API tools faq
paste
paladin316

Exes_45923344b1856078dd1358fa4e3477e1_exe_2019-06-30_15_30.json

paladin316
Jun 30th, 2019
2,396
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 44.35 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Ptsecurity"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_45923344b1856078dd1358fa4e3477e1.exe"
  7. [*] File Size: 199156
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
  9. [*] SHA256: "da884edd99275310f7cbd56324483449378c36f7dcec6afa5722c967ae5f9db3"
  10. [*] MD5: "45923344b1856078dd1358fa4e3477e1"
  11. [*] SHA1: "2e95a88641e0801d13538dfefaff60506e8f8c5b"
  12. [*] SHA512: "2341d39e97dc1626002aa4cc1c17f7d68fecb514c692124fef526f5319e527cc99045f87c0909e1bd141f79bb7c029f5983eac25037a279def0355f487125cfb"
  13. [*] CRC32: "3B420F21"
  14. [*] SSDEEP: "3072:66T2uTLIwk0QfV/3/ece//JuEsQYLvlYixffC8rGD5kfnGEO0QbR+sDLECGFC4+v:h2u1Q9/3ukEsBCgfC8rG9Dp+aYCGfgB"
  15.  
  16. [*] Process Execution: [
  17. "Exes_45923344b1856078dd1358fa4e3477e1.exe",
  18. "cmd.exe",
  19. "services.exe",
  20. "xwxpsm.exe"
  21. ]
  22.  
  23. [*] Signatures Detected: [
  24. {
  25. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  26. "Details": [
  27. {
  28. "IP": "103.30.43.120:8080"
  29. }
  30. ]
  31. },
  32. {
  33. "Description": "Creates RWX memory",
  34. "Details": []
  35. },
  36. {
  37. "Description": "Reads data out of its own binary image",
  38. "Details": [
  39. {
  40. "self_read": "process: Exes_45923344b1856078dd1358fa4e3477e1.exe, pid: 2220, offset: 0x000057f4, length: 0x0002b200"
  41. },
  42. {
  43. "self_read": "process: xwxpsm.exe, pid: 3020, offset: 0x000057f4, length: 0x0002b200"
  44. }
  45. ]
  46. },
  47. {
  48. "Description": "A process created a hidden window",
  49. "Details": [
  50. {
  51. "Process": "Exes_45923344b1856078dd1358fa4e3477e1.exe -> C:\\Windows\\System32\\cmd.exe"
  52. }
  53. ]
  54. },
  55. {
  56. "Description": "Performs some HTTP requests",
  57. "Details": [
  58. {
  59. "url": "http://www.msftncsi.com/ncsi.txt"
  60. }
  61. ]
  62. },
  63. {
  64. "Description": "The binary likely contains encrypted or compressed data.",
  65. "Details": [
  66. {
  67. "section": "name: UPX1, entropy: 7.87, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00004600, virtual_size: 0x00005000"
  68. }
  69. ]
  70. },
  71. {
  72. "Description": "The executable is compressed using UPX",
  73. "Details": [
  74. {
  75. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x00009000"
  76. }
  77. ]
  78. },
  79. {
  80. "Description": "Installs itself for autorun at Windows startup",
  81. "Details": [
  82. {
  83. "service name": "wdwa"
  84. },
  85. {
  86. "service path": "C:\\Windows\\xwxpsm.exe"
  87. }
  88. ]
  89. },
  90. {
  91. "Description": "File has been identified by 59 Antiviruses on VirusTotal as malicious",
  92. "Details": [
  93. {
  94. "Bkav": "W32.HfsAutoB."
  95. },
  96. {
  97. "MicroWorld-eScan": "Win32.Parite.C"
  98. },
  99. {
  100. "CMC": "Virus.Win32.Parite.b!O"
  101. },
  102. {
  103. "CAT-QuickHeal": "W32.Perite.A"
  104. },
  105. {
  106. "ALYac": "Win32.Parite.C"
  107. },
  108. {
  109. "Cylance": "Unsafe"
  110. },
  111. {
  112. "BitDefender": "Win32.Parite.C"
  113. },
  114. {
  115. "K7GW": "Virus ( 00001b711 )"
  116. },
  117. {
  118. "K7AntiVirus": "Virus ( 00001b711 )"
  119. },
  120. {
  121. "Invincea": "heuristic"
  122. },
  123. {
  124. "Baidu": "Win32.Virus.Parite.d"
  125. },
  126. {
  127. "F-Prot": "W32/Parite.C"
  128. },
  129. {
  130. "Symantec": "W32.Pinfi.B"
  131. },
  132. {
  133. "ESET-NOD32": "Win32/Parite.C"
  134. },
  135. {
  136. "APEX": "Malicious"
  137. },
  138. {
  139. "ClamAV": "Heuristics.W32.Parite.B"
  140. },
  141. {
  142. "GData": "Win32.Worm.ServStart.B"
  143. },
  144. {
  145. "Kaspersky": "Virus.Win32.Parite.c"
  146. },
  147. {
  148. "NANO-Antivirus": "Virus.Win32.Parite.bysj"
  149. },
  150. {
  151. "ViRobot": "Win32.Parite.C"
  152. },
  153. {
  154. "Rising": "Trojan.Fuerboos!8.EFC8/N3#86% (RDM+:cmRtazqc1O4+N/Ym0qWYyrSze0qr)"
  155. },
  156. {
  157. "Ad-Aware": "Win32.Parite.C"
  158. },
  159. {
  160. "Emsisoft": "Win32.Parite.C (B)"
  161. },
  162. {
  163. "Comodo": "Virus.Win32.Parite.gen@1dp8c4"
  164. },
  165. {
  166. "DrWeb": "Win32.Parite.3"
  167. },
  168. {
  169. "Zillya": "Virus.Parite.Win32.2"
  170. },
  171. {
  172. "TrendMicro": "PE_PARITE.A"
  173. },
  174. {
  175. "McAfee-GW-Edition": "BehavesLike.Win32.Pate.cc"
  176. },
  177. {
  178. "Trapmine": "malicious.high.ml.score"
  179. },
  180. {
  181. "FireEye": "Generic.mg.45923344b1856078"
  182. },
  183. {
  184. "Sophos": "W32/Parite-C"
  185. },
  186. {
  187. "SentinelOne": "DFI - Malicious PE"
  188. },
  189. {
  190. "Cyren": "W32/Parite.C"
  191. },
  192. {
  193. "Jiangmin": "Win32/Parite.c"
  194. },
  195. {
  196. "Avira": "W32/Parite"
  197. },
  198. {
  199. "MAX": "malware (ai score=87)"
  200. },
  201. {
  202. "Antiy-AVL": "Virus/Win32.Parite.c"
  203. },
  204. {
  205. "Endgame": "malicious (moderate confidence)"
  206. },
  207. {
  208. "Arcabit": "Win32.Parite.C"
  209. },
  210. {
  211. "ZoneAlarm": "Virus.Win32.Parite.c"
  212. },
  213. {
  214. "Microsoft": "Virus:Win32/Parite.C"
  215. },
  216. {
  217. "AhnLab-V3": "Win32/Parite"
  218. },
  219. {
  220. "Acronis": "suspicious"
  221. },
  222. {
  223. "McAfee": "W32/Pate.c"
  224. },
  225. {
  226. "TACHYON": "Virus/W32.Parite.C"
  227. },
  228. {
  229. "VBA32": "Virus.Parite.C"
  230. },
  231. {
  232. "Malwarebytes": "Trojan.ServStart"
  233. },
  234. {
  235. "Panda": "W32/Parite.A"
  236. },
  237. {
  238. "Zoner": "Trojan.Win32.Parite.22014"
  239. },
  240. {
  241. "Tencent": "Virus.Win32.Parite.a"
  242. },
  243. {
  244. "Yandex": "Win32.Parite.C"
  245. },
  246. {
  247. "Ikarus": "Worm.Win32.ServStart"
  248. },
  249. {
  250. "Fortinet": "W32/Generic.AC.32FD!tr"
  251. },
  252. {
  253. "MaxSecure": "Virus.Parite.C"
  254. },
  255. {
  256. "AVG": "Win32:Parite"
  257. },
  258. {
  259. "Cybereason": "malicious.4b1856"
  260. },
  261. {
  262. "Avast": "Win32:Parite"
  263. },
  264. {
  265. "CrowdStrike": "win/malicious_confidence_100% (D)"
  266. },
  267. {
  268. "Qihoo-360": "Virus.Win32.Parite.I"
  269. }
  270. ]
  271. },
  272. {
  273. "Description": "Created network traffic indicative of malicious activity",
  274. "Details": [
  275. {
  276. "signature": "ET TROJAN [PTsecurity] Botnet Nitol.B Checkin"
  277. }
  278. ]
  279. }
  280. ]
  281.  
