API tools faq
paste
paladin316

Exes_ded1b05b0a49319281b31b94d9343ea6_doc_2019-07-02_02_30.json

paladin316
Jul 1st, 2019
2,402
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 65.27 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_ded1b05b0a49319281b31b94d9343ea6.doc"
  7. [*] File Size: 249344
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "9d288fe3ceb9c8173058b70a739c0d90fac7c98d95bd32709eb1160d841b2400"
  10. [*] MD5: "ded1b05b0a49319281b31b94d9343ea6"
  11. [*] SHA1: "8843476b2efc4bfcfb01ffd2d9938a277e31472a"
  12. [*] SHA512: "2e111a93b55479edd75a5afe1b4ef06ba61a737f24189e7e66408bd5994f5476c5fb72f2cb17e8e473911d53658e549f49f529e1dc0921d65f2e6b0b32bd0492"
  13. [*] CRC32: "0BBE6F8C"
  14. [*] SSDEEP: "6144:dfHuG+GzzxVWYgKW9k9R8rQ/qgBoQjxX:dvuBgxVfgKt9KU/TBoU5"
  15.  
  16. [*] Process Execution: [
  17. "Exes_ded1b05b0a49319281b31b94d9343ea6.doc",
  18. "cmd.exe",
  19. "powershell.exe",
  20. "cmd.exe",
  21. "sc.exe",
  22. "cmd.exe",
  23. "sc.exe",
  24. "cmd.exe",
  25. "sc.exe",
  26. "cmd.exe",
  27. "sc.exe",
  28. "cmd.exe",
  29. "powershell.exe",
  30. "svchost.exe",
  31. "services.exe",
  32. "lsass.exe",
  33. "taskhost.exe",
  34. "svchost.exe",
  35. "WerFault.exe"
  36. ]
  37.  
  38. [*] Signatures Detected: [
  39. {
  40. "Description": "At least one process apparently crashed during execution",
  41. "Details": []
  42. },
  43. {
  44. "Description": "Creates RWX memory",
  45. "Details": []
  46. },
  47. {
  48. "Description": "Possible date expiration check, exits too soon after checking local time",
  49. "Details": [
  50. {
  51. "process": "cmd.exe, PID 2920"
  52. }
  53. ]
  54. },
  55. {
  56. "Description": "A process created a hidden window",
  57. "Details": [
  58. {
  59. "Process": "Exes_ded1b05b0a49319281b31b94d9343ea6.doc -> cmd"
  60. },
  61. {
  62. "Process": "Exes_ded1b05b0a49319281b31b94d9343ea6.doc -> cmd"
  63. },
  64. {
  65. "Process": "Exes_ded1b05b0a49319281b31b94d9343ea6.doc -> cmd"
  66. }
  67. ]
  68. },
  69. {
  70. "Description": "The binary likely contains encrypted or compressed data.",
  71. "Details": [
  72. {
  73. "section": "name: .data, entropy: 8.00, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00029c00, virtual_size: 0x0002a17c"
  74. }
  75. ]
  76. },
  77. {
  78. "Description": "Attempts to stop active services",
  79. "Details": [
  80. {
  81. "servicename": "WinDefend"
  82. }
  83. ]
  84. },
  85. {
  86. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  87. "Details": [
  88. {
  89. "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 12278625 times"
  90. }
  91. ]
  92. },
  93. {
  94. "Description": "Spoofs its process name and/or associated pathname to appear as a legitimate process",
  95. "Details": [
  96. {
  97. "modified_name": "svchost.exe",
  98. "modified_path": "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_ded1b05b0a49319281b31b94d9343ea6.doc",
  99. "original_name": "svchost.exe",
  100. "original_path": "C:\\Windows\\system32\\svchost.exe"
  101. }
  102. ]
  103. },
  104. {
  105. "Description": "Creates a hidden or system file",
  106. "Details": [
  107. {
  108. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1051622.TMP"
  109. }
  110. ]
  111. },
  112. {
  113. "Description": "File has been identified by 20 Antiviruses on VirusTotal as malicious",
  114. "Details": [
  115. {
  116. "FireEye": "Generic.mg.ded1b05b0a493192"
  117. },
  118. {
  119. "Qihoo-360": "QVM41.1.Malware.Gen"
  120. },
  121. {
  122. "McAfee": "Artemis!DED1B05B0A49"
  123. },
  124. {
  125. "Alibaba": "Trojan:Win32/Kryptik.262dcaed"
  126. },
  127. {
  128. "ESET-NOD32": "a variant of Win32/Kryptik.GTHE"
  129. },
  130. {
  131. "APEX": "Malicious"
  132. },
  133. {
  134. "Paloalto": "generic.ml"
  135. },
  136. {
  137. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  138. },
  139. {
  140. "Avast": "FileRepMalware"
  141. },
  142. {
  143. "VIPRE": "Trojan.Win32.Generic.pak!cobra"
  144. },
  145. {
  146. "Invincea": "heuristic"
  147. },
  148. {
  149. "McAfee-GW-Edition": "BehavesLike.Win32.Ramnit.dc"
  150. },
  151. {
  152. "Trapmine": "malicious.high.ml.score"
  153. },
  154. {
  155. "Webroot": "W32.Trojan.Gen"
  156. },
  157. {
  158. "Microsoft": "Trojan:Win32/MereTam.A"
  159. },
  160. {
  161. "Endgame": "malicious (high confidence)"
  162. },
  163. {
  164. "Acronis": "suspicious"
  165. },
  166. {
  167. "SentinelOne": "DFI - Malicious PE"
  168. },
  169. {
  170. "AVG": "FileRepMalware"
  171. },
  172. {
  173. "CrowdStrike": "win/malicious_confidence_100% (W)"
  174. }
  175. ]
  176. },
  177. {
  178. "Description": "Attempts to disable Windows Defender",
  179. "Details": []
  180. }
  181. ]
  182.  
  183. [*] Started Service: [
  184. "KeyIso",
  185. "WerSvc"
  186. ]
  187.  
  188. [*] Executed Commands: [
  189. "\"C:\\Windows\\System32\\cmd.exe\" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true",
  190. "cmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true",
  191. "\"C:\\Windows\\System32\\cmd.exe\" /c sc stop WinDefend",
  192. "cmd /c sc stop WinDefend",
  193. "\"C:\\Windows\\System32\\cmd.exe\" /c sc delete WinDefend",
  194. "cmd /c sc delete WinDefend",
  195. "C:\\Windows\\system32\\cmd.exe /c sc stop WinDefend",
  196. "C:\\Windows\\system32\\cmd.exe /c sc delete WinDefend",
  197. "C:\\Windows\\system32\\cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true",
  198. "C:\\Windows\\system32\\svchost.exe",
  199. "powershell Set-MpPreference -DisableRealtimeMonitoring $true",
  200. "sc stop WinDefend",
  201. "sc delete WinDefend",
  202. "C:\\Windows\\system32\\lsass.exe",
  203. "taskhost.exe $(Arg0)",
  204. "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
  205. "C:\\Windows\\system32\\WerFault.exe -u -p 2548 -s 288"
  206. ]
  207.  
  208. [*] Mutexes: [
  209. "Local\\ZoneAttributeCacheCounterMutex",
  210. "Local\\ZonesCacheCounterMutex",
  211. "Local\\ZonesLockedCacheCounterMutex",
  212. "Global\\CLR_CASOFF_MUTEX",
  213. "Global\\838B6C9EB27932960",
  214. "Local\\WERReportingForProcess2548",
  215. "Global\\\\xe5\\x88\\x90\\xc2\\xa9"
  216. ]
  217.  
  218. [*] Modified Files: [
  219. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-0000000000-0000000000-0000000000-1000\\00000000-0000-0000-0000-000000000000b_00000000-0000-0000-0000-000000000000",
  220. "C:\\Users\\user\\AppData\\Local\\Temp\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  221. "\\??\\PIPE\\srvsvc",
  222. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\4Z6ZKBV2VOZ0KWA42HEP.temp",
  223. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1051622.TMP",
  224. "C:\\Windows\\SysWOW64\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  225. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\E2I67M19ECVXAQAAL5K6.temp",
  226. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms",
  227. "C:\\Windows\\sysnative\\LogFiles\\Scm\\4963ad21-c4a5-42a5-b9bd-e441d57204fe",
  228. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER9FCD.tmp.appcompat.txt"
  229. ]
  230.  
