API tools faq
paste
paladin316

Exes_4beafd97cdfd8e80dbad3a64725ed2f9_exe_2019-06-27_21_30.json

paladin316
Jun 27th, 2019
2,096
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 66.93 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_4beafd97cdfd8e80dbad3a64725ed2f9.exe"
  7. [*] File Size: 404480
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "f25d654ad0afc5e4de2acaf0f156fd73e011113910248a89e4186a447b8bfbde"
  10. [*] MD5: "4beafd97cdfd8e80dbad3a64725ed2f9"
  11. [*] SHA1: "4e6d0663290c24ab333cf0accb04f6b8323f7c7b"
  12. [*] SHA512: "cc4a95609f2ab31988e8449e3832d10c9fb0a888c5139d57f88628910eb77aa4f1a0616abed544a8dbf597945b78bcb89247d536b0d4c64ece6e304884bb2dbf"
  13. [*] CRC32: "108EE037"
  14. [*] SSDEEP: "6144:5WTzSVC7YvSIdfeJ87trNwGkqe7UhbkwBfYNlyDg6co6uVl:5WPWBSId2Ktrvkqe7lQDgK6uVl"
  15.  
  16. [*] Process Execution: [
  17. "Exes_4beafd97cdfd8e80dbad3a64725ed2f9.exe",
  18. "IntelRapid.exe",
  19. "services.exe",
  20. "svchost.exe",
  21. "WMIADAP.exe",
  22. "taskeng.exe",
  23. "svchost.exe",
  24. "WmiPrvSE.exe",
  25. "svchost.exe",
  26. "svchost.exe",
  27. "taskhost.exe"
  28. ]
  29.  
  30. [*] Signatures Detected: [
  31. {
  32. "Description": "Creates RWX memory",
  33. "Details": []
  34. },
  35. {
  36. "Description": "A process attempted to delay the analysis task.",
  37. "Details": [
  38. {
  39. "Process": "svchost.exe tried to sleep 720 seconds, actually delayed analysis time by 0 seconds"
  40. },
  41. {
  42. "Process": "WmiPrvSE.exe tried to sleep 360 seconds, actually delayed analysis time by 0 seconds"
  43. }
  44. ]
  45. },
  46. {
  47. "Description": "A process created a hidden window",
  48. "Details": [
  49. {
  50. "Process": "svchost.exe -> \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE"
  51. }
  52. ]
  53. },
  54. {
  55. "Description": "Drops a binary and executes it",
  56. "Details": [
  57. {
  58. "binary": "C:\\Users\\user\\AppData\\Roaming\\Intel Rapid\\IntelRapid.exe"
  59. }
  60. ]
  61. },
  62. {
  63. "Description": "Attempts to restart the guest VM",
  64. "Details": []
  65. },
  66. {
  67. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  68. "Details": [
  69. {
  70. "Spam": "services.exe (504) called API GetSystemTimeAsFileTime 8314380 times"
  71. }
  72. ]
  73. },
  74. {
  75. "Description": "Installs itself for autorun at Windows startup",
  76. "Details": [
  77. {
  78. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\IntelRapid.lnk"
  79. },
  80. {
  81. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\IntelRapid.lnk"
  82. }
  83. ]
  84. },
  85. {
  86. "Description": "Creates a copy of itself",
  87. "Details": [
  88. {
  89. "copy": "C:\\Users\\user\\AppData\\Roaming\\Intel Rapid\\IntelRapid.exe"
  90. }
  91. ]
  92. }
  93. ]
  94.  
  95. [*] Started Service: [
  96. "Winmgmt"
  97. ]
  98.  
  99. [*] Executed Commands: [
  100. "C:\\Users\\user\\AppData\\Roaming\\Intel Rapid\\IntelRapid.exe",
  101. "\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE wmiadap.exe /F /T /R",
  102. "taskeng.exe {10F1DA76-90B9-412E-8D22-E64B15D00033} S-1-5-18:NT AUTHORITY\\System:Service:",
  103. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding",
  104. "C:\\Windows\\system32\\svchost.exe -k netsvcs"
  105. ]
  106.  
  107. [*] Mutexes: [
  108. "{37529D08-A67E-40B3-B0F2-EB87331B47F5}",
  109. "Global\\ADAP_WMI_ENTRY",
  110. "Global\\RefreshRA_Mutex",
  111. "Global\\RefreshRA_Mutex_Lib",
  112. "Global\\RefreshRA_Mutex_Flag"
  113. ]
  114.  
  115. [*] Modified Files: [
  116. "C:\\Users\\user\\AppData\\Roaming\\Intel Rapid\\IntelRapid.exe",
  117. "\\??\\PIPE\\srvsvc",
  118. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\IntelRapid.lnk",
  119. "C:\\Windows\\sysnative\\Tasks\\Intel Rapid",
  120. "C:\\Windows\\appcompat\\Programs\\RecentFileCache.bcf",
  121. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MP Scheduled Scan",
  122. "\\Device\\LanmanDatagramReceiver",
  123. "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
  124. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk",
  125. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h",
  126. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  127. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.ini",
  128. "\\??\\PIPE\\samr",
  129. "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
  130. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
  131. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
  132. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
  133. "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
  134. "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
  135. "C:\\Windows\\sysnative\\LogFiles\\Scm\\5869f1c1-01d7-41f7-84b7-715672259fa8",
  136. "\\??\\WMIDataDevice",
  137. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
  138. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM"
  139. ]
  140.  
  141. [*] Deleted Files: [
  142. "C:\\Windows\\Tasks\\Intel Rapid.job",
  143. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MpIdleTask",
  144. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MP Scheduled Scan",
  145. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log",
  146. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  147. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h"
  148. ]
  149.  
  150. [*] Modified Registry Keys: [
  151. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{844E0DFC-7472-4CA9-96DC-9859ED19B312}\\Path",
  152. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{844E0DFC-7472-4CA9-96DC-9859ED19B312}\\Hash",
  153. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Intel Rapid\\Id",
  154. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Intel Rapid\\Index",
  155. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{844E0DFC-7472-4CA9-96DC-9859ED19B312}\\Triggers",
  156. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{844E0DFC-7472-4CA9-96DC-9859ED19B312}\\DynamicInfo",
  157. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  158. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\PreviousServiceShutdown",
  159. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
  160. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{D802E2E4-2771-458F-A331-5941A64C01E1}\\Path",
  161. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{D802E2E4-2771-458F-A331-5941A64C01E1}\\Hash",
  162. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Id",
  163. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Index",
  164. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{D802E2E4-2771-458F-A331-5941A64C01E1}\\Triggers",
  165. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{D802E2E4-2771-458F-A331-5941A64C01E1}\\DynamicInfo",
  166. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{ED0D73D7-BC97-46E2-AC55-FD6EB3F72C05}\\DynamicInfo",
  167. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{10F1DA76-90B9-412E-8D22-E64B15D00033}",
  168. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
  169. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
  170. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
  171. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
  172. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
  173. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ThrottleDrege",
  174. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Parameters\\ServiceDllUnloadOnStop",
  175. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStopMissed",
  176. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
  177. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider",
  178. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\IDE\\DiskVBOX_HARDDISK___________________________1.0_____\\5&33d1638a&0&0.0.0_0-{00000000-0000-0000-0000-000000000000}",
  179. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\advapi32.dll[MofResourceName]",
  180. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\en-US\\advapi32.dll.mui[MofResourceName]",
  181. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ACPI.sys[ACPIMOFResource]",
  182. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ACPI.sys.mui[ACPIMOFResource]",
  183. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ndis.sys[MofResourceName]",
  184. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ndis.sys.mui[MofResourceName]",
  185. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\mssmbios.sys[MofResource]",
  186. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\mssmbios.sys.mui[MofResource]",
  187. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\HDAudBus.sys[HDAudioMofName]",
  188. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\HDAudBus.sys.mui[HDAudioMofName]",
  189. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\intelppm.sys[PROCESSORWMI]",
  190. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\intelppm.sys.mui[PROCESSORWMI]",
  191. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\portcls.SYS[PortclsMof]",
  192. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\en-US\\portcls.SYS.mui[PortclsMof]",
  193. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sys[MonitorWMI]"
  194. ]
  195.  