  282. [*] Started Service: [
  283. "wdwa"
  284. ]
  285.  
  286. [*] Executed Commands: [
  287. "\"C:\\Windows\\system32\\cmd.exe\" /c del C:\\Users\\user\\AppData\\Local\\Temp\\EXES_4~1.EXE > nul",
  288. "C:\\Windows\\System32\\cmd.exe /c del C:\\Users\\user\\AppData\\Local\\Temp\\EXES_4~1.EXE > nul",
  289. "C:\\Windows\\xwxpsm.exe"
  290. ]
  291.  
  292. [*] Mutexes: [
  293. "Residented",
  294. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_45923344b1856078dd1358fa4e3477e1.exe",
  295. "Local\\ZoneAttributeCacheCounterMutex",
  296. "Local\\ZonesCacheCounterMutex",
  297. "Local\\ZonesLockedCacheCounterMutex",
  298. "C:\\Windows\\xwxpsm.exe",
  299. "wdwa",
  300. "DBWinMutex"
  301. ]
  302.  
  303. [*] Modified Files: [
  304. "C:\\Users\\user\\AppData\\Local\\Temp\\uig6A48.tmp",
  305. "C:\\Windows\\xwxpsm.exe",
  306. "C:\\Windows\\Temp\\mjg6F0B.tmp",
  307. "\\??\\nul"
  308. ]
  309.  
  310. [*] Deleted Files: [
  311. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_45923344b1856078dd1358fa4e3477e1.exe"
  312. ]
  313.  
  314. [*] Modified Registry Keys: [
  315. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\wdwa\\Description",
  316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect"
  318. ]
  319.  
  320. [*] Deleted Registry Keys: [
  321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  322. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  324. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  325. ]
  326.  
  327. [*] DNS Communications: [
  328. {
  329. "type": "A",
  330. "request": "ip.yototoo.com",
  331. "answers": [
  332. {
  333. "data": "139.196.209.127",
  334. "type": "A"
  335. }
  336. ]
  337. }
  338. ]
  339.  
  340. [*] Domains: [
  341. {
  342. "ip": "139.196.209.127",
  343. "domain": "ip.yototoo.com"
  344. }
  345. ]
  346.  
  347. [*] Network Communication - ICMP: []
  348.  
  349. [*] Network Communication - HTTP: [
  350. {
  351. "count": 1,
  352. "body": "",
  353. "uri": "http://www.msftncsi.com/ncsi.txt",
  354. "user-agent": "Microsoft NCSI",
  355. "method": "GET",
  356. "host": "www.msftncsi.com",
  357. "version": "1.1",
  358. "path": "/ncsi.txt",
  359. "data": "GET /ncsi.txt HTTP/1.1\r\nConnection: Close\r\nUser-Agent: Microsoft NCSI\r\nHost: www.msftncsi.com\r\n\r\n",
  360. "port": 80
  361. }
  362. ]
  363.  
  364. [*] Network Communication - SMTP: []
  365.  
  366. [*] Network Communication - Hosts: []
  367.  
  368. [*] Network Communication - IRC: []
  369.  
