API tools faq
paste
paladin316

Exes_00c53e6946023a23d8c11cd25858408b_exe.json

paladin316
Jun 19th, 2019
2,118
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 65.11 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_00c53e6946023a23d8c11cd25858408b.exe"
  7. [*] File Size: 114176
  8. [*] File Type: "MS-DOS executable"
  9. [*] SHA256: "4759ce507a4d1166d4353badd23eb0e9dce62c50a17c99b99b08537d2879c7fe"
  10. [*] MD5: "00c53e6946023a23d8c11cd25858408b"
  11. [*] SHA1: "b5007db2a76f3677a4ed5224007aa782bb76ad4f"
  12. [*] SHA512: "486a4ed7186d6a684f2856c5d2320446b93d02231fa87c0183f4781c45aac6ad70cd97f6692a088e397c1a8b9e43894f6ecca7f57843c53504cfafd9820d918a"
  13. [*] CRC32: "E54CE88C"
  14. [*] SSDEEP: "3072:dL83s21VklM/NfTHjHXeye+qh3Na9u/U/:dY3hGIfTDBsM"
  15.  
  16. [*] Process Execution: [
  17. "Exes_00c53e6946023a23d8c11cd25858408b.exe",
  18. "services.exe",
  19. "sqlbrowserse.exe",
  20. "sqlbrowserse.exe",
  21. "svchost.exe",
  22. "WerFault.exe",
  23. "WerFault.exe",
  24. "wermgr.exe",
  25. "GoogleUpdate.exe",
  26. "svchost.exe",
  27. "WmiPrvSE.exe",
  28. "svchost.exe",
  29. "svchost.exe",
  30. "svchost.exe",
  31. "wermgr.exe",
  32. "WerFault.exe",
  33. "taskhost.exe"
  34. ]
  35.  
  36. [*] Signatures Detected: [
  37. {
  38. "Description": "At least one process apparently crashed during execution",
  39. "Details": []
  40. },
  41. {
  42. "Description": "Attempts to connect to a dead IP:Port (4 unique times)",
  43. "Details": [
  44. {
  45. "IP": "114.113.151.154:21381"
  46. },
  47. {
  48. "IP": "172.217.164.195:443"
  49. },
  50. {
  51. "IP": "203.205.151.50:80"
  52. },
  53. {
  54. "IP": "203.205.151.50:443"
  55. }
  56. ]
  57. },
  58. {
  59. "Description": "A process attempted to delay the analysis task.",
  60. "Details": [
  61. {
  62. "Process": "sqlbrowserse.exe tried to sleep 284 seconds, actually delayed analysis time by 0 seconds"
  63. }
  64. ]
  65. },
  66. {
  67. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  68. "Details": [
  69. {
  70. "ioc": "http://crl.globalsign.net/root-r2.crl0"
  71. }
  72. ]
  73. },
  74. {
  75. "Description": "Drops a binary and executes it",
  76. "Details": [
  77. {
  78. "binary": "C:\\Program Files (x86)\\Microsoft SQL Server\\sqlbrowserse.exe"
  79. }
  80. ]
  81. },
  82. {
  83. "Description": "Performs some HTTP requests",
  84. "Details": [
  85. {
  86. "url": "http://users.qzone.qq.com/fcg-bin/cgi_get_portrait.fcg?uins="
  87. }
  88. ]
  89. },
  90. {
  91. "Description": "The binary likely contains encrypted or compressed data.",
  92. "Details": [
  93. {
  94. "section": "name: .MPRESS1, entropy: 8.00, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00018000, virtual_size: 0x0003f000"
  95. }
  96. ]
  97. },
  98. {
  99. "Description": "Deletes its original binary from disk",
  100. "Details": []
  101. },
  102. {
  103. "Description": "Sniffs keystrokes",
  104. "Details": [
  105. {
  106. "GetAsyncKeyState": "Process: sqlbrowserse.exe(692)"
  107. }
  108. ]
  109. },
  110. {
  111. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  112. "Details": [
  113. {
  114. "Spam": "services.exe (504) called API GetSystemTimeAsFileTime 16825009 times"
  115. }
  116. ]
  117. },
  118. {
  119. "Description": "Installs itself for autorun at Windows startup",
  120. "Details": [
  121. {
  122. "service name": "SQL\\xef\\xbf\\x8a\\xef\\xbf\\xbd\\xef\\xbe\\xbe\\xef\\xbf\\x9d\\xef\\xbe\\xbf\\xef\\xbf\\xa2\\xef\\xbe\\xb7\\xef\\xbf\\xbe\\xef\\xbf\\x8e\\xef\\xbf\\xb1"
  123. },
  124. {
  125. "service path": "C:\\Program Files (x86)\\Microsoft SQL Server\\sqlbrowserse.exe"
  126. }
  127. ]
  128. },
  129. {
  130. "Description": "Creates a hidden or system file",
  131. "Details": [
  132. {
  133. "file": "C:\\Program Files (x86)\\Microsoft SQL Server\\sqlbrowserse.exe"
  134. }
  135. ]
  136. },
  137. {
  138. "Description": "Checks the system manufacturer, likely for anti-virtualization",
  139. "Details": []
  140. },
  141. {
  142. "Description": "Creates a copy of itself",
  143. "Details": [
  144. {
  145. "copy": "C:\\Program Files (x86)\\Microsoft SQL Server\\sqlbrowserse.exe"
  146. }
  147. ]
  148. },
  149. {
  150. "Description": "Attempts to disable UAC",
  151. "Details": []
  152. },
  153. {
  154. "Description": "Attempts to modify UAC prompt behavior",
  155. "Details": []
  156. },
  157. {
  158. "Description": "Created a service that was not started",
  159. "Details": [
  160. {
  161. "service": "SQL\\xef\\xbf\\x8a\\xef\\xbf\\xbd\\xef\\xbe\\xbe\\xef\\xbf\\x9d\\xef\\xbe\\xbf\\xef\\xbf\\xa2\\xef\\xbe\\xb7\\xef\\xbf\\xbe\\xef\\xbf\\x8e\\xef\\xbf\\xb1"
  162. }
  163. ]
  164. }
  165. ]
  166.  
  167. [*] Started Service: [
  168. "SQL\\xc3\\x8a\\xc3\\xbd\\xc2\\xbe\\xc3\\x9d\\xc2\\xbf\\xc3\\xa2\\xc2\\xb7\\xc3\\xbe\\xc3\\x8e\\xc3\\xb1",
  169. "WerSvc"
  170. ]
  171.  
  172. [*] Executed Commands: [
  173. "C:\\Program Files (x86)\\Microsoft SQL Server\\sqlbrowserse.exe",
  174. "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
  175. "\"C:\\Program Files (x86)\\Google\\Update\\GoogleUpdate.exe\" /svc",
  176. "C:\\Windows\\System32\\svchost.exe -k netsvcs",
  177. "C:\\Windows\\system32\\svchost.exe -k netsvcs",
  178. "taskhost.exe $(Arg0)",
  179. "C:\\Program Files (x86)\\Microsoft SQL Server\\sqlbrowserse.exe Win7",
  180. "C:\\Windows\\SysWOW64\\WerFault.exe -u -p 2708 -s 288",
  181. "C:\\Windows\\SysWOW64\\WerFault.exe -u -p 692 -s 984",
  182. "\"C:\\Windows\\system32\\wermgr.exe\" \"-queuereporting_svc\" \"C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_sqlbrowserse.exe_256467e7b9ce905bd66f299e5f4f39e8bdd033_cab_03b579c9\"",
  183. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding",
  184. "\"C:\\Windows\\system32\\wermgr.exe\" \"-queuereporting_svc\" \"C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_sqlbrowserse.exe_ce2e69648775cad0a45e39fc58e6a44baa20_cab_08b7d6bd\"",
  185. "C:\\Windows\\system32\\WerFault.exe -u -p 2680 -s 284"
  186. ]
  187.  
  188. [*] Mutexes: [
  189. "Local\\!IETld!Mutex",
  190. "Local\\ZonesCounterMutex",
  191. "Local\\ZoneAttributeCacheCounterMutex",
  192. "Local\\ZonesCacheCounterMutex",
  193. "Local\\ZonesLockedCacheCounterMutex",
  194. "IESQMMUTEX_0_208",
  195. "Local\\WERReportingForProcess2708",
  196. "Global\\55c0ecbd-9227-11e9-a14c-18c08650be99",
  197. "Local\\WERReportingForProcess692",
  198. "Microsoft.Windows.Setup",
  199. "Global\\74f1901f-9227-11e9-a14c-18c08650be99",
  200. "Global\\\\xed\\xa9\\xb0\\xc7\\x90",
  201. "WERUI_APPCRASH-256467e7b9ce905bd66f299e5f4f39e8bdd033",
  202. "Global\\G{D19BAF17-7C87-467E-8D63-6C4B1C836373}",
  203. "Global\\G{6885AE8E-C070-458d-9711-37B9BEAB65F6}",
  204. "Global\\G{66CC0160-ABB3-4066-AE47-1CA6AD5065C8}",
  205. "Global\\G{0A175FBE-AEEC-4fea-855A-2AA549A88846}",
  206. "Global\\\\xc6\\xa0\\x1f",
  207. "WERUI_APPCRASH-ce2e69648775cad0a45e39fc58e6a44baa20",
  208. "Local\\WERReportingForProcess2680"
  209. ]
  210.  