  196. [*] Deleted Registry Keys: [
  197. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Intel Rapid.job",
  198. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Intel Rapid.job.fp",
  199. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  200. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sys[MonitorWMI]"
  201. ]
  202.  
  203. [*] DNS Communications: []
  204.  
  205. [*] Domains: []
  206.  
  207. [*] Network Communication - ICMP: []
  208.  
  209. [*] Network Communication - HTTP: []
  210.  
  211. [*] Network Communication - SMTP: []
  212.  
  213. [*] Network Communication - Hosts: []
  214.  
  215. [*] Network Communication - IRC: []
  216.  
  217. [*] Static Analysis: {
  218. "pe": {
  219. "peid_signatures": null,
  220. "imports": [
  221. {
  222. "imports": [
  223. {
  224. "name": "HeapReAlloc",
  225. "address": "0x431000"
  226. },
  227. {
  228. "name": "GetNativeSystemInfo",
  229. "address": "0x431004"
  230. },
  231. {
  232. "name": "GetDriveTypeW",
  233. "address": "0x431008"
  234. },
  235. {
  236. "name": "GetProfileIntW",
  237. "address": "0x43100c"
  238. },
  239. {
  240. "name": "WaitForSingleObject",
  241. "address": "0x431010"
  242. },
  243. {
  244. "name": "SetTapeParameters",
  245. "address": "0x431014"
  246. },
  247. {
  248. "name": "GetModuleHandleW",
  249. "address": "0x431018"
  250. },
  251. {
  252. "name": "GetCurrentThread",
  253. "address": "0x43101c"
  254. },
  255. {
  256. "name": "ExpandEnvironmentStringsA",
  257. "address": "0x431020"
  258. },
  259. {
  260. "name": "FormatMessageA",
  261. "address": "0x431024"
  262. },
  263. {
  264. "name": "WaitNamedPipeW",
  265. "address": "0x431028"
  266. },
  267. {
  268. "name": "EnumTimeFormatsA",
  269. "address": "0x43102c"
  270. },
  271. {
  272. "name": "GetSystemDirectoryW",
  273. "address": "0x431030"
  274. },
  275. {
  276. "name": "WideCharToMultiByte",
  277. "address": "0x431034"
  278. },
  279. {
  280. "name": "LoadLibraryW",
  281. "address": "0x431038"
  282. },
  283. {
  284. "name": "FormatMessageW",
  285. "address": "0x43103c"
  286. },
  287. {
  288. "name": "GetStringTypeExW",
  289. "address": "0x431040"
  290. },
  291. {
  292. "name": "LeaveCriticalSection",
  293. "address": "0x431044"
  294. },
  295. {
  296. "name": "CreateMailslotW",
  297. "address": "0x431048"
  298. },
  299. {
  300. "name": "WritePrivateProfileStringW",
  301. "address": "0x43104c"
  302. },
  303. {
  304. "name": "ReplaceFileA",
  305. "address": "0x431050"
  306. },
  307. {
  308. "name": "EnumSystemLocalesA",
  309. "address": "0x431054"
  310. },
  311. {
  312. "name": "GetLastError",
  313. "address": "0x431058"
  314. },
  315. {
  316. "name": "GetLongPathNameW",
  317. "address": "0x43105c"
  318. },
  319. {
  320. "name": "GetProcAddress",
  321. "address": "0x431060"
  322. },
  323. {
  324. "name": "MoveFileW",
  325. "address": "0x431064"
  326. },
  327. {
  328. "name": "GetFirmwareEnvironmentVariableW",
  329. "address": "0x431068"
  330. },
  331. {
  332. "name": "DefineDosDeviceA",
  333. "address": "0x43106c"
  334. },
  335. {
  336. "name": "LocalAlloc",
  337. "address": "0x431070"
  338. },
  339. {
  340. "name": "FindFirstVolumeMountPointW",
  341. "address": "0x431074"
  342. },
  343. {
  344. "name": "GetProfileStringA",
  345. "address": "0x431078"
  346. },
  347. {
  348. "name": "HeapLock",
  349. "address": "0x43107c"
  350. },
  351. {
  352. "name": "WaitForMultipleObjects",
  353. "address": "0x431080"
  354. },
  355. {
  356. "name": "GetVolumePathNamesForVolumeNameA",
  357. "address": "0x431084"
  358. },
  359. {
  360. "name": "GetDefaultCommConfigA",
  361. "address": "0x431088"
  362. },
  363. {
  364. "name": "DeleteCriticalSection",
  365. "address": "0x43108c"
  366. },
  367. {
  368. "name": "WriteConsoleOutputAttribute",
  369. "address": "0x431090"
  370. },
  371. {
  372. "name": "MoveFileWithProgressW",
  373. "address": "0x431094"
  374. },
  375. {
  376. "name": "WriteConsoleW",
  377. "address": "0x431098"
  378. },
  379. {
  380. "name": "GetStringTypeW",
  381. "address": "0x43109c"
  382. },
  383. {
  384. "name": "ReadConsoleW",
  385. "address": "0x4310a0"
  386. },
  387. {
  388. "name": "ReadFile",
  389. "address": "0x4310a4"
  390. },
  391. {
  392. "name": "OutputDebugStringW",
  393. "address": "0x4310a8"
  394. },
  395. {
  396. "name": "FlushFileBuffers",
  397. "address": "0x4310ac"
  398. },
  399. {
  400. "name": "HeapFree",
  401. "address": "0x4310b0"
  402. },
  403. {
  404. "name": "EncodePointer",
  405. "address": "0x4310b4"
  406. },
  407. {
  408. "name": "DecodePointer",
  409. "address": "0x4310b8"
  410. },
  411. {
  412. "name": "GetCommandLineA",
  413. "address": "0x4310bc"
  414. },
  415. {
  416. "name": "RaiseException",
  417. "address": "0x4310c0"
  418. },
  419. {
  420. "name": "RtlUnwind",
  421. "address": "0x4310c4"
  422. },
  423. {
  424. "name": "IsDebuggerPresent",
  425. "address": "0x4310c8"
  426. },
  427. {
  428. "name": "IsProcessorFeaturePresent",
  429. "address": "0x4310cc"
  430. },
  431. {
  432. "name": "EnterCriticalSection",
  433. "address": "0x4310d0"
  434. },
  435. {
  436. "name": "GetStdHandle",
  437. "address": "0x4310d4"
  438. },
  439. {
  440. "name": "GetFileType",
  441. "address": "0x4310d8"
  442. },
  443. {
  444. "name": "GetStartupInfoW",
  445. "address": "0x4310dc"
  446. },
  447. {
  448. "name": "GetProcessHeap",
  449. "address": "0x4310e0"
  450. },
  451. {
  452. "name": "HeapAlloc",
  453. "address": "0x4310e4"
  454. },
  455. {
  456. "name": "ExitProcess",
  457. "address": "0x4310e8"
  458. },
  459. {
  460. "name": "GetModuleHandleExW",
  461. "address": "0x4310ec"
  462. },
  463. {
  464. "name": "AreFileApisANSI",
  465. "address": "0x4310f0"
  466. },
  467. {
  468. "name": "MultiByteToWideChar",
  469. "address": "0x4310f4"
  470. },
  471. {
  472. "name": "HeapSize",
  473. "address": "0x4310f8"
  474. },
  475. {
  476. "name": "CloseHandle",
  477. "address": "0x4310fc"
  478. },
  479. {
  480. "name": "SetLastError",
  481. "address": "0x431100"
  482. },
  483. {
  484. "name": "GetCurrentThreadId",
  485. "address": "0x431104"
  486. },
  487. {
  488. "name": "GetModuleFileNameA",
  489. "address": "0x431108"
  490. },
  491. {
  492. "name": "WriteFile",
  493. "address": "0x43110c"
  494. },
  495. {
  496. "name": "GetModuleFileNameW",
  497. "address": "0x431110"
  498. },
  499. {
  500. "name": "QueryPerformanceCounter",
  501. "address": "0x431114"
  502. },
  503. {
  504. "name": "GetCurrentProcessId",
  505. "address": "0x431118"
  506. },
  507. {
  508. "name": "GetSystemTimeAsFileTime",
  509. "address": "0x43111c"
  510. },
  511. {
  512. "name": "GetEnvironmentStringsW",
  513. "address": "0x431120"
  514. },
  515. {
  516. "name": "FreeEnvironmentStringsW",
  517. "address": "0x431124"
  518. },
  519. {
  520. "name": "UnhandledExceptionFilter",
  521. "address": "0x431128"
  522. },
  523. {
  524. "name": "SetUnhandledExceptionFilter",
  525. "address": "0x43112c"
  526. },
  527. {
  528. "name": "InitializeCriticalSectionAndSpinCount",
  529. "address": "0x431130"
  530. },
  531. {
  532. "name": "CreateEventW",
  533. "address": "0x431134"
  534. },
  535. {
  536. "name": "Sleep",
  537. "address": "0x431138"
  538. },
  539. {
  540. "name": "GetCurrentProcess",
  541. "address": "0x43113c"
  542. },
  543. {
  544. "name": "TerminateProcess",
  545. "address": "0x431140"
  546. },
  547. {
  548. "name": "TlsAlloc",
  549. "address": "0x431144"
  550. },
  551. {
  552. "name": "TlsGetValue",
  553. "address": "0x431148"
  554. },
  555. {
  556. "name": "TlsSetValue",
  557. "address": "0x43114c"
  558. },
  559. {
  560. "name": "TlsFree",
  561. "address": "0x431150"
  562. },
  563. {
  564. "name": "GetTickCount",
  565. "address": "0x431154"
  566. },
  567. {
  568. "name": "CreateSemaphoreW",
  569. "address": "0x431158"
  570. },
  571. {
  572. "name": "FatalAppExitA",
  573. "address": "0x43115c"
  574. },
  575. {
  576. "name": "IsValidCodePage",
  577. "address": "0x431160"
  578. },
  579. {
  580. "name": "GetACP",
  581. "address": "0x431164"
  582. },
  583. {
  584. "name": "GetOEMCP",
  585. "address": "0x431168"
  586. },
  587. {
  588. "name": "GetCPInfo",
  589. "address": "0x43116c"
  590. },
  591. {
  592. "name": "GetConsoleCP",
  593. "address": "0x431170"
  594. },
  595. {
  596. "name": "GetConsoleMode",
  597. "address": "0x431174"
  598. },
  599. {
  600. "name": "SetFilePointerEx",
  601. "address": "0x431178"
  602. },
  603. {
  604. "name": "SetConsoleCtrlHandler",
  605. "address": "0x43117c"
  606. },
  607. {
  608. "name": "FreeLibrary",
  609. "address": "0x431180"
  610. },
  611. {
  612. "name": "LoadLibraryExW",
  613. "address": "0x431184"
  614. },
  615. {
  616. "name": "GetDateFormatW",
  617. "address": "0x431188"
  618. },
  619. {
  620. "name": "GetTimeFormatW",
  621. "address": "0x43118c"
  622. },
  623. {
  624. "name": "CompareStringW",
  625. "address": "0x431190"
  626. },
  627. {
  628. "name": "LCMapStringW",
  629. "address": "0x431194"
  630. },
  631. {
  632. "name": "GetLocaleInfoW",
  633. "address": "0x431198"
  634. },
  635. {
  636. "name": "IsValidLocale",
  637. "address": "0x43119c"
  638. },
  639. {
  640. "name": "GetUserDefaultLCID",
  641. "address": "0x4311a0"
  642. },
  643. {
  644. "name": "EnumSystemLocalesW",
  645. "address": "0x4311a4"
  646. },
  647. {
  648. "name": "SetStdHandle",
  649. "address": "0x4311a8"
  650. },
  651. {
  652. "name": "CreateFileW",
  653. "address": "0x4311ac"
  654. }
  655. ],
  656. "dll": "KERNEL32.dll"
  657. },
  658. {
  659. "imports": [
  660. {
  661. "name": "GetScrollBarInfo",
  662. "address": "0x4311b4"
  663. },
  664. {
  665. "name": "RegisterDeviceNotificationW",
  666. "address": "0x4311b8"
  667. },
  668. {
  669. "name": "RegisterClipboardFormatW",
  670. "address": "0x4311bc"
  671. },
  672. {
  673. "name": "GetMessageTime",
  674. "address": "0x4311c0"
  675. },
  676. {
  677. "name": "OemToCharW",
  678. "address": "0x4311c4"
  679. }
  680. ],
  681. "dll": "USER32.dll"
  682. }
  683. ],
  684. "digital_signers": null,
  685. "exported_dll_name": null,
  686. "actual_checksum": "0x00065404",
  687. "overlay": null,
  688. "imagebase": "0x00400000",
  689. "reported_checksum": "0x00065404",
  690. "icon_hash": null,
  691. "entrypoint": "0x00408e67",
  692. "timestamp": "2018-11-29 16:20:12",
  693. "osversion": "5.1",
  694. "sections": [
  695. {
  696. "name": ".text",
  697. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  698. "virtual_address": "0x00001000",
  699. "size_of_data": "0x0002fc00",
  700. "entropy": "6.72",
  701. "raw_address": "0x00000400",
  702. "virtual_size": "0x0002fafd",
  703. "characteristics_raw": "0x60000020"
  704. },
  705. {
  706. "name": ".rdata",
  707. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  708. "virtual_address": "0x00031000",
  709. "size_of_data": "0x00029e00",
  710. "entropy": "6.54",
  711. "raw_address": "0x00030000",
  712. "virtual_size": "0x00029da8",
  713. "characteristics_raw": "0x40000040"
  714. },
  715. {
  716. "name": ".data",
  717. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  718. "virtual_address": "0x0005b000",
  719. "size_of_data": "0x00002400",
  720. "entropy": "2.65",
  721. "raw_address": "0x00059e00",
  722. "virtual_size": "0x00014dec",
  723. "characteristics_raw": "0xc0000040"
  724. },
  725. {
  726. "name": ".rsrc",
  727. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  728. "virtual_address": "0x00070000",
  729. "size_of_data": "0x00004400",
  730. "entropy": "5.28",
  731. "raw_address": "0x0005c200",
  732. "virtual_size": "0x000043c0",
  733. "characteristics_raw": "0x40000040"
  734. },
  735. {
  736. "name": ".reloc",
  737. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  738. "virtual_address": "0x00075000",
  739. "size_of_data": "0x00002600",
  740. "entropy": "6.55",
  741. "raw_address": "0x00060600",
  742. "virtual_size": "0x00002448",
  743. "characteristics_raw": "0x42000040"
  744. }
  745. ],
  746. "resources": [],
  747. "dirents": [
  748. {
  749. "virtual_address": "0x00000000",
  750. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  751. "size": "0x00000000"
  752. },
  753. {
  754. "virtual_address": "0x0005a2fc",
  755. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  756. "size": "0x0000003c"
  757. },
  758. {
  759. "virtual_address": "0x00070000",
  760. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  761. "size": "0x000043c0"
  762. },
  763. {
  764. "virtual_address": "0x00000000",
  765. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  766. "size": "0x00000000"
  767. },
  768. {
  769. "virtual_address": "0x00000000",
  770. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  771. "size": "0x00000000"
  772. },
  773. {
  774. "virtual_address": "0x00075000",
  775. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  776. "size": "0x00002448"
  777. },
  778. {
  779. "virtual_address": "0x00031230",
  780. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  781. "size": "0x00000038"
  782. },
  783. {
  784. "virtual_address": "0x00000000",
  785. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  786. "size": "0x00000000"
  787. },
  788. {
  789. "virtual_address": "0x00000000",
  790. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  791. "size": "0x00000000"
  792. },
  793. {
  794. "virtual_address": "0x00000000",
  795. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  796. "size": "0x00000000"
  797. },
  798. {
  799. "virtual_address": "0x000590e0",
  800. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  801. "size": "0x00000040"
  802. },
  803. {
  804. "virtual_address": "0x00000000",
  805. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  806. "size": "0x00000000"
  807. },
  808. {
  809. "virtual_address": "0x00031000",
  810. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  811. "size": "0x000001cc"
  812. },
  813. {
  814. "virtual_address": "0x00000000",
  815. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  816. "size": "0x00000000"
  817. },
  818. {
  819. "virtual_address": "0x00000000",
  820. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  821. "size": "0x00000000"
  822. },
  823. {
  824. "virtual_address": "0x00000000",
  825. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  826. "size": "0x00000000"
  827. }
  828. ],
  829. "exports": [],
  830. "guest_signers": {},
  831. "imphash": "0575512908f63895e946809d86ee310d",
  832. "icon_fuzzy": null,
  833. "icon": null,
  834. "pdbpath": "C:\\liweso.pdb\\x00ypt_server\\runtime\\crypt\\tmp_1975999154\\bin\\kohafif.pdb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb9\\x00\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\xcdE\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xd0\\x91E",
  835. "imported_dll_count": 2,
  836. "versioninfo": []
  837. }
  838. }
  839.  
  840. [*] Resolved APIs: [
  841. "kernel32.dll.FlsAlloc",
  842. "kernel32.dll.FlsFree",
  843. "kernel32.dll.FlsGetValue",
  844. "kernel32.dll.FlsSetValue",
  845. "kernel32.dll.InitializeCriticalSectionEx",
  846. "kernel32.dll.CreateEventExW",
  847. "kernel32.dll.CreateSemaphoreExW",
  848. "kernel32.dll.SetThreadStackGuarantee",
  849. "kernel32.dll.CreateThreadpoolTimer",
  850. "kernel32.dll.SetThreadpoolTimer",
  851. "kernel32.dll.WaitForThreadpoolTimerCallbacks",
  852. "kernel32.dll.CloseThreadpoolTimer",
  853. "kernel32.dll.CreateThreadpoolWait",
  854. "kernel32.dll.SetThreadpoolWait",
  855. "kernel32.dll.CloseThreadpoolWait",
  856. "kernel32.dll.FlushProcessWriteBuffers",
  857. "kernel32.dll.FreeLibraryWhenCallbackReturns",
  858. "kernel32.dll.GetCurrentProcessorNumber",
  859. "kernel32.dll.GetLogicalProcessorInformation",
  860. "kernel32.dll.CreateSymbolicLinkW",
  861. "kernel32.dll.EnumSystemLocalesEx",
  862. "kernel32.dll.CompareStringEx",
  863. "kernel32.dll.GetDateFormatEx",
  864. "kernel32.dll.GetLocaleInfoEx",
  865. "kernel32.dll.GetTimeFormatEx",
  866. "kernel32.dll.GetUserDefaultLocaleName",
  867. "kernel32.dll.IsValidLocaleName",
  868. "kernel32.dll.LCMapStringEx",
  869. "kernel32.dll.GetTickCount64",
  870. "kernel32.dll.VirtualProtect",
  871. "kernel32.dll.LoadLibraryA",
  872. "kernel32.dll.VirtualAlloc",
  873. "kernel32.dll.VirtualFree",
  874. "kernel32.dll.GetVersionExA",
  875. "kernel32.dll.TerminateProcess",
  876. "kernel32.dll.ExitProcess",
  877. "kernel32.dll.SetErrorMode",
  878. "kernel32.dll.CreateMutexW",
  879. "kernel32.dll.Sleep",
  880. "kernel32.dll.GetLastError",
  881. "kernel32.dll.CloseHandle",
  882. "kernel32.dll.ReadProcessMemory",
  883. "kernel32.dll.SizeofResource",
  884. "kernel32.dll.EnumResourceNamesW",
  885. "kernel32.dll.LockResource",
  886. "kernel32.dll.LoadResource",
  887. "kernel32.dll.FindResourceW",
  888. "kernel32.dll.CreateDirectoryW",
  889. "kernel32.dll.GetModuleFileNameW",
  890. "kernel32.dll.GetFileAttributesW",
  891. "kernel32.dll.CreateProcessW",
  892. "kernel32.dll.CopyFileW",
  893. "kernel32.dll.EnterCriticalSection",
  894. "kernel32.dll.LeaveCriticalSection",
  895. "kernel32.dll.InitializeCriticalSection",
  896. "kernel32.dll.DeleteCriticalSection",
  897. "kernel32.dll.GlobalSize",
  898. "kernel32.dll.GlobalAlloc",
  899. "kernel32.dll.GlobalFree",
  900. "kernel32.dll.GlobalLock",
  901. "kernel32.dll.GetTickCount",
  902. "kernel32.dll.GlobalUnlock",
  903. "kernel32.dll.SetLastError",
  904. "kernel32.dll.WaitForMultipleObjects",
  905. "kernel32.dll.CreateEventW",
  906. "kernel32.dll.GetExitCodeThread",
  907. "kernel32.dll.SetEvent",
  908. "kernel32.dll.TerminateThread",
  909. "kernel32.dll.CreateThread",
  910. "kernel32.dll.CreateFileW",
  911. "kernel32.dll.WriteConsoleW",
  912. "kernel32.dll.SetFilePointerEx",
  913. "kernel32.dll.GetConsoleMode",
  914. "kernel32.dll.GetConsoleCP",
  915. "kernel32.dll.FlushFileBuffers",
  916. "kernel32.dll.HeapReAlloc",
  917. "kernel32.dll.HeapSize",
  918. "kernel32.dll.GetProcessHeap",
  919. "kernel32.dll.GetStringTypeW",
  920. "kernel32.dll.GetFileType",
  921. "kernel32.dll.SetStdHandle",
  922. "kernel32.dll.LCMapStringW",
  923. "kernel32.dll.FreeEnvironmentStringsW",
  924. "kernel32.dll.GetEnvironmentStringsW",
  925. "kernel32.dll.GetCommandLineW",
  926. "kernel32.dll.GetCommandLineA",
  927. "kernel32.dll.GetCPInfo",
  928. "kernel32.dll.GetOEMCP",
  929. "kernel32.dll.IsValidCodePage",
  930. "kernel32.dll.QueryPerformanceCounter",
  931. "kernel32.dll.GetCurrentProcessId",
  932. "kernel32.dll.GetCurrentThreadId",
  933. "kernel32.dll.GetSystemTimeAsFileTime",
  934. "kernel32.dll.InitializeSListHead",
  935. "kernel32.dll.IsDebuggerPresent",
  936. "kernel32.dll.UnhandledExceptionFilter",
  937. "kernel32.dll.SetUnhandledExceptionFilter",
  938. "kernel32.dll.GetStartupInfoW",
  939. "kernel32.dll.IsProcessorFeaturePresent",
  940. "kernel32.dll.GetModuleHandleW",
  941. "kernel32.dll.GetCurrentProcess",
  942. "kernel32.dll.LocalFree",
  943. "kernel32.dll.RaiseException",
  944. "kernel32.dll.RtlUnwind",
  945. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  946. "kernel32.dll.TlsAlloc",
  947. "kernel32.dll.TlsGetValue",
  948. "kernel32.dll.TlsSetValue",
  949. "kernel32.dll.TlsFree",
  950. "kernel32.dll.FreeLibrary",
  951. "kernel32.dll.GetProcAddress",
  952. "kernel32.dll.LoadLibraryExW",
  953. "kernel32.dll.GetStdHandle",
  954. "kernel32.dll.WriteFile",
  955. "kernel32.dll.GetModuleFileNameA",
  956. "kernel32.dll.MultiByteToWideChar",
  957. "kernel32.dll.WideCharToMultiByte",
  958. "kernel32.dll.GetModuleHandleExW",
  959. "kernel32.dll.GetACP",
  960. "kernel32.dll.HeapFree",
  961. "kernel32.dll.HeapAlloc",
  962. "kernel32.dll.FindClose",
  963. "kernel32.dll.FindFirstFileExA",
  964. "kernel32.dll.FindNextFileA",
  965. "user32.dll.GetMessageW",
  966. "user32.dll.DefWindowProcW",
  967. "user32.dll.DestroyWindow",
  968. "user32.dll.CreateWindowExW",
  969. "user32.dll.GetClassInfoW",
  970. "user32.dll.CloseWindow",
  971. "user32.dll.GetWindowLongW",
  972. "user32.dll.DispatchMessageW",
  973. "user32.dll.RegisterClassW",
  974. "user32.dll.TranslateMessage",
  975. "user32.dll.RemoveClipboardFormatListener",
  976. "user32.dll.SetWindowLongW",
  977. "user32.dll.AddClipboardFormatListener",
  978. "user32.dll.OpenClipboard",
  979. "user32.dll.CloseClipboard",
  980. "user32.dll.EmptyClipboard",
  981. "user32.dll.GetClipboardData",
  982. "user32.dll.SetClipboardData",
  983. "user32.dll.IsClipboardFormatAvailable",
  984. "user32.dll.GetKeyboardLayoutList",
  985. "user32.dll.IsWindow",
  986. "shell32.dll.SHGetSpecialFolderPathW",
  987. "ole32.dll.CoInitializeEx",
  988. "ole32.dll.CoCreateInstance",
  989. "ole32.dll.CoUninitialize",
  990. "oleaut32.dll.#8",
  991. "oleaut32.dll.#6",
  992. "oleaut32.dll.#2",
  993. "msvcr100.dll.atexit",
  994. "cryptbase.dll.SystemFunction036",
  995. "ole32.dll.CoTaskMemAlloc",
  996. "propsys.dll.PSCreateMemoryPropertyStore",
  997. "ole32.dll.CoGetApartmentType",
  998. "comctl32.dll.#236",
  999. "ole32.dll.CoGetMalloc",
  1000. "ole32.dll.CreateBindCtx",
  1001. "comctl32.dll.#320",
  1002. "comctl32.dll.#324",
  1003. "comctl32.dll.#323",
  1004. "comctl32.dll.#388",
  1005. "comctl32.dll.#328",
  1006. "comctl32.dll.#334",
  1007. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  1008. "advapi32.dll.RegEnumKeyW",
  1009. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  1010. "advapi32.dll.InitializeSecurityDescriptor",
  1011. "advapi32.dll.SetEntriesInAclW",
  1012. "comctl32.dll.#332",
  1013. "ntmarta.dll.GetMartaExtensionInterface",
  1014. "advapi32.dll.SetSecurityDescriptorDacl",
  1015. "advapi32.dll.IsTextUnicode",
  1016. "comctl32.dll.#338",
  1017. "comctl32.dll.#386",
  1018. "comctl32.dll.#339",
  1019. "shell32.dll.#102",
  1020. "sechost.dll.ConvertSidToStringSidW",
  1021. "profapi.dll.#104",
  1022. "ole32.dll.PropVariantClear",
  1023. "oleaut32.dll.#9",
  1024. "ole32.dll.CoTaskMemFree",
  1025. "advapi32.dll.RegQueryValueW",
  1026. "apphelp.dll.ApphelpCheckShellObject",
  1027. "linkinfo.dll.CreateLinkInfoW",
  1028. "user32.dll.IsCharAlphaW",
  1029. "user32.dll.CharPrevW",
  1030. "ntshrui.dll.GetNetResourceFromLocalPathW",
  1031. "srvcli.dll.NetShareEnum",
  1032. "cscapi.dll.CscNetApiGetInterface",
  1033. "slc.dll.SLGetWindowsInformationDWORD",
  1034. "shlwapi.dll.PathRemoveFileSpecW",
  1035. "linkinfo.dll.DestroyLinkInfo",
  1036. "ole32.dll.NdrOleInitializeExtension",
  1037. "ole32.dll.CoGetClassObject",
  1038. "ole32.dll.CoGetMarshalSizeMax",
  1039. "ole32.dll.CoMarshalInterface",
  1040. "ole32.dll.CoUnmarshalInterface",
  1041. "ole32.dll.StringFromIID",
  1042. "ole32.dll.CoGetPSClsid",
  1043. "ole32.dll.CoReleaseMarshalData",
  1044. "ole32.dll.DcomChannelSetHResult",
  1045. "oleaut32.dll.#500",
  1046. "sspicli.dll.GetUserNameExW",
  1047. "xmllite.dll.CreateXmlWriter",
  1048. "xmllite.dll.CreateXmlWriterOutputWithEncodingName",
  1049. "netutils.dll.NetApiBufferFree",
  1050. "advapi32.dll.UnregisterTraceGuids",
  1051. "advapi32.dll.WmiMofEnumerateResourcesW",
  1052. "advapi32.dll.WmiFreeBuffer",
  1053. "advapi32.dll.WmiCloseBlock",
  1054. "propsys.dll.PropVariantToVariant",
  1055. "wbemcore.dll.Shutdown",
  1056. "sechost.dll.OpenSCManagerW",
  1057. "sechost.dll.OpenServiceW",
  1058. "sechost.dll.QueryServiceStatus",
  1059. "rasapi32.dll.RasEnumConnectionsW",
  1060. "rasapi32.dll.RasConnectionNotificationW",
  1061. "uxtheme.dll.ThemeInitApiHook",
  1062. "user32.dll.IsProcessDPIAware",
  1063. "sechost.dll.LookupAccountNameLocalW",
  1064. "advapi32.dll.LookupAccountSidW",
  1065. "sechost.dll.LookupAccountSidLocalW",
  1066. "kernel32.dll.GetThreadPreferredUILanguages",
  1067. "kernel32.dll.SetThreadPreferredUILanguages",
  1068. "kernel32.dll.LocaleNameToLCID",
  1069. "kernel32.dll.LCIDToLocaleName",
  1070. "kernel32.dll.GetSystemDefaultLocaleName",
  1071. "fastprox.dll.DllGetClassObject",
  1072. "fastprox.dll.DllCanUnloadNow",
  1073. "oleaut32.dll.#283",
  1074. "oleaut32.dll.#284",
  1075. "kernel32.dll.RegOpenKeyExW",
  1076. "psapi.dll.EnumProcesses",
  1077. "psapi.dll.EnumProcessModules",
  1078. "psapi.dll.GetModuleBaseNameW",
  1079. "ntdll.dll.NtQuerySystemInformation",
  1080. "vssapi.dll.CreateWriter",
  1081. "advapi32.dll.LookupAccountNameW",
  1082. "samcli.dll.NetLocalGroupGetMembers",
  1083. "samlib.dll.SamConnect",
  1084. "rpcrt4.dll.NdrClientCall3",
  1085. "rpcrt4.dll.RpcStringBindingComposeW",
  1086. "rpcrt4.dll.RpcBindingFromStringBindingW",
  1087. "rpcrt4.dll.RpcStringFreeW",
  1088. "rpcrt4.dll.RpcBindingFree",
  1089. "samlib.dll.SamOpenDomain",
  1090. "samlib.dll.SamLookupNamesInDomain",
  1091. "samlib.dll.SamOpenAlias",
  1092. "samlib.dll.SamFreeMemory",
  1093. "samlib.dll.SamCloseHandle",
  1094. "samlib.dll.SamGetMembersInAlias",
  1095. "samlib.dll.SamEnumerateDomainsInSamServer",
  1096. "samlib.dll.SamLookupDomainInSamServer",
  1097. "ole32.dll.CoCreateGuid",
  1098. "ole32.dll.StringFromCLSID",
  1099. "oleaut32.dll.#4",
  1100. "oleaut32.dll.#7",
  1101. "propsys.dll.VariantToPropVariant",
  1102. "wbemcore.dll.Reinitialize",
  1103. "wbemsvc.dll.DllGetClassObject",
  1104. "wbemsvc.dll.DllCanUnloadNow",
  1105. "authz.dll.AuthzInitializeContextFromToken",
  1106. "authz.dll.AuthzInitializeObjectAccessAuditEvent2",
  1107. "authz.dll.AuthzAccessCheck",
  1108. "authz.dll.AuthzFreeAuditEvent",
  1109. "authz.dll.AuthzFreeContext",
  1110. "authz.dll.AuthzInitializeResourceManager",
  1111. "authz.dll.AuthzFreeResourceManager",
  1112. "rpcrt4.dll.RpcBindingCreateW",
  1113. "rpcrt4.dll.RpcBindingBind",
  1114. "rpcrt4.dll.I_RpcMapWin32Status",
  1115. "advapi32.dll.EventRegister",
  1116. "advapi32.dll.EventUnregister",
  1117. "advapi32.dll.EventWrite",
  1118. "kernel32.dll.RegCloseKey",
  1119. "kernel32.dll.RegSetValueExW",
  1120. "kernel32.dll.RegQueryValueExW",
  1121. "wmisvc.dll.IsImproperShutdownDetected",
  1122. "wevtapi.dll.EvtRender",
  1123. "wevtapi.dll.EvtNext",
  1124. "wevtapi.dll.EvtClose",
  1125. "wevtapi.dll.EvtQuery",
  1126. "wevtapi.dll.EvtCreateRenderContext",
  1127. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  1128. "rpcrt4.dll.RpcBindingSetOption",
  1129. "ole32.dll.CoCreateFreeThreadedMarshaler",
  1130. "ole32.dll.CreateStreamOnHGlobal",
  1131. "advapi32.dll.RegCreateKeyExW",
  1132. "advapi32.dll.RegSetValueExW",
  1133. "cryptsp.dll.CryptAcquireContextW",
  1134. "cryptsp.dll.CryptGenRandom",
  1135. "cryptsp.dll.CryptReleaseContext",
  1136. "kernelbase.dll.InitializeAcl",
  1137. "kernelbase.dll.AddAce",
  1138. "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  1139. "kernel32.dll.IsThreadAFiber",
  1140. "advapi32.dll.InitiateSystemShutdownExW",
  1141. "ole32.dll.CoInitializeSecurity",
  1142. "kernel32.dll.SortGetHandle",
  1143. "kernel32.dll.SortCloseHandle",
  1144. "wmisvc.dll.ServiceMain",
  1145. "sechost.dll.RegisterServiceCtrlHandlerExW",
  1146. "sechost.dll.SetServiceStatus",
  1147. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  1148. "advapi32.dll.RegisterEventSourceW",
  1149. "advapi32.dll.ReportEventW",
  1150. "advapi32.dll.DeregisterEventSource",
  1151. "advapi32.dll.WmiOpenBlock",
  1152. "kernel32.dll.OpenProcessToken",
  1153. "kernelbase.dll.GetTokenInformation",
  1154. "kernelbase.dll.DuplicateTokenEx",
  1155. "kernelbase.dll.AdjustTokenPrivileges",
  1156. "kernelbase.dll.AllocateAndInitializeSid",
  1157. "kernelbase.dll.CheckTokenMembership",
  1158. "oleaut32.dll.#285",
  1159. "advapi32.dll.RegOpenKeyW",
  1160. "kernel32.dll.SetThreadToken",
  1161. "ole32.dll.CLSIDFromString",
  1162. "oleaut32.dll.#17",
  1163. "oleaut32.dll.#20",
  1164. "oleaut32.dll.#19",
  1165. "oleaut32.dll.#25",
  1166. "oleaut32.dll.#286",
  1167. "authz.dll.AuthzInitializeContextFromSid",
  1168. "ole32.dll.CoGetCallContext",
  1169. "ole32.dll.CoImpersonateClient",
  1170. "advapi32.dll.OpenThreadToken",
  1171. "ole32.dll.CoRevertToSelf",
  1172. "ole32.dll.CoSwitchCallContext",
  1173. "ntdll.dll.EtwUnregisterTraceGuids",
  1174. "dwmapi.dll.DwmIsCompositionEnabled",
  1175. "rpcrt4.dll.UuidFromStringW",
  1176. "radarrs.dll.WdiDiagnosticModuleMain",
  1177. "radarrs.dll.WdiHandleInstance",
  1178. "radarrs.dll.WdiGetDiagnosticModuleInterfaceVersion",
  1179. "advapi32.dll.CryptAcquireContextW",
  1180. "shlwapi.dll.PathIsDirectoryW",
  1181. "advapi32.dll.RegQueryValueExW",
  1182. "advapi32.dll.RegNotifyChangeKeyValue"
  1183. ]
  1184.  
  1185. [*] Static Analysis: {
  1186. "pe": {
  1187. "peid_signatures": null,
  1188. "imports": [
  1189. {
  1190. "imports": [
  1191. {
  1192. "name": "HeapReAlloc",
  1193. "address": "0x431000"
  1194. },
  1195. {
  1196. "name": "GetNativeSystemInfo",
  1197. "address": "0x431004"
  1198. },
  1199. {
  1200. "name": "GetDriveTypeW",
  1201. "address": "0x431008"
  1202. },
  1203. {
  1204. "name": "GetProfileIntW",
  1205. "address": "0x43100c"
  1206. },
  1207. {
  1208. "name": "WaitForSingleObject",
  1209. "address": "0x431010"
  1210. },
  1211. {
  1212. "name": "SetTapeParameters",
  1213. "address": "0x431014"
  1214. },
  1215. {
  1216. "name": "GetModuleHandleW",
  1217. "address": "0x431018"
  1218. },
  1219. {
  1220. "name": "GetCurrentThread",
  1221. "address": "0x43101c"
  1222. },
  1223. {
  1224. "name": "ExpandEnvironmentStringsA",
  1225. "address": "0x431020"
  1226. },
  1227. {
  1228. "name": "FormatMessageA",
  1229. "address": "0x431024"
  1230. },
  1231. {
  1232. "name": "WaitNamedPipeW",
  1233. "address": "0x431028"
  1234. },
  1235. {
  1236. "name": "EnumTimeFormatsA",
  1237. "address": "0x43102c"
  1238. },
  1239. {
  1240. "name": "GetSystemDirectoryW",
  1241. "address": "0x431030"
  1242. },
  1243. {
  1244. "name": "WideCharToMultiByte",
  1245. "address": "0x431034"
  1246. },
  1247. {
  1248. "name": "LoadLibraryW",
  1249. "address": "0x431038"
  1250. },
  1251. {
  1252. "name": "FormatMessageW",
  1253. "address": "0x43103c"
  1254. },
  1255. {
  1256. "name": "GetStringTypeExW",
  1257. "address": "0x431040"
  1258. },
  1259. {
  1260. "name": "LeaveCriticalSection",
  1261. "address": "0x431044"
  1262. },
  1263. {
  1264. "name": "CreateMailslotW",
  1265. "address": "0x431048"
  1266. },
  1267. {
  1268. "name": "WritePrivateProfileStringW",
  1269. "address": "0x43104c"
  1270. },
  1271. {
  1272. "name": "ReplaceFileA",
  1273. "address": "0x431050"
  1274. },
  1275. {
  1276. "name": "EnumSystemLocalesA",
  1277. "address": "0x431054"
  1278. },
  1279. {
  1280. "name": "GetLastError",
  1281. "address": "0x431058"
  1282. },
  1283. {
  1284. "name": "GetLongPathNameW",
  1285. "address": "0x43105c"
  1286. },
  1287. {
  1288. "name": "GetProcAddress",
  1289. "address": "0x431060"
  1290. },
  1291. {
  1292. "name": "MoveFileW",
  1293. "address": "0x431064"
  1294. },
  1295. {
  1296. "name": "GetFirmwareEnvironmentVariableW",
  1297. "address": "0x431068"
  1298. },
  1299. {
  1300. "name": "DefineDosDeviceA",
  1301. "address": "0x43106c"
  1302. },
  1303. {
  1304. "name": "LocalAlloc",
  1305. "address": "0x431070"
  1306. },
  1307. {
  1308. "name": "FindFirstVolumeMountPointW",
  1309. "address": "0x431074"
  1310. },
  1311. {
  1312. "name": "GetProfileStringA",
  1313. "address": "0x431078"
  1314. },
  1315. {
  1316. "name": "HeapLock",
  1317. "address": "0x43107c"
  1318. },
  1319. {
  1320. "name": "WaitForMultipleObjects",
  1321. "address": "0x431080"
  1322. },
  1323. {
  1324. "name": "GetVolumePathNamesForVolumeNameA",
  1325. "address": "0x431084"
  1326. },
  1327. {
  1328. "name": "GetDefaultCommConfigA",
  1329. "address": "0x431088"
  1330. },
  1331. {
  1332. "name": "DeleteCriticalSection",
  1333. "address": "0x43108c"
  1334. },
  1335. {
  1336. "name": "WriteConsoleOutputAttribute",
  1337. "address": "0x431090"
  1338. },
  1339. {
  1340. "name": "MoveFileWithProgressW",
  1341. "address": "0x431094"
  1342. },
  1343. {
  1344. "name": "WriteConsoleW",
  1345. "address": "0x431098"
  1346. },
  1347. {
  1348. "name": "GetStringTypeW",
  1349. "address": "0x43109c"
  1350. },
  1351. {
  1352. "name": "ReadConsoleW",
  1353. "address": "0x4310a0"
  1354. },
  1355. {
  1356. "name": "ReadFile",
  1357. "address": "0x4310a4"
  1358. },
  1359. {
  1360. "name": "OutputDebugStringW",
  1361. "address": "0x4310a8"
  1362. },
  1363. {
  1364. "name": "FlushFileBuffers",
  1365. "address": "0x4310ac"
  1366. },
  1367. {
  1368. "name": "HeapFree",
  1369. "address": "0x4310b0"
  1370. },
  1371. {
  1372. "name": "EncodePointer",
  1373. "address": "0x4310b4"
  1374. },
  1375. {
  1376. "name": "DecodePointer",
  1377. "address": "0x4310b8"
  1378. },
  1379. {
  1380. "name": "GetCommandLineA",
  1381. "address": "0x4310bc"
  1382. },
  1383. {
  1384. "name": "RaiseException",
  1385. "address": "0x4310c0"
  1386. },
  1387. {
  1388. "name": "RtlUnwind",
  1389. "address": "0x4310c4"
  1390. },
  1391. {
  1392. "name": "IsDebuggerPresent",
  1393. "address": "0x4310c8"
  1394. },
  1395. {
  1396. "name": "IsProcessorFeaturePresent",
  1397. "address": "0x4310cc"
  1398. },
  1399. {
  1400. "name": "EnterCriticalSection",
  1401. "address": "0x4310d0"
  1402. },
  1403. {
  1404. "name": "GetStdHandle",
  1405. "address": "0x4310d4"
  1406. },
  1407. {
  1408. "name": "GetFileType",
  1409. "address": "0x4310d8"
  1410. },
  1411. {
  1412. "name": "GetStartupInfoW",
  1413. "address": "0x4310dc"
  1414. },
  1415. {
  1416. "name": "GetProcessHeap",
  1417. "address": "0x4310e0"
  1418. },
  1419. {
  1420. "name": "HeapAlloc",
  1421. "address": "0x4310e4"
  1422. },
  1423. {
  1424. "name": "ExitProcess",
  1425. "address": "0x4310e8"
  1426. },
  1427. {
  1428. "name": "GetModuleHandleExW",
  1429. "address": "0x4310ec"
  1430. },
  1431. {
  1432. "name": "AreFileApisANSI",
  1433. "address": "0x4310f0"
  1434. },
  1435. {
  1436. "name": "MultiByteToWideChar",
  1437. "address": "0x4310f4"
  1438. },
  1439. {
  1440. "name": "HeapSize",
  1441. "address": "0x4310f8"
  1442. },
  1443. {
  1444. "name": "CloseHandle",
  1445. "address": "0x4310fc"
  1446. },
  1447. {
  1448. "name": "SetLastError",
  1449. "address": "0x431100"
  1450. },
  1451. {
  1452. "name": "GetCurrentThreadId",
  1453. "address": "0x431104"
  1454. },
  1455. {
  1456. "name": "GetModuleFileNameA",
  1457. "address": "0x431108"
  1458. },
  1459. {
  1460. "name": "WriteFile",
  1461. "address": "0x43110c"
  1462. },
  1463. {
  1464. "name": "GetModuleFileNameW",
  1465. "address": "0x431110"
  1466. },
  1467. {
  1468. "name": "QueryPerformanceCounter",
  1469. "address": "0x431114"
  1470. },
  1471. {
  1472. "name": "GetCurrentProcessId",
  1473. "address": "0x431118"
  1474. },
  1475. {
  1476. "name": "GetSystemTimeAsFileTime",
  1477. "address": "0x43111c"
  1478. },
  1479. {
  1480. "name": "GetEnvironmentStringsW",
  1481. "address": "0x431120"
  1482. },
  1483. {
  1484. "name": "FreeEnvironmentStringsW",
  1485. "address": "0x431124"
  1486. },
  1487. {
  1488. "name": "UnhandledExceptionFilter",
  1489. "address": "0x431128"
  1490. },
  1491. {
  1492. "name": "SetUnhandledExceptionFilter",
  1493. "address": "0x43112c"
  1494. },
  1495. {
  1496. "name": "InitializeCriticalSectionAndSpinCount",
  1497. "address": "0x431130"
  1498. },
  1499. {
  1500. "name": "CreateEventW",
  1501. "address": "0x431134"
  1502. },
  1503. {
  1504. "name": "Sleep",
  1505. "address": "0x431138"
  1506. },
  1507. {
  1508. "name": "GetCurrentProcess",
  1509. "address": "0x43113c"
  1510. },
  1511. {
  1512. "name": "TerminateProcess",
  1513. "address": "0x431140"
  1514. },
  1515. {
  1516. "name": "TlsAlloc",
  1517. "address": "0x431144"
  1518. },
  1519. {
  1520. "name": "TlsGetValue",
  1521. "address": "0x431148"
  1522. },
  1523. {
  1524. "name": "TlsSetValue",
  1525. "address": "0x43114c"
  1526. },
  1527. {
  1528. "name": "TlsFree",
  1529. "address": "0x431150"
  1530. },
  1531. {
  1532. "name": "GetTickCount",
  1533. "address": "0x431154"
  1534. },
  1535. {
  1536. "name": "CreateSemaphoreW",
  1537. "address": "0x431158"
  1538. },
  1539. {
  1540. "name": "FatalAppExitA",
  1541. "address": "0x43115c"
  1542. },
  1543. {
  1544. "name": "IsValidCodePage",
  1545. "address": "0x431160"
  1546. },
  1547. {
  1548. "name": "GetACP",
  1549. "address": "0x431164"
  1550. },
  1551. {
  1552. "name": "GetOEMCP",
  1553. "address": "0x431168"
  1554. },
  1555. {
  1556. "name": "GetCPInfo",
  1557. "address": "0x43116c"
  1558. },
  1559. {
  1560. "name": "GetConsoleCP",
  1561. "address": "0x431170"
  1562. },
  1563. {
  1564. "name": "GetConsoleMode",
  1565. "address": "0x431174"
  1566. },
  1567. {
  1568. "name": "SetFilePointerEx",
  1569. "address": "0x431178"
  1570. },
  1571. {
  1572. "name": "SetConsoleCtrlHandler",
  1573. "address": "0x43117c"
  1574. },
  1575. {
  1576. "name": "FreeLibrary",
  1577. "address": "0x431180"
  1578. },
  1579. {
  1580. "name": "LoadLibraryExW",
  1581. "address": "0x431184"
  1582. },
  1583. {
  1584. "name": "GetDateFormatW",
  1585. "address": "0x431188"
  1586. },
  1587. {
  1588. "name": "GetTimeFormatW",
  1589. "address": "0x43118c"
  1590. },
  1591. {
  1592. "name": "CompareStringW",
  1593. "address": "0x431190"
  1594. },
  1595. {
  1596. "name": "LCMapStringW",
  1597. "address": "0x431194"
  1598. },
  1599. {
  1600. "name": "GetLocaleInfoW",
  1601. "address": "0x431198"
  1602. },
  1603. {
  1604. "name": "IsValidLocale",
  1605. "address": "0x43119c"
  1606. },
  1607. {
  1608. "name": "GetUserDefaultLCID",
  1609. "address": "0x4311a0"
  1610. },
  1611. {
  1612. "name": "EnumSystemLocalesW",
  1613. "address": "0x4311a4"
  1614. },
  1615. {
  1616. "name": "SetStdHandle",