  370. [*] Static Analysis: {
  371. "pe": {
  372. "peid_signatures": null,
  373. "imports": [
  374. {
  375. "imports": [
  376. {
  377. "name": "LoadLibraryA",
  378. "address": "0x40f53c"
  379. },
  380. {
  381. "name": "GetProcAddress",
  382. "address": "0x40f540"
  383. },
  384. {
  385. "name": "VirtualProtect",
  386. "address": "0x40f544"
  387. },
  388. {
  389. "name": "VirtualAlloc",
  390. "address": "0x40f548"
  391. },
  392. {
  393. "name": "VirtualFree",
  394. "address": "0x40f54c"
  395. },
  396. {
  397. "name": "ExitProcess",
  398. "address": "0x40f550"
  399. }
  400. ],
  401. "dll": "KERNEL32.DLL"
  402. },
  403. {
  404. "imports": [
  405. {
  406. "name": "OpenServiceA",
  407. "address": "0x40f558"
  408. }
  409. ],
  410. "dll": "ADVAPI32.dll"
  411. },
  412. {
  413. "imports": [
  414. {
  415. "name": "GetIfTable",
  416. "address": "0x40f560"
  417. }
  418. ],
  419. "dll": "iphlpapi.dll"
  420. },
  421. {
  422. "imports": [
  423. {
  424. "name": "free",
  425. "address": "0x40f568"
  426. }
  427. ],
  428. "dll": "MSVCRT.dll"
  429. },
  430. {
  431. "imports": [
  432. {
  433. "name": "ShellExecuteA",
  434. "address": "0x40f570"
  435. }
  436. ],
  437. "dll": "SHELL32.dll"
  438. },
  439. {
  440. "imports": [
  441. {
  442. "name": "SHDeleteKeyA",
  443. "address": "0x40f578"
  444. }
  445. ],
  446. "dll": "SHLWAPI.dll"
  447. },
  448. {
  449. "imports": [
  450. {
  451. "name": "wsprintfA",
  452. "address": "0x40f580"
  453. }
  454. ],
  455. "dll": "USER32.dll"
  456. },
  457. {
  458. "imports": [
  459. {
  460. "name": "htons",
  461. "address": "0x40f588"
  462. }
  463. ],
  464. "dll": "WS2_32.dll"
  465. }
  466. ],
  467. "digital_signers": null,
  468. "exported_dll_name": null,
  469. "actual_checksum": "0x000365fc",
  470. "overlay": {
  471. "size": "0x0002aff4",
  472. "offset": "0x00005a00"
  473. },
  474. "imagebase": "0x00400000",
  475. "reported_checksum": "0x00000000",
  476. "icon_hash": null,
  477. "entrypoint": "0x00410000",
  478. "timestamp": "2015-03-25 02:55:20",
  479. "osversion": "4.0",
  480. "sections": [
  481. {
  482. "name": "UPX0",
  483. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  484. "virtual_address": "0x00001000",
  485. "size_of_data": "0x00000000",
  486. "entropy": "0.00",
  487. "raw_address": "0x00000400",
  488. "virtual_size": "0x00009000",
  489. "characteristics_raw": "0xe0000080"
  490. },
  491. {
  492. "name": "UPX1",
  493. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  494. "virtual_address": "0x0000a000",
  495. "size_of_data": "0x00004600",
  496. "entropy": "7.87",
  497. "raw_address": "0x00000400",
  498. "virtual_size": "0x00005000",
  499. "characteristics_raw": "0xe0000040"
  500. },
  501. {
  502. "name": ".rsrc",
  503. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  504. "virtual_address": "0x0000f000",
  505. "size_of_data": "0x00000800",
  506. "entropy": "3.04",
  507. "raw_address": "0x00004a00",
  508. "virtual_size": "0x00001000",
  509. "characteristics_raw": "0xc0000040"
  510. },
  511. {
  512. "name": ".wtq\t",
  513. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  514. "virtual_address": "0x00010000",
  515. "size_of_data": "0x00000800",
  516. "entropy": "6.38",
  517. "raw_address": "0x00005200",
  518. "virtual_size": "0x00001000",
  519. "characteristics_raw": "0xe0000020"
  520. }
  521. ],
  522. "resources": [],
  523. "dirents": [
  524. {
  525. "virtual_address": "0x00000000",
  526. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  527. "size": "0x00000000"
  528. },
  529. {
  530. "virtual_address": "0x0000f488",
  531. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  532. "size": "0x0000020c"
  533. },
  534. {
  535. "virtual_address": "0x0000f000",
  536. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  537. "size": "0x00000488"
  538. },
  539. {
  540. "virtual_address": "0x00000000",
  541. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  542. "size": "0x00000000"
  543. },
  544. {
  545. "virtual_address": "0x00000000",
  546. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  547. "size": "0x00000000"
  548. },
  549. {
  550. "virtual_address": "0x00000000",
  551. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  552. "size": "0x00000000"
  553. },
  554. {
  555. "virtual_address": "0x00000000",
  556. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  557. "size": "0x00000000"
  558. },
  559. {
  560. "virtual_address": "0x00000000",
  561. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  562. "size": "0x00000000"
  563. },
  564. {
  565. "virtual_address": "0x00000000",
  566. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  567. "size": "0x00000000"
  568. },
  569. {
  570. "virtual_address": "0x00000000",
  571. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  572. "size": "0x00000000"
  573. },
  574. {
  575. "virtual_address": "0x00000000",
  576. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  577. "size": "0x00000000"
  578. },
  579. {
  580. "virtual_address": "0x00000000",
  581. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  582. "size": "0x00000000"
  583. },
  584. {
  585. "virtual_address": "0x00000000",
  586. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  587. "size": "0x00000000"
  588. },
  589. {
  590. "virtual_address": "0x00000000",
  591. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  592. "size": "0x00000000"
  593. },
  594. {
  595. "virtual_address": "0x00000000",
  596. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  597. "size": "0x00000000"
  598. },
  599. {
  600. "virtual_address": "0x00000000",
  601. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  602. "size": "0x00000000"
  603. }
  604. ],
  605. "exports": [],
  606. "guest_signers": {},
  607. "imphash": "3373d1b2b40da2c0ce319c59ccaf75c5",
  608. "icon_fuzzy": null,
  609. "icon": null,
  610. "pdbpath": null,
  611. "imported_dll_count": 8,
  612. "versioninfo": []
  613. }
  614. }
  615.  
  616. [*] Resolved APIs: [
  617. "kernel32.dll.LoadLibraryA",
  618. "kernel32.dll.GetProcAddress",
  619. "kernel32.dll.GetTempPathA",
  620. "kernel32.dll.GetTempFileNameA",
  621. "kernel32.dll.CreateFileA",
  622. "kernel32.dll.ReadFile",
  623. "kernel32.dll.WriteFile",
  624. "kernel32.dll.SetFilePointer",
  625. "kernel32.dll.CloseHandle",
  626. "kernel32.dll.GetTickCount",
  627. "kernel32.dll.GetModuleFileNameA",
  628. "advapi32.dll.RegOpenKeyExA",
  629. "advapi32.dll.RegQueryValueExA",
  630. "advapi32.dll.RegCloseKey",
  631. "kernel32.dll.CompareStringA",
  632. "kernel32.dll.CopyFileA",
  633. "kernel32.dll.CreateEventA",
  634. "kernel32.dll.CreateMutexA",
  635. "kernel32.dll.CreateProcessA",
  636. "kernel32.dll.CreateThread",
  637. "kernel32.dll.DeleteCriticalSection",
  638. "kernel32.dll.DeleteFileA",
  639. "kernel32.dll.EnterCriticalSection",
  640. "kernel32.dll.EnumCalendarInfoA",
  641. "kernel32.dll.ExitProcess",
  642. "kernel32.dll.ExitThread",
  643. "kernel32.dll.FileTimeToDosDateTime",
  644. "kernel32.dll.FileTimeToLocalFileTime",
  645. "kernel32.dll.FindClose",
  646. "kernel32.dll.FindFirstFileA",
  647. "kernel32.dll.FindNextFileA",
  648. "kernel32.dll.FindResourceA",
  649. "kernel32.dll.FormatMessageA",
  650. "kernel32.dll.FreeEnvironmentStringsA",
  651. "kernel32.dll.FreeLibrary",
  652. "kernel32.dll.FreeResource",
  653. "kernel32.dll.GetACP",
  654. "kernel32.dll.GetCPInfo",
  655. "kernel32.dll.GetCommandLineA",
  656. "kernel32.dll.GetComputerNameA",
  657. "kernel32.dll.GetCurrentProcessId",
  658. "kernel32.dll.GetCurrentThreadId",
  659. "kernel32.dll.GetDiskFreeSpaceA",
  660. "kernel32.dll.GetDriveTypeA",
  661. "kernel32.dll.GetEnvironmentStrings",
  662. "kernel32.dll.GetExitCodeThread",
  663. "kernel32.dll.GetFileAttributesA",
  664. "kernel32.dll.GetFileSize",
  665. "kernel32.dll.GetFileTime",
  666. "kernel32.dll.GetFileType",
  667. "kernel32.dll.GetFullPathNameA",
  668. "kernel32.dll.GetLastError",
  669. "kernel32.dll.GetLocalTime",
  670. "kernel32.dll.GetLocaleInfoA",
  671. "kernel32.dll.GetLogicalDriveStringsA",
  672. "kernel32.dll.GetModuleHandleA",
  673. "kernel32.dll.GetOEMCP",
  674. "kernel32.dll.GetProcessHeap",
  675. "kernel32.dll.GetStartupInfoA",
  676. "kernel32.dll.GetStdHandle",
  677. "kernel32.dll.GetStringTypeW",
  678. "kernel32.dll.GetSystemDirectoryA",
  679. "kernel32.dll.GetSystemInfo",
  680. "kernel32.dll.GetThreadLocale",
  681. "kernel32.dll.GetTimeZoneInformation",
  682. "kernel32.dll.GetVersion",
  683. "kernel32.dll.GetVersionExA",
  684. "kernel32.dll.GetWindowsDirectoryA",
  685. "kernel32.dll.GlobalAddAtomA",
  686. "kernel32.dll.GlobalAlloc",
  687. "kernel32.dll.GlobalDeleteAtom",
  688. "kernel32.dll.GlobalFree",
  689. "kernel32.dll.GlobalHandle",
  690. "kernel32.dll.GlobalLock",
  691. "kernel32.dll.GlobalReAlloc",
  692. "kernel32.dll.GlobalUnlock",
  693. "kernel32.dll.HeapAlloc",
  694. "kernel32.dll.HeapFree",
  695. "kernel32.dll.InitializeCriticalSection",
  696. "kernel32.dll.InterlockedDecrement",
  697. "kernel32.dll.InterlockedIncrement",
  698. "kernel32.dll.LCMapStringA",
  699. "kernel32.dll.LeaveCriticalSection",
  700. "kernel32.dll.LoadLibraryExA",
  701. "kernel32.dll.LoadResource",
  702. "kernel32.dll.LocalAlloc",
  703. "kernel32.dll.LocalFree",
  704. "kernel32.dll.LockResource",
  705. "kernel32.dll.MulDiv",
  706. "kernel32.dll.MultiByteToWideChar",
  707. "kernel32.dll.OpenFile",
  708. "kernel32.dll.OpenMutexA",
  709. "kernel32.dll.RaiseException",
  710. "kernel32.dll.RtlUnwind",
  711. "kernel32.dll.SetConsoleCtrlHandler",
  712. "kernel32.dll.SetEndOfFile",
  713. "kernel32.dll.SetErrorMode",
  714. "kernel32.dll.SetEvent",
  715. "kernel32.dll.SetFileAttributesA",
  716. "kernel32.dll.SetFileTime",
  717. "kernel32.dll.SetHandleCount",
  718. "kernel32.dll.SetLastError",
  719. "kernel32.dll.SetThreadLocale",
  720. "kernel32.dll.SetThreadPriority",
  721. "kernel32.dll.SizeofResource",
  722. "kernel32.dll.Sleep",
  723. "kernel32.dll.TlsAlloc",
  724. "kernel32.dll.TlsFree",
  725. "kernel32.dll.TlsGetValue",
  726. "kernel32.dll.TlsSetValue",
  727. "kernel32.dll.UnhandledExceptionFilter",
  728. "kernel32.dll.VirtualAlloc",
  729. "kernel32.dll.VirtualFree",
  730. "kernel32.dll.VirtualQuery",
  731. "kernel32.dll.WaitForSingleObject",
  732. "kernel32.dll.WideCharToMultiByte",
  733. "kernel32.dll._lopen",
  734. "kernel32.dll.lstrcatA",
  735. "kernel32.dll.lstrcmpiA",
  736. "kernel32.dll.lstrcpyA",
  737. "kernel32.dll.lstrcpynA",
  738. "kernel32.dll.lstrlenA",
  739. "advapi32.dll.RegCreateKeyExA",
  740. "advapi32.dll.RegFlushKey",
  741. "advapi32.dll.RegSetValueExA",
  742. "comctl32.dll.ImageList_Add",
  743. "comctl32.dll.ImageList_BeginDrag",
  744. "comctl32.dll.ImageList_Create",
  745. "comctl32.dll.ImageList_Destroy",
  746. "comctl32.dll.ImageList_DragEnter",
  747. "comctl32.dll.ImageList_DragLeave",
  748. "comctl32.dll.ImageList_DragMove",
  749. "comctl32.dll.ImageList_DragShowNolock",
  750. "comctl32.dll.ImageList_Draw",
  751. "comctl32.dll.ImageList_EndDrag",
  752. "comctl32.dll.ImageList_GetBkColor",
  753. "comctl32.dll.ImageList_GetDragImage",
  754. "comctl32.dll.ImageList_GetIconSize",
  755. "comctl32.dll.ImageList_GetImageCount",
  756. "comctl32.dll.ImageList_Read",
  757. "comctl32.dll.ImageList_Remove",
  758. "comctl32.dll.ImageList_ReplaceIcon",
  759. "comctl32.dll.ImageList_SetBkColor",
  760. "comctl32.dll.ImageList_SetDragCursorImage",
  761. "comctl32.dll.ImageList_SetIconSize",
  762. "comctl32.dll.ImageList_Write",
  763. "comctl32.dll.ImageList_DrawEx",
  764. "gdi32.dll.BitBlt",
  765. "gdi32.dll.CreateBitmap",
  766. "gdi32.dll.CreateBrushIndirect",
  767. "gdi32.dll.CreateCompatibleBitmap",
  768. "gdi32.dll.CreateCompatibleDC",
  769. "gdi32.dll.CreateDIBSection",
  770. "gdi32.dll.CreateDIBitmap",
  771. "gdi32.dll.CreateFontIndirectA",
  772. "gdi32.dll.CreateHalftonePalette",
  773. "gdi32.dll.CreatePalette",
  774. "gdi32.dll.CreatePenIndirect",
  775. "gdi32.dll.CreateSolidBrush",
  776. "gdi32.dll.DeleteDC",
  777. "gdi32.dll.DeleteObject",
  778. "gdi32.dll.ExcludeClipRect",
  779. "gdi32.dll.GetBitmapBits",
  780. "gdi32.dll.GetBrushOrgEx",
  781. "gdi32.dll.GetClipBox",
  782. "gdi32.dll.GetCurrentPositionEx",
  783. "gdi32.dll.GetDCOrgEx",
  784. "gdi32.dll.GetDIBColorTable",
  785. "gdi32.dll.GetDIBits",
  786. "gdi32.dll.GetDeviceCaps",
  787. "gdi32.dll.GetObjectA",
  788. "gdi32.dll.GetPaletteEntries",
  789. "gdi32.dll.GetPixel",
  790. "gdi32.dll.GetStockObject",
  791. "gdi32.dll.GetSystemPaletteEntries",
  792. "gdi32.dll.GetTextExtentPoint32A",
  793. "gdi32.dll.GetTextMetricsA",
  794. "gdi32.dll.GetWindowOrgEx",
  795. "gdi32.dll.IntersectClipRect",
  796. "gdi32.dll.LineTo",
  797. "gdi32.dll.MaskBlt",
  798. "gdi32.dll.MoveToEx",
  799. "gdi32.dll.PatBlt",
  800. "gdi32.dll.RealizePalette",
  801. "gdi32.dll.RectVisible",
  802. "gdi32.dll.RestoreDC",
  803. "gdi32.dll.SaveDC",
  804. "gdi32.dll.SelectObject",
  805. "gdi32.dll.SelectPalette",
  806. "gdi32.dll.SetBkColor",
  807. "gdi32.dll.SetBkMode",
  808. "gdi32.dll.SetBrushOrgEx",
  809. "gdi32.dll.SetDIBColorTable",
  810. "gdi32.dll.SetPixel",
  811. "gdi32.dll.SetROP2",
  812. "gdi32.dll.SetStretchBltMode",
  813. "gdi32.dll.SetTextColor",
  814. "gdi32.dll.SetViewportOrgEx",
  815. "gdi32.dll.SetWindowOrgEx",
  816. "gdi32.dll.StretchBlt",
  817. "gdi32.dll.UnrealizeObject",
  818. "mpr.dll.WNetCloseEnum",
  819. "mpr.dll.WNetEnumResourceA",
  820. "mpr.dll.WNetOpenEnumA",
  821. "ole32.dll.IsEqualGUID",
  822. "oleaut32.dll.SysAllocStringLen",
  823. "oleaut32.dll.SysFreeString",
  824. "oleaut32.dll.SysReAllocStringLen",
  825. "oleaut32.dll.SysStringLen",
  826. "oleaut32.dll.VariantChangeTypeEx",
  827. "oleaut32.dll.VariantClear",
  828. "oleaut32.dll.VariantCopyInd",
  829. "user32.dll.ActivateKeyboardLayout",
  830. "user32.dll.AdjustWindowRectEx",
  831. "user32.dll.BeginPaint",
  832. "user32.dll.CallNextHookEx",
  833. "user32.dll.CallWindowProcA",
  834. "user32.dll.CharLowerA",
  835. "user32.dll.CharLowerBuffA",
  836. "user32.dll.CharNextA",
  837. "user32.dll.CheckMenuItem",
  838. "user32.dll.ClientToScreen",
  839. "user32.dll.CreateIcon",
  840. "user32.dll.CreateMenu",
  841. "user32.dll.CreatePopupMenu",
  842. "user32.dll.CreateWindowExA",
  843. "user32.dll.DefFrameProcA",
  844. "user32.dll.DefMDIChildProcA",
  845. "user32.dll.DefWindowProcA",
  846. "user32.dll.DeleteMenu",
  847. "user32.dll.DestroyCursor",
  848. "user32.dll.DestroyIcon",
  849. "user32.dll.DestroyMenu",
  850. "user32.dll.DestroyWindow",
  851. "user32.dll.DispatchMessageA",
  852. "user32.dll.DrawEdge",
  853. "user32.dll.DrawFrameControl",
  854. "user32.dll.DrawIcon",
  855. "user32.dll.DrawIconEx",
  856. "user32.dll.DrawMenuBar",
  857. "user32.dll.DrawTextA",
  858. "user32.dll.EnableMenuItem",
  859. "user32.dll.EnableScrollBar",
  860. "user32.dll.EnableWindow",
  861. "user32.dll.EndPaint",
  862. "user32.dll.EnumThreadWindows",
  863. "user32.dll.EnumWindows",
  864. "user32.dll.EqualRect",
  865. "user32.dll.FillRect",
  866. "user32.dll.FindWindowA",
  867. "user32.dll.FrameRect",
  868. "user32.dll.GetActiveWindow",
  869. "user32.dll.GetCapture",
  870. "user32.dll.GetClassInfoA",
  871. "user32.dll.GetClientRect",
  872. "user32.dll.GetCursor",
  873. "user32.dll.GetCursorPos",
  874. "user32.dll.GetDC",
  875. "user32.dll.GetDCEx",
  876. "user32.dll.GetDesktopWindow",
  877. "user32.dll.GetFocus",
  878. "user32.dll.GetForegroundWindow",
  879. "user32.dll.GetIconInfo",
  880. "user32.dll.GetKeyNameTextA",
  881. "user32.dll.GetKeyState",
  882. "user32.dll.GetKeyboardLayout",
  883. "user32.dll.GetKeyboardLayoutList",
  884. "user32.dll.GetKeyboardState",
  885. "user32.dll.GetKeyboardType",
  886. "user32.dll.GetLastActivePopup",
  887. "user32.dll.GetMenu",
  888. "user32.dll.GetMenuItemCount",
  889. "user32.dll.GetMenuItemID",
  890. "user32.dll.GetMenuItemInfoA",
  891. "user32.dll.GetMenuState",
  892. "user32.dll.GetMenuStringA",
  893. "user32.dll.GetParent",
  894. "user32.dll.GetPropA",
  895. "user32.dll.GetScrollInfo",
  896. "user32.dll.GetScrollPos",
  897. "user32.dll.GetScrollRange",
  898. "user32.dll.GetSubMenu",
  899. "user32.dll.GetSysColor",
  900. "user32.dll.GetSystemMetrics",
  901. "user32.dll.GetTopWindow",
  902. "user32.dll.GetWindow",
  903. "user32.dll.GetWindowDC",
  904. "user32.dll.GetWindowLongA",
  905. "user32.dll.GetWindowPlacement",
  906. "user32.dll.GetWindowRect",
  907. "user32.dll.GetWindowTextA",
  908. "user32.dll.GetWindowThreadProcessId",
  909. "user32.dll.InflateRect",
  910. "user32.dll.InsertMenuA",
  911. "user32.dll.InsertMenuItemA",
  912. "user32.dll.IntersectRect",
  913. "user32.dll.InvalidateRect",
  914. "user32.dll.IsChild",
  915. "user32.dll.IsDialogMessageA",
  916. "user32.dll.IsIconic",
  917. "user32.dll.IsRectEmpty",
  918. "user32.dll.IsWindow",
  919. "user32.dll.IsWindowEnabled",
  920. "user32.dll.IsWindowVisible",
  921. "user32.dll.IsZoomed",
  922. "user32.dll.KillTimer",
  923. "user32.dll.LoadBitmapA",
  924. "user32.dll.LoadCursorA",
  925. "user32.dll.LoadIconA",
  926. "user32.dll.LoadKeyboardLayoutA",
  927. "user32.dll.LoadStringA",
  928. "user32.dll.MapVirtualKeyA",
  929. "user32.dll.MapWindowPoints",
  930. "user32.dll.MessageBoxA",
  931. "user32.dll.MsgWaitForMultipleObjects",
  932. "user32.dll.OemToCharA",
  933. "user32.dll.OffsetRect",
  934. "user32.dll.PeekMessageA",
  935. "user32.dll.PostMessageA",
  936. "user32.dll.PostQuitMessage",
  937. "user32.dll.PtInRect",
  938. "user32.dll.RegisterClassA",
  939. "user32.dll.RegisterClipboardFormatA",
  940. "user32.dll.RegisterWindowMessageA",
  941. "user32.dll.ReleaseCapture",
  942. "user32.dll.ReleaseDC",
  943. "user32.dll.RemoveMenu",
  944. "user32.dll.RemovePropA",
  945. "user32.dll.ScreenToClient",
  946. "user32.dll.ScrollWindow",
  947. "user32.dll.SendMessageA",
  948. "user32.dll.SetActiveWindow",
  949. "user32.dll.SetCapture",
  950. "user32.dll.SetClassLongA",
  951. "user32.dll.SetCursor",
  952. "user32.dll.SetFocus",
  953. "user32.dll.SetForegroundWindow",
  954. "user32.dll.SetMenu",
  955. "user32.dll.SetMenuItemInfoA",
  956. "user32.dll.SetPropA",
  957. "user32.dll.SetRect",
  958. "user32.dll.SetScrollInfo",
  959. "user32.dll.SetScrollPos",
  960. "user32.dll.SetScrollRange",
  961. "user32.dll.SetTimer",
  962. "user32.dll.SetWindowLongA",
  963. "user32.dll.SetWindowPlacement",
  964. "user32.dll.SetWindowPos",
  965. "user32.dll.SetWindowsHookExA",
  966. "user32.dll.ShowCursor",
  967. "user32.dll.ShowOwnedPopups",
  968. "user32.dll.ShowScrollBar",
  969. "user32.dll.ShowWindow",
  970. "user32.dll.SystemParametersInfoA",
  971. "user32.dll.TrackPopupMenu",
  972. "user32.dll.TranslateMDISysAccel",
  973. "user32.dll.TranslateMessage",
  974. "user32.dll.UnhookWindowsHookEx",
  975. "user32.dll.UnregisterClassA",
  976. "user32.dll.UpdateWindow",
  977. "user32.dll.WaitMessage",
  978. "user32.dll.WinHelpA",
  979. "user32.dll.WindowFromPoint",
  980. "user32.dll.wsprintfA",
  981. "user32.dll.GetSystemMenu",
  982. "wsock32.dll.#103",
  983. "wsock32.dll.#107",
  984. "wsock32.dll.#101",
  985. "wsock32.dll.#108",
  986. "wsock32.dll.#116",
  987. "wsock32.dll.#111",
  988. "wsock32.dll.#115",
  989. "wsock32.dll.#3",
  990. "wsock32.dll.#4",
  991. "wsock32.dll.#52",
  992. "wsock32.dll.#55",
  993. "wsock32.dll.#9",
  994. "wsock32.dll.#10",
  995. "wsock32.dll.#12",
  996. "wsock32.dll.#13",
  997. "wsock32.dll.#15",
  998. "wsock32.dll.#16",
  999. "wsock32.dll.#17",
  1000. "wsock32.dll.#19",
  1001. "wsock32.dll.#20",
  1002. "wsock32.dll.#21",
  1003. "wsock32.dll.#23",
  1004. "wsock32.dll.#2",
  1005. "kernel32.dll.GetDiskFreeSpaceExA",
  1006. "user32.dll.GetMonitorInfoA",
  1007. "user32.dll.EnumDisplayMonitors",
  1008. "comctl32.dll.InitializeFlatSB",
  1009. "comctl32.dll.UninitializeFlatSB",
  1010. "comctl32.dll.FlatSB_GetScrollProp",
  1011. "comctl32.dll.FlatSB_SetScrollProp",
  1012. "comctl32.dll.FlatSB_EnableScrollBar",
  1013. "comctl32.dll.FlatSB_ShowScrollBar",
  1014. "comctl32.dll.FlatSB_GetScrollRange",
  1015. "comctl32.dll.FlatSB_GetScrollInfo",
  1016. "comctl32.dll.FlatSB_GetScrollPos",
  1017. "comctl32.dll.FlatSB_SetScrollPos",
  1018. "comctl32.dll.FlatSB_SetScrollInfo",
  1019. "comctl32.dll.FlatSB_SetScrollRange",
  1020. "kernel32.dll.SortGetHandle",
  1021. "kernel32.dll.SortCloseHandle",
  1022. "uig6a48.tmp.Initiate",
  1023. "kernel32.dll.GetCurrentThread",
  1024. "kernel32.dll.GetCurrentProcess",
  1025. "kernel32.dll.SetPriorityClass",
  1026. "kernel32.dll.ReleaseMutex",
  1027. "kernel32.dll.OutputDebugStringA",
  1028. "kernel32.dll.EnumResourceNamesA",
  1029. "kernel32.dll.EndUpdateResourceA",
  1030. "kernel32.dll.UpdateResourceA",
  1031. "kernel32.dll.BeginUpdateResourceA",
  1032. "kernel32.dll.GlobalMemoryStatusEx",
  1033. "kernel32.dll.GetSystemDefaultUILanguage",
  1034. "kernel32.dll.TerminateProcess",
  1035. "kernel32.dll.lstrcmpA",
  1036. "kernel32.dll.WinExec",
  1037. "advapi32.dll.OpenSCManagerA",
  1038. "advapi32.dll.OpenServiceA",
  1039. "advapi32.dll.CloseServiceHandle",
  1040. "advapi32.dll.DeleteService",
  1041. "advapi32.dll.StartServiceCtrlDispatcherA",
  1042. "iphlpapi.dll.GetIfTable",
  1043. "iphlpapi.dll.GetAdaptersInfo",
  1044. "msvcrt.dll.strstr",
  1045. "msvcrt.dll._except_handler3",
  1046. "msvcrt.dll.strncmp",
  1047. "msvcrt.dll.strcat",
  1048. "msvcrt.dll._controlfp",
  1049. "msvcrt.dll.__set_app_type",
  1050. "msvcrt.dll.__p__fmode",
  1051. "msvcrt.dll.__p__commode",
  1052. "msvcrt.dll._adjust_fdiv",
  1053. "msvcrt.dll.__setusermatherr",
  1054. "msvcrt.dll._initterm",
  1055. "msvcrt.dll.__getmainargs",
  1056. "msvcrt.dll._acmdln",
  1057. "msvcrt.dll._XcptFilter",
  1058. "msvcrt.dll._exit",
  1059. "msvcrt.dll.free",
  1060. "msvcrt.dll.strcmp",
  1061. "msvcrt.dll.??2@YAPAXI@Z",
  1062. "msvcrt.dll.realloc",
  1063. "msvcrt.dll.malloc",
  1064. "msvcrt.dll.strlen",
  1065. "msvcrt.dll.sprintf",
  1066. "msvcrt.dll.memset",
  1067. "msvcrt.dll.memcpy",
  1068. "msvcrt.dll.atoi",
  1069. "msvcrt.dll.strncpy",
  1070. "msvcrt.dll.strcspn",
  1071. "msvcrt.dll.exit",
  1072. "msvcrt.dll.strcpy",
  1073. "msvcrt.dll.localtime",
  1074. "msvcrt.dll.time",
  1075. "msvcrt.dll.??3@YAXPAX@Z",
  1076. "shell32.dll.ShellExecuteA",
  1077. "shell32.dll.SHChangeNotify",
  1078. "shell32.dll.ShellExecuteExA",
  1079. "shlwapi.dll.SHDeleteKeyA",
  1080. "ws2_32.dll.#19",
  1081. "ws2_32.dll.#18",
  1082. "ws2_32.dll.#151",
  1083. "ws2_32.dll.#3",
  1084. "ws2_32.dll.#21",
  1085. "ws2_32.dll.WSAIoctl",
  1086. "ws2_32.dll.#23",
  1087. "ws2_32.dll.#4",
  1088. "ws2_32.dll.#57",
  1089. "ws2_32.dll.#52",
  1090. "ws2_32.dll.#116",
  1091. "ws2_32.dll.#12",
  1092. "ws2_32.dll.#16",
  1093. "ws2_32.dll.#8",
  1094. "ws2_32.dll.#115",
  1095. "ws2_32.dll.#11",
  1096. "ws2_32.dll.#20",
  1097. "ws2_32.dll.#9",
  1098. "ws2_32.dll.htons",
  1099. "advapi32.dll.StartServiceA",
  1100. "advapi32.dll.RegOpenKeyA",
  1101. "advapi32.dll.UnlockServiceDatabase",
  1102. "advapi32.dll.ChangeServiceConfig2A",
  1103. "advapi32.dll.CreateServiceA",
  1104. "advapi32.dll.LockServiceDatabase",
  1105. "kernel32.dll.GetShortPathNameA",
  1106. "kernel32.dll.GetEnvironmentVariableA",
  1107. "ole32.dll.OleInitialize",
  1108. "cryptbase.dll.SystemFunction036",
  1109. "uxtheme.dll.ThemeInitApiHook",
  1110. "user32.dll.IsProcessDPIAware",
  1111. "ole32.dll.CreateBindCtx",
  1112. "ole32.dll.CoTaskMemAlloc",
  1113. "propsys.dll.PSCreateMemoryPropertyStore",
  1114. "propsys.dll.PSPropertyBag_WriteDWORD",
  1115. "ole32.dll.CoGetApartmentType",
  1116. "ole32.dll.CoRegisterInitializeSpy",
  1117. "ole32.dll.CoTaskMemFree",
  1118. "comctl32.dll.#236",
  1119. "oleaut32.dll.#6",
  1120. "ole32.dll.CoGetMalloc",
  1121. "propsys.dll.PSPropertyBag_ReadDWORD",
  1122. "comctl32.dll.#320",
  1123. "ole32.dll.StringFromGUID2",
  1124. "comctl32.dll.#324",
  1125. "comctl32.dll.#323",
  1126. "advapi32.dll.RegEnumKeyW",
  1127. "oleaut32.dll.#2",
  1128. "propsys.dll.PSPropertyBag_ReadBSTR",
  1129. "propsys.dll.PSPropertyBag_ReadStrAlloc",
  1130. "shell32.dll.#102",
  1131. "advapi32.dll.OpenThreadToken",
  1132. "ole32.dll.CoInitializeEx",
  1133. "ole32.dll.CoCreateInstance",
  1134. "advapi32.dll.InitializeSecurityDescriptor",
  1135. "advapi32.dll.SetEntriesInAclW",
  1136. "ntmarta.dll.GetMartaExtensionInterface",
  1137. "advapi32.dll.SetSecurityDescriptorDacl",
  1138. "advapi32.dll.IsTextUnicode",
  1139. "comctl32.dll.#328",
  1140. "comctl32.dll.#334",
  1141. "comctl32.dll.#332",
  1142. "comctl32.dll.#338",
  1143. "comctl32.dll.#339",
  1144. "ole32.dll.CoUninitialize",
  1145. "sechost.dll.ConvertSidToStringSidW",
  1146. "profapi.dll.#104",
  1147. "propsys.dll.#430",
  1148. "advapi32.dll.RegOpenKeyExW",
  1149. "advapi32.dll.RegGetValueW",
  1150. "ole32.dll.CoTaskMemRealloc",
  1151. "propsys.dll.InitPropVariantFromStringAsVector",
  1152. "propsys.dll.PSCoerceToCanonicalValue",
  1153. "propsys.dll.PropVariantToStringAlloc",
  1154. "ole32.dll.PropVariantClear",
  1155. "ole32.dll.CoAllowSetForegroundWindow",
  1156. "kernel32.dll.InitializeSRWLock",
  1157. "kernel32.dll.AcquireSRWLockExclusive",
  1158. "kernel32.dll.AcquireSRWLockShared",
  1159. "kernel32.dll.ReleaseSRWLockExclusive",
  1160. "kernel32.dll.ReleaseSRWLockShared",
  1161. "shell32.dll.SHGetFolderPathW",
  1162. "advapi32.dll.SaferGetPolicyInformation",
  1163. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  1164. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  1165. "comctl32.dll.#386",
  1166. "sfc.dll.SfcIsFileProtected",
  1167. "ntdll.dll.RtlDllShutdownInProgress",
  1168. "comctl32.dll.#329",
  1169. "ole32.dll.OleUninitialize",
  1170. "ole32.dll.CoRevokeInitializeSpy",
  1171. "comctl32.dll.#388",
  1172. "oleaut32.dll.#500",
  1173. "advapi32.dll.UnregisterTraceGuids",
  1174. "comctl32.dll.#321",
  1175. "mjg6f0b.tmp.Initiate",
  1176. "ws2_32.dll.closesocket",
  1177. "advapi32.dll.SetServiceStatus",
  1178. "advapi32.dll.RegisterServiceCtrlHandlerA",
  1179. "ws2_32.dll.gethostbyname",
  1180. "kernel32.dll.SetThreadUILanguage",
  1181. "kernel32.dll.CopyFileExW",
  1182. "kernel32.dll.IsDebuggerPresent",
  1183. "kernel32.dll.SetConsoleInputExeNameW"
  1184. ]
  1185.  
