API tools faq
paste
paladin316

TQPTZS_EXE.json

paladin316
Jun 20th, 2019
2,195
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 119.98 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 0.5
  5.  
  6. [*] File Name: "TQPTZS.EXE"
  7. [*] File Size: 349472
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "37600d8ef127026a42ad7c75e43cfc995aeddd902353297e12707e75959e6d08"
  10. [*] MD5: "eafc86be9694b713d5d359015e151379"
  11. [*] SHA1: "7bfafb720bcb8673198ef31b4f6ff25d7d2c0ad0"
  12. [*] SHA512: "f7b141e3f721ce7644c46834c79ca898b01483b61d97f271e021d465d33d6a1818c84a2ca922a02a8ac82f087d6cf20fbc0143f0b906d424659e23f4d5c254d1"
  13. [*] CRC32: "98DB6030"
  14. [*] SSDEEP: "6144:eL2JXnVIyIzHSeOTxqHGjzHy9QWBEDszNiyjzdxxOsgA:m2J3VIyI5KqHGjzy9QWCD4n"
  15.  
  16. [*] Process Execution: [
  17. "TQPTZS.EXE"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "File has been identified by 4 Antiviruses on VirusTotal as malicious",
  23. "Details": [
  24. {
  25. "Norman": "W32/FakeAV.W!genr"
  26. },
  27. {
  28. "eSafe": "Win32.TrojanHorse"
  29. },
  30. {
  31. "VIPRE": "Trojan.Win32.Generic.pak!cobra"
  32. },
  33. {
  34. "VBA32": "Rootkit.Ressdt.ajw"
  35. }
  36. ]
  37. }
  38. ]
  39.  
  40. [*] Started Service: []
  41.  
  42. [*] Executed Commands: [
  43. "rd /S /Q C:\\Windows\\system32\\gfhynrth.vir0"
  44. ]
  45.  
  46. [*] Mutexes: [
  47. "TQ Mutex",
  48. "CicLoadWinStaWinSta0",
  49. "Local\\MSCTF.CtfMonitorInstMutexDefault1"
  50. ]
  51.  
  52. [*] Modified Files: [
  53. "C:\\Users\\user\\AppData\\Local\\Temp\\TQAT\\krt.ini",
  54. "C:\\Windows\\System32\\gfhynrth.vir0"
  55. ]
  56.  
  57. [*] Deleted Files: [
  58. "C:\\Windows\\System32\\gfhynrth.dll",
  59. "C:\\Windows\\System32\\rhdhj.dll",
  60. "C:\\Windows\\System32\\yuker.dll",
  61. "C:\\Windows\\System32\\uyjtd.dll",
  62. "C:\\Windows\\System32\\dhugtj.dll",
  63. "C:\\Windows\\System32\\thef.dll",
  64. "C:\\Windows\\System32\\grgrjj.dll",
  65. "C:\\Windows\\System32\\midimapmy.dll",
  66. "C:\\Windows\\System32\\mpmyfapi.dll",
  67. "C:\\Windows\\System32\\mpmyhapi.dll",
  68. "C:\\Windows\\System32\\sdaf323.dll",
  69. "C:\\Windows\\System32\\jrhhh.dll",
  70. "C:\\Windows\\System32\\mmsystemmy.dll",
  71. "C:\\Users\\user\\AppData\\Local\\Temp\\DEL.TMP",
  72. "C:\\Users\\user\\AppData\\Local\\Temp\\TQAT\\tqsys.sys",
  73. "C:\\Users\\user\\AppData\\Local\\Temp\\TQAT\\TQProtect.exe",
  74. "C:\\Users\\user\\AppData\\Local\\Temp\\TQAT\\WlProtect.exe",
  75. "C:\\Users\\user\\AppData\\Local\\Temp\\TQAT\\WlzProtect.exe",
  76. "C:\\Users\\user\\AppData\\Local\\Temp\\TQAT\\wlpt.exe",
  77. "C:\\Users\\user\\AppData\\Local\\Temp\\TQAT\\WlzProtect.DAT",
  78. "C:\\Users\\user\\AppData\\Local\\Temp\\TQAT\\rn~r.exe",
  79. "C:\\Users\\user\\AppData\\Local\\Temp\\TQAT\\}qsm.exe",
  80. "C:\\Users\\user\\AppData\\Local\\Temp\\TQAT\\QSOU.EXE",
  81. "C:\\Users\\user\\AppData\\Local\\Temp\\TQAT\\QIPP.EXE",
  82. "C:\\Users\\user\\AppData\\Local\\Temp\\TQAT\\update.exe",
  83. "C:\\Users\\user\\AppData\\Local\\Temp\\TQAT\\NSPUHT.EXE",
  84. "C:\\Users\\user\\AppData\\Local\\Temp\\TQAT\\qvop.EXE",
  85. "C:\\Users\\user\\AppData\\Local\\Temp\\TQAT\\VXHV.EXE",
  86. "C:\\Users\\user\\AppData\\Local\\Temp\\TQAT\\tqst.EXE",
  87. "C:\\Users\\user\\AppData\\Local\\Temp\\rn~r.exe",
  88. "C:\\Users\\user\\AppData\\Local\\Temp\\}qsm.exe",
  89. "C:\\Users\\user\\AppData\\Local\\Temp\\QSOU.EXE",
  90. "C:\\Users\\user\\AppData\\Local\\Temp\\TQIT.exe",
  91. "C:\\Users\\user\\AppData\\Local\\Temp\\TQTT.exe",
  92. "C:\\Users\\user\\AppData\\Local\\Temp\\VXHV.EXE",
  93. "C:\\Users\\user\\AppData\\Local\\Temp\\tsqt.exe",
  94. "C:\\Users\\user\\AppData\\Local\\Temp\\ttsq.exe",
  95. "C:\\Users\\user\\AppData\\Local\\Temp\\tpat.exe",
  96. "C:\\Users\\user\\AppData\\Local\\Temp\\qtpt.exe",
  97. "C:\\Users\\user\\AppData\\Local\\Temp\\QIPP.EXE",
  98. "C:\\Users\\user\\AppData\\Local\\Temp\\NSPUHT.EXE",
  99. "C:\\Users\\user\\AppData\\Local\\Temp\\qvop.EXE",
  100. "C:\\Users\\user\\AppData\\Local\\Temp\\tqst.EXE",
  101. "C:\\Users\\user\\AppData\\Local\\Temp\\Ly5CfmSW.exe",
  102. "C:\\Users\\user\\AppData\\Local\\Temp\\qa9SoQGD.exe",
  103. "C:\\Users\\user\\AppData\\Local\\Temp\\UKhxpVQy.bat"
  104. ]
  105.  
  106. [*] Modified Registry Keys: []
  107.  
  108. [*] Deleted Registry Keys: []
  109.  
  110. [*] DNS Communications: []
  111.  
  112. [*] Domains: []
  113.  
  114. [*] Network Communication - ICMP: []
  115.  
  116. [*] Network Communication - HTTP: []
  117.  
  118. [*] Network Communication - SMTP: []
  119.  
  120. [*] Network Communication - Hosts: []
  121.  
  122. [*] Network Communication - IRC: []
  123.  
  124. [*] Static Analysis: {
  125. "pe": {
  126. "peid_signatures": null,
  127. "imports": [
  128. {
  129. "imports": [
  130. {
  131. "name": "SetStdHandle",
  132. "address": "0x42d118"
  133. },
  134. {
  135. "name": "GetFileType",
  136. "address": "0x42d11c"
  137. },
  138. {
  139. "name": "HeapReAlloc",
  140. "address": "0x42d120"
  141. },
  142. {
  143. "name": "HeapSize",
  144. "address": "0x42d124"
  145. },
  146. {
  147. "name": "GetACP",
  148. "address": "0x42d128"
  149. },
  150. {
  151. "name": "GetEnvironmentVariableA",
  152. "address": "0x42d12c"
  153. },
  154. {
  155. "name": "HeapDestroy",
  156. "address": "0x42d130"
  157. },
  158. {
  159. "name": "HeapCreate",
  160. "address": "0x42d134"
  161. },
  162. {
  163. "name": "VirtualFree",
  164. "address": "0x42d138"
  165. },
  166. {
  167. "name": "VirtualAlloc",
  168. "address": "0x42d13c"
  169. },
  170. {
  171. "name": "IsBadWritePtr",
  172. "address": "0x42d140"
  173. },
  174. {
  175. "name": "UnhandledExceptionFilter",
  176. "address": "0x42d144"
  177. },
  178. {
  179. "name": "FreeEnvironmentStringsA",
  180. "address": "0x42d148"
  181. },
  182. {
  183. "name": "FreeEnvironmentStringsW",
  184. "address": "0x42d14c"
  185. },
  186. {
  187. "name": "GetEnvironmentStrings",
  188. "address": "0x42d150"
  189. },
  190. {
  191. "name": "GetEnvironmentStringsW",
  192. "address": "0x42d154"
  193. },
  194. {
  195. "name": "RaiseException",
  196. "address": "0x42d158"
  197. },
  198. {
  199. "name": "GetStdHandle",
  200. "address": "0x42d15c"
  201. },
  202. {
  203. "name": "SetUnhandledExceptionFilter",
  204. "address": "0x42d160"
  205. },
  206. {
  207. "name": "LCMapStringA",
  208. "address": "0x42d164"
  209. },
  210. {
  211. "name": "LCMapStringW",
  212. "address": "0x42d168"
  213. },
  214. {
  215. "name": "GetStringTypeA",
  216. "address": "0x42d16c"
  217. },
  218. {
  219. "name": "GetStringTypeW",
  220. "address": "0x42d170"
  221. },
  222. {
  223. "name": "IsBadReadPtr",
  224. "address": "0x42d174"
  225. },
  226. {
  227. "name": "IsBadCodePtr",
  228. "address": "0x42d178"
  229. },
  230. {
  231. "name": "CompareStringA",
  232. "address": "0x42d17c"
  233. },
  234. {
  235. "name": "CompareStringW",
  236. "address": "0x42d180"
  237. },
  238. {
  239. "name": "SetEnvironmentVariableA",
  240. "address": "0x42d184"
  241. },
  242. {
  243. "name": "ExitProcess",
  244. "address": "0x42d188"
  245. },
  246. {
  247. "name": "GetCommandLineA",
  248. "address": "0x42d18c"
  249. },
  250. {
  251. "name": "GetProfileStringA",
  252. "address": "0x42d190"
  253. },
  254. {
  255. "name": "GetStartupInfoA",
  256. "address": "0x42d194"
  257. },
  258. {
  259. "name": "GetTimeZoneInformation",
  260. "address": "0x42d198"
  261. },
  262. {
  263. "name": "RtlUnwind",
  264. "address": "0x42d19c"
  265. },
  266. {
  267. "name": "GetTickCount",
  268. "address": "0x42d1a0"
  269. },
  270. {
  271. "name": "FileTimeToLocalFileTime",
  272. "address": "0x42d1a4"
  273. },
  274. {
  275. "name": "FileTimeToSystemTime",
  276. "address": "0x42d1a8"
  277. },
  278. {
  279. "name": "SetErrorMode",
  280. "address": "0x42d1ac"
  281. },
  282. {
  283. "name": "GetOEMCP",
  284. "address": "0x42d1b0"
  285. },
  286. {
  287. "name": "GetCPInfo",
  288. "address": "0x42d1b4"
  289. },
  290. {
  291. "name": "GetProcessVersion",
  292. "address": "0x42d1b8"
  293. },
  294. {
  295. "name": "TlsGetValue",
  296. "address": "0x42d1bc"
  297. },
  298. {
  299. "name": "LocalReAlloc",
  300. "address": "0x42d1c0"
  301. },
  302. {
  303. "name": "TlsSetValue",
  304. "address": "0x42d1c4"
  305. },
  306. {
  307. "name": "GlobalReAlloc",
  308. "address": "0x42d1c8"
  309. },
  310. {
  311. "name": "TlsFree",
  312. "address": "0x42d1cc"
  313. },
  314. {
  315. "name": "GlobalHandle",
  316. "address": "0x42d1d0"
  317. },
  318. {
  319. "name": "TlsAlloc",
  320. "address": "0x42d1d4"
  321. },
  322. {
  323. "name": "GlobalFlags",
  324. "address": "0x42d1d8"
  325. },
  326. {
  327. "name": "GetThreadLocale",
  328. "address": "0x42d1dc"
  329. },
  330. {
  331. "name": "GetFullPathNameA",
  332. "address": "0x42d1e0"
  333. },
  334. {
  335. "name": "GetVolumeInformationA",
  336. "address": "0x42d1e4"
  337. },
  338. {
  339. "name": "SetEndOfFile",
  340. "address": "0x42d1e8"
  341. },
  342. {
  343. "name": "UnlockFile",
  344. "address": "0x42d1ec"
  345. },
  346. {
  347. "name": "LockFile",
  348. "address": "0x42d1f0"
  349. },
  350. {
  351. "name": "FlushFileBuffers",
  352. "address": "0x42d1f4"
  353. },
  354. {
  355. "name": "SetFilePointer",
  356. "address": "0x42d1f8"
  357. },
  358. {
  359. "name": "ReadFile",
  360. "address": "0x42d1fc"
  361. },
  362. {
  363. "name": "DuplicateHandle",
  364. "address": "0x42d200"
  365. },
  366. {
  367. "name": "LeaveCriticalSection",
  368. "address": "0x42d204"
  369. },
  370. {
  371. "name": "DeleteCriticalSection",
  372. "address": "0x42d208"
  373. },
  374. {
  375. "name": "InitializeCriticalSection",
  376. "address": "0x42d20c"
  377. },
  378. {
  379. "name": "EnterCriticalSection",
  380. "address": "0x42d210"
  381. },
  382. {
  383. "name": "FindFirstFileA",
  384. "address": "0x42d214"
  385. },
  386. {
  387. "name": "FindClose",
  388. "address": "0x42d218"
  389. },
  390. {
  391. "name": "lstrcpynA",
  392. "address": "0x42d21c"
  393. },
  394. {