  231. [*] Deleted Files: [
  232. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1051622.TMP",
  233. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.1616.17141734",
  234. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1616.17141750",
  235. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.1616.17141750",
  236. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\E2I67M19ECVXAQAAL5K6.temp",
  237. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2380.17166015",
  238. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2380.17166015",
  239. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2380.17166031",
  240. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER9FCD.tmp",
  241. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER9FCD.tmp.appcompat.txt"
  242. ]
  243.  
  244. [*] Modified Registry Keys: [
  245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  247. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender",
  248. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\DisableAntiSpyware",
  249. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection",
  250. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring",
  251. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection",
  252. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnRealtimeEnable",
  253. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableIOAVProtection",
  254. "DisableNotifications",
  255. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  256. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WerSvc\\Type",
  257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent",
  258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent"
  259. ]
  260.  
  261. [*] Deleted Registry Keys: [
  262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  263. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  265. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  266. ]
  267.  
  268. [*] DNS Communications: []
  269.  
  270. [*] Domains: []
  271.  
  272. [*] Network Communication - ICMP: []
  273.  
  274. [*] Network Communication - HTTP: []
  275.  
  276. [*] Network Communication - SMTP: []
  277.  
  278. [*] Network Communication - Hosts: []
  279.  
  280. [*] Network Communication - IRC: []
  281.  
  282. [*] Static Analysis: {
  283. "pe": {
  284. "peid_signatures": null,
  285. "imports": [
  286. {
  287. "imports": [
  288. {
  289. "name": "SetUnhandledExceptionFilter",
  290. "address": "0x404034"
  291. },
  292. {
  293. "name": "UnhandledExceptionFilter",
  294. "address": "0x404038"
  295. },
  296. {
  297. "name": "GetCurrentProcess",
  298. "address": "0x40403c"
  299. },
  300. {
  301. "name": "TerminateProcess",
  302. "address": "0x404040"
  303. },
  304. {
  305. "name": "IsDebuggerPresent",
  306. "address": "0x404044"
  307. },
  308. {
  309. "name": "InterlockedCompareExchange",
  310. "address": "0x404048"
  311. },
  312. {
  313. "name": "Sleep",
  314. "address": "0x40404c"
  315. },
  316. {
  317. "name": "InterlockedExchange",
  318. "address": "0x404050"
  319. },
  320. {
  321. "name": "QueryPerformanceCounter",
  322. "address": "0x404054"
  323. },
  324. {
  325. "name": "GetTickCount",
  326. "address": "0x404058"
  327. },
  328. {
  329. "name": "GetCurrentThreadId",
  330. "address": "0x40405c"
  331. },
  332. {
  333. "name": "GetCurrentProcessId",
  334. "address": "0x404060"
  335. },
  336. {
  337. "name": "MapViewOfFile",
  338. "address": "0x404064"
  339. },
  340. {
  341. "name": "CreateFileA",
  342. "address": "0x404068"
  343. },
  344. {
  345. "name": "GetFileSize",
  346. "address": "0x40406c"
  347. },
  348. {
  349. "name": "CloseHandle",
  350. "address": "0x404070"
  351. },
  352. {
  353. "name": "ReadFile",
  354. "address": "0x404074"
  355. },
  356. {
  357. "name": "CreateFileMappingW",
  358. "address": "0x404078"
  359. },
  360. {
  361. "name": "GetStartupInfoA",
  362. "address": "0x40407c"
  363. },
  364. {
  365. "name": "GetSystemTimeAsFileTime",
  366. "address": "0x404080"
  367. }
  368. ],
  369. "dll": "KERNEL32.dll"
  370. },
  371. {
  372. "imports": [
  373. {
  374. "name": "CreateWindowExA",
  375. "address": "0x404114"
  376. },
  377. {
  378. "name": "EndDialog",
  379. "address": "0x404118"
  380. },
  381. {
  382. "name": "ReleaseCapture",
  383. "address": "0x40411c"
  384. },
  385. {
  386. "name": "DefWindowProcA",
  387. "address": "0x404120"
  388. },
  389. {
  390. "name": "SetCapture",
  391. "address": "0x404124"
  392. },
  393. {
  394. "name": "EndPaint",
  395. "address": "0x404128"
  396. },
  397. {
  398. "name": "BeginPaint",
  399. "address": "0x40412c"
  400. },
  401. {
  402. "name": "SetWindowPos",
  403. "address": "0x404130"
  404. },
  405. {
  406. "name": "DialogBoxParamA",
  407. "address": "0x404134"
  408. },
  409. {
  410. "name": "InvalidateRect",
  411. "address": "0x404138"
  412. },
  413. {
  414. "name": "ShowCursor",
  415. "address": "0x40413c"
  416. },
  417. {
  418. "name": "SetCursor",
  419. "address": "0x404140"
  420. },
  421. {
  422. "name": "LoadCursorA",
  423. "address": "0x404144"
  424. },
  425. {
  426. "name": "DestroyWindow",
  427. "address": "0x404148"
  428. },
  429. {
  430. "name": "GetMessageA",
  431. "address": "0x40414c"
  432. },
  433. {
  434. "name": "TranslateMessage",
  435. "address": "0x404150"
  436. },
  437. {
  438. "name": "DispatchMessageA",
  439. "address": "0x404154"
  440. },
  441. {
  442. "name": "LoadIconA",
  443. "address": "0x404158"
  444. },
  445. {
  446. "name": "RegisterClassA",
  447. "address": "0x40415c"
  448. },
  449. {
  450. "name": "PostQuitMessage",
  451. "address": "0x404160"
  452. },
  453. {
  454. "name": "ShowWindow",
  455. "address": "0x404164"
  456. },
  457. {
  458. "name": "UpdateWindow",
  459. "address": "0x404168"
  460. },
  461. {
  462. "name": "MessageBoxA",
  463. "address": "0x40416c"
  464. },
  465. {
  466. "name": "GetClientRect",
  467. "address": "0x404170"
  468. },
  469. {
  470. "name": "GetSystemMetrics",
  471. "address": "0x404174"
  472. },
  473. {
  474. "name": "ClientToScreen",
  475. "address": "0x404178"
  476. },
  477. {
  478. "name": "WindowFromPoint",
  479. "address": "0x40417c"
  480. },
  481. {
  482. "name": "GetDlgCtrlID",
  483. "address": "0x404180"
  484. },
  485. {
  486. "name": "GetParent",
  487. "address": "0x404184"
  488. },
  489. {
  490. "name": "ScreenToClient",
  491. "address": "0x404188"
  492. },
  493. {
  494. "name": "MoveWindow",
  495. "address": "0x40418c"
  496. },
  497. {
  498. "name": "GetWindowRect",
  499. "address": "0x404190"
  500. },
  501. {
  502. "name": "GetDlgItem",
  503. "address": "0x404194"
  504. },
  505. {
  506. "name": "GetMenu",
  507. "address": "0x404198"
  508. }
  509. ],
  510. "dll": "USER32.dll"
  511. },
  512. {
  513. "imports": [
  514. {
  515. "name": "CreateCompatibleDC",
  516. "address": "0x404010"
  517. },
  518. {
  519. "name": "SetDIBitsToDevice",
  520. "address": "0x404014"
  521. },
  522. {
  523. "name": "SelectObject",
  524. "address": "0x404018"
  525. },
  526. {
  527. "name": "SetStretchBltMode",
  528. "address": "0x40401c"
  529. },
  530. {
  531. "name": "StretchDIBits",
  532. "address": "0x404020"
  533. },
  534. {
  535. "name": "GetStockObject",
  536. "address": "0x404024"
  537. },
  538. {
  539. "name": "CreateDIBitmap",
  540. "address": "0x404028"
  541. },
  542. {
  543. "name": "BitBlt",
  544. "address": "0x40402c"
  545. }
  546. ],
  547. "dll": "GDI32.dll"
  548. },
  549. {
  550. "imports": [
  551. {
  552. "name": "GetOpenFileNameA",