  211. [*] Modified Files: [
  212. "C:\\Program Files (x86)\\Microsoft SQL Server\\sqlbrowserse.exe",
  213. "C:\\Windows\\System32\\24163531.bak",
  214. "C:\\Windows\\sysnative\\LogFiles\\Scm\\4963ad21-c4a5-42a5-b9bd-e441d57204fe",
  215. "C:\\Windows\\sysnative\\LogFiles\\Scm\\54963014-f948-4bc2-804f-9d49746f9a25",
  216. "C:\\Windows\\Temp\\WER5171.tmp.appcompat.txt",
  217. "C:\\Windows\\Temp\\WER68C3.tmp.WERInternalMetadata.xml",
  218. "C:\\Windows\\Temp\\WER68E3.tmp.hdmp",
  219. "C:\\Windows\\Temp\\WER7086.tmp.mdmp",
  220. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_sqlbrowserse.exe_256467e7b9ce905bd66f299e5f4f39e8bdd033_cab_03b579c9\\WER5171.tmp.appcompat.txt",
  221. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_sqlbrowserse.exe_256467e7b9ce905bd66f299e5f4f39e8bdd033_cab_03b579c9\\WER68C3.tmp.WERInternalMetadata.xml",
  222. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_sqlbrowserse.exe_256467e7b9ce905bd66f299e5f4f39e8bdd033_cab_03b579c9\\WER68E3.tmp.hdmp",
  223. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_sqlbrowserse.exe_256467e7b9ce905bd66f299e5f4f39e8bdd033_cab_03b579c9\\WER7086.tmp.mdmp",
  224. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_sqlbrowserse.exe_256467e7b9ce905bd66f299e5f4f39e8bdd033_cab_03b579c9\\Report.wer",
  225. "C:\\Windows\\Temp\\WER46BE.tmp.appcompat.txt",
  226. "C:\\Windows\\Temp\\WER72F0.tmp.WERInternalMetadata.xml",
  227. "C:\\Windows\\Temp\\WERA1C1.tmp.hdmp",
  228. "C:\\Windows\\Temp\\WERA76F.tmp.mdmp",
  229. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_sqlbrowserse.exe_ce2e69648775cad0a45e39fc58e6a44baa20_cab_08b7d6bd\\WER46BE.tmp.appcompat.txt",
  230. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_sqlbrowserse.exe_ce2e69648775cad0a45e39fc58e6a44baa20_cab_08b7d6bd\\WER72F0.tmp.WERInternalMetadata.xml",
  231. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_sqlbrowserse.exe_ce2e69648775cad0a45e39fc58e6a44baa20_cab_08b7d6bd\\WERA1C1.tmp.hdmp",
  232. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_sqlbrowserse.exe_ce2e69648775cad0a45e39fc58e6a44baa20_cab_08b7d6bd\\WERA76F.tmp.mdmp",
  233. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_sqlbrowserse.exe_ce2e69648775cad0a45e39fc58e6a44baa20_cab_08b7d6bd\\Report.wer",
  234. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_sqlbrowserse.exe_256467e7b9ce905bd66f299e5f4f39e8bdd033_cab_03b579c9\\Report.wer.tmp",
  235. "\\??\\PIPE\\wkssvc",
  236. "\\??\\pipe\\GoogleCrashServices\\S-1-5-18",
  237. "C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat",
  238. "C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat",
  239. "\\??\\PIPE\\samr",
  240. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  241. "\\??\\WMIDataDevice",
  242. "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
  243. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
  244. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
  245. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
  246. "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
  247. "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
  248. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
  249. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_sqlbrowserse.exe_ce2e69648775cad0a45e39fc58e6a44baa20_cab_08b7d6bd\\Report.wer.tmp"
  250. ]
  251.  
  252. [*] Deleted Files: [
  253. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_00c53e6946023a23d8c11cd25858408b.exe",
  254. "C:\\Windows\\System32\\24163531.bak",
  255. "C:\\Windows\\Temp\\WER5171.tmp",
  256. "C:\\Windows\\Temp\\WER5171.tmp.appcompat.txt",
  257. "C:\\Windows\\Temp\\WER68C3.tmp",
  258. "C:\\Windows\\Temp\\WER68C3.tmp.WERInternalMetadata.xml",
  259. "C:\\Windows\\Temp\\WER68E3.tmp",
  260. "C:\\Windows\\Temp\\WER68E3.tmp.hdmp",
  261. "C:\\Windows\\Temp\\WER7086.tmp",
  262. "C:\\Windows\\Temp\\WER7086.tmp.mdmp",
  263. "C:\\Windows\\Temp\\WER46BE.tmp",
  264. "C:\\Windows\\Temp\\WER46BE.tmp.appcompat.txt",
  265. "C:\\Windows\\Temp\\WER72F0.tmp",
  266. "C:\\Windows\\Temp\\WER72F0.tmp.WERInternalMetadata.xml",
  267. "C:\\Windows\\Temp\\WERA1C1.tmp",
  268. "C:\\Windows\\Temp\\WERA1C1.tmp.hdmp",
  269. "C:\\Windows\\Temp\\WERA76F.tmp",
  270. "C:\\Windows\\Temp\\WERA76F.tmp.mdmp",
  271. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_sqlbrowserse.exe_256467e7b9ce905bd66f299e5f4f39e8bdd033_cab_03b579c9\\Report.wer.tmp",
  272. "C:\\Program Files (x86)\\Google\\Update\\Install\\{5E6C534E-BEB0-496F-AC30-74975E59C356}\\74.0.3729.169_73.0.3683.86_chrome_updater.exe",
  273. "C:\\Program Files (x86)\\Google\\Update\\Install\\{5E6C534E-BEB0-496F-AC30-74975E59C356}",
  274. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_sqlbrowserse.exe_ce2e69648775cad0a45e39fc58e6a44baa20_cab_08b7d6bd\\Report.wer.tmp"
  275. ]
  276.  
  277. [*] Modified Registry Keys: [
  278. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin",
  279. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA",
  280. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop",
  281. "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SQL\\xef\\xbf\\x8a\\xef\\xbf\\xbd\\xef\\xbe\\xbe\\xef\\xbf\\x9d\\xef\\xbe\\xbf\\xef\\xbf\\xa2\\xef\\xbe\\xb7\\xef\\xbf\\xbe\\xef\\xbf\\x8e\\xef\\xbf\\xb1",
  282. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\SQL\\xc3\\x8a\\xc3\\xbd\\xc2\\xbe\\xc3\\x9d\\xc2\\xbf\\xc3\\xa2\\xc2\\xb7\\xc3\\xbe\\xc3\\x8e\\xc3\\xb1\\MarkTime",
  283. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\SQL\\xc3\\x8a\\xc3\\xbd\\xc2\\xbe\\xc3\\x9d\\xc2\\xbf\\xc3\\xa2\\xc2\\xb7\\xc3\\xbe\\xc3\\x8e\\xc3\\xb1\\Description",
  284. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WerSvc\\Type",
  285. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\BITS\\Type",
  286. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Type",
  287. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  288. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  289. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
  290. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Debug",
  291. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\Windows Error Reporting\\Debug\\ExceptionRecord",
  292. "HKEY_LOCAL_MACHINE\\Software\\Google\\Update\\PersistedPings\\{62BDC987-04BE-4A02-878F-13073737AE9E}",
  293. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\PersistedPings\\{62BDC987-04BE-4A02-878F-13073737AE9E}\\PersistedPingString",
  294. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\PersistedPings\\{62BDC987-04BE-4A02-878F-13073737AE9E}\\PersistedPingTime",
  295. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\pv",
  296. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\pv",
  297. "HKEY_LOCAL_MACHINE\\Software\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\CurrentState",
  298. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\CurrentState\\StateValue",
  299. "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000_CLASSES\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  300. "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000\\Software\\Google\\Update\\proxy\\source",
  301. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\RollCallDayStartSec",
  302. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\DayOfLastRollCall",
  303. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\ping_freshness",
  304. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\cohort\\(Default)",
  305. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\cohort\\hint",
  306. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\cohort\\name",
  307. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\LastCheckSuccess",
  308. "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000\\Software\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\dr",
  309. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\RollCallDayStartSec",
  310. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\DayOfLastRollCall",
  311. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\ping_freshness",
  312. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\cohort\\(Default)",
  313. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\cohort\\hint",
  314. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\cohort\\name",
  315. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\UpdateAvailableCount",
  316. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\UpdateAvailableSince",
  317. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\LastChecked",
  318. "HKEY_LOCAL_MACHINE\\Software\\Google\\Update\\PersistedPings\\{E3C688AB-4B89-4D48-B4AC-C3921C2DE8E3}",
  319. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\PersistedPings\\{E3C688AB-4B89-4D48-B4AC-C3921C2DE8E3}\\PersistedPingString",
  320. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\PersistedPings\\{E3C688AB-4B89-4D48-B4AC-C3921C2DE8E3}\\PersistedPingTime",
  321. "HKEY_LOCAL_MACHINE\\Software\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\CurrentState",
  322. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\CurrentState\\DownloadTimeRemainingMs",
  323. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\CurrentState\\DownloadProgressPercent",
  324. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\CurrentState\\StateValue",
  325. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\BITS\\Performance\\PerfMMFileName",
  326. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BackupRestore\\FilesNotToBackup\\BITS_LOG",
  327. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BackupRestore\\FilesNotToBackup\\BITS_BAK",
  328. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
  329. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ThrottleDrege",
  330. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Parameters\\ServiceDllUnloadOnStop",
  331. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  332. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
  333. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
  334. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
  335. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
  336. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
  337. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
  338. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider"
  339. ]
  340.  
  341. [*] Deleted Registry Keys: [
  342. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  343. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  344. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  345. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  346. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\uid",
  347. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\old-uid",
  348. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\tttoken",
  349. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\UpdateAvailableCount",
  350. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\UpdateAvailableSince",
  351. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\dr",
  352. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\tttoken"
  353. ]
  354.  
  355. [*] DNS Communications: [
  356. {
  357. "type": "A",
  358. "request": "m.ovvvo.buzz",
  359. "answers": [
  360. {
  361. "data": "114.113.151.154",
  362. "type": "A"
  363. }
  364. ]
  365. },
  366. {
  367. "type": "A",
  368. "request": "users.qzone.qq.com",
  369. "answers": [
  370. {
  371. "data": "nds.qzone.qq.com",
  372. "type": "CNAME"
  373. },
  374. {
  375. "data": "203.205.151.50",
  376. "type": "A"
  377. }
  378. ]
  379. }
  380. ]
  381.  