  395. "name": "GetFileTime",
  396. "address": "0x42d220"
  397. },
  398. {
  399. "name": "GetFileSize",
  400. "address": "0x42d224"
  401. },
  402. {
  403. "name": "FormatMessageA",
  404. "address": "0x42d228"
  405. },
  406. {
  407. "name": "LocalFree",
  408. "address": "0x42d22c"
  409. },
  410. {
  411. "name": "WaitForSingleObject",
  412. "address": "0x42d230"
  413. },
  414. {
  415. "name": "GlobalAlloc",
  416. "address": "0x42d234"
  417. },
  418. {
  419. "name": "lstrcmpA",
  420. "address": "0x42d238"
  421. },
  422. {
  423. "name": "GetCurrentThread",
  424. "address": "0x42d23c"
  425. },
  426. {
  427. "name": "MultiByteToWideChar",
  428. "address": "0x42d240"
  429. },
  430. {
  431. "name": "WideCharToMultiByte",
  432. "address": "0x42d244"
  433. },
  434. {
  435. "name": "InterlockedDecrement",
  436. "address": "0x42d248"
  437. },
  438. {
  439. "name": "InterlockedIncrement",
  440. "address": "0x42d24c"
  441. },
  442. {
  443. "name": "MulDiv",
  444. "address": "0x42d250"
  445. },
  446. {
  447. "name": "SetLastError",
  448. "address": "0x42d254"
  449. },
  450. {
  451. "name": "GetVersion",
  452. "address": "0x42d258"
  453. },
  454. {
  455. "name": "lstrcatA",
  456. "address": "0x42d25c"
  457. },
  458. {
  459. "name": "GetCurrentThreadId",
  460. "address": "0x42d260"
  461. },
  462. {
  463. "name": "GlobalGetAtomNameA",
  464. "address": "0x42d264"
  465. },
  466. {
  467. "name": "lstrcmpiA",
  468. "address": "0x42d268"
  469. },
  470. {
  471. "name": "GlobalAddAtomA",
  472. "address": "0x42d26c"
  473. },
  474. {
  475. "name": "GlobalFindAtomA",
  476. "address": "0x42d270"
  477. },
  478. {
  479. "name": "GlobalDeleteAtom",
  480. "address": "0x42d274"
  481. },
  482. {
  483. "name": "lstrcpyA",
  484. "address": "0x42d278"
  485. },
  486. {
  487. "name": "GetModuleHandleA",
  488. "address": "0x42d27c"
  489. },
  490. {
  491. "name": "GlobalLock",
  492. "address": "0x42d280"
  493. },
  494. {
  495. "name": "GlobalUnlock",
  496. "address": "0x42d284"
  497. },
  498. {
  499. "name": "GlobalFree",
  500. "address": "0x42d288"
  501. },
  502. {
  503. "name": "lstrlenA",
  504. "address": "0x42d28c"
  505. },
  506. {
  507. "name": "GetFileAttributesA",
  508. "address": "0x42d290"
  509. },
  510. {
  511. "name": "GetProcessHeap",
  512. "address": "0x42d294"
  513. },
  514. {
  515. "name": "HeapAlloc",
  516. "address": "0x42d298"
  517. },
  518. {
  519. "name": "HeapFree",
  520. "address": "0x42d29c"
  521. },
  522. {
  523. "name": "FindResourceA",
  524. "address": "0x42d2a0"
  525. },
  526. {
  527. "name": "SizeofResource",
  528. "address": "0x42d2a4"
  529. },
  530. {
  531. "name": "LoadResource",
  532. "address": "0x42d2a8"
  533. },
  534. {
  535. "name": "LockResource",
  536. "address": "0x42d2ac"
  537. },
  538. {
  539. "name": "WriteFile",
  540. "address": "0x42d2b0"
  541. },
  542. {
  543. "name": "SetFileAttributesA",
  544. "address": "0x42d2b4"
  545. },
  546. {
  547. "name": "MoveFileExA",
  548. "address": "0x42d2b8"
  549. },
  550. {
  551. "name": "WinExec",
  552. "address": "0x42d2bc"
  553. },
  554. {
  555. "name": "GetVersionExA",
  556. "address": "0x42d2c0"
  557. },
  558. {
  559. "name": "GetPrivateProfileIntA",
  560. "address": "0x42d2c4"
  561. },
  562. {
  563. "name": "WritePrivateProfileStringA",
  564. "address": "0x42d2c8"
  565. },
  566. {
  567. "name": "TerminateProcess",
  568. "address": "0x42d2cc"
  569. },
  570. {
  571. "name": "CreateToolhelp32Snapshot",
  572. "address": "0x42d2d0"
  573. },
  574. {
  575. "name": "Process32First",
  576. "address": "0x42d2d4"
  577. },
  578. {
  579. "name": "Process32Next",
  580. "address": "0x42d2d8"
  581. },
  582. {
  583. "name": "OpenProcess",
  584. "address": "0x42d2dc"
  585. },
  586. {
  587. "name": "DeleteFileA",
  588. "address": "0x42d2e0"
  589. },
  590. {
  591. "name": "GetSystemDirectoryA",
  592. "address": "0x42d2e4"
  593. },
  594. {
  595. "name": "LocalAlloc",
  596. "address": "0x42d2e8"
  597. },
  598. {
  599. "name": "GetCurrentProcess",
  600. "address": "0x42d2ec"
  601. },
  602. {
  603. "name": "GetModuleFileNameA",
  604. "address": "0x42d2f0"
  605. },
  606. {
  607. "name": "CreateDirectoryA",
  608. "address": "0x42d2f4"
  609. },
  610. {
  611. "name": "CreateFileA",
  612. "address": "0x42d2f8"
  613. },
  614. {
  615. "name": "GetCurrentProcessId",
  616. "address": "0x42d2fc"
  617. },
  618. {
  619. "name": "DeviceIoControl",
  620. "address": "0x42d300"
  621. },
  622. {
  623. "name": "CreateMutexA",
  624. "address": "0x42d304"
  625. },
  626. {
  627. "name": "GetLastError",
  628. "address": "0x42d308"
  629. },
  630. {
  631. "name": "LoadLibraryA",
  632. "address": "0x42d30c"
  633. },
  634. {
  635. "name": "GetProcAddress",
  636. "address": "0x42d310"
  637. },
  638. {
  639. "name": "FreeLibrary",
  640. "address": "0x42d314"
  641. },
  642. {
  643. "name": "CreateFileW",
  644. "address": "0x42d318"
  645. },
  646. {
  647. "name": "SetHandleCount",
  648. "address": "0x42d31c"
  649. },
  650. {
  651. "name": "CloseHandle",
  652. "address": "0x42d320"
  653. }
  654. ],
  655. "dll": "KERNEL32.dll"
  656. },
  657. {
  658. "imports": [
  659. {
  660. "name": "EndPaint",
  661. "address": "0x42d364"
  662. },
  663. {
  664. "name": "BeginPaint",
  665. "address": "0x42d368"
  666. },
  667. {
  668. "name": "GetWindowDC",
  669. "address": "0x42d36c"
  670. },
  671. {
  672. "name": "ReleaseDC",
  673. "address": "0x42d370"
  674. },
  675. {
  676. "name": "GetDC",
  677. "address": "0x42d374"
  678. },
  679. {
  680. "name": "ClientToScreen",
  681. "address": "0x42d378"
  682. },
  683. {
  684. "name": "GetMenuCheckMarkDimensions",
  685. "address": "0x42d37c"
  686. },
  687. {
  688. "name": "GetMenuState",
  689. "address": "0x42d380"
  690. },
  691. {
  692. "name": "ModifyMenuA",
  693. "address": "0x42d384"
  694. },
  695. {
  696. "name": "SetMenuItemBitmaps",
  697. "address": "0x42d388"
  698. },
  699. {
  700. "name": "CheckMenuItem",
  701. "address": "0x42d38c"
  702. },
  703. {
  704. "name": "EnableMenuItem",
  705. "address": "0x42d390"
  706. },
  707. {
  708. "name": "ShowWindow",
  709. "address": "0x42d394"
  710. },
  711. {
  712. "name": "MoveWindow",
  713. "address": "0x42d398"
  714. },
  715. {
  716. "name": "SetWindowTextA",
  717. "address": "0x42d39c"
  718. },
  719. {
  720. "name": "IsDialogMessageA",
  721. "address": "0x42d3a0"
  722. },
  723. {
  724. "name": "PostMessageA",
  725. "address": "0x42d3a4"
  726. },
  727. {
  728. "name": "UpdateWindow",
  729. "address": "0x42d3a8"
  730. },
  731. {
  732. "name": "SendDlgItemMessageA",
  733. "address": "0x42d3ac"
  734. },
  735. {
  736. "name": "MapWindowPoints",
  737. "address": "0x42d3b0"
  738. },
  739. {
  740. "name": "GetSysColor",
  741. "address": "0x42d3b4"
  742. },
  743. {
  744. "name": "PeekMessageA",
  745. "address": "0x42d3b8"
  746. },
  747. {
  748. "name": "DispatchMessageA",
  749. "address": "0x42d3bc"
  750. },
  751. {
  752. "name": "GetFocus",
  753. "address": "0x42d3c0"
  754. },
  755. {
  756. "name": "SetFocus",
  757. "address": "0x42d3c4"
  758. },
  759. {
  760. "name": "AdjustWindowRectEx",
  761. "address": "0x42d3c8"
  762. },
  763. {
  764. "name": "ScreenToClient",
  765. "address": "0x42d3cc"
  766. },
  767. {
  768. "name": "IsWindowVisible",
  769. "address": "0x42d3d0"
  770. },
  771. {
  772. "name": "GetTopWindow",
  773. "address": "0x42d3d4"
  774. },
  775. {
  776. "name": "MessageBoxA",
  777. "address": "0x42d3d8"
  778. },
  779. {
  780. "name": "IsChild",
  781. "address": "0x42d3dc"
  782. },
  783. {
  784. "name": "GetCapture",
  785. "address": "0x42d3e0"
  786. },
  787. {
  788. "name": "WinHelpA",
  789. "address": "0x42d3e4"
  790. },
  791. {
  792. "name": "wsprintfA",
  793. "address": "0x42d3e8"
  794. },
  795. {
  796. "name": "GetClassInfoA",
  797. "address": "0x42d3ec"
  798. },
  799. {
  800. "name": "RegisterClassA",
  801. "address": "0x42d3f0"
  802. },
  803. {
  804. "name": "GetMenu",
  805. "address": "0x42d3f4"
  806. },
  807. {
  808. "name": "GetMenuItemCount",
  809. "address": "0x42d3f8"
  810. },
  811. {
  812. "name": "GetSubMenu",
  813. "address": "0x42d3fc"
  814. },
  815. {
  816. "name": "TabbedTextOutA",
  817. "address": "0x42d400"
  818. },
  819. {
  820. "name": "GetWindowTextLengthA",
  821. "address": "0x42d404"
  822. },
  823. {
  824. "name": "GetWindowTextA",
  825. "address": "0x42d408"
  826. },
  827. {
  828. "name": "GetDlgCtrlID",
  829. "address": "0x42d40c"
  830. },
  831. {
  832. "name": "GetKeyState",
  833. "address": "0x42d410"
  834. },
  835. {
  836. "name": "CreateWindowExA",
  837. "address": "0x42d414"
  838. },
  839. {
  840. "name": "SetWindowsHookExA",
  841. "address": "0x42d418"
  842. },
  843. {
  844. "name": "CallNextHookEx",
  845. "address": "0x42d41c"
  846. },
  847. {
  848. "name": "GetClassLongA",
  849. "address": "0x42d420"
  850. },
  851. {
  852. "name": "SetPropA",
  853. "address": "0x42d424"
  854. },
  855. {
  856. "name": "UnhookWindowsHookEx",
  857. "address": "0x42d428"
  858. },
  859. {
  860. "name": "GetPropA",
  861. "address": "0x42d42c"
  862. },
  863. {
  864. "name": "CallWindowProcA",
  865. "address": "0x42d430"
  866. },
  867. {
  868. "name": "RemovePropA",
  869. "address": "0x42d434"
  870. },
  871. {
  872. "name": "DefWindowProcA",
  873. "address": "0x42d438"
  874. },
  875. {
  876. "name": "InvalidateRect",
  877. "address": "0x42d43c"
  878. },
  879. {
  880. "name": "GetMessagePos",
  881. "address": "0x42d440"
  882. },
  883. {
  884. "name": "GetLastActivePopup",
  885. "address": "0x42d444"
  886. },
  887. {
  888. "name": "wsprintfW",
  889. "address": "0x42d448"
  890. },
  891. {
  892. "name": "SetWindowPos",
  893. "address": "0x42d44c"
  894. },
  895. {
  896. "name": "UnregisterClassA",
  897. "address": "0x42d450"
  898. },
  899. {
  900. "name": "HideCaret",
  901. "address": "0x42d454"
  902. },
  903. {
  904. "name": "ShowCaret",
  905. "address": "0x42d458"
  906. },