  1617. "address": "0x4311a8"
  1618. },
  1619. {
  1620. "name": "CreateFileW",
  1621. "address": "0x4311ac"
  1622. }
  1623. ],
  1624. "dll": "KERNEL32.dll"
  1625. },
  1626. {
  1627. "imports": [
  1628. {
  1629. "name": "GetScrollBarInfo",
  1630. "address": "0x4311b4"
  1631. },
  1632. {
  1633. "name": "RegisterDeviceNotificationW",
  1634. "address": "0x4311b8"
  1635. },
  1636. {
  1637. "name": "RegisterClipboardFormatW",
  1638. "address": "0x4311bc"
  1639. },
  1640. {
  1641. "name": "GetMessageTime",
  1642. "address": "0x4311c0"
  1643. },
  1644. {
  1645. "name": "OemToCharW",
  1646. "address": "0x4311c4"
  1647. }
  1648. ],
  1649. "dll": "USER32.dll"
  1650. }
  1651. ],
  1652. "digital_signers": null,
  1653. "exported_dll_name": null,
  1654. "actual_checksum": "0x00065404",
  1655. "overlay": null,
  1656. "imagebase": "0x00400000",
  1657. "reported_checksum": "0x00065404",
  1658. "icon_hash": null,
  1659. "entrypoint": "0x00408e67",
  1660. "timestamp": "2018-11-29 16:20:12",
  1661. "osversion": "5.1",
  1662. "sections": [
  1663. {
  1664. "name": ".text",
  1665. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1666. "virtual_address": "0x00001000",
  1667. "size_of_data": "0x0002fc00",
  1668. "entropy": "6.72",
  1669. "raw_address": "0x00000400",
  1670. "virtual_size": "0x0002fafd",
  1671. "characteristics_raw": "0x60000020"
  1672. },
  1673. {
  1674. "name": ".rdata",
  1675. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1676. "virtual_address": "0x00031000",
  1677. "size_of_data": "0x00029e00",
  1678. "entropy": "6.54",
  1679. "raw_address": "0x00030000",
  1680. "virtual_size": "0x00029da8",
  1681. "characteristics_raw": "0x40000040"
  1682. },
  1683. {
  1684. "name": ".data",
  1685. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1686. "virtual_address": "0x0005b000",
  1687. "size_of_data": "0x00002400",
  1688. "entropy": "2.65",
  1689. "raw_address": "0x00059e00",
  1690. "virtual_size": "0x00014dec",
  1691. "characteristics_raw": "0xc0000040"
  1692. },
  1693. {
  1694. "name": ".rsrc",
  1695. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1696. "virtual_address": "0x00070000",
  1697. "size_of_data": "0x00004400",
  1698. "entropy": "5.28",
  1699. "raw_address": "0x0005c200",
  1700. "virtual_size": "0x000043c0",
  1701. "characteristics_raw": "0x40000040"
  1702. },
  1703. {
  1704. "name": ".reloc",
  1705. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1706. "virtual_address": "0x00075000",
  1707. "size_of_data": "0x00002600",
  1708. "entropy": "6.55",
  1709. "raw_address": "0x00060600",
  1710. "virtual_size": "0x00002448",
  1711. "characteristics_raw": "0x42000040"
  1712. }
  1713. ],
  1714. "resources": [],
  1715. "dirents": [
  1716. {
  1717. "virtual_address": "0x00000000",
  1718. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1719. "size": "0x00000000"
  1720. },
  1721. {
  1722. "virtual_address": "0x0005a2fc",
  1723. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1724. "size": "0x0000003c"
  1725. },
  1726. {
  1727. "virtual_address": "0x00070000",
  1728. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1729. "size": "0x000043c0"
  1730. },
  1731. {
  1732. "virtual_address": "0x00000000",
  1733. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1734. "size": "0x00000000"
  1735. },
  1736. {
  1737. "virtual_address": "0x00000000",
  1738. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1739. "size": "0x00000000"
  1740. },
  1741. {
  1742. "virtual_address": "0x00075000",
  1743. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1744. "size": "0x00002448"
  1745. },
  1746. {
  1747. "virtual_address": "0x00031230",
  1748. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1749. "size": "0x00000038"
  1750. },
  1751. {
  1752. "virtual_address": "0x00000000",
  1753. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1754. "size": "0x00000000"
  1755. },
  1756. {
  1757. "virtual_address": "0x00000000",
  1758. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1759. "size": "0x00000000"
  1760. },
  1761. {
  1762. "virtual_address": "0x00000000",
  1763. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1764. "size": "0x00000000"
  1765. },
  1766. {
  1767. "virtual_address": "0x000590e0",
  1768. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1769. "size": "0x00000040"
  1770. },
  1771. {
  1772. "virtual_address": "0x00000000",
  1773. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1774. "size": "0x00000000"
  1775. },
  1776. {
  1777. "virtual_address": "0x00031000",
  1778. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1779. "size": "0x000001cc"
  1780. },
  1781. {
  1782. "virtual_address": "0x00000000",
  1783. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1784. "size": "0x00000000"
  1785. },
  1786. {
  1787. "virtual_address": "0x00000000",
  1788. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1789. "size": "0x00000000"
  1790. },
  1791. {
  1792. "virtual_address": "0x00000000",
  1793. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1794. "size": "0x00000000"
  1795. }
  1796. ],
  1797. "exports": [],
  1798. "guest_signers": {},
  1799. "imphash": "0575512908f63895e946809d86ee310d",
  1800. "icon_fuzzy": null,
  1801. "icon": null,
  1802. "pdbpath": "C:\\liweso.pdb\\x00ypt_server\\runtime\\crypt\\tmp_1975999154\\bin\\kohafif.pdb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb9\\x00\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\xcdE\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xd0\\x91E",
  1803. "imported_dll_count": 2,
  1804. "versioninfo": []
  1805. }
  1806. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!