  382. [*] Domains: [
  383. {
  384. "ip": "114.113.151.154",
  385. "domain": "m.ovvvo.buzz"
  386. },
  387. {
  388. "ip": "203.205.151.50",
  389. "domain": "users.qzone.qq.com"
  390. }
  391. ]
  392.  
  393. [*] Network Communication - ICMP: []
  394.  
  395. [*] Network Communication - HTTP: [
  396. {
  397. "count": 6,
  398. "body": "",
  399. "uri": "http://users.qzone.qq.com/fcg-bin/cgi_get_portrait.fcg?uins=",
  400. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  401. "method": "GET",
  402. "host": "users.qzone.qq.com",
  403. "version": "1.1",
  404. "path": "/fcg-bin/cgi_get_portrait.fcg?uins=",
  405. "data": "GET /fcg-bin/cgi_get_portrait.fcg?uins= HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: users.qzone.qq.com\r\nConnection: Keep-Alive\r\n\r\n",
  406. "port": 80
  407. }
  408. ]
  409.  
  410. [*] Network Communication - SMTP: []
  411.  
  412. [*] Network Communication - Hosts: []
  413.  
  414. [*] Network Communication - IRC: []
  415.  
  416. [*] Static Analysis: {
  417. "pe": {
  418. "peid_signatures": null,
  419. "imports": [
  420. {
  421. "imports": [
  422. {
  423. "name": "GetModuleHandleA",
  424. "address": "0x440050"
  425. },
  426. {
  427. "name": "GetProcAddress",
  428. "address": "0x440054"
  429. }
  430. ],
  431. "dll": "KERNEL32.DLL"
  432. },
  433. {
  434. "imports": [
  435. {
  436. "name": "FreeSid",
  437. "address": "0x44005c"
  438. }
  439. ],
  440. "dll": "ADVAPI32.dll"
  441. },
  442. {
  443. "imports": [
  444. {
  445. "name": "ShellExecuteExA",
  446. "address": "0x440064"
  447. }
  448. ],
  449. "dll": "SHELL32.dll"
  450. }
  451. ],
  452. "digital_signers": null,
  453. "exported_dll_name": null,
  454. "actual_checksum": "0x0002a03e",
  455. "overlay": null,
  456. "imagebase": "0x00400000",
  457. "reported_checksum": "0x00000000",
  458. "icon_hash": null,
  459. "entrypoint": "0x004400de",
  460. "timestamp": "2017-08-12 04:05:00",
  461. "osversion": "4.0",
  462. "sections": [
  463. {
  464. "name": ".MPRESS1",
  465. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  466. "virtual_address": "0x00001000",
  467. "size_of_data": "0x00018000",
  468. "entropy": "8.00",
  469. "raw_address": "0x00000200",
  470. "virtual_size": "0x0003f000",
  471. "characteristics_raw": "0xe00000e0"
  472. },
  473. {
  474. "name": ".MPRESS2",
  475. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  476. "virtual_address": "0x00040000",
  477. "size_of_data": "0x00000e00",
  478. "entropy": "5.55",
  479. "raw_address": "0x00018200",
  480. "virtual_size": "0x00000c48",
  481. "characteristics_raw": "0xe00000e0"
  482. },
  483. {
  484. "name": ".rsrc",
  485. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  486. "virtual_address": "0x00041000",
  487. "size_of_data": "0x00002e00",
  488. "entropy": "5.23",
  489. "raw_address": "0x00019000",
  490. "virtual_size": "0x00002c8c",
  491. "characteristics_raw": "0xc0000040"
  492. }
  493. ],
  494. "resources": [],
  495. "dirents": [
  496. {
  497. "virtual_address": "0x00000000",
  498. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  499. "size": "0x00000000"
  500. },
  501. {
  502. "virtual_address": "0x00040000",
  503. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  504. "size": "0x000000e0"
  505. },
  506. {
  507. "virtual_address": "0x00041000",
  508. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  509. "size": "0x00002c8c"
  510. },
  511. {
  512. "virtual_address": "0x00000000",
  513. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  514. "size": "0x00000000"
  515. },
  516. {
  517. "virtual_address": "0x00000000",
  518. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  519. "size": "0x00000000"
  520. },
  521. {
  522. "virtual_address": "0x00000000",
  523. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  524. "size": "0x00000000"
  525. },
  526. {
  527. "virtual_address": "0x00000000",
  528. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  529. "size": "0x00000000"
  530. },
  531. {
  532. "virtual_address": "0x00000000",
  533. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  534. "size": "0x00000000"
  535. },
  536. {
  537. "virtual_address": "0x00000000",
  538. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  539. "size": "0x00000000"
  540. },
  541. {
  542. "virtual_address": "0x00000000",
  543. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  544. "size": "0x00000000"
  545. },
  546. {
  547. "virtual_address": "0x00000000",
  548. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  549. "size": "0x00000000"
  550. },
  551. {
  552. "virtual_address": "0x00000000",
  553. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  554. "size": "0x00000000"
  555. },
  556. {
  557. "virtual_address": "0x00040050",
  558. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  559. "size": "0x00000018"
  560. },
  561. {
  562. "virtual_address": "0x00000000",
  563. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  564. "size": "0x00000000"
  565. },
  566. {
  567. "virtual_address": "0x00000000",
  568. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  569. "size": "0x00000000"
  570. },
  571. {
  572. "virtual_address": "0x00000000",
  573. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  574. "size": "0x00000000"
  575. }
  576. ],
  577. "exports": [],
  578. "guest_signers": {},
  579. "imphash": "32211670deb7493daef70884a73f68a5",
  580. "icon_fuzzy": null,
  581. "icon": null,
  582. "pdbpath": null,
  583. "imported_dll_count": 3,
  584. "versioninfo": []
  585. }
  586. }
  587.  
  588. [*] Resolved APIs: [
  589. "kernel32.dll.VirtualProtect",
  590. "kernel32.dll.VirtualFree",
  591. "kernel32.dll.GetProcAddress",
  592. "kernel32.dll.LoadLibraryA",
  593. "kernel32.dll.IsBadReadPtr",
  594. "kernel32.dll.HeapFree",
  595. "kernel32.dll.FreeLibrary",
  596. "kernel32.dll.GetVersionExA",
  597. "kernel32.dll.GetModuleFileNameA",
  598. "kernel32.dll.WriteFile",
  599. "kernel32.dll.VirtualAlloc",
  600. "kernel32.dll.GetProcessHeap",
  601. "kernel32.dll.ExitProcess",
  602. "kernel32.dll.HeapAlloc",
  603. "kernel32.dll.GetStringTypeA",
  604. "kernel32.dll.LCMapStringW",
  605. "kernel32.dll.HeapReAlloc",
  606. "kernel32.dll.RtlUnwind",
  607. "kernel32.dll.RaiseException",
  608. "kernel32.dll.GetModuleHandleA",
  609. "kernel32.dll.GetStartupInfoA",
  610. "kernel32.dll.GetCommandLineA",
  611. "kernel32.dll.GetVersion",
  612. "kernel32.dll.IsBadWritePtr",
  613. "kernel32.dll.GetEnvironmentVariableA",
  614. "kernel32.dll.HeapDestroy",
  615. "kernel32.dll.HeapCreate",
  616. "kernel32.dll.SetUnhandledExceptionFilter",
  617. "kernel32.dll.TerminateProcess",
  618. "kernel32.dll.GetCurrentProcess",
  619. "kernel32.dll.UnhandledExceptionFilter",
  620. "kernel32.dll.FreeEnvironmentStringsA",
  621. "kernel32.dll.FreeEnvironmentStringsW",
  622. "kernel32.dll.WideCharToMultiByte",
  623. "kernel32.dll.GetEnvironmentStrings",
  624. "kernel32.dll.GetEnvironmentStringsW",
  625. "kernel32.dll.SetHandleCount",
  626. "kernel32.dll.GetStdHandle",
  627. "kernel32.dll.GetFileType",
  628. "kernel32.dll.IsBadCodePtr",
  629. "kernel32.dll.GetCPInfo",
  630. "kernel32.dll.GetACP",
  631. "kernel32.dll.GetOEMCP",
  632. "kernel32.dll.MultiByteToWideChar",
  633. "kernel32.dll.LCMapStringA",
  634. "kernel32.dll.GetStringTypeW",
  635. "advapi32.dll.CheckTokenMembership",
  636. "advapi32.dll.FreeSid",
  637. "advapi32.dll.AllocateAndInitializeSid",
  638. "shell32.dll.ShellExecuteExA",
  639. "kernel32.dll.DeviceIoControl",