  907. {
  908. "name": "ExcludeUpdateRgn",
  909. "address": "0x42d45c"
  910. },
  911. {
  912. "name": "DrawFocusRect",
  913. "address": "0x42d460"
  914. },
  915. {
  916. "name": "DefDlgProcA",
  917. "address": "0x42d464"
  918. },
  919. {
  920. "name": "GetForegroundWindow",
  921. "address": "0x42d468"
  922. },
  923. {
  924. "name": "SetForegroundWindow",
  925. "address": "0x42d46c"
  926. },
  927. {
  928. "name": "GetWindow",
  929. "address": "0x42d470"
  930. },
  931. {
  932. "name": "SetWindowLongA",
  933. "address": "0x42d474"
  934. },
  935. {
  936. "name": "RegisterWindowMessageA",
  937. "address": "0x42d478"
  938. },
  939. {
  940. "name": "IntersectRect",
  941. "address": "0x42d47c"
  942. },
  943. {
  944. "name": "SystemParametersInfoA",
  945. "address": "0x42d480"
  946. },
  947. {
  948. "name": "GetWindowPlacement",
  949. "address": "0x42d484"
  950. },
  951. {
  952. "name": "GetNextDlgTabItem",
  953. "address": "0x42d488"
  954. },
  955. {
  956. "name": "EndDialog",
  957. "address": "0x42d48c"
  958. },
  959. {
  960. "name": "GetActiveWindow",
  961. "address": "0x42d490"
  962. },
  963. {
  964. "name": "SetActiveWindow",
  965. "address": "0x42d494"
  966. },
  967. {
  968. "name": "IsWindow",
  969. "address": "0x42d498"
  970. },
  971. {
  972. "name": "CreateDialogIndirectParamA",
  973. "address": "0x42d49c"
  974. },
  975. {
  976. "name": "DestroyWindow",
  977. "address": "0x42d4a0"
  978. },
  979. {
  980. "name": "GetParent",
  981. "address": "0x42d4a4"
  982. },
  983. {
  984. "name": "GetDlgItem",
  985. "address": "0x42d4a8"
  986. },
  987. {
  988. "name": "IsWindowEnabled",
  989. "address": "0x42d4ac"
  990. },
  991. {
  992. "name": "GetWindowLongA",
  993. "address": "0x42d4b0"
  994. },
  995. {
  996. "name": "CopyRect",
  997. "address": "0x42d4b4"
  998. },
  999. {
  1000. "name": "InflateRect",
  1001. "address": "0x42d4b8"
  1002. },
  1003. {
  1004. "name": "OffsetRect",
  1005. "address": "0x42d4bc"
  1006. },
  1007. {
  1008. "name": "DrawTextA",
  1009. "address": "0x42d4c0"
  1010. },
  1011. {
  1012. "name": "GetSystemMenu",
  1013. "address": "0x42d4c4"
  1014. },
  1015. {
  1016. "name": "AppendMenuA",
  1017. "address": "0x42d4c8"
  1018. },
  1019. {
  1020. "name": "EnableWindow",
  1021. "address": "0x42d4cc"
  1022. },
  1023. {
  1024. "name": "PtInRect",
  1025. "address": "0x42d4d0"
  1026. },
  1027. {
  1028. "name": "IsIconic",
  1029. "address": "0x42d4d4"
  1030. },
  1031. {
  1032. "name": "SendMessageA",
  1033. "address": "0x42d4d8"
  1034. },
  1035. {
  1036. "name": "GetSystemMetrics",
  1037. "address": "0x42d4dc"
  1038. },
  1039. {
  1040. "name": "GetClientRect",
  1041. "address": "0x42d4e0"
  1042. },
  1043. {
  1044. "name": "LoadIconA",
  1045. "address": "0x42d4e4"
  1046. },
  1047. {
  1048. "name": "DrawIcon",
  1049. "address": "0x42d4e8"
  1050. },
  1051. {
  1052. "name": "GrayStringA",
  1053. "address": "0x42d4ec"
  1054. },
  1055. {
  1056. "name": "GetMenuItemID",
  1057. "address": "0x42d4f0"
  1058. },
  1059. {
  1060. "name": "PostThreadMessageA",
  1061. "address": "0x42d4f4"
  1062. },
  1063. {
  1064. "name": "LoadBitmapA",
  1065. "address": "0x42d4f8"
  1066. },
  1067. {
  1068. "name": "FrameRect",
  1069. "address": "0x42d4fc"
  1070. },
  1071. {
  1072. "name": "IsWindowUnicode",
  1073. "address": "0x42d500"
  1074. },
  1075. {
  1076. "name": "GetWindowRect",
  1077. "address": "0x42d504"
  1078. },
  1079. {
  1080. "name": "RegisterClipboardFormatA",
  1081. "address": "0x42d508"
  1082. },
  1083. {
  1084. "name": "MessageBeep",
  1085. "address": "0x42d50c"
  1086. },
  1087. {
  1088. "name": "GetNextDlgGroupItem",
  1089. "address": "0x42d510"
  1090. },
  1091. {
  1092. "name": "SetRect",
  1093. "address": "0x42d514"
  1094. },
  1095. {
  1096. "name": "CopyAcceleratorTableA",
  1097. "address": "0x42d518"
  1098. },
  1099. {
  1100. "name": "CharNextA",
  1101. "address": "0x42d51c"
  1102. },
  1103. {
  1104. "name": "GetSysColorBrush",
  1105. "address": "0x42d520"
  1106. },
  1107. {
  1108. "name": "LoadCursorA",
  1109. "address": "0x42d524"
  1110. },
  1111. {
  1112. "name": "GetClassNameA",
  1113. "address": "0x42d528"
  1114. },
  1115. {
  1116. "name": "CharUpperA",
  1117. "address": "0x42d52c"
  1118. },
  1119. {
  1120. "name": "GetDesktopWindow",
  1121. "address": "0x42d530"
  1122. },
  1123. {
  1124. "name": "LoadStringA",
  1125. "address": "0x42d534"
  1126. },
  1127. {
  1128. "name": "MapDialogRect",
  1129. "address": "0x42d538"
  1130. },
  1131. {
  1132. "name": "SetWindowContextHelpId",
  1133. "address": "0x42d53c"
  1134. },
  1135. {
  1136. "name": "GetMessageA",
  1137. "address": "0x42d540"
  1138. },
  1139. {
  1140. "name": "TranslateMessage",
  1141. "address": "0x42d544"
  1142. },
  1143. {
  1144. "name": "GetMessageTime",
  1145. "address": "0x42d548"
  1146. },
  1147. {
  1148. "name": "ValidateRect",
  1149. "address": "0x42d54c"
  1150. },
  1151. {
  1152. "name": "GetCursorPos",
  1153. "address": "0x42d550"
  1154. },
  1155. {
  1156. "name": "SetCursor",
  1157. "address": "0x42d554"
  1158. },
  1159. {
  1160. "name": "PostQuitMessage",
  1161. "address": "0x42d558"
  1162. },
  1163. {
  1164. "name": "DestroyMenu",
  1165. "address": "0x42d55c"
  1166. }
  1167. ],
  1168. "dll": "USER32.dll"
  1169. },
  1170. {
  1171. "imports": [
  1172. {
  1173. "name": "GetDeviceCaps",
  1174. "address": "0x42d070"
  1175. },
  1176. {
  1177. "name": "GetViewportExtEx",
  1178. "address": "0x42d074"
  1179. },
  1180. {
  1181. "name": "GetWindowExtEx",
  1182. "address": "0x42d078"
  1183. },
  1184. {
  1185. "name": "PtVisible",
  1186. "address": "0x42d07c"
  1187. },
  1188. {
  1189. "name": "RectVisible",
  1190. "address": "0x42d080"
  1191. },
  1192. {
  1193. "name": "TextOutA",
  1194. "address": "0x42d084"
  1195. },
  1196. {
  1197. "name": "ExtTextOutA",
  1198. "address": "0x42d088"
  1199. },
  1200. {
  1201. "name": "Escape",
  1202. "address": "0x42d08c"
  1203. },
  1204. {
  1205. "name": "GetTextColor",
  1206. "address": "0x42d090"
  1207. },
  1208. {
  1209. "name": "GetBkColor",
  1210. "address": "0x42d094"
  1211. },
  1212. {
  1213. "name": "DPtoLP",
  1214. "address": "0x42d098"
  1215. },
  1216. {
  1217. "name": "LPtoDP",
  1218. "address": "0x42d09c"
  1219. },
  1220. {
  1221. "name": "GetMapMode",
  1222. "address": "0x42d0a0"
  1223. },
  1224. {
  1225. "name": "PatBlt",
  1226. "address": "0x42d0a4"
  1227. },
  1228. {
  1229. "name": "IntersectClipRect",
  1230. "address": "0x42d0a8"
  1231. },
  1232. {
  1233. "name": "ScaleWindowExtEx",
  1234. "address": "0x42d0ac"
  1235. },
  1236. {
  1237. "name": "SetWindowExtEx",
  1238. "address": "0x42d0b0"
  1239. },
  1240. {
  1241. "name": "ScaleViewportExtEx",
  1242. "address": "0x42d0b4"
  1243. },
  1244. {
  1245. "name": "SetViewportExtEx",
  1246. "address": "0x42d0b8"
  1247. },
  1248. {
  1249. "name": "OffsetViewportOrgEx",
  1250. "address": "0x42d0bc"
  1251. },
  1252. {
  1253. "name": "SetViewportOrgEx",
  1254. "address": "0x42d0c0"
  1255. },
  1256. {
  1257. "name": "SetMapMode",
  1258. "address": "0x42d0c4"
  1259. },
  1260. {
  1261. "name": "GetStockObject",
  1262. "address": "0x42d0c8"
  1263. },
  1264. {
  1265. "name": "SelectObject",
  1266. "address": "0x42d0cc"
  1267. },
  1268. {
  1269. "name": "RestoreDC",
  1270. "address": "0x42d0d0"
  1271. },
  1272. {
  1273. "name": "SaveDC",
  1274. "address": "0x42d0d4"
  1275. },
  1276. {
  1277. "name": "DeleteDC",
  1278. "address": "0x42d0d8"
  1279. },
  1280. {
  1281. "name": "CreateBitmap",
  1282. "address": "0x42d0dc"
  1283. },
  1284. {
  1285. "name": "SetBkColor",
  1286. "address": "0x42d0e0"
  1287. },
  1288. {
  1289. "name": "GetClipBox",
  1290. "address": "0x42d0e4"
  1291. },
  1292. {
  1293. "name": "DeleteObject",
  1294. "address": "0x42d0e8"
  1295. },
  1296. {
  1297. "name": "SetBkMode",
  1298. "address": "0x42d0ec"
  1299. },
  1300. {
  1301. "name": "SetTextColor",
  1302. "address": "0x42d0f0"
  1303. },
  1304. {
  1305. "name": "CreateCompatibleDC",
  1306. "address": "0x42d0f4"
  1307. },
  1308. {
  1309. "name": "GetObjectA",
  1310. "address": "0x42d0f8"
  1311. },
  1312. {
  1313. "name": "StretchBlt",
  1314. "address": "0x42d0fc"
  1315. },
  1316. {
  1317. "name": "CreateFontIndirectA",
  1318. "address": "0x42d100"
  1319. },
  1320. {
  1321. "name": "CreateDIBitmap",
  1322. "address": "0x42d104"
  1323. },
  1324. {
  1325. "name": "GetTextExtentPointA",
  1326. "address": "0x42d108"
  1327. },
  1328. {
  1329. "name": "BitBlt",
  1330. "address": "0x42d10c"
  1331. },
  1332. {
  1333. "name": "CreateSolidBrush",
  1334. "address": "0x42d110"
  1335. }
  1336. ],
  1337. "dll": "GDI32.dll"
  1338. },
  1339. {
  1340. "imports": [
  1341. {
  1342. "name": "GetFileTitleA",
  1343. "address": "0x42d5ac"
  1344. }
  1345. ],
  1346. "dll": "comdlg32.dll"
  1347. },
  1348. {
  1349. "imports": [
  1350. {
  1351. "name": "ClosePrinter",
  1352. "address": "0x42d59c"
  1353. },
  1354. {
  1355. "name": "OpenPrinterA",
  1356. "address": "0x42d5a0"
  1357. },
  1358. {
  1359. "name": "DocumentPropertiesA",
  1360. "address": "0x42d5a4"
  1361. }
  1362. ],
  1363. "dll": "WINSPOOL.DRV"
  1364. },
  1365. {
  1366. "imports": [
  1367. {
  1368. "name": "RegSetKeySecurity",
  1369. "address": "0x42d000"
  1370. },
  1371. {
  1372. "name": "RegCreateKeyExA",
  1373. "address": "0x42d004"
  1374. },
  1375. {
  1376. "name": "AllocateAndInitializeSid",
  1377. "address": "0x42d008"
  1378. },
  1379. {
  1380. "name": "GetLengthSid",
  1381. "address": "0x42d00c"
  1382. },
  1383. {
  1384. "name": "InitializeAcl",
  1385. "address": "0x42d010"
  1386. },
  1387. {
  1388. "name": "AddAccessAllowedAce",
  1389. "address": "0x42d014"
  1390. },
  1391. {
  1392. "name": "InitializeSecurityDescriptor",
  1393. "address": "0x42d018"
  1394. },
  1395. {
  1396. "name": "SetSecurityDescriptorDacl",
  1397. "address": "0x42d01c"
  1398. },
  1399. {
  1400. "name": "AdjustTokenPrivileges",
  1401. "address": "0x42d020"
  1402. },
  1403. {
  1404. "name": "FreeSid",
  1405. "address": "0x42d024"
  1406. },
  1407. {
  1408. "name": "LookupAccountNameA",
  1409. "address": "0x42d028"
  1410. },
  1411. {
  1412. "name": "RegOpenKeyExA",
  1413. "address": "0x42d02c"
  1414. },
  1415. {
  1416. "name": "RegSetValueExA",
  1417. "address": "0x42d030"
  1418. },
  1419. {
  1420. "name": "RegCloseKey",
  1421. "address": "0x42d034"
  1422. },
  1423. {
  1424. "name": "ControlService",
  1425. "address": "0x42d038"
  1426. },
  1427. {
  1428. "name": "DeleteService",
  1429. "address": "0x42d03c"
  1430. },
  1431. {
  1432. "name": "CreateServiceA",
  1433. "address": "0x42d040"
  1434. },
  1435. {
  1436. "name": "StartServiceA",
  1437. "address": "0x42d044"
  1438. },
  1439. {
  1440. "name": "QueryServiceConfigA",
  1441. "address": "0x42d048"
  1442. },
  1443. {
  1444. "name": "QueryServiceStatus",
  1445. "address": "0x42d04c"
  1446. },
  1447. {
  1448. "name": "OpenSCManagerA",
  1449. "address": "0x42d050"
  1450. },
  1451. {
  1452. "name": "OpenServiceA",
  1453. "address": "0x42d054"
  1454. },
  1455. {
  1456. "name": "CloseServiceHandle",
  1457. "address": "0x42d058"
  1458. },
  1459. {
  1460. "name": "OpenProcessToken",
  1461. "address": "0x42d05c"
  1462. },
  1463. {
  1464. "name": "LookupPrivilegeValueA",
  1465. "address": "0x42d060"
  1466. }
  1467. ],
  1468. "dll": "ADVAPI32.dll"
  1469. },
  1470. {
  1471. "imports": [
  1472. {
  1473. "name": null,
  1474. "address": "0x42d068"
  1475. }
  1476. ],
  1477. "dll": "COMCTL32.dll"
  1478. },
  1479. {
  1480. "imports": [
  1481. {
  1482. "name": null,
  1483. "address": "0x42d5f4"
  1484. }
  1485. ],
  1486. "dll": "oledlg.dll"
  1487. },
  1488. {
  1489. "imports": [
  1490. {
  1491. "name": "CoTaskMemFree",
  1492. "address": "0x42d5b4"
  1493. },
  1494. {
  1495. "name": "CoTaskMemAlloc",
  1496. "address": "0x42d5b8"
  1497. },
  1498. {
  1499. "name": "OleInitialize",
  1500. "address": "0x42d5bc"
  1501. },
  1502. {
  1503. "name": "OleUninitialize",
  1504. "address": "0x42d5c0"
  1505. },
  1506. {
  1507. "name": "CoFreeUnusedLibraries",
  1508. "address": "0x42d5c4"
  1509. },
  1510. {
  1511. "name": "CreateILockBytesOnHGlobal",
  1512. "address": "0x42d5c8"
  1513. },
  1514. {
  1515. "name": "StgCreateDocfileOnILockBytes",
  1516. "address": "0x42d5cc"
  1517. },
  1518. {
  1519. "name": "CoRegisterMessageFilter",
  1520. "address": "0x42d5d0"
  1521. },
  1522. {
  1523. "name": "CoRevokeClassObject",
  1524. "address": "0x42d5d4"
  1525. },
  1526. {
  1527. "name": "OleFlushClipboard",
  1528. "address": "0x42d5d8"
  1529. },
  1530. {
  1531. "name": "OleIsCurrentClipboard",
  1532. "address": "0x42d5dc"
  1533. },
  1534. {
  1535. "name": "StgOpenStorageOnILockBytes",
  1536. "address": "0x42d5e0"
  1537. },
  1538. {
  1539. "name": "CoGetClassObject",
  1540. "address": "0x42d5e4"
  1541. },
  1542. {
  1543. "name": "CLSIDFromString",
  1544. "address": "0x42d5e8"
  1545. },
  1546. {
  1547. "name": "CLSIDFromProgID",
  1548. "address": "0x42d5ec"
  1549. }
  1550. ],
  1551. "dll": "ole32.dll"
  1552. },
  1553. {
  1554. "imports": [
  1555. {
  1556. "name": null,
  1557. "address": "0x42d350"
  1558. }
  1559. ],
  1560. "dll": "OLEPRO32.DLL"
  1561. },
  1562. {
  1563. "imports": [
  1564. {
  1565. "name": "VariantChangeType",
  1566. "address": "0x42d328"
  1567. },
  1568. {
  1569. "name": "VariantTimeToSystemTime",
  1570. "address": "0x42d32c"
  1571. },
  1572. {
  1573. "name": "VariantClear",
  1574. "address": "0x42d330"
  1575. },
  1576. {
  1577. "name": "SysAllocStringLen",
  1578. "address": "0x42d334"
  1579. },
  1580. {
  1581. "name": "SysFreeString",
  1582. "address": "0x42d338"
  1583. },
  1584. {
  1585. "name": "SysAllocString",
  1586. "address": "0x42d33c"
  1587. },
  1588. {
  1589. "name": "SysAllocStringByteLen",
  1590. "address": "0x42d340"
  1591. },
  1592. {
  1593. "name": "SysStringLen",
  1594. "address": "0x42d344"
  1595. },
  1596. {
  1597. "name": "VariantCopy",
  1598. "address": "0x42d348"
  1599. }
  1600. ],
  1601. "dll": "OLEAUT32.dll"
  1602. },
  1603. {
  1604. "imports": [
  1605. {
  1606. "name": "GetModuleFileNameExA",
  1607. "address": "0x42d358"
  1608. },
  1609. {
  1610. "name": "EnumProcessModules",
  1611. "address": "0x42d35c"
  1612. }
  1613. ],
  1614. "dll": "PSAPI.DLL"
  1615. },
  1616. {
  1617. "imports": [
  1618. {
  1619. "name": "InternetGetLastResponseInfoA",
  1620. "address": "0x42d564"
  1621. },
  1622. {
  1623. "name": "InternetQueryDataAvailable",
  1624. "address": "0x42d568"
  1625. },
  1626. {
  1627. "name": "InternetReadFile",
  1628. "address": "0x42d56c"
  1629. },
  1630. {
  1631. "name": "InternetWriteFile",
  1632. "address": "0x42d570"
  1633. },
  1634. {
  1635. "name": "InternetSetFilePointer",
  1636. "address": "0x42d574"
  1637. },
  1638. {
  1639. "name": "InternetSetStatusCallback",
  1640. "address": "0x42d578"
  1641. },
  1642. {
  1643. "name": "InternetSetOptionExA",
  1644. "address": "0x42d57c"
  1645. },
  1646. {
  1647. "name": "InternetOpenUrlA",
  1648. "address": "0x42d580"
  1649. },
  1650. {
  1651. "name": "InternetCrackUrlA",
  1652. "address": "0x42d584"
  1653. },
  1654. {
  1655. "name": "InternetCanonicalizeUrlA",
  1656. "address": "0x42d588"
  1657. },
  1658. {
  1659. "name": "InternetQueryOptionA",
  1660. "address": "0x42d58c"
  1661. },
  1662. {
  1663. "name": "InternetOpenA",
  1664. "address": "0x42d590"
  1665. },
  1666. {
  1667. "name": "InternetCloseHandle",
  1668. "address": "0x42d594"
  1669. }
  1670. ],
  1671. "dll": "WININET.dll"
  1672. }
  1673. ],
  1674. "digital_signers": null,
  1675. "exported_dll_name": null,
  1676. "actual_checksum": "0x0006297b",
  1677. "overlay": {
  1678. "size": "0x00001520",
  1679. "offset": "0x00054000"
  1680. },
  1681. "imagebase": "0x00400000",
  1682. "reported_checksum": "0x0006297b",
  1683. "icon_hash": null,
  1684. "entrypoint": "0x0040f6fc",
  1685. "timestamp": "2008-07-11 07:45:21",
  1686. "osversion": "4.0",
  1687. "sections": [
  1688. {
  1689. "name": ".text",
  1690. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1691. "virtual_address": "0x00001000",
  1692. "size_of_data": "0x0002c000",
  1693. "entropy": "6.59",
  1694. "raw_address": "0x00001000",
  1695. "virtual_size": "0x0002b937",
  1696. "characteristics_raw": "0x60000020"
  1697. },
  1698. {
  1699. "name": ".rdata",
  1700. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1701. "virtual_address": "0x0002d000",
  1702. "size_of_data": "0x0000b000",
  1703. "entropy": "4.55",
  1704. "raw_address": "0x0002d000",
  1705. "virtual_size": "0x0000a620",
  1706. "characteristics_raw": "0x40000040"
  1707. },
  1708. {
  1709. "name": ".data",
  1710. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1711. "virtual_address": "0x00038000",
  1712. "size_of_data": "0x00005000",
  1713. "entropy": "2.98",
  1714. "raw_address": "0x00038000",
  1715. "virtual_size": "0x00009168",
  1716. "characteristics_raw": "0xc0000040"
  1717. },
  1718. {
  1719. "name": ".rsrc",
  1720. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1721. "virtual_address": "0x00042000",
  1722. "size_of_data": "0x00017000",
  1723. "entropy": "6.25",
  1724. "raw_address": "0x0003d000",
  1725. "virtual_size": "0x00016490",
  1726. "characteristics_raw": "0x40000040"
  1727. }
  1728. ],
  1729. "resources": [],
  1730. "dirents": [
  1731. {
  1732. "virtual_address": "0x00000000",
  1733. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1734. "size": "0x00000000"
  1735. },
  1736. {
  1737. "virtual_address": "0x000355c0",
  1738. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1739. "size": "0x00000118"
  1740. },
  1741. {
  1742. "virtual_address": "0x00042000",
  1743. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1744. "size": "0x00016490"
  1745. },
  1746. {
  1747. "virtual_address": "0x00000000",
  1748. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1749. "size": "0x00000000"
  1750. },
  1751. {
  1752. "virtual_address": "0x00054000",
  1753. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1754. "size": "0x00001520"
  1755. },
  1756. {
  1757. "virtual_address": "0x00000000",
  1758. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1759. "size": "0x00000000"
  1760. },
  1761. {
  1762. "virtual_address": "0x00000000",
  1763. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1764. "size": "0x00000000"
  1765. },
  1766. {
  1767. "virtual_address": "0x00000000",
  1768. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1769. "size": "0x00000000"
  1770. },
  1771. {
  1772. "virtual_address": "0x00000000",
  1773. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1774. "size": "0x00000000"
  1775. },
  1776. {
  1777. "virtual_address": "0x00000000",
  1778. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1779. "size": "0x00000000"
  1780. },
  1781. {
  1782. "virtual_address": "0x00000000",
  1783. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1784. "size": "0x00000000"
  1785. },
  1786. {
  1787. "virtual_address": "0x00000000",
  1788. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1789. "size": "0x00000000"
  1790. },
  1791. {
  1792. "virtual_address": "0x0002d000",
  1793. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1794. "size": "0x000005fc"
  1795. },
  1796. {
  1797. "virtual_address": "0x00000000",
  1798. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1799. "size": "0x00000000"
  1800. },
  1801. {
  1802. "virtual_address": "0x00000000",
  1803. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1804. "size": "0x00000000"
  1805. },
  1806. {
  1807. "virtual_address": "0x00000000",
  1808. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1809. "size": "0x00000000"
  1810. }
  1811. ],
  1812. "exports": [],
  1813. "guest_signers": {},
  1814. "imphash": "940f1f3564f8c29235f80f4ef8cdf034",
  1815. "icon_fuzzy": null,
  1816. "icon": null,
  1817. "pdbpath": null,
  1818. "imported_dll_count": 13,
  1819. "versioninfo": []
  1820. }
  1821. }
  1822.  
  1823. [*] Resolved APIs: [
  1824. "kernel32.dll.IsProcessorFeaturePresent",
  1825. "comctl32.dll.InitCommonControlsEx",
  1826. "dwmapi.dll.DwmIsCompositionEnabled",
  1827. "kernel32.dll.SortGetHandle",
  1828. "kernel32.dll.SortCloseHandle",
  1829. "user32.dll.GetSystemMetrics",
  1830. "user32.dll.MonitorFromWindow",
  1831. "user32.dll.MonitorFromRect",
  1832. "user32.dll.MonitorFromPoint",
  1833. "user32.dll.EnumDisplayMonitors",
  1834. "user32.dll.GetMonitorInfoA",
  1835. "ole32.dll.CoInitializeEx",
  1836. "ole32.dll.CoUninitialize",
  1837. "cryptbase.dll.SystemFunction036",
  1838. "ole32.dll.CoRegisterInitializeSpy",
  1839. "ole32.dll.CoRevokeInitializeSpy",
  1840. "oleaut32.dll.#500"
  1841. ]
  1842.  
  1843. [*] Static Analysis: {
  1844. "pe": {
  1845. "peid_signatures": null,
  1846. "imports": [
  1847. {
  1848. "imports": [
  1849. {
  1850. "name": "SetStdHandle",
  1851. "address": "0x42d118"
  1852. },
  1853. {
  1854. "name": "GetFileType",
  1855. "address": "0x42d11c"
  1856. },
  1857. {
  1858. "name": "HeapReAlloc",
  1859. "address": "0x42d120"
  1860. },
  1861. {
  1862. "name": "HeapSize",
  1863. "address": "0x42d124"
  1864. },
  1865. {
  1866. "name": "GetACP",
  1867. "address": "0x42d128"
  1868. },
  1869. {
  1870. "name": "GetEnvironmentVariableA",
  1871. "address": "0x42d12c"
  1872. },
  1873. {
  1874. "name": "HeapDestroy",
  1875. "address": "0x42d130"
  1876. },
  1877. {
  1878. "name": "HeapCreate",
  1879. "address": "0x42d134"
  1880. },
  1881. {
  1882. "name": "VirtualFree",
  1883. "address": "0x42d138"
  1884. },
  1885. {
  1886. "name": "VirtualAlloc",
  1887. "address": "0x42d13c"
  1888. },
  1889. {
  1890. "name": "IsBadWritePtr",
  1891. "address": "0x42d140"
  1892. },
  1893. {
  1894. "name": "UnhandledExceptionFilter",
  1895. "address": "0x42d144"
  1896. },
  1897. {
  1898. "name": "FreeEnvironmentStringsA",
  1899. "address": "0x42d148"
  1900. },
  1901. {
  1902. "name": "FreeEnvironmentStringsW",
  1903. "address": "0x42d14c"
  1904. },
  1905. {
  1906. "name": "GetEnvironmentStrings",
  1907. "address": "0x42d150"
  1908. },
  1909. {
  1910. "name": "GetEnvironmentStringsW",
  1911. "address": "0x42d154"
  1912. },
  1913. {
  1914. "name": "RaiseException",
  1915. "address": "0x42d158"
  1916. },
  1917. {
  1918. "name": "GetStdHandle",
  1919. "address": "0x42d15c"
  1920. },
  1921. {
  1922. "name": "SetUnhandledExceptionFilter",
  1923. "address": "0x42d160"
  1924. },
  1925. {
  1926. "name": "LCMapStringA",
  1927. "address": "0x42d164"
  1928. },
  1929. {
  1930. "name": "LCMapStringW",
  1931. "address": "0x42d168"
  1932. },
  1933. {
  1934. "name": "GetStringTypeA",
  1935. "address": "0x42d16c"
  1936. },
  1937. {
  1938. "name": "GetStringTypeW",
  1939. "address": "0x42d170"
  1940. },
  1941. {
  1942. "name": "IsBadReadPtr",
  1943. "address": "0x42d174"
  1944. },
  1945. {
  1946. "name": "IsBadCodePtr",
  1947. "address": "0x42d178"
  1948. },
  1949. {
  1950. "name": "CompareStringA",
  1951. "address": "0x42d17c"
  1952. },
  1953. {
  1954. "name": "CompareStringW",
  1955. "address": "0x42d180"
  1956. },
  1957. {
  1958. "name": "SetEnvironmentVariableA",
  1959. "address": "0x42d184"
  1960. },
  1961. {
  1962. "name": "ExitProcess",
  1963. "address": "0x42d188"
  1964. },
  1965. {
  1966. "name": "GetCommandLineA",
  1967. "address": "0x42d18c"
  1968. },
  1969. {
  1970. "name": "GetProfileStringA",
  1971. "address": "0x42d190"
  1972. },
  1973. {
  1974. "name": "GetStartupInfoA",
  1975. "address": "0x42d194"
  1976. },
  1977. {
  1978. "name": "GetTimeZoneInformation",
  1979. "address": "0x42d198"
  1980. },
  1981. {
  1982. "name": "RtlUnwind",
  1983. "address": "0x42d19c"
  1984. },
  1985. {
  1986. "name": "GetTickCount",
  1987. "address": "0x42d1a0"
  1988. },
  1989. {
  1990. "name": "FileTimeToLocalFileTime",
  1991. "address": "0x42d1a4"
  1992. },
  1993. {
  1994. "name": "FileTimeToSystemTime",
  1995. "address": "0x42d1a8"
  1996. },
  1997. {
  1998. "name": "SetErrorMode",
  1999. "address": "0x42d1ac"
  2000. },
  2001. {
  2002. "name": "GetOEMCP",
  2003. "address": "0x42d1b0"
  2004. },
  2005. {
  2006. "name": "GetCPInfo",
  2007. "address": "0x42d1b4"
  2008. },
  2009. {
  2010. "name": "GetProcessVersion",
  2011. "address": "0x42d1b8"
  2012. },
  2013. {
  2014. "name": "TlsGetValue",
  2015. "address": "0x42d1bc"
  2016. },
  2017. {
  2018. "name": "LocalReAlloc",
  2019. "address": "0x42d1c0"
  2020. },
  2021. {
  2022. "name": "TlsSetValue",
  2023. "address": "0x42d1c4"
  2024. },
  2025. {
  2026. "name": "GlobalReAlloc",
  2027. "address": "0x42d1c8"
  2028. },
  2029. {
  2030. "name": "TlsFree",
  2031. "address": "0x42d1cc"
  2032. },
  2033. {
  2034. "name": "GlobalHandle",
  2035. "address": "0x42d1d0"
  2036. },
  2037. {
  2038. "name": "TlsAlloc",
  2039. "address": "0x42d1d4"
  2040. },
  2041. {
  2042. "name": "GlobalFlags",
  2043. "address": "0x42d1d8"
  2044. },
  2045. {
  2046. "name": "GetThreadLocale",
  2047. "address": "0x42d1dc"
  2048. },
  2049. {
  2050. "name": "GetFullPathNameA",
  2051. "address": "0x42d1e0"
  2052. },
  2053. {
  2054. "name": "GetVolumeInformationA",
  2055. "address": "0x42d1e4"
  2056. },
  2057. {
  2058. "name": "SetEndOfFile",
  2059. "address": "0x42d1e8"
  2060. },
  2061. {
  2062. "name": "UnlockFile",
  2063. "address": "0x42d1ec"
  2064. },
  2065. {
  2066. "name": "LockFile",
  2067. "address": "0x42d1f0"
  2068. },
  2069. {
  2070. "name": "FlushFileBuffers",
  2071. "address": "0x42d1f4"
  2072. },
  2073. {
  2074. "name": "SetFilePointer",
  2075. "address": "0x42d1f8"
  2076. },
  2077. {
  2078. "name": "ReadFile",
  2079. "address": "0x42d1fc"
  2080. },
  2081. {
  2082. "name": "DuplicateHandle",
  2083. "address": "0x42d200"
  2084. },
  2085. {
  2086. "name": "LeaveCriticalSection",
  2087. "address": "0x42d204"
  2088. },
  2089. {
  2090. "name": "DeleteCriticalSection",
  2091. "address": "0x42d208"
  2092. },
  2093. {
  2094. "name": "InitializeCriticalSection",
  2095. "address": "0x42d20c"
  2096. },
  2097. {
  2098. "name": "EnterCriticalSection",
  2099. "address": "0x42d210"
  2100. },
  2101. {
  2102. "name": "FindFirstFileA",
  2103. "address": "0x42d214"
  2104. },
  2105. {
  2106. "name": "FindClose",
  2107. "address": "0x42d218"
  2108. },
  2109. {
  2110. "name": "lstrcpynA",
  2111. "address": "0x42d21c"
  2112. },
  2113. {
  2114. "name": "GetFileTime",
  2115. "address": "0x42d220"
  2116. },
  2117. {
  2118. "name": "GetFileSize",
  2119. "address": "0x42d224"
  2120. },
  2121. {
  2122. "name": "FormatMessageA",
  2123. "address": "0x42d228"
  2124. },
  2125. {
  2126. "name": "LocalFree",
  2127. "address": "0x42d22c"
  2128. },
  2129. {
  2130. "name": "WaitForSingleObject",
  2131. "address": "0x42d230"
  2132. },
  2133. {
  2134. "name": "GlobalAlloc",
  2135. "address": "0x42d234"
  2136. },
  2137. {
  2138. "name": "lstrcmpA",
  2139. "address": "0x42d238"
  2140. },
  2141. {
  2142. "name": "GetCurrentThread",
  2143. "address": "0x42d23c"
  2144. },
  2145. {
  2146. "name": "MultiByteToWideChar",
  2147. "address": "0x42d240"
  2148. },
  2149. {
  2150. "name": "WideCharToMultiByte",
  2151. "address": "0x42d244"
  2152. },
  2153. {
  2154. "name": "InterlockedDecrement",
  2155. "address": "0x42d248"
  2156. },
  2157. {
  2158. "name": "InterlockedIncrement",
  2159. "address": "0x42d24c"
  2160. },
  2161. {
  2162. "name": "MulDiv",
  2163. "address": "0x42d250"
  2164. },
  2165. {
  2166. "name": "SetLastError",
  2167. "address": "0x42d254"
  2168. },
  2169. {
  2170. "name": "GetVersion",
  2171. "address": "0x42d258"
  2172. },
  2173. {
  2174. "name": "lstrcatA",
  2175. "address": "0x42d25c"
  2176. },
  2177. {
  2178. "name": "GetCurrentThreadId",
  2179. "address": "0x42d260"
  2180. },
  2181. {
  2182. "name": "GlobalGetAtomNameA",
  2183. "address": "0x42d264"
  2184. },
  2185. {
  2186. "name": "lstrcmpiA",
  2187. "address": "0x42d268"
  2188. },
  2189. {
  2190. "name": "GlobalAddAtomA",
  2191. "address": "0x42d26c"
  2192. },
  2193. {
  2194. "name": "GlobalFindAtomA",
  2195. "address": "0x42d270"
  2196. },
  2197. {
  2198. "name": "GlobalDeleteAtom",
  2199. "address": "0x42d274"
  2200. },
  2201. {
  2202. "name": "lstrcpyA",
  2203. "address": "0x42d278"
  2204. },
  2205. {
  2206. "name": "GetModuleHandleA",
  2207. "address": "0x42d27c"
  2208. },
  2209. {
  2210. "name": "GlobalLock",
  2211. "address": "0x42d280"
  2212. },
  2213. {
  2214. "name": "GlobalUnlock",
  2215. "address": "0x42d284"
  2216. },
  2217. {
  2218. "name": "GlobalFree",
  2219. "address": "0x42d288"
  2220. },
  2221. {
  2222. "name": "lstrlenA",
  2223. "address": "0x42d28c"
  2224. },
  2225. {
  2226. "name": "GetFileAttributesA",
  2227. "address": "0x42d290"
  2228. },
  2229. {
  2230. "name": "GetProcessHeap",
  2231. "address": "0x42d294"
  2232. },
  2233. {
  2234. "name": "HeapAlloc",
  2235. "address": "0x42d298"
  2236. },
  2237. {
  2238. "name": "HeapFree",
  2239. "address": "0x42d29c"
  2240. },
  2241. {
  2242. "name": "FindResourceA",
  2243. "address": "0x42d2a0"
  2244. },
  2245. {
  2246. "name": "SizeofResource",
  2247. "address": "0x42d2a4"
  2248. },
  2249. {
  2250. "name": "LoadResource",
  2251. "address": "0x42d2a8"
  2252. },
  2253. {
  2254. "name": "LockResource",