  553. "address": "0x404008"
  554. }
  555. ],
  556. "dll": "COMDLG32.dll"
  557. },
  558. {
  559. "imports": [
  560. {
  561. "name": "CryptAcquireContextA",
  562. "address": "0x404000"
  563. }
  564. ],
  565. "dll": "ADVAPI32.dll"
  566. },
  567. {
  568. "imports": [
  569. {
  570. "name": "_controlfp_s",
  571. "address": "0x404098"
  572. },
  573. {
  574. "name": "_invoke_watson",
  575. "address": "0x40409c"
  576. },
  577. {
  578. "name": "_except_handler4_common",
  579. "address": "0x4040a0"
  580. },
  581. {
  582. "name": "_decode_pointer",
  583. "address": "0x4040a4"
  584. },
  585. {
  586. "name": "_onexit",
  587. "address": "0x4040a8"
  588. },
  589. {
  590. "name": "_lock",
  591. "address": "0x4040ac"
  592. },
  593. {
  594. "name": "__dllonexit",
  595. "address": "0x4040b0"
  596. },
  597. {
  598. "name": "_unlock",
  599. "address": "0x4040b4"
  600. },
  601. {
  602. "name": "?terminate@@YAXXZ",
  603. "address": "0x4040b8"
  604. },
  605. {
  606. "name": "_crt_debugger_hook",
  607. "address": "0x4040bc"
  608. },
  609. {
  610. "name": "__set_app_type",
  611. "address": "0x4040c0"
  612. },
  613. {
  614. "name": "_encode_pointer",
  615. "address": "0x4040c4"
  616. },
  617. {
  618. "name": "__p__fmode",
  619. "address": "0x4040c8"
  620. },
  621. {
  622. "name": "__p__commode",
  623. "address": "0x4040cc"
  624. },
  625. {
  626. "name": "_adjust_fdiv",
  627. "address": "0x4040d0"
  628. },
  629. {
  630. "name": "__setusermatherr",
  631. "address": "0x4040d4"
  632. },
  633. {
  634. "name": "rand",
  635. "address": "0x4040d8"
  636. },
  637. {
  638. "name": "malloc",
  639. "address": "0x4040dc"
  640. },
  641. {
  642. "name": "free",
  643. "address": "0x4040e0"
  644. },
  645. {
  646. "name": "_amsg_exit",
  647. "address": "0x4040e4"
  648. },
  649. {
  650. "name": "__getmainargs",
  651. "address": "0x4040e8"
  652. },
  653. {
  654. "name": "_cexit",
  655. "address": "0x4040ec"
  656. },
  657. {
  658. "name": "_exit",
  659. "address": "0x4040f0"
  660. },
  661. {
  662. "name": "_XcptFilter",
  663. "address": "0x4040f4"
  664. },
  665. {
  666. "name": "_ismbblead",
  667. "address": "0x4040f8"
  668. },
  669. {
  670. "name": "exit",
  671. "address": "0x4040fc"
  672. },
  673. {
  674. "name": "_acmdln",
  675. "address": "0x404100"
  676. },
  677. {
  678. "name": "_initterm",
  679. "address": "0x404104"
  680. },
  681. {
  682. "name": "_initterm_e",
  683. "address": "0x404108"
  684. },
  685. {
  686. "name": "_configthreadlocale",
  687. "address": "0x40410c"
  688. }
  689. ],
  690. "dll": "MSVCR90.dll"
  691. },
  692. {
  693. "imports": [
  694. {
  695. "name": "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  696. "address": "0x404088"
  697. },
  698. {
  699. "name": "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z",
  700. "address": "0x40408c"
  701. },
  702. {
  703. "name": "??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  704. "address": "0x404090"
  705. }
  706. ],
  707. "dll": "MSVCP90.dll"
  708. }
  709. ],
  710. "digital_signers": null,
  711. "exported_dll_name": null,
  712. "actual_checksum": "0x0004521c",
  713. "overlay": null,
  714. "imagebase": "0x00400000",
  715. "reported_checksum": "0x0004521c",
  716. "icon_hash": null,
  717. "entrypoint": "0x00403477",
  718. "timestamp": "2019-07-01 06:45:17",
  719. "osversion": "5.0",
  720. "sections": [
  721. {
  722. "name": ".text",
  723. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  724. "virtual_address": "0x00001000",
  725. "size_of_data": "0x00002a00",
  726. "entropy": "6.26",
  727. "raw_address": "0x00000400",
  728. "virtual_size": "0x000029be",
  729. "characteristics_raw": "0x60000020"
  730. },
  731. {
  732. "name": ".rdata",
  733. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  734. "virtual_address": "0x00004000",
  735. "size_of_data": "0x00004200",
  736. "entropy": "6.08",
  737. "raw_address": "0x00002e00",
  738. "virtual_size": "0x00004096",
  739. "characteristics_raw": "0x40000040"
  740. },
  741. {
  742. "name": ".data",
  743. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  744. "virtual_address": "0x00009000",
  745. "size_of_data": "0x00029c00",
  746. "entropy": "8.00",
  747. "raw_address": "0x00007000",
  748. "virtual_size": "0x0002a17c",
  749. "characteristics_raw": "0xc0000040"
  750. },
  751. {
  752. "name": ".rsrc",
  753. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  754. "virtual_address": "0x00034000",
  755. "size_of_data": "0x0000ba00",
  756. "entropy": "5.49",
  757. "raw_address": "0x00030c00",
  758. "virtual_size": "0x0000b8ea",
  759. "characteristics_raw": "0x40000040"
  760. },
  761. {
  762. "name": ".reloc",
  763. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  764. "virtual_address": "0x00040000",
  765. "size_of_data": "0x00000800",
  766. "entropy": "5.10",
  767. "raw_address": "0x0003c600",
  768. "virtual_size": "0x000007ba",
  769. "characteristics_raw": "0x42000040"
  770. }
  771. ],
  772. "resources": [],
  773. "dirents": [
  774. {
  775. "virtual_address": "0x00000000",
  776. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  777. "size": "0x00000000"
  778. },
  779. {
  780. "virtual_address": "0x0000770c",
  781. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  782. "size": "0x000000a0"
  783. },
  784. {
  785. "virtual_address": "0x00034000",
  786. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  787. "size": "0x0000b8ea"
  788. },
  789. {
  790. "virtual_address": "0x00000000",
  791. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  792. "size": "0x00000000"
  793. },
  794. {
  795. "virtual_address": "0x00000000",
  796. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  797. "size": "0x00000000"
  798. },
  799. {
  800. "virtual_address": "0x00040000",
  801. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  802. "size": "0x00000524"
  803. },
  804. {
  805. "virtual_address": "0x00000000",
  806. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  807. "size": "0x00000000"
  808. },
  809. {
  810. "virtual_address": "0x00000000",
  811. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  812. "size": "0x00000000"
  813. },
  814. {
  815. "virtual_address": "0x00000000",
  816. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  817. "size": "0x00000000"
  818. },
  819. {
  820. "virtual_address": "0x00000000",
  821. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  822. "size": "0x00000000"
  823. },
  824. {
  825. "virtual_address": "0x00007640",
  826. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  827. "size": "0x00000040"
  828. },
  829. {
  830. "virtual_address": "0x00000000",
  831. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  832. "size": "0x00000000"
  833. },
  834. {
  835. "virtual_address": "0x00004000",
  836. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  837. "size": "0x000001a0"
  838. },
  839. {
  840. "virtual_address": "0x00000000",
  841. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  842. "size": "0x00000000"
  843. },
  844. {
  845. "virtual_address": "0x00000000",
  846. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  847. "size": "0x00000000"
  848. },
  849. {
  850. "virtual_address": "0x00000000",
  851. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  852. "size": "0x00000000"
  853. }
  854. ],
  855. "exports": [],
  856. "guest_signers": {},
  857. "imphash": "e7da0e6cc5faa043f26b08286ff6fc41",
  858. "icon_fuzzy": null,
  859. "icon": null,
  860. "pdbpath": null,
  861. "imported_dll_count": 7,
  862. "versioninfo": []
  863. }
  864. }
  865.  
