API tools faq
paste
paladin316

Exes_c16da8f082d2ee71cb9cff395c6e7ebf_exe_2019-07-02_18_30.json

paladin316
Jul 2nd, 2019
2,388
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 82.67 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Fareit"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_c16da8f082d2ee71cb9cff395c6e7ebf.exe"
  7. [*] File Size: 96256
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "55ede14b2dbad82dd5fcc13fd8ee5a5a8a419621f4958f88643e3f944144660e"
  10. [*] MD5: "c16da8f082d2ee71cb9cff395c6e7ebf"
  11. [*] SHA1: "1f6f829c4d5d866c87fe4e316694f8dfe0b4e07f"
  12. [*] SHA512: "90d98bd8fc4fbc22b94b88b5918d88f4e3556e4a4643b254f8283b5c31035a96bfcbb175c2b2fcca0064854af72989fcd25fc30a566931c92ab4544426e0199f"
  13. [*] CRC32: "79F0D773"
  14. [*] SSDEEP: "1536:lzAX/kLsqQxGoXhTSbwQInU0XdijI01e+dKxIkbTdFhDZqJyQgDOXSk:GkLQ7FIwQIZXdKDdCIkbnhDZq0QgDOXn"
  15.  
  16. [*] Process Execution: [
  17. "Exes_c16da8f082d2ee71cb9cff395c6e7ebf.exe",
  18. "cmd.exe",
  19. "BN65EA.tmp",
  20. "BNB91.tmp",
  21. "services.exe",
  22. "taskhost.exe",
  23. "sc.exe",
  24. "svchost.exe",
  25. "WerFault.exe",
  26. "wermgr.exe",
  27. "svchost.exe"
  28. ]
  29.  
  30. [*] Signatures Detected: [
  31. {
  32. "Description": "At least one process apparently crashed during execution",
  33. "Details": []
  34. },
  35. {
  36. "Description": "Creates RWX memory",
  37. "Details": []
  38. },
  39. {
  40. "Description": "A process attempted to delay the analysis task.",
  41. "Details": [
  42. {
  43. "Process": "BNB91.tmp tried to sleep 1270 seconds, actually delayed analysis time by 0 seconds"
  44. },
  45. {
  46. "Process": "Exes_c16da8f082d2ee71cb9cff395c6e7ebf.exe tried to sleep 1500 seconds, actually delayed analysis time by 0 seconds"
  47. },
  48. {
  49. "Process": "BN65EA.tmp tried to sleep 1620 seconds, actually delayed analysis time by 0 seconds"
  50. }
  51. ]
  52. },
  53. {
  54. "Description": "Drops a binary and executes it",
  55. "Details": [
  56. {
  57. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\BNB91.tmp"
  58. },
  59. {
  60. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\BN65EA.tmp"
  61. }
  62. ]
  63. },
  64. {
  65. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  66. "Details": [
  67. {
  68. "post_no_referer": "HTTP traffic contains a POST request with no referer header"
  69. },
  70. {
  71. "http_version_old": "HTTP traffic uses version 1.0"
  72. },
  73. {
  74. "ip_hostname": "HTTP connection was made to an IP address rather than domain name"
  75. },
  76. {
  77. "suspicious_request": "http://andpartanthat.com/4/forum.php"
  78. },
  79. {
  80. "suspicious_request": "http://geysirland.com/wp-content/plugins//1"
  81. },
  82. {
  83. "suspicious_request": "http://andpartanthat.com/mlu/forum.php"
  84. },
  85. {
  86. "suspicious_request": "http://www.gruenbaum.com.br/wp-content/plugins/qtranslate/art2.exe"
  87. },
  88. {
  89. "suspicious_request": "http://31.44.184.33/H7mp"
  90. },
  91. {
  92. "suspicious_request": "http://31.44.184.33/ga.js"
  93. }
  94. ]
  95. },
  96. {
  97. "Description": "Performs some HTTP requests",
  98. "Details": [
  99. {
  100. "url": "http://api.ipify.org/"
  101. },
  102. {
  103. "url": "http://andpartanthat.com/4/forum.php"
  104. },
  105. {
  106. "url": "http://geysirland.com/wp-content/plugins//1"
  107. },
  108. {
  109. "url": "http://andpartanthat.com/mlu/forum.php"