  2255. "address": "0x42d2ac"
  2256. },
  2257. {
  2258. "name": "WriteFile",
  2259. "address": "0x42d2b0"
  2260. },
  2261. {
  2262. "name": "SetFileAttributesA",
  2263. "address": "0x42d2b4"
  2264. },
  2265. {
  2266. "name": "MoveFileExA",
  2267. "address": "0x42d2b8"
  2268. },
  2269. {
  2270. "name": "WinExec",
  2271. "address": "0x42d2bc"
  2272. },
  2273. {
  2274. "name": "GetVersionExA",
  2275. "address": "0x42d2c0"
  2276. },
  2277. {
  2278. "name": "GetPrivateProfileIntA",
  2279. "address": "0x42d2c4"
  2280. },
  2281. {
  2282. "name": "WritePrivateProfileStringA",
  2283. "address": "0x42d2c8"
  2284. },
  2285. {
  2286. "name": "TerminateProcess",
  2287. "address": "0x42d2cc"
  2288. },
  2289. {
  2290. "name": "CreateToolhelp32Snapshot",
  2291. "address": "0x42d2d0"
  2292. },
  2293. {
  2294. "name": "Process32First",
  2295. "address": "0x42d2d4"
  2296. },
  2297. {
  2298. "name": "Process32Next",
  2299. "address": "0x42d2d8"
  2300. },
  2301. {
  2302. "name": "OpenProcess",
  2303. "address": "0x42d2dc"
  2304. },
  2305. {
  2306. "name": "DeleteFileA",
  2307. "address": "0x42d2e0"
  2308. },
  2309. {
  2310. "name": "GetSystemDirectoryA",
  2311. "address": "0x42d2e4"
  2312. },
  2313. {
  2314. "name": "LocalAlloc",
  2315. "address": "0x42d2e8"
  2316. },
  2317. {
  2318. "name": "GetCurrentProcess",
  2319. "address": "0x42d2ec"
  2320. },
  2321. {
  2322. "name": "GetModuleFileNameA",
  2323. "address": "0x42d2f0"
  2324. },
  2325. {
  2326. "name": "CreateDirectoryA",
  2327. "address": "0x42d2f4"
  2328. },
  2329. {
  2330. "name": "CreateFileA",
  2331. "address": "0x42d2f8"
  2332. },
  2333. {
  2334. "name": "GetCurrentProcessId",
  2335. "address": "0x42d2fc"
  2336. },
  2337. {
  2338. "name": "DeviceIoControl",
  2339. "address": "0x42d300"
  2340. },
  2341. {
  2342. "name": "CreateMutexA",
  2343. "address": "0x42d304"
  2344. },
  2345. {
  2346. "name": "GetLastError",
  2347. "address": "0x42d308"
  2348. },
  2349. {
  2350. "name": "LoadLibraryA",
  2351. "address": "0x42d30c"
  2352. },
  2353. {
  2354. "name": "GetProcAddress",
  2355. "address": "0x42d310"
  2356. },
  2357. {
  2358. "name": "FreeLibrary",
  2359. "address": "0x42d314"
  2360. },
  2361. {
  2362. "name": "CreateFileW",
  2363. "address": "0x42d318"
  2364. },
  2365. {
  2366. "name": "SetHandleCount",
  2367. "address": "0x42d31c"
  2368. },
  2369. {
  2370. "name": "CloseHandle",
  2371. "address": "0x42d320"
  2372. }
  2373. ],
  2374. "dll": "KERNEL32.dll"
  2375. },
  2376. {
  2377. "imports": [
  2378. {
  2379. "name": "EndPaint",
  2380. "address": "0x42d364"
  2381. },
  2382. {
  2383. "name": "BeginPaint",
  2384. "address": "0x42d368"
  2385. },
  2386. {
  2387. "name": "GetWindowDC",
  2388. "address": "0x42d36c"
  2389. },
  2390. {
  2391. "name": "ReleaseDC",
  2392. "address": "0x42d370"
  2393. },
  2394. {
  2395. "name": "GetDC",
  2396. "address": "0x42d374"
  2397. },
  2398. {
  2399. "name": "ClientToScreen",
  2400. "address": "0x42d378"
  2401. },
  2402. {
  2403. "name": "GetMenuCheckMarkDimensions",
  2404. "address": "0x42d37c"
  2405. },
  2406. {
  2407. "name": "GetMenuState",
  2408. "address": "0x42d380"
  2409. },
  2410. {
  2411. "name": "ModifyMenuA",
  2412. "address": "0x42d384"
  2413. },
  2414. {
  2415. "name": "SetMenuItemBitmaps",
  2416. "address": "0x42d388"
  2417. },
  2418. {
  2419. "name": "CheckMenuItem",
  2420. "address": "0x42d38c"
  2421. },
  2422. {
  2423. "name": "EnableMenuItem",
  2424. "address": "0x42d390"
  2425. },
  2426. {
  2427. "name": "ShowWindow",
  2428. "address": "0x42d394"
  2429. },
  2430. {
  2431. "name": "MoveWindow",
  2432. "address": "0x42d398"
  2433. },
  2434. {
  2435. "name": "SetWindowTextA",
  2436. "address": "0x42d39c"
  2437. },
  2438. {
  2439. "name": "IsDialogMessageA",
  2440. "address": "0x42d3a0"
  2441. },
  2442. {
  2443. "name": "PostMessageA",
  2444. "address": "0x42d3a4"
  2445. },
  2446. {
  2447. "name": "UpdateWindow",
  2448. "address": "0x42d3a8"
  2449. },
  2450. {
  2451. "name": "SendDlgItemMessageA",
  2452. "address": "0x42d3ac"
  2453. },
  2454. {
  2455. "name": "MapWindowPoints",
  2456. "address": "0x42d3b0"
  2457. },
  2458. {
  2459. "name": "GetSysColor",
  2460. "address": "0x42d3b4"
  2461. },
  2462. {
  2463. "name": "PeekMessageA",
  2464. "address": "0x42d3b8"
  2465. },
  2466. {
  2467. "name": "DispatchMessageA",
  2468. "address": "0x42d3bc"
  2469. },
  2470. {
  2471. "name": "GetFocus",
  2472. "address": "0x42d3c0"
  2473. },
  2474. {
  2475. "name": "SetFocus",
  2476. "address": "0x42d3c4"
  2477. },
  2478. {
  2479. "name": "AdjustWindowRectEx",
  2480. "address": "0x42d3c8"
  2481. },
  2482. {
  2483. "name": "ScreenToClient",
  2484. "address": "0x42d3cc"
  2485. },
  2486. {
  2487. "name": "IsWindowVisible",
  2488. "address": "0x42d3d0"
  2489. },
  2490. {
  2491. "name": "GetTopWindow",
  2492. "address": "0x42d3d4"
  2493. },
  2494. {
  2495. "name": "MessageBoxA",
  2496. "address": "0x42d3d8"
  2497. },
  2498. {
  2499. "name": "IsChild",
  2500. "address": "0x42d3dc"
  2501. },
  2502. {
  2503. "name": "GetCapture",
  2504. "address": "0x42d3e0"
  2505. },
  2506. {
  2507. "name": "WinHelpA",
  2508. "address": "0x42d3e4"
  2509. },
  2510. {
  2511. "name": "wsprintfA",
  2512. "address": "0x42d3e8"
  2513. },
  2514. {
  2515. "name": "GetClassInfoA",
  2516. "address": "0x42d3ec"
  2517. },
  2518. {
  2519. "name": "RegisterClassA",
  2520. "address": "0x42d3f0"
  2521. },
  2522. {
  2523. "name": "GetMenu",
  2524. "address": "0x42d3f4"
  2525. },
  2526. {
  2527. "name": "GetMenuItemCount",
  2528. "address": "0x42d3f8"
  2529. },
  2530. {
  2531. "name": "GetSubMenu",
  2532. "address": "0x42d3fc"
  2533. },
  2534. {
  2535. "name": "TabbedTextOutA",
  2536. "address": "0x42d400"
  2537. },
  2538. {
  2539. "name": "GetWindowTextLengthA",
  2540. "address": "0x42d404"
  2541. },
  2542. {
  2543. "name": "GetWindowTextA",
  2544. "address": "0x42d408"
  2545. },
  2546. {
  2547. "name": "GetDlgCtrlID",
  2548. "address": "0x42d40c"
  2549. },
  2550. {
  2551. "name": "GetKeyState",
  2552. "address": "0x42d410"
  2553. },
  2554. {
  2555. "name": "CreateWindowExA",
  2556. "address": "0x42d414"
  2557. },
  2558. {
  2559. "name": "SetWindowsHookExA",
  2560. "address": "0x42d418"
  2561. },
  2562. {
  2563. "name": "CallNextHookEx",
  2564. "address": "0x42d41c"
  2565. },
  2566. {
  2567. "name": "GetClassLongA",
  2568. "address": "0x42d420"
  2569. },
  2570. {
  2571. "name": "SetPropA",
  2572. "address": "0x42d424"
  2573. },
  2574. {
  2575. "name": "UnhookWindowsHookEx",
  2576. "address": "0x42d428"
  2577. },
  2578. {
  2579. "name": "GetPropA",
  2580. "address": "0x42d42c"
  2581. },
  2582. {
  2583. "name": "CallWindowProcA",
  2584. "address": "0x42d430"
  2585. },
  2586. {
  2587. "name": "RemovePropA",
  2588. "address": "0x42d434"
  2589. },
  2590. {
  2591. "name": "DefWindowProcA",
  2592. "address": "0x42d438"
  2593. },
  2594. {
  2595. "name": "InvalidateRect",
  2596. "address": "0x42d43c"
  2597. },
  2598. {
  2599. "name": "GetMessagePos",
  2600. "address": "0x42d440"
  2601. },
  2602. {
  2603. "name": "GetLastActivePopup",
  2604. "address": "0x42d444"
  2605. },
  2606. {
  2607. "name": "wsprintfW",
  2608. "address": "0x42d448"
  2609. },
  2610. {
  2611. "name": "SetWindowPos",
  2612. "address": "0x42d44c"
  2613. },
  2614. {
  2615. "name": "UnregisterClassA",
  2616. "address": "0x42d450"
  2617. },
  2618. {
  2619. "name": "HideCaret",
  2620. "address": "0x42d454"
  2621. },
  2622. {
  2623. "name": "ShowCaret",
  2624. "address": "0x42d458"
  2625. },
  2626. {
  2627. "name": "ExcludeUpdateRgn",
  2628. "address": "0x42d45c"
  2629. },
  2630. {
  2631. "name": "DrawFocusRect",
  2632. "address": "0x42d460"
  2633. },
  2634. {
  2635. "name": "DefDlgProcA",
  2636. "address": "0x42d464"
  2637. },
  2638. {
  2639. "name": "GetForegroundWindow",
  2640. "address": "0x42d468"
  2641. },
  2642. {
  2643. "name": "SetForegroundWindow",
  2644. "address": "0x42d46c"
  2645. },
  2646. {
  2647. "name": "GetWindow",
  2648. "address": "0x42d470"
  2649. },
  2650. {
  2651. "name": "SetWindowLongA",
  2652. "address": "0x42d474"
  2653. },
  2654. {
  2655. "name": "RegisterWindowMessageA",
  2656. "address": "0x42d478"
  2657. },
  2658. {
  2659. "name": "IntersectRect",
  2660. "address": "0x42d47c"
  2661. },
  2662. {
  2663. "name": "SystemParametersInfoA",
  2664. "address": "0x42d480"
  2665. },
  2666. {
  2667. "name": "GetWindowPlacement",
  2668. "address": "0x42d484"
  2669. },
  2670. {
  2671. "name": "GetNextDlgTabItem",
  2672. "address": "0x42d488"
  2673. },
  2674. {
  2675. "name": "EndDialog",
  2676. "address": "0x42d48c"
  2677. },
  2678. {
  2679. "name": "GetActiveWindow",
  2680. "address": "0x42d490"
  2681. },
  2682. {
  2683. "name": "SetActiveWindow",
  2684. "address": "0x42d494"
  2685. },
  2686. {
  2687. "name": "IsWindow",
  2688. "address": "0x42d498"
  2689. },
  2690. {
  2691. "name": "CreateDialogIndirectParamA",
  2692. "address": "0x42d49c"
  2693. },
  2694. {
  2695. "name": "DestroyWindow",
  2696. "address": "0x42d4a0"
  2697. },
  2698. {
  2699. "name": "GetParent",
  2700. "address": "0x42d4a4"
  2701. },
  2702. {
  2703. "name": "GetDlgItem",