  866. [*] Resolved APIs: [
  867. "cryptsp.dll.CryptAcquireContextA",
  868. "kernel32.dll.VirtualAlloc",
  869. "ntdll.dll.memcpy",
  870. "kernel32.dll.GetCurrentProcess",
  871. "kernel32.dll.CloseHandle",
  872. "advapi32.dll.OpenProcessToken",
  873. "advapi32.dll.GetTokenInformation",
  874. "kernel32.dll.Wow64EnableWow64FsRedirection",
  875. "advapi32.dll.RegCloseKey",
  876. "advapi32.dll.RegCreateKeyW",
  877. "advapi32.dll.RegOpenKeyExW",
  878. "advapi32.dll.RegSetValueExW",
  879. "shell32.dll.ShellExecuteA",
  880. "ole32.dll.OleInitialize",
  881. "cryptbase.dll.SystemFunction036",
  882. "uxtheme.dll.ThemeInitApiHook",
  883. "user32.dll.IsProcessDPIAware",
  884. "ole32.dll.CreateBindCtx",
  885. "ole32.dll.CoTaskMemAlloc",
  886. "propsys.dll.PSCreateMemoryPropertyStore",
  887. "propsys.dll.PSPropertyBag_WriteDWORD",
  888. "ole32.dll.CoGetApartmentType",
  889. "ole32.dll.CoRegisterInitializeSpy",
  890. "ole32.dll.CoTaskMemFree",
  891. "comctl32.dll.#236",
  892. "oleaut32.dll.#6",
  893. "ole32.dll.CoGetMalloc",
  894. "propsys.dll.PSPropertyBag_ReadDWORD",
  895. "propsys.dll.PSPropertyBag_ReadGUID",
  896. "comctl32.dll.#320",
  897. "comctl32.dll.#324",
  898. "comctl32.dll.#323",
  899. "advapi32.dll.RegEnumKeyW",
  900. "advapi32.dll.OpenThreadToken",
  901. "ole32.dll.StringFromGUID2",
  902. "apphelp.dll.ApphelpCheckShellObject",
  903. "ole32.dll.CoCreateInstance",
  904. "urlmon.dll.CreateUri",
  905. "kernel32.dll.InitializeSRWLock",
  906. "kernel32.dll.AcquireSRWLockExclusive",
  907. "kernel32.dll.AcquireSRWLockShared",
  908. "kernel32.dll.ReleaseSRWLockExclusive",
  909. "kernel32.dll.ReleaseSRWLockShared",
  910. "comctl32.dll.#328",
  911. "comctl32.dll.#334",
  912. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  913. "oleaut32.dll.#2",
  914. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  915. "shell32.dll.#102",
  916. "comctl32.dll.#332",
  917. "propsys.dll.PSPropertyBag_ReadStrAlloc",
  918. "comctl32.dll.#386",
  919. "ole32.dll.CoInitializeEx",
  920. "advapi32.dll.InitializeSecurityDescriptor",
  921. "advapi32.dll.SetEntriesInAclW",
  922. "ntmarta.dll.GetMartaExtensionInterface",
  923. "advapi32.dll.SetSecurityDescriptorDacl",
  924. "advapi32.dll.IsTextUnicode",
  925. "comctl32.dll.#338",
  926. "comctl32.dll.#339",
  927. "ole32.dll.CoUninitialize",
  928. "sechost.dll.ConvertSidToStringSidW",
  929. "profapi.dll.#104",
  930. "propsys.dll.#430",
  931. "advapi32.dll.RegGetValueW",
  932. "ole32.dll.CoTaskMemRealloc",
  933. "propsys.dll.InitPropVariantFromStringAsVector",
  934. "propsys.dll.PSCoerceToCanonicalValue",
  935. "propsys.dll.PropVariantToStringAlloc",
  936. "ole32.dll.PropVariantClear",
  937. "ole32.dll.CoAllowSetForegroundWindow",
  938. "shell32.dll.SHGetFolderPathW",
  939. "advapi32.dll.SaferGetPolicyInformation",
  940. "ntdll.dll.RtlDllShutdownInProgress",
  941. "comctl32.dll.#329",
  942. "ole32.dll.OleUninitialize",
  943. "ole32.dll.CoRevokeInitializeSpy",
  944. "comctl32.dll.#388",
  945. "oleaut32.dll.#500",
  946. "advapi32.dll.CryptAcquireContextA",
  947. "advapi32.dll.CryptImportKey",
  948. "advapi32.dll.CryptEncrypt",
  949. "cryptsp.dll.CryptImportKey",
  950. "cryptbase.dll.SystemFunction040",
  951. "cryptbase.dll.SystemFunction041",
  952. "cryptsp.dll.CryptEncrypt",
  953. "advapi32.dll.UnregisterTraceGuids",
  954. "comctl32.dll.#321",
  955. "kernel32.dll.SetThreadUILanguage",
  956. "kernel32.dll.CopyFileExW",
  957. "kernel32.dll.IsDebuggerPresent",
  958. "kernel32.dll.SetConsoleInputExeNameW",
  959. "kernel32.dll.SortGetHandle",
  960. "kernel32.dll.SortCloseHandle",
  961. "shell32.dll.#66",
  962. "comctl32.dll.#385",
  963. "comctl32.dll.#336",
  964. "comctl32.dll.#333",
  965. "linkinfo.dll.IsValidLinkInfo",
  966. "propsys.dll.#417",
  967. "propsys.dll.PSGetNameFromPropertyKey",
  968. "propsys.dll.PSStringFromPropertyKey",
  969. "propsys.dll.InitVariantFromBuffer",
  970. "oleaut32.dll.#9",
  971. "propsys.dll.PropVariantToGUID",
  972. "linkinfo.dll.CreateLinkInfoW",
  973. "user32.dll.IsCharAlphaW",
  974. "user32.dll.CharPrevW",
  975. "ntshrui.dll.GetNetResourceFromLocalPathW",
  976. "srvcli.dll.NetShareEnum",
  977. "cscapi.dll.CscNetApiGetInterface",
  978. "slc.dll.SLGetWindowsInformationDWORD",
  979. "shlwapi.dll.PathRemoveFileSpecW",
  980. "linkinfo.dll.DestroyLinkInfo",
  981. "propsys.dll.PropVariantToBoolean",
  982. "cryptsp.dll.CryptAcquireContextW",
  983. "cryptsp.dll.CryptGenRandom",
  984. "cryptsp.dll.CryptReleaseContext",
  985. "advapi32.dll.GetSecurityInfo",
  986. "advapi32.dll.SetSecurityInfo",
  987. "advapi32.dll.GetSecurityDescriptorControl",
  988. "advapi32.dll.RegQueryInfoKeyW",
  989. "advapi32.dll.RegEnumKeyExW",
  990. "advapi32.dll.RegEnumValueW",
  991. "advapi32.dll.RegQueryValueExW",
  992. "shlwapi.dll.UrlIsW",
  993. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  994. "msvcrt.dll._set_error_mode",
  995. "msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z",
  996. "kernel32.dll.FindActCtxSectionStringW",
  997. "kernel32.dll.GetSystemWindowsDirectoryW",
  998. "mscoree.dll.GetProcessExecutableHeap",
  999. "mscorwks.dll.DllGetClassObjectInternal",
  1000. "mscorwks.dll.GetCLRFunction",
  1001. "advapi32.dll.RegisterTraceGuidsW",
  1002. "advapi32.dll.GetTraceLoggerHandle",
  1003. "advapi32.dll.GetTraceEnableLevel",
  1004. "advapi32.dll.GetTraceEnableFlags",
  1005. "advapi32.dll.TraceEvent",
  1006. "mscoree.dll.IEE",
  1007. "mscorwks.dll.IEE",
  1008. "mscoree.dll.GetStartupFlags",