  640. "kernel32.dll.Beep",
  641. "kernel32.dll.WinExec",
  642. "kernel32.dll.TerminateThread",
  643. "kernel32.dll.InitializeCriticalSection",
  644. "kernel32.dll.DeleteCriticalSection",
  645. "kernel32.dll.LeaveCriticalSection",
  646. "kernel32.dll.EnterCriticalSection",
  647. "kernel32.dll.GlobalFree",
  648. "kernel32.dll.GlobalUnlock",
  649. "kernel32.dll.GlobalLock",
  650. "kernel32.dll.GlobalAlloc",
  651. "kernel32.dll.GlobalSize",
  652. "kernel32.dll.LoadLibraryW",
  653. "kernel32.dll.GlobalMemoryStatusEx",
  654. "kernel32.dll.Process32First",
  655. "kernel32.dll.InterlockedDecrement",
  656. "kernel32.dll.OpenEventA",
  657. "kernel32.dll.MoveFileExA",
  658. "kernel32.dll.SetFileAttributesA",
  659. "kernel32.dll.DefineDosDeviceA",
  660. "kernel32.dll.lstrcmpiA",
  661. "kernel32.dll.GetCurrentDirectoryA",
  662. "kernel32.dll.OpenProcess",
  663. "kernel32.dll.QueryDosDeviceA",
  664. "kernel32.dll.GetPriorityClass",
  665. "kernel32.dll.GetComputerNameA",
  666. "kernel32.dll.FileTimeToSystemTime",
  667. "kernel32.dll.SystemTimeToTzSpecificLocalTime",
  668. "kernel32.dll.SuspendThread",
  669. "kernel32.dll.OpenThread",
  670. "kernel32.dll.Thread32Next",
  671. "kernel32.dll.Thread32First",
  672. "kernel32.dll.ResumeThread",
  673. "kernel32.dll.GetCurrentThreadId",
  674. "kernel32.dll.OutputDebugStringA",
  675. "kernel32.dll.Process32Next",
  676. "kernel32.dll.CreateToolhelp32Snapshot",
  677. "kernel32.dll.CopyFileA",
  678. "kernel32.dll.MoveFileA",
  679. "kernel32.dll.SetFilePointer",
  680. "kernel32.dll.ReadFile",
  681. "kernel32.dll.CreateFileA",
  682. "kernel32.dll.GetFileSize",
  683. "kernel32.dll.RemoveDirectoryA",
  684. "kernel32.dll.GetLogicalDriveStringsA",
  685. "kernel32.dll.GetVolumeInformationA",
  686. "kernel32.dll.GetDiskFreeSpaceExA",
  687. "kernel32.dll.GetDriveTypeA",
  688. "kernel32.dll.ExpandEnvironmentStringsA",
  689. "kernel32.dll.CreateProcessA",
  690. "kernel32.dll.GetFileAttributesA",
  691. "kernel32.dll.CreateDirectoryA",
  692. "kernel32.dll.GetLastError",
  693. "kernel32.dll.FindFirstFileA",
  694. "kernel32.dll.LocalAlloc",
  695. "kernel32.dll.LocalReAlloc",
  696. "kernel32.dll.LocalSize",
  697. "kernel32.dll.LocalFree",
  698. "kernel32.dll.FindNextFileA",
  699. "kernel32.dll.FindClose",
  700. "kernel32.dll.DeleteFileA",
  701. "kernel32.dll.GetPrivateProfileStringA",
  702. "kernel32.dll.lstrcmpA",
  703. "kernel32.dll.GetWindowsDirectoryA",
  704. "kernel32.dll.lstrcatA",
  705. "kernel32.dll.GetPrivateProfileSectionNamesA",
  706. "kernel32.dll.lstrlenA",
  707. "kernel32.dll.GetSystemDirectoryA",
  708. "kernel32.dll.GetCurrentProcessId",
  709. "kernel32.dll.GetTickCount",
  710. "kernel32.dll.CreateThread",
  711. "kernel32.dll.ExitThread",
  712. "kernel32.dll.Sleep",
  713. "kernel32.dll.CancelIo",
  714. "kernel32.dll.InterlockedExchange",
  715. "kernel32.dll.SetEvent",
  716. "kernel32.dll.ResetEvent",
  717. "kernel32.dll.lstrcpyA",
  718. "kernel32.dll.WaitForSingleObject",
  719. "kernel32.dll.CloseHandle",
  720. "kernel32.dll.CreateEventA",
  721. "kernel32.dll.GetLocalTime",
  722. "kernel32.dll.GetSystemInfo",
  723. "kernel32.dll.DisableThreadLibraryCalls",
  724. "mfc42.dll.#825",
  725. "mfc42.dll.#800",
  726. "mfc42.dll.#540",
  727. "mfc42.dll.#6877",
  728. "mfc42.dll.#939",
  729. "mfc42.dll.#2818",
  730. "mfc42.dll.#4278",
  731. "mfc42.dll.#860",
  732. "mfc42.dll.#6663",
  733. "mfc42.dll.#858",
  734. "mfc42.dll.#535",
  735. "mfc42.dll.#922",
  736. "mfc42.dll.#924",
  737. "mfc42.dll.#926",
  738. "mfc42.dll.#4129",
  739. "mfc42.dll.#2764",
  740. "mfc42.dll.#6648",
  741. "mfc42.dll.#537",
  742. "mfc42.dll.#823",
  743. "msvcrt.dll.exit",
  744. "msvcrt.dll._access",
  745. "msvcrt.dll.ftell",
  746. "msvcrt.dll.fseek",
  747. "msvcrt.dll.fwrite",
  748. "msvcrt.dll.fclose",
  749. "msvcrt.dll._local_unwind2",
  750. "msvcrt.dll._iob",
  751. "msvcrt.dll.fprintf",
  752. "msvcrt.dll.sprintf",
  753. "msvcrt.dll.printf",
  754. "msvcrt.dll.time",
  755. "msvcrt.dll.srand",
  756. "msvcrt.dll.rand",
  757. "msvcrt.dll.realloc",
  758. "msvcrt.dll.memmove",
  759. "msvcrt.dll.system",
  760. "msvcrt.dll.strrchr",
  761. "msvcrt.dll.strncpy",
  762. "msvcrt.dll._except_handler3",
  763. "msvcrt.dll.free",
  764. "msvcrt.dll.strstr",
  765. "msvcrt.dll.malloc",
  766. "msvcrt.dll.strchr",
  767. "msvcrt.dll.__CxxFrameHandler",
  768. "msvcrt.dll._ftol",
  769. "msvcrt.dll.strncmp",
  770. "msvcrt.dll._vsnprintf",
  771. "msvcrt.dll.getchar",
  772. "msvcrt.dll.clock",
  773. "msvcrt.dll._mbsnbicmp",
  774. "msvcrt.dll.localtime",
  775. "msvcrt.dll._beginthreadex",
  776. "msvcrt.dll.strncat",
  777. "msvcrt.dll.__dllonexit",
  778. "msvcrt.dll._onexit",
  779. "msvcrt.dll._initterm",
  780. "msvcrt.dll._adjust_fdiv",
  781. "msvcrt.dll._CxxThrowException",
  782. "msvcrt.dll.??1type_info@@UAE@XZ",
  783. "msvcrt.dll.fopen",
  784. "msvcrt.dll.wcslen",
  785. "msvcrt.dll._strnicmp",
  786. "msvcrt.dll._strupr",
  787. "msvcrt.dll._stricmp",
  788. "msvcrt.dll.atoi",
  789. "user32.dll.EndDialog",
  790. "user32.dll.SendMessageA",
  791. "user32.dll.SetWindowPos",
  792. "user32.dll.IsWindowVisible",
  793. "user32.dll.GetMessageA",
  794. "user32.dll.GetClassNameA",
  795. "user32.dll.GetCursorInfo",
  796. "user32.dll.GetCursorPos",
  797. "user32.dll.TranslateMessage",
  798. "user32.dll.GetWindow",
  799. "user32.dll.PostMessageA",
  800. "user32.dll.CloseDesktop",
  801. "user32.dll.SetThreadDesktop",
  802. "user32.dll.OpenInputDesktop",
  803. "user32.dll.GetUserObjectInformationA",
  804. "user32.dll.GetThreadDesktop",
  805. "user32.dll.DispatchMessageA",
  806. "user32.dll.ShowWindow",
  807. "user32.dll.UpdateWindow",
  808. "user32.dll.ReleaseDC",
  809. "user32.dll.GetDesktopWindow",
  810. "user32.dll.GetDC",
  811. "user32.dll.SetRect",
  812. "user32.dll.GetSystemMetrics",
  813. "user32.dll.GetClipboardData",
  814. "user32.dll.OpenClipboard",
  815. "user32.dll.EmptyClipboard",
  816. "user32.dll.SetClipboardData",
  817. "user32.dll.CloseClipboard",
  818. "user32.dll.mouse_event",
  819. "user32.dll.SetCursorPos",
  820. "user32.dll.WindowFromPoint",
  821. "user32.dll.SetCapture",
  822. "user32.dll.keybd_event",
  823. "user32.dll.SystemParametersInfoA",
  824. "user32.dll.BlockInput",
  825. "user32.dll.DestroyCursor",
  826. "user32.dll.LoadCursorA",
  827. "user32.dll.EnumWindows",
  828. "user32.dll.FindWindowA",
  829. "user32.dll.MoveWindow",
  830. "user32.dll.GetWindowRect",
  831. "user32.dll.SwapMouseButton",
  832. "user32.dll.ExitWindowsEx",
  833. "user32.dll.MessageBoxA",
  834. "user32.dll.GetKeyState",
  835. "user32.dll.GetAsyncKeyState",
  836. "user32.dll.GetForegroundWindow",
  837. "user32.dll.GetWindowTextA",
  838. "user32.dll.CharNextA",
  839. "user32.dll.SetWindowTextA",
  840. "user32.dll.GetDlgItemTextA",
  841. "user32.dll.wsprintfA",
  842. "user32.dll.SetDlgItemTextA",
  843. "user32.dll.GetDlgItem",
  844. "user32.dll.CreateDialogParamA",
  845. "user32.dll.MapVirtualKeyA",
  846. "gdi32.dll.SelectObject",
  847. "gdi32.dll.CreateCompatibleDC",
  848. "gdi32.dll.DeleteObject",
  849. "gdi32.dll.DeleteDC",
  850. "gdi32.dll.BitBlt",
  851. "gdi32.dll.GetDIBits",
  852. "gdi32.dll.CreateCompatibleBitmap",
  853. "gdi32.dll.CreateDIBSection",
  854. "advapi32.dll.QueryServiceStatus",
  855. "advapi32.dll.ReadEventLogA",
  856. "advapi32.dll.GetTokenInformation",
  857. "advapi32.dll.LookupAccountSidA",
  858. "advapi32.dll.IsValidSid",
  859. "advapi32.dll.LookupAccountNameA",
  860. "advapi32.dll.LsaClose",
