API tools faq
paste
paladin316

Exes_ccf5b663061e7e2755f8eed37e49b732_exe_2019-07-03_06_30.json

paladin316
Jul 3rd, 2019
2,101
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 109.76 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_ccf5b663061e7e2755f8eed37e49b732.exe"
  7. [*] File Size: 5427200
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
  9. [*] SHA256: "f9a972757cd0d8a837eb30f6a28bc9b5e2a6674825b18359648c50bbb7d6d74a"
  10. [*] MD5: "ccf5b663061e7e2755f8eed37e49b732"
  11. [*] SHA1: "6176da306c6557a27641d34047d82f40cddf5cf7"
  12. [*] SHA512: "0a14cdad86888ca7fe977ff88a3e9315da5866f8330af8282aa9bdd49ad75bde4ed08b87b089cce48a6862f33be4f819289216af315176e5f25cd6c4cc229198"
  13. [*] CRC32: "15289F93"
  14. [*] SSDEEP: "98304:1dLG+QUvfklNE8lHIMVpboQuiA0qhKLgfGKPsvXFshyNvjxE77K5kMn/Gead8h5n:fG+QVe9jhKLgfGKcNFi+7nH4P0QzRAen"
  15.  
  16. [*] Process Execution: [
  17. "Exes_ccf5b663061e7e2755f8eed37e49b732.exe",
  18. "cmd.exe",
  19. "PING.EXE",
  20. "updelle.exe",
  21. "services.exe",
  22. "updelle.exe",
  23. "cmd.exe",
  24. "cmd.exe",
  25. "cacls.exe",
  26. "cmd.exe",
  27. "cacls.exe",
  28. "cmd.exe",
  29. "cacls.exe",
  30. "netsh.exe",
  31. "netsh.exe",
  32. "netsh.exe",
  33. "cmd.exe",
  34. "wpcap.exe",
  35. "net.exe",
  36. "net1.exe",
  37. "net.exe",
  38. "net1.exe",
  39. "net.exe",
  40. "net1.exe",
  41. "net.exe",
  42. "net1.exe",
  43. "cmd.exe",
  44. "net.exe",
  45. "net1.exe",
  46. "cmd.exe",
  47. "ubsbsgiep.exe",
  48. "svchost.exe",
  49. "taskhost.exe",
  50. "svchost.exe",
  51. "WerFault.exe"
  52. ]
  53.  
  54. [*] Signatures Detected: [
  55. {
  56. "Description": "At least one process apparently crashed during execution",
  57. "Details": []
  58. },
  59. {
  60. "Description": "Possible date expiration check, exits too soon after checking local time",
  61. "Details": [
  62. {
  63. "process": "cmd.exe, PID 1920"
  64. }
  65. ]
  66. },
  67. {
  68. "Description": "Creates RWX memory",
  69. "Details": []
  70. },
  71. {
  72. "Description": "Loads a driver",
  73. "Details": [
  74. {
  75. "driver service name": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\npf"
  76. }
  77. ]
  78. },
  79. {
  80. "Description": "Expresses interest in specific running processes",
  81. "Details": [
  82. {
  83. "process": "csrss.exe"
  84. }
  85. ]
  86. },
  87. {
  88. "Description": "Repeatedly searches for a not-found process, may want to run with startbrowser=1 option",
  89. "Details": []
  90. },
  91. {
  92. "Description": "Reads data out of its own binary image",
  93. "Details": [
  94. {
  95. "self_read": "process: wpcap.exe, pid: 2192, offset: 0x00000000, length: 0x0000c000"
  96. },
  97. {
  98. "self_read": "process: wpcap.exe, pid: 2192, offset: 0x00000000, length: 0x0006a139"
  99. },
  100. {
  101. "self_read": "process: wpcap.exe, pid: 2192, offset: 0x0000c01c, length: 0x0005e121"
  102. }
  103. ]
  104. },
  105. {
  106. "Description": "Drops a binary and executes it",
  107. "Details": [
  108. {
  109. "binary": "C:\\Windows\\kyiguqful\\gqalzrrnl\\ubsbsgiep.exe"
  110. },
  111. {
  112. "binary": "C:\\Windows\\tbftqpep\\updelle.exe"
  113. },
  114. {
  115. "binary": "C:\\Windows\\kyiguqful\\gqalzrrnl\\wpcap.exe"
  116. }
  117. ]
  118. },
  119. {
  120. "Description": "Performs some HTTP requests",
  121. "Details": [
  122. {
  123. "url": "http://uio.hognoob.se:63145/cfg.ini"
  124. }
  125. ]
  126. },
  127. {
  128. "Description": "The binary likely contains encrypted or compressed data.",
  129. "Details": [
  130. {
  131. "section": "name: UPX1, entropy: 7.82, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0052c800, virtual_size: 0x0052d000"
  132. }
  133. ]
  134. },
  135. {
  136. "Description": "The executable is compressed using UPX",
  137. "Details": [
  138. {
  139. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x00170000"
  140. }
  141. ]
  142. },
  143. {
  144. "Description": "Deletes its original binary from disk",
  145. "Details": []
  146. },
  147. {
  148. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  149. "Details": [
  150. {
  151. "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 12715671 times"
  152. }
  153. ]
  154. },
  155. {
  156. "Description": "Mimics the file times of a Windows system file",
  157. "Details": [
  158. {
  159. "mimic_dest": "C:\\Program Files\\WinPcap\\LICENSE",
  160. "mimic_source": "C:\\Windows\\Temp\\nsdE821.tmp\\options.ini"
  161. },
  162. {
  163. "mimic_dest": "C:\\Program Files\\WinPcap\\rpcapd.exe",
  164. "mimic_source": "C:\\Windows\\Temp\\nsdE821.tmp\\options.ini"
  165. }
  166. ]
  167. },
  168. {
  169. "Description": "Installs itself for autorun at Windows startup",
  170. "Details": [
  171. {
  172. "service name": "uzlatehyk"
  173. },
  174. {
  175. "service path": "C:\\Windows\\tbftqpep\\updelle.exe"
  176. },
  177. {
  178. "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\npf\\ImagePath"
  179. },
  180. {
  181. "data": "system32\\drivers\\npf.sys"
  182. }
  183. ]
  184. },
  185. {
  186. "Description": "File has been identified by 47 Antiviruses on VirusTotal as malicious",
  187. "Details": [
  188. {
  189. "MicroWorld-eScan": "Generic.Backdoor.Torr.94C32930"
  190. },
  191. {
  192. "CAT-QuickHeal": "Trojanpws.Qqpass.16543"
  193. },
  194. {
  195. "ALYac": "Generic.Backdoor.Torr.94C32930"
  196. },
  197. {
  198. "Malwarebytes": "Trojan.BitCoinMiner"
  199. },
  200. {
  201. "AegisLab": "Trojan.Multi.Generic.lpKS"
  202. },
  203. {
  204. "Alibaba": "VirTool:Win32/CeeInject.84035381"
  205. },
  206. {
  207. "Arcabit": "Generic.Backdoor.Torr.94C32930"
  208. },
  209. {
  210. "F-Prot": "W32/Trojan.CLL.gen!Eldorado"
  211. },
  212. {
  213. "Symantec": "Hacktool.Mimikatz"
  214. },
  215. {
  216. "APEX": "Malicious"
  217. },
  218. {
  219. "ClamAV": "Win.Exploit.EQGRP-6322722-0"
  220. },
  221. {
  222. "Kaspersky": "HEUR:Exploit.Win32.MS17-010.gen"
  223. },
  224. {
  225. "BitDefender": "Generic.Backdoor.Torr.94C32930"
  226. },
  227. {
  228. "Avast": "Win32:Malware-gen"
  229. },
  230. {
  231. "Ad-Aware": "Generic.Backdoor.Torr.94C32930"
  232. },
  233. {
  234. "Emsisoft": "Generic.Backdoor.Torr.94C32930 (B)"
  235. },
  236. {
  237. "Comodo": "Packed.Win32.MUPX.Gen@24tbus"
  238. },
  239. {
  240. "DrWeb": "Trojan.Equation.77"
  241. },
  242. {
  243. "TrendMicro": "TROJ_GEN.R002C0DG219"
  244. },
  245. {
  246. "McAfee-GW-Edition": "BehavesLike.Win32.Trojan.tc"
  247. },
  248. {
  249. "Trapmine": "malicious.high.ml.score"
  250. },
  251. {
  252. "FireEye": "Generic.mg.ccf5b663061e7e27"
  253. },
  254. {
  255. "Sophos": "Mal/Behav-004"
  256. },
  257. {
  258. "SentinelOne": "DFI - Malicious PE"
  259. },
  260. {
  261. "Cyren": "W32/Trojan.CLL.gen!Eldorado"
  262. },
  263. {
  264. "Avira": "HEUR/AGEN.1014767"
  265. },
  266. {
  267. "Antiy-AVL": "GrayWare/Win32.FlyStudio.a"
  268. },
  269. {
  270. "Microsoft": "VirTool:Win32/CeeInject.SN!bit"
  271. },
  272. {
  273. "Endgame": "malicious (moderate confidence)"
  274. },
  275. {
  276. "ZoneAlarm": "HEUR:Exploit.Win32.MS17-010.gen"
  277. },
  278. {
  279. "GData": "Win32.Trojan.FlyStudio.F"
  280. },
  281. {
  282. "AhnLab-V3": "Malware/Win32.Generic.C3246619"
  283. },
  284. {
  285. "Acronis": "suspicious"
  286. },
  287. {
  288. "McAfee": "Artemis!CCF5B663061E"
  289. },
  290. {
  291. "MAX": "malware (ai score=94)"
  292. },
  293. {
  294. "VBA32": "BScope.Adware.Wajam"
  295. },
  296. {
  297. "Cylance": "Unsafe"
  298. },
  299. {
  300. "ESET-NOD32": "a variant of Win32/CoinMiner.BUJ"
  301. },
  302. {
  303. "TrendMicro-HouseCall": "TROJ_GEN.R002C0DG219"
  304. },
  305. {
  306. "Rising": "Exploit.MS17-010!8.E85D (CLOUD)"
  307. },
  308. {
  309. "Ikarus": "Trojan-PSW.QQpass"
  310. },
  311. {
  312. "eGambit": "hacktool.mimikatz"
  313. },
  314. {
  315. "Fortinet": "W32/CoinMiner.BUJ!tr"
  316. },
  317. {
  318. "AVG": "Win32:Malware-gen"
  319. },
  320. {
  321. "Cybereason": "malicious.3061e7"
  322. },
  323. {
  324. "CrowdStrike": "win/malicious_confidence_90% (W)"
  325. },
  326. {
  327. "Qihoo-360": "Win32/Trojan.Exploit.46b"
  328. }
  329. ]
  330. },
  331. {
  332. "Description": "Checks the system manufacturer, likely for anti-virtualization",
  333. "Details": []
  334. },
  335. {
  336. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  337. "Details": [
  338. {
  339. "target": "clamav:Win.Exploit.EQGRP-6322722-0, sha256:f9a972757cd0d8a837eb30f6a28bc9b5e2a6674825b18359648c50bbb7d6d74a, type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
  340. },
  341. {
  342. "dropped": "clamav:Win.Exploit.EQGRP-6322722-0, sha256:f0e5e4189f9e6f2f9af23957ecaed63dc90c1d751e3f2350a71177fce2485b50 , guest_paths:C:\\Windows\\tbftqpep\\updelle.exe, type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
  343. }
  344. ]
  345. },
  346. {
  347. "Description": "The sample wrote data to the system hosts file.",
  348. "Details": []
  349. },
  350. {
  351. "Description": "Generates some ICMP traffic",
  352. "Details": []
  353. },
  354. {
  355. "Description": "Collects information to fingerprint the system",
  356. "Details": []
  357. },
  358. {
  359. "Description": "Installs WinPCAP",
  360. "Details": [
  361. {
  362. "file": "C:\\Windows\\System32\\Packet.dll"
  363. }
  364. ]
  365. },
  366. {
  367. "Description": "Created network traffic indicative of malicious activity",
  368. "Details": [
  369. {
  370. "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 35"
  371. }
  372. ]
  373. }
  374. ]
  375.  
  376. [*] Started Service: [
  377. "uzlatehyk",
  378. "WerSvc",
  379. "PolicyAgent",
  380. "npf"
  381. ]
  382.  
  383. [*] Executed Commands: [
  384. "cmd /c ping 127.0.0.1 -n 5 & Start C:\\Windows\\tbftqpep\\updelle.exe",
  385. "C:\\Windows\\system32\\PING.EXE ping 127.0.0.1 -n 5",
  386. "C:\\Windows\\tbftqpep\\updelle.exe",
  387. "C:\\Windows\\system32\\svchost.exe -k NetworkServiceNetworkRestricted",
  388. "taskhost.exe $(Arg0)",
  389. "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
  390. "cmd /c echo Y|cacls C:\\Windows\\system32\\drivers\\etc\\hosts /T /D users & echo Y|cacls C:\\Windows\\system32\\drivers\\etc\\hosts /T /D administrators & echo Y|cacls C:\\Windows\\system32\\drivers\\etc\\hosts /T /D SYSTEM",
  391. "netsh ipsec static del all",
  392. "netsh ipsec static add policy name=Bastards description=FuckingBastards",
  393. "netsh ipsec static add filteraction name=BastardsList action=block",
  394. "C:\\Windows\\system32\\cmd.exe /S /D /c\" echo Y\"",
  395. "cacls C:\\Windows\\system32\\drivers\\etc\\hosts /T /D users",
  396. "cacls C:\\Windows\\system32\\drivers\\etc\\hosts /T /D administrators",
  397. "cacls C:\\Windows\\system32\\drivers\\etc\\hosts /T /D SYSTEM",
  398. "C:\\Windows\\kyiguqful\\gqalzrrnl\\wpcap.exe /S",
  399. "net stop \"Boundary Meter\"",
  400. "net stop \"TrueSight Meter\"",
  401. "net stop npf",
  402. "net start npf",
  403. "C:\\Windows\\system32\\net1 stop \"Boundary Meter\"",
  404. "C:\\Windows\\system32\\net1 stop \"TrueSight Meter\"",
  405. "C:\\Windows\\system32\\net1 stop npf",
  406. "C:\\Windows\\system32\\net1 start npf",
  407. "net start npf",
  408. "C:\\Windows\\system32\\net1 start npf",
  409. "C:\\Windows\\kyiguqful\\gqalzrrnl\\ubsbsgiep.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\\Windows\\kyiguqful\\gqalzrrnl\\Scant.txt",
  410. "C:\\Windows\\system32\\WerFault.exe -u -p 2636 -s 288"
  411. ]
  412.  
  413. [*] Mutexes: [
  414. "IESQMMUTEX_0_208",
  415. "Local\\WERReportingForProcess2636",
  416. "Global\\\\xe5\\x88\\x90\\xc2\\x96"
  417. ]
  418.  
  419. [*] Modified Files: [
  420. "C:\\Windows\\tbftqpep\\updelle.exe",
  421. "C:\\Users\\user\\AppData\\Local\\Temp\\9849234\\....\\TemporaryFile",
  422. "C:\\Users\\user\\AppData\\Local\\Temp\\9849234\\TemporaryFile",
  423. "C:\\Windows\\sysnative\\LogFiles\\Scm\\4963ad21-c4a5-42a5-b9bd-e441d57204fe",
  424. "C:\\Windows\\sysnative\\LogFiles\\Scm\\d7d76640-0d5a-4bc6-bcc4-fc3dc8bbb140",
  425. "C:\\Windows\\System32\\drivers\\etc\\hosts",
  426. "\\Device\\Http\\Communication",
  427. "C:\\Windows\\Temp\\nsdE820.tmp",
  428. "C:\\Windows\\Temp\\nsdE821.tmp\\options.ini",
  429. "C:\\Windows\\Temp\\nsdE821.tmp\\final.ini",
  430. "C:\\Windows\\Temp\\nsdE821.tmp\\System.dll",
  431. "C:\\Windows\\Temp\\nsdE821.tmp\\nsExec.dll",
  432. "\\Device\\NamedPipe",
  433. "C:\\Windows\\System32\\pthreadVC.dll",
  434. "C:\\Windows\\System32\\wpcap.dll",
  435. "C:\\Windows\\System32\\Packet.dll",
  436. "C:\\Program Files\\WinPcap\\rpcapd.exe",
  437. "C:\\Program Files\\WinPcap\\LICENSE",
  438. "C:\\Program Files\\WinPcap\\uninstall.exe",
  439. "C:\\Windows\\sysnative\\drivers\\npf.sys",
  440. "C:\\Windows\\sysnative\\wpcap.dll",
  441. "C:\\Windows\\sysnative\\Packet.dll",
  442. "\\??\\Global\\NPF_{CFCD29B3-A836-426F-8329-8362EC941293}",
  443. "\\??\\Global\\NPF_{D720734D-0C14-4C25-829D-F6B4814978B3}",
  444. "\\??\\Global\\NPF_{CACEFAA3-95D9-4B5B-B275-FF35DF23713E}",
  445. "\\??\\Global\\NPF_{B22E8C55-CC74-4FBE-B907-F46D25953BEC}",
  446. "\\??\\Global\\NPF_{5D403E7A-7554-4DD5-A8CF-7099B00A9E2D}",
  447. "\\??\\Global\\NPF_NdisWanIpv6",
  448. "\\??\\Global\\NPF_NdisWanBh",
  449. "\\??\\Global\\NPF_{8C8DAC1D-0390-4B59-BF93-EC6C9E68D36A}",
  450. "\\??\\Global\\NPF_NdisWanIp",
  451. "\\??\\Global\\NPF_{BFA735C0-8C32-4848-B88D-FA17C2729720}",
  452. "\\??\\Global\\NPF_{50CD5E3E-0F08-4519-A9EF-B9802ED12701}",
  453. "\\??\\Global\\NPF_{D25DE530-2291-4668-A771-4DAC18E7B55D}",
  454. "C:\\Windows\\kyiguqful\\gqalzrrnl\\Scant.txt",
  455. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB7FD.tmp.appcompat.txt",
  456. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER9D3D.tmp.WERInternalMetadata.xml",
  457. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER9D8C.tmp.hdmp"
  458. ]
  459.  
  460. [*] Deleted Files: [
  461. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_ccf5b663061e7e2755f8eed37e49b732.exe",
  462. "C:\\Users\\user\\AppData\\Local\\Temp\\9849234\\....\\",
  463. "C:\\Users\\user\\AppData\\Local\\Temp\\9849234\\TemporaryFile\\TemporaryFile",
  464. "C:\\Users\\user\\AppData\\Local\\Temp\\9849234\\TemporaryFile",
  465. "C:\\Users\\user\\AppData\\Local\\Temp\\9849234",
  466. "C:\\Windows\\kyiguqful\\gqalzrrnl\\ip.txt",
  467. "C:\\Windows\\kyiguqful\\gqalzrrnl\\Result.txt",
  468. "C:\\Windows\\Temp\\nsiE7F0.tmp",
  469. "C:\\Windows\\Temp\\nsdE821.tmp",
  470. "C:\\Windows\\Temp\\nsdE821.tmp\\final.ini",
  471. "C:\\Windows\\Temp\\nsdE821.tmp\\nsExec.dll",
  472. "C:\\Windows\\Temp\\nsdE821.tmp\\options.ini",
  473. "C:\\Windows\\Temp\\nsdE821.tmp\\System.dll",
  474. "C:\\Windows\\Temp\\nsdE821.tmp\\",
  475. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB7FD.tmp",
  476. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB7FD.tmp.appcompat.txt",
  477. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER9D3D.tmp",
  478. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER9D3D.tmp.WERInternalMetadata.xml",
  479. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER9D8C.tmp",
  480. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER9D8C.tmp.hdmp",
  481. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERA8B9.tmp"
  482. ]
  483.  
  484. [*] Modified Registry Keys: [
  485. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\PolicyAgent\\Type",
  486. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\PolicyAgent\\Start",
  487. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\npf",
  488. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\npf\\Type",
  489. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\npf\\Start",
  490. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\npf\\ErrorControl",
  491. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\npf\\ImagePath",
  492. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\npf\\DisplayName",
  493. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\npf\\WOW64",
  494. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WerSvc\\Type",
  495. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
  496. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  497. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\dhcpqec.dll,-100",
  498. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\dhcpqec.dll,-101",
  499. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\dhcpqec.dll,-103",
  500. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\dhcpqec.dll,-102",
  501. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\napipsec.dll,-1",
  502. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\napipsec.dll,-2",
  503. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\napipsec.dll,-4",
  504. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\napipsec.dll,-3",
  505. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\tsgqec.dll,-100",
  506. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\tsgqec.dll,-101",
  507. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\tsgqec.dll,-102",
  508. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\tsgqec.dll,-103",
  509. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\eapqec.dll,-100",
  510. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\eapqec.dll,-101",
  511. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\eapqec.dll,-102",
  512. "HKEY_USERS\\.DEFAULT\\SOFTWARE\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\eapqec.dll,-103",
  513. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecISAKMPPolicy{ca083eb7-2e8a-4120-b2b6-f9fca8274055}",
  514. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecISAKMPPolicy{ca083eb7-2e8a-4120-b2b6-f9fca8274055}\\className",
  515. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecISAKMPPolicy{ca083eb7-2e8a-4120-b2b6-f9fca8274055}\\name",
  516. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecISAKMPPolicy{ca083eb7-2e8a-4120-b2b6-f9fca8274055}\\ipsecID",
  517. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecISAKMPPolicy{ca083eb7-2e8a-4120-b2b6-f9fca8274055}\\ipsecDataType",
  518. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecISAKMPPolicy{ca083eb7-2e8a-4120-b2b6-f9fca8274055}\\ipsecData",
  519. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecISAKMPPolicy{ca083eb7-2e8a-4120-b2b6-f9fca8274055}\\whenChanged",
  520. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy{438a80fb-7d8c-4a3c-9ac7-f215298c9dd2}",
  521. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy{438a80fb-7d8c-4a3c-9ac7-f215298c9dd2}\\className",
  522. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy{438a80fb-7d8c-4a3c-9ac7-f215298c9dd2}\\name",
  523. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy{438a80fb-7d8c-4a3c-9ac7-f215298c9dd2}\\ipsecID",
  524. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy{438a80fb-7d8c-4a3c-9ac7-f215298c9dd2}\\ipsecNegotiationPolicyAction",
  525. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy{438a80fb-7d8c-4a3c-9ac7-f215298c9dd2}\\ipsecNegotiationPolicyType",
  526. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy{438a80fb-7d8c-4a3c-9ac7-f215298c9dd2}\\ipsecDataType",
  527. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy{438a80fb-7d8c-4a3c-9ac7-f215298c9dd2}\\ipsecData",
  528. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy{438a80fb-7d8c-4a3c-9ac7-f215298c9dd2}\\whenChanged",
  529. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecPolicy{81cc066d-e002-4cf2-9628-40f85e9a3bbd}",
  530. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecPolicy{81cc066d-e002-4cf2-9628-40f85e9a3bbd}\\className",
  531. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecPolicy{81cc066d-e002-4cf2-9628-40f85e9a3bbd}\\description",
  532. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecPolicy{81cc066d-e002-4cf2-9628-40f85e9a3bbd}\\name",
  533. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecPolicy{81cc066d-e002-4cf2-9628-40f85e9a3bbd}\\ipsecName",
  534. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecPolicy{81cc066d-e002-4cf2-9628-40f85e9a3bbd}\\ipsecID",
  535. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecPolicy{81cc066d-e002-4cf2-9628-40f85e9a3bbd}\\ipsecDataType",
  536. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecPolicy{81cc066d-e002-4cf2-9628-40f85e9a3bbd}\\ipsecData",
  537. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecPolicy{81cc066d-e002-4cf2-9628-40f85e9a3bbd}\\ipsecISAKMPReference",
  538. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecPolicy{81cc066d-e002-4cf2-9628-40f85e9a3bbd}\\whenChanged",
  539. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecISAKMPPolicy{ca083eb7-2e8a-4120-b2b6-f9fca8274055}\\ipsecOwnersReference",
  540. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFA{b2545444-c98b-4467-ae30-e44a4264f8dc}",
  541. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFA{b2545444-c98b-4467-ae30-e44a4264f8dc}\\className",
  542. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFA{b2545444-c98b-4467-ae30-e44a4264f8dc}\\name",
  543. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFA{b2545444-c98b-4467-ae30-e44a4264f8dc}\\ipsecID",
  544. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFA{b2545444-c98b-4467-ae30-e44a4264f8dc}\\ipsecDataType",
  545. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFA{b2545444-c98b-4467-ae30-e44a4264f8dc}\\ipsecData",
  546. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFA{b2545444-c98b-4467-ae30-e44a4264f8dc}\\ipsecNegotiationPolicyReference",
  547. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFA{b2545444-c98b-4467-ae30-e44a4264f8dc}\\whenChanged",
  548. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecPolicy{81cc066d-e002-4cf2-9628-40f85e9a3bbd}\\ipsecNFAReference",
  549. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFA{b2545444-c98b-4467-ae30-e44a4264f8dc}\\ipsecOwnersReference",
  550. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy{438a80fb-7d8c-4a3c-9ac7-f215298c9dd2}\\ipsecOwnersReference",
  551. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy{dcc07e33-8b9d-45e5-b3e2-bdcf1a4690f1}",
  552. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy{dcc07e33-8b9d-45e5-b3e2-bdcf1a4690f1}\\className",
  553. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy{dcc07e33-8b9d-45e5-b3e2-bdcf1a4690f1}\\name",
  554. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy{dcc07e33-8b9d-45e5-b3e2-bdcf1a4690f1}\\ipsecName",
  555. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy{dcc07e33-8b9d-45e5-b3e2-bdcf1a4690f1}\\ipsecID",
  556. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy{dcc07e33-8b9d-45e5-b3e2-bdcf1a4690f1}\\ipsecNegotiationPolicyAction",
  557. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy{dcc07e33-8b9d-45e5-b3e2-bdcf1a4690f1}\\ipsecNegotiationPolicyType",
  558. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy{dcc07e33-8b9d-45e5-b3e2-bdcf1a4690f1}\\ipsecDataType",
  559. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy{dcc07e33-8b9d-45e5-b3e2-bdcf1a4690f1}\\ipsecData",
  560. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy{dcc07e33-8b9d-45e5-b3e2-bdcf1a4690f1}\\whenChanged",
  561. "HKEY_LOCAL_MACHINE\\Software\\WinPcap",
  562. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\WinPcap\\(Default)",
  563. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WinPcapInst",
  564. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WinPcapInst\\UninstallString",
  565. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WinPcapInst\\QuietUninstallString",
  566. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WinPcapInst\\DisplayIcon",
  567. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WinPcapInst\\DisplayName",
  568. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WinPcapInst\\DisplayVersion",
  569. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WinPcapInst\\Publisher",
  570. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WinPcapInst\\URLInfoAbout",
  571. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WinPcapInst\\URLUpdateInfo",
  572. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WinPcapInst\\VersionMajor",
  573. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WinPcapInst\\VersionMinor",
  574. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WinPcapInst\\InstalledBy",
  575. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WinPcapInst\\NoModify",
  576. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WinPcapInst\\NoRepair",
  577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent",
  578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent"
  579. ]
  580.  
  581. [*] Deleted Registry Keys: [
  582. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy{438a80fb-7d8c-4a3c-9ac7-f215298c9dd2}\\description",
  583. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFA{b2545444-c98b-4467-ae30-e44a4264f8dc}\\description",
  584. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy{dcc07e33-8b9d-45e5-b3e2-bdcf1a4690f1}\\description"
  585. ]
  586.  
  587. [*] DNS Communications: [
  588. {
  589. "type": "A",
  590. "request": "uio.hognoob.se",
  591. "answers": [
  592. {
  593. "data": "185.164.72.143",
  594. "type": "A"
  595. }
  596. ]
  597. },
  598. {
  599. "type": "A",
  600. "request": "upa1.hognoob.se",
  601. "answers": [
  602. {
  603. "data": "172.105.237.113",
  604. "type": "A"
  605. }
  606. ]
  607. },
  608. {
  609. "type": "A",
  610. "request": "upa2.hognoob.se",
  611. "answers": [
  612. {
  613. "data": "139.162.13.92",
  614. "type": "A"
  615. }
  616. ]
  617. }
  618. ]
  619.  
  620. [*] Domains: [
  621. {
  622. "ip": "185.164.72.143",
  623. "domain": "uio.hognoob.se"
  624. },
  625. {
  626. "ip": "139.162.13.92",
  627. "domain": "upa2.hognoob.se"
  628. },
  629. {
  630. "ip": "172.105.237.113",
  631. "domain": "upa1.hognoob.se"
  632. }
  633. ]
  634.  
  635. [*] Network Communication - ICMP: [
  636. {
  637. "src": "218.3.121.17",
  638. "dst": "169.254.255.254
  639. "type": 3,
  640. "data": ""
  641. },
  642. {
  643. "src": "222.186.128.30",
  644. "dst": "169.254.255.254
  645. "type": 3,
  646. "data": ""
  647. },
  648. {
  649. "src": "222.186.130.139",
  650. "dst": "169.254.255.254
  651. "type": 3,
  652. "data": ""
  653. },
  654. {
  655. "src": "222.186.130.95",
  656. "dst": "169.254.255.254
  657. "type": 3,
  658. "data": ""
  659. },
  660. {
  661. "src": "222.186.134.224",
  662. "dst": "169.254.255.254
  663. "type": 3,
  664. "data": ""
  665. },
  666. {
  667. "src": "222.186.134.225",
  668. "dst": "169.254.255.254
  669. "type": 3,
  670. "data": ""
  671. },
  672. {
  673. "src": "222.186.134.241",
  674. "dst": "169.254.255.254
  675. "type": 3,
  676. "data": ""
  677. },
  678. {
  679. "src": "222.186.135.210",
  680. "dst": "169.254.255.254
  681. "type": 3,
  682. "data": ""
  683. },
  684. {
  685. "src": "222.186.135.215",
  686. "dst": "169.254.255.254
  687. "type": 3,
  688. "data": ""
  689. },
  690. {
  691. "src": "222.186.135.218",
  692. "dst": "169.254.255.254
  693. "type": 3,
  694. "data": ""
  695. },
  696. {
  697. "src": "222.186.136.132",
  698. "dst": "169.254.255.254
  699. "type": 3,
  700. "data": ""
  701. },
  702. {
  703. "src": "222.186.137.113",
  704. "dst": "169.254.255.254
  705. "type": 3,
  706. "data": ""
  707. },
  708. {
  709. "src": "222.186.137.251",
  710. "dst": "169.254.255.254
  711. "type": 3,
  712. "data": ""
  713. },
  714. {
  715. "src": "222.186.161.96",
  716. "dst": "169.254.255.254
  717. "type": 3,
  718. "data": ""
  719. },
  720. {
  721. "src": "222.186.168.196",
  722. "dst": "169.254.255.254
  723. "type": 3,
  724. "data": ""
  725. },
  726. {
  727. "src": "222.186.174.201",
  728. "dst": "169.254.255.254
  729. "type": 3,
  730. "data": ""
  731. },
  732. {
  733. "src": "222.186.174.210",
  734. "dst": "169.254.255.254
  735. "type": 3,
  736. "data": ""
  737. },
  738. {
  739. "src": "222.186.175.224",
  740. "dst": "169.254.255.254
  741. "type": 3,
  742. "data": ""
  743. },
  744. {
  745. "src": "222.186.180.123",
  746. "dst": "169.254.255.254
  747. "type": 3,
  748. "data": ""
  749. },
  750. {
  751. "src": "222.186.186.44",
  752. "dst": "169.254.255.254
  753. "type": 3,
  754. "data": ""
  755. },
  756. {
  757. "src": "218.3.121.17",
  758. "dst": "169.254.255.254
  759. "type": 3,
  760. "data": ""
  761. },
  762. {
  763. "src": "221.230.4.154",
  764. "dst": "169.254.255.254
  765. "type": 3,
  766. "data": ""
  767. },
  768. {
  769. "src": "221.230.4.154",
  770. "dst": "169.254.255.254
  771. "type": 3,
  772. "data": ""
  773. },
  774. {
  775. "src": "222.186.128.28",
  776. "dst": "169.254.255.254
  777. "type": 3,
  778. "data": ""
  779. },
  780. {
  781. "src": "222.186.130.201",
  782. "dst": "169.254.255.254
  783. "type": 3,
  784. "data": ""
  785. },
  786. {
  787. "src": "222.186.130.222",
  788. "dst": "169.254.255.254
  789. "type": 3,
  790. "data": ""
  791. },
  792. {
  793. "src": "222.186.134.49",
  794. "dst": "169.254.255.254
  795. "type": 3,
  796. "data": ""
  797. },
  798. {
  799. "src": "222.186.135.216",
  800. "dst": "169.254.255.254
  801. "type": 3,
  802. "data": ""
  803. },
  804. {
  805. "src": "222.186.135.217",
  806. "dst": "169.254.255.254
  807. "type": 3,
  808. "data": ""
  809. },
  810. {
  811. "src": "222.186.136.156",
  812. "dst": "169.254.255.254
  813. "type": 3,
  814. "data": ""
  815. },
  816. {
  817. "src": "222.186.136.28",
  818. "dst": "169.254.255.254
  819. "type": 3,
  820. "data": ""
  821. },
  822. {
  823. "src": "222.186.148.148",
  824. "dst": "169.254.255.254
  825. "type": 3,
  826. "data": ""
  827. },
  828. {
  829. "src": "222.186.168.198",
  830. "dst": "169.254.255.254
  831. "type": 3,
  832. "data": ""
  833. },
  834. {
  835. "src": "222.186.174.213",
  836. "dst": "169.254.255.254
  837. "type": 3,
  838. "data": ""
  839. },
  840. {
  841. "src": "222.186.174.215",
  842. "dst": "169.254.255.254
  843. "type": 3,
  844. "data": ""
  845. },
  846. {
  847. "src": "222.186.175.251",
  848. "dst": "169.254.255.254
  849. "type": 3,
  850. "data": ""
  851. },
  852. {
  853. "src": "222.186.190.156",
  854. "dst": "169.254.255.254
  855. "type": 3,
  856. "data": ""
  857. },
  858. {
  859. "src": "222.186.190.6",
  860. "dst": "169.254.255.254
  861. "type": 3,
  862. "data": ""
  863. },
  864. {
  865. "src": "222.186.192.14",
  866. "dst": "169.254.255.254
  867. "type": 3,
  868. "data": ""
  869. },
  870. {
  871. "src": "222.186.192.14",
  872. "dst": "169.254.255.254
  873. "type": 3,
  874. "data": ""
  875. },
  876. {
  877. "src": "222.186.192.14",
  878. "dst": "169.254.255.254
  879. "type": 3,
  880. "data": ""
  881. },
  882. {
  883. "src": "222.186.192.14",
  884. "dst": "169.254.255.254
  885. "type": 3,
  886. "data": ""
  887. },
  888. {
  889. "src": "222.186.192.190",
  890. "dst": "169.254.255.254
  891. "type": 3,
  892. "data": ""
  893. },
  894. {
  895. "src": "222.186.192.190",
  896. "dst": "169.254.255.254
  897. "type": 3,
  898. "data": ""
  899. },
  900. {
  901. "src": "222.186.192.190",
  902. "dst": "169.254.255.254
  903. "type": 3,
  904. "data": ""
  905. },
  906. {
  907. "src": "222.186.192.190",
  908. "dst": "169.254.255.254
  909. "type": 3,
  910. "data": ""
  911. },
  912. {
  913. "src": "222.186.192.190",
  914. "dst": "169.254.255.254
  915. "type": 3,
  916. "data": ""
  917. },
  918. {
  919. "src": "222.186.192.190",
  920. "dst": "169.254.255.254
  921. "type": 3,
  922. "data": ""
  923. },
  924. {
  925. "src": "222.186.192.190",
  926. "dst": "169.254.255.254
  927. "type": 3,
  928. "data": ""
  929. },
  930. {
  931. "src": "222.186.192.190",
  932. "dst": "169.254.255.254
  933. "type": 3,
  934. "data": ""
  935. },
  936. {
  937. "src": "222.186.192.190",
  938. "dst": "169.254.255.254
  939. "type": 3,
  940. "data": ""
  941. },
  942. {
  943. "src": "222.186.192.190",
  944. "dst": "169.254.255.254
  945. "type": 3,
  946. "data": ""
  947. },
  948. {
  949. "src": "222.186.192.190",
  950. "dst": "169.254.255.254
  951. "type": 3,
  952. "data": ""
  953. },
  954. {
  955. "src": "222.186.192.190",
  956. "dst": "169.254.255.254
  957. "type": 3,
  958. "data": ""
  959. },
  960. {
  961. "src": "222.186.193.150",
  962. "dst": "169.254.255.254
  963. "type": 3,
  964. "data": ""
  965. },
  966. {
  967. "src": "222.186.193.150",
  968. "dst": "169.254.255.254
  969. "type": 3,
  970. "data": ""
  971. },
  972. {
  973. "src": "222.186.193.150",
  974. "dst": "169.254.255.254
  975. "type": 3,
  976. "data": ""
  977. },
  978. {
  979. "src": "222.186.193.150",
  980. "dst": "169.254.255.254
  981. "type": 3,
  982. "data": ""
  983. },
  984. {
  985. "src": "222.186.193.209",
  986. "dst": "169.254.255.254
  987. "type": 3,
  988. "data": ""
  989. },
  990. {
  991. "src": "222.186.193.49",
  992. "dst": "169.254.255.254
  993. "type": 3,
  994. "data": ""
  995. },
  996. {
  997. "src": "222.186.193.81",
  998. "dst": "169.254.255.254
  999. "type": 3,
  1000. "data": ""
  1001. },
  1002. {
  1003. "src": "222.186.195.14",
  1004. "dst": "169.254.255.254
  1005. "type": 3,
  1006. "data": ""
  1007. },
  1008. {
  1009. "src": "222.186.195.14",
  1010. "dst": "169.254.255.254
  1011. "type": 3,
  1012. "data": ""
  1013. },
  1014. {
  1015. "src": "222.186.195.38",
  1016. "dst": "169.254.255.254
  1017. "type": 3,
  1018. "data": ""
  1019. },
  1020. {
  1021. "src": "222.186.195.6",
  1022. "dst": "169.254.255.254
  1023. "type": 3,
  1024. "data": ""
  1025. },
  1026. {
  1027. "src": "222.186.195.6",
  1028. "dst": "169.254.255.254
  1029. "type": 3,
  1030. "data": ""
  1031. },
  1032. {
  1033. "src": "222.186.195.65",
  1034. "dst": "169.254.255.254
  1035. "type": 3,
  1036. "data": ""
  1037. },
  1038. {
  1039. "src": "222.186.195.97",
  1040. "dst": "169.254.255.254
  1041. "type": 3,
  1042. "data": ""
  1043. },
  1044. {
  1045. "src": "222.186.196.110",
  1046. "dst": "169.254.255.254
  1047. "type": 3,
  1048. "data": ""
  1049. },
  1050. {
  1051. "src": "222.186.196.110",
  1052. "dst": "169.254.255.254
  1053. "type": 3,
  1054. "data": ""
  1055. },
  1056. {
  1057. "src": "222.186.196.118",
  1058. "dst": "169.254.255.254
  1059. "type": 3,
  1060. "data": ""
  1061. },
  1062. {
  1063. "src": "222.186.196.126",
  1064. "dst": "169.254.255.254
  1065. "type": 3,
  1066. "data": ""
  1067. },
  1068. {
  1069. "src": "222.186.196.198",
  1070. "dst": "169.254.255.254
  1071. "type": 3,
  1072. "data": ""
  1073. },
  1074. {
  1075. "src": "222.186.196.201",
  1076. "dst": "169.254.255.254
  1077. "type": 3,
  1078. "data": ""
  1079. },
  1080. {
  1081. "src": "222.186.196.253",
  1082. "dst": "169.254.255.254
  1083. "type": 3,
  1084. "data": ""
  1085. },
  1086. {
  1087. "src": "222.186.196.30",
  1088. "dst": "169.254.255.254
  1089. "type": 3,
  1090. "data": ""
  1091. },
  1092. {
  1093. "src": "222.186.196.30",
  1094. "dst": "169.254.255.254
  1095. "type": 3,
  1096. "data": ""
  1097. },
  1098. {
  1099. "src": "222.186.196.30",
  1100. "dst": "169.254.255.254
  1101. "type": 3,
  1102. "data": ""
  1103. },
  1104. {
  1105. "src": "222.186.196.30",
  1106. "dst": "169.254.255.254
  1107. "type": 3,
  1108. "data": ""
  1109. },
  1110. {
  1111. "src": "222.186.196.30",
  1112. "dst": "169.254.255.254
  1113. "type": 3,
  1114. "data": ""
  1115. },
  1116. {
  1117. "src": "222.186.196.30",
  1118. "dst": "169.254.255.254
  1119. "type": 3,
  1120. "data": ""
  1121. },
  1122. {
  1123. "src": "222.186.196.30",
  1124. "dst": "169.254.255.254
  1125. "type": 3,
  1126. "data": ""
  1127. },
  1128. {
  1129. "src": "222.186.196.46",
  1130. "dst": "169.254.255.254
  1131. "type": 3,
  1132. "data": ""
  1133. },
  1134. {
  1135. "src": "222.186.196.46",
  1136. "dst": "169.254.255.254
  1137. "type": 3,
  1138. "data": ""
  1139. },
  1140. {
  1141. "src": "222.186.196.78",
  1142. "dst": "169.254.255.254
  1143. "type": 3,
  1144. "data": ""
  1145. },
  1146. {
  1147. "src": "222.186.196.78",
  1148. "dst": "169.254.255.254
  1149. "type": 3,
  1150. "data": ""
  1151. },
  1152. {
  1153. "src": "222.186.196.94",
  1154. "dst": "169.254.255.254
  1155. "type": 3,
  1156. "data": ""
  1157. },
  1158. {
  1159. "src": "222.186.196.94",
  1160. "dst": "169.254.255.254
  1161. "type": 3,
  1162. "data": ""
  1163. },
  1164. {
  1165. "src": "222.186.197.129",
  1166. "dst": "169.254.255.254
  1167. "type": 3,
  1168. "data": ""
  1169. },
  1170. {
  1171. "src": "222.186.197.185",
  1172. "dst": "169.254.255.254
  1173. "type": 3,
  1174. "data": ""
  1175. },
  1176. {
  1177. "src": "222.186.197.94",
  1178. "dst": "169.254.255.254
  1179. "type": 3,
  1180. "data": ""
  1181. },
  1182. {
  1183. "src": "222.186.199.102",
  1184. "dst": "169.254.255.254
  1185. "type": 3,
  1186. "data": ""
  1187. },
  1188. {
  1189. "src": "222.186.199.110",
  1190. "dst": "169.254.255.254
  1191. "type": 3,
  1192. "data": ""
  1193. },
  1194. {
  1195. "src": "222.186.199.118",
  1196. "dst": "169.254.255.254
  1197. "type": 3,
  1198. "data": ""
  1199. },
  1200. {
  1201. "src": "222.186.199.134",
  1202. "dst": "169.254.255.254
  1203. "type": 3,
  1204. "data": ""
  1205. },
  1206. {
  1207. "src": "222.186.199.134",
  1208. "dst": "169.254.255.254
  1209. "type": 3,
  1210. "data": ""
  1211. },
  1212. {
  1213. "src": "222.186.199.134",
  1214. "dst": "169.254.255.254
  1215. "type": 3,
  1216. "data": ""
  1217. },
  1218. {
  1219. "src": "222.186.199.134",
  1220. "dst": "169.254.255.254
  1221. "type": 3,
  1222. "data": ""
  1223. },
  1224. {
  1225. "src": "222.186.199.161",
  1226. "dst": "169.254.255.254
  1227. "type": 3,
  1228. "data": ""
  1229. },
  1230. {
  1231. "src": "222.186.199.22",
  1232. "dst": "169.254.255.254
  1233. "type": 3,
  1234. "data": ""
  1235. },
  1236. {
  1237. "src": "222.186.199.6",
  1238. "dst": "169.254.255.254
  1239. "type": 3,
  1240. "data": ""
  1241. },
  1242. {
  1243. "src": "222.186.199.89",
  1244. "dst": "169.254.255.254
  1245. "type": 3,
  1246. "data": ""
  1247. },
  1248. {
  1249. "src": "222.186.202.166",
  1250. "dst": "169.254.255.254
  1251. "type": 3,
  1252. "data": ""
  1253. },
  1254. {
  1255. "src": "222.186.203.182",
  1256. "dst": "169.254.255.254
  1257. "type": 3,
  1258. "data": ""
  1259. },
  1260. {
  1261. "src": "222.186.203.182",
  1262. "dst": "169.254.255.254
  1263. "type": 3,
  1264. "data": ""
  1265. },
  1266. {
  1267. "src": "222.186.203.182",
  1268. "dst": "169.254.255.254
  1269. "type": 3,
  1270. "data": ""
  1271. },
  1272. {
  1273. "src": "222.186.203.182",
  1274. "dst": "169.254.255.254
  1275. "type": 3,
  1276. "data": ""
  1277. },
  1278. {
  1279. "src": "222.186.203.201",
  1280. "dst": "169.254.255.254
  1281. "type": 3,
  1282. "data": ""
  1283. },
  1284. {
  1285. "src": "222.186.203.209",
  1286. "dst": "169.254.255.254
  1287. "type": 3,
  1288. "data": ""
  1289. },
  1290. {
  1291. "src": "222.186.203.217",
  1292. "dst": "169.254.255.254
  1293. "type": 3,
  1294. "data": ""
  1295. },
  1296. {
  1297. "src": "222.186.203.62",
  1298. "dst": "169.254.255.254
  1299. "type": 3,
  1300. "data": ""
  1301. },
  1302. {
  1303. "src": "222.186.204.126",
  1304. "dst": "169.254.255.254
  1305. "type": 3,
  1306. "data": ""
  1307. },
  1308. {
  1309. "src": "222.186.204.126",
  1310. "dst": "169.254.255.254
  1311. "type": 3,
  1312. "data": ""
  1313. },
  1314. {
  1315. "src": "222.186.204.158",
  1316. "dst": "169.254.255.254
  1317. "type": 3,
  1318. "data": ""
  1319. },
  1320. {
  1321. "src": "222.186.204.177",
  1322. "dst": "169.254.255.254
  1323. "type": 3,
  1324. "data": ""
  1325. },
  1326. {
  1327. "src": "222.186.204.206",
  1328. "dst": "169.254.255.254
  1329. "type": 3,
  1330. "data": ""
  1331. },
  1332. {
  1333. "src": "222.186.204.30",
  1334. "dst": "169.254.255.254
  1335. "type": 3,
  1336. "data": ""
  1337. },
  1338. {
  1339. "src": "222.186.204.30",
  1340. "dst": "169.254.255.254
  1341. "type": 3,
  1342. "data": ""
  1343. },
  1344. {
  1345. "src": "222.186.204.33",
  1346. "dst": "169.254.255.254
  1347. "type": 3,
  1348. "data": ""
  1349. },
  1350. {
  1351. "src": "222.186.204.46",
  1352. "dst": "169.254.255.254
  1353. "type": 3,
  1354. "data": ""
  1355. },
  1356. {
  1357. "src": "222.186.204.78",
  1358. "dst": "169.254.255.254
  1359. "type": 3,
  1360. "data": ""
  1361. },
  1362. {
  1363. "src": "222.186.204.86",
  1364. "dst": "169.254.255.254
  1365. "type": 3,
  1366. "data": ""
  1367. },
  1368. {
  1369. "src": "222.186.204.94",
  1370. "dst": "169.254.255.254
  1371. "type": 3,
  1372. "data": ""
  1373. },
  1374. {
  1375. "src": "222.186.204.94",
  1376. "dst": "169.254.255.254
  1377. "type": 3,
  1378. "data": ""
  1379. },
  1380. {
  1381. "src": "222.186.206.37",
  1382. "dst": "169.254.255.254
  1383. "type": 3,
  1384. "data": ""
  1385. },
  1386. {
  1387. "src": "222.186.206.62",
  1388. "dst": "169.254.255.254
  1389. "type": 3,
  1390. "data": ""
  1391. },
  1392. {
  1393. "src": "222.186.208.134",
  1394. "dst": "169.254.255.254
  1395. "type": 3,
  1396. "data": ""
  1397. },
  1398. {
  1399. "src": "222.186.208.62",
  1400. "dst": "169.254.255.254
  1401. "type": 3,
  1402. "data": ""
  1403. },
  1404. {
  1405. "src": "222.186.208.62",
  1406. "dst": "169.254.255.254
  1407. "type": 3,
  1408. "data": ""
  1409. },
  1410. {
  1411. "src": "222.186.208.62",
  1412. "dst": "169.254.255.254
  1413. "type": 3,
  1414. "data": ""
  1415. },
  1416. {
  1417. "src": "222.186.208.62",
  1418. "dst": "169.254.255.254
  1419. "type": 3,
  1420. "data": ""
  1421. },
  1422. {
  1423. "src": "222.186.209.110",
  1424. "dst": "169.254.255.254
  1425. "type": 3,
  1426. "data": ""
  1427. },
  1428. {
  1429. "src": "222.186.209.126",
  1430. "dst": "169.254.255.254
  1431. "type": 3,
  1432. "data": ""
  1433. },
  1434. {
  1435. "src": "222.186.209.126",
  1436. "dst": "169.254.255.254
  1437. "type": 3,
  1438. "data": ""
  1439. },
  1440. {
  1441. "src": "222.186.209.126",
  1442. "dst": "169.254.255.254
  1443. "type": 3,
  1444. "data": ""
  1445. },
  1446. {
  1447. "src": "222.186.209.126",
  1448. "dst": "169.254.255.254
  1449. "type": 3,
  1450. "data": ""
  1451. },
  1452. {