  1009. "mscoree.dll.GetHostConfigurationFile",
  1010. "mscoree.dll.GetCORSystemDirectory",
  1011. "ntdll.dll.RtlVirtualUnwind",
  1012. "kernel32.dll.IsWow64Process",
  1013. "advapi32.dll.AllocateAndInitializeSid",
  1014. "advapi32.dll.InitializeAcl",
  1015. "advapi32.dll.AddAccessAllowedAce",
  1016. "advapi32.dll.FreeSid",
  1017. "kernel32.dll.SetThreadStackGuarantee",
  1018. "kernel32.dll.FlsSetValue",
  1019. "kernel32.dll.FlsGetValue",
  1020. "kernel32.dll.FlsAlloc",
  1021. "kernel32.dll.FlsFree",
  1022. "kernel32.dll.AddVectoredContinueHandler",
  1023. "kernel32.dll.RemoveVectoredContinueHandler",
  1024. "advapi32.dll.ConvertSidToStringSidW",
  1025. "kernel32.dll.FlushProcessWriteBuffers",
  1026. "kernel32.dll.GetWriteWatch",
  1027. "kernel32.dll.ResetWriteWatch",
  1028. "kernel32.dll.CreateMemoryResourceNotification",
  1029. "kernel32.dll.QueryMemoryResourceNotification",
  1030. "kernel32.dll.GlobalMemoryStatusEx",
  1031. "ole32.dll.CoGetContextToken",
  1032. "oleaut32.dll.#149",
  1033. "kernel32.dll.GetUserDefaultUILanguage",
  1034. "kernel32.dll.GetVersionExW",
  1035. "kernel32.dll.GetFullPathNameW",
  1036. "kernel32.dll.SetErrorMode",
  1037. "kernel32.dll.GetFileAttributesExW",
  1038. "version.dll.GetFileVersionInfoSizeW",
  1039. "version.dll.GetFileVersionInfoW",
  1040. "version.dll.VerQueryValueW",
  1041. "kernel32.dll.lstrlen",
  1042. "kernel32.dll.lstrlenW",
  1043. "mscoree.dll.ND_RI2",
  1044. "kernel32.dll.lstrcpy",
  1045. "kernel32.dll.lstrcpyW",
  1046. "version.dll.VerLanguageNameW",
  1047. "kernel32.dll.GetCurrentProcessId",
  1048. "advapi32.dll.LookupPrivilegeValueW",
  1049. "advapi32.dll.AdjustTokenPrivileges",
  1050. "kernel32.dll.OpenProcess",
  1051. "psapi.dll.EnumProcessModules",
  1052. "psapi.dll.GetModuleInformation",
  1053. "psapi.dll.GetModuleBaseNameW",
  1054. "psapi.dll.GetModuleFileNameExW",
  1055. "kernel32.dll.GetExitCodeProcess",
  1056. "ntdll.dll.NtQuerySystemInformation",
  1057. "user32.dll.EnumWindows",
  1058. "user32.dll.GetWindowThreadProcessId",
  1059. "kernel32.dll.WerSetFlags",
  1060. "kernel32.dll.SetThreadPreferredUILanguages",
  1061. "kernel32.dll.GetThreadPreferredUILanguages",
  1062. "kernel32.dll.GetUserDefaultLocaleName",
  1063. "kernel32.dll.GetEnvironmentVariableW",
  1064. "advapi32.dll.CryptReleaseContext",
  1065. "advapi32.dll.CryptCreateHash",
  1066. "advapi32.dll.CryptDestroyHash",
  1067. "advapi32.dll.CryptHashData",
  1068. "advapi32.dll.CryptGetHashParam",
  1069. "advapi32.dll.CryptExportKey",
  1070. "advapi32.dll.CryptGenKey",
  1071. "advapi32.dll.CryptGetKeyParam",
  1072. "advapi32.dll.CryptDestroyKey",
  1073. "advapi32.dll.CryptVerifySignatureA",
  1074. "advapi32.dll.CryptSignHashA",
  1075. "advapi32.dll.CryptGetProvParam",
  1076. "advapi32.dll.CryptGetUserKey",
  1077. "advapi32.dll.CryptEnumProvidersA",
  1078. "cryptsp.dll.CryptHashData",
  1079. "cryptsp.dll.CryptGetHashParam",
  1080. "cryptsp.dll.CryptDestroyHash",
  1081. "cryptsp.dll.CryptDestroyKey",
  1082. "mscoree.dll.GetTokenForVTableEntry",
  1083. "mscoree.dll.SetTargetForVTableEntry",
  1084. "mscoree.dll.GetTargetForVTableEntry",
  1085. "culture.dll.ConvertLangIdToCultureName",
  1086. "ole32.dll.CoCreateGuid",
  1087. "kernel32.dll.CreateFileW",
  1088. "kernel32.dll.GetConsoleScreenBufferInfo",
  1089. "kernel32.dll.LocalFree",
  1090. "kernel32.dll.LocalAlloc",
  1091. "mscoree.dll.ND_RI4",
  1092. "advapi32.dll.DuplicateTokenEx",
  1093. "advapi32.dll.CheckTokenMembership",
  1094. "kernel32.dll.GetConsoleTitleW",
  1095. "mscorjit.dll.getJit",
  1096. "kernel32.dll.SetConsoleTitleW",
  1097. "kernel32.dll.SetConsoleCtrlHandler",
  1098. "kernel32.dll.CreateEventW",
  1099. "ntdll.dll.WinSqmIsOptedIn",
  1100. "kernel32.dll.ExpandEnvironmentStringsW",
  1101. "shfolder.dll.SHGetFolderPathW",
  1102. "kernel32.dll.SetEnvironmentVariableW",
  1103. "kernel32.dll.GetACP",
  1104. "kernel32.dll.UnmapViewOfFile",
  1105. "kernel32.dll.GetFileType",
  1106. "kernel32.dll.ReadFile",
  1107. "kernel32.dll.GetSystemInfo",
  1108. "kernel32.dll.VirtualQuery",
  1109. "secur32.dll.GetUserNameExW",
  1110. "advapi32.dll.GetUserNameW",
  1111. "kernel32.dll.ReleaseMutex",
  1112. "advapi32.dll.RegisterEventSourceW",
  1113. "advapi32.dll.DeregisterEventSource",
  1114. "advapi32.dll.ReportEventW",
  1115. "kernel32.dll.GetLogicalDrives",
  1116. "kernel32.dll.GetDriveTypeW",
  1117. "kernel32.dll.GetVolumeInformationW",
  1118. "kernel32.dll.GetCurrentDirectoryW",
  1119. "kernel32.dll.GetLastError",
  1120. "kernel32.dll.GetStdHandle",
  1121. "kernel32.dll.GetConsoleMode",
  1122. "kernel32.dll.SetEvent",
  1123. "kernel32.dll.FindFirstFileW",
  1124. "kernel32.dll.FindClose",
  1125. "mscoree.dll.DllGetClassObject",
  1126. "diasymreader.dll.DllGetClassObjectInternal",
  1127. "kernel32.dll.GetConsoleOutputCP",
  1128. "gdi32.dll.TranslateCharsetInfo",
  1129. "kernel32.dll.SetConsoleTextAttribute",
  1130. "kernel32.dll.WriteConsoleW",
  1131. "mscoree.dll.CorExitProcess",
  1132. "mscorwks.dll.CorExitProcess",
  1133. "mscorwks.dll._CorDllMain",
  1134. "kernel32.dll.CreateActCtxW",
  1135. "kernel32.dll.AddRefActCtx",
  1136. "kernel32.dll.ReleaseActCtx",
  1137. "kernel32.dll.ActivateActCtx",
  1138. "kernel32.dll.DeactivateActCtx",
  1139. "kernel32.dll.GetCurrentActCtx",
  1140. "kernel32.dll.QueryActCtxW",
  1141. "netutils.dll.NetApiBufferFree",
  1142. "kernel32.dll.IsProcessorFeaturePresent",
  1143. "ntdll.dll.RtlUnwind",
  1144. "mscoree.dll._CorExeMain",
  1145. "mscoree.dll._CorImageUnloading",