  861. "advapi32.dll.LsaRetrievePrivateData",
  862. "advapi32.dll.LsaOpenPolicy",
  863. "advapi32.dll.LsaFreeMemory",
  864. "advapi32.dll.CloseEventLog",
  865. "advapi32.dll.ClearEventLogA",
  866. "advapi32.dll.OpenEventLogA",
  867. "advapi32.dll.AdjustTokenPrivileges",
  868. "advapi32.dll.LookupPrivilegeValueA",
  869. "advapi32.dll.OpenProcessToken",
  870. "advapi32.dll.DeleteService",
  871. "advapi32.dll.OpenServiceA",
  872. "advapi32.dll.OpenSCManagerA",
  873. "advapi32.dll.RegSetValueExA",
  874. "advapi32.dll.RegOpenKeyExA",
  875. "advapi32.dll.RegDeleteValueA",
  876. "advapi32.dll.RegDeleteKeyA",
  877. "advapi32.dll.RegCreateKeyExA",
  878. "advapi32.dll.RegQueryInfoKeyA",
  879. "advapi32.dll.RegCloseKey",
  880. "advapi32.dll.RegEnumKeyExA",
  881. "advapi32.dll.RegEnumValueA",
  882. "advapi32.dll.RegQueryValueExA",
  883. "advapi32.dll.RegOpenKeyA",
  884. "advapi32.dll.CreateProcessAsUserA",
  885. "advapi32.dll.SetTokenInformation",
  886. "advapi32.dll.DuplicateTokenEx",
  887. "advapi32.dll.RegQueryValueA",
  888. "advapi32.dll.StartServiceCtrlDispatcherA",
  889. "advapi32.dll.CloseServiceHandle",
  890. "advapi32.dll.StartServiceA",
  891. "advapi32.dll.UnlockServiceDatabase",
  892. "advapi32.dll.ChangeServiceConfig2A",
  893. "advapi32.dll.LockServiceDatabase",
  894. "advapi32.dll.CreateServiceA",
  895. "advapi32.dll.QueryServiceConfigA",
  896. "advapi32.dll.QueryServiceConfig2A",
  897. "advapi32.dll.EnumServicesStatusA",
  898. "advapi32.dll.ControlService",
  899. "shell32.dll.ShellExecuteA",
  900. "shell32.dll.SHGetSpecialFolderPathA",
  901. "shell32.dll.SHGetFileInfoA",
  902. "ws2_32.dll.#4",
  903. "ws2_32.dll.#52",
  904. "ws2_32.dll.#23",
  905. "ws2_32.dll.#21",
  906. "ws2_32.dll.WSAIoctl",
  907. "ws2_32.dll.#116",
  908. "ws2_32.dll.#115",
  909. "ws2_32.dll.#6",
  910. "ws2_32.dll.#9",
  911. "ws2_32.dll.#18",
  912. "ws2_32.dll.#16",
  913. "ws2_32.dll.#3",
  914. "ws2_32.dll.#19",
  915. "ws2_32.dll.#12",
  916. "ws2_32.dll.#15",
  917. "ws2_32.dll.#111",
  918. "ws2_32.dll.#57",
  919. "ws2_32.dll.#8",
  920. "ws2_32.dll.WSASocketA",
  921. "ws2_32.dll.#20",
  922. "ws2_32.dll.#11",
  923. "msvcp60.dll.?_Init@?$basic_filebuf@DU?$char_traits@D@std@@@std@@IAEXPAU_iobuf@@W4_Initfl@12@@Z",
  924. "msvcp60.dll.?_Initcvt@?$basic_filebuf@DU?$char_traits@D@std@@@std@@IAEXXZ",
  925. "msvcp60.dll.?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z",
  926. "msvcp60.dll.?_Fpz@std@@3_JB",
  927. "msvcp60.dll.??0_Lockit@std@@QAE@XZ",
  928. "msvcp60.dll.??1_Lockit@std@@QAE@XZ",
  929. "msvcp60.dll.??1?$basic_filebuf@DU?$char_traits@D@std@@@std@@UAE@XZ",
  930. "msvcp60.dll.??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@",
  931. "msvcp60.dll.?_Xlen@std@@YAXXZ",
  932. "msvcp60.dll.??1ios_base@std@@UAE@XZ",
  933. "msvcp60.dll.??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ",
  934. "msvcp60.dll.??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ",
  935. "msvcp60.dll.??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ",
  936. "msvcp60.dll.?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB",
  937. "msvcp60.dll.?_Xran@std@@YAXXZ",
  938. "msvcp60.dll.?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ",
  939. "msvcp60.dll.?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z",
  940. "msvcp60.dll.?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z",
  941. "msvcp60.dll.?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z",
  942. "msvcp60.dll.?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z",
  943. "msvcp60.dll.??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  944. "msvcp60.dll.?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB",
  945. "msvcp60.dll.?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z",
  946. "msvcp60.dll.?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ",
  947. "msvcp60.dll.?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z",
  948. "msvcp60.dll.?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBDH@Z",
  949. "msvcp60.dll.?getline@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@AAV21@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z",
  950. "msvcp60.dll.??_7?$basic_filebuf@DU?$char_traits@D@std@@@std@@6B@",
  951. "msvcp60.dll.?close@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@XZ",
  952. "msvcp60.dll.??1locale@std@@QAE@XZ",
  953. "msvcp60.dll.??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ",
  954. "msvcp60.dll.??_8?$basic_ifstream@DU?$char_traits@D@std@@@std@@7B@",
  955. "msvcp60.dll.?__Fiopen@std@@YAPAU_iobuf@@PBDH@Z",
  956. "msvcp60.dll.??0ios_base@std@@IAE@XZ",
  957. "msvcp60.dll.??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@",
  958. "msvcp60.dll.??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z",
  959. "msvcp60.dll.??0?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAE@PAU_iobuf@@@Z",
  960. "msvcp60.dll.??_7?$basic_ifstream@DU?$char_traits@D@std@@@std@@6B@",
  961. "iphlpapi.dll.GetIfTable",
  962. "iphlpapi.dll.GetAdaptersInfo",
  963. "winmm.dll.mciSendStringA",
  964. "wtsapi32.dll.WTSQuerySessionInformationA",
  965. "wtsapi32.dll.WTSFreeMemory",
  966. "urlmon.dll.URLDownloadToFileA",
  967. "wininet.dll.InternetOpenA",
  968. "wininet.dll.InternetOpenUrlA",
  969. "wininet.dll.InternetReadFile",
  970. "wininet.dll.InternetCloseHandle",
  971. "wininet.dll.DeleteUrlCacheEntryA",
  972. "ole32.dll.OleRun",
  973. "ole32.dll.CoCreateInstance",
  974. "ole32.dll.CoInitialize",
  975. "ole32.dll.CLSIDFromProgID",
  976. "ole32.dll.CLSIDFromString",
  977. "ole32.dll.CoUninitialize",
  978. "oleaut32.dll.#6",
  979. "oleaut32.dll.#2",
  980. "oleaut32.dll.#200",
  981. "oleaut32.dll.#9",
  982. "psapi.dll.GetProcessMemoryInfo",
  983. "psapi.dll.GetProcessImageFileNameA",
  984. "psapi.dll.EnumProcessModules",
  985. "psapi.dll.GetModuleFileNameExA",
  986. "kernel32.dll.IsWow64Process",
  987. "user32.dll.OpenDesktopA",
  988. "userenv.dll.CreateEnvironmentBlock",
  989. "kernel32.dll.WTSGetActiveConsoleSessionId",
  990. "sechost.dll.ConvertSidToStringSidW",
  991. "sspicli.dll.GetUserNameExW",
  992. "cryptbase.dll.SystemFunction036",
  993. "uxtheme.dll.ThemeInitApiHook",
  994. "user32.dll.IsProcessDPIAware",
  995. "kernel32.dll.GetModuleHandleW",
  996. "urlmon.dll.DllCanUnloadNow",
  997. "urlmon.dll.IEDllLoader",
  998. "urlmon.dll.CoInternetCreateZoneManager",
  999. "urlmon.dll.CoInternetGetSession",
  1000. "urlmon.dll.CopyBindInfo",
  1001. "urlmon.dll.CreateURLMoniker",
  1002. "urlmon.dll.RegisterBindStatusCallback",
  1003. "urlmon.dll.ReleaseBindInfo",
  1004. "urlmon.dll.RevokeBindStatusCallback",
  1005. "urlmon.dll.UrlMkGetSessionOption",
  1006. "urlmon.dll.CoInternetCreateSecurityManager",
  1007. "urlmon.dll.CreateUri",
  1008. "urlmon.dll.CoInternetCombineUrl",
  1009. "urlmon.dll.CoInternetGetSecurityUrl",
  1010. "urlmon.dll.IsValidURL",
  1011. "wininet.dll.InternetCrackUrlW",
  1012. "wininet.dll.InternetCreateUrlW",
  1013. "kernel32.dll.InitializeSRWLock",
  1014. "kernel32.dll.AcquireSRWLockExclusive",
  1015. "kernel32.dll.AcquireSRWLockShared",
  1016. "kernel32.dll.ReleaseSRWLockExclusive",
  1017. "kernel32.dll.ReleaseSRWLockShared",
  1018. "rasapi32.dll.RasConnectionNotificationW",
  1019. "sechost.dll.NotifyServiceStatusChangeA",
  1020. "iphlpapi.dll.GetAdapterIndex",
  1021. "ole32.dll.CoInitializeEx",
  1022. "advapi32.dll.RegDeleteTreeA",
  1023. "advapi32.dll.RegDeleteTreeW",
  1024. "ole32.dll.CoTaskMemAlloc",
  1025. "oleaut32.dll.#8",
  1026. "oleaut32.dll.DllGetClassObject",
  1027. "oleaut32.dll.DllCanUnloadNow",
