API tools faq
paste
paladin316

Exes_d4cf22a20f3522b8ff428b8cfd1d546d_exe.json

paladin316
Jun 20th, 2019
2,253
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 70.80 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Coinminer"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_d4cf22a20f3522b8ff428b8cfd1d546d.exe"
  7. [*] File Size: 1231360
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "793b03e1ef10c1cac4ffdddf2802d0a21d0a825797818c31831ce34fc83e0bc3"
  10. [*] MD5: "d4cf22a20f3522b8ff428b8cfd1d546d"
  11. [*] SHA1: "9c40b47682439e0c0aa3b1f40074d248c8e39784"
  12. [*] SHA512: "d8f08986b4e1d8f32fc4c2deaeca20bcaf1f7f0fe49789de3bb19f2bcbe0ed88933cc9a789d6d7913d5c1b573b306ad6b67492993d9887ea992366191e5d0331"
  13. [*] CRC32: "3AC07B4C"
  14. [*] SSDEEP: "24576:WGz5rGKdc/dBpLQ0p+fqAvcMH5p+wlL2/5NuCZD49n9i90XUkXO0JdUf2:W4RpdcO0kq2c2awl45NuU09n9i90XUwp"
  15.  
  16. [*] Process Execution: [
  17. "Exes_d4cf22a20f3522b8ff428b8cfd1d546d.exe",
  18. "cmd.exe",
  19. "PING.EXE",
  20. "services.exe",
  21. "svchost.exe",
  22. "sc.exe",
  23. "svchost.exe",
  24. "GoogleUpdate.exe"
  25. ]
  26.  
  27. [*] Signatures Detected: [
  28. {
  29. "Description": "The binary likely contains encrypted or compressed data.",
  30. "Details": [
  31. {
  32. "section": "name: .data, entropy: 7.94, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00108a00, virtual_size: 0x0010991c"
  33. }
  34. ]
  35. },
  36. {
  37. "Description": "Deletes its original binary from disk",
  38. "Details": []
  39. },
  40. {
  41. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  42. "Details": [
  43. {
  44. "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 17813162 times"
  45. }
  46. ]
  47. },
  48. {
  49. "Description": "Installs itself for autorun at Windows startup",
  50. "Details": [
  51. {
  52. "service name": "clr_optimization_v4.0.30328_64"
  53. },
  54. {
  55. "service path": "C:\\ProgramData\\clr_optimization_v4.0.30328_64\\svchost.exe"
  56. }
  57. ]
  58. },
  59. {
  60. "Description": "File has been identified by 57 Antiviruses on VirusTotal as malicious",
  61. "Details": [
  62. {
  63. "Bkav": "W32.PanuiesyYEL.Trojan"
  64. },
  65. {
  66. "MicroWorld-eScan": "Trojan.GenericKD.41182456"
  67. },
  68. {
  69. "CAT-QuickHeal": "Trojan.Generic"
  70. },
  71. {
  72. "McAfee": "CoinMiner-FAN!D4CF22A20F35"
  73. },
  74. {
  75. "Cylance": "Unsafe"
  76. },
  77. {
  78. "CrowdStrike": "win/malicious_confidence_90% (W)"
  79. },
  80. {
  81. "Alibaba": "Trojan:Win32/CoinMiner.7e8d97db"
  82. },
  83. {
  84. "K7GW": "Riskware ( 00543ad11 )"
  85. },
  86. {
  87. "K7AntiVirus": "Riskware ( 00543ad11 )"
  88. },
  89. {
  90. "Arcabit": "Trojan.Generic.D27464F8"
  91. },
  92. {
  93. "Invincea": "heuristic"
  94. },
  95. {
  96. "Cyren": "W32/Application.DZVT-9340"
  97. },
  98. {
  99. "Symantec": "Trojan.Zbot"
  100. },
  101. {
  102. "APEX": "Malicious"
  103. },
  104. {
  105. "Paloalto": "generic.ml"
  106. },
  107. {
  108. "Kaspersky": "HEUR:Trojan.Win32.Generic"
  109. },
  110. {
  111. "BitDefender": "Trojan.GenericKD.41182456"
  112. },
  113. {
  114. "NANO-Antivirus": "Trojan.Win32.CoinMiner.fogvwd"
  115. },
  116. {
  117. "Avast": "Win32:Miner-AY [Trj]"
  118. },
  119. {
  120. "Tencent": "Win32.Trojan.Inject.Auto"
  121. },
  122. {
  123. "Ad-Aware": "Trojan.GenericKD.41182456"
  124. },
  125. {
  126. "Emsisoft": "Trojan.GenericKD.41182456 (B)"
  127. },
  128. {
  129. "Comodo": "Malware@#11h3nx8t7azzv"
  130. },
  131. {
  132. "F-Secure": "Heuristic.HEUR/AGEN.1037613"
  133. },
  134. {
  135. "DrWeb": "Trojan.DownLoader27.40459"
  136. },
  137. {
  138. "Zillya": "Trojan.Generic.Win32.704228"
  139. },
  140. {
  141. "TrendMicro": "Coinminer.Win32.MALXMR.SMUKQ"
  142. },
  143. {
  144. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.tc"
  145. },
  146. {
  147. "Trapmine": "malicious.high.ml.score"
  148. },
  149. {
  150. "FireEye": "Generic.mg.d4cf22a20f3522b8"
  151. },
  152. {
  153. "Sophos": "Troj/Miner-QH"
  154. },
  155. {
  156. "Ikarus": "Trojan.Win32.CoinMiner"
  157. },
  158. {
  159. "F-Prot": "W32/S-b23566af!Eldorado"
  160. },
  161. {
  162. "Jiangmin": "Trojan.Generic.cwgjj"
  163. },
  164. {
  165. "Webroot": "W32.Trojan.Gen"
  166. },
  167. {
  168. "Avira": "HEUR/AGEN.1037613"
  169. },
  170. {
  171. "Antiy-AVL": "Trojan/Win32.CoinMiner"
  172. },
  173. {
  174. "Microsoft": "Trojan:Win32/CoinMiner.DH!bit"
  175. },
  176. {
  177. "Endgame": "malicious (high confidence)"
  178. },
  179. {
  180. "ZoneAlarm": "HEUR:Trojan.Win32.Generic"
  181. },
  182. {
  183. "GData": "Win32.Application.CoinMiner.BQ"
  184. },
  185. {
  186. "AhnLab-V3": "Trojan/Win32.CoinMiner.R261580"
  187. },
  188. {
  189. "Acronis": "suspicious"
  190. },
  191. {
  192. "VBA32": "BScope.Trojan.Miner"
  193. },
  194. {
  195. "MAX": "malware (ai score=100)"
  196. },
  197. {
  198. "Malwarebytes": "Trojan.BitCoinMiner"
  199. },
  200. {
  201. "ESET-NOD32": "a variant of Win32/CoinMiner.BTO"
  202. },
  203. {
  204. "TrendMicro-HouseCall": "Coinminer.Win32.MALXMR.SMUKQ"
  205. },
  206. {
  207. "Rising": "Trojan.CoinMiner!1.B84E (CLOUD)"
  208. },
  209. {
  210. "Yandex": "Trojan.Agent!68oBjYMP7vc"
  211. },
  212. {
  213. "SentinelOne": "DFI - Malicious PE"
  214. },
  215. {
  216. "eGambit": "Unsafe.AI_Score_89%"
  217. },
  218. {
  219. "Fortinet": "W32/CoinMiner.BTO!tr"
  220. },
  221. {
  222. "AVG": "Win32:Miner-AY [Trj]"
  223. },
  224. {
  225. "Cybereason": "malicious.20f352"
  226. },
  227. {
  228. "Panda": "Trj/GdSda.A"
  229. },
  230. {
  231. "Qihoo-360": "Win32/Trojan.2e1"
  232. }
  233. ]
  234. }
  235. ]
  236.  
  237. [*] Started Service: [
  238. "clr_optimization_v4.0.30328_64",
  239. "W32Time"
  240. ]
  241.  
  242. [*] Executed Commands: [
  243. "C:\\Windows\\system32\\cmd.exe /c @ping -n 15 127.0.0.1&del C:\\Users\\user\\AppData\\Local\\Temp\\EXES_D~1.EXE > nul",
  244. "C:\\ProgramData\\clr_optimization_v4.0.30328_64\\svchost.exe",
  245. "C:\\Windows\\system32\\sc.exe start w32time task_started",
  246. "C:\\Windows\\system32\\svchost.exe -k LocalService",
  247. "\"C:\\Program Files (x86)\\Google\\Update\\GoogleUpdate.exe\" /svc",
  248. "C:\\Windows\\system32\\PING.EXE ping -n 15 127.0.0.1"
  249. ]
  250.  
  251. [*] Mutexes: []
  252.  
  253. [*] Modified Files: [
  254. "C:\\ProgramData\\clr_optimization_v4.0.30328_64\\svchost.exe",
  255. "C:\\Windows\\sysnative\\LogFiles\\Scm\\7bbc503c-5977-4798-a4ae-61483a7e030d",
  256. "\\??\\nul",
  257. "\\??\\PIPE\\lsarpc"
  258. ]
  259.  
  260. [*] Deleted Files: [
  261. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_d4cf22a20f3522b8ff428b8cfd1d546d.exe"
  262. ]
  263.  
  264. [*] Modified Registry Keys: [
  265. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\clr_optimization_v4.0.30328_64\\Description",
  266. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\Type",
  267. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\BITS\\Start",
  268. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\TimeProviders\\NtpClient\\SpecialPollTimeRemaining"
  269. ]
  270.  
  271. [*] Deleted Registry Keys: []
  272.  
  273. [*] DNS Communications: [
  274. {
  275. "type": "A",
  276. "request": "tgoodluck.info",
  277. "answers": [
  278. {
  279. "data": "121.17.160.2",
  280. "type": "A"
  281. },
  282. {
  283. "data": "43.246.173.98",
  284. "type": "A"
  285. },
  286. {
  287. "data": "103.123.108.2",
  288. "type": "A"
  289. }
  290. ]
  291. }
  292. ]
  293.  
  294. [*] Domains: [
  295. {
  296. "ip": "121.17.160.2",
  297. "domain": "tgoodluck.info"
  298. }
  299. ]
  300.  
  301. [*] Network Communication - ICMP: []
  302.  
  303. [*] Network Communication - HTTP: []
  304.  
  305. [*] Network Communication - SMTP: []
  306.  
  307. [*] Network Communication - Hosts: []
  308.  
  309. [*] Network Communication - IRC: []
  310.  
  311. [*] Static Analysis: {
  312. "pe": {
  313. "peid_signatures": null,
  314. "imports": [
  315. {
  316. "imports": [
  317. {
  318. "name": "lstrcatW",
  319. "address": "0x41b07c"
  320. },
  321. {
  322. "name": "DeleteFileW",
  323. "address": "0x41b080"
  324. },
  325. {
  326. "name": "lstrcpyA",
  327. "address": "0x41b084"
  328. },
  329. {
  330. "name": "Process32FirstW",
  331. "address": "0x41b088"
  332. },
  333. {
  334. "name": "GetCurrentProcessId",
  335. "address": "0x41b08c"
  336. },
  337. {
  338. "name": "CreateProcessW",
  339. "address": "0x41b090"
  340. },
  341. {
  342. "name": "WideCharToMultiByte",
  343. "address": "0x41b094"
  344. },
  345. {
  346. "name": "lstrcpyW",
  347. "address": "0x41b098"
  348. },
  349. {
  350. "name": "WinExec",
  351. "address": "0x41b09c"
  352. },
  353. {
  354. "name": "lstrcmpiW",
  355. "address": "0x41b0a0"
  356. },
  357. {
  358. "name": "CreateThread",
  359. "address": "0x41b0a4"
  360. },
  361. {
  362. "name": "HeapFree",
  363. "address": "0x41b0a8"
  364. },
  365. {
  366. "name": "HeapAlloc",
  367. "address": "0x41b0ac"
  368. },
  369. {
  370. "name": "GetProcessHeap",
  371. "address": "0x41b0b0"
  372. },
  373. {
  374. "name": "SuspendThread",
  375. "address": "0x41b0b4"
  376. },
  377. {
  378. "name": "GetSystemDirectoryW",
  379. "address": "0x41b0b8"
  380. },
  381. {
  382. "name": "ResumeThread",
  383. "address": "0x41b0bc"
  384. },
  385. {
  386. "name": "DuplicateHandle",
  387. "address": "0x41b0c0"
  388. },
  389. {
  390. "name": "FreeLibrary",
  391. "address": "0x41b0c4"
  392. },
  393. {
  394. "name": "OpenThread",
  395. "address": "0x41b0c8"
  396. },
  397. {
  398. "name": "CreateDirectoryW",
  399. "address": "0x41b0cc"
  400. },
  401. {
  402. "name": "GetCommandLineW",
  403. "address": "0x41b0d0"
  404. },
  405. {
  406. "name": "GetModuleFileNameW",
  407. "address": "0x41b0d4"
  408. },
  409. {
  410. "name": "GetCurrentThread",
  411. "address": "0x41b0d8"
  412. },
  413. {
  414. "name": "GetSystemInfo",
  415. "address": "0x41b0dc"
  416. },
  417. {
  418. "name": "GetWindowsDirectoryW",
  419. "address": "0x41b0e0"
  420. },
  421. {
  422. "name": "VirtualAllocEx",
  423. "address": "0x41b0e4"
  424. },
  425. {
  426. "name": "CopyFileW",
  427. "address": "0x41b0e8"
  428. },
  429. {
  430. "name": "CreateRemoteThread",
  431. "address": "0x41b0ec"
  432. },
  433. {
  434. "name": "HeapSize",
  435. "address": "0x41b0f0"
  436. },
  437. {
  438. "name": "GetStringTypeW",
  439. "address": "0x41b0f4"
  440. },
  441. {
  442. "name": "FreeEnvironmentStringsW",
  443. "address": "0x41b0f8"
  444. },
  445. {
  446. "name": "GetEnvironmentStringsW",
  447. "address": "0x41b0fc"
  448. },
  449. {
  450. "name": "GetCommandLineA",
  451. "address": "0x41b100"
  452. },
  453. {
  454. "name": "GetCPInfo",
  455. "address": "0x41b104"
  456. },
  457. {
  458. "name": "GetOEMCP",
  459. "address": "0x41b108"
  460. },
  461. {
  462. "name": "IsValidCodePage",
  463. "address": "0x41b10c"
  464. },
  465. {
  466. "name": "SetEvent",
  467. "address": "0x41b110"
  468. },
  469. {
  470. "name": "Process32NextW",
  471. "address": "0x41b114"
  472. },
  473. {
  474. "name": "Sleep",
  475. "address": "0x41b118"
  476. },
  477. {
  478. "name": "MultiByteToWideChar",
  479. "address": "0x41b11c"
  480. },
  481. {
  482. "name": "CreateEventW",
  483. "address": "0x41b120"
  484. },
  485. {
  486. "name": "CreateToolhelp32Snapshot",
  487. "address": "0x41b124"
  488. },
  489. {
  490. "name": "GetLogicalDriveStringsW",
  491. "address": "0x41b128"
  492. },
  493. {
  494. "name": "lstrcatA",
  495. "address": "0x41b12c"
  496. },
  497. {
  498. "name": "GetCurrentThreadId",
  499. "address": "0x41b130"
  500. },
  501. {
  502. "name": "CreateFileW",
  503. "address": "0x41b134"
  504. },
  505. {
  506. "name": "WaitForSingleObject",
  507. "address": "0x41b138"
  508. },
  509. {
  510. "name": "GetEnvironmentVariableA",
  511. "address": "0x41b13c"
  512. },
  513. {
  514. "name": "SetThreadPriority",
  515. "address": "0x41b140"
  516. },
  517. {
  518. "name": "TerminateProcess",
  519. "address": "0x41b144"
  520. },
  521. {
  522. "name": "WriteFile",
  523. "address": "0x41b148"
  524. },
  525. {
  526. "name": "lstrlenW",
  527. "address": "0x41b14c"
  528. },
  529. {
  530. "name": "SetPriorityClass",
  531. "address": "0x41b150"
  532. },
  533. {
  534. "name": "SetLastError",
  535. "address": "0x41b154"
  536. },
  537. {
  538. "name": "QueryDosDeviceW",
  539. "address": "0x41b158"
  540. },
  541. {
  542. "name": "GetModuleFileNameA",
  543. "address": "0x41b15c"
  544. },
  545. {
  546. "name": "WriteProcessMemory",
  547. "address": "0x41b160"
  548. },
  549. {
  550. "name": "GetShortPathNameA",
  551. "address": "0x41b164"
  552. },
  553. {
  554. "name": "LoadLibraryW",
  555. "address": "0x41b168"
  556. },
  557. {
  558. "name": "IsWow64Process",
  559. "address": "0x41b16c"
  560. },
  561. {
  562. "name": "GetModuleHandleW",
  563. "address": "0x41b170"
  564. },
  565. {
  566. "name": "ReadProcessMemory",
  567. "address": "0x41b174"
  568. },
  569. {
  570. "name": "GetProcAddress",
  571. "address": "0x41b178"
  572. },
  573. {
  574. "name": "CloseHandle",
  575. "address": "0x41b17c"
  576. },
  577. {
  578. "name": "GetLastError",
  579. "address": "0x41b180"
  580. },
  581. {
  582. "name": "OpenProcess",
  583. "address": "0x41b184"
  584. },
  585. {
  586. "name": "GetModuleHandleA",
  587. "address": "0x41b188"
  588. },
  589. {
  590. "name": "GetCurrentProcess",
  591. "address": "0x41b18c"
  592. },
  593. {
  594. "name": "SetStdHandle",
  595. "address": "0x41b190"
  596. },
  597. {
  598. "name": "HeapReAlloc",
  599. "address": "0x41b194"
  600. },
  601. {
  602. "name": "FlushFileBuffers",
  603. "address": "0x41b198"
  604. },
  605. {
  606. "name": "GetConsoleCP",
  607. "address": "0x41b19c"
  608. },
  609. {
  610. "name": "EnterCriticalSection",
  611. "address": "0x41b1a0"
  612. },
  613. {
  614. "name": "LeaveCriticalSection",
  615. "address": "0x41b1a4"
  616. },
  617. {
  618. "name": "InitializeCriticalSectionAndSpinCount",
  619. "address": "0x41b1a8"
  620. },
  621. {
  622. "name": "DeleteCriticalSection",
  623. "address": "0x41b1ac"
  624. },
  625. {
  626. "name": "ResetEvent",
  627. "address": "0x41b1b0"
  628. },
  629. {
  630. "name": "WaitForSingleObjectEx",
  631. "address": "0x41b1b4"
  632. },
  633. {
  634. "name": "UnhandledExceptionFilter",
  635. "address": "0x41b1b8"
  636. },
  637. {
  638. "name": "SetUnhandledExceptionFilter",
  639. "address": "0x41b1bc"
  640. },
  641. {
  642. "name": "IsProcessorFeaturePresent",
  643. "address": "0x41b1c0"
  644. },
  645. {
  646. "name": "IsDebuggerPresent",
  647. "address": "0x41b1c4"
  648. },
  649. {
  650. "name": "GetStartupInfoW",
  651. "address": "0x41b1c8"
  652. },
  653. {
  654. "name": "QueryPerformanceCounter",
  655. "address": "0x41b1cc"
  656. },
  657. {
  658. "name": "GetSystemTimeAsFileTime",
  659. "address": "0x41b1d0"
  660. },
  661. {
  662. "name": "InitializeSListHead",
  663. "address": "0x41b1d4"
  664. },
  665. {
  666. "name": "RtlUnwind",
  667. "address": "0x41b1d8"
  668. },
  669. {
  670. "name": "RaiseException",
  671. "address": "0x41b1dc"
  672. },
  673. {
  674. "name": "EncodePointer",
  675. "address": "0x41b1e0"
  676. },
  677. {
  678. "name": "TlsAlloc",
  679. "address": "0x41b1e4"
  680. },
  681. {
  682. "name": "TlsGetValue",
  683. "address": "0x41b1e8"
  684. },
  685. {
  686. "name": "TlsSetValue",
  687. "address": "0x41b1ec"
  688. },
  689. {
  690. "name": "TlsFree",
  691. "address": "0x41b1f0"
  692. },
  693. {
  694. "name": "LoadLibraryExW",
  695. "address": "0x41b1f4"
  696. },
  697. {
  698. "name": "ExitProcess",
  699. "address": "0x41b1f8"
  700. },
  701. {
  702. "name": "GetModuleHandleExW",
  703. "address": "0x41b1fc"
  704. },
  705. {
  706. "name": "GetFileAttributesExW",
  707. "address": "0x41b200"
  708. },
  709. {
  710. "name": "ExitThread",
  711. "address": "0x41b204"
  712. },
  713. {
  714. "name": "FreeLibraryAndExitThread",
  715. "address": "0x41b208"
  716. },
  717. {
  718. "name": "FindClose",
  719. "address": "0x41b20c"
  720. },
  721. {
  722. "name": "FindFirstFileExW",
  723. "address": "0x41b210"
  724. },
  725. {
  726. "name": "FindNextFileW",
  727. "address": "0x41b214"
  728. },
  729. {
  730. "name": "GetFileType",
  731. "address": "0x41b218"
  732. },
  733. {
  734. "name": "GetStdHandle",
  735. "address": "0x41b21c"
  736. },
  737. {
  738. "name": "WriteConsoleW",
  739. "address": "0x41b220"
  740. },
  741. {
  742. "name": "GetACP",
  743. "address": "0x41b224"
  744. },
  745. {
  746. "name": "LCMapStringW",
  747. "address": "0x41b228"
  748. },
  749. {
  750. "name": "SetFilePointerEx",
  751. "address": "0x41b22c"
  752. },
  753. {
  754. "name": "GetConsoleMode",
  755. "address": "0x41b230"
  756. },
  757. {
  758. "name": "DecodePointer",
  759. "address": "0x41b234"
  760. }
  761. ],
  762. "dll": "KERNEL32.dll"
  763. },
  764. {
  765. "imports": [
  766. {
  767. "name": "GetUserObjectInformationW",
  768. "address": "0x41b24c"
  769. },
  770. {
  771. "name": "wsprintfW",
  772. "address": "0x41b250"
  773. },
  774. {
  775. "name": "SetThreadDesktop",
  776. "address": "0x41b254"
  777. },
  778. {
  779. "name": "GetThreadDesktop",
  780. "address": "0x41b258"
  781. },
  782. {
  783. "name": "CloseDesktop",
  784. "address": "0x41b25c"
  785. },
  786. {
  787. "name": "OpenInputDesktop",
  788. "address": "0x41b260"
  789. }
  790. ],
  791. "dll": "USER32.dll"
  792. },
  793. {
  794. "imports": [
  795. {
  796. "name": "DeleteService",
  797. "address": "0x41b000"
  798. },
  799. {
  800. "name": "StartServiceCtrlDispatcherW",
  801. "address": "0x41b004"
  802. },
  803. {
  804. "name": "RegDeleteValueW",
  805. "address": "0x41b008"
  806. },
  807. {
  808. "name": "GetTokenInformation",
  809. "address": "0x41b00c"
  810. },
  811. {
  812. "name": "CreateServiceW",
  813. "address": "0x41b010"
  814. },
  815. {
  816. "name": "QueryServiceStatus",
  817. "address": "0x41b014"
  818. },
  819. {
  820. "name": "UnlockServiceDatabase",
  821. "address": "0x41b018"
  822. },
  823. {
  824. "name": "CloseServiceHandle",
  825. "address": "0x41b01c"
  826. },
  827. {
  828. "name": "OpenSCManagerW",
  829. "address": "0x41b020"
  830. },
  831. {
  832. "name": "SetServiceStatus",
  833. "address": "0x41b024"
  834. },
  835. {
  836. "name": "ChangeServiceConfig2W",
  837. "address": "0x41b028"
  838. },
  839. {
  840. "name": "LockServiceDatabase",
  841. "address": "0x41b02c"
  842. },
  843. {
  844. "name": "RegisterServiceCtrlHandlerW",
  845. "address": "0x41b030"
  846. },
  847. {
  848. "name": "ControlService",
  849. "address": "0x41b034"
  850. },
  851. {
  852. "name": "StartServiceW",
  853. "address": "0x41b038"
  854. },
  855. {
  856. "name": "QueryServiceConfigW",
  857. "address": "0x41b03c"
  858. },
  859. {
  860. "name": "OpenServiceW",
  861. "address": "0x41b040"
  862. },
  863. {
  864. "name": "QueryServiceStatusEx",
  865. "address": "0x41b044"
  866. },
  867. {
  868. "name": "RegOpenKeyW",
  869. "address": "0x41b048"
  870. },
  871. {
  872. "name": "LookupPrivilegeValueW",
  873. "address": "0x41b04c"
  874. },
  875. {
  876. "name": "AdjustTokenPrivileges",
  877. "address": "0x41b050"
  878. },
  879. {
  880. "name": "SetTokenInformation",
  881. "address": "0x41b054"
  882. },
  883. {
  884. "name": "OpenProcessToken",
  885. "address": "0x41b058"
  886. },
  887. {
  888. "name": "CreateProcessAsUserW",
  889. "address": "0x41b05c"
  890. },
  891. {
  892. "name": "DuplicateTokenEx",
  893. "address": "0x41b060"
  894. },
  895. {
  896. "name": "RegCloseKey",
  897. "address": "0x41b064"
  898. },
  899. {
  900. "name": "RegCreateKeyExW",
  901. "address": "0x41b068"
  902. },
  903. {
  904. "name": "RegSetValueExW",
  905. "address": "0x41b06c"
  906. },
  907. {
  908. "name": "RegOpenKeyExW",
  909. "address": "0x41b070"
  910. },
  911. {
  912. "name": "RegQueryValueExW",
  913. "address": "0x41b074"
  914. }
  915. ],
  916. "dll": "ADVAPI32.dll"
  917. },
  918. {
  919. "imports": [
  920. {
  921. "name": "SHGetSpecialFolderPathW",
  922. "address": "0x41b244"
  923. }
  924. ],
  925. "dll": "SHELL32.dll"
  926. },
  927. {
  928. "imports": [
  929. {
  930. "name": "WTSQueryUserToken",
  931. "address": "0x41b278"
  932. }
  933. ],
  934. "dll": "WTSAPI32.dll"
  935. },
  936. {
  937. "imports": [
  938. {
  939. "name": "CreateEnvironmentBlock",
  940. "address": "0x41b268"
  941. }
  942. ],
  943. "dll": "USERENV.dll"
  944. },
  945. {
  946. "imports": [
  947. {
  948. "name": "GetProcessImageFileNameW",
  949. "address": "0x41b23c"
  950. }
  951. ],
  952. "dll": "PSAPI.DLL"
  953. },
  954. {
  955. "imports": [
  956. {
  957. "name": "inet_addr",
  958. "address": "0x41b270"
  959. }
  960. ],
  961. "dll": "WS2_32.dll"
  962. }
  963. ],
  964. "digital_signers": null,
  965. "exported_dll_name": "SuperXmrWithOutTls.dat",
  966. "actual_checksum": "0x00132b26",
  967. "overlay": null,
  968. "imagebase": "0x00400000",
  969. "reported_checksum": "0x00000000",
  970. "icon_hash": null,
  971. "entrypoint": "0x004091ca",
  972. "timestamp": "2019-03-14 12:49:15",
  973. "osversion": "5.1",
  974. "sections": [
  975. {
  976. "name": ".text",
  977. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  978. "virtual_address": "0x00001000",
  979. "size_of_data": "0x00019200",
  980. "entropy": "6.65",
  981. "raw_address": "0x00000400",
  982. "virtual_size": "0x000191d9",
  983. "characteristics_raw": "0x60000020"
  984. },
  985. {
  986. "name": ".rdata",
  987. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  988. "virtual_address": "0x0001b000",
  989. "size_of_data": "0x00008e00",
  990. "entropy": "5.40",
  991. "raw_address": "0x00019600",
  992. "virtual_size": "0x00008cfc",
  993. "characteristics_raw": "0x40000040"
  994. },
  995. {
  996. "name": ".data",
  997. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  998. "virtual_address": "0x00024000",
  999. "size_of_data": "0x00108a00",
  1000. "entropy": "7.94",
  1001. "raw_address": "0x00022400",
  1002. "virtual_size": "0x0010991c",
  1003. "characteristics_raw": "0xc0000040"
  1004. },
  1005. {
  1006. "name": ".rsrc",
  1007. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1008. "virtual_address": "0x0012e000",
  1009. "size_of_data": "0x00000200",
  1010. "entropy": "4.72",
  1011. "raw_address": "0x0012ae00",
  1012. "virtual_size": "0x000001e0",
  1013. "characteristics_raw": "0x40000040"
  1014. },
  1015. {
  1016. "name": ".reloc",
  1017. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1018. "virtual_address": "0x0012f000",
  1019. "size_of_data": "0x00001a00",
  1020. "entropy": "6.44",
  1021. "raw_address": "0x0012b000",
  1022. "virtual_size": "0x00001820",
  1023. "characteristics_raw": "0x42000040"
  1024. }
  1025. ],
  1026. "resources": [],
  1027. "dirents": [
  1028. {
  1029. "virtual_address": "0x00022c80",
  1030. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1031. "size": "0x000001c8"
  1032. },
  1033. {
  1034. "virtual_address": "0x00022e48",
  1035. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1036. "size": "0x000000b4"
  1037. },
  1038. {
  1039. "virtual_address": "0x0012e000",
  1040. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1041. "size": "0x000001e0"
  1042. },
  1043. {
  1044. "virtual_address": "0x00000000",
  1045. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1046. "size": "0x00000000"
  1047. },
  1048. {
  1049. "virtual_address": "0x00000000",
  1050. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1051. "size": "0x00000000"
  1052. },
  1053. {
  1054. "virtual_address": "0x0012f000",
  1055. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1056. "size": "0x00001820"
  1057. },
  1058. {
  1059. "virtual_address": "0x00021d10",
  1060. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1061. "size": "0x00000070"
  1062. },
  1063. {
  1064. "virtual_address": "0x00000000",
  1065. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1066. "size": "0x00000000"
  1067. },
  1068. {
  1069. "virtual_address": "0x00000000",
  1070. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1071. "size": "0x00000000"
  1072. },
  1073. {
  1074. "virtual_address": "0x00021e20",
  1075. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1076. "size": "0x00000018"
  1077. },
  1078. {
  1079. "virtual_address": "0x00021d80",
  1080. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1081. "size": "0x00000040"
  1082. },
  1083. {
  1084. "virtual_address": "0x00000000",
  1085. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1086. "size": "0x00000000"
  1087. },
  1088. {
  1089. "virtual_address": "0x0001b000",
  1090. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1091. "size": "0x00000280"
  1092. },
  1093. {
  1094. "virtual_address": "0x00000000",
  1095. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1096. "size": "0x00000000"
  1097. },
  1098. {
  1099. "virtual_address": "0x00000000",
  1100. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1101. "size": "0x00000000"
  1102. },
  1103. {
  1104. "virtual_address": "0x00000000",
  1105. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1106. "size": "0x00000000"
  1107. }
  1108. ],
  1109. "exports": [
  1110. {
  1111. "ordinal": 1,
  1112. "name": "CloseHandle64",
  1113. "address": "0x4046d0"
  1114. },
  1115. {
  1116. "ordinal": 2,
  1117. "name": "GetModuleHandle64",
  1118. "address": "0x4034a0"
  1119. },
  1120. {
  1121. "ordinal": 3,
  1122. "name": "GetProcAddress64",
  1123. "address": "0x403d30"
  1124. },
  1125. {
  1126. "ordinal": 4,
  1127. "name": "GetThreadContext64",
  1128. "address": "0x404460"
  1129. },
  1130. {
  1131. "ordinal": 5,
  1132. "name": "MyCreateRemoteThread64",
  1133. "address": "0x4045c0"
  1134. },
  1135. {
  1136. "ordinal": 6,
  1137. "name": "ReadProcessMemory64",
  1138. "address": "0x404220"
  1139. },
  1140. {
  1141. "ordinal": 7,
  1142. "name": "SetLastErrorFromX64Call",
  1143. "address": "0x403cc0"
  1144. },
  1145. {
  1146. "ordinal": 8,
  1147. "name": "SetThreadContext64",
  1148. "address": "0x404510"
  1149. },
  1150. {
  1151. "ordinal": 9,
  1152. "name": "VirtualAllocEx64",
  1153. "address": "0x403f00"
  1154. },
  1155. {
  1156. "ordinal": 10,
  1157. "name": "VirtualFreeEx64",
  1158. "address": "0x404010"
  1159. },
  1160. {
  1161. "ordinal": 11,
  1162. "name": "VirtualProtectEx64",
  1163. "address": "0x404110"
  1164. },
  1165. {
  1166. "ordinal": 12,
  1167. "name": "VirtualQueryEx64",
  1168. "address": "0x403e00"
  1169. },
  1170. {
  1171. "ordinal": 13,
  1172. "name": "WriteProcessMemory64",
  1173. "address": "0x404340"
  1174. },
  1175. {
  1176. "ordinal": 14,
  1177. "name": "X64Call",
  1178. "address": "0x4032b0"
  1179. }
  1180. ],
  1181. "guest_signers": {},
  1182. "imphash": "e79a2a6b0cb9b9ae85ed391389e3ad1c",
  1183. "icon_fuzzy": null,
  1184. "icon": null,
  1185. "pdbpath": "E:\\Conding\\xmrig\\SupperMiner\\vip\\wer guo\\SuperMiner\\SuperMiner\\SuperMiner\\Release\\pdb\\SuperXmrWithOutTls.pdb",
  1186. "imported_dll_count": 8,
  1187. "versioninfo": []
  1188. }
  1189. }
  1190.  
  1191. [*] Resolved APIs: [
  1192. "kernel32.dll.InitializeCriticalSectionEx",
  1193. "kernel32.dll.FlsAlloc",
  1194. "kernel32.dll.FlsSetValue",
  1195. "kernel32.dll.FlsGetValue",
  1196. "kernel32.dll.LCMapStringEx",
  1197. "api-ms-win-core-synch-l1-2-0.dll.InitializeConditionVariable",
  1198. "api-ms-win-core-synch-l1-2-0.dll.SleepConditionVariableCS",
  1199. "api-ms-win-core-synch-l1-2-0.dll.WakeAllConditionVariable",
  1200. "kernel32.dll.GetNativeSystemInfo",
  1201. "kernel32.dll.SetThreadUILanguage",
  1202. "kernel32.dll.CopyFileExW",
  1203. "kernel32.dll.IsDebuggerPresent",
  1204. "kernel32.dll.SetConsoleInputExeNameW",
  1205. "kernel32.dll.SortGetHandle",
  1206. "kernel32.dll.SortCloseHandle",
  1207. "mswsock.dll.WSPStartup",
  1208. "wshtcpip.dll.WSHOpenSocket",
  1209. "wshtcpip.dll.WSHOpenSocket2",
  1210. "wshtcpip.dll.WSHJoinLeaf",
  1211. "wshtcpip.dll.WSHNotify",
  1212. "wshtcpip.dll.WSHGetSocketInformation",
  1213. "wshtcpip.dll.WSHSetSocketInformation",
  1214. "wshtcpip.dll.WSHGetSockaddrType",
  1215. "wshtcpip.dll.WSHGetWildcardSockaddr",
  1216. "wshtcpip.dll.WSHGetBroadcastSockaddr",
  1217. "wshtcpip.dll.WSHAddressToString",
  1218. "wshtcpip.dll.WSHStringToAddress",
  1219. "wshtcpip.dll.WSHIoctl",
  1220. "ole32.dll.CoInitializeEx",
  1221. "cryptbase.dll.SystemFunction036",
  1222. "ole32.dll.CoInitializeSecurity",
  1223. "sechost.dll.LookupAccountNameLocalW",
  1224. "advapi32.dll.LookupAccountSidW",
  1225. "sechost.dll.LookupAccountSidLocalW",
  1226. "ole32.dll.CoCreateInstance",
  1227. "w32time.dll.SvchostEntry_W32Time",
  1228. "w32time.dll.SvchostPushServiceGlobals",
  1229. "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  1230. "ws2_32.dll.#115",
  1231. "ws2_32.dll.WSASocketW",
  1232. "ws2_32.dll.WSAIoctl",
  1233. "ws2_32.dll.#111",
  1234. "userenv.dll.RegisterGPNotification",
  1235. "gpapi.dll.RegisterGPNotificationInternal",
  1236. "sechost.dll.OpenSCManagerW",
  1237. "sechost.dll.OpenServiceW",
  1238. "sechost.dll.CloseServiceHandle",
  1239. "sechost.dll.QueryServiceConfigW",
  1240. "dsrole.dll.DsRoleGetPrimaryDomainInformation",
  1241. "dsrole.dll.DsRoleFreeMemory",
  1242. "sspicli.dll.LsaRegisterPolicyChangeNotification",
  1243. "w32time.dll.TimeProvClose",
  1244. "w32time.dll.TimeProvCommand",
  1245. "w32time.dll.TimeProvOpen",
  1246. "ws2_32.dll.getaddrinfo",
  1247. "ws2_32.dll.freeaddrinfo",
  1248. "ws2_32.dll.#23",
  1249. "ws2_32.dll.#21",
  1250. "ws2_32.dll.#2",
  1251. "ws2_32.dll.WSAEventSelect",
  1252. "vmictimeprovider.dll.TimeProvClose",
  1253. "ws2_32.dll.GetAddrInfoW",
  1254. "vmictimeprovider.dll.TimeProvCommand",
  1255. "vmictimeprovider.dll.TimeProvOpen",
  1256. "advapi32.dll.EventRegister",
  1257. "advapi32.dll.EventEnabled",
  1258. "advapi32.dll.EventWrite",
  1259. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  1260. "ws2_32.dll.FreeAddrInfoW",
  1261. "ws2_32.dll.WSAAddressToStringW",
  1262. "ws2_32.dll.#3",
  1263. "ws2_32.dll.#116",
  1264. "advapi32.dll.EventUnregister",
  1265. "sspicli.dll.LsaUnregisterPolicyChangeNotification",
  1266. "userenv.dll.UnregisterGPNotification",
  1267. "gpapi.dll.UnregisterGPNotificationInternal"
  1268. ]
  1269.  
  1270. [*] Static Analysis: {
  1271. "pe": {
  1272. "peid_signatures": null,
  1273. "imports": [
  1274. {
  1275. "imports": [
  1276. {
  1277. "name": "lstrcatW",
  1278. "address": "0x41b07c"
  1279. },
  1280. {
  1281. "name": "DeleteFileW",
  1282. "address": "0x41b080"
  1283. },
  1284. {
  1285. "name": "lstrcpyA",
  1286. "address": "0x41b084"
  1287. },
  1288. {
  1289. "name": "Process32FirstW",
  1290. "address": "0x41b088"
  1291. },
  1292. {
  1293. "name": "GetCurrentProcessId",
  1294. "address": "0x41b08c"
  1295. },
  1296. {
  1297. "name": "CreateProcessW",
  1298. "address": "0x41b090"
  1299. },
  1300. {
  1301. "name": "WideCharToMultiByte",
  1302. "address": "0x41b094"
  1303. },
  1304. {
  1305. "name": "lstrcpyW",
  1306. "address": "0x41b098"
  1307. },
  1308. {
  1309. "name": "WinExec",
  1310. "address": "0x41b09c"
  1311. },
  1312. {
  1313. "name": "lstrcmpiW",
  1314. "address": "0x41b0a0"
  1315. },
  1316. {
  1317. "name": "CreateThread",
  1318. "address": "0x41b0a4"
  1319. },
  1320. {
  1321. "name": "HeapFree",
  1322. "address": "0x41b0a8"
  1323. },
  1324. {
  1325. "name": "HeapAlloc",
  1326. "address": "0x41b0ac"
  1327. },
  1328. {
  1329. "name": "GetProcessHeap",
  1330. "address": "0x41b0b0"
  1331. },
  1332. {
  1333. "name": "SuspendThread",
  1334. "address": "0x41b0b4"
  1335. },
  1336. {
  1337. "name": "GetSystemDirectoryW",
  1338. "address": "0x41b0b8"
  1339. },
  1340. {
  1341. "name": "ResumeThread",
  1342. "address": "0x41b0bc"
  1343. },
  1344. {
  1345. "name": "DuplicateHandle",
  1346. "address": "0x41b0c0"
  1347. },
  1348. {
  1349. "name": "FreeLibrary",
  1350. "address": "0x41b0c4"
  1351. },
  1352. {
  1353. "name": "OpenThread",
  1354. "address": "0x41b0c8"
  1355. },
  1356. {
  1357. "name": "CreateDirectoryW",
  1358. "address": "0x41b0cc"
  1359. },
  1360. {
  1361. "name": "GetCommandLineW",
  1362. "address": "0x41b0d0"
  1363. },
  1364. {
  1365. "name": "GetModuleFileNameW",
  1366. "address": "0x41b0d4"
  1367. },
  1368. {
  1369. "name": "GetCurrentThread",
  1370. "address": "0x41b0d8"
  1371. },
  1372. {
  1373. "name": "GetSystemInfo",
  1374. "address": "0x41b0dc"
  1375. },
  1376. {
  1377. "name": "GetWindowsDirectoryW",
  1378. "address": "0x41b0e0"
  1379. },
  1380. {
  1381. "name": "VirtualAllocEx",
  1382. "address": "0x41b0e4"
  1383. },
  1384. {
  1385. "name": "CopyFileW",
  1386. "address": "0x41b0e8"
  1387. },
  1388. {
  1389. "name": "CreateRemoteThread",
  1390. "address": "0x41b0ec"
  1391. },
  1392. {
  1393. "name": "HeapSize",
  1394. "address": "0x41b0f0"
  1395. },
  1396. {
  1397. "name": "GetStringTypeW",
  1398. "address": "0x41b0f4"
  1399. },
  1400. {
  1401. "name": "FreeEnvironmentStringsW",
  1402. "address": "0x41b0f8"
  1403. },
  1404. {
  1405. "name": "GetEnvironmentStringsW",
  1406. "address": "0x41b0fc"
  1407. },
  1408. {
  1409. "name": "GetCommandLineA",
  1410. "address": "0x41b100"
  1411. },
  1412. {
  1413. "name": "GetCPInfo",
  1414. "address": "0x41b104"
  1415. },
  1416. {
  1417. "name": "GetOEMCP",
  1418. "address": "0x41b108"
  1419. },
  1420. {
  1421. "name": "IsValidCodePage",
  1422. "address": "0x41b10c"
  1423. },
  1424. {
  1425. "name": "SetEvent",
  1426. "address": "0x41b110"
  1427. },
  1428. {
  1429. "name": "Process32NextW",
  1430. "address": "0x41b114"
  1431. },
  1432. {
  1433. "name": "Sleep",
  1434. "address": "0x41b118"
  1435. },
  1436. {
  1437. "name": "MultiByteToWideChar",
  1438. "address": "0x41b11c"
  1439. },
  1440. {
  1441. "name": "CreateEventW",
  1442. "address": "0x41b120"
  1443. },
  1444. {
  1445. "name": "CreateToolhelp32Snapshot",
  1446. "address": "0x41b124"
  1447. },
  1448. {
  1449. "name": "GetLogicalDriveStringsW",
  1450. "address": "0x41b128"
  1451. },
  1452. {
  1453. "name": "lstrcatA",
  1454. "address": "0x41b12c"
  1455. },
  1456. {
  1457. "name": "GetCurrentThreadId",
  1458. "address": "0x41b130"
  1459. },
  1460. {
  1461. "name": "CreateFileW",
  1462. "address": "0x41b134"
  1463. },
  1464. {
  1465. "name": "WaitForSingleObject",
  1466. "address": "0x41b138"
  1467. },
  1468. {
  1469. "name": "GetEnvironmentVariableA",
  1470. "address": "0x41b13c"
  1471. },
  1472. {
  1473. "name": "SetThreadPriority",
  1474. "address": "0x41b140"
  1475. },
  1476. {
  1477. "name": "TerminateProcess",
  1478. "address": "0x41b144"
  1479. },
  1480. {
  1481. "name": "WriteFile",
  1482. "address": "0x41b148"
  1483. },
  1484. {
  1485. "name": "lstrlenW",
  1486. "address": "0x41b14c"
  1487. },
  1488. {
  1489. "name": "SetPriorityClass",
  1490. "address": "0x41b150"
  1491. },
  1492. {
  1493. "name": "SetLastError",
  1494. "address": "0x41b154"
  1495. },
  1496. {
  1497. "name": "QueryDosDeviceW",
  1498. "address": "0x41b158"
  1499. },
  1500. {
  1501. "name": "GetModuleFileNameA",
  1502. "address": "0x41b15c"
  1503. },
  1504. {
  1505. "name": "WriteProcessMemory",
  1506. "address": "0x41b160"
  1507. },
  1508. {
  1509. "name": "GetShortPathNameA",
  1510. "address": "0x41b164"
  1511. },
  1512. {
  1513. "name": "LoadLibraryW",
  1514. "address": "0x41b168"
  1515. },
  1516. {
  1517. "name": "IsWow64Process",
  1518. "address": "0x41b16c"
  1519. },
  1520. {
  1521. "name": "GetModuleHandleW",
  1522. "address": "0x41b170"
  1523. },
  1524. {
  1525. "name": "ReadProcessMemory",
  1526. "address": "0x41b174"
  1527. },
  1528. {
  1529. "name": "GetProcAddress",
  1530. "address": "0x41b178"
  1531. },
  1532. {
  1533. "name": "CloseHandle",
  1534. "address": "0x41b17c"
  1535. },
  1536. {
  1537. "name": "GetLastError",
  1538. "address": "0x41b180"
  1539. },
  1540. {
  1541. "name": "OpenProcess",
  1542. "address": "0x41b184"
  1543. },
  1544. {
  1545. "name": "GetModuleHandleA",
  1546. "address": "0x41b188"
  1547. },
  1548. {
  1549. "name": "GetCurrentProcess",
  1550. "address": "0x41b18c"
  1551. },
  1552. {
  1553. "name": "SetStdHandle",
  1554. "address": "0x41b190"
  1555. },
  1556. {
  1557. "name": "HeapReAlloc",
  1558. "address": "0x41b194"
  1559. },
  1560. {
  1561. "name": "FlushFileBuffers",
  1562. "address": "0x41b198"
  1563. },
  1564. {
  1565. "name": "GetConsoleCP",
  1566. "address": "0x41b19c"
  1567. },
  1568. {
  1569. "name": "EnterCriticalSection",
  1570. "address": "0x41b1a0"
  1571. },
  1572. {
  1573. "name": "LeaveCriticalSection",
  1574. "address": "0x41b1a4"
  1575. },
  1576. {
  1577. "name": "InitializeCriticalSectionAndSpinCount",
  1578. "address": "0x41b1a8"
  1579. },
  1580. {
  1581. "name": "DeleteCriticalSection",
  1582. "address": "0x41b1ac"
  1583. },
  1584. {
  1585. "name": "ResetEvent",
  1586. "address": "0x41b1b0"
  1587. },
  1588. {
  1589. "name": "WaitForSingleObjectEx",
  1590. "address": "0x41b1b4"
  1591. },
  1592. {
  1593. "name": "UnhandledExceptionFilter",
  1594. "address": "0x41b1b8"
  1595. },
  1596. {
  1597. "name": "SetUnhandledExceptionFilter",
  1598. "address": "0x41b1bc"
  1599. },
  1600. {
  1601. "name": "IsProcessorFeaturePresent",
  1602. "address": "0x41b1c0"
  1603. },
  1604. {
  1605. "name": "IsDebuggerPresent",
  1606. "address": "0x41b1c4"
  1607. },
  1608. {
  1609. "name": "GetStartupInfoW",
  1610. "address": "0x41b1c8"
  1611. },
  1612. {
  1613. "name": "QueryPerformanceCounter",
  1614. "address": "0x41b1cc"
  1615. },
  1616. {
  1617. "name": "GetSystemTimeAsFileTime",
  1618. "address": "0x41b1d0"
  1619. },
  1620. {
  1621. "name": "InitializeSListHead",
  1622. "address": "0x41b1d4"
  1623. },
  1624. {
  1625. "name": "RtlUnwind",
  1626. "address": "0x41b1d8"
  1627. },
  1628. {
  1629. "name": "RaiseException",
  1630. "address": "0x41b1dc"
  1631. },
  1632. {
  1633. "name": "EncodePointer",
  1634. "address": "0x41b1e0"
  1635. },
  1636. {
  1637. "name": "TlsAlloc",
  1638. "address": "0x41b1e4"
  1639. },
  1640. {
  1641. "name": "TlsGetValue",
  1642. "address": "0x41b1e8"
  1643. },
  1644. {
  1645. "name": "TlsSetValue",
  1646. "address": "0x41b1ec"
  1647. },
  1648. {
  1649. "name": "TlsFree",
  1650. "address": "0x41b1f0"
  1651. },
  1652. {
  1653. "name": "LoadLibraryExW",
  1654. "address": "0x41b1f4"
  1655. },
  1656. {
  1657. "name": "ExitProcess",
  1658. "address": "0x41b1f8"
  1659. },
  1660. {
  1661. "name": "GetModuleHandleExW",
  1662. "address": "0x41b1fc"
  1663. },
  1664. {
  1665. "name": "GetFileAttributesExW",
  1666. "address": "0x41b200"
  1667. },
  1668. {
  1669. "name": "ExitThread",
  1670. "address": "0x41b204"
  1671. },
  1672. {
  1673. "name": "FreeLibraryAndExitThread",
  1674. "address": "0x41b208"
  1675. },
  1676. {
  1677. "name": "FindClose",
  1678. "address": "0x41b20c"
  1679. },
  1680. {
  1681. "name": "FindFirstFileExW",
  1682. "address": "0x41b210"
  1683. },
  1684. {
  1685. "name": "FindNextFileW",
  1686. "address": "0x41b214"
  1687. },
  1688. {
  1689. "name": "GetFileType",
  1690. "address": "0x41b218"
  1691. },
  1692. {
  1693. "name": "GetStdHandle",
  1694. "address": "0x41b21c"
  1695. },
  1696. {
  1697. "name": "WriteConsoleW",
  1698. "address": "0x41b220"
  1699. },
  1700. {
  1701. "name": "GetACP",
  1702. "address": "0x41b224"
  1703. },
  1704. {
  1705. "name": "LCMapStringW",
  1706. "address": "0x41b228"
  1707. },
  1708. {
  1709. "name": "SetFilePointerEx",
  1710. "address": "0x41b22c"
  1711. },
  1712. {
  1713. "name": "GetConsoleMode",
  1714. "address": "0x41b230"
  1715. },
  1716. {
  1717. "name": "DecodePointer",
  1718. "address": "0x41b234"
  1719. }
  1720. ],
  1721. "dll": "KERNEL32.dll"
  1722. },
  1723. {
  1724. "imports": [
  1725. {
  1726. "name": "GetUserObjectInformationW",
  1727. "address": "0x41b24c"
  1728. },
  1729. {
  1730. "name": "wsprintfW",
  1731. "address": "0x41b250"
  1732. },
  1733. {
  1734. "name": "SetThreadDesktop",
  1735. "address": "0x41b254"
  1736. },
  1737. {
  1738. "name": "GetThreadDesktop",
  1739. "address": "0x41b258"
  1740. },
  1741. {
  1742. "name": "CloseDesktop",
  1743. "address": "0x41b25c"
  1744. },
  1745. {
  1746. "name": "OpenInputDesktop",
  1747. "address": "0x41b260"
  1748. }
  1749. ],
  1750. "dll": "USER32.dll"
  1751. },
  1752. {
  1753. "imports": [
  1754. {
  1755. "name": "DeleteService",
  1756. "address": "0x41b000"
  1757. },
  1758. {
  1759. "name": "StartServiceCtrlDispatcherW",
  1760. "address": "0x41b004"
  1761. },
  1762. {
  1763. "name": "RegDeleteValueW",
  1764. "address": "0x41b008"
  1765. },
  1766. {
  1767. "name": "GetTokenInformation",
  1768. "address": "0x41b00c"
  1769. },
  1770. {
  1771. "name": "CreateServiceW",
  1772. "address": "0x41b010"
  1773. },
  1774. {
  1775. "name": "QueryServiceStatus",
  1776. "address": "0x41b014"
  1777. },
  1778. {
  1779. "name": "UnlockServiceDatabase",
  1780. "address": "0x41b018"
  1781. },
  1782. {
  1783. "name": "CloseServiceHandle",
  1784. "address": "0x41b01c"
  1785. },
  1786. {
  1787. "name": "OpenSCManagerW",
  1788. "address": "0x41b020"
  1789. },
  1790. {
  1791. "name": "SetServiceStatus",
  1792. "address": "0x41b024"
  1793. },
  1794. {
  1795. "name": "ChangeServiceConfig2W",
  1796. "address": "0x41b028"
  1797. },
  1798. {
  1799. "name": "LockServiceDatabase",
  1800. "address": "0x41b02c"
  1801. },
  1802. {
  1803. "name": "RegisterServiceCtrlHandlerW",
  1804. "address": "0x41b030"
  1805. },
  1806. {
  1807. "name": "ControlService",
  1808. "address": "0x41b034"
  1809. },
  1810. {
  1811. "name": "StartServiceW",
  1812. "address": "0x41b038"
  1813. },
  1814. {
  1815. "name": "QueryServiceConfigW",
  1816. "address": "0x41b03c"
  1817. },
  1818. {
  1819. "name": "OpenServiceW",
  1820. "address": "0x41b040"
  1821. },
  1822. {
  1823. "name": "QueryServiceStatusEx",
  1824. "address": "0x41b044"
  1825. },
  1826. {
  1827. "name": "RegOpenKeyW",
  1828. "address": "0x41b048"
  1829. },
  1830. {
  1831. "name": "LookupPrivilegeValueW",
  1832. "address": "0x41b04c"
  1833. },
  1834. {
  1835. "name": "AdjustTokenPrivileges",
  1836. "address": "0x41b050"
  1837. },
  1838. {
  1839. "name": "SetTokenInformation",
  1840. "address": "0x41b054"
  1841. },
  1842. {
  1843. "name": "OpenProcessToken",
  1844. "address": "0x41b058"
  1845. },
  1846. {
  1847. "name": "CreateProcessAsUserW",
  1848. "address": "0x41b05c"
  1849. },
  1850. {
  1851. "name": "DuplicateTokenEx",
  1852. "address": "0x41b060"
  1853. },
  1854. {
  1855. "name": "RegCloseKey",
  1856. "address": "0x41b064"
  1857. },
  1858. {
  1859. "name": "RegCreateKeyExW",
  1860. "address": "0x41b068"
  1861. },
  1862. {
  1863. "name": "RegSetValueExW",
  1864. "address": "0x41b06c"
  1865. },
  1866. {
  1867. "name": "RegOpenKeyExW",
  1868. "address": "0x41b070"
  1869. },
  1870. {
  1871. "name": "RegQueryValueExW",
  1872. "address": "0x41b074"
  1873. }
  1874. ],
  1875. "dll": "ADVAPI32.dll"
  1876. },
  1877. {
  1878. "imports": [
  1879. {
  1880. "name": "SHGetSpecialFolderPathW",
  1881. "address": "0x41b244"
  1882. }
  1883. ],
  1884. "dll": "SHELL32.dll"
  1885. },
  1886. {
  1887. "imports": [
  1888. {
  1889. "name": "WTSQueryUserToken",
  1890. "address": "0x41b278"
  1891. }
  1892. ],
  1893. "dll": "WTSAPI32.dll"
  1894. },
  1895. {
  1896. "imports": [
  1897. {
  1898. "name": "CreateEnvironmentBlock",
  1899. "address": "0x41b268"
  1900. }
  1901. ],
  1902. "dll": "USERENV.dll"
  1903. },
  1904. {
  1905. "imports": [
  1906. {
  1907. "name": "GetProcessImageFileNameW",
  1908. "address": "0x41b23c"
  1909. }
  1910. ],
  1911. "dll": "PSAPI.DLL"
  1912. },
  1913. {
  1914. "imports": [
  1915. {
  1916. "name": "inet_addr",
  1917. "address": "0x41b270"
  1918. }
  1919. ],
  1920. "dll": "WS2_32.dll"
  1921. }
  1922. ],
  1923. "digital_signers": null,
  1924. "exported_dll_name": "SuperXmrWithOutTls.dat",
  1925. "actual_checksum": "0x00132b26",
  1926. "overlay": null,
  1927. "imagebase": "0x00400000",
  1928. "reported_checksum": "0x00000000",
  1929. "icon_hash": null,
  1930. "entrypoint": "0x004091ca",
  1931. "timestamp": "2019-03-14 12:49:15",
  1932. "osversion": "5.1",
  1933. "sections": [
  1934. {
  1935. "name": ".text",
  1936. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1937. "virtual_address": "0x00001000",
  1938. "size_of_data": "0x00019200",
  1939. "entropy": "6.65",
  1940. "raw_address": "0x00000400",
  1941. "virtual_size": "0x000191d9",
  1942. "characteristics_raw": "0x60000020"
  1943. },
  1944. {
  1945. "name": ".rdata",
  1946. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1947. "virtual_address": "0x0001b000",
  1948. "size_of_data": "0x00008e00",
  1949. "entropy": "5.40",
  1950. "raw_address": "0x00019600",
  1951. "virtual_size": "0x00008cfc",
  1952. "characteristics_raw": "0x40000040"
  1953. },
  1954. {
  1955. "name": ".data",
  1956. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1957. "virtual_address": "0x00024000",
  1958. "size_of_data": "0x00108a00",
  1959. "entropy": "7.94",
  1960. "raw_address": "0x00022400",
  1961. "virtual_size": "0x0010991c",
  1962. "characteristics_raw": "0xc0000040"
  1963. },
  1964. {
  1965. "name": ".rsrc",
  1966. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1967. "virtual_address": "0x0012e000",
  1968. "size_of_data": "0x00000200",
  1969. "entropy": "4.72",
  1970. "raw_address": "0x0012ae00",
  1971. "virtual_size": "0x000001e0",
  1972. "characteristics_raw": "0x40000040"
  1973. },
  1974. {
  1975. "name": ".reloc",
  1976. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1977. "virtual_address": "0x0012f000",
  1978. "size_of_data": "0x00001a00",
  1979. "entropy": "6.44",
  1980. "raw_address": "0x0012b000",
  1981. "virtual_size": "0x00001820",
  1982. "characteristics_raw": "0x42000040"
  1983. }
  1984. ],
  1985. "resources": [],
  1986. "dirents": [
  1987. {
  1988. "virtual_address": "0x00022c80",
  1989. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1990. "size": "0x000001c8"
  1991. },
  1992. {
  1993. "virtual_address": "0x00022e48",
  1994. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1995. "size": "0x000000b4"
  1996. },
  1997. {
  1998. "virtual_address": "0x0012e000",
  1999. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  2000. "size": "0x000001e0"
  2001. },
  2002. {
  2003. "virtual_address": "0x00000000",
  2004. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  2005. "size": "0x00000000"
  2006. },
  2007. {
  2008. "virtual_address": "0x00000000",
  2009. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  2010. "size": "0x00000000"
  2011. },
  2012. {
  2013. "virtual_address": "0x0012f000",
  2014. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  2015. "size": "0x00001820"
  2016. },
  2017. {
  2018. "virtual_address": "0x00021d10",
  2019. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  2020. "size": "0x00000070"
  2021. },
  2022. {
  2023. "virtual_address": "0x00000000",
  2024. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  2025. "size": "0x00000000"
  2026. },
  2027. {
  2028. "virtual_address": "0x00000000",
  2029. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  2030. "size": "0x00000000"
  2031. },
  2032. {
  2033. "virtual_address": "0x00021e20",
  2034. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  2035. "size": "0x00000018"
  2036. },
  2037. {
  2038. "virtual_address": "0x00021d80",
  2039. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  2040. "size": "0x00000040"
  2041. },
  2042. {
  2043. "virtual_address": "0x00000000",
  2044. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  2045. "size": "0x00000000"
  2046. },
  2047. {
  2048. "virtual_address": "0x0001b000",
  2049. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  2050. "size": "0x00000280"
  2051. },
  2052. {
  2053. "virtual_address": "0x00000000",
  2054. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  2055. "size": "0x00000000"
  2056. },
  2057. {
  2058. "virtual_address": "0x00000000",
  2059. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  2060. "size": "0x00000000"
  2061. },
  2062. {
  2063. "virtual_address": "0x00000000",
  2064. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  2065. "size": "0x00000000"
  2066. }
  2067. ],
  2068. "exports": [
  2069. {
  2070. "ordinal": 1,
  2071. "name": "CloseHandle64",
  2072. "address": "0x4046d0"
  2073. },
  2074. {
  2075. "ordinal": 2,
  2076. "name": "GetModuleHandle64",
  2077. "address": "0x4034a0"
  2078. },
  2079. {
  2080. "ordinal": 3,
  2081. "name": "GetProcAddress64",
  2082. "address": "0x403d30"
  2083. },
  2084. {
  2085. "ordinal": 4,
  2086. "name": "GetThreadContext64",
  2087. "address": "0x404460"
  2088. },
  2089. {
  2090. "ordinal": 5,
  2091. "name": "MyCreateRemoteThread64",
  2092. "address": "0x4045c0"
  2093. },
  2094. {
  2095. "ordinal": 6,
  2096. "name": "ReadProcessMemory64",
  2097. "address": "0x404220"
  2098. },
  2099. {
  2100. "ordinal": 7,
  2101. "name": "SetLastErrorFromX64Call",
  2102. "address": "0x403cc0"
  2103. },
  2104. {
  2105. "ordinal": 8,
  2106. "name": "SetThreadContext64",
  2107. "address": "0x404510"
  2108. },
  2109. {
  2110. "ordinal": 9,
  2111. "name": "VirtualAllocEx64",
  2112. "address": "0x403f00"
  2113. },
  2114. {
  2115. "ordinal": 10,
  2116. "name": "VirtualFreeEx64",
  2117. "address": "0x404010"
  2118. },
  2119. {
  2120. "ordinal": 11,
  2121. "name": "VirtualProtectEx64",
  2122. "address": "0x404110"
  2123. },
  2124. {
  2125. "ordinal": 12,
  2126. "name": "VirtualQueryEx64",
  2127. "address": "0x403e00"
  2128. },
  2129. {
  2130. "ordinal": 13,
  2131. "name": "WriteProcessMemory64",
  2132. "address": "0x404340"
  2133. },
  2134. {
  2135. "ordinal": 14,
  2136. "name": "X64Call",
  2137. "address": "0x4032b0"
  2138. }
  2139. ],
  2140. "guest_signers": {},
  2141. "imphash": "e79a2a6b0cb9b9ae85ed391389e3ad1c",
  2142. "icon_fuzzy": null,
  2143. "icon": null,
  2144. "pdbpath": "E:\\Conding\\xmrig\\SupperMiner\\vip\\wer guo\\SuperMiner\\SuperMiner\\SuperMiner\\Release\\pdb\\SuperXmrWithOutTls.pdb",
  2145. "imported_dll_count": 8,
  2146. "versioninfo": []
  2147. }
  2148. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!