  1146. "mscoree.dll._CorValidateImage",
  1147. "cryptsp.dll.CryptExportKey",
  1148. "cryptsp.dll.CryptCreateHash",
  1149. "kernel32.dll.SwitchToThread",
  1150. "rpcrt4.dll.UuidFromStringW",
  1151. "rpcrt4.dll.RpcBindingCreateW",
  1152. "rpcrt4.dll.RpcBindingBind",
  1153. "sechost.dll.OpenSCManagerW",
  1154. "sechost.dll.OpenServiceW",
  1155. "sechost.dll.StartServiceW",
  1156. "sechost.dll.CloseServiceHandle",
  1157. "sechost.dll.LookupAccountNameLocalW",
  1158. "advapi32.dll.LookupAccountSidW",
  1159. "sechost.dll.LookupAccountSidLocalW",
  1160. "wersvc.dll.ServiceMain",
  1161. "wersvc.dll.SvchostPushServiceGlobals",
  1162. "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  1163. "faultrep.dll.WerpInitiateCrashReporting",
  1164. "wer.dll.WerpCreateMachineStore",
  1165. "shell32.dll.SHGetFolderPathEx",
  1166. "userenv.dll.CreateEnvironmentBlock",
  1167. "sspicli.dll.GetUserNameExW",
  1168. "userenv.dll.DestroyEnvironmentBlock",
  1169. "imm32.dll.ImmDisableIME",
  1170. "wer.dll.WerpCreateIntegratorReportId",
  1171. "wer.dll.WerReportCreate",
  1172. "wer.dll.WerpSetIntegratorReportId",
  1173. "wer.dll.WerReportSetParameter",
  1174. "dbgeng.dll.DebugCreate",
  1175. "ntdll.dll.CsrGetProcessId",
  1176. "ntdll.dll.DbgBreakPoint",
  1177. "ntdll.dll.DbgPrint",
  1178. "ntdll.dll.DbgPrompt",
  1179. "ntdll.dll.DbgUiConvertStateChangeStructure",
  1180. "ntdll.dll.DbgUiGetThreadDebugObject",
  1181. "ntdll.dll.DbgUiIssueRemoteBreakin",
  1182. "ntdll.dll.DbgUiSetThreadDebugObject",
  1183. "ntdll.dll.NtAllocateVirtualMemory",
  1184. "ntdll.dll.NtClose",
  1185. "ntdll.dll.NtCreateDebugObject",
  1186. "ntdll.dll.NtCreateFile",
  1187. "ntdll.dll.NtDebugActiveProcess",
  1188. "ntdll.dll.NtDebugContinue",
  1189. "ntdll.dll.NtFreeVirtualMemory",
  1190. "ntdll.dll.NtOpenProcess",
  1191. "ntdll.dll.NtOpenThread",
  1192. "ntdll.dll.NtQueryInformationProcess",
  1193. "ntdll.dll.NtQueryInformationThread",
  1194. "ntdll.dll.NtQueryMutant",
  1195. "ntdll.dll.NtQueryObject",
  1196. "ntdll.dll.NtRemoveProcessDebug",
  1197. "ntdll.dll.NtResumeThread",
  1198. "ntdll.dll.NtSetInformationDebugObject",
  1199. "ntdll.dll.NtSetInformationProcess",
  1200. "ntdll.dll.NtSystemDebugControl",
  1201. "ntdll.dll.NtWaitForDebugEvent",
  1202. "ntdll.dll.RtlAnsiStringToUnicodeString",
  1203. "ntdll.dll.RtlCreateProcessParameters",
  1204. "ntdll.dll.RtlCreateUserProcess",
  1205. "ntdll.dll.RtlDestroyProcessParameters",
  1206. "ntdll.dll.RtlDosPathNameToNtPathName_U",
  1207. "ntdll.dll.RtlFindMessage",
  1208. "ntdll.dll.RtlFreeHeap",
  1209. "ntdll.dll.RtlFreeUnicodeString",
  1210. "ntdll.dll.RtlGetFunctionTableListHead",
  1211. "ntdll.dll.RtlGetUnloadEventTrace",
  1212. "ntdll.dll.RtlGetUnloadEventTraceEx",
  1213. "ntdll.dll.RtlInitAnsiString",
  1214. "ntdll.dll.RtlInitUnicodeString",
  1215. "ntdll.dll.RtlTryEnterCriticalSection",
  1216. "ntdll.dll.RtlUnicodeStringToAnsiString",
  1217. "ntdll.dll.NtOpenProcessToken",
  1218. "ntdll.dll.NtOpenThreadToken",
  1219. "ntdll.dll.NtQueryInformationToken",
  1220. "kernel32.dll.CloseProfileUserMapping",
  1221. "kernel32.dll.CreateToolhelp32Snapshot",
  1222. "kernel32.dll.DebugActiveProcessStop",
  1223. "kernel32.dll.DebugBreak",
  1224. "kernel32.dll.DebugBreakProcess",
  1225. "kernel32.dll.DebugSetProcessKillOnExit",
  1226. "kernel32.dll.Module32First",
  1227. "kernel32.dll.Module32FirstW",
  1228. "kernel32.dll.Module32Next",
  1229. "kernel32.dll.Module32NextW",
  1230. "kernel32.dll.OpenThread",
  1231. "kernel32.dll.Process32First",
  1232. "kernel32.dll.Process32FirstW",
  1233. "kernel32.dll.Process32Next",
  1234. "kernel32.dll.Process32NextW",
  1235. "kernel32.dll.ProcessIdToSessionId",
  1236. "kernel32.dll.SetProcessShutdownParameters",
  1237. "kernel32.dll.Thread32First",
  1238. "kernel32.dll.Thread32Next",
  1239. "kernel32.dll.GetTimeZoneInformation",
  1240. "kernel32.dll.DuplicateHandle",
  1241. "kernel32.dll.Wow64GetThreadSelectorEntry",
  1242. "advapi32.dll.CloseServiceHandle",
  1243. "advapi32.dll.ControlService",
  1244. "advapi32.dll.CreateServiceA",
  1245. "advapi32.dll.CreateServiceW",
  1246. "advapi32.dll.DeleteService",
  1247. "advapi32.dll.EnumServicesStatusExA",
  1248. "advapi32.dll.EnumServicesStatusExW",
  1249. "advapi32.dll.GetEventLogInformation",
  1250. "advapi32.dll.OpenSCManagerA",
  1251. "advapi32.dll.OpenSCManagerW",
  1252. "advapi32.dll.OpenServiceA",
  1253. "advapi32.dll.OpenServiceW",
  1254. "advapi32.dll.StartServiceA",
  1255. "advapi32.dll.StartServiceW",
  1256. "advapi32.dll.GetSidSubAuthority",
  1257. "advapi32.dll.GetSidSubAuthorityCount",
  1258. "version.dll.GetFileVersionInfoSizeExW",
  1259. "version.dll.GetFileVersionInfoExW",
  1260. "dbghelp.dll.WinDbgExtensionDllInit",
  1261. "dbghelp.dll.ExtensionApiVersion",
  1262. "wer.dll.WerpSetDynamicParameter",
  1263. "wer.dll.WerReportAddDump",
  1264. "wer.dll.WerpSetCallBack",
  1265. "wer.dll.WerReportSetUIOption",
  1266. "wer.dll.WerpAddRegisteredDataToReport",
  1267. "wer.dll.WerReportSubmit",
  1268. "user32.dll.LoadStringW",
  1269. "advapi32.dll.RegCreateKeyExW",
  1270. "sensapi.dll.IsNetworkAlive",
  1271. "rpcrt4.dll.RpcBindingFromStringBindingW",
  1272. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  1273. "rpcrt4.dll.NdrClientCall3",
  1274. "user32.dll.CharUpperW",
  1275. "wer.dll.WerpAddAppCompatData",
  1276. "apphelp.dll.SdbGetFileAttributes",
  1277. "apphelp.dll.SdbFormatAttribute",
  1278. "apphelp.dll.SdbFreeFileAttributes"
  1279. ]
  1280.  
  1281. [*] Static Analysis: {
  1282. "pe": {
  1283. "peid_signatures": null,
  1284. "imports": [
  1285. {
  1286. "imports": [
  1287. {
  1288. "name": "SetUnhandledExceptionFilter",
  1289. "address": "0x404034"
  1290. },
  1291. {
  1292. "name": "UnhandledExceptionFilter",
  1293. "address": "0x404038"
  1294. },
  1295. {
  1296. "name": "GetCurrentProcess",
  1297. "address": "0x40403c"
  1298. },
  1299. {
  1300. "name": "TerminateProcess",
  1301. "address": "0x404040"
  1302. },
  1303. {
  1304. "name": "IsDebuggerPresent",
  1305. "address": "0x404044"
  1306. },
  1307. {
  1308. "name": "InterlockedCompareExchange",
  1309. "address": "0x404048"
  1310. },
  1311. {
  1312. "name": "Sleep",
  1313. "address": "0x40404c"
  1314. },
  1315. {
  1316. "name": "InterlockedExchange",
  1317. "address": "0x404050"
  1318. },
  1319. {
  1320. "name": "QueryPerformanceCounter",
  1321. "address": "0x404054"
  1322. },
  1323. {
  1324. "name": "GetTickCount",
  1325. "address": "0x404058"
  1326. },
  1327. {
  1328. "name": "GetCurrentThreadId",
  1329. "address": "0x40405c"
  1330. },
  1331. {
  1332. "name": "GetCurrentProcessId",
  1333. "address": "0x404060"
  1334. },
  1335. {
  1336. "name": "MapViewOfFile",
  1337. "address": "0x404064"
  1338. },
  1339. {
  1340. "name": "CreateFileA",
  1341. "address": "0x404068"
  1342. },
  1343. {
  1344. "name": "GetFileSize",
  1345. "address": "0x40406c"
  1346. },
  1347. {
  1348. "name": "CloseHandle",
  1349. "address": "0x404070"
  1350. },
  1351. {
  1352. "name": "ReadFile",
  1353. "address": "0x404074"
  1354. },
  1355. {
  1356. "name": "CreateFileMappingW",
  1357. "address": "0x404078"
  1358. },
  1359. {
  1360. "name": "GetStartupInfoA",
  1361. "address": "0x40407c"
  1362. },
  1363. {
  1364. "name": "GetSystemTimeAsFileTime",
  1365. "address": "0x404080"
  1366. }
  1367. ],
  1368. "dll": "KERNEL32.dll"
  1369. },
  1370. {
  1371. "imports": [
  1372. {
  1373. "name": "CreateWindowExA",
  1374. "address": "0x404114"
  1375. },
  1376. {
  1377. "name": "EndDialog",
  1378. "address": "0x404118"
  1379. },
  1380. {
  1381. "name": "ReleaseCapture",
  1382. "address": "0x40411c"
  1383. },
  1384. {
  1385. "name": "DefWindowProcA",
  1386. "address": "0x404120"
  1387. },
  1388. {
  1389. "name": "SetCapture",
  1390. "address": "0x404124"
  1391. },
  1392. {
  1393. "name": "EndPaint",
  1394. "address": "0x404128"
  1395. },
  1396. {
  1397. "name": "BeginPaint",
  1398. "address": "0x40412c"
  1399. },
  1400. {
  1401. "name": "SetWindowPos",
  1402. "address": "0x404130"
  1403. },
  1404. {
  1405. "name": "DialogBoxParamA",
  1406. "address": "0x404134"
  1407. },
  1408. {
  1409. "name": "InvalidateRect",
  1410. "address": "0x404138"
  1411. },
  1412. {
  1413. "name": "ShowCursor",
  1414. "address": "0x40413c"
  1415. },
  1416. {
  1417. "name": "SetCursor",
  1418. "address": "0x404140"
  1419. },
  1420. {
  1421. "name": "LoadCursorA",
  1422. "address": "0x404144"
  1423. },
  1424. {
  1425. "name": "DestroyWindow",
  1426. "address": "0x404148"
  1427. },
  1428. {
  1429. "name": "GetMessageA",
  1430. "address": "0x40414c"
  1431. },
  1432. {
  1433. "name": "TranslateMessage",
  1434. "address": "0x404150"
  1435. },
  1436. {
  1437. "name": "DispatchMessageA",
  1438. "address": "0x404154"
  1439. },
  1440. {
  1441. "name": "LoadIconA",
  1442. "address": "0x404158"
  1443. },
  1444. {
  1445. "name": "RegisterClassA",
  1446. "address": "0x40415c"
  1447. },
  1448. {
  1449. "name": "PostQuitMessage",
  1450. "address": "0x404160"
  1451. },
  1452. {
  1453. "name": "ShowWindow",
  1454. "address": "0x404164"
  1455. },
  1456. {
  1457. "name": "UpdateWindow",
  1458. "address": "0x404168"
  1459. },
  1460. {
  1461. "name": "MessageBoxA",
  1462. "address": "0x40416c"
  1463. },
  1464. {
  1465. "name": "GetClientRect",
  1466. "address": "0x404170"
  1467. },
  1468. {
  1469. "name": "GetSystemMetrics",
  1470. "address": "0x404174"
  1471. },
  1472. {
  1473. "name": "ClientToScreen",
  1474. "address": "0x404178"
  1475. },
  1476. {
  1477. "name": "WindowFromPoint",
  1478. "address": "0x40417c"
  1479. },
  1480. {
  1481. "name": "GetDlgCtrlID",
  1482. "address": "0x404180"
  1483. },
  1484. {
  1485. "name": "GetParent",
  1486. "address": "0x404184"
  1487. },
  1488. {
  1489. "name": "ScreenToClient",
  1490. "address": "0x404188"
  1491. },
  1492. {
  1493. "name": "MoveWindow",
  1494. "address": "0x40418c"
  1495. },
  1496. {
  1497. "name": "GetWindowRect",
  1498. "address": "0x404190"
  1499. },
  1500. {
  1501. "name": "GetDlgItem",
  1502. "address": "0x404194"
  1503. },
  1504. {
  1505. "name": "GetMenu",
  1506. "address": "0x404198"
  1507. }
  1508. ],
  1509. "dll": "USER32.dll"
  1510. },
  1511. {
  1512. "imports": [
  1513. {
  1514. "name": "CreateCompatibleDC",
  1515. "address": "0x404010"
  1516. },
  1517. {
  1518. "name": "SetDIBitsToDevice",
  1519. "address": "0x404014"
  1520. },
  1521. {
  1522. "name": "SelectObject",
  1523. "address": "0x404018"
  1524. },
  1525. {
  1526. "name": "SetStretchBltMode",
  1527. "address": "0x40401c"
  1528. },
  1529. {
  1530. "name": "StretchDIBits",
  1531. "address": "0x404020"
  1532. },
  1533. {
  1534. "name": "GetStockObject",
  1535. "address": "0x404024"
  1536. },
  1537. {
  1538. "name": "CreateDIBitmap",
  1539. "address": "0x404028"
  1540. },
  1541. {
  1542. "name": "BitBlt",
  1543. "address": "0x40402c"
  1544. }
  1545. ],
  1546. "dll": "GDI32.dll"
  1547. },
  1548. {
  1549. "imports": [
  1550. {
  1551. "name": "GetOpenFileNameA",
  1552. "address": "0x404008"
  1553. }
  1554. ],
  1555. "dll": "COMDLG32.dll"
  1556. },
  1557. {
  1558. "imports": [
  1559. {
  1560. "name": "CryptAcquireContextA",
  1561. "address": "0x404000"
  1562. }
  1563. ],
  1564. "dll": "ADVAPI32.dll"
  1565. },
  1566. {
  1567. "imports": [
  1568. {
  1569. "name": "_controlfp_s",
  1570. "address": "0x404098"
  1571. },
  1572. {
  1573. "name": "_invoke_watson",
  1574. "address": "0x40409c"
  1575. },
  1576. {
  1577. "name": "_except_handler4_common",
  1578. "address": "0x4040a0"
  1579. },
  1580. {
  1581. "name": "_decode_pointer",
  1582. "address": "0x4040a4"
  1583. },
  1584. {
  1585. "name": "_onexit",
  1586. "address": "0x4040a8"
  1587. },
  1588. {
  1589. "name": "_lock",
  1590. "address": "0x4040ac"
  1591. },
  1592. {
  1593. "name": "__dllonexit",
  1594. "address": "0x4040b0"
  1595. },
  1596. {
  1597. "name": "_unlock",
  1598. "address": "0x4040b4"
  1599. },
  1600. {
  1601. "name": "?terminate@@YAXXZ",
  1602. "address": "0x4040b8"
  1603. },
  1604. {
  1605. "name": "_crt_debugger_hook",
  1606. "address": "0x4040bc"
  1607. },
  1608. {
  1609. "name": "__set_app_type",