  1453. "src": "222.186.209.145",
  1454. "dst": "169.254.255.254
  1455. "type": 3,
  1456. "data": ""
  1457. },
  1458. {
  1459. "src": "222.186.209.17",
  1460. "dst": "169.254.255.254
  1461. "type": 3,
  1462. "data": ""
  1463. },
  1464. {
  1465. "src": "222.186.209.174",
  1466. "dst": "169.254.255.254
  1467. "type": 3,
  1468. "data": ""
  1469. },
  1470. {
  1471. "src": "222.186.209.193",
  1472. "dst": "169.254.255.254
  1473. "type": 3,
  1474. "data": ""
  1475. },
  1476. {
  1477. "src": "222.186.209.194",
  1478. "dst": "169.254.255.254
  1479. "type": 3,
  1480. "data": ""
  1481. },
  1482. {
  1483. "src": "222.186.209.22",
  1484. "dst": "169.254.255.254
  1485. "type": 3,
  1486. "data": ""
  1487. },
  1488. {
  1489. "src": "222.186.209.22",
  1490. "dst": "169.254.255.254
  1491. "type": 3,
  1492. "data": ""
  1493. },
  1494. {
  1495. "src": "222.186.209.225",
  1496. "dst": "169.254.255.254
  1497. "type": 3,
  1498. "data": ""
  1499. },
  1500. {
  1501. "src": "222.186.209.225",
  1502. "dst": "169.254.255.254
  1503. "type": 3,
  1504. "data": ""
  1505. },
  1506. {
  1507. "src": "222.186.209.225",
  1508. "dst": "169.254.255.254
  1509. "type": 3,
  1510. "data": ""
  1511. },
  1512. {
  1513. "src": "222.186.209.225",
  1514. "dst": "169.254.255.254
  1515. "type": 3,
  1516. "data": ""
  1517. },
  1518. {
  1519. "src": "222.186.209.226",
  1520. "dst": "169.254.255.254
  1521. "type": 3,
  1522. "data": ""
  1523. },
  1524. {
  1525. "src": "222.186.209.33",
  1526. "dst": "169.254.255.254
  1527. "type": 3,
  1528. "data": ""
  1529. },
  1530. {
  1531. "src": "222.186.209.46",
  1532. "dst": "169.254.255.254
  1533. "type": 3,
  1534. "data": ""
  1535. },
  1536. {
  1537. "src": "222.186.209.58",
  1538. "dst": "169.254.255.254
  1539. "type": 3,
  1540. "data": ""
  1541. },
  1542. {
  1543. "src": "222.186.209.78",
  1544. "dst": "169.254.255.254
  1545. "type": 3,
  1546. "data": ""
  1547. },
  1548. {
  1549. "src": "222.186.209.78",
  1550. "dst": "169.254.255.254
  1551. "type": 3,
  1552. "data": ""
  1553. },
  1554. {
  1555. "src": "222.186.211.254",
  1556. "dst": "169.254.255.254
  1557. "type": 3,
  1558. "data": ""
  1559. },
  1560. {
  1561. "src": "222.186.211.254",
  1562. "dst": "169.254.255.254
  1563. "type": 3,
  1564. "data": ""
  1565. },
  1566. {
  1567. "src": "222.186.211.254",
  1568. "dst": "169.254.255.254
  1569. "type": 3,
  1570. "data": ""
  1571. },
  1572. {
  1573. "src": "222.186.211.254",
  1574. "dst": "169.254.255.254
  1575. "type": 3,
  1576. "data": ""
  1577. },
  1578. {
  1579. "src": "222.186.211.254",
  1580. "dst": "169.254.255.254
  1581. "type": 3,
  1582. "data": ""
  1583. },
  1584. {
  1585. "src": "222.186.211.254",
  1586. "dst": "169.254.255.254
  1587. "type": 3,
  1588. "data": ""
  1589. },
  1590. {
  1591. "src": "222.186.211.254",
  1592. "dst": "169.254.255.254
  1593. "type": 3,
  1594. "data": ""
  1595. },
  1596. {
  1597. "src": "222.186.212.122",
  1598. "dst": "169.254.255.254
  1599. "type": 3,
  1600. "data": ""
  1601. },
  1602. {
  1603. "src": "222.186.212.126",
  1604. "dst": "169.254.255.254
  1605. "type": 3,
  1606. "data": ""
  1607. },
  1608. {
  1609. "src": "222.186.212.126",
  1610. "dst": "169.254.255.254
  1611. "type": 3,
  1612. "data": ""
  1613. },
  1614. {
  1615. "src": "222.186.212.198",
  1616. "dst": "169.254.255.254
  1617. "type": 3,
  1618. "data": ""
  1619. },
  1620. {
  1621. "src": "222.186.214.21",
  1622. "dst": "169.254.255.254
  1623. "type": 3,
  1624. "data": ""
  1625. },
  1626. {
  1627. "src": "222.186.216.254",
  1628. "dst": "169.254.255.254
  1629. "type": 3,
  1630. "data": ""
  1631. },
  1632. {
  1633. "src": "222.186.216.254",
  1634. "dst": "169.254.255.254
  1635. "type": 3,
  1636. "data": ""
  1637. },
  1638. {
  1639. "src": "222.186.216.254",
  1640. "dst": "169.254.255.254
  1641. "type": 3,
  1642. "data": ""
  1643. },
  1644. {
  1645. "src": "222.186.216.254",
  1646. "dst": "169.254.255.254
  1647. "type": 3,
  1648. "data": ""
  1649. },
  1650. {
  1651. "src": "222.186.216.254",
  1652. "dst": "169.254.255.254
  1653. "type": 3,
  1654. "data": ""
  1655. },
  1656. {
  1657. "src": "222.186.216.254",
  1658. "dst": "169.254.255.254
  1659. "type": 3,
  1660. "data": ""
  1661. },
  1662. {
  1663. "src": "222.186.216.254",
  1664. "dst": "169.254.255.254
  1665. "type": 3,
  1666. "data": ""
  1667. },
  1668. {
  1669. "src": "222.186.216.254",
  1670. "dst": "169.254.255.254
  1671. "type": 3,
  1672. "data": ""
  1673. },
  1674. {
  1675. "src": "222.186.216.254",
  1676. "dst": "169.254.255.254
  1677. "type": 3,
  1678. "data": ""
  1679. },
  1680. {
  1681. "src": "222.186.216.254",
  1682. "dst": "169.254.255.254
  1683. "type": 3,
  1684. "data": ""
  1685. },
  1686. {
  1687. "src": "222.186.216.254",
  1688. "dst": "169.254.255.254
  1689. "type": 3,
  1690. "data": ""
  1691. },
  1692. {
  1693. "src": "222.186.217.62",
  1694. "dst": "169.254.255.254
  1695. "type": 3,
  1696. "data": ""
  1697. },
  1698. {
  1699. "src": "222.186.217.62",
  1700. "dst": "169.254.255.254
  1701. "type": 3,
  1702. "data": ""
  1703. },
  1704. {
  1705. "src": "222.186.217.62",
  1706. "dst": "169.254.255.254
  1707. "type": 3,
  1708. "data": ""
  1709. },
  1710. {
  1711. "src": "222.186.218.129",
  1712. "dst": "169.254.255.254
  1713. "type": 3,
  1714. "data": ""
  1715. },
  1716. {
  1717. "src": "222.186.218.190",
  1718. "dst": "169.254.255.254
  1719. "type": 3,
  1720. "data": ""
  1721. },
  1722. {
  1723. "src": "222.186.218.222",
  1724. "dst": "169.254.255.254
  1725. "type": 3,
  1726. "data": ""
  1727. },
  1728. {
  1729. "src": "222.186.218.222",
  1730. "dst": "169.254.255.254
  1731. "type": 3,
  1732. "data": ""
  1733. },
  1734. {
  1735. "src": "222.186.221.130",
  1736. "dst": "169.254.255.254
  1737. "type": 3,
  1738. "data": ""
  1739. },
  1740. {
  1741. "src": "222.186.221.190",
  1742. "dst": "169.254.255.254
  1743. "type": 3,
  1744. "data": ""
  1745. },
  1746. {
  1747. "src": "222.186.222.94",
  1748. "dst": "169.254.255.254
  1749. "type": 3,
  1750. "data": ""
  1751. },
  1752. {
  1753. "src": "222.186.222.94",
  1754. "dst": "169.254.255.254
  1755. "type": 3,
  1756. "data": ""
  1757. },
  1758. {
  1759. "src": "222.186.222.94",
  1760. "dst": "169.254.255.254
  1761. "type": 3,
  1762. "data": ""
  1763. },
  1764. {
  1765. "src": "222.186.223.230",
  1766. "dst": "169.254.255.254
  1767. "type": 3,
  1768. "data": ""
  1769. },
  1770. {
  1771. "src": "222.186.223.70",
  1772. "dst": "169.254.255.254
  1773. "type": 3,
  1774. "data": ""
  1775. },
  1776. {
  1777. "src": "222.186.223.70",
  1778. "dst": "169.254.255.254
  1779. "type": 3,
  1780. "data": ""
  1781. },
  1782. {
  1783. "src": "222.186.223.70",
  1784. "dst": "169.254.255.254
  1785. "type": 3,
  1786. "data": ""
  1787. },
  1788. {
  1789. "src": "222.186.223.70",
  1790. "dst": "169.254.255.254
  1791. "type": 3,
  1792. "data": ""
  1793. },
  1794. {
  1795. "src": "222.186.223.89",
  1796. "dst": "169.254.255.254
  1797. "type": 3,
  1798. "data": ""
  1799. },
  1800. {
  1801. "src": "222.186.226.254",
  1802. "dst": "169.254.255.254
  1803. "type": 3,
  1804. "data": ""
  1805. },
  1806. {
  1807. "src": "222.186.226.254",
  1808. "dst": "169.254.255.254
  1809. "type": 3,
  1810. "data": ""
  1811. },
  1812. {
  1813. "src": "222.186.226.254",
  1814. "dst": "169.254.255.254
  1815. "type": 3,
  1816. "data": ""
  1817. },
  1818. {
  1819. "src": "222.186.226.254",
  1820. "dst": "169.254.255.254
  1821. "type": 3,
  1822. "data": ""
  1823. },
  1824. {
  1825. "src": "222.186.226.254",
  1826. "dst": "169.254.255.254
  1827. "type": 3,
  1828. "data": ""
  1829. },
  1830. {
  1831. "src": "222.186.226.254",
  1832. "dst": "169.254.255.254
  1833. "type": 3,
  1834. "data": ""
  1835. },
  1836. {
  1837. "src": "222.186.226.254",
  1838. "dst": "169.254.255.254
  1839. "type": 3,
  1840. "data": ""
  1841. },
  1842. {
  1843. "src": "222.186.226.254",
  1844. "dst": "169.254.255.254
  1845. "type": 3,
  1846. "data": ""
  1847. },
  1848. {
  1849. "src": "222.186.226.254",
  1850. "dst": "169.254.255.254
  1851. "type": 3,
  1852. "data": ""
  1853. },
  1854. {
  1855. "src": "222.186.226.254",
  1856. "dst": "169.254.255.254
  1857. "type": 3,
  1858. "data": ""
  1859. },
  1860. {
  1861. "src": "222.186.226.254",
  1862. "dst": "169.254.255.254
  1863. "type": 3,
  1864. "data": ""
  1865. },
  1866. {
  1867. "src": "222.186.227.110",
  1868. "dst": "169.254.255.254
  1869. "type": 3,
  1870. "data": ""
  1871. },
  1872. {
  1873. "src": "222.186.227.126",
  1874. "dst": "169.254.255.254
  1875. "type": 3,
  1876. "data": ""
  1877. },
  1878. {
  1879. "src": "222.186.227.126",
  1880. "dst": "169.254.255.254
  1881. "type": 3,
  1882. "data": ""
  1883. },
  1884. {
  1885. "src": "222.186.227.52",
  1886. "dst": "169.254.255.254
  1887. "type": 3,
  1888. "data": ""
  1889. },
  1890. {
  1891. "src": "222.186.227.62",
  1892. "dst": "169.254.255.254
  1893. "type": 3,
  1894. "data": ""
  1895. },
  1896. {
  1897. "src": "222.186.227.86",
  1898. "dst": "169.254.255.254
  1899. "type": 3,
  1900. "data": ""
  1901. },
  1902. {
  1903. "src": "222.186.227.86",
  1904. "dst": "169.254.255.254
  1905. "type": 3,
  1906. "data": ""
  1907. },
  1908. {
  1909. "src": "222.186.227.97",
  1910. "dst": "169.254.255.254
  1911. "type": 3,
  1912. "data": ""
  1913. },
  1914. {
  1915. "src": "222.186.230.190",
  1916. "dst": "169.254.255.254
  1917. "type": 3,
  1918. "data": ""
  1919. },
  1920. {
  1921. "src": "222.186.232.169",
  1922. "dst": "169.254.255.254
  1923. "type": 3,
  1924. "data": ""
  1925. },
  1926. {
  1927. "src": "222.186.232.174",
  1928. "dst": "169.254.255.254
  1929. "type": 3,
  1930. "data": ""
  1931. },
  1932. {
  1933. "src": "222.186.232.235",
  1934. "dst": "169.254.255.254
  1935. "type": 3,
  1936. "data": ""
  1937. },
  1938. {
  1939. "src": "222.186.232.51",
  1940. "dst": "169.254.255.254
  1941. "type": 3,
  1942. "data": ""
  1943. },
  1944. {
  1945. "src": "222.186.233.193",
  1946. "dst": "169.254.255.254
  1947. "type": 3,
  1948. "data": ""
  1949. },
  1950. {
  1951. "src": "222.186.233.86",
  1952. "dst": "169.254.255.254
  1953. "type": 3,
  1954. "data": ""
  1955. },
  1956. {
  1957. "src": "222.186.234.65",
  1958. "dst": "169.254.255.254
  1959. "type": 3,
  1960. "data": ""
  1961. },
  1962. {
  1963. "src": "222.186.235.126",
  1964. "dst": "169.254.255.254
  1965. "type": 3,
  1966. "data": ""
  1967. },
  1968. {
  1969. "src": "222.186.235.156",
  1970. "dst": "169.254.255.254
  1971. "type": 3,
  1972. "data": ""
  1973. },
  1974. {
  1975. "src": "222.186.235.222",
  1976. "dst": "169.254.255.254
  1977. "type": 3,
  1978. "data": ""
  1979. },
  1980. {
  1981. "src": "222.186.235.41",
  1982. "dst": "169.254.255.254
  1983. "type": 3,
  1984. "data": ""
  1985. },
  1986. {
  1987. "src": "222.186.235.42",
  1988. "dst": "169.254.255.254
  1989. "type": 3,
  1990. "data": ""
  1991. },
  1992. {
  1993. "src": "222.186.235.43",
  1994. "dst": "169.254.255.254
  1995. "type": 3,
  1996. "data": ""
  1997. },
  1998. {
  1999. "src": "222.186.235.44",
  2000. "dst": "169.254.255.254
  2001. "type": 3,
  2002. "data": ""
  2003. },
  2004. {
  2005. "src": "222.186.235.97",
  2006. "dst": "169.254.255.254
  2007. "type": 3,
  2008. "data": ""
  2009. },
  2010. {
  2011. "src": "222.186.236.126",
  2012. "dst": "169.254.255.254
  2013. "type": 3,
  2014. "data": ""
  2015. },
  2016. {
  2017. "src": "222.186.236.126",
  2018. "dst": "169.254.255.254
  2019. "type": 3,
  2020. "data": ""
  2021. },
  2022. {
  2023. "src": "222.186.236.222",
  2024. "dst": "169.254.255.254
  2025. "type": 3,
  2026. "data": ""
  2027. },
  2028. {
  2029. "src": "222.186.236.33",
  2030. "dst": "169.254.255.254
  2031. "type": 3,
  2032. "data": ""
  2033. },
  2034. {
  2035. "src": "222.186.236.49",
  2036. "dst": "169.254.255.254
  2037. "type": 3,
  2038. "data": ""
  2039. },
  2040. {
  2041. "src": "222.186.238.14",
  2042. "dst": "169.254.255.254
  2043. "type": 3,
  2044. "data": ""
  2045. },
  2046. {
  2047. "src": "222.186.240.35",
  2048. "dst": "169.254.255.254
  2049. "type": 3,
  2050. "data": ""
  2051. },
  2052. {
  2053. "src": "222.186.241.126",
  2054. "dst": "169.254.255.254
  2055. "type": 3,
  2056. "data": ""
  2057. },
  2058. {
  2059. "src": "222.186.241.23",
  2060. "dst": "169.254.255.254
  2061. "type": 3,
  2062. "data": ""
  2063. },
  2064. {
  2065. "src": "222.186.242.190",
  2066. "dst": "169.254.255.254
  2067. "type": 3,
  2068. "data": ""
  2069. },
  2070. {
  2071. "src": "222.186.242.190",
  2072. "dst": "169.254.255.254
  2073. "type": 3,
  2074. "data": ""
  2075. },
  2076. {
  2077. "src": "222.186.242.190",
  2078. "dst": "169.254.255.254
  2079. "type": 3,
  2080. "data": ""
  2081. },
  2082. {
  2083. "src": "222.186.242.190",
  2084. "dst": "169.254.255.254
  2085. "type": 3,
  2086. "data": ""
  2087. },
  2088. {
  2089. "src": "222.186.242.21",
  2090. "dst": "169.254.255.254
  2091. "type": 3,
  2092. "data": ""
  2093. },
  2094. {
  2095. "src": "222.186.242.218",
  2096. "dst": "169.254.255.254
  2097. "type": 3,
  2098. "data": ""
  2099. },
  2100. {
  2101. "src": "222.186.242.238",
  2102. "dst": "169.254.255.254
  2103. "type": 3,
  2104. "data": ""
  2105. },
  2106. {
  2107. "src": "222.186.242.238",
  2108. "dst": "169.254.255.254
  2109. "type": 3,
  2110. "data": ""
  2111. },
  2112. {
  2113. "src": "222.186.242.238",
  2114. "dst": "169.254.255.254
  2115. "type": 3,
  2116. "data": ""
  2117. },
  2118. {
  2119. "src": "222.186.242.238",
  2120. "dst": "169.254.255.254
  2121. "type": 3,
  2122. "data": ""
  2123. },
  2124. {
  2125. "src": "222.186.242.45",
  2126. "dst": "169.254.255.254
  2127. "type": 3,
  2128. "data": ""
  2129. },
  2130. {
  2131. "src": "222.186.242.94",
  2132. "dst": "169.254.255.254
  2133. "type": 3,
  2134. "data": ""
  2135. },
  2136. {
  2137. "src": "222.186.242.94",
  2138. "dst": "169.254.255.254
  2139. "type": 3,
  2140. "data": ""
  2141. },
  2142. {
  2143. "src": "222.186.242.94",
  2144. "dst": "169.254.255.254
  2145. "type": 3,
  2146. "data": ""
  2147. },
  2148. {
  2149. "src": "222.186.242.94",
  2150. "dst": "169.254.255.254
  2151. "type": 3,
  2152. "data": ""
  2153. },
  2154. {
  2155. "src": "222.186.242.94",
  2156. "dst": "169.254.255.254
  2157. "type": 3,
  2158. "data": ""
  2159. },
  2160. {
  2161. "src": "222.186.242.94",
  2162. "dst": "169.254.255.254
  2163. "type": 3,
  2164. "data": ""
  2165. },
  2166. {
  2167. "src": "222.186.244.157",
  2168. "dst": "169.254.255.254
  2169. "type": 3,
  2170. "data": ""
  2171. },
  2172. {
  2173. "src": "222.186.244.166",
  2174. "dst": "169.254.255.254
  2175. "type": 3,
  2176. "data": ""
  2177. },
  2178. {
  2179. "src": "222.186.244.201",
  2180. "dst": "169.254.255.254
  2181. "type": 3,
  2182. "data": ""
  2183. },
  2184. {
  2185. "src": "222.186.244.94",
  2186. "dst": "169.254.255.254
  2187. "type": 3,
  2188. "data": ""
  2189. },
  2190. {
  2191. "src": "222.186.244.94",
  2192. "dst": "169.254.255.254
  2193. "type": 3,
  2194. "data": ""
  2195. },
  2196. {
  2197. "src": "222.186.247.169",
  2198. "dst": "169.254.255.254
  2199. "type": 3,
  2200. "data": ""
  2201. },
  2202. {
  2203. "src": "222.186.247.221",
  2204. "dst": "169.254.255.254
  2205. "type": 3,
  2206. "data": ""
  2207. },
  2208. {
  2209. "src": "222.186.247.65",
  2210. "dst": "169.254.255.254
  2211. "type": 3,
  2212. "data": ""
  2213. },
  2214. {
  2215. "src": "222.186.248.62",
  2216. "dst": "169.254.255.254
  2217. "type": 3,
  2218. "data": ""
  2219. },
  2220. {
  2221. "src": "222.186.249.110",
  2222. "dst": "169.254.255.254
  2223. "type": 3,
  2224. "data": ""
  2225. },
  2226. {
  2227. "src": "222.186.249.126",
  2228. "dst": "169.254.255.254
  2229. "type": 3,
  2230. "data": ""
  2231. },
  2232. {
  2233. "src": "222.186.249.14",
  2234. "dst": "169.254.255.254
  2235. "type": 3,
  2236. "data": ""
  2237. },
  2238. {
  2239. "src": "222.186.249.142",
  2240. "dst": "169.254.255.254
  2241. "type": 3,
  2242. "data": ""
  2243. },
  2244. {
  2245. "src": "222.186.249.142",
  2246. "dst": "169.254.255.254
  2247. "type": 3,
  2248. "data": ""
  2249. },
  2250. {
  2251. "src": "222.186.249.153",
  2252. "dst": "169.254.255.254
  2253. "type": 3,
  2254. "data": ""
  2255. },
  2256. {
  2257. "src": "222.186.249.174",
  2258. "dst": "169.254.255.254
  2259. "type": 3,
  2260. "data": ""
  2261. },
  2262. {
  2263. "src": "222.186.249.198",
  2264. "dst": "169.254.255.254
  2265. "type": 3,
  2266. "data": ""
  2267. },
  2268. {
  2269. "src": "222.186.249.222",
  2270. "dst": "169.254.255.254
  2271. "type": 3,
  2272. "data": ""
  2273. },
  2274. {
  2275. "src": "222.186.251.105",
  2276. "dst": "169.254.255.254
  2277. "type": 3,
  2278. "data": ""
  2279. },
  2280. {
  2281. "src": "222.186.251.134",
  2282. "dst": "169.254.255.254
  2283. "type": 3,
  2284. "data": ""
  2285. },
  2286. {
  2287. "src": "222.186.251.139",
  2288. "dst": "169.254.255.254
  2289. "type": 3,
  2290. "data": ""
  2291. },
  2292. {
  2293. "src": "222.186.251.153",
  2294. "dst": "169.254.255.254
  2295. "type": 3,
  2296. "data": ""
  2297. },
  2298. {
  2299. "src": "222.186.251.158",
  2300. "dst": "169.254.255.254
  2301. "type": 3,
  2302. "data": ""
  2303. },
  2304. {
  2305. "src": "222.186.251.166",
  2306. "dst": "169.254.255.254
  2307. "type": 3,
  2308. "data": ""
  2309. },
  2310. {
  2311. "src": "222.186.251.166",
  2312. "dst": "169.254.255.254
  2313. "type": 3,
  2314. "data": ""
  2315. },
  2316. {
  2317. "src": "222.186.251.166",
  2318. "dst": "169.254.255.254
  2319. "type": 3,
  2320. "data": ""
  2321. },
  2322. {
  2323. "src": "222.186.251.166",
  2324. "dst": "169.254.255.254
  2325. "type": 3,
  2326. "data": ""
  2327. },
  2328. {
  2329. "src": "222.186.251.177",
  2330. "dst": "169.254.255.254
  2331. "type": 3,
  2332. "data": ""
  2333. },
  2334. {
  2335. "src": "222.186.251.233",
  2336. "dst": "169.254.255.254
  2337. "type": 3,
  2338. "data": ""
  2339. },
  2340. {
  2341. "src": "222.186.251.238",
  2342. "dst": "169.254.255.254
  2343. "type": 3,
  2344. "data": ""
  2345. },
  2346. {
  2347. "src": "222.186.251.238",
  2348. "dst": "169.254.255.254
  2349. "type": 3,
  2350. "data": ""
  2351. },
  2352. {
  2353. "src": "222.186.251.246",
  2354. "dst": "169.254.255.254
  2355. "type": 3,
  2356. "data": ""
  2357. },
  2358. {
  2359. "src": "222.186.251.62",
  2360. "dst": "169.254.255.254
  2361. "type": 3,
  2362. "data": ""
  2363. },
  2364. {
  2365. "src": "222.186.253.134",
  2366. "dst": "169.254.255.254
  2367. "type": 3,
  2368. "data": ""
  2369. },
  2370. {
  2371. "src": "222.186.253.209",
  2372. "dst": "169.254.255.254
  2373. "type": 3,
  2374. "data": ""
  2375. },
  2376. {
  2377. "src": "222.186.253.214",
  2378. "dst": "169.254.255.254
  2379. "type": 3,
  2380. "data": ""
  2381. },
  2382. {
  2383. "src": "222.186.253.22",
  2384. "dst": "169.254.255.254
  2385. "type": 3,
  2386. "data": ""
  2387. },
  2388. {
  2389. "src": "222.186.253.254",
  2390. "dst": "169.254.255.254
  2391. "type": 3,
  2392. "data": ""
  2393. },
  2394. {
  2395. "src": "222.186.253.254",
  2396. "dst": "169.254.255.254
  2397. "type": 3,
  2398. "data": ""
  2399. },
  2400. {
  2401. "src": "222.186.253.254",
  2402. "dst": "169.254.255.254
  2403. "type": 3,
  2404. "data": ""
  2405. },
  2406. {
  2407. "src": "222.186.253.30",
  2408. "dst": "169.254.255.254
  2409. "type": 3,
  2410. "data": ""
  2411. },
  2412. {
  2413. "src": "222.186.253.38",
  2414. "dst": "169.254.255.254
  2415. "type": 3,
  2416. "data": ""
  2417. },
  2418. {
  2419. "src": "222.186.253.38",
  2420. "dst": "169.254.255.254
  2421. "type": 3,
  2422. "data": ""
  2423. },
  2424. {
  2425. "src": "222.186.253.38",
  2426. "dst": "169.254.255.254
  2427. "type": 3,
  2428. "data": ""
  2429. },
  2430. {
  2431. "src": "222.186.253.41",
  2432. "dst": "169.254.255.254
  2433. "type": 3,
  2434. "data": ""
  2435. },
  2436. {
  2437. "src": "222.186.253.46",
  2438. "dst": "169.254.255.254
  2439. "type": 3,
  2440. "data": ""
  2441. },
  2442. {
  2443. "src": "222.186.47.66",
  2444. "dst": "169.254.255.254
  2445. "type": 11,
  2446. "data": ""
  2447. },
  2448. {
  2449. "src": "222.186.47.70",
  2450. "dst": "169.254.255.254
  2451. "type": 11,
  2452. "data": ""
  2453. }
  2454. ]
  2455.  
  2456. [*] Network Communication - HTTP: [
  2457. {
  2458. "count": 2,
  2459. "body": "",
  2460. "uri": "http://uio.hognoob.se:63145/cfg.ini",
  2461. "user-agent": "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)",
  2462. "method": "GET",
  2463. "host": "uio.hognoob.se:63145",
  2464. "version": "1.1",
  2465. "path": "/cfg.ini",
  2466. "data": "GET /cfg.ini HTTP/1.1\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\r\nAccept: */*\r\nHost: uio.hognoob.se:63145\r\nCache-Control: no-cache\r\n\r\n",
  2467. "port": 63145
  2468. }
  2469. ]
  2470.  
  2471. [*] Network Communication - SMTP: []
  2472.  
  2473. [*] Network Communication - Hosts: []
  2474.  
  2475. [*] Network Communication - IRC: []
  2476.  
  2477. [*] Static Analysis: {
  2478. "pe": {
  2479. "peid_signatures": null,
  2480. "imports": [
  2481. {
  2482. "imports": [
  2483. {
  2484. "name": "RegCloseKey",
  2485. "address": "0xa9e154"
  2486. }
  2487. ],
  2488. "dll": "ADVAPI32.dll"
  2489. },
  2490. {
  2491. "imports": [
  2492. {
  2493. "name": null,
  2494. "address": "0xa9e15c"
  2495. }
  2496. ],
  2497. "dll": "COMCTL32.dll"
  2498. },
  2499. {
  2500. "imports": [
  2501. {
  2502. "name": "ChooseColorA",
  2503. "address": "0xa9e164"
  2504. }
  2505. ],
  2506. "dll": "comdlg32.dll"
  2507. },
  2508. {
  2509. "imports": [
  2510. {
  2511. "name": "Escape",
  2512. "address": "0xa9e16c"
  2513. }
  2514. ],
  2515. "dll": "GDI32.dll"
  2516. },
  2517. {
  2518. "imports": [
  2519. {
  2520. "name": "GetAdaptersInfo",
  2521. "address": "0xa9e174"
  2522. }
  2523. ],
  2524. "dll": "iphlpapi.dll"
  2525. },
  2526. {
  2527. "imports": [
  2528. {
  2529. "name": "LoadLibraryA",
  2530. "address": "0xa9e17c"
  2531. },
  2532. {
  2533. "name": "ExitProcess",
  2534. "address": "0xa9e180"
  2535. },
  2536. {
  2537. "name": "GetProcAddress",
  2538. "address": "0xa9e184"
  2539. },
  2540. {
  2541. "name": "VirtualProtect",
  2542. "address": "0xa9e188"
  2543. }
  2544. ],
  2545. "dll": "KERNEL32.DLL"
  2546. },
  2547. {
  2548. "imports": [
  2549. {
  2550. "name": "OleRun",
  2551. "address": "0xa9e190"
  2552. }
  2553. ],
  2554. "dll": "ole32.dll"
  2555. },
  2556. {
  2557. "imports": [
  2558. {
  2559. "name": "VariantCopy",
  2560. "address": "0xa9e198"
  2561. }
  2562. ],
  2563. "dll": "OLEAUT32.dll"
  2564. },
  2565. {
  2566. "imports": [
  2567. {
  2568. "name": "RasHangUpA",
  2569. "address": "0xa9e1a0"
  2570. }
  2571. ],
  2572. "dll": "RASAPI32.dll"
  2573. },
  2574. {
  2575. "imports": [
  2576. {
  2577. "name": "ShellExecuteA",
  2578. "address": "0xa9e1a8"
  2579. }
  2580. ],
  2581. "dll": "SHELL32.dll"
  2582. },
  2583. {
  2584. "imports": [
  2585. {
  2586. "name": "GetDC",
  2587. "address": "0xa9e1b0"
  2588. }
  2589. ],
  2590. "dll": "USER32.dll"
  2591. },
  2592. {
  2593. "imports": [
  2594. {
  2595. "name": "VerQueryValueA",
  2596. "address": "0xa9e1b8"
  2597. }
  2598. ],
  2599. "dll": "VERSION.dll"
  2600. },
  2601. {
  2602. "imports": [
  2603. {
  2604. "name": "InternetOpenA",
  2605. "address": "0xa9e1c0"
  2606. }
  2607. ],
  2608. "dll": "WININET.dll"
  2609. },
  2610. {
  2611. "imports": [
  2612. {
  2613. "name": "waveOutOpen",
  2614. "address": "0xa9e1c8"
  2615. }
  2616. ],
  2617. "dll": "WINMM.dll"
  2618. },
  2619. {
  2620. "imports": [
  2621. {
  2622. "name": "OpenPrinterA",
  2623. "address": "0xa9e1d0"
  2624. }
  2625. ],
  2626. "dll": "WINSPOOL.DRV"
  2627. },
  2628. {
  2629. "imports": [
  2630. {
  2631. "name": "recvfrom",
  2632. "address": "0xa9e1d8"
  2633. }
  2634. ],
  2635. "dll": "WS2_32.dll"
  2636. }
  2637. ],
  2638. "digital_signers": null,
  2639. "exported_dll_name": null,
  2640. "actual_checksum": "0x00532b7a",
  2641. "overlay": null,
  2642. "imagebase": "0x00400000",
  2643. "reported_checksum": "0x00000000",
  2644. "icon_hash": null,
  2645. "entrypoint": "0x00a9d5e0",
  2646. "timestamp": "2019-07-01 18:18:51",
  2647. "osversion": "4.0",
  2648. "sections": [
  2649. {
  2650. "name": "UPX0",
  2651. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2652. "virtual_address": "0x00001000",
  2653. "size_of_data": "0x00000000",
  2654. "entropy": "0.00",
  2655. "raw_address": "0x00000400",
  2656. "virtual_size": "0x00170000",
  2657. "characteristics_raw": "0xe0000080"
  2658. },
  2659. {
  2660. "name": "UPX1",
  2661. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2662. "virtual_address": "0x00171000",
  2663. "size_of_data": "0x0052c800",
  2664. "entropy": "7.82",
  2665. "raw_address": "0x00000400",
  2666. "virtual_size": "0x0052d000",
  2667. "characteristics_raw": "0xe0000040"
  2668. },
  2669. {
  2670. "name": "UPX2",
  2671. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2672. "virtual_address": "0x0069e000",
  2673. "size_of_data": "0x00000400",
  2674. "entropy": "3.70",
  2675. "raw_address": "0x0052cc00",
  2676. "virtual_size": "0x00001000",
  2677. "characteristics_raw": "0xc0000040"
  2678. }
  2679. ],
  2680. "resources": [],
  2681. "dirents": [
  2682. {
  2683. "virtual_address": "0x00000000",
  2684. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  2685. "size": "0x00000000"
  2686. },
  2687. {
  2688. "virtual_address": "0x0069e000",
  2689. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  2690. "size": "0x0000037c"
  2691. },
  2692. {
  2693. "virtual_address": "0x00000000",
  2694. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  2695. "size": "0x00000000"
  2696. },
  2697. {
  2698. "virtual_address": "0x00000000",
  2699. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  2700. "size": "0x00000000"
  2701. },
  2702. {
  2703. "virtual_address": "0x00000000",
  2704. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  2705. "size": "0x00000000"
  2706. },
  2707. {
  2708. "virtual_address": "0x00000000",
  2709. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  2710. "size": "0x00000000"
  2711. },
  2712. {
  2713. "virtual_address": "0x00000000",
  2714. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  2715. "size": "0x00000000"
  2716. },
  2717. {
  2718. "virtual_address": "0x00000000",
  2719. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  2720. "size": "0x00000000"
  2721. },
  2722. {
  2723. "virtual_address": "0x00000000",
  2724. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  2725. "size": "0x00000000"
  2726. },
  2727. {
  2728. "virtual_address": "0x00000000",
  2729. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  2730. "size": "0x00000000"
  2731. },
  2732. {
  2733. "virtual_address": "0x00000000",
  2734. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  2735. "size": "0x00000000"
  2736. },
  2737. {
  2738. "virtual_address": "0x00000000",
  2739. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  2740. "size": "0x00000000"
  2741. },
  2742. {
  2743. "virtual_address": "0x00000000",
  2744. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  2745. "size": "0x00000000"
  2746. },
  2747. {
  2748. "virtual_address": "0x00000000",
  2749. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  2750. "size": "0x00000000"
  2751. },
  2752. {
  2753. "virtual_address": "0x00000000",
  2754. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  2755. "size": "0x00000000"
  2756. },
  2757. {
  2758. "virtual_address": "0x00000000",
  2759. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  2760. "size": "0x00000000"
  2761. }
  2762. ],
  2763. "exports": [],
  2764. "guest_signers": {},
  2765. "imphash": "7e8fd41cc4af90fd0b2731fbcc919e1a",
  2766. "icon_fuzzy": null,
  2767. "icon": null,
  2768. "pdbpath": null,
  2769. "imported_dll_count": 16,
  2770. "versioninfo": []
  2771. }
  2772. }
  2773.  
  2774. [*] Resolved APIs: [
  2775. "kernel32.dll.FileTimeToSystemTime",
  2776. "kernel32.dll.GetTimeZoneInformation",
  2777. "kernel32.dll.SetLastError",
  2778. "kernel32.dll.GetSystemDirectoryA",
  2779. "kernel32.dll.GetWindowsDirectoryA",
  2780. "kernel32.dll.GetCurrentProcess",
  2781. "kernel32.dll.MultiByteToWideChar",
  2782. "kernel32.dll.WideCharToMultiByte",
  2783. "kernel32.dll.Process32Next",
  2784. "kernel32.dll.Process32First",
  2785. "kernel32.dll.CreateToolhelp32Snapshot",
  2786. "kernel32.dll.SetFilePointer",
  2787. "kernel32.dll.GetFileSize",
  2788. "kernel32.dll.TerminateProcess",
  2789. "kernel32.dll.OpenProcess",
  2790. "kernel32.dll.GetVersion",
  2791. "kernel32.dll.TerminateThread",
  2792. "kernel32.dll.CreateSemaphoreA",
  2793. "kernel32.dll.ResumeThread",
  2794. "kernel32.dll.ReleaseSemaphore",
  2795. "kernel32.dll.EnterCriticalSection",
  2796. "kernel32.dll.LeaveCriticalSection",
  2797. "kernel32.dll.GetProfileStringA",
  2798. "kernel32.dll.WriteFile",
  2799. "kernel32.dll.InterlockedExchange",
  2800. "kernel32.dll.IsBadCodePtr",
  2801. "kernel32.dll.CompareStringW",
  2802. "kernel32.dll.CompareStringA",
  2803. "kernel32.dll.GetStringTypeW",
  2804. "kernel32.dll.GetStringTypeA",
  2805. "kernel32.dll.SetUnhandledExceptionFilter",
  2806. "kernel32.dll.IsBadWritePtr",
  2807. "kernel32.dll.VirtualAlloc",
  2808. "kernel32.dll.LCMapStringW",
  2809. "kernel32.dll.LCMapStringA",
  2810. "kernel32.dll.SetEnvironmentVariableA",
  2811. "kernel32.dll.VirtualFree",
  2812. "kernel32.dll.HeapCreate",
  2813. "kernel32.dll.HeapDestroy",
  2814. "kernel32.dll.GetEnvironmentVariableA",
  2815. "kernel32.dll.GetStdHandle",
  2816. "kernel32.dll.SetHandleCount",
  2817. "kernel32.dll.GetEnvironmentStringsW",
  2818. "kernel32.dll.GetEnvironmentStrings",
  2819. "kernel32.dll.FreeEnvironmentStringsW",
  2820. "kernel32.dll.FreeEnvironmentStringsA",
  2821. "kernel32.dll.UnhandledExceptionFilter",
  2822. "kernel32.dll.GetFileType",
  2823. "kernel32.dll.SetStdHandle",
  2824. "kernel32.dll.GetACP",
  2825. "kernel32.dll.HeapSize",
  2826. "kernel32.dll.RaiseException",
  2827. "kernel32.dll.GetLocalTime",
  2828. "kernel32.dll.GetSystemTime",
  2829. "kernel32.dll.RtlUnwind",
  2830. "kernel32.dll.GetStartupInfoA",
  2831. "kernel32.dll.GetOEMCP",
  2832. "kernel32.dll.GetCPInfo",
  2833. "kernel32.dll.GetProcessVersion",
  2834. "kernel32.dll.SetErrorMode",
  2835. "kernel32.dll.GlobalFlags",
  2836. "kernel32.dll.GetCurrentThread",
  2837. "kernel32.dll.GetFileTime",
  2838. "kernel32.dll.TlsGetValue",
  2839. "kernel32.dll.LocalReAlloc",
  2840. "kernel32.dll.TlsSetValue",
  2841. "kernel32.dll.TlsFree",
  2842. "kernel32.dll.GlobalHandle",
  2843. "kernel32.dll.TlsAlloc",
  2844. "kernel32.dll.LocalAlloc",
  2845. "kernel32.dll.lstrcmpA",
  2846. "kernel32.dll.GlobalGetAtomNameA",
  2847. "kernel32.dll.GlobalAddAtomA",
  2848. "kernel32.dll.GlobalFindAtomA",
  2849. "kernel32.dll.GlobalDeleteAtom",
  2850. "kernel32.dll.lstrcmpiA",
  2851. "kernel32.dll.SetEndOfFile",
  2852. "kernel32.dll.UnlockFile",
  2853. "kernel32.dll.LockFile",
  2854. "kernel32.dll.FlushFileBuffers",
  2855. "kernel32.dll.DuplicateHandle",
  2856. "kernel32.dll.lstrcpynA",
  2857. "kernel32.dll.FileTimeToLocalFileTime",
  2858. "kernel32.dll.LocalFree",
  2859. "kernel32.dll.InterlockedDecrement",
  2860. "kernel32.dll.InterlockedIncrement",
  2861. "kernel32.dll.WaitForMultipleObjects",
  2862. "kernel32.dll.CreateFileA",
  2863. "kernel32.dll.SetEvent",
  2864. "kernel32.dll.FindResourceA",
  2865. "kernel32.dll.LoadResource",
  2866. "kernel32.dll.LockResource",
  2867. "kernel32.dll.ReadFile",
  2868. "kernel32.dll.CloseHandle",
  2869. "kernel32.dll.WaitForSingleObject",
  2870. "kernel32.dll.CreateProcessA",
  2871. "kernel32.dll.GetTickCount",
  2872. "kernel32.dll.GetCommandLineA",
  2873. "kernel32.dll.MulDiv",
  2874. "kernel32.dll.GetProcAddress",
  2875. "kernel32.dll.GetModuleHandleA",
  2876. "kernel32.dll.GetVolumeInformationA",
  2877. "kernel32.dll.SetCurrentDirectoryA",
  2878. "kernel32.dll.CreateDirectoryA",
  2879. "kernel32.dll.CopyFileA",
  2880. "kernel32.dll.DeleteFileA",
  2881. "kernel32.dll.lstrlenW",
  2882. "kernel32.dll.RemoveDirectoryA",
  2883. "kernel32.dll.GetModuleFileNameA",
  2884. "kernel32.dll.GetCurrentThreadId",
  2885. "kernel32.dll.ExitProcess",
  2886. "kernel32.dll.GlobalSize",
  2887. "kernel32.dll.GlobalFree",
  2888. "kernel32.dll.DeleteCriticalSection",
  2889. "kernel32.dll.InitializeCriticalSection",
  2890. "kernel32.dll.lstrcatA",
  2891. "kernel32.dll.lstrlenA",
  2892. "kernel32.dll.WinExec",
  2893. "kernel32.dll.lstrcpyA",
  2894. "kernel32.dll.FindNextFileA",
  2895. "kernel32.dll.GlobalReAlloc",
  2896. "kernel32.dll.HeapFree",
  2897. "kernel32.dll.HeapReAlloc",
  2898. "kernel32.dll.GetProcessHeap",
  2899. "kernel32.dll.HeapAlloc",
  2900. "kernel32.dll.GetUserDefaultLCID",
  2901. "kernel32.dll.GetFullPathNameA",
  2902. "kernel32.dll.FreeLibrary",
  2903. "kernel32.dll.LoadLibraryA",
  2904. "kernel32.dll.GetLastError",
  2905. "kernel32.dll.GetVersionExA",
  2906. "kernel32.dll.WritePrivateProfileStringA",
  2907. "kernel32.dll.CreateThread",
  2908. "kernel32.dll.CreateEventA",
  2909. "kernel32.dll.Sleep",
  2910. "kernel32.dll.GlobalAlloc",
  2911. "kernel32.dll.GlobalLock",
  2912. "kernel32.dll.GlobalUnlock",
  2913. "kernel32.dll.GetTempPathA",
  2914. "kernel32.dll.FindFirstFileA",
  2915. "kernel32.dll.FindClose",
  2916. "kernel32.dll.SetFileAttributesA",
  2917. "kernel32.dll.GetFileAttributesA",
  2918. "kernel32.dll.MoveFileA",
  2919. "kernel32.dll.IsBadReadPtr",
  2920. "advapi32.dll.RegQueryValueA",
  2921. "advapi32.dll.RegSetValueExA",
  2922. "advapi32.dll.RegOpenKeyExA",
  2923. "advapi32.dll.RegCloseKey",
  2924. "advapi32.dll.RegCreateKeyExA",
  2925. "comctl32.dll.ImageList_Destroy",
  2926. "comctl32.dll.#17",
  2927. "comdlg32.dll.ChooseColorA",
  2928. "comdlg32.dll.GetOpenFileNameA",
  2929. "comdlg32.dll.GetFileTitleA",
  2930. "comdlg32.dll.GetSaveFileNameA",
  2931. "gdi32.dll.Escape",
  2932. "gdi32.dll.ExtTextOutA",
  2933. "gdi32.dll.TextOutA",
  2934. "gdi32.dll.RectVisible",
  2935. "gdi32.dll.PtVisible",
  2936. "gdi32.dll.GetViewportExtEx",
  2937. "gdi32.dll.ExtSelectClipRgn",
  2938. "gdi32.dll.LineTo",
  2939. "gdi32.dll.MoveToEx",
  2940. "gdi32.dll.ExcludeClipRect",
  2941. "gdi32.dll.GetClipBox",
  2942. "gdi32.dll.ScaleWindowExtEx",
  2943. "gdi32.dll.SetWindowExtEx",
  2944. "gdi32.dll.GetTextMetricsA",
  2945. "gdi32.dll.SetStretchBltMode",
  2946. "gdi32.dll.GetClipRgn",
  2947. "gdi32.dll.CreatePolygonRgn",
  2948. "gdi32.dll.SelectClipRgn",
  2949. "gdi32.dll.DeleteObject",
  2950. "gdi32.dll.CreateDIBitmap",
  2951. "gdi32.dll.GetSystemPaletteEntries",
  2952. "gdi32.dll.CreatePalette",
  2953. "gdi32.dll.StretchBlt",
  2954. "gdi32.dll.SelectPalette",
  2955. "gdi32.dll.RealizePalette",
  2956. "gdi32.dll.GetDIBits",
  2957. "gdi32.dll.GetWindowExtEx",
  2958. "gdi32.dll.GetViewportOrgEx",
  2959. "gdi32.dll.GetWindowOrgEx",
  2960. "gdi32.dll.BeginPath",
  2961. "gdi32.dll.EndPath",
  2962. "gdi32.dll.PathToRegion",
  2963. "gdi32.dll.CreateEllipticRgn",
  2964. "gdi32.dll.CreateRoundRectRgn",
  2965. "gdi32.dll.GetTextColor",
  2966. "gdi32.dll.GetBkMode",
  2967. "gdi32.dll.GetBkColor",
  2968. "gdi32.dll.GetROP2",
  2969. "gdi32.dll.GetStretchBltMode",
  2970. "gdi32.dll.GetPolyFillMode",
  2971. "gdi32.dll.CreateCompatibleBitmap",
  2972. "gdi32.dll.CreateDCA",
  2973. "gdi32.dll.CreateBitmap",
  2974. "gdi32.dll.SelectObject",
  2975. "gdi32.dll.CreatePen",
  2976. "gdi32.dll.PatBlt",
  2977. "gdi32.dll.CombineRgn",
  2978. "gdi32.dll.CreateRectRgn",
  2979. "gdi32.dll.FillRgn",
  2980. "gdi32.dll.CreateSolidBrush",
  2981. "gdi32.dll.CreateFontIndirectA",
  2982. "gdi32.dll.GetStockObject",
  2983. "gdi32.dll.GetObjectA",
  2984. "gdi32.dll.EndPage",
  2985. "gdi32.dll.EndDoc",
  2986. "gdi32.dll.DeleteDC",
  2987. "gdi32.dll.StartDocA",
  2988. "gdi32.dll.StartPage",
  2989. "gdi32.dll.BitBlt",
  2990. "gdi32.dll.CreateCompatibleDC",
  2991. "gdi32.dll.Ellipse",
  2992. "gdi32.dll.Rectangle",
  2993. "gdi32.dll.LPtoDP",
  2994. "gdi32.dll.DPtoLP",
  2995. "gdi32.dll.GetCurrentObject",
  2996. "gdi32.dll.RoundRect",
  2997. "gdi32.dll.GetTextExtentPoint32A",
  2998. "gdi32.dll.GetDeviceCaps",
  2999. "gdi32.dll.CreateRectRgnIndirect",
  3000. "gdi32.dll.SetBkColor",
  3001. "gdi32.dll.SaveDC",
  3002. "gdi32.dll.RestoreDC",
  3003. "gdi32.dll.SetBkMode",
  3004. "gdi32.dll.SetPolyFillMode",
  3005. "gdi32.dll.SetROP2",
  3006. "gdi32.dll.SetTextColor",
  3007. "gdi32.dll.SetMapMode",
  3008. "gdi32.dll.SetViewportOrgEx",
  3009. "gdi32.dll.OffsetViewportOrgEx",
  3010. "gdi32.dll.SetViewportExtEx",
  3011. "gdi32.dll.ScaleViewportExtEx",
  3012. "gdi32.dll.SetWindowOrgEx",
  3013. "iphlpapi.dll.GetAdaptersInfo",
  3014. "ole32.dll.CLSIDFromProgID",
  3015. "ole32.dll.OleRun",
  3016. "ole32.dll.CoCreateInstance",
  3017. "ole32.dll.CLSIDFromString",
  3018. "ole32.dll.OleUninitialize",
  3019. "ole32.dll.OleInitialize",
  3020. "oleaut32.dll.#23",
  3021. "oleaut32.dll.#25",
  3022. "oleaut32.dll.#11",
  3023. "oleaut32.dll.#8",
  3024. "oleaut32.dll.#2",
  3025. "oleaut32.dll.#16",
  3026. "oleaut32.dll.#15",
  3027. "oleaut32.dll.#26",
  3028. "oleaut32.dll.#163",
  3029. "oleaut32.dll.#165",
  3030. "oleaut32.dll.#24",
  3031. "oleaut32.dll.#17",
  3032. "oleaut32.dll.#20",
  3033. "oleaut32.dll.#19",
  3034. "oleaut32.dll.#12",
  3035. "oleaut32.dll.#9",
  3036. "oleaut32.dll.#161",
  3037. "oleaut32.dll.#186",
  3038. "oleaut32.dll.#10",
  3039. "rasapi32.dll.RasHangUpA",
  3040. "rasapi32.dll.RasGetConnectStatusA",
  3041. "shell32.dll.SHGetSpecialFolderPathA",
  3042. "shell32.dll.Shell_NotifyIconA",
  3043. "shell32.dll.ShellExecuteA",
  3044. "user32.dll.WaitForInputIdle",
  3045. "user32.dll.GetClipboardData",
  3046. "user32.dll.OpenClipboard",
  3047. "user32.dll.wsprintfA",
  3048. "user32.dll.CloseClipboard",
  3049. "user32.dll.EqualRect",
  3050. "user32.dll.SetClipboardData",
  3051. "user32.dll.EmptyClipboard",
  3052. "user32.dll.GetSystemMetrics",
  3053. "user32.dll.GetCursorPos",
  3054. "user32.dll.MessageBoxA",
  3055. "user32.dll.GetSysColorBrush",
  3056. "user32.dll.GetWindowTextA",
  3057. "user32.dll.GetDlgItem",
  3058. "user32.dll.FindWindowA",
  3059. "user32.dll.GetWindowThreadProcessId",
  3060. "user32.dll.GetClassNameA",
  3061. "user32.dll.GetDesktopWindow",
  3062. "user32.dll.GetForegroundWindow",
  3063. "user32.dll.SetWindowTextA",
  3064. "user32.dll.LoadIconA",
  3065. "user32.dll.TranslateMessage",
  3066. "user32.dll.DrawFrameControl",
  3067. "user32.dll.DrawEdge",
  3068. "user32.dll.DrawFocusRect",
  3069. "user32.dll.WindowFromPoint",
  3070. "user32.dll.GetMessageA",
  3071. "user32.dll.DispatchMessageA",
  3072. "user32.dll.SetRectEmpty",
  3073. "user32.dll.RegisterClipboardFormatA",
  3074. "user32.dll.CreateIconFromResourceEx",
  3075. "user32.dll.CreateIconFromResource",
  3076. "user32.dll.DrawIconEx",
  3077. "user32.dll.CreatePopupMenu",
  3078. "user32.dll.AppendMenuA",
  3079. "user32.dll.ModifyMenuA",
  3080. "user32.dll.CreateMenu",
  3081. "user32.dll.CreateAcceleratorTableA",
  3082. "user32.dll.GetDlgCtrlID",
  3083. "user32.dll.LoadStringA",
  3084. "user32.dll.GetMenuCheckMarkDimensions",
  3085. "user32.dll.GetMenuState",
  3086. "user32.dll.SetMenuItemBitmaps",
  3087. "user32.dll.CheckMenuItem",
  3088. "user32.dll.MoveWindow",
  3089. "user32.dll.IsDialogMessageA",
  3090. "user32.dll.ScrollWindowEx",
  3091. "user32.dll.SendDlgItemMessageA",
  3092. "user32.dll.MapWindowPoints",
  3093. "user32.dll.AdjustWindowRectEx",
  3094. "user32.dll.GetScrollPos",
  3095. "user32.dll.RegisterClassA",
  3096. "user32.dll.GetMenuItemCount",
  3097. "user32.dll.GetMenuItemID",
  3098. "user32.dll.CreateWindowExA",
  3099. "user32.dll.SetWindowsHookExA",
  3100. "user32.dll.CallNextHookEx",
  3101. "user32.dll.GetClassLongA",
  3102. "user32.dll.SetPropA",
  3103. "user32.dll.UnhookWindowsHookEx",
  3104. "user32.dll.GetPropA",
  3105. "user32.dll.CallWindowProcA",
  3106. "user32.dll.GetSubMenu",
  3107. "user32.dll.EnableMenuItem",
  3108. "user32.dll.ClientToScreen",
  3109. "user32.dll.EnumDisplaySettingsA",
  3110. "user32.dll.LoadImageA",
  3111. "user32.dll.SystemParametersInfoA",
  3112. "user32.dll.ShowWindow",
  3113. "user32.dll.IsWindowEnabled",
  3114. "user32.dll.TranslateAcceleratorA",
  3115. "user32.dll.GetKeyState",
  3116. "user32.dll.CopyAcceleratorTableA",
  3117. "user32.dll.PostQuitMessage",
  3118. "user32.dll.IsZoomed",
  3119. "user32.dll.GetClassInfoA",
  3120. "user32.dll.DefWindowProcA",
  3121. "user32.dll.GetMenu",
  3122. "user32.dll.SetMenu",
  3123. "user32.dll.PeekMessageA",
  3124. "user32.dll.IsIconic",
  3125. "user32.dll.SetFocus",
  3126. "user32.dll.GetActiveWindow",
  3127. "user32.dll.GetWindow",
  3128. "user32.dll.DestroyAcceleratorTable",
  3129. "user32.dll.SetWindowRgn",
  3130. "user32.dll.GetMessagePos",
  3131. "user32.dll.ScreenToClient",
  3132. "user32.dll.ChildWindowFromPointEx",
  3133. "user32.dll.CopyRect",
  3134. "user32.dll.LoadBitmapA",
  3135. "user32.dll.WinHelpA",
  3136. "user32.dll.KillTimer",
  3137. "user32.dll.SetTimer",
  3138. "user32.dll.ReleaseCapture",
  3139. "user32.dll.GetCapture",
  3140. "user32.dll.SetCapture",
  3141. "user32.dll.GetScrollRange",
  3142. "user32.dll.SetScrollRange",
  3143. "user32.dll.SetScrollPos",
  3144. "user32.dll.SetRect",
  3145. "user32.dll.InflateRect",
  3146. "user32.dll.IntersectRect",
  3147. "user32.dll.DestroyIcon",
  3148. "user32.dll.PtInRect",
  3149. "user32.dll.OffsetRect",
  3150. "user32.dll.IsWindowVisible",
  3151. "user32.dll.EnableWindow",
  3152. "user32.dll.RedrawWindow",
  3153. "user32.dll.GetWindowLongA",
  3154. "user32.dll.SetWindowLongA",
  3155. "user32.dll.GetSysColor",
  3156. "user32.dll.SetActiveWindow",
  3157. "user32.dll.SetCursorPos",
  3158. "user32.dll.LoadCursorA",
  3159. "user32.dll.SetCursor",
  3160. "user32.dll.GetDC",
  3161. "user32.dll.FillRect",
  3162. "user32.dll.IsRectEmpty",
  3163. "user32.dll.ReleaseDC",
  3164. "user32.dll.IsChild",
  3165. "user32.dll.DestroyMenu",
  3166. "user32.dll.SetForegroundWindow",
  3167. "user32.dll.GetWindowRect",
  3168. "user32.dll.UnregisterClassA",
  3169. "user32.dll.UpdateWindow",
  3170. "user32.dll.ValidateRect",
  3171. "user32.dll.InvalidateRect",
  3172. "user32.dll.GetClientRect",
  3173. "user32.dll.GetFocus",
  3174. "user32.dll.GetParent",
  3175. "user32.dll.GetTopWindow",
  3176. "user32.dll.PostMessageA",
  3177. "user32.dll.IsWindow",
  3178. "user32.dll.SetParent",
  3179. "user32.dll.DestroyCursor",
  3180. "user32.dll.SendMessageA",
  3181. "user32.dll.SetWindowPos",
  3182. "user32.dll.GetWindowTextLengthA",
  3183. "user32.dll.CharUpperA",
  3184. "user32.dll.GetWindowDC",
  3185. "user32.dll.BeginPaint",
  3186. "user32.dll.EndPaint",
  3187. "user32.dll.TabbedTextOutA",
  3188. "user32.dll.DrawTextA",
  3189. "user32.dll.GrayStringA",
  3190. "user32.dll.DestroyWindow",
  3191. "user32.dll.CreateDialogIndirectParamA",
  3192. "user32.dll.EndDialog",
  3193. "user32.dll.GetNextDlgTabItem",
  3194. "user32.dll.GetWindowPlacement",
  3195. "user32.dll.RegisterWindowMessageA",
  3196. "user32.dll.GetLastActivePopup",
  3197. "user32.dll.GetMessageTime",
  3198. "user32.dll.RemovePropA",
  3199. "version.dll.GetFileVersionInfoA",
  3200. "version.dll.VerQueryValueA",
  3201. "version.dll.VerLanguageNameA",
  3202. "version.dll.GetFileVersionInfoSizeA",
  3203. "wininet.dll.InternetCanonicalizeUrlA",
  3204. "wininet.dll.InternetCrackUrlA",
  3205. "wininet.dll.HttpOpenRequestA",
  3206. "wininet.dll.HttpSendRequestA",
  3207. "wininet.dll.HttpQueryInfoA",
  3208. "wininet.dll.InternetReadFile",
  3209. "wininet.dll.InternetConnectA",
  3210. "wininet.dll.InternetSetOptionA",
  3211. "wininet.dll.InternetCloseHandle",
  3212. "wininet.dll.InternetOpenA",
  3213. "winmm.dll.midiStreamRestart",
  3214. "winmm.dll.midiStreamClose",
  3215. "winmm.dll.midiOutReset",
  3216. "winmm.dll.midiStreamStop",
  3217. "winmm.dll.waveOutUnprepareHeader",
  3218. "winmm.dll.waveOutPrepareHeader",
  3219. "winmm.dll.waveOutWrite",
  3220. "winmm.dll.waveOutPause",
  3221. "winmm.dll.waveOutReset",
  3222. "winmm.dll.waveOutClose",
  3223. "winmm.dll.midiStreamOut",
  3224. "winmm.dll.midiOutPrepareHeader",
  3225. "winmm.dll.midiStreamProperty",
  3226. "winmm.dll.midiStreamOpen",
  3227. "winmm.dll.midiOutUnprepareHeader",
  3228. "winmm.dll.waveOutOpen",
  3229. "winmm.dll.waveOutGetNumDevs",
  3230. "winspool.drv.OpenPrinterA",
  3231. "winspool.drv.DocumentPropertiesA",
  3232. "winspool.drv.ClosePrinter",
  3233. "ws2_32.dll.#18",
  3234. "ws2_32.dll.#116",
  3235. "ws2_32.dll.#115",
  3236. "ws2_32.dll.#52",
  3237. "ws2_32.dll.#12",
  3238. "ws2_32.dll.#11",
  3239. "ws2_32.dll.#57",
  3240. "ws2_32.dll.#19",
  3241. "ws2_32.dll.#3",
  3242. "ws2_32.dll.#101",
  3243. "ws2_32.dll.#9",
  3244. "ws2_32.dll.#2",
  3245. "ws2_32.dll.#6",
  3246. "ws2_32.dll.#15",
  3247. "ws2_32.dll.#151",
  3248. "ws2_32.dll.#1",
  3249. "ws2_32.dll.#5",
  3250. "ws2_32.dll.#13",
  3251. "ws2_32.dll.#16",
  3252. "ws2_32.dll.#8",
  3253. "ws2_32.dll.#23",
  3254. "ws2_32.dll.#4",
  3255. "ws2_32.dll.#10",
  3256. "ws2_32.dll.#20",
  3257. "ws2_32.dll.#17",
  3258. "kernel32.dll.IsProcessorFeaturePresent",
  3259. "cryptbase.dll.SystemFunction036",
  3260. "dwmapi.dll.DwmIsCompositionEnabled",
  3261. "kernel32.dll.GetNativeSystemInfo",
  3262. "kernel32.dll.Wow64DisableWow64FsRedirection",
  3263. "advapi32.dll.RegDisableReflectionKey",
  3264. "advapi32.dll.RegQueryValueExA",
  3265. "advapi32.dll.RegEnableReflectionKey",
  3266. "kernel32.dll.Wow64RevertWow64FsRedirection",
  3267. "advapi32.dll.CryptAcquireContextA",
  3268. "cryptsp.dll.CryptAcquireContextA",
  3269. "advapi32.dll.CryptCreateHash",
  3270. "cryptsp.dll.CryptCreateHash",
  3271. "advapi32.dll.CryptHashData",
  3272. "cryptsp.dll.CryptHashData",
  3273. "advapi32.dll.CryptGetHashParam",
  3274. "cryptsp.dll.CryptGetHashParam",
  3275. "advapi32.dll.CryptDestroyHash",
  3276. "cryptsp.dll.CryptDestroyHash",
  3277. "advapi32.dll.CryptReleaseContext",
  3278. "cryptsp.dll.CryptReleaseContext",
  3279. "kernel32.dll.GetComputerNameA",
  3280. "advapi32.dll.OpenSCManagerA",
  3281. "advapi32.dll.OpenServiceA",
  3282. "advapi32.dll.CloseServiceHandle",
  3283. "ntdll.dll.RtlAdjustPrivilege",
  3284. "kernel32.dll.InterlockedCompareExchange",
  3285. "oleaut32.dll.#500",
  3286. "kernel32.dll.SetThreadUILanguage",
  3287. "kernel32.dll.CopyFileExW",
  3288. "kernel32.dll.IsDebuggerPresent",
  3289. "kernel32.dll.SetConsoleInputExeNameW",
  3290. "kernel32.dll.SortGetHandle",
  3291. "kernel32.dll.SortCloseHandle",
  3292. "mswsock.dll.WSPStartup",
  3293. "wshtcpip.dll.WSHOpenSocket",
  3294. "wshtcpip.dll.WSHOpenSocket2",
  3295. "wshtcpip.dll.WSHJoinLeaf",
  3296. "wshtcpip.dll.WSHNotify",
  3297. "wshtcpip.dll.WSHGetSocketInformation",
  3298. "wshtcpip.dll.WSHSetSocketInformation",
  3299. "wshtcpip.dll.WSHGetSockaddrType",
  3300. "wshtcpip.dll.WSHGetWildcardSockaddr",
  3301. "wshtcpip.dll.WSHGetBroadcastSockaddr",
  3302. "wshtcpip.dll.WSHAddressToString",
  3303. "wshtcpip.dll.WSHStringToAddress",
  3304. "wshtcpip.dll.WSHIoctl",
  3305. "advapi32.dll.StartServiceCtrlDispatcherA",
  3306. "advapi32.dll.CreateServiceA",
  3307. "kernel32.dll.lstrcpyn",
  3308. "advapi32.dll.ChangeServiceConfig2A",
  3309. "advapi32.dll.StartServiceA",
  3310. "advapi32.dll.QueryServiceStatus",
  3311. "advapi32.dll.RegisterServiceCtrlHandlerA",
  3312. "advapi32.dll.SetServiceStatus",
  3313. "rasapi32.dll.RasConnectionNotificationW",
  3314. "sechost.dll.NotifyServiceStatusChangeA",
  3315. "ole32.dll.CoInitializeEx",
  3316. "advapi32.dll.RegDeleteTreeA",
  3317. "advapi32.dll.RegDeleteTreeW",
  3318. "ole32.dll.CoTaskMemAlloc",
  3319. "oleaut32.dll.DllGetClassObject",
  3320. "oleaut32.dll.DllCanUnloadNow",
  3321. "advapi32.dll.RegOpenKeyW",
  3322. "ole32.dll.CoTaskMemFree",
  3323. "ole32.dll.StringFromIID",
  3324. "iphlpapi.dll.GetAdaptersAddresses",
  3325. "dhcpcsvc.dll.DhcpRequestParams",
  3326. "oleaut32.dll.#6",
  3327. "advapi32.dll.ChangeServiceConfigA",
  3328. "ole32.dll.CoUninitialize",
  3329. "sechost.dll.LookupAccountNameLocalW",
  3330. "rasmontr.dll.InitHelperDll",
  3331. "nshwfp.dll.InitHelperDll",
  3332. "dhcpcmonitor.dll.InitHelperDll",
  3333. "wshelper.dll.InitHelperDll",
  3334. "nshhttp.dll.InitHelperDll",
  3335. "fwcfg.dll.InitHelperDll",
  3336. "authfwcfg.dll.InitHelperDll",
  3337. "ifmon.dll.InitHelperDll",
  3338. "netiohlp.dll.InitHelperDll",
  3339. "whhelper.dll.InitHelperDll",
  3340. "hnetmon.dll.InitHelperDll",
  3341. "rpcnsh.dll.InitHelperDll",
  3342. "dot3cfg.dll.InitHelperDll",
  3343. "napmontr.dll.InitHelperDll",
  3344. "nshipsec.dll.InitHelperDll",
  3345. "p2pnetsh.dll.InitHelperDll",
  3346. "wlancfg.dll.InitHelperDll",
  3347. "peerdistsh.dll.InitHelperDll",
  3348. "cryptsp.dll.CryptEnumProvidersW",
  3349. "user32.dll.LoadStringW",
  3350. "advapi32.dll.RegCreateKeyExW",
  3351. "advapi32.dll.RegOpenKeyExW",
  3352. "sechost.dll.OpenSCManagerW",
  3353. "sechost.dll.OpenServiceW",
  3354. "sechost.dll.QueryServiceConfigW",
  3355. "sechost.dll.CloseServiceHandle",
  3356. "sechost.dll.QueryServiceStatus",
  3357. "advapi32.dll.RegQueryInfoKeyW",
  3358. "advapi32.dll.RegEnumKeyExW",
  3359. "advapi32.dll.LookupAccountSidW",
  3360. "sechost.dll.LookupAccountSidLocalW",
  3361. "cryptsp.dll.CryptAcquireContextW",
  3362. "cryptsp.dll.CryptGenRandom",
  3363. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  3364. "httpapi.dll.HttpInitialize",
  3365. "userenv.dll.RegisterGPNotification",
  3366. "userenv.dll.UnregisterGPNotification",
  3367. "gpapi.dll.RegisterGPNotificationInternal",
  3368. "bcryptprimitives.dll.GetHashInterface",
  3369. "bcryptprimitives.dll.GetCipherInterface",
  3370. "httpapi.dll.HttpTerminate",
  3371. "gpapi.dll.UnregisterGPNotificationInternal",
  3372. "comctl32.dll.#388",
  3373. "ipsecsvc.dll.SpdServiceMain",
  3374. "rpcrt4.dll.NdrClientCall3",
  3375. "rpcrt4.dll.RpcBindingCreateW",
  3376. "rpcrt4.dll.RpcBindingBind",
  3377. "rpcrt4.dll.I_RpcMapWin32Status",
  3378. "rpcrt4.dll.RpcBindingFree",
  3379. "advapi32.dll.RegNotifyChangeKeyValue",
  3380. "advapi32.dll.CreateWellKnownSid",
  3381. "oleaut32.dll.#7",
  3382. "ole32.dll.NdrOleInitializeExtension",
  3383. "ole32.dll.CoGetClassObject",
  3384. "ole32.dll.CoGetMarshalSizeMax",
  3385. "ole32.dll.CoMarshalInterface",
  3386. "ole32.dll.CoUnmarshalInterface",
  3387. "ole32.dll.CoGetPSClsid",
  3388. "ole32.dll.CoReleaseMarshalData",
  3389. "ole32.dll.DcomChannelSetHResult",
  3390. "advapi32.dll.RegQueryValueExW",
  3391. "ws2_32.dll.WSASocketW",
  3392. "ws2_32.dll.WSACreateEvent",
  3393. "ws2_32.dll.WSAResetEvent",
  3394. "ws2_32.dll.WSAEventSelect",
  3395. "ws2_32.dll.WSAIoctl",
  3396. "ws2_32.dll.#111",
  3397. "secur32.dll.InitSecurityInterfaceW",
  3398. "cryptsp.dll.SystemFunction035",
  3399. "shfolder.dll.SHGetFolderPathA",
  3400. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  3401. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  3402. "comctl32.dll.#332",
  3403. "comctl32.dll.#386",
  3404. "kernel32.dll.GetUserDefaultUILanguage",
  3405. "shell32.dll.#680",
  3406. "system.dll.Call",
  3407. "kernel32.dll.IsWow64Process",
  3408. "nsexec.dll.Exec",
  3409. "kernel32.dll.Wow64EnableWow64FsRedirection",
  3410. "advapi32.dll.DeleteService",
  3411. "ole32.dll.CoRevokeInitializeSpy",
  3412. "advapi32.dll.UnregisterTraceGuids",
  3413. "comctl32.dll.#321",
  3414. "rpcrt4.dll.I_RpcSNCHOption",
  3415. "sechost.dll.ControlService",
  3416. "sechost.dll.StartServiceW",
  3417. "kernel32.dll.FlsAlloc",
  3418. "kernel32.dll.FlsGetValue",
  3419. "kernel32.dll.FlsSetValue",
  3420. "kernel32.dll.FlsFree",
  3421. "dbghelp.dll.SymFromAddr",
  3422. "dbghelp.dll.SymInitialize",
  3423. "wpcap.dll.pcap_close",
  3424. "wpcap.dll.pcap_datalink",
  3425. "wpcap.dll.pcap_dispatch",
  3426. "wpcap.dll.pcap_findalldevs",
  3427. "wpcap.dll.pcap_freealldevs",
  3428. "wpcap.dll.pcap_lib_version",
  3429. "wpcap.dll.pcap_lookupdev",
  3430. "wpcap.dll.pcap_major_version",
  3431. "wpcap.dll.pcap_minor_version",
  3432. "wpcap.dll.pcap_open_live",
  3433. "wpcap.dll.pcap_open_offline",
  3434. "wpcap.dll.pcap_sendpacket",
  3435. "wpcap.dll.pcap_next",
  3436. "wpcap.dll.pcap_setdirection",
  3437. "wpcap.dll.pcap_datalink_val_to_name",
  3438. "wpcap.dll.pcap_perror",
  3439. "wpcap.dll.pcap_sendqueue_alloc",
  3440. "wpcap.dll.pcap_sendqueue_transmit",
  3441. "wpcap.dll.pcap_sendqueue_destroy",
  3442. "wpcap.dll.pcap_sendqueue_queue",
  3443. "wersvc.dll.ServiceMain",
  3444. "wersvc.dll.SvchostPushServiceGlobals",