  2704. "address": "0x42d4a8"
  2705. },
  2706. {
  2707. "name": "IsWindowEnabled",
  2708. "address": "0x42d4ac"
  2709. },
  2710. {
  2711. "name": "GetWindowLongA",
  2712. "address": "0x42d4b0"
  2713. },
  2714. {
  2715. "name": "CopyRect",
  2716. "address": "0x42d4b4"
  2717. },
  2718. {
  2719. "name": "InflateRect",
  2720. "address": "0x42d4b8"
  2721. },
  2722. {
  2723. "name": "OffsetRect",
  2724. "address": "0x42d4bc"
  2725. },
  2726. {
  2727. "name": "DrawTextA",
  2728. "address": "0x42d4c0"
  2729. },
  2730. {
  2731. "name": "GetSystemMenu",
  2732. "address": "0x42d4c4"
  2733. },
  2734. {
  2735. "name": "AppendMenuA",
  2736. "address": "0x42d4c8"
  2737. },
  2738. {
  2739. "name": "EnableWindow",
  2740. "address": "0x42d4cc"
  2741. },
  2742. {
  2743. "name": "PtInRect",
  2744. "address": "0x42d4d0"
  2745. },
  2746. {
  2747. "name": "IsIconic",
  2748. "address": "0x42d4d4"
  2749. },
  2750. {
  2751. "name": "SendMessageA",
  2752. "address": "0x42d4d8"
  2753. },
  2754. {
  2755. "name": "GetSystemMetrics",
  2756. "address": "0x42d4dc"
  2757. },
  2758. {
  2759. "name": "GetClientRect",
  2760. "address": "0x42d4e0"
  2761. },
  2762. {
  2763. "name": "LoadIconA",
  2764. "address": "0x42d4e4"
  2765. },
  2766. {
  2767. "name": "DrawIcon",
  2768. "address": "0x42d4e8"
  2769. },
  2770. {
  2771. "name": "GrayStringA",
  2772. "address": "0x42d4ec"
  2773. },
  2774. {
  2775. "name": "GetMenuItemID",
  2776. "address": "0x42d4f0"
  2777. },
  2778. {
  2779. "name": "PostThreadMessageA",
  2780. "address": "0x42d4f4"
  2781. },
  2782. {
  2783. "name": "LoadBitmapA",
  2784. "address": "0x42d4f8"
  2785. },
  2786. {
  2787. "name": "FrameRect",
  2788. "address": "0x42d4fc"
  2789. },
  2790. {
  2791. "name": "IsWindowUnicode",
  2792. "address": "0x42d500"
  2793. },
  2794. {
  2795. "name": "GetWindowRect",
  2796. "address": "0x42d504"
  2797. },
  2798. {
  2799. "name": "RegisterClipboardFormatA",
  2800. "address": "0x42d508"
  2801. },
  2802. {
  2803. "name": "MessageBeep",
  2804. "address": "0x42d50c"
  2805. },
  2806. {
  2807. "name": "GetNextDlgGroupItem",
  2808. "address": "0x42d510"
  2809. },
  2810. {
  2811. "name": "SetRect",
  2812. "address": "0x42d514"
  2813. },
  2814. {
  2815. "name": "CopyAcceleratorTableA",
  2816. "address": "0x42d518"
  2817. },
  2818. {
  2819. "name": "CharNextA",
  2820. "address": "0x42d51c"
  2821. },
  2822. {
  2823. "name": "GetSysColorBrush",
  2824. "address": "0x42d520"
  2825. },
  2826. {
  2827. "name": "LoadCursorA",
  2828. "address": "0x42d524"
  2829. },
  2830. {
  2831. "name": "GetClassNameA",
  2832. "address": "0x42d528"
  2833. },
  2834. {
  2835. "name": "CharUpperA",
  2836. "address": "0x42d52c"
  2837. },
  2838. {
  2839. "name": "GetDesktopWindow",
  2840. "address": "0x42d530"
  2841. },
  2842. {
  2843. "name": "LoadStringA",
  2844. "address": "0x42d534"
  2845. },
  2846. {
  2847. "name": "MapDialogRect",
  2848. "address": "0x42d538"
  2849. },
  2850. {
  2851. "name": "SetWindowContextHelpId",
  2852. "address": "0x42d53c"
  2853. },
  2854. {
  2855. "name": "GetMessageA",
  2856. "address": "0x42d540"
  2857. },
  2858. {
  2859. "name": "TranslateMessage",
  2860. "address": "0x42d544"
  2861. },
  2862. {
  2863. "name": "GetMessageTime",
  2864. "address": "0x42d548"
  2865. },
  2866. {
  2867. "name": "ValidateRect",
  2868. "address": "0x42d54c"
  2869. },
  2870. {
  2871. "name": "GetCursorPos",
  2872. "address": "0x42d550"
  2873. },
  2874. {
  2875. "name": "SetCursor",
  2876. "address": "0x42d554"
  2877. },
  2878. {
  2879. "name": "PostQuitMessage",
  2880. "address": "0x42d558"
  2881. },
  2882. {
  2883. "name": "DestroyMenu",
  2884. "address": "0x42d55c"
  2885. }
  2886. ],
  2887. "dll": "USER32.dll"
  2888. },
  2889. {
  2890. "imports": [
  2891. {
  2892. "name": "GetDeviceCaps",
  2893. "address": "0x42d070"
  2894. },
  2895. {
  2896. "name": "GetViewportExtEx",
  2897. "address": "0x42d074"
  2898. },
  2899. {
  2900. "name": "GetWindowExtEx",
  2901. "address": "0x42d078"
  2902. },
  2903. {
  2904. "name": "PtVisible",
  2905. "address": "0x42d07c"
  2906. },
  2907. {
  2908. "name": "RectVisible",
  2909. "address": "0x42d080"
  2910. },
  2911. {
  2912. "name": "TextOutA",
  2913. "address": "0x42d084"
  2914. },
  2915. {
  2916. "name": "ExtTextOutA",
  2917. "address": "0x42d088"
  2918. },
  2919. {
  2920. "name": "Escape",
  2921. "address": "0x42d08c"
  2922. },
  2923. {
  2924. "name": "GetTextColor",
  2925. "address": "0x42d090"
  2926. },
  2927. {
  2928. "name": "GetBkColor",
  2929. "address": "0x42d094"
  2930. },
  2931. {
  2932. "name": "DPtoLP",
  2933. "address": "0x42d098"
  2934. },
  2935. {
  2936. "name": "LPtoDP",
  2937. "address": "0x42d09c"
  2938. },
  2939. {
  2940. "name": "GetMapMode",
  2941. "address": "0x42d0a0"
  2942. },
  2943. {
  2944. "name": "PatBlt",
  2945. "address": "0x42d0a4"
  2946. },
  2947. {
  2948. "name": "IntersectClipRect",
  2949. "address": "0x42d0a8"
  2950. },
  2951. {
  2952. "name": "ScaleWindowExtEx",
  2953. "address": "0x42d0ac"
  2954. },
  2955. {
  2956. "name": "SetWindowExtEx",
  2957. "address": "0x42d0b0"
  2958. },
  2959. {
  2960. "name": "ScaleViewportExtEx",
  2961. "address": "0x42d0b4"
  2962. },
  2963. {
  2964. "name": "SetViewportExtEx",
  2965. "address": "0x42d0b8"
  2966. },
  2967. {
  2968. "name": "OffsetViewportOrgEx",
  2969. "address": "0x42d0bc"
  2970. },
  2971. {
  2972. "name": "SetViewportOrgEx",
  2973. "address": "0x42d0c0"
  2974. },
  2975. {
  2976. "name": "SetMapMode",
  2977. "address": "0x42d0c4"
  2978. },
  2979. {
  2980. "name": "GetStockObject",
  2981. "address": "0x42d0c8"
  2982. },
  2983. {
  2984. "name": "SelectObject",
  2985. "address": "0x42d0cc"
  2986. },
  2987. {
  2988. "name": "RestoreDC",
  2989. "address": "0x42d0d0"
  2990. },
  2991. {
  2992. "name": "SaveDC",
  2993. "address": "0x42d0d4"
  2994. },
  2995. {
  2996. "name": "DeleteDC",
  2997. "address": "0x42d0d8"
  2998. },
  2999. {
  3000. "name": "CreateBitmap",
  3001. "address": "0x42d0dc"
  3002. },
  3003. {
  3004. "name": "SetBkColor",
  3005. "address": "0x42d0e0"
  3006. },
  3007. {
  3008. "name": "GetClipBox",
  3009. "address": "0x42d0e4"
  3010. },
  3011. {
  3012. "name": "DeleteObject",
  3013. "address": "0x42d0e8"
  3014. },
  3015. {
  3016. "name": "SetBkMode",
  3017. "address": "0x42d0ec"
  3018. },
  3019. {
  3020. "name": "SetTextColor",
  3021. "address": "0x42d0f0"
  3022. },
  3023. {
  3024. "name": "CreateCompatibleDC",
  3025. "address": "0x42d0f4"
  3026. },
  3027. {
  3028. "name": "GetObjectA",
  3029. "address": "0x42d0f8"
  3030. },
  3031. {
  3032. "name": "StretchBlt",
  3033. "address": "0x42d0fc"
  3034. },
  3035. {
  3036. "name": "CreateFontIndirectA",
  3037. "address": "0x42d100"
  3038. },
  3039. {
  3040. "name": "CreateDIBitmap",
  3041. "address": "0x42d104"
  3042. },
  3043. {
  3044. "name": "GetTextExtentPointA",
  3045. "address": "0x42d108"
  3046. },
  3047. {
  3048. "name": "BitBlt",
  3049. "address": "0x42d10c"
  3050. },
  3051. {
  3052. "name": "CreateSolidBrush",
  3053. "address": "0x42d110"
  3054. }
  3055. ],
  3056. "dll": "GDI32.dll"
  3057. },
  3058. {
  3059. "imports": [
  3060. {
  3061. "name": "GetFileTitleA",
  3062. "address": "0x42d5ac"
  3063. }
  3064. ],
  3065. "dll": "comdlg32.dll"
  3066. },
  3067. {
  3068. "imports": [
  3069. {
  3070. "name": "ClosePrinter",
  3071. "address": "0x42d59c"
  3072. },
  3073. {
  3074. "name": "OpenPrinterA",
  3075. "address": "0x42d5a0"
  3076. },
  3077. {
  3078. "name": "DocumentPropertiesA",
  3079. "address": "0x42d5a4"
  3080. }
  3081. ],
  3082. "dll": "WINSPOOL.DRV"
  3083. },
  3084. {
  3085. "imports": [
  3086. {
  3087. "name": "RegSetKeySecurity",
  3088. "address": "0x42d000"
  3089. },
  3090. {
  3091. "name": "RegCreateKeyExA",
  3092. "address": "0x42d004"
  3093. },
  3094. {
  3095. "name": "AllocateAndInitializeSid",
  3096. "address": "0x42d008"
  3097. },
  3098. {
  3099. "name": "GetLengthSid",
  3100. "address": "0x42d00c"
  3101. },
  3102. {
  3103. "name": "InitializeAcl",
  3104. "address": "0x42d010"
  3105. },
  3106. {
  3107. "name": "AddAccessAllowedAce",
  3108. "address": "0x42d014"
  3109. },
  3110. {
  3111. "name": "InitializeSecurityDescriptor",
  3112. "address": "0x42d018"
  3113. },
  3114. {
  3115. "name": "SetSecurityDescriptorDacl",
  3116. "address": "0x42d01c"
  3117. },
  3118. {
  3119. "name": "AdjustTokenPrivileges",
  3120. "address": "0x42d020"
  3121. },
  3122. {
  3123. "name": "FreeSid",
  3124. "address": "0x42d024"
  3125. },
  3126. {
  3127. "name": "LookupAccountNameA",
  3128. "address": "0x42d028"
  3129. },
  3130. {
  3131. "name": "RegOpenKeyExA",
  3132. "address": "0x42d02c"
  3133. },
  3134. {
  3135. "name": "RegSetValueExA",
  3136. "address": "0x42d030"
  3137. },
  3138. {
  3139. "name": "RegCloseKey",
  3140. "address": "0x42d034"
  3141. },
  3142. {
  3143. "name": "ControlService",
  3144. "address": "0x42d038"
  3145. },
  3146. {
  3147. "name": "DeleteService",
  3148. "address": "0x42d03c"
  3149. },
  3150. {
  3151. "name": "CreateServiceA",
  3152. "address": "0x42d040"
  3153. },
  3154. {
  3155. "name": "StartServiceA",
  3156. "address": "0x42d044"
  3157. },
  3158. {
  3159. "name": "QueryServiceConfigA",