  1186. [*] Static Analysis: {
  1187. "pe": {
  1188. "peid_signatures": null,
  1189. "imports": [
  1190. {
  1191. "imports": [
  1192. {
  1193. "name": "LoadLibraryA",
  1194. "address": "0x40f53c"
  1195. },
  1196. {
  1197. "name": "GetProcAddress",
  1198. "address": "0x40f540"
  1199. },
  1200. {
  1201. "name": "VirtualProtect",
  1202. "address": "0x40f544"
  1203. },
  1204. {
  1205. "name": "VirtualAlloc",
  1206. "address": "0x40f548"
  1207. },
  1208. {
  1209. "name": "VirtualFree",
  1210. "address": "0x40f54c"
  1211. },
  1212. {
  1213. "name": "ExitProcess",
  1214. "address": "0x40f550"
  1215. }
  1216. ],
  1217. "dll": "KERNEL32.DLL"
  1218. },
  1219. {
  1220. "imports": [
  1221. {
  1222. "name": "OpenServiceA",
  1223. "address": "0x40f558"
  1224. }
  1225. ],
  1226. "dll": "ADVAPI32.dll"
  1227. },
  1228. {
  1229. "imports": [
  1230. {
  1231. "name": "GetIfTable",
  1232. "address": "0x40f560"
  1233. }
  1234. ],
  1235. "dll": "iphlpapi.dll"
  1236. },
  1237. {
  1238. "imports": [
  1239. {
  1240. "name": "free",
  1241. "address": "0x40f568"
  1242. }
  1243. ],
  1244. "dll": "MSVCRT.dll"
  1245. },
  1246. {
  1247. "imports": [
  1248. {
  1249. "name": "ShellExecuteA",
  1250. "address": "0x40f570"
  1251. }
  1252. ],
  1253. "dll": "SHELL32.dll"
  1254. },
  1255. {
  1256. "imports": [
  1257. {
  1258. "name": "SHDeleteKeyA",
  1259. "address": "0x40f578"
  1260. }
  1261. ],
  1262. "dll": "SHLWAPI.dll"
  1263. },
  1264. {
  1265. "imports": [
  1266. {
  1267. "name": "wsprintfA",
  1268. "address": "0x40f580"
  1269. }
  1270. ],
  1271. "dll": "USER32.dll"
  1272. },
  1273. {
  1274. "imports": [
  1275. {
  1276. "name": "htons",
  1277. "address": "0x40f588"
  1278. }
  1279. ],
  1280. "dll": "WS2_32.dll"
  1281. }
  1282. ],
  1283. "digital_signers": null,
  1284. "exported_dll_name": null,
  1285. "actual_checksum": "0x000365fc",
  1286. "overlay": {
  1287. "size": "0x0002aff4",
  1288. "offset": "0x00005a00"
  1289. },
  1290. "imagebase": "0x00400000",
  1291. "reported_checksum": "0x00000000",
  1292. "icon_hash": null,
  1293. "entrypoint": "0x00410000",
  1294. "timestamp": "2015-03-25 02:55:20",
  1295. "osversion": "4.0",
  1296. "sections": [
  1297. {
  1298. "name": "UPX0",
  1299. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1300. "virtual_address": "0x00001000",
  1301. "size_of_data": "0x00000000",
  1302. "entropy": "0.00",
  1303. "raw_address": "0x00000400",
  1304. "virtual_size": "0x00009000",
  1305. "characteristics_raw": "0xe0000080"
  1306. },
  1307. {
  1308. "name": "UPX1",
  1309. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1310. "virtual_address": "0x0000a000",
  1311. "size_of_data": "0x00004600",
  1312. "entropy": "7.87",
  1313. "raw_address": "0x00000400",
  1314. "virtual_size": "0x00005000",
  1315. "characteristics_raw": "0xe0000040"
  1316. },
  1317. {
  1318. "name": ".rsrc",
  1319. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1320. "virtual_address": "0x0000f000",
  1321. "size_of_data": "0x00000800",
  1322. "entropy": "3.04",
  1323. "raw_address": "0x00004a00",
  1324. "virtual_size": "0x00001000",
  1325. "characteristics_raw": "0xc0000040"
  1326. },
  1327. {
  1328. "name": ".wtq\t",
  1329. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1330. "virtual_address": "0x00010000",
  1331. "size_of_data": "0x00000800",
  1332. "entropy": "6.38",
  1333. "raw_address": "0x00005200",
  1334. "virtual_size": "0x00001000",
  1335. "characteristics_raw": "0xe0000020"
  1336. }
  1337. ],
  1338. "resources": [],
  1339. "dirents": [
  1340. {
  1341. "virtual_address": "0x00000000",
  1342. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1343. "size": "0x00000000"
  1344. },
  1345. {
  1346. "virtual_address": "0x0000f488",
  1347. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1348. "size": "0x0000020c"
  1349. },
  1350. {
  1351. "virtual_address": "0x0000f000",
  1352. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1353. "size": "0x00000488"
  1354. },
  1355. {
  1356. "virtual_address": "0x00000000",
  1357. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1358. "size": "0x00000000"
  1359. },
  1360. {
  1361. "virtual_address": "0x00000000",
  1362. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1363. "size": "0x00000000"
  1364. },
  1365. {
  1366. "virtual_address": "0x00000000",
  1367. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1368. "size": "0x00000000"
  1369. },
  1370. {
  1371. "virtual_address": "0x00000000",
  1372. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1373. "size": "0x00000000"
  1374. },
  1375. {
  1376. "virtual_address": "0x00000000",
  1377. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1378. "size": "0x00000000"
  1379. },
  1380. {
  1381. "virtual_address": "0x00000000",
  1382. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1383. "size": "0x00000000"
  1384. },
  1385. {
  1386. "virtual_address": "0x00000000",
  1387. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1388. "size": "0x00000000"
  1389. },
  1390. {
  1391. "virtual_address": "0x00000000",
  1392. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1393. "size": "0x00000000"
  1394. },
  1395. {
  1396. "virtual_address": "0x00000000",
  1397. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1398. "size": "0x00000000"
  1399. },
  1400. {
  1401. "virtual_address": "0x00000000",
  1402. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1403. "size": "0x00000000"
  1404. },
  1405. {
  1406. "virtual_address": "0x00000000",
  1407. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1408. "size": "0x00000000"
  1409. },
  1410. {
  1411. "virtual_address": "0x00000000",
  1412. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1413. "size": "0x00000000"
  1414. },
  1415. {
  1416. "virtual_address": "0x00000000",
  1417. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1418. "size": "0x00000000"
  1419. }
  1420. ],
  1421. "exports": [],
  1422. "guest_signers": {},
  1423. "imphash": "3373d1b2b40da2c0ce319c59ccaf75c5",
  1424. "icon_fuzzy": null,
  1425. "icon": null,
  1426. "pdbpath": null,
  1427. "imported_dll_count": 8,
  1428. "versioninfo": []
  1429. }
  1430. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!