  1610. "address": "0x4040c0"
  1611. },
  1612. {
  1613. "name": "_encode_pointer",
  1614. "address": "0x4040c4"
  1615. },
  1616. {
  1617. "name": "__p__fmode",
  1618. "address": "0x4040c8"
  1619. },
  1620. {
  1621. "name": "__p__commode",
  1622. "address": "0x4040cc"
  1623. },
  1624. {
  1625. "name": "_adjust_fdiv",
  1626. "address": "0x4040d0"
  1627. },
  1628. {
  1629. "name": "__setusermatherr",
  1630. "address": "0x4040d4"
  1631. },
  1632. {
  1633. "name": "rand",
  1634. "address": "0x4040d8"
  1635. },
  1636. {
  1637. "name": "malloc",
  1638. "address": "0x4040dc"
  1639. },
  1640. {
  1641. "name": "free",
  1642. "address": "0x4040e0"
  1643. },
  1644. {
  1645. "name": "_amsg_exit",
  1646. "address": "0x4040e4"
  1647. },
  1648. {
  1649. "name": "__getmainargs",
  1650. "address": "0x4040e8"
  1651. },
  1652. {
  1653. "name": "_cexit",
  1654. "address": "0x4040ec"
  1655. },
  1656. {
  1657. "name": "_exit",
  1658. "address": "0x4040f0"
  1659. },
  1660. {
  1661. "name": "_XcptFilter",
  1662. "address": "0x4040f4"
  1663. },
  1664. {
  1665. "name": "_ismbblead",
  1666. "address": "0x4040f8"
  1667. },
  1668. {
  1669. "name": "exit",
  1670. "address": "0x4040fc"
  1671. },
  1672. {
  1673. "name": "_acmdln",
  1674. "address": "0x404100"
  1675. },
  1676. {
  1677. "name": "_initterm",
  1678. "address": "0x404104"
  1679. },
  1680. {
  1681. "name": "_initterm_e",
  1682. "address": "0x404108"
  1683. },
  1684. {
  1685. "name": "_configthreadlocale",
  1686. "address": "0x40410c"
  1687. }
  1688. ],
  1689. "dll": "MSVCR90.dll"
  1690. },
  1691. {
  1692. "imports": [
  1693. {
  1694. "name": "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  1695. "address": "0x404088"
  1696. },
  1697. {
  1698. "name": "??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z",
  1699. "address": "0x40408c"
  1700. },
  1701. {
  1702. "name": "??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  1703. "address": "0x404090"
  1704. }
  1705. ],
  1706. "dll": "MSVCP90.dll"
  1707. }
  1708. ],
  1709. "digital_signers": null,
  1710. "exported_dll_name": null,
  1711. "actual_checksum": "0x0004521c",
  1712. "overlay": null,
  1713. "imagebase": "0x00400000",
  1714. "reported_checksum": "0x0004521c",
  1715. "icon_hash": null,
  1716. "entrypoint": "0x00403477",
  1717. "timestamp": "2019-07-01 06:45:17",
  1718. "osversion": "5.0",
  1719. "sections": [
  1720. {
  1721. "name": ".text",
  1722. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1723. "virtual_address": "0x00001000",
  1724. "size_of_data": "0x00002a00",
  1725. "entropy": "6.26",
  1726. "raw_address": "0x00000400",
  1727. "virtual_size": "0x000029be",
  1728. "characteristics_raw": "0x60000020"
  1729. },
  1730. {
  1731. "name": ".rdata",
  1732. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1733. "virtual_address": "0x00004000",
  1734. "size_of_data": "0x00004200",
  1735. "entropy": "6.08",
  1736. "raw_address": "0x00002e00",
  1737. "virtual_size": "0x00004096",
  1738. "characteristics_raw": "0x40000040"
  1739. },
  1740. {
  1741. "name": ".data",
  1742. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1743. "virtual_address": "0x00009000",
  1744. "size_of_data": "0x00029c00",
  1745. "entropy": "8.00",
  1746. "raw_address": "0x00007000",
  1747. "virtual_size": "0x0002a17c",
  1748. "characteristics_raw": "0xc0000040"
  1749. },
  1750. {
  1751. "name": ".rsrc",
  1752. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1753. "virtual_address": "0x00034000",
  1754. "size_of_data": "0x0000ba00",
  1755. "entropy": "5.49",
  1756. "raw_address": "0x00030c00",
  1757. "virtual_size": "0x0000b8ea",
  1758. "characteristics_raw": "0x40000040"
  1759. },
  1760. {
  1761. "name": ".reloc",
  1762. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1763. "virtual_address": "0x00040000",
  1764. "size_of_data": "0x00000800",
  1765. "entropy": "5.10",
  1766. "raw_address": "0x0003c600",
  1767. "virtual_size": "0x000007ba",
  1768. "characteristics_raw": "0x42000040"
  1769. }
  1770. ],
  1771. "resources": [],
  1772. "dirents": [
  1773. {
  1774. "virtual_address": "0x00000000",
  1775. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1776. "size": "0x00000000"
  1777. },
  1778. {
  1779. "virtual_address": "0x0000770c",
  1780. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1781. "size": "0x000000a0"
  1782. },
  1783. {
  1784. "virtual_address": "0x00034000",
  1785. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1786. "size": "0x0000b8ea"
  1787. },
  1788. {
  1789. "virtual_address": "0x00000000",
  1790. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1791. "size": "0x00000000"
  1792. },
  1793. {
  1794. "virtual_address": "0x00000000",
  1795. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1796. "size": "0x00000000"
  1797. },
  1798. {
  1799. "virtual_address": "0x00040000",
  1800. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1801. "size": "0x00000524"
  1802. },
  1803. {
  1804. "virtual_address": "0x00000000",
  1805. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1806. "size": "0x00000000"
  1807. },
  1808. {
  1809. "virtual_address": "0x00000000",
  1810. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1811. "size": "0x00000000"
  1812. },
  1813. {
  1814. "virtual_address": "0x00000000",
  1815. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1816. "size": "0x00000000"
  1817. },
  1818. {
  1819. "virtual_address": "0x00000000",
  1820. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1821. "size": "0x00000000"
  1822. },
  1823. {
  1824. "virtual_address": "0x00007640",
  1825. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1826. "size": "0x00000040"
  1827. },
  1828. {
  1829. "virtual_address": "0x00000000",
  1830. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1831. "size": "0x00000000"
  1832. },
  1833. {
  1834. "virtual_address": "0x00004000",
  1835. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1836. "size": "0x000001a0"
  1837. },
  1838. {
  1839. "virtual_address": "0x00000000",
  1840. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1841. "size": "0x00000000"
  1842. },
  1843. {
  1844. "virtual_address": "0x00000000",
  1845. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1846. "size": "0x00000000"
  1847. },
  1848. {
  1849. "virtual_address": "0x00000000",
  1850. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1851. "size": "0x00000000"
  1852. }
  1853. ],
  1854. "exports": [],
  1855. "guest_signers": {},
  1856. "imphash": "e7da0e6cc5faa043f26b08286ff6fc41",
  1857. "icon_fuzzy": null,
  1858. "icon": null,
  1859. "pdbpath": null,
  1860. "imported_dll_count": 7,
  1861. "versioninfo": []
  1862. }
  1863. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!