  1028. "advapi32.dll.RegOpenKeyW",
  1029. "ole32.dll.CoTaskMemFree",
  1030. "ole32.dll.StringFromIID",
  1031. "iphlpapi.dll.GetAdaptersAddresses",
  1032. "dhcpcsvc.dll.DhcpRequestParams",
  1033. "urlmon.dll.CoInternetIsFeatureEnabledForUrl",
  1034. "crypt32.dll.CertOpenStore",
  1035. "oleaut32.dll.#500",
  1036. "userenv.dll.GetUserProfileDirectoryW",
  1037. "wintrust.dll.WinVerifyTrust",
  1038. "wintrust.dll.WTHelperProvDataFromStateData",
  1039. "wintrust.dll.WTHelperGetProvSignerFromChain",
  1040. "schannel.dll.InitSecurityInterfaceA",
  1041. "crypt32.dll.CertSelectCertificateChains",
  1042. "crypt32.dll.CertFreeCertificateChainList",
  1043. "cryptsp.dll.SystemFunction035",
  1044. "schannel.dll.SpUserModeInitialize",
  1045. "advapi32.dll.RegCreateKeyExW",
  1046. "advapi32.dll.RegQueryValueExW",
  1047. "crypt32.dll.CertDuplicateStore",
  1048. "crypt32.dll.CertControlStore",
  1049. "crypt32.dll.CertCloseStore",
  1050. "kernel32.dll.SortGetHandle",
  1051. "kernel32.dll.SortCloseHandle",
  1052. "wersvc.dll.ServiceMain",
  1053. "wersvc.dll.SvchostPushServiceGlobals",
  1054. "advapi32.dll.RegGetValueW",
  1055. "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  1056. "faultrep.dll.WerpInitiateCrashReporting",
  1057. "wer.dll.WerpCreateMachineStore",
  1058. "shell32.dll.SHGetFolderPathEx",
  1059. "ole32.dll.StringFromGUID2",
  1060. "profapi.dll.#104",
  1061. "userenv.dll.DestroyEnvironmentBlock",
  1062. "wer.dll.WerpSvcReportFromMachineQueue",
  1063. "advapi32.dll.DuplicateToken",
  1064. "wtsapi32.dll.WTSQueryUserToken",
  1065. "winsta.dll.WinStationQueryInformationW",
  1066. "advapi32.dll.LookupAccountSidW",
  1067. "sechost.dll.LookupAccountSidLocalW",
  1068. "advapi32.dll.CreateWellKnownSid",
  1069. "rpcrt4.dll.RpcStringBindingComposeW",
  1070. "rpcrt4.dll.RpcBindingFromStringBindingW",
  1071. "rpcrt4.dll.RpcStringFreeW",
  1072. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  1073. "sechost.dll.LookupAccountNameLocalW",
  1074. "rpcrt4.dll.NdrClientCall3",
  1075. "rpcrt4.dll.RpcBindingFree",
  1076. "advapi32.dll.ImpersonateLoggedOnUser",
  1077. "advapi32.dll.CreateProcessAsUserW",
  1078. "advapi32.dll.RevertToSelf",
  1079. "imm32.dll.ImmDisableIME",
  1080. "psapi.dll.GetModuleFileNameExW",
  1081. "version.dll.GetFileVersionInfoSizeW",
  1082. "version.dll.GetFileVersionInfoW",
  1083. "version.dll.VerQueryValueW",
  1084. "wer.dll.WerpCreateIntegratorReportId",
  1085. "wer.dll.WerReportCreate",
  1086. "wer.dll.WerpSetIntegratorReportId",
  1087. "wer.dll.WerReportSetParameter",
  1088. "dbgeng.dll.DebugCreate",
  1089. "ntdll.dll.CsrGetProcessId",
  1090. "ntdll.dll.DbgBreakPoint",
  1091. "ntdll.dll.DbgPrint",
  1092. "ntdll.dll.DbgPrompt",
  1093. "ntdll.dll.DbgUiConvertStateChangeStructure",
  1094. "ntdll.dll.DbgUiGetThreadDebugObject",
  1095. "ntdll.dll.DbgUiIssueRemoteBreakin",
  1096. "ntdll.dll.DbgUiSetThreadDebugObject",
  1097. "ntdll.dll.NtAllocateVirtualMemory",
  1098. "ntdll.dll.NtClose",
  1099. "ntdll.dll.NtCreateDebugObject",
  1100. "ntdll.dll.NtCreateFile",
  1101. "ntdll.dll.NtDebugActiveProcess",
  1102. "ntdll.dll.NtDebugContinue",
  1103. "ntdll.dll.NtFreeVirtualMemory",
  1104. "ntdll.dll.NtOpenProcess",
  1105. "ntdll.dll.NtOpenThread",
  1106. "ntdll.dll.NtQueryInformationProcess",
  1107. "ntdll.dll.NtQueryInformationThread",
  1108. "ntdll.dll.NtQueryMutant",
  1109. "ntdll.dll.NtQueryObject",
  1110. "ntdll.dll.NtQuerySystemInformation",
  1111. "ntdll.dll.NtRemoveProcessDebug",
  1112. "ntdll.dll.NtResumeThread",
  1113. "ntdll.dll.NtSetInformationDebugObject",
  1114. "ntdll.dll.NtSetInformationProcess",
  1115. "ntdll.dll.NtSystemDebugControl",
  1116. "ntdll.dll.NtWaitForDebugEvent",
  1117. "ntdll.dll.RtlAnsiStringToUnicodeString",
  1118. "ntdll.dll.RtlCreateProcessParameters",
  1119. "ntdll.dll.RtlCreateUserProcess",
  1120. "ntdll.dll.RtlDestroyProcessParameters",
  1121. "ntdll.dll.RtlDosPathNameToNtPathName_U",
  1122. "ntdll.dll.RtlFindMessage",
  1123. "ntdll.dll.RtlFreeHeap",
  1124. "ntdll.dll.RtlFreeUnicodeString",
  1125. "ntdll.dll.RtlGetUnloadEventTrace",
  1126. "ntdll.dll.RtlGetUnloadEventTraceEx",
  1127. "ntdll.dll.RtlInitAnsiString",
  1128. "ntdll.dll.RtlInitUnicodeString",
  1129. "ntdll.dll.RtlTryEnterCriticalSection",
  1130. "ntdll.dll.RtlUnicodeStringToAnsiString",
  1131. "ntdll.dll.NtOpenProcessToken",
  1132. "ntdll.dll.NtOpenThreadToken",
  1133. "ntdll.dll.NtQueryInformationToken",
  1134. "kernel32.dll.CloseProfileUserMapping",
  1135. "kernel32.dll.DebugActiveProcessStop",
  1136. "kernel32.dll.DebugBreak",
  1137. "kernel32.dll.DebugBreakProcess",
  1138. "kernel32.dll.DebugSetProcessKillOnExit",
  1139. "kernel32.dll.Module32First",
  1140. "kernel32.dll.Module32FirstW",
  1141. "kernel32.dll.Module32Next",
  1142. "kernel32.dll.Module32NextW",
  1143. "kernel32.dll.Process32FirstW",
  1144. "kernel32.dll.Process32NextW",
  1145. "kernel32.dll.ProcessIdToSessionId",
  1146. "kernel32.dll.SetProcessShutdownParameters",
  1147. "kernel32.dll.GetTimeZoneInformation",
  1148. "kernel32.dll.DuplicateHandle",
  1149. "kernel32.dll.Wow64GetThreadSelectorEntry",
  1150. "advapi32.dll.CreateServiceW",
  1151. "advapi32.dll.EnumServicesStatusExA",
  1152. "advapi32.dll.EnumServicesStatusExW",
  1153. "advapi32.dll.GetEventLogInformation",
  1154. "advapi32.dll.OpenSCManagerW",
  1155. "advapi32.dll.OpenServiceW",
  1156. "advapi32.dll.StartServiceW",
  1157. "advapi32.dll.GetSidSubAuthority",
  1158. "advapi32.dll.GetSidSubAuthorityCount",
  1159. "version.dll.GetFileVersionInfoSizeExW",
  1160. "version.dll.GetFileVersionInfoExW",
  1161. "dbghelp.dll.WinDbgExtensionDllInit",
  1162. "dbghelp.dll.ExtensionApiVersion",
  1163. "wer.dll.WerpSetDynamicParameter",
  1164. "wer.dll.WerReportAddDump",
  1165. "wer.dll.WerpSetCallBack",
  1166. "wer.dll.WerReportSetUIOption",
  1167. "wer.dll.WerpAddRegisteredDataToReport",
  1168. "wer.dll.WerReportSubmit",
  1169. "advapi32.dll.RegOpenKeyExW",
  1170. "user32.dll.LoadStringW",
  1171. "user32.dll.GetProcessWindowStation",
  1172. "user32.dll.GetUserObjectInformationW",
  1173. "sensapi.dll.IsNetworkAlive",
  1174. "rpcrt4.dll.NdrClientCall2",
  1175. "user32.dll.CharUpperW",
  1176. "wer.dll.WerpAddAppCompatData",
  1177. "apphelp.dll.SdbGetFileAttributes",
  1178. "apphelp.dll.SdbFormatAttribute",
  1179. "apphelp.dll.SdbFreeFileAttributes",
  1180. "cryptsp.dll.CryptAcquireContextW",
  1181. "cryptsp.dll.CryptCreateHash",
  1182. "cryptsp.dll.CryptHashData",
  1183. "cryptsp.dll.CryptGetHashParam",
  1184. "cryptsp.dll.CryptDestroyHash",
  1185. "cryptsp.dll.CryptReleaseContext",
  1186. "dbghelp.dll.MiniDumpWriteDump",
  1187. "kernel32.dll.GetLongPathNameA",
  1188. "kernel32.dll.GetLongPathNameW",
  1189. "kernel32.dll.GetProcessTimes",
  1190. "powrprof.dll.CallNtPowerInformation",
  1191. "version.dll.GetFileVersionInfoSizeA",
  1192. "version.dll.GetFileVersionInfoA",
  1193. "version.dll.VerQueryValueA",
  1194. "verifier.dll.VerifierEnumerateResource",
  1195. "ntdll.dll.NtSuspendProcess",
  1196. "ntdll.dll.NtResumeProcess",
  1197. "advapi32.dll.QueryTraceW",
  1198. "advapi32.dll.GetLengthSid",
  1199. "advapi32.dll.CopySid",
  1200. "advapi32.dll.InitializeAcl",
  1201. "advapi32.dll.AddAccessAllowedAceEx",
  1202. "advapi32.dll.InitializeSecurityDescriptor",
  1203. "advapi32.dll.SetSecurityDescriptorDacl",
  1204. "advapi32.dll.RegisterEventSourceW",
  1205. "advapi32.dll.ReportEventW",
  1206. "advapi32.dll.DeregisterEventSource",
  1207. "wer.dll.WerpGetStoreLocation",
  1208. "wer.dll.WerpGetStoreType",
  1209. "wer.dll.WerReportCloseHandle",
  1210. "user32.dll.MsgWaitForMultipleObjects",
  1211. "wer.dll.WerpFreeString",
  1212. "werui.dll.WerUICreate",
  1213. "werui.dll.WerUIStart",
  1214. "werui.dll.WerUITerminate",
  1215. "werui.dll.WerUIDelete",
  1216. "kernel32.dll.FlsAlloc",
  1217. "kernel32.dll.FlsSetValue",
  1218. "kernel32.dll.FlsGetValue",
  1219. "kernel32.dll.LCMapStringEx",
  1220. "kernel32.dll.InitializeCriticalSectionEx",
  1221. "kernel32.dll.FlsFree",
  1222. "kernel32.dll.InitOnceExecuteOnce",
  1223. "kernel32.dll.CreateEventExW",
  1224. "kernel32.dll.CreateSemaphoreW",
  1225. "kernel32.dll.CreateSemaphoreExW",
  1226. "kernel32.dll.CreateThreadpoolTimer",
  1227. "kernel32.dll.SetThreadpoolTimer",
  1228. "kernel32.dll.WaitForThreadpoolTimerCallbacks",
  1229. "kernel32.dll.CloseThreadpoolTimer",
  1230. "kernel32.dll.CreateThreadpoolWait",
  1231. "kernel32.dll.SetThreadpoolWait",
  1232. "kernel32.dll.CloseThreadpoolWait",
  1233. "kernel32.dll.FlushProcessWriteBuffers",
  1234. "kernel32.dll.FreeLibraryWhenCallbackReturns",
  1235. "kernel32.dll.GetCurrentProcessorNumber",
  1236. "kernel32.dll.CreateSymbolicLinkW",
  1237. "kernel32.dll.GetTickCount64",
  1238. "kernel32.dll.GetFileInformationByHandleEx",
  1239. "kernel32.dll.SetFileInformationByHandle",
  1240. "kernel32.dll.InitializeConditionVariable",
  1241. "kernel32.dll.WakeConditionVariable",
  1242. "kernel32.dll.WakeAllConditionVariable",
  1243. "kernel32.dll.SleepConditionVariableCS",
  1244. "kernel32.dll.TryAcquireSRWLockExclusive",
  1245. "kernel32.dll.SleepConditionVariableSRW",
  1246. "kernel32.dll.CreateThreadpoolWork",
  1247. "kernel32.dll.SubmitThreadpoolWork",
  1248. "kernel32.dll.CloseThreadpoolWork",
  1249. "kernel32.dll.CompareStringEx",
  1250. "kernel32.dll.GetLocaleInfoEx",
  1251. "goopdate.dll.DllEntry",
  1252. "kernel32.dll.RtlCaptureStackBackTrace",
  1253. "wkscli.dll.NetWkstaGetInfo",
  1254. "cscapi.dll.CscNetApiGetInterface",
  1255. "ntmarta.dll.GetMartaExtensionInterface",
  1256. "kernel32.dll.CreateMutexExW",
  1257. "rpcrt4.dll.UuidCreate",
  1258. "cryptsp.dll.CryptGenRandom",
  1259. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  1260. "ole32.dll.CoGetClassObject",
  1261. "ole32.dll.CoGetMarshalSizeMax",
  1262. "ole32.dll.CoMarshalInterface",
  1263. "ole32.dll.CoUnmarshalInterface",
  1264. "ole32.dll.CoGetPSClsid",
  1265. "ole32.dll.CoReleaseMarshalData",
  1266. "ole32.dll.DcomChannelSetHResult",
  1267. "psmachine.dll.DllGetClassObject",
  1268. "psmachine.dll.DllCanUnloadNow",
  1269. "ntdll.dll.RtlGetVersion",
  1270. "kernel32.dll.GetNativeSystemInfo",
  1271. "winhttp.dll.WinHttpAddRequestHeaders",
  1272. "winhttp.dll.WinHttpCheckPlatform",
  1273. "winhttp.dll.WinHttpCloseHandle",
  1274. "winhttp.dll.WinHttpConnect",
  1275. "winhttp.dll.WinHttpCrackUrl",
  1276. "winhttp.dll.WinHttpCreateUrl",
  1277. "winhttp.dll.WinHttpDetectAutoProxyConfigUrl",
  1278. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  1279. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  1280. "winhttp.dll.WinHttpGetProxyForUrl",
  1281. "winhttp.dll.WinHttpOpen",
  1282. "winhttp.dll.WinHttpOpenRequest",
  1283. "winhttp.dll.WinHttpQueryAuthSchemes",
  1284. "winhttp.dll.WinHttpQueryDataAvailable",
  1285. "winhttp.dll.WinHttpQueryHeaders",
  1286. "winhttp.dll.WinHttpQueryOption",
  1287. "winhttp.dll.WinHttpReadData",
  1288. "winhttp.dll.WinHttpReceiveResponse",
  1289. "winhttp.dll.WinHttpSendRequest",
  1290. "winhttp.dll.WinHttpSetDefaultProxyConfiguration",
  1291. "winhttp.dll.WinHttpSetCredentials",
  1292. "winhttp.dll.WinHttpSetOption",
  1293. "winhttp.dll.WinHttpSetStatusCallback",
  1294. "winhttp.dll.WinHttpSetTimeouts",
  1295. "winhttp.dll.WinHttpWriteData",
  1296. "shlwapi.dll.StrCmpNW",
  1297. "shlwapi.dll.#153",
  1298. "ws2_32.dll.GetAddrInfoW",
  1299. "ws2_32.dll.WSASocketW",
  1300. "ws2_32.dll.#2",
  1301. "ws2_32.dll.FreeAddrInfoW",
  1302. "ws2_32.dll.#5",
  1303. "ws2_32.dll.WSASend",
  1304. "ws2_32.dll.WSARecv",
  1305. "secur32.dll.FreeContextBuffer",
  1306. "ncrypt.dll.SslOpenProvider",
  1307. "ncrypt.dll.GetSChannelInterface",
  1308. "bcryptprimitives.dll.GetHashInterface",
  1309. "ncrypt.dll.SslIncrementProviderReferenceCount",
  1310. "ncrypt.dll.SslImportKey",
  1311. "bcryptprimitives.dll.GetCipherInterface",
  1312. "ncrypt.dll.SslLookupCipherSuiteInfo",
  1313. "ncrypt.dll.BCryptOpenAlgorithmProvider",
  1314. "ncrypt.dll.BCryptGetProperty",
  1315. "ncrypt.dll.BCryptCreateHash",
  1316. "ncrypt.dll.BCryptHashData",
  1317. "ncrypt.dll.BCryptFinishHash",
  1318. "ncrypt.dll.BCryptDestroyHash",
  1319. "crypt32.dll.CertGetCertificateChain",
  1320. "sechost.dll.ConvertStringSidToSidW",
  1321. "userenv.dll.RegisterGPNotification",
  1322. "gpapi.dll.RegisterGPNotificationInternal",
  1323. "sechost.dll.OpenSCManagerW",
  1324. "sechost.dll.OpenServiceW",
  1325. "sechost.dll.CloseServiceHandle",
  1326. "sechost.dll.QueryServiceConfigW",
  1327. "winsta.dll.WinStationRegisterNotificationEvent",
  1328. "rpcrt4.dll.RpcAsyncInitializeHandle",
  1329. "rpcrt4.dll.NdrAsyncClientCall",
  1330. "cryptsp.dll.CryptAcquireContextA",
  1331. "cryptsp.dll.CryptVerifySignatureA",
  1332. "cryptsp.dll.CryptDestroyKey",
  1333. "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
  1334. "ncrypt.dll.BCryptImportKeyPair",
  1335. "ncrypt.dll.BCryptVerifySignature",
  1336. "ncrypt.dll.BCryptDestroyKey",
  1337. "crypt32.dll.CertVerifyCertificateChainPolicy",
  1338. "crypt32.dll.CertFreeCertificateChain",
  1339. "crypt32.dll.CertDuplicateCertificateContext",
  1340. "ncrypt.dll.SslEncryptPacket",
  1341. "ncrypt.dll.SslDecryptPacket",
  1342. "winsta.dll.WinStationEnumerateW",
  1343. "rpcrt4.dll.I_RpcExceptionFilter",
  1344. "winsta.dll.WinStationFreeMemory",
  1345. "ole32.dll.CoInitializeSecurity",
  1346. "qmgr.dll.ServiceMain",
  1347. "advapi32.dll.SetEntriesInAclW",
  1348. "bitsigd.dll.InitializeEx",
  1349. "upnp.dll.DllGetClassObject",
  1350. "upnp.dll.DllCanUnloadNow",
  1351. "rpcrt4.dll.RpcStringBindingComposeA",
  1352. "rpcrt4.dll.RpcBindingFromStringBindingA",
  1353. "rpcrt4.dll.RpcStringFreeA",
  1354. "sxs.dll.SxsOleAut32MapIIDToProxyStubCLSID",
  1355. "advapi32.dll.RegQueryValueW",
  1356. "oleaut32.dll.BSTR_UserSize",
  1357. "oleaut32.dll.BSTR_UserMarshal",
  1358. "oleaut32.dll.BSTR_UserUnmarshal",
  1359. "oleaut32.dll.BSTR_UserFree",
  1360. "oleaut32.dll.VARIANT_UserSize",
  1361. "oleaut32.dll.VARIANT_UserMarshal",
  1362. "oleaut32.dll.VARIANT_UserUnmarshal",
  1363. "oleaut32.dll.VARIANT_UserFree",
  1364. "oleaut32.dll.LPSAFEARRAY_UserSize",
  1365. "oleaut32.dll.LPSAFEARRAY_UserMarshal",
  1366. "oleaut32.dll.LPSAFEARRAY_UserUnmarshal",
  1367. "oleaut32.dll.LPSAFEARRAY_UserFree",
  1368. "advapi32.dll.LogonUserW",
  1369. "sspicli.dll.LogonUserExExW",
  1370. "wtsapi32.dll.WTSEnumerateSessionsW",
  1371. "advapi32.dll.QueryAllTracesW",
  1372. "vssapi.dll.CreateWriter",
  1373. "advapi32.dll.LookupAccountNameW",
  1374. "samcli.dll.NetLocalGroupGetMembers",
  1375. "samlib.dll.SamConnect",
  1376. "samlib.dll.SamOpenDomain",
  1377. "samlib.dll.SamLookupNamesInDomain",
  1378. "samlib.dll.SamOpenAlias",
  1379. "samlib.dll.SamFreeMemory",
  1380. "samlib.dll.SamCloseHandle",
  1381. "samlib.dll.SamGetMembersInAlias",
  1382. "netutils.dll.NetApiBufferFree",
  1383. "samlib.dll.SamEnumerateDomainsInSamServer",
  1384. "samlib.dll.SamLookupDomainInSamServer",
  1385. "ole32.dll.CoCreateGuid",
  1386. "ole32.dll.StringFromCLSID",
  1387. "oleaut32.dll.#4",
  1388. "oleaut32.dll.#7",
  1389. "propsys.dll.VariantToPropVariant",
  1390. "ole32.dll.CoRegisterClassObject",
  1391. "kernel32.dll.GetThreadPreferredUILanguages",
  1392. "kernel32.dll.SetThreadPreferredUILanguages",
  1393. "kernel32.dll.LocaleNameToLCID",
  1394. "kernel32.dll.LCIDToLocaleName",
  1395. "kernel32.dll.GetSystemDefaultLocaleName",
  1396. "fastprox.dll.DllGetClassObject",
  1397. "fastprox.dll.DllCanUnloadNow",
  1398. "oleaut32.dll.#283",
  1399. "oleaut32.dll.#284",
  1400. "kernel32.dll.RegOpenKeyExW",
  1401. "ntdll.dll.EtwUnregisterTraceGuids",
  1402. "wmisvc.dll.ServiceMain",
  1403. "sechost.dll.RegisterServiceCtrlHandlerExW",
  1404. "sechost.dll.SetServiceStatus",
  1405. "advapi32.dll.WmiOpenBlock",
  1406. "wbemcore.dll.Reinitialize",
  1407. "wbemsvc.dll.DllGetClassObject",
  1408. "wbemsvc.dll.DllCanUnloadNow",
  1409. "authz.dll.AuthzInitializeContextFromToken",
  1410. "authz.dll.AuthzInitializeObjectAccessAuditEvent2",
  1411. "authz.dll.AuthzAccessCheck",
  1412. "authz.dll.AuthzFreeAuditEvent",
  1413. "authz.dll.AuthzFreeContext",
  1414. "authz.dll.AuthzInitializeResourceManager",
  1415. "authz.dll.AuthzFreeResourceManager",
  1416. "rpcrt4.dll.RpcBindingCreateW",
  1417. "rpcrt4.dll.RpcBindingBind",
  1418. "rpcrt4.dll.I_RpcMapWin32Status",
  1419. "advapi32.dll.EventRegister",
  1420. "advapi32.dll.EventUnregister",
  1421. "advapi32.dll.EventWrite",
  1422. "kernel32.dll.RegCloseKey",
  1423. "kernel32.dll.RegSetValueExW",
  1424. "kernel32.dll.RegQueryValueExW",
  1425. "wmisvc.dll.IsImproperShutdownDetected",
  1426. "wevtapi.dll.EvtRender",
  1427. "wevtapi.dll.EvtNext",
  1428. "wevtapi.dll.EvtClose",
  1429. "wevtapi.dll.EvtQuery",
  1430. "wevtapi.dll.EvtCreateRenderContext",
  1431. "rpcrt4.dll.RpcBindingSetOption",
  1432. "ole32.dll.CoCreateFreeThreadedMarshaler",
  1433. "ole32.dll.CreateStreamOnHGlobal",
  1434. "advapi32.dll.RegSetValueExW",
  1435. "kernelbase.dll.InitializeAcl",
  1436. "kernelbase.dll.AddAce",
  1437. "kernel32.dll.IsThreadAFiber",
  1438. "kernel32.dll.OpenProcessToken",
  1439. "kernelbase.dll.GetTokenInformation",
  1440. "kernelbase.dll.DuplicateTokenEx",
  1441. "kernelbase.dll.AdjustTokenPrivileges",
  1442. "kernel32.dll.SetThreadToken",
  1443. "kernelbase.dll.CheckTokenMembership",
  1444. "kernelbase.dll.AllocateAndInitializeSid",
  1445. "oleaut32.dll.#285",
  1446. "oleaut32.dll.#286",
  1447. "oleaut32.dll.#17",
  1448. "oleaut32.dll.#20",
  1449. "oleaut32.dll.#19",
  1450. "oleaut32.dll.#25",
  1451. "authz.dll.AuthzInitializeContextFromSid",
  1452. "ole32.dll.CoGetCallContext",
  1453. "ole32.dll.CoImpersonateClient",
  1454. "advapi32.dll.OpenThreadToken",
  1455. "ole32.dll.CoRevertToSelf",
  1456. "ole32.dll.CoSwitchCallContext",
  1457. "ntdll.dll.RtlGetFunctionTableListHead"
  1458. ]
  1459.  
  1460. [*] Static Analysis: {
  1461. "pe": {
  1462. "peid_signatures": null,
  1463. "imports": [
  1464. {
  1465. "imports": [
  1466. {
  1467. "name": "GetModuleHandleA",
  1468. "address": "0x440050"
  1469. },
  1470. {
  1471. "name": "GetProcAddress",
  1472. "address": "0x440054"
  1473. }
  1474. ],
  1475. "dll": "KERNEL32.DLL"
  1476. },
  1477. {
  1478. "imports": [
  1479. {
  1480. "name": "FreeSid",
  1481. "address": "0x44005c"
  1482. }
  1483. ],
  1484. "dll": "ADVAPI32.dll"
  1485. },
  1486. {
  1487. "imports": [
  1488. {
  1489. "name": "ShellExecuteExA",
  1490. "address": "0x440064"
  1491. }
  1492. ],
  1493. "dll": "SHELL32.dll"
  1494. }
  1495. ],
  1496. "digital_signers": null,
  1497. "exported_dll_name": null,
  1498. "actual_checksum": "0x0002a03e",
  1499. "overlay": null,
  1500. "imagebase": "0x00400000",
  1501. "reported_checksum": "0x00000000",
  1502. "icon_hash": null,
  1503. "entrypoint": "0x004400de",
  1504. "timestamp": "2017-08-12 04:05:00",
  1505. "osversion": "4.0",
  1506. "sections": [
  1507. {
  1508. "name": ".MPRESS1",
  1509. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1510. "virtual_address": "0x00001000",
  1511. "size_of_data": "0x00018000",
  1512. "entropy": "8.00",
  1513. "raw_address": "0x00000200",
  1514. "virtual_size": "0x0003f000",
  1515. "characteristics_raw": "0xe00000e0"
  1516. },
  1517. {
  1518. "name": ".MPRESS2",
  1519. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1520. "virtual_address": "0x00040000",
  1521. "size_of_data": "0x00000e00",
  1522. "entropy": "5.55",
  1523. "raw_address": "0x00018200",
  1524. "virtual_size": "0x00000c48",
  1525. "characteristics_raw": "0xe00000e0"
  1526. },
  1527. {
  1528. "name": ".rsrc",
  1529. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1530. "virtual_address": "0x00041000",
  1531. "size_of_data": "0x00002e00",
  1532. "entropy": "5.23",
  1533. "raw_address": "0x00019000",
  1534. "virtual_size": "0x00002c8c",
  1535. "characteristics_raw": "0xc0000040"
  1536. }
  1537. ],
  1538. "resources": [],
  1539. "dirents": [
  1540. {
  1541. "virtual_address": "0x00000000",
  1542. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1543. "size": "0x00000000"
  1544. },
  1545. {
  1546. "virtual_address": "0x00040000",
  1547. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1548. "size": "0x000000e0"
  1549. },
  1550. {
  1551. "virtual_address": "0x00041000",
  1552. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1553. "size": "0x00002c8c"
  1554. },
  1555. {
  1556. "virtual_address": "0x00000000",
  1557. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1558. "size": "0x00000000"
  1559. },
  1560. {
  1561. "virtual_address": "0x00000000",
  1562. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1563. "size": "0x00000000"
  1564. },
  1565. {
  1566. "virtual_address": "0x00000000",
  1567. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1568. "size": "0x00000000"
  1569. },
  1570. {
  1571. "virtual_address": "0x00000000",
  1572. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1573. "size": "0x00000000"
  1574. },
  1575. {
  1576. "virtual_address": "0x00000000",
  1577. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1578. "size": "0x00000000"
  1579. },
  1580. {
  1581. "virtual_address": "0x00000000",
  1582. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1583. "size": "0x00000000"
  1584. },
  1585. {
  1586. "virtual_address": "0x00000000",
  1587. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1588. "size": "0x00000000"
  1589. },
  1590. {
  1591. "virtual_address": "0x00000000",
  1592. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1593. "size": "0x00000000"
  1594. },
  1595. {
  1596. "virtual_address": "0x00000000",
  1597. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1598. "size": "0x00000000"
  1599. },
  1600. {
  1601. "virtual_address": "0x00040050",
  1602. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1603. "size": "0x00000018"
  1604. },
  1605. {
  1606. "virtual_address": "0x00000000",
  1607. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1608. "size": "0x00000000"
  1609. },
  1610. {
  1611. "virtual_address": "0x00000000",
  1612. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1613. "size": "0x00000000"
  1614. },
  1615. {
  1616. "virtual_address": "0x00000000",
  1617. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1618. "size": "0x00000000"
  1619. }
  1620. ],
  1621. "exports": [],
  1622. "guest_signers": {},
  1623. "imphash": "32211670deb7493daef70884a73f68a5",
  1624. "icon_fuzzy": null,
  1625. "icon": null,
  1626. "pdbpath": null,
  1627. "imported_dll_count": 3,
  1628. "versioninfo": []
  1629. }
  1630. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!