  110. },
  111. {
  112. "url": "http://www.gruenbaum.com.br/wp-content/plugins/qtranslate/art2.exe"
  113. },
  114. {
  115. "url": "http://31.44.184.33/H7mp"
  116. },
  117. {
  118. "url": "http://31.44.184.33/ga.js"
  119. }
  120. ]
  121. },
  122. {
  123. "Description": "Looks up the external IP address",
  124. "Details": [
  125. {
  126. "domain": "api.ipify.org"
  127. }
  128. ]
  129. },
  130. {
  131. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  132. "Details": [
  133. {
  134. "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 9306576 times"
  135. }
  136. ]
  137. },
  138. {
  139. "Description": "Steals private information from local Internet browsers",
  140. "Details": [
  141. {
  142. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal"
  143. },
  144. {
  145. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data"
  146. },
  147. {
  148. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal"
  149. },
  150. {
  151. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
  152. }
  153. ]
  154. },
  155. {
  156. "Description": "Network activity contains more than one unique useragent.",
  157. "Details": [
  158. {
  159. "Process": "Exes_c16da8f082d2ee71cb9cff395c6e7ebf.exe"
  160. },
  161. {
  162. "User-Agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko"
  163. },
  164. {
  165. "Process": "BN65EA.tmp"
  166. },
  167. {
  168. "User-Agent": ""
  169. },
  170. {
  171. "Process": "BN65EA.tmp"
  172. },
  173. {
  174. "User-Agent": "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; NP07; NP07)"
  175. }
  176. ]
  177. },
  178. {
  179. "Description": "A process sent information about the computer to a remote location.",
  180. "Details": [
  181. {
  182. "Beacon": "Exes_c16da8f082d2ee71cb9cff395c6e7ebf.exe: GUID=13962712492586483736&BUILD=0207_349876&INFO=Host @ Host\\user&IP=0.0.0.0&TYPE=1&WIN=6.1(x64)"
  183. }
  184. ]
  185. },
  186. {
  187. "Description": "Collects information about installed applications",
  188. "Details": [
  189. {
  190. "Program": "Google Update Helper"
  191. },
  192. {
  193. "Program": "Microsoft Excel MUI 2013"
  194. },
  195. {
  196. "Program": "Microsoft Outlook MUI 2013"
  197. },
  198. {
  199. },
  200. {
  201. "Program": "Google Chrome"
  202. },
  203. {
  204. "Program": "Adobe Flash Player 29 NPAPI"
  205. },
  206. {
  207. "Program": "Adobe Flash Player 29 ActiveX"
  208. },
  209. {
  210. "Program": "Microsoft DCF MUI 2013"
  211. },
  212. {
  213. "Program": "Microsoft Access MUI 2013"
  214. },
  215. {
  216. "Program": "Microsoft Office Proofing Tools 2013 - English"
  217. },
  218. {
  219. "Program": "Adobe Acrobat Reader DC"
  220. },
  221. {
  222. "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xef\\xbf\\xb1ol"
  223. },
  224. {
  225. "Program": "Microsoft Publisher MUI 2013"
  226. },
  227. {
  228. "Program": "Outils de v\\xef\\xbf\\xa9rification linguistique 2013 de Microsoft Office\\xef\\xbe\\xa0- Fran\\xef\\xbf\\xa7ais"
  229. },
  230. {
  231. "Program": "Microsoft Office Shared MUI 2013"
  232. },
  233. {
  234. "Program": "Microsoft Office OSM MUI 2013"
  235. },
  236. {
  237. "Program": "Microsoft InfoPath MUI 2013"
  238. },
  239. {
  240. "Program": "Microsoft Office Shared Setup Metadata MUI 2013"
  241. },
  242. {
  243. "Program": "Microsoft Word MUI 2013"
  244. },
  245. {
  246. "Program": "Microsoft Groove MUI 2013"
  247. },
  248. {
  249. },
  250. {
  251. "Program": "Microsoft Access Setup Metadata MUI 2013"
  252. },
  253. {
  254. "Program": "Microsoft Office OSM UX MUI 2013"
  255. },
  256. {
  257. "Program": "Microsoft PowerPoint MUI 2013"
  258. },
  259. {
  260. "Program": "Microsoft Office Professional Plus 2013"
  261. },
  262. {
  263. "Program": "Adobe Refresh Manager"
  264. },
  265. {
  266. "Program": "Microsoft Office Proofing 2013"
  267. },
  268. {
  269. "Program": "Microsoft Lync MUI 2013"
  270. },
  271. {
  272. },
  273. {
  274. "Program": "Microsoft OneNote MUI 2013"
  275. }
  276. ]
  277. },
  278. {
  279. "Description": "File has been identified by 15 Antiviruses on VirusTotal as malicious",
  280. "Details": [
  281. {
  282. "Cylance": "Unsafe"
  283. },
  284. {
  285. "APEX": "Malicious"
  286. },
  287. {
  288. "Avast": "FileRepMalware"
  289. },
  290. {
  291. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  292. },
  293. {
  294. "Paloalto": "generic.ml"
  295. },
  296. {
  297. "Rising": "Trojan.Kryptik!8.8/N3#89% (RDM+:cmRtazqysGEjsoOpYpokdc5Y04Lc)"
  298. },
  299. {
  300. "Endgame": "malicious (high confidence)"
  301. },
  302. {
  303. "Invincea": "heuristic"
  304. },
  305. {
  306. "FireEye": "Generic.mg.c16da8f082d2ee71"
  307. },
  308. {
  309. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  310. },
  311. {
  312. "VBA32": "BScope.Trojan.Chanitor"
  313. },
  314. {
  315. "Webroot": "W32.Trojan.Gen"
  316. },
  317. {
  318. "AVG": "FileRepMalware"
  319. },
  320. {
  321. "Cybereason": "malicious.c4d5d8"
  322. },
  323. {
  324. "Qihoo-360": "HEUR/QVM20.1.424D.Malware.Gen"
  325. }
  326. ]
  327. },
  328. {
  329. "Description": "Checks the system manufacturer, likely for anti-virtualization",
  330. "Details": []
  331. },
  332. {
  333. "Description": "Harvests credentials from local FTP client softwares",
  334. "Details": [
  335. {
  336. "file": "C:\\Program Files (x86)\\CuteFTP\\sm.dat"
  337. },
  338. {
  339. "file": "C:\\Users\\user\\AppData\\Local\\CuteFTP\\sm.dat"
  340. },
  341. {
  342. "file": "C:\\Users\\user\\AppData\\Roaming\\GlobalSCAPE\\CuteFTP\\sm.dat"
  343. },
  344. {
  345. "file": "C:\\Users\\user\\AppData\\Roaming\\CuteFTP\\sm.dat"
  346. },
  347. {
  348. "file": "C:\\Program Files (x86)\\GlobalSCAPE\\CuteFTP\\sm.dat"
  349. },
  350. {
  351. "file": "C:\\ProgramData\\CuteFTP\\sm.dat"
  352. },
  353. {
  354. "file": "C:\\ProgramData\\GlobalSCAPE\\CuteFTP\\sm.dat"
  355. },
  356. {
  357. "file": "C:\\Users\\user\\AppData\\Local\\GlobalSCAPE\\CuteFTP\\sm.dat"
  358. },
  359. {
  360. "file": "C:\\Users\\user\\AppData\\Local\\FlashFXP\\4\\Sites.dat"
  361. },
  362. {
  363. "file": "C:\\ProgramData\\FlashFXP\\3\\Sites.dat"
  364. },
  365. {
  366. "file": "C:\\Users\\user\\AppData\\Local\\FlashFXP\\3\\Sites.dat"
  367. },
  368. {
  369. "file": "C:\\Users\\user\\AppData\\Roaming\\FlashFXP\\4\\Sites.dat"
  370. },
  371. {
  372. "file": "C:\\ProgramData\\FlashFXP\\4\\Sites.dat"
  373. },
  374. {
  375. "file": "C:\\Users\\user\\AppData\\Roaming\\FlashFXP\\3\\Sites.dat"
  376. },
  377. {
  378. "file": "C:\\Users\\user\\AppData\\Local\\FlashFXP\\3\\Quick.dat"
  379. },
  380. {
  381. "file": "C:\\ProgramData\\FlashFXP\\4\\Quick.dat"
  382. },
  383. {
  384. "file": "C:\\Users\\user\\AppData\\Roaming\\FlashFXP\\4\\Quick.dat"
  385. },
  386. {
  387. "file": "C:\\Users\\user\\AppData\\Local\\FlashFXP\\4\\Quick.dat"
  388. },
  389. {
  390. "file": "C:\\Users\\user\\AppData\\Roaming\\FlashFXP\\3\\Quick.dat"
  391. },
  392. {
  393. "file": "C:\\ProgramData\\FlashFXP\\3\\Quick.dat"
  394. },
  395. {
  396. "file": "C:\\Users\\user\\AppData\\Local\\FileZilla\\sitemanager.xml"
  397. },
  398. {
  399. "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\sitemanager.xml"
  400. },
  401. {
  402. "file": "C:\\ProgramData\\FileZilla\\sitemanager.xml"
  403. },
  404. {
  405. "file": "C:\\ProgramData\\FileZilla\\recentservers.xml"
  406. },
  407. {
  408. "file": "C:\\Users\\user\\AppData\\Local\\FileZilla\\recentservers.xml"
  409. },
  410. {
  411. "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\recentservers.xml"
  412. },
  413. {
  414. "file": "C:\\Users\\user\\AppData\\Local\\VanDyke\\Config\\Sessions\\*.*"
  415. },
  416. {
  417. "file": "C:\\Users\\user\\AppData\\Roaming\\VanDyke\\Config\\Sessions\\*.*"
  418. },
  419. {
  420. "file": "C:\\ProgramData\\VanDyke\\Config\\Sessions\\*.*"
  421. },
  422. {
  423. "file": "C:\\Users\\user\\AppData\\Roaming\\SmartFTP\\*.*"
  424. },
  425. {
  426. "file": "C:\\Users\\user\\AppData\\Local\\SmartFTP\\*.*"
  427. },
  428. {
  429. "file": "C:\\ProgramData\\SmartFTP\\*.*"
  430. },
  431. {
  432. "file": "C:\\Program Files (x86)\\Common Files\\Ipswitch\\WS_FTP\\*.*"
  433. },
  434. {
  435. "key": "HKEY_CURRENT_USER\\Software\\GlobalSCAPE\\CuteFTP 7 Professional\\QCToolbar"
  436. },
  437. {
  438. "key": "HKEY_CURRENT_USER\\Software\\GlobalSCAPE\\CuteFTP 9\\QCToolbar"
  439. },
  440. {
  441. "key": "HKEY_CURRENT_USER\\Software\\GlobalSCAPE\\CuteFTP 8 Professional\\QCToolbar"
  442. },
  443. {
  444. "key": "HKEY_CURRENT_USER\\Software\\GlobalSCAPE\\CuteFTP 8 Home\\QCToolbar"
  445. },
  446. {
  447. "key": "HKEY_CURRENT_USER\\Software\\GlobalSCAPE\\CuteFTP 6 Professional\\QCToolbar"
  448. },
  449. {
  450. "key": "HKEY_CURRENT_USER\\Software\\GlobalSCAPE\\CuteFTP 6 Home\\QCToolbar"
  451. },
  452. {
  453. "key": "HKEY_CURRENT_USER\\Software\\GlobalSCAPE\\CuteFTP 7 Home\\QCToolbar"
  454. },
  455. {
  456. "key": "HKEY_LOCAL_MACHINE\\Software\\Ghisler\\Windows Commander"
  457. },
  458. {
  459. "key": "HKEY_CURRENT_USER\\Software\\Ghisler\\Windows Commander"
  460. },
  461. {
  462. "key": "HKEY_CURRENT_USER\\Software\\Ghisler\\Total Commander"
  463. },
  464. {
  465. "key": "HKEY_LOCAL_MACHINE\\Software\\Ghisler\\Total Commander"
  466. },
  467. {
  468. "key": "HKEY_CURRENT_USER\\Software\\BPFTP\\Bullet Proof FTP\\Options"
  469. },
  470. {
  471. "key": "HKEY_CURRENT_USER\\Software\\BPFTP\\Bullet Proof FTP\\Main"
  472. },
  473. {
  474. "key": "HKEY_CURRENT_USER\\Software\\FileZilla"
  475. },
  476. {
  477. "key": "HKEY_LOCAL_MACHINE\\Software\\FileZilla"
  478. },
  479. {
  480. "key": "HKEY_CURRENT_USER\\Software\\FileZilla Client"
  481. },
  482. {
  483. "key": "HKEY_LOCAL_MACHINE\\Software\\FileZilla Client"
  484. },
  485. {
  486. "key": "HKEY_CURRENT_USER\\Software\\FTPWare\\COREFTP\\Sites"
  487. },
  488. {
  489. "key": "HKEY_CURRENT_USER\\Software\\BulletProof Software\\BulletProof FTP Client\\Main"
  490. },
  491. {
  492. "key": "HKEY_CURRENT_USER\\Software\\BulletProof Software\\BulletProof FTP Client\\Options"
  493. }
  494. ]
  495. },
  496. {
  497. "Description": "Harvests information related to installed mail clients",
  498. "Details": [
  499. {
  500. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook"
  501. },
  502. {
  503. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Microsoft Outlook Internet Settings"
  504. },
  505. {
  506. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Port"
  507. },
  508. {
  509. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Password"
  510. },
  511. {
  512. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\0a0d020000000000c000000000000046"
  513. },
  514. {
  515. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9234ed9445f8fa418a542f350f18f326"
  516. },
  517. {
  518. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\NNTP User Name"
  519. },
  520. {
  521. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Password2"
  522. },
  523. {
  524. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTPMail Server"
  525. },
  526. {
  527. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTP Password"
  528. },
  529. {
  530. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Port"
  531. },
  532. {
  533. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTPMail Password2"
  534. },
  535. {
  536. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTP Server URL"
  537. },
  538. {
  539. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP User"
  540. },
  541. {
  542. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\cb23f8734d88734ca66c47c4527fd259"
  543. },
  544. {
  545. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\NNTP Password2"
  546. },
  547. {
  548. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTPMail Password2"
  549. },
  550. {
  551. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTP Password"
  552. },
  553. {
  554. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
  555. },
  556. {
  557. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Server"
  558. },
  559. {
  560. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Email Address"
  561. },
  562. {
  563. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
  564. },
  565. {
  566. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Server"
  567. },
  568. {
  569. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Port"
  570. },
  571. {
  572. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Port"
  573. },
  574. {
  575. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP User"
  576. },
  577. {
  578. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Password2"
  579. },
  580. {
  581. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\NNTP Password"
  582. },
  583. {
  584. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Password"
  585. },
  586. {
  587. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Port"
  588. },
  589. {
  590. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\Email"
  591. },
  592. {
  593. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8408552e6dae7d45a0ba01520b6221ff"
  594. },
  595. {
  596. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Password"
  597. },
  598. {
  599. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTPMail User Name"
  600. },
  601. {
  602. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2"
  603. },
  604. {
  605. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\240a97d961ed46428e29a3f1f1c23670"
  606. },
  607. {
  608. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Server"
  609. },
  610. {
  611. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\NNTP Email Address"
  612. