156.  
  157. [*] Executed Commands: [
  158. "\"C:\\Windows\\System32\\cmd.exe\" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true",
  159. "cmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true",
  160. "\"C:\\Windows\\System32\\cmd.exe\" /c sc stop WinDefend",
  161. "cmd /c sc stop WinDefend",
  162. "\"C:\\Windows\\System32\\cmd.exe\" /c sc delete WinDefend",
  163. "cmd /c sc delete WinDefend",
  164. "C:\\Windows\\system32\\cmd.exe /c sc stop WinDefend",
  165. "C:\\Windows\\system32\\cmd.exe /c sc delete WinDefend",
  166. "C:\\Windows\\system32\\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true",
  167. "C:\\Windows\\system32\\svchost.exe",
  168. "powershell Set-MpPreference -DisableRealtimeMonitoring $true",
  169. "sc stop WinDefend",
  170. "sc delete WinDefend",
  171. "C:\\Windows\\system32\\lsass.exe",
  172. "taskhost.exe $(Arg0)",
  173. "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
  174. "C:\\Windows\\system32\\WerFault.exe -u -p 356 -s 288"
  175. ]
  176.  
  177. [*] Mutexes: [
  178. "Local\\ZoneAttributeCacheCounterMutex",
  179. "Local\\ZonesCacheCounterMutex",
  180. "Local\\ZonesLockedCacheCounterMutex",
  181. "Global\\CLR_CASOFF_MUTEX",
  182. "Global\\838B6C9EB27932960",
  183. "Local\\WERReportingForProcess356",
  184. "Global\\\\xe5\\x88\\x90\\xc2\\x9e"
  185. ]
  186.  
  187. [*] Modified Files: [
  188. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-0000000000-0000000000-0000000000-1000\\00000000-0000-0000-0000-000000000000b_00000000-0000-0000-0000-000000000000",
  189. "C:\\Users\\user\\AppData\\Local\\Temp\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  190. "\\??\\PIPE\\srvsvc",
  191. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\UQJR17LCL8LHIIRRH6YX.temp",
  192. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1031560.TMP",
  193. "C:\\Windows\\SysWOW64\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  194. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\DP4YV9KVQHIMHSBMEBOB.temp",
  195. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms",
  196. "C:\\Windows\\sysnative\\LogFiles\\Scm\\4963ad21-c4a5-42a5-b9bd-e441d57204fe",
  197. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERCC21.tmp.appcompat.txt",
  198. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERCF6E.tmp.WERInternalMetadata.xml",
  199. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERCF8E.tmp.hdmp"
  200. ]
  201.  
  202. [*] Deleted Files: [
  203. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1031560.TMP",
  204. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.1824.16993859",
  205. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1824.16993859",
  206. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.1824.16993859",
  207. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\DP4YV9KVQHIMHSBMEBOB.temp",
  208. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2904.17014359",
  209. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2904.17014375",
  210. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2904.17014375",
  211. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERCC21.tmp",
  212. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERCC21.tmp.appcompat.txt",
  213. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERCF6E.tmp",
  214. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERCF6E.tmp.WERInternalMetadata.xml",
  215. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERCF8E.tmp",
  216. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERCF8E.tmp.hdmp"
  217. ]
  218.  
  219. [*] Modified Registry Keys: [
  220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  222. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender",
  223. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\DisableAntiSpyware",
  224. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection",
  225. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring",
  226. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection",
  227. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnRealtimeEnable",
  228. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableIOAVProtection",
  229. "DisableNotifications",
  230. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  231. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WerSvc\\Type",
  232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent",
  233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent"
  234. ]
  235.  
  236. [*] Deleted Registry Keys: [
  237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  238. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  240. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  241. ]
  242.  
  243. [*] DNS Communications: []
  244.  
  245. [*] Domains: []
  246.  
  247. [*] Network Communication - ICMP: []
  248.  
  249. [*] Network Communication - HTTP: []
  250.  
  251. [*] Network Communication - SMTP: []
  252.  
  253. [*] Network Communication - Hosts: []
  254.  
  255. [*] Network Communication - IRC: []
  256.  
  257. [*] Static Analysis: {
  258. "pe": {
  259. "peid_signatures": null,
  260. "imports": [
  261. {
  262. "imports": [
  263. {
  264. "name": "InitCommonControlsEx",
  265. "address": "0x404008"
  266. },
  267. {
  268. "name": null,
  269. "address": "0x40400c"
  270. }
  271. ],
  272. "dll": "COMCTL32.dll"
  273. },
  274. {
  275. "imports": [
  276. {
  277. "name": "IsDebuggerPresent",
  278. "address": "0x404044"
  279. },
  280. {
  281. "name": "SetUnhandledExceptionFilter",
  282. "address": "0x404048"
  283. },
  284. {
  285. "name": "UnhandledExceptionFilter",
  286. "address": "0x40404c"
  287. },
  288. {
  289. "name": "GetCurrentProcess",
  290. "address": "0x404050"
  291. },
  292. {
  293. "name": "TerminateProcess",
  294. "address": "0x404054"
  295. },
  296. {
  297. "name": "GetStartupInfoA",
  298. "address": "0x404058"
  299. },
  300. {
  301. "name": "QueryPerformanceCounter",
  302. "address": "0x40405c"
  303. },
  304. {
  305. "name": "Sleep",
  306. "address": "0x404060"
  307. },
  308. {
  309. "name": "InterlockedExchange",
  310. "address": "0x404064"
  311. },
  312. {
  313. "name": "GetSystemTimeAsFileTime",
  314. "address": "0x404068"
  315. },
  316. {
  317. "name": "LocalFree",
  318. "address": "0x40406c"
  319. },
  320. {
  321. "name": "FormatMessageA",
  322. "address": "0x404070"
  323. },
  324. {
  325. "name": "GetLastError",
  326. "address": "0x404074"
  327. },
  328. {
  329. "name": "ReadFile",
  330. "address": "0x404078"
  331. },
  332. {
  333. "name": "GetTickCount",
  334. "address": "0x40407c"
  335. },
  336. {
  337. "name": "GetCurrentThreadId",
  338. "address": "0x404080"
  339. },
  340. {
  341. "name": "GetCurrentProcessId",
  342. "address": "0x404084"
  343. },
  344. {
  345. "name": "CreateFileMappingW",
  346. "address": "0x404088"
  347. },
  348. {
  349. "name": "MapViewOfFile",
  350. "address": "0x40408c"
  351. },
  352. {
  353. "name": "CreateFileA",
  354. "address": "0x404090"
  355. },
  356. {
  357. "name": "GetFileSize",
  358. "address": "0x404094"
  359. },
  360. {
  361. "name": "InterlockedCompareExchange",
  362. "address": "0x404098"
  363. },
  364. {
  365. "name": "CloseHandle",
  366. "address": "0x40409c"
  367. }
  368. ],
  369. "dll": "KERNEL32.dll"
  370. },
  371. {
  372. "imports": [
  373. {
  374. "name": "ShowCursor",
  375. "address": "0x40413c"
  376. },
  377. {
  378. "name": "SetCursor",
  379. "address": "0x404140"
  380. },
  381. {
  382. "name": "LoadCursorA",
  383. "address": "0x404144"
  384. },
  385. {
  386. "name": "InvalidateRect",
  387. "address": "0x404148"
  388. },
  389. {
  390. "name": "MoveWindow",
  391. "address": "0x40414c"
  392. },
  393. {
  394. "name": "SetWindowTextA",
  395. "address": "0x404150"
  396. },
  397. {
  398. "name": "SendMessageA",
  399. "address": "0x404154"
  400. },
  401. {
  402. "name": "GetSystemMetrics",
  403. "address": "0x404158"
  404. },
  405. {
  406. "name": "CreateWindowExA",
  407. "address": "0x40415c"
  408. },
  409. {
  410. "name": "GetWindowLongA",
  411. "address": "0x404160"
  412. },
  413. {
  414. "name": "PostQuitMessage",
  415. "address": "0x404164"
  416. },
  417. {
  418. "name": "RegisterClassA",
  419. "address": "0x404168"
  420. },
  421. {
  422. "name": "LoadIconA",
  423. "address": "0x40416c"
  424. },
  425. {
  426. "name": "ShowWindow",
  427. "address": "0x404170"
  428. },
  429. {
  430. "name": "TranslateMessage",
  431. "address": "0x404174"
  432. },
  433. {
  434. "name": "GetMessageA",
  435. "address": "0x404178"
  436. },
  437. {
  438. "name": "GetDC",
  439. "address": "0x40417c"
  440. },
  441. {
  442. "name": "CreateMenu",
  443. "address": "0x404180"
  444. },
  445. {
  446. "name": "AppendMenuA",
  447. "address": "0x404184"
  448. },
  449. {
  450. "name": "SetMenu",
  451. "address": "0x404188"
  452. },
  453. {
  454. "name": "SetScrollInfo",
  455. "address": "0x40418c"
  456. },
  457. {
  458. "name": "UpdateWindow",
  459. "address": "0x404190"
  460. },
  461. {
  462. "name": "BeginPaint",
  463. "address": "0x404194"
  464. },
  465. {
  466. "name": "GetClientRect",
  467. "address": "0x404198"
  468. },
  469. {
  470. "name": "FillRect",
  471. "address": "0x40419c"
  472. },
  473. {
  474. "name": "EndPaint",
  475. "address": "0x4041a0"
  476. },
  477. {
  478. "name": "ScrollWindowEx",
  479. "address": "0x4041a4"
  480. },
  481. {
  482. "name": "DefWindowProcA",
  483. "address": "0x4041a8"
  484. },
  485. {
  486. "name": "MessageBoxA",
  487. "address": "0x4041ac"
  488. },
  489. {
  490. "name": "DispatchMessageA",
  491. "address": "0x4041b0"
  492. }
  493. ],
  494. "dll": "USER32.dll"
  495. },
  496. {
  497. "imports": [
  498. {
  499. "name": "BitBlt",
  500. "address": "0x40401c"
  501. },
  502. {
  503. "name": "CreateSolidBrush",
  504. "address": "0x404020"
  505. },
  506. {
  507. "name": "SetDIBitsToDevice",
  508. "address": "0x404024"
  509. },
  510. {
  511. "name": "SelectObject",
  512. "address": "0x404028"
  513. },
  514. {
  515. "name": "CreateCompatibleBitmap",
  516. "address": "0x40402c"
  517. },
  518. {
  519. "name": "CreateCompatibleDC",
  520. "address": "0x404030"
  521. },
  522. {
  523. "name": "DeleteDC",
  524. "address": "0x404034"
  525. },
  526. {
  527. "name": "GetStockObject",
  528. "address": "0x404038"
  529. },
  530. {
  531. "name": "DeleteObject",
  532. "address": "0x40403c"
  533. }
  534. ],
  535. "dll": "GDI32.dll"
  536. },
  537. {
  538. "imports": [
  539. {
  540. "name": "GetOpenFileNameA",
  541. "address": "0x404014"
  542. }
  543. ],
  544. "dll": "COMDLG32.dll"
  545. },
  546. {
  547. "imports": [
  548. {
  549. "name": "CryptAcquireContextA",
  550. "address": "0x404000"
  551. }
  552. ],
  553. "dll": "ADVAPI32.dll"
  554. },
  555. {
  556. "imports": [
  557. {
  558. "name": "??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  559. "address": "0x4040a4"
  560. },
  561. {
  562. "name": "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  563. "address": "0x4040a8"
  564. },
  565. {
  566. "name": "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z",
  567. "address": "0x4040ac"
  568. },
  569. {
  570. "name": "??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z",
  571. "address": "0x4040b0"
  572. },
  573. {
  574. "name": "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z",
  575. "address": "0x4040b4"
  576. }
  577. ],
  578. "dll": "MSVCP90.dll"
  579. },
  580. {
  581. "imports": [
  582. {
  583. "name": "_lock",
  584. "address": "0x4040bc"
  585. },
  586. {
  587. "name": "__dllonexit",
  588. "address": "0x4040c0"
  589. },
  590. {
  591. "name": "_unlock",
  592. "address": "0x4040c4"
  593. },
  594. {
  595. "name": "?terminate@@YAXXZ",
  596. "address": "0x4040c8"
  597. },
  598. {
  599. "name": "_crt_debugger_hook",
  600. "address": "0x4040cc"
  601. },
  602. {
  603. "name": "_onexit",
  604. "address": "0x4040d0"
  605. },
  606. {
  607. "name": "__set_app_type",
  608. "address": "0x4040d4"
  609. },
  610. {
  611. "name": "_encode_pointer",
  612. "address": "0x4040d8"
  613. },
  614. {
  615. "name": "__p__fmode",
  616. "address": "0x4040dc"
  617. },
  618. {
  619. "name": "__p__commode",
  620. "address": "0x4040e0"
  621. },
  622. {
  623. "name": "_adjust_fdiv",
  624. "address": "0x4040e4"
  625. },
  626. {
  627. "name": "__setusermatherr",
  628. "address": "0x4040e8"
  629. },
  630. {
  631. "name": "_decode_pointer",
  632. "address": "0x4040ec"
  633. },
  634. {
  635. "name": "_except_handler4_common",
  636. "address": "0x4040f0"
  637. },
  638. {
  639. "name": "_invoke_watson",
  640. "address": "0x4040f4"
  641. },
  642. {
  643. "name": "_controlfp_s",
  644. "address": "0x4040f8"
  645. },
  646. {
  647. "name": "malloc",
  648. "address": "0x4040fc"
  649. },
  650. {
  651. "name": "free",
  652. "address": "0x404100"
  653. },
  654. {
  655. "name": "sprintf",
  656. "address": "0x404104"
  657. },
  658. {
  659. "name": "__CxxFrameHandler3",
  660. "address": "0x404108"
  661. },
  662. {
  663. "name": "_amsg_exit",
  664. "address": "0x40410c"
  665. },
  666. {
  667. "name": "__getmainargs",
  668. "address": "0x404110"
  669. },
  670. {
  671. "name": "_cexit",
  672. "address": "0x404114"
  673. },
  674. {
  675. "name": "_exit",
  676. "address": "0x404118"
  677. },
  678. {
  679. "name": "_XcptFilter",
  680. "address": "0x40411c"
  681. },
  682. {
  683. "name": "_ismbblead",
  684. "address": "0x404120"
  685. },
  686. {
  687. "name": "exit",
  688. "address": "0x404124"
  689. },
  690. {
  691. "name": "_acmdln",
  692. "address": "0x404128"
  693. },
  694. {
  695. "name": "_initterm",
  696. "address": "0x40412c"
  697. },
  698. {
  699. "name": "_initterm_e",
  700. "address": "0x404130"
  701. },
  702. {
  703. "name": "_configthreadlocale",
  704. "address": "0x404134"
  705. }
  706. ],
  707. "dll": "MSVCR90.dll"
  708. }
  709. ],
  710. "digital_signers": null,
  711. "exported_dll_name": null,
  712. "actual_checksum": "0x0005669a",
  713. "overlay": null,
  714. "imagebase": "0x00400000",
  715. "reported_checksum": "0x0005669a",
  716. "icon_hash": null,
  717. "entrypoint": "0x00402a57",
  718. "timestamp": "2019-06-25 13:41:15",
  719. "osversion": "5.0",
  720. "sections": [
  721. {
  722. "name": ".text",
  723. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  724. "virtual_address": "0x00001000",
  725. "size_of_data": "0x00002200",
  726. "entropy": "6.20",
  727. "raw_address": "0x00000400",
  728. "virtual_size": "0x00002164",
  729. "characteristics_raw": "0x60000020"
  730. },
  731. {
  732. "name": ".rdata",
  733. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  734. "virtual_address": "0x00004000",
  735. "size_of_data": "0x00039e00",
  736. "entropy": "6.06",
  737. "raw_address": "0x00002600",
  738. "virtual_size": "0x00039c8e",
  739. "characteristics_raw": "0x40000040"
  740. },
  741. {
  742. "name": ".data",
  743. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  744. "virtual_address": "0x0003e000",
  745. "size_of_data": "0x00000200",
  746. "entropy": "0.81",
  747. "raw_address": "0x0003c400",
  748. "virtual_size": "0x00000744",
  749. "characteristics_raw": "0xc0000040"
  750. },
  751. {
  752. "name": ".rsrc",
  753. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  754. "virtual_address": "0x0003f000",
  755. "size_of_data": "0x00017a00",
  756. "entropy": "5.32",
  757. "raw_address": "0x0003c600",
  758. "virtual_size": "0x00017842",
  759. "characteristics_raw": "0x40000040"
  760. }
  761. ],
  762. "resources": [],
  763. "dirents": [
  764. {
  765. "virtual_address": "0x00000000",
  766. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  767. "size": "0x00000000"
  768. },
  769. {
  770. "virtual_address": "0x0003d1cc",
  771. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  772. "size": "0x000000b4"
  773. },
  774. {
  775. "virtual_address": "0x0003f000",
  776. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  777. "size": "0x00017842"
  778. },
  779. {
  780. "virtual_address": "0x00000000",
  781. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  782. "size": "0x00000000"
  783. },
  784. {
  785. "virtual_address": "0x00000000",
  786. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  787. "size": "0x00000000"
  788. },
  789. {
  790. "virtual_address": "0x00000000",
  791. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  792. "size": "0x00000000"
  793. },
  794. {
  795. "virtual_address": "0x000041e0",
  796. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  797. "size": "0x0000001c"
  798. },
  799. {
  800. "virtual_address": "0x00000000",
  801. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  802. "size": "0x00000000"
  803. },
  804. {
  805. "virtual_address": "0x00000000",
  806. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  807. "size": "0x00000000"
  808. },
  809. {
  810. "virtual_address": "0x00000000",
  811. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  812. "size": "0x00000000"
  813. },
  814. {
  815. "virtual_address": "0x0003cff8",
  816. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  817. "size": "0x00000040"
  818. },
  819. {
  820. "virtual_address": "0x00000000",
  821. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  822. "size": "0x00000000"
  823. },
  824. {
  825. "virtual_address": "0x00004000",
  826. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  827. "size": "0x000001b8"
  828. },
  829. {
  830. "virtual_address": "0x00000000",
  831. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  832. "size": "0x00000000"
  833. },
  834. {
  835. "virtual_address": "0x00000000",
  836. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  837. "size": "0x00000000"
  838. },
  839. {
  840. "virtual_address": "0x00000000",
  841. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  842. "size": "0x00000000"
  843. }
  844. ],
  845. "exports": [],
  846. "guest_signers": {},
  847. "imphash": "e7090938ed62dc17f7da4646537d15ac",
  848. "icon_fuzzy": null,
  849. "icon": null,
  850. "pdbpath": "000000000000000000000000000000000000000000000000000000000000",
  851. "imported_dll_count": 8,
  852. "versioninfo": []
  853. }
  854. }
  855.  
  856. [*] Resolved APIs: [
  857. "cryptsp.dll.CryptAcquireContextA",
  858. "kernel32.dll.VirtualAlloc",
  859. "ntdll.dll.memcpy",
  860. "kernel32.dll.GetCurrentProcess",
  861. "kernel32.dll.CloseHandle",
  862. "advapi32.dll.OpenProcessToken",
  863. "advapi32.dll.GetTokenInformation",
  864. "kernel32.dll.Wow64EnableWow64FsRedirection",
  865. "advapi32.dll.RegCloseKey",
  866. "advapi32.dll.RegCreateKeyW",
  867. "advapi32.dll.RegOpenKeyExW",
  868. "advapi32.dll.RegSetValueExW",
  869. "shell32.dll.ShellExecuteA",
  870. "ole32.dll.OleInitialize",
  871. "cryptbase.dll.SystemFunction036",
  872. "ole32.dll.CreateBindCtx",
  873. "ole32.dll.CoTaskMemAlloc",
  874. "propsys.dll.PSCreateMemoryPropertyStore",
  875. "propsys.dll.PSPropertyBag_WriteDWORD",
  876. "ole32.dll.CoGetApartmentType",
  877. "ole32.dll.CoRegisterInitializeSpy",
  878. "ole32.dll.CoTaskMemFree",
  879. "comctl32.dll.#236",
  880. "oleaut32.dll.#6",
  881. "ole32.dll.CoGetMalloc",
  882. "propsys.dll.PSPropertyBag_ReadDWORD",
  883. "propsys.dll.PSPropertyBag_ReadGUID",
  884. "comctl32.dll.#320",
  885. "comctl32.dll.#324",
  886. "comctl32.dll.#323",
  887. "advapi32.dll.RegEnumKeyW",
  888. "advapi32.dll.OpenThreadToken",
  889. "ole32.dll.StringFromGUID2",
  890. "apphelp.dll.ApphelpCheckShellObject",
  891. "ole32.dll.CoCreateInstance",
  892. "urlmon.dll.CreateUri",
  893. "kernel32.dll.InitializeSRWLock",
  894. "kernel32.dll.AcquireSRWLockExclusive",
  895. "kernel32.dll.AcquireSRWLockShared",
  896. "kernel32.dll.ReleaseSRWLockExclusive",
  897. "kernel32.dll.ReleaseSRWLockShared",
  898. "comctl32.dll.#328",
  899. "comctl32.dll.#334",
  900. "oleaut32.dll.#2",
  901. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  902. "shell32.dll.#102",
  903. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  904. "propsys.dll.PSPropertyBag_ReadStrAlloc",
  905. "comctl32.dll.#332",
  906. "ole32.dll.CoInitializeEx",
  907. "comctl32.dll.#386",
  908. "advapi32.dll.InitializeSecurityDescriptor",
  909. "advapi32.dll.SetEntriesInAclW",
  910. "ntmarta.dll.GetMartaExtensionInterface",
  911. "advapi32.dll.SetSecurityDescriptorDacl",
  912. "advapi32.dll.IsTextUnicode",
  913. "comctl32.dll.#338",
  914. "comctl32.dll.#339",
  915. "ole32.dll.CoUninitialize",
  916. "sechost.dll.ConvertSidToStringSidW",
  917. "profapi.dll.#104",
  918. "propsys.dll.#430",
  919. "advapi32.dll.RegGetValueW",
  920. "ole32.dll.CoTaskMemRealloc",
  921. "propsys.dll.InitPropVariantFromStringAsVector",
  922. "propsys.dll.PSCoerceToCanonicalValue",
  923. "propsys.dll.PropVariantToStringAlloc",
  924. "ole32.dll.PropVariantClear",
  925. "ole32.dll.CoAllowSetForegroundWindow",
  926. "shell32.dll.SHGetFolderPathW",
  927. "advapi32.dll.SaferGetPolicyInformation",
  928. "ntdll.dll.RtlDllShutdownInProgress",
  929. "comctl32.dll.#329",
  930. "ole32.dll.OleUninitialize",
  931. "ole32.dll.CoRevokeInitializeSpy",
  932. "comctl32.dll.#388",
  933. "oleaut32.dll.#500",
  934. "advapi32.dll.CryptAcquireContextA",
  935. "advapi32.dll.CryptImportKey",
  936. "advapi32.dll.CryptEncrypt",
  937. "cryptsp.dll.CryptImportKey",
  938. "cryptbase.dll.SystemFunction040",
  939. "cryptbase.dll.SystemFunction041",
  940. "cryptsp.dll.CryptEncrypt",
  941. "advapi32.dll.UnregisterTraceGuids",
  942. "comctl32.dll.#321",
  943. "kernel32.dll.SetThreadUILanguage",
  944. "kernel32.dll.CopyFileExW",
  945. "kernel32.dll.IsDebuggerPresent",
  946. "kernel32.dll.SetConsoleInputExeNameW",
  947. "kernel32.dll.SortGetHandle",
  948. "kernel32.dll.SortCloseHandle",
  949. "uxtheme.dll.ThemeInitApiHook",
  950. "user32.dll.IsProcessDPIAware",
  951. "shell32.dll.#66",
  952. "comctl32.dll.#385",
  953. "comctl32.dll.#336",
  954. "linkinfo.dll.IsValidLinkInfo",
  955. "comctl32.dll.#333",
  956. "propsys.dll.#417",
  957. "propsys.dll.PSGetNameFromPropertyKey",
  958. "propsys.dll.PSStringFromPropertyKey",
  959. "propsys.dll.InitVariantFromBuffer",
  960. "oleaut32.dll.#9",
  961. "propsys.dll.PropVariantToGUID",
  962. "linkinfo.dll.CreateLinkInfoW",
  963. "user32.dll.IsCharAlphaW",
  964. "user32.dll.CharPrevW",
  965. "ntshrui.dll.GetNetResourceFromLocalPathW",
  966. "srvcli.dll.NetShareEnum",
  967. "cscapi.dll.CscNetApiGetInterface",
  968. "slc.dll.SLGetWindowsInformationDWORD",
  969. "shlwapi.dll.PathRemoveFileSpecW",
  970. "linkinfo.dll.DestroyLinkInfo",
  971. "propsys.dll.PropVariantToBoolean",
  972. "cryptsp.dll.CryptAcquireContextW",
  973. "cryptsp.dll.CryptGenRandom",
  974. "cryptsp.dll.CryptReleaseContext",
  975. "advapi32.dll.GetSecurityInfo",
  976. "advapi32.dll.SetSecurityInfo",
  977. "advapi32.dll.GetSecurityDescriptorControl",
  978. "advapi32.dll.RegQueryInfoKeyW",
  979. "advapi32.dll.RegEnumKeyExW",
  980. "advapi32.dll.RegEnumValueW",
  981. "advapi32.dll.RegQueryValueExW",
  982. "shlwapi.dll.UrlIsW",
  983. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  984. "msvcrt.dll._set_error_mode",
  985. "msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z",
  986. "kernel32.dll.FindActCtxSectionStringW",
  987. "kernel32.dll.GetSystemWindowsDirectoryW",
  988. "mscoree.dll.GetProcessExecutableHeap",
  989. "mscorwks.dll.DllGetClassObjectInternal",
  990. "mscorwks.dll.GetCLRFunction",
  991. "advapi32.dll.RegisterTraceGuidsW",
  992. "advapi32.dll.GetTraceLoggerHandle",
  993. "advapi32.dll.GetTraceEnableLevel",
  994. "advapi32.dll.GetTraceEnableFlags",
  995. "advapi32.dll.TraceEvent",
  996. "mscoree.dll.IEE",
  997. "mscorwks.dll.IEE",
  998. "mscoree.dll.GetStartupFlags",
  999. "mscoree.dll.GetHostConfigurationFile",
  1000. "mscoree.dll.GetCORSystemDirectory",
  1001. "ntdll.dll.RtlVirtualUnwind",
  1002. "kernel32.dll.IsWow64Process",
  1003. "advapi32.dll.AllocateAndInitializeSid",
  1004. "advapi32.dll.InitializeAcl",
  1005. "advapi32.dll.AddAccessAllowedAce",
  1006. "advapi32.dll.FreeSid",
  1007. "kernel32.dll.SetThreadStackGuarantee",
  1008. "kernel32.dll.FlsSetValue",
  1009. "kernel32.dll.FlsGetValue",
  1010. "kernel32.dll.FlsAlloc",
  1011. "kernel32.dll.FlsFree",
  1012. "kernel32.dll.AddVectoredContinueHandler",
  1013. "kernel32.dll.RemoveVectoredContinueHandler",
  1014. "advapi32.dll.ConvertSidToStringSidW",
  1015. "kernel32.dll.FlushProcessWriteBuffers",
  1016. "kernel32.dll.GetWriteWatch",
  1017. "kernel32.dll.ResetWriteWatch",
  1018. "kernel32.dll.CreateMemoryResourceNotification",
  1019. "kernel32.dll.QueryMemoryResourceNotification",
  1020. "kernel32.dll.GlobalMemoryStatusEx",
  1021. "ole32.dll.CoGetContextToken",
  1022. "oleaut32.dll.#149",
  1023. "kernel32.dll.GetUserDefaultUILanguage",
  1024. "kernel32.dll.GetVersionExW",
  1025. "kernel32.dll.GetFullPathNameW",
  1026. "kernel32.dll.SetErrorMode",
  1027. "kernel32.dll.GetFileAttributesExW",
  1028. "version.dll.GetFileVersionInfoSizeW",
  1029. "version.dll.GetFileVersionInfoW",
  1030. "version.dll.VerQueryValueW",
  1031. "kernel32.dll.lstrlen",
  1032. "kernel32.dll.lstrlenW",
  1033. "mscoree.dll.ND_RI2",
  1034. "kernel32.dll.lstrcpy",
  1035. "kernel32.dll.lstrcpyW",
  1036. "version.dll.VerLanguageNameW",
  1037. "kernel32.dll.GetCurrentProcessId",
  1038. "advapi32.dll.LookupPrivilegeValueW",
  1039. "advapi32.dll.AdjustTokenPrivileges",
  1040. "kernel32.dll.OpenProcess",
  1041. "psapi.dll.EnumProcessModules",
  1042. "psapi.dll.GetModuleInformation",
  1043. "psapi.dll.GetModuleBaseNameW",
  1044. "psapi.dll.GetModuleFileNameExW",
  1045. "kernel32.dll.GetExitCodeProcess",
  1046. "ntdll.dll.NtQuerySystemInformation",
  1047. "user32.dll.EnumWindows",
  1048. "user32.dll.GetWindowThreadProcessId",
  1049. "kernel32.dll.WerSetFlags",
  1050. "kernel32.dll.SetThreadPreferredUILanguages",
  1051. "kernel32.dll.GetThreadPreferredUILanguages",
  1052. "kernel32.dll.GetUserDefaultLocaleName",
  1053. "kernel32.dll.GetEnvironmentVariableW",
  1054. "advapi32.dll.CryptReleaseContext",
  1055. "advapi32.dll.CryptCreateHash",
  1056. "advapi32.dll.CryptDestroyHash",
  1057. "advapi32.dll.CryptHashData",
  1058. "advapi32.dll.CryptGetHashParam",
  1059. "advapi32.dll.CryptExportKey",
  1060. "advapi32.dll.CryptGenKey",
  1061. "advapi32.dll.CryptGetKeyParam",
  1062. "advapi32.dll.CryptDestroyKey",
  1063. "advapi32.dll.CryptVerifySignatureA",
  1064. "advapi32.dll.CryptSignHashA",
  1065. "advapi32.dll.CryptGetProvParam",
  1066. "advapi32.dll.CryptGetUserKey",
  1067. "advapi32.dll.CryptEnumProvidersA",
  1068. "cryptsp.dll.CryptHashData",
  1069. "cryptsp.dll.CryptGetHashParam",
  1070. "cryptsp.dll.CryptDestroyHash",
  1071. "cryptsp.dll.CryptDestroyKey",
  1072. "mscoree.dll.GetTokenForVTableEntry",
  1073. "mscoree.dll.SetTargetForVTableEntry",
  1074. "mscoree.dll.GetTargetForVTableEntry",
  1075. "culture.dll.ConvertLangIdToCultureName",
  1076. "ole32.dll.CoCreateGuid",
  1077. "kernel32.dll.CreateFileW",
  1078. "kernel32.dll.GetConsoleScreenBufferInfo",
  1079. "kernel32.dll.LocalFree",
  1080. "kernel32.dll.LocalAlloc",
  1081. "mscoree.dll.ND_RI4",
  1082. "advapi32.dll.DuplicateTokenEx",
  1083. "advapi32.dll.CheckTokenMembership",
  1084. "kernel32.dll.GetConsoleTitleW",
  1085. "mscorjit.dll.getJit",
  1086. "kernel32.dll.SetConsoleTitleW",
  1087. "kernel32.dll.SetConsoleCtrlHandler",
  1088. "kernel32.dll.CreateEventW",
  1089. "ntdll.dll.WinSqmIsOptedIn",
  1090. "kernel32.dll.ExpandEnvironmentStringsW",
  1091. "shfolder.dll.SHGetFolderPathW",
  1092. "kernel32.dll.SetEnvironmentVariableW",
  1093. "kernel32.dll.GetACP",
  1094. "kernel32.dll.UnmapViewOfFile",
  1095. "kernel32.dll.GetFileType",
  1096. "kernel32.dll.ReadFile",
  1097. "kernel32.dll.GetSystemInfo",
  1098. "kernel32.dll.VirtualQuery",
  1099. "secur32.dll.GetUserNameExW",
  1100. "advapi32.dll.GetUserNameW",
  1101. "kernel32.dll.ReleaseMutex",
  1102. "advapi32.dll.RegisterEventSourceW",
  1103. "advapi32.dll.DeregisterEventSource",
  1104. "advapi32.dll.ReportEventW",
  1105. "kernel32.dll.GetLogicalDrives",
  1106. "kernel32.dll.GetDriveTypeW",
  1107. "kernel32.dll.GetVolumeInformationW",
  1108. "kernel32.dll.GetCurrentDirectoryW",
  1109. "kernel32.dll.GetLastError",
  1110. "kernel32.dll.GetStdHandle",
  1111. "kernel32.dll.GetConsoleMode",
  1112. "kernel32.dll.SetEvent",
  1113. "kernel32.dll.FindFirstFileW",
  1114. "kernel32.dll.FindClose",
  1115. "mscoree.dll.DllGetClassObject",
  1116. "diasymreader.dll.DllGetClassObjectInternal",
  1117. "kernel32.dll.GetConsoleOutputCP",
  1118. "gdi32.dll.TranslateCharsetInfo",
  1119. "kernel32.dll.SetConsoleTextAttribute",
  1120. "kernel32.dll.WriteConsoleW",
  1121. "mscoree.dll.CorExitProcess",
  1122. "mscorwks.dll.CorExitProcess",
  1123. "mscorwks.dll._CorDllMain",
  1124. "kernel32.dll.CreateActCtxW",
  1125. "kernel32.dll.AddRefActCtx",
  1126. "kernel32.dll.ReleaseActCtx",
  1127. "kernel32.dll.ActivateActCtx",
  1128. "kernel32.dll.DeactivateActCtx",
  1129. "kernel32.dll.GetCurrentActCtx",
  1130. "kernel32.dll.QueryActCtxW",
  1131. "netutils.dll.NetApiBufferFree",
  1132. "kernel32.dll.IsProcessorFeaturePresent",
  1133. "ntdll.dll.RtlUnwind",
  1134. "mscoree.dll._CorExeMain",
  1135. "mscoree.dll._CorImageUnloading",
  1136. "mscoree.dll._CorValidateImage",
  1137. "cryptsp.dll.CryptExportKey",
  1138. "cryptsp.dll.CryptCreateHash",
  1139. "kernel32.dll.SwitchToThread",
  1140. "rpcrt4.dll.UuidFromStringW",
  1141. "rpcrt4.dll.RpcBindingCreateW",
  1142. "rpcrt4.dll.RpcBindingBind",
  1143. "sechost.dll.OpenSCManagerW",
  1144. "sechost.dll.OpenServiceW",
  1145. "sechost.dll.StartServiceW",
  1146. "sechost.dll.CloseServiceHandle",
  1147. "sechost.dll.LookupAccountNameLocalW",
  1148. "advapi32.dll.LookupAccountSidW",
  1149. "sechost.dll.LookupAccountSidLocalW",
  1150. "wersvc.dll.ServiceMain",
  1151. "wersvc.dll.SvchostPushServiceGlobals",
  1152. "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  1153. "faultrep.dll.WerpInitiateCrashReporting",
  1154. "wer.dll.WerpCreateMachineStore",
  1155. "shell32.dll.SHGetFolderPathEx",
  1156. "userenv.dll.CreateEnvironmentBlock",
  1157. "sspicli.dll.GetUserNameExW",
  1158. "userenv.dll.DestroyEnvironmentBlock",
  1159. "imm32.dll.ImmDisableIME",
  1160. "wer.dll.WerpCreateIntegratorReportId",
  1161. "wer.dll.WerReportCreate",
  1162. "wer.dll.WerpSetIntegratorReportId",
  1163. "wer.dll.WerReportSetParameter",
  1164. "dbgeng.dll.DebugCreate",
  1165. "ntdll.dll.CsrGetProcessId",
  1166. "ntdll.dll.DbgBreakPoint",
  1167. "ntdll.dll.DbgPrint",
  1168. "ntdll.dll.DbgPrompt",
  1169. "ntdll.dll.DbgUiConvertStateChangeStructure",
  1170. "ntdll.dll.DbgUiGetThreadDebugObject",
  1171. "ntdll.dll.DbgUiIssueRemoteBreakin",
  1172. "ntdll.dll.DbgUiSetThreadDebugObject",
  1173. "ntdll.dll.NtAllocateVirtualMemory",
  1174. "ntdll.dll.NtClose",
  1175. "ntdll.dll.NtCreateDebugObject",
  1176. "ntdll.dll.NtCreateFile",
  1177. "ntdll.dll.NtDebugActiveProcess",
  1178. "ntdll.dll.NtDebugContinue",
  1179. "ntdll.dll.NtFreeVirtualMemory",
  1180. "ntdll.dll.NtOpenProcess",
  1181. "ntdll.dll.NtOpenThread",
  1182. "ntdll.dll.NtQueryInformationProcess",
  1183. "ntdll.dll.NtQueryInformationThread",
  1184. "ntdll.dll.NtQueryMutant",
  1185. "ntdll.dll.NtQueryObject",
  1186. "ntdll.dll.NtRemoveProcessDebug",
  1187. "ntdll.dll.NtResumeThread",
  1188. "ntdll.dll.NtSetInformationDebugObject",
  1189. "ntdll.dll.NtSetInformationProcess",
  1190. "ntdll.dll.NtSystemDebugControl",
  1191. "ntdll.dll.NtWaitForDebugEvent",
  1192. "ntdll.dll.RtlAnsiStringToUnicodeString",
  1193. "ntdll.dll.RtlCreateProcessParameters",
  1194. "ntdll.dll.RtlCreateUserProcess",
  1195. "ntdll.dll.RtlDestroyProcessParameters",
  1196. "ntdll.dll.RtlDosPathNameToNtPathName_U",
  1197. "ntdll.dll.RtlFindMessage",
  1198. "ntdll.dll.RtlFreeHeap",
  1199. "ntdll.dll.RtlFreeUnicodeString",
  1200. "ntdll.dll.RtlGetFunctionTableListHead",
  1201. "ntdll.dll.RtlGetUnloadEventTrace",
  1202. "ntdll.dll.RtlGetUnloadEventTraceEx",
  1203. "ntdll.dll.RtlInitAnsiString",
  1204. "ntdll.dll.RtlInitUnicodeString",
  1205. "ntdll.dll.RtlTryEnterCriticalSection",
  1206. "ntdll.dll.RtlUnicodeStringToAnsiString",
  1207. "ntdll.dll.NtOpenProcessToken",
  1208. "ntdll.dll.NtOpenThreadToken",
  1209. "ntdll.dll.NtQueryInformationToken",
  1210. "kernel32.dll.CloseProfileUserMapping",
  1211. "kernel32.dll.CreateToolhelp32Snapshot",
  1212. "kernel32.dll.DebugActiveProcessStop",
  1213. "kernel32.dll.DebugBreak",
  1214. "kernel32.dll.DebugBreakProcess",
  1215. "kernel32.dll.DebugSetProcessKillOnExit",
  1216. "kernel32.dll.Module32First",
  1217. "kernel32.dll.Module32FirstW",
  1218. "kernel32.dll.Module32Next",
  1219. "kernel32.dll.Module32NextW",
  1220. "kernel32.dll.OpenThread",
  1221. "kernel32.dll.Process32First",
  1222. "kernel32.dll.Process32FirstW",
  1223. "kernel32.dll.Process32Next",
  1224. "kernel32.dll.Process32NextW",
  1225. "kernel32.dll.ProcessIdToSessionId",
  1226. "kernel32.dll.SetProcessShutdownParameters",
  1227. "kernel32.dll.Thread32First",
  1228. "kernel32.dll.Thread32Next",
  1229. "kernel32.dll.GetTimeZoneInformation",
  1230. "kernel32.dll.DuplicateHandle",
  1231. "kernel32.dll.Wow64GetThreadSelectorEntry",
  1232. "advapi32.dll.CloseServiceHandle",
  1233. "advapi32.dll.ControlService",
  1234. "advapi32.dll.CreateServiceA",
  1235. "advapi32.dll.CreateServiceW",
  1236. "advapi32.dll.DeleteService",
  1237. "advapi32.dll.EnumServicesStatusExA",
  1238. "advapi32.dll.EnumServicesStatusExW",
  1239. "advapi32.dll.GetEventLogInformation",
  1240. "advapi32.dll.OpenSCManagerA",
  1241. "advapi32.dll.OpenSCManagerW",
  1242. "advapi32.dll.OpenServiceA",
  1243. "advapi32.dll.OpenServiceW",
  1244. "advapi32.dll.StartServiceA",
  1245. "advapi32.dll.StartServiceW",
  1246. "advapi32.dll.GetSidSubAuthority",
  1247. "advapi32.dll.GetSidSubAuthorityCount",
  1248. "version.dll.GetFileVersionInfoSizeExW",
  1249. "version.dll.GetFileVersionInfoExW",
  1250. "dbghelp.dll.WinDbgExtensionDllInit",
  1251. "dbghelp.dll.ExtensionApiVersion",
  1252. "wer.dll.WerpSetDynamicParameter",
  1253. "wer.dll.WerReportAddDump",
  1254. "wer.dll.WerpSetCallBack",
  1255. "wer.dll.WerReportSetUIOption",
  1256. "wer.dll.WerpAddRegisteredDataToReport",
  1257. "wer.dll.WerReportSubmit",
  1258. "user32.dll.LoadStringW",
  1259. "advapi32.dll.RegCreateKeyExW",
  1260. "sensapi.dll.IsNetworkAlive",
  1261. "rpcrt4.dll.RpcBindingFromStringBindingW",
  1262. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  1263. "rpcrt4.dll.NdrClientCall3",
  1264. "user32.dll.CharUpperW",
  1265. "wer.dll.WerpAddAppCompatData",
  1266. "apphelp.dll.SdbGetFileAttributes",
  1267. "apphelp.dll.SdbFormatAttribute",
  1268. "apphelp.dll.SdbFreeFileAttributes",
  1269. "dbghelp.dll.MiniDumpWriteDump",
  1270. "kernel32.dll.GetLongPathNameA",
  1271. "kernel32.dll.GetLongPathNameW",
  1272. "kernel32.dll.GetProcessTimes",
  1273. "advapi32.dll.RegOpenKeyExA",
  1274. "advapi32.dll.RegQueryValueExA",
  1275. "powrprof.dll.CallNtPowerInformation",
  1276. "version.dll.GetFileVersionInfoSizeA",
  1277. "version.dll.GetFileVersionInfoA",
  1278. "version.dll.VerQueryValueA"
  1279. ]
  1280.  
  1281. [*] Static Analysis: {
  1282. "pe": {
  1283. "peid_signatures": null,
  1284. "imports": [
  1285. {
  1286. "imports": [
  1287. {
  1288. "name": "InitCommonControlsEx",
  1289. "address": "0x404008"
  1290. },
  1291. {
  1292. "name": null,
  1293. "address": "0x40400c"
  1294. }
  1295. ],
  1296. "dll": "COMCTL32.dll"
  1297. },
  1298. {
  1299. "imports": [
  1300. {
  1301. "name": "IsDebuggerPresent",
  1302. "address": "0x404044"
  1303. },
  1304. {
  1305. "name": "SetUnhandledExceptionFilter",
  1306. "address": "0x404048"
  1307. },
  1308. {
  1309. "name": "UnhandledExceptionFilter",
  1310. "address": "0x40404c"
  1311. },
  1312. {
  1313. "name": "GetCurrentProcess",
  1314. "address": "0x404050"
  1315. },
  1316. {
  1317. "name": "TerminateProcess",
  1318. "address": "0x404054"
  1319. },
  1320. {
  1321. "name": "GetStartupInfoA",
  1322. "address": "0x404058"
  1323. },
  1324. {
  1325. "name": "QueryPerformanceCounter",
  1326. "address": "0x40405c"
  1327. },
  1328. {
  1329. "name": "Sleep",
  1330. "address": "0x404060"
  1331. },
  1332. {
  1333. "name": "InterlockedExchange",
  1334. "address": "0x404064"
  1335. },
  1336. {
  1337. "name": "GetSystemTimeAsFileTime",
  1338. "address": "0x404068"
  1339. },
  1340. {
  1341. "name": "LocalFree",
  1342. "address": "0x40406c"
  1343. },
  1344. {
  1345. "name": "FormatMessageA",
  1346. "address": "0x404070"
  1347. },
  1348. {
  1349. "name": "GetLastError",
  1350. "address": "0x404074"
  1351. },
  1352. {
  1353. "name": "ReadFile",
  1354. "address": "0x404078"
  1355. },
  1356. {
  1357. "name": "GetTickCount",
  1358. "address": "0x40407c"
  1359. },
  1360. {
  1361. "name": "GetCurrentThreadId",
  1362. "address": "0x404080"
  1363. },
  1364. {
  1365. "name": "GetCurrentProcessId",
  1366. "address": "0x404084"
  1367. },
  1368. {
  1369. "name": "CreateFileMappingW",
  1370. "address": "0x404088"
  1371. },
  1372. {
  1373. "name": "MapViewOfFile",
  1374. "address": "0x40408c"
  1375. },
  1376. {
  1377. "name": "CreateFileA",
  1378. "address": "0x404090"
  1379. },
  1380. {
  1381. "name": "GetFileSize",
  1382. "address": "0x404094"
  1383. },
  1384. {
  1385. "name": "InterlockedCompareExchange",
  1386. "address": "0x404098"
  1387. },
  1388. {
  1389. "name": "CloseHandle",
  1390. "address": "0x40409c"
  1391. }
  1392. ],
  1393. "dll": "KERNEL32.dll"
  1394. },
  1395. {
  1396. "imports": [
  1397. {
  1398. "name": "ShowCursor",
  1399. "address": "0x40413c"
  1400. },
  1401. {
  1402. "name": "SetCursor",
  1403. "address": "0x404140"
  1404. },
  1405. {
  1406. "name": "LoadCursorA",
  1407. "address": "0x404144"
  1408. },
  1409. {
  1410. "name": "InvalidateRect",
  1411. "address": "0x404148"
  1412. },
  1413. {
  1414. "name": "MoveWindow",
  1415. "address": "0x40414c"
  1416. },
  1417. {
  1418. "name": "SetWindowTextA",
  1419. "address": "0x404150"
  1420. },
  1421. {
  1422. "name": "SendMessageA",
  1423. "address": "0x404154"
  1424. },
  1425. {
  1426. "name": "GetSystemMetrics",
  1427. "address": "0x404158"
  1428. },
  1429. {
  1430. "name": "CreateWindowExA",
  1431. "address": "0x40415c"
  1432. },
  1433. {
  1434. "name": "GetWindowLongA",
  1435. "address": "0x404160"
  1436. },
  1437. {
  1438. "name": "PostQuitMessage",
  1439. "address": "0x404164"
  1440. },
  1441. {
  1442. "name": "RegisterClassA",
  1443. "address": "0x404168"
  1444. },
  1445. {
  1446. "name": "LoadIconA",
  1447. "address": "0x40416c"
  1448. },
  1449. {
  1450. "name": "ShowWindow",
  1451. "address": "0x404170"
  1452. },
  1453. {
  1454. "name": "TranslateMessage",
  1455. "address": "0x404174"
  1456. },
  1457. {
  1458. "name": "GetMessageA",
  1459. "address": "0x404178"
  1460. },
  1461. {
  1462. "name": "GetDC",
  1463. "address": "0x40417c"
  1464. },
  1465. {
  1466. "name": "CreateMenu",
  1467. "address": "0x404180"
  1468. },
  1469. {
  1470. "name": "AppendMenuA",
  1471. "address": "0x404184"
  1472. },
  1473. {
  1474. "name": "SetMenu",
  1475. "address": "0x404188"
  1476. },
  1477. {
  1478. "name": "SetScrollInfo",
  1479. "address": "0x40418c"
  1480. },
  1481. {
  1482. "name": "UpdateWindow",
  1483. "address": "0x404190"
  1484. },
  1485. {
  1486. "name": "BeginPaint",
  1487. "address": "0x404194"
  1488. },
  1489. {
  1490. "name": "GetClientRect",
  1491. "address": "0x404198"
  1492. },
  1493. {
  1494. "name": "FillRect",
  1495. "address": "0x40419c"
  1496. },
  1497. {
  1498. "name": "EndPaint",
  1499. "address": "0x4041a0"
  1500. },
  1501. {
  1502. "name": "ScrollWindowEx",
  1503. "address": "0x4041a4"
  1504. },
  1505. {
  1506. "name": "DefWindowProcA",
  1507. "address": "0x4041a8"
  1508. },
  1509. {
  1510. "name": "MessageBoxA",
  1511. "address": "0x4041ac"
  1512. },
  1513. {
  1514. "name": "DispatchMessageA",
  1515. "address": "0x4041b0"
  1516. }
  1517. ],
  1518. "dll": "USER32.dll"
  1519. },
  1520. {
  1521. "imports": [
  1522. {
  1523. "name": "BitBlt",
  1524. "address": "0x40401c"
  1525. },
  1526. {
  1527. "name": "CreateSolidBrush",
  1528. "address": "0x404020"
  1529. },
  1530. {
  1531. "name": "SetDIBitsToDevice",
  1532. "address": "0x404024"
  1533. },
  1534. {
  1535. "name": "SelectObject",
  1536. "address": "0x404028"
  1537. },
  1538. {
  1539. "name": "CreateCompatibleBitmap",
  1540. "address": "0x40402c"
  1541. },
  1542. {
  1543. "name": "CreateCompatibleDC",
  1544. "address": "0x404030"
  1545. },
  1546. {
  1547. "name": "DeleteDC",
  1548. "address": "0x404034"
  1549. },
  1550. {
  1551. "name": "GetStockObject",
  1552. "address": "0x404038"
  1553. },
  1554. {
  1555. "name": "DeleteObject",
  1556. "address": "0x40403c"
  1557. }
  1558. ],
  1559. "dll": "GDI32.dll"
  1560. },
  1561. {
  1562. "imports": [
  1563. {
  1564. "name": "GetOpenFileNameA",
  1565. "address": "0x404014"
  1566. }
  1567. ],
  1568. "dll": "COMDLG32.dll"
  1569. },
  1570. {
  1571. "imports": [
  1572. {
  1573. "name": "CryptAcquireContextA",
  1574. "address": "0x404000"
  1575. }
  1576. ],
  1577. "dll": "ADVAPI32.dll"
  1578. },
  1579. {
  1580. "imports": [
  1581. {
  1582. "name": "??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  1583. "address": "0x4040a4"
  1584. },
  1585. {
  1586. "name": "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  1587. "address": "0x4040a8"
  1588. },
  1589. {
  1590. "name": "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z",
  1591. "address": "0x4040ac"
  1592. },
  1593. {
  1594. "name": "??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z",
  1595. "address": "0x4040b0"
  1596. },
  1597. {
  1598. "name": "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z",
  1599. "address": "0x4040b4"
  1600. }
  1601. ],
  1602. "dll": "MSVCP90.dll"
  1603. },
  1604. {
  1605. "imports": [
  1606. {
  1607. "name": "_lock",
  1608. "address": "0x4040bc"
  1609. },
  1610. {
  1611. "name": "__dllonexit",
  1612. "address": "0x4040c0"
  1613. },
  1614. {
  1615. "name": "_unlock",
  1616. "address": "0x4040c4"
  1617. },
  1618. {
  1619. "name": "?terminate@@YAXXZ",
  1620. "address": "0x4040c8"
  1621. },
  1622. {
  1623. "name": "_crt_debugger_hook",
  1624. "address": "0x4040cc"
  1625. },
  1626. {
  1627. "name": "_onexit",
  1628. "address": "0x4040d0"
  1629. },
  1630. {
  1631. "name": "__set_app_type",
  1632. "address": "0x4040d4"
  1633. },
  1634. {
  1635. "name": "_encode_pointer",
  1636. "address": "0x4040d8"
  1637. },
  1638. {
  1639. "name": "__p__fmode",
  1640. "address": "0x4040dc"
  1641. },
  1642. {
  1643. "name": "__p__commode",
  1644. "address": "0x4040e0"
  1645. },
  1646. {
  1647. "name": "_adjust_fdiv",
  1648. "address": "0x4040e4"
  1649. },
  1650. {
  1651. "name": "__setusermatherr",
  1652. "address": "0x4040e8"
  1653. },
  1654. {
  1655. "name": "_decode_pointer",
  1656. "address": "0x4040ec"
  1657. },
  1658. {
  1659. "name": "_except_handler4_common",
  1660. "address": "0x4040f0"
  1661. },
  1662. {
  1663. "name": "_invoke_watson",
  1664. "address": "0x4040f4"
  1665. },
  1666. {
  1667. "name": "_controlfp_s",
  1668. "address": "0x4040f8"
  1669. },
  1670. {
  1671. "name": "malloc",
  1672. "address": "0x4040fc"
  1673. },
  1674. {
  1675. "name": "free",
  1676. "address": "0x404100"
  1677. },
  1678. {
  1679. "name": "sprintf",
  1680. "address": "0x404104"
  1681. },
  1682. {
  1683. "name": "__CxxFrameHandler3",
  1684. "address": "0x404108"
  1685. },
  1686. {
  1687. "name": "_amsg_exit",
  1688. "address": "0x40410c"
  1689. },
  1690. {
  1691. "name": "__getmainargs",
  1692. "address": "0x404110"
  1693. },
  1694. {
  1695. "name": "_cexit",
  1696. "address": "0x404114"
  1697. },
  1698. {
  1699. "name": "_exit",
  1700. "address": "0x404118"
  1701. },
  1702. {
  1703. "name": "_XcptFilter",
  1704. "address": "0x40411c"
  1705. },
  1706. {
  1707. "name": "_ismbblead",
  1708. "address": "0x404120"
  1709. },
  1710. {
  1711. "name": "exit",
  1712. "address": "0x404124"
  1713. },
  1714. {
  1715. "name": "_acmdln",
  1716. "address": "0x404128"
  1717. },
  1718. {
  1719. "name": "_initterm",
  1720. "address": "0x40412c"
  1721. },
  1722. {
  1723. "name": "_initterm_e",
  1724. "address": "0x404130"
  1725. },
  1726. {
  1727. "name": "_configthreadlocale",
  1728. "address": "0x404134"
  1729. }
  1730. ],
  1731. "dll": "MSVCR90.dll"
  1732. }
  1733. ],
  1734. "digital_signers": null,
  1735. "exported_dll_name": null,
  1736. "actual_checksum": "0x0005669a",
  1737. "overlay": null,
  1738. "imagebase": "0x00400000",
  1739. "reported_checksum": "0x0005669a",
  1740. "icon_hash": null,
  1741. "entrypoint": "0x00402a57",
  1742. "timestamp": "2019-06-25 13:41:15",
  1743. "osversion": "5.0",
  1744. "sections": [
  1745. {
  1746. "name": ".text",
  1747. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1748. "virtual_address": "0x00001000",
  1749. "size_of_data": "0x00002200",
  1750. "entropy": "6.20",
  1751. "raw_address": "0x00000400",
  1752. "virtual_size": "0x00002164",
  1753. "characteristics_raw": "0x60000020"
  1754. },
  1755. {
  1756. "name": ".rdata",
  1757. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1758. "virtual_address": "0x00004000",
  1759. "size_of_data": "0x00039e00",
  1760. "entropy": "6.06",
  1761. "raw_address": "0x00002600",
  1762. "virtual_size": "0x00039c8e",
  1763. "characteristics_raw": "0x40000040"
  1764. },
  1765. {
  1766. "name": ".data",
  1767. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1768. "virtual_address": "0x0003e000",
  1769. "size_of_data": "0x00000200",
  1770. "entropy": "0.81",
  1771. "raw_address": "0x0003c400",
  1772. "virtual_size": "0x00000744",
  1773. "characteristics_raw": "0xc0000040"
  1774. },
  1775. {
  1776. "name": ".rsrc",
  1777. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1778. "virtual_address": "0x0003f000",
  1779. "size_of_data": "0x00017a00",
  1780. "entropy": "5.32",
  1781. "raw_address": "0x0003c600",
  1782. "virtual_size": "0x00017842",
  1783. "characteristics_raw": "0x40000040"
  1784. }
  1785. ],
  1786. "resources": [],
  1787. "dirents": [
  1788. {
  1789. "virtual_address": "0x00000000",
  1790. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1791. "size": "0x00000000"
  1792. },
  1793. {
  1794. "virtual_address": "0x0003d1cc",
  1795. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1796. "size": "0x000000b4"
  1797. },
  1798. {
  1799. "virtual_address": "0x0003f000",
  1800. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1801. "size": "0x00017842"
  1802. },
  1803. {
  1804. "virtual_address": "0x00000000",
  1805. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1806. "size": "0x00000000"
  1807. },
  1808. {
  1809. "virtual_address": "0x00000000",
  1810. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1811. "size": "0x00000000"
  1812. },
  1813. {
  1814. "virtual_address": "0x00000000",
  1815. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1816. "size": "0x00000000"
  1817. },
  1818. {
  1819. "virtual_address": "0x000041e0",
  1820. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1821. "size": "0x0000001c"
  1822. },
  1823. {
  1824. "virtual_address": "0x00000000",
  1825. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1826. "size": "0x00000000"
  1827. },
  1828. {
  1829. "virtual_address": "0x00000000",
  1830. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1831. "size": "0x00000000"
  1832. },
  1833. {
  1834. "virtual_address": "0x00000000",
  1835. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1836. "size": "0x00000000"
  1837. },
  1838. {
  1839. "virtual_address": "0x0003cff8",
  1840. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1841. "size": "0x00000040"
  1842. },
  1843. {
  1844. "virtual_address": "0x00000000",
  1845. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1846. "size": "0x00000000"
  1847. },
  1848. {
  1849. "virtual_address": "0x00004000",
  1850. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1851. "size": "0x000001b8"
  1852. },
  1853. {
  1854. "virtual_address": "0x00000000",
  1855. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1856. "size": "0x00000000"
  1857. },
  1858. {
  1859. "virtual_address": "0x00000000",
  1860. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1861. "size": "0x00000000"
  1862. },
  1863. {
  1864. "virtual_address": "0x00000000",
  1865. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1866. "size": "0x00000000"
  1867. }
  1868. ],
  1869. "exports": [],
  1870. "guest_signers": {},
  1871. "imphash": "e7090938ed62dc17f7da4646537d15ac",
  1872. "icon_fuzzy": null,
  1873. "icon": null,
  1874. "pdbpath": "000000000000000000000000000000000000000000000000000000000000",
  1875. "imported_dll_count": 8,
  1876. "versioninfo": []
  1877. }
  1878. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!