  3445. "advapi32.dll.RegGetValueW",
  3446. "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  3447. "faultrep.dll.WerpInitiateCrashReporting",
  3448. "wer.dll.WerpCreateMachineStore",
  3449. "shell32.dll.SHGetFolderPathEx",
  3450. "ole32.dll.StringFromGUID2",
  3451. "profapi.dll.#104",
  3452. "userenv.dll.CreateEnvironmentBlock",
  3453. "sechost.dll.ConvertSidToStringSidW",
  3454. "sspicli.dll.GetUserNameExW",
  3455. "userenv.dll.DestroyEnvironmentBlock",
  3456. "imm32.dll.ImmDisableIME",
  3457. "psapi.dll.GetModuleFileNameExW",
  3458. "version.dll.GetFileVersionInfoSizeW",
  3459. "version.dll.GetFileVersionInfoW",
  3460. "version.dll.VerQueryValueW",
  3461. "wer.dll.WerpCreateIntegratorReportId",
  3462. "wer.dll.WerReportCreate",
  3463. "advapi32.dll.OpenProcessToken",
  3464. "wer.dll.WerpSetIntegratorReportId",
  3465. "wer.dll.WerReportSetParameter",
  3466. "dbgeng.dll.DebugCreate",
  3467. "ntdll.dll.CsrGetProcessId",
  3468. "ntdll.dll.DbgBreakPoint",
  3469. "ntdll.dll.DbgPrint",
  3470. "ntdll.dll.DbgPrompt",
  3471. "ntdll.dll.DbgUiConvertStateChangeStructure",
  3472. "ntdll.dll.DbgUiGetThreadDebugObject",
  3473. "ntdll.dll.DbgUiIssueRemoteBreakin",
  3474. "ntdll.dll.DbgUiSetThreadDebugObject",
  3475. "ntdll.dll.NtAllocateVirtualMemory",
  3476. "ntdll.dll.NtClose",
  3477. "ntdll.dll.NtCreateDebugObject",
  3478. "ntdll.dll.NtCreateFile",
  3479. "ntdll.dll.NtDebugActiveProcess",
  3480. "ntdll.dll.NtDebugContinue",
  3481. "ntdll.dll.NtFreeVirtualMemory",
  3482. "ntdll.dll.NtOpenProcess",
  3483. "ntdll.dll.NtOpenThread",
  3484. "ntdll.dll.NtQueryInformationProcess",
  3485. "ntdll.dll.NtQueryInformationThread",
  3486. "ntdll.dll.NtQueryMutant",
  3487. "ntdll.dll.NtQueryObject",
  3488. "ntdll.dll.NtQuerySystemInformation",
  3489. "ntdll.dll.NtRemoveProcessDebug",
  3490. "ntdll.dll.NtResumeThread",
  3491. "ntdll.dll.NtSetInformationDebugObject",
  3492. "ntdll.dll.NtSetInformationProcess",
  3493. "ntdll.dll.NtSystemDebugControl",
  3494. "ntdll.dll.NtWaitForDebugEvent",
  3495. "ntdll.dll.RtlAnsiStringToUnicodeString",
  3496. "ntdll.dll.RtlCreateProcessParameters",
  3497. "ntdll.dll.RtlCreateUserProcess",
  3498. "ntdll.dll.RtlDestroyProcessParameters",
  3499. "ntdll.dll.RtlDosPathNameToNtPathName_U",
  3500. "ntdll.dll.RtlFindMessage",
  3501. "ntdll.dll.RtlFreeHeap",
  3502. "ntdll.dll.RtlFreeUnicodeString",
  3503. "ntdll.dll.RtlGetFunctionTableListHead",
  3504. "ntdll.dll.RtlGetUnloadEventTrace",
  3505. "ntdll.dll.RtlGetUnloadEventTraceEx",
  3506. "ntdll.dll.RtlInitAnsiString",
  3507. "ntdll.dll.RtlInitUnicodeString",
  3508. "ntdll.dll.RtlTryEnterCriticalSection",
  3509. "ntdll.dll.RtlUnicodeStringToAnsiString",
  3510. "ntdll.dll.NtOpenProcessToken",
  3511. "ntdll.dll.NtOpenThreadToken",
  3512. "ntdll.dll.NtQueryInformationToken",
  3513. "kernel32.dll.CloseProfileUserMapping",
  3514. "kernel32.dll.DebugActiveProcessStop",
  3515. "kernel32.dll.DebugBreak",
  3516. "kernel32.dll.DebugBreakProcess",
  3517. "kernel32.dll.DebugSetProcessKillOnExit",
  3518. "kernel32.dll.Module32First",
  3519. "kernel32.dll.Module32FirstW",
  3520. "kernel32.dll.Module32Next",
  3521. "kernel32.dll.Module32NextW",
  3522. "kernel32.dll.OpenThread",
  3523. "kernel32.dll.Process32FirstW",
  3524. "kernel32.dll.Process32NextW",
  3525. "kernel32.dll.ProcessIdToSessionId",
  3526. "kernel32.dll.SetProcessShutdownParameters",
  3527. "kernel32.dll.Thread32First",
  3528. "kernel32.dll.Thread32Next",
  3529. "kernel32.dll.Wow64GetThreadSelectorEntry",
  3530. "advapi32.dll.ControlService",
  3531. "advapi32.dll.CreateServiceW",
  3532. "advapi32.dll.EnumServicesStatusExA",
  3533. "advapi32.dll.EnumServicesStatusExW",
  3534. "advapi32.dll.GetEventLogInformation",
  3535. "advapi32.dll.GetTokenInformation",
  3536. "advapi32.dll.OpenSCManagerW",
  3537. "advapi32.dll.OpenServiceW",
  3538. "advapi32.dll.StartServiceW",
  3539. "advapi32.dll.GetSidSubAuthority",
  3540. "advapi32.dll.GetSidSubAuthorityCount",
  3541. "version.dll.GetFileVersionInfoSizeExW",
  3542. "version.dll.GetFileVersionInfoExW",
  3543. "dbghelp.dll.WinDbgExtensionDllInit",
  3544. "dbghelp.dll.ExtensionApiVersion",
  3545. "wer.dll.WerpSetDynamicParameter",
  3546. "wer.dll.WerReportAddDump",
  3547. "wer.dll.WerpSetCallBack",
  3548. "wer.dll.WerReportSetUIOption",
  3549. "wer.dll.WerpAddRegisteredDataToReport",
  3550. "wer.dll.WerReportSubmit",
  3551. "advapi32.dll.RegSetValueExW",
  3552. "advapi32.dll.AllocateAndInitializeSid",
  3553. "advapi32.dll.CheckTokenMembership",
  3554. "advapi32.dll.FreeSid",
  3555. "sensapi.dll.IsNetworkAlive",
  3556. "rpcrt4.dll.RpcBindingFromStringBindingW",
  3557. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  3558. "user32.dll.CharUpperW",
  3559. "wer.dll.WerpAddAppCompatData",
  3560. "apphelp.dll.SdbGetFileAttributes",
  3561. "apphelp.dll.SdbFormatAttribute",
  3562. "apphelp.dll.SdbFreeFileAttributes",
  3563. "dbghelp.dll.MiniDumpWriteDump",
  3564. "kernel32.dll.GetLongPathNameA",
  3565. "kernel32.dll.GetLongPathNameW",
  3566. "kernel32.dll.GetProcessTimes",
  3567. "powrprof.dll.CallNtPowerInformation",
  3568. "psapi.dll.EnumProcessModules",
  3569. "verifier.dll.VerifierEnumerateResource",
  3570. "ntdll.dll.NtSuspendProcess",
  3571. "ntdll.dll.NtResumeProcess"
  3572. ]
  3573.  
  3574. [*] Static Analysis: {
  3575. "pe": {
  3576. "peid_signatures": null,
  3577. "imports": [
  3578. {
  3579. "imports": [
  3580. {
  3581. "name": "RegCloseKey",
  3582. "address": "0xa9e154"
  3583. }
  3584. ],
  3585. "dll": "ADVAPI32.dll"
  3586. },
  3587. {
  3588. "imports": [
  3589. {
  3590. "name": null,
  3591. "address": "0xa9e15c"
  3592. }
  3593. ],
  3594. "dll": "COMCTL32.dll"
  3595. },
  3596. {
  3597. "imports": [
  3598. {
  3599. "name": "ChooseColorA",
  3600. "address": "0xa9e164"
  3601. }
  3602. ],
  3603. "dll": "comdlg32.dll"
  3604. },
  3605. {
  3606. "imports": [
  3607. {
  3608. "name": "Escape",
  3609. "address": "0xa9e16c"
  3610. }
  3611. ],
  3612. "dll": "GDI32.dll"
  3613. },
  3614. {
  3615. "imports": [
  3616. {
  3617. "name": "GetAdaptersInfo",
  3618. "address": "0xa9e174"
  3619. }
  3620. ],
  3621. "dll": "iphlpapi.dll"
  3622. },
  3623. {
  3624. "imports": [
  3625. {
  3626. "name": "LoadLibraryA",
  3627. "address": "0xa9e17c"
  3628. },
  3629. {
  3630. "name": "ExitProcess",
  3631. "address": "0xa9e180"
  3632. },
  3633. {
  3634. "name": "GetProcAddress",
  3635. "address": "0xa9e184"
  3636. },
  3637. {
  3638. "name": "VirtualProtect",
  3639. "address": "0xa9e188"
  3640. }
  3641. ],
  3642. "dll": "KERNEL32.DLL"
  3643. },
  3644. {
  3645. "imports": [
  3646. {
  3647. "name": "OleRun",
  3648. "address": "0xa9e190"
  3649. }
  3650. ],
  3651. "dll": "ole32.dll"
  3652. },
  3653. {
  3654. "imports": [
  3655. {
  3656. "name": "VariantCopy",
  3657. "address": "0xa9e198"
  3658. }
  3659. ],
  3660. "dll": "OLEAUT32.dll"
  3661. },
  3662. {
  3663. "imports": [
  3664. {
  3665. "name": "RasHangUpA",
  3666. "address": "0xa9e1a0"
  3667. }
  3668. ],
  3669. "dll": "RASAPI32.dll"
  3670. },
  3671. {
  3672. "imports": [
  3673. {
  3674. "name": "ShellExecuteA",
  3675. "address": "0xa9e1a8"
  3676. }
  3677. ],
  3678. "dll": "SHELL32.dll"
  3679. },
  3680. {
  3681. "imports": [
  3682. {
  3683. "name": "GetDC",
  3684. "address": "0xa9e1b0"
  3685. }
  3686. ],
  3687. "dll": "USER32.dll"
  3688. },
  3689. {
  3690. "imports": [
  3691. {
  3692. "name": "VerQueryValueA",
  3693. "address": "0xa9e1b8"
  3694. }
  3695. ],
  3696. "dll": "VERSION.dll"
  3697. },
  3698. {
  3699. "imports": [
  3700. {
  3701. "name": "InternetOpenA",
  3702. "address": "0xa9e1c0"
  3703. }
  3704. ],
  3705. "dll": "WININET.dll"
  3706. },
  3707. {
  3708. "imports": [
  3709. {
  3710. "name": "waveOutOpen",
  3711. "address": "0xa9e1c8"
  3712. }
  3713. ],
  3714. "dll": "WINMM.dll"
  3715. },
  3716. {
  3717. "imports": [
  3718. {
  3719. "name": "OpenPrinterA",
  3720. "address": "0xa9e1d0"
  3721. }
  3722. ],
  3723. "dll": "WINSPOOL.DRV"
  3724. },
  3725. {
  3726. "imports": [
  3727. {
  3728. "name": "recvfrom",
  3729. "address": "0xa9e1d8"
  3730. }
  3731. ],
  3732. "dll": "WS2_32.dll"
  3733. }
  3734. ],
  3735. "digital_signers": null,
  3736. "exported_dll_name": null,
  3737. "actual_checksum": "0x00532b7a",
  3738. "overlay": null,
  3739. "imagebase": "0x00400000",
  3740. "reported_checksum": "0x00000000",
  3741. "icon_hash": null,
  3742. "entrypoint": "0x00a9d5e0",
  3743. "timestamp": "2019-07-01 18:18:51",
  3744. "osversion": "4.0",
  3745. "sections": [
  3746. {
  3747. "name": "UPX0",
  3748. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  3749. "virtual_address": "0x00001000",
  3750. "size_of_data": "0x00000000",
  3751. "entropy": "0.00",
  3752. "raw_address": "0x00000400",
  3753. "virtual_size": "0x00170000",
  3754. "characteristics_raw": "0xe0000080"
  3755. },
  3756. {
  3757. "name": "UPX1",
  3758. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  3759. "virtual_address": "0x00171000",
  3760. "size_of_data": "0x0052c800",
  3761. "entropy": "7.82",
  3762. "raw_address": "0x00000400",
  3763. "virtual_size": "0x0052d000",
  3764. "characteristics_raw": "0xe0000040"
  3765. },
  3766. {
  3767. "name": "UPX2",
  3768. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  3769. "virtual_address": "0x0069e000",
  3770. "size_of_data": "0x00000400",
  3771. "entropy": "3.70",
  3772. "raw_address": "0x0052cc00",
  3773. "virtual_size": "0x00001000",
  3774. "characteristics_raw": "0xc0000040"
  3775. }
  3776. ],
  3777. "resources": [],
  3778. "dirents": [
  3779. {
  3780. "virtual_address": "0x00000000",
  3781. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  3782. "size": "0x00000000"
  3783. },
  3784. {
  3785. "virtual_address": "0x0069e000",
  3786. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  3787. "size": "0x0000037c"
  3788. },
  3789. {
  3790. "virtual_address": "0x00000000",
  3791. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  3792. "size": "0x00000000"
  3793. },
  3794. {
  3795. "virtual_address": "0x00000000",
  3796. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  3797. "size": "0x00000000"
  3798. },
  3799. {
  3800. "virtual_address": "0x00000000",
  3801. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  3802. "size": "0x00000000"
  3803. },
  3804. {
  3805. "virtual_address": "0x00000000",
  3806. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  3807. "size": "0x00000000"
  3808. },
  3809. {
  3810. "virtual_address": "0x00000000",
  3811. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  3812. "size": "0x00000000"
  3813. },
  3814. {
  3815. "virtual_address": "0x00000000",
  3816. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  3817. "size": "0x00000000"
  3818. },
  3819. {
  3820. "virtual_address": "0x00000000",
  3821. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  3822. "size": "0x00000000"
  3823. },
  3824. {
  3825. "virtual_address": "0x00000000",
  3826. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  3827. "size": "0x00000000"
  3828. },
  3829. {
  3830. "virtual_address": "0x00000000",
  3831. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  3832. "size": "0x00000000"
  3833. },
  3834. {
  3835. "virtual_address": "0x00000000",
  3836. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  3837. "size": "0x00000000"
  3838. },
  3839. {
  3840. "virtual_address": "0x00000000",
  3841. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  3842. "size": "0x00000000"
  3843. },
  3844. {
  3845. "virtual_address": "0x00000000",
  3846. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  3847. "size": "0x00000000"
  3848. },
  3849. {
  3850. "virtual_address": "0x00000000",
  3851. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  3852. "size": "0x00000000"
  3853. },
  3854. {
  3855. "virtual_address": "0x00000000",
  3856. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  3857. "size": "0x00000000"
  3858. }
  3859. ],
  3860. "exports": [],
  3861. "guest_signers": {},
  3862. "imphash": "7e8fd41cc4af90fd0b2731fbcc919e1a",
  3863. "icon_fuzzy": null,
  3864. "icon": null,
  3865. "pdbpath": null,
  3866. "imported_dll_count": 16,
  3867. "versioninfo": []
  3868. }
  3869. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!