  3160. "address": "0x42d048"
  3161. },
  3162. {
  3163. "name": "QueryServiceStatus",
  3164. "address": "0x42d04c"
  3165. },
  3166. {
  3167. "name": "OpenSCManagerA",
  3168. "address": "0x42d050"
  3169. },
  3170. {
  3171. "name": "OpenServiceA",
  3172. "address": "0x42d054"
  3173. },
  3174. {
  3175. "name": "CloseServiceHandle",
  3176. "address": "0x42d058"
  3177. },
  3178. {
  3179. "name": "OpenProcessToken",
  3180. "address": "0x42d05c"
  3181. },
  3182. {
  3183. "name": "LookupPrivilegeValueA",
  3184. "address": "0x42d060"
  3185. }
  3186. ],
  3187. "dll": "ADVAPI32.dll"
  3188. },
  3189. {
  3190. "imports": [
  3191. {
  3192. "name": null,
  3193. "address": "0x42d068"
  3194. }
  3195. ],
  3196. "dll": "COMCTL32.dll"
  3197. },
  3198. {
  3199. "imports": [
  3200. {
  3201. "name": null,
  3202. "address": "0x42d5f4"
  3203. }
  3204. ],
  3205. "dll": "oledlg.dll"
  3206. },
  3207. {
  3208. "imports": [
  3209. {
  3210. "name": "CoTaskMemFree",
  3211. "address": "0x42d5b4"
  3212. },
  3213. {
  3214. "name": "CoTaskMemAlloc",
  3215. "address": "0x42d5b8"
  3216. },
  3217. {
  3218. "name": "OleInitialize",
  3219. "address": "0x42d5bc"
  3220. },
  3221. {
  3222. "name": "OleUninitialize",
  3223. "address": "0x42d5c0"
  3224. },
  3225. {
  3226. "name": "CoFreeUnusedLibraries",
  3227. "address": "0x42d5c4"
  3228. },
  3229. {
  3230. "name": "CreateILockBytesOnHGlobal",
  3231. "address": "0x42d5c8"
  3232. },
  3233. {
  3234. "name": "StgCreateDocfileOnILockBytes",
  3235. "address": "0x42d5cc"
  3236. },
  3237. {
  3238. "name": "CoRegisterMessageFilter",
  3239. "address": "0x42d5d0"
  3240. },
  3241. {
  3242. "name": "CoRevokeClassObject",
  3243. "address": "0x42d5d4"
  3244. },
  3245. {
  3246. "name": "OleFlushClipboard",
  3247. "address": "0x42d5d8"
  3248. },
  3249. {
  3250. "name": "OleIsCurrentClipboard",
  3251. "address": "0x42d5dc"
  3252. },
  3253. {
  3254. "name": "StgOpenStorageOnILockBytes",
  3255. "address": "0x42d5e0"
  3256. },
  3257. {
  3258. "name": "CoGetClassObject",
  3259. "address": "0x42d5e4"
  3260. },
  3261. {
  3262. "name": "CLSIDFromString",
  3263. "address": "0x42d5e8"
  3264. },
  3265. {
  3266. "name": "CLSIDFromProgID",
  3267. "address": "0x42d5ec"
  3268. }
  3269. ],
  3270. "dll": "ole32.dll"
  3271. },
  3272. {
  3273. "imports": [
  3274. {
  3275. "name": null,
  3276. "address": "0x42d350"
  3277. }
  3278. ],
  3279. "dll": "OLEPRO32.DLL"
  3280. },
  3281. {
  3282. "imports": [
  3283. {
  3284. "name": "VariantChangeType",
  3285. "address": "0x42d328"
  3286. },
  3287. {
  3288. "name": "VariantTimeToSystemTime",
  3289. "address": "0x42d32c"
  3290. },
  3291. {
  3292. "name": "VariantClear",
  3293. "address": "0x42d330"
  3294. },
  3295. {
  3296. "name": "SysAllocStringLen",
  3297. "address": "0x42d334"
  3298. },
  3299. {
  3300. "name": "SysFreeString",
  3301. "address": "0x42d338"
  3302. },
  3303. {
  3304. "name": "SysAllocString",
  3305. "address": "0x42d33c"
  3306. },
  3307. {
  3308. "name": "SysAllocStringByteLen",
  3309. "address": "0x42d340"
  3310. },
  3311. {
  3312. "name": "SysStringLen",
  3313. "address": "0x42d344"
  3314. },
  3315. {
  3316. "name": "VariantCopy",
  3317. "address": "0x42d348"
  3318. }
  3319. ],
  3320. "dll": "OLEAUT32.dll"
  3321. },
  3322. {
  3323. "imports": [
  3324. {
  3325. "name": "GetModuleFileNameExA",
  3326. "address": "0x42d358"
  3327. },
  3328. {
  3329. "name": "EnumProcessModules",
  3330. "address": "0x42d35c"
  3331. }
  3332. ],
  3333. "dll": "PSAPI.DLL"
  3334. },
  3335. {
  3336. "imports": [
  3337. {
  3338. "name": "InternetGetLastResponseInfoA",
  3339. "address": "0x42d564"
  3340. },
  3341. {
  3342. "name": "InternetQueryDataAvailable",
  3343. "address": "0x42d568"
  3344. },
  3345. {
  3346. "name": "InternetReadFile",
  3347. "address": "0x42d56c"
  3348. },
  3349. {
  3350. "name": "InternetWriteFile",
  3351. "address": "0x42d570"
  3352. },
  3353. {
  3354. "name": "InternetSetFilePointer",
  3355. "address": "0x42d574"
  3356. },
  3357. {
  3358. "name": "InternetSetStatusCallback",
  3359. "address": "0x42d578"
  3360. },
  3361. {
  3362. "name": "InternetSetOptionExA",
  3363. "address": "0x42d57c"
  3364. },
  3365. {
  3366. "name": "InternetOpenUrlA",
  3367. "address": "0x42d580"
  3368. },
  3369. {
  3370. "name": "InternetCrackUrlA",
  3371. "address": "0x42d584"
  3372. },
  3373. {
  3374. "name": "InternetCanonicalizeUrlA",
  3375. "address": "0x42d588"
  3376. },
  3377. {
  3378. "name": "InternetQueryOptionA",
  3379. "address": "0x42d58c"
  3380. },
  3381. {
  3382. "name": "InternetOpenA",
  3383. "address": "0x42d590"
  3384. },
  3385. {
  3386. "name": "InternetCloseHandle",
  3387. "address": "0x42d594"
  3388. }
  3389. ],
  3390. "dll": "WININET.dll"
  3391. }
  3392. ],
  3393. "digital_signers": null,
  3394. "exported_dll_name": null,
  3395. "actual_checksum": "0x0006297b",
  3396. "overlay": {
  3397. "size": "0x00001520",
  3398. "offset": "0x00054000"
  3399. },
  3400. "imagebase": "0x00400000",
  3401. "reported_checksum": "0x0006297b",
  3402. "icon_hash": null,
  3403. "entrypoint": "0x0040f6fc",
  3404. "timestamp": "2008-07-11 07:45:21",
  3405. "osversion": "4.0",
  3406. "sections": [
  3407. {
  3408. "name": ".text",
  3409. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  3410. "virtual_address": "0x00001000",
  3411. "size_of_data": "0x0002c000",
  3412. "entropy": "6.59",
  3413. "raw_address": "0x00001000",
  3414. "virtual_size": "0x0002b937",
  3415. "characteristics_raw": "0x60000020"
  3416. },
  3417. {
  3418. "name": ".rdata",
  3419. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  3420. "virtual_address": "0x0002d000",
  3421. "size_of_data": "0x0000b000",
  3422. "entropy": "4.55",
  3423. "raw_address": "0x0002d000",
  3424. "virtual_size": "0x0000a620",
  3425. "characteristics_raw": "0x40000040"
  3426. },
  3427. {
  3428. "name": ".data",
  3429. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  3430. "virtual_address": "0x00038000",
  3431. "size_of_data": "0x00005000",
  3432. "entropy": "2.98",
  3433. "raw_address": "0x00038000",
  3434. "virtual_size": "0x00009168",
  3435. "characteristics_raw": "0xc0000040"
  3436. },
  3437. {
  3438. "name": ".rsrc",
  3439. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  3440. "virtual_address": "0x00042000",
  3441. "size_of_data": "0x00017000",
  3442. "entropy": "6.25",
  3443. "raw_address": "0x0003d000",
  3444. "virtual_size": "0x00016490",
  3445. "characteristics_raw": "0x40000040"
  3446. }
  3447. ],
  3448. "resources": [],
  3449. "dirents": [
  3450. {
  3451. "virtual_address": "0x00000000",
  3452. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  3453. "size": "0x00000000"
  3454. },
  3455. {
  3456. "virtual_address": "0x000355c0",
  3457. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  3458. "size": "0x00000118"
  3459. },
  3460. {
  3461. "virtual_address": "0x00042000",
  3462. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  3463. "size": "0x00016490"
  3464. },
  3465. {
  3466. "virtual_address": "0x00000000",
  3467. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  3468. "size": "0x00000000"
  3469. },
  3470. {
  3471. "virtual_address": "0x00054000",
  3472. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  3473. "size": "0x00001520"
  3474. },
  3475. {
  3476. "virtual_address": "0x00000000",
  3477. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  3478. "size": "0x00000000"
  3479. },
  3480. {
  3481. "virtual_address": "0x00000000",
  3482. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  3483. "size": "0x00000000"
  3484. },
  3485. {
  3486. "virtual_address": "0x00000000",
  3487. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  3488. "size": "0x00000000"
  3489. },
  3490. {
  3491. "virtual_address": "0x00000000",
  3492. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  3493. "size": "0x00000000"
  3494. },
  3495. {
  3496. "virtual_address": "0x00000000",
  3497. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  3498. "size": "0x00000000"
  3499. },
  3500. {
  3501. "virtual_address": "0x00000000",
  3502. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  3503. "size": "0x00000000"
  3504. },
  3505. {
  3506. "virtual_address": "0x00000000",
  3507. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  3508. "size": "0x00000000"
  3509. },
  3510. {
  3511. "virtual_address": "0x0002d000",
  3512. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  3513. "size": "0x000005fc"
  3514. },
  3515. {
  3516. "virtual_address": "0x00000000",
  3517. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  3518. "size": "0x00000000"
  3519. },
  3520. {
  3521. "virtual_address": "0x00000000",
  3522. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  3523. "size": "0x00000000"
  3524. },
  3525. {
  3526. "virtual_address": "0x00000000",
  3527. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  3528. "size": "0x00000000"
  3529. }
  3530. ],
  3531. "exports": [],
  3532. "guest_signers": {},
  3533. "imphash": "940f1f3564f8c29235f80f4ef8cdf034",
  3534. "icon_fuzzy": null,
  3535. "icon": null,
  3536. "pdbpath": null,
  3537. "imported_dll_count": 13,
  3538. "versioninfo": []
  3539. }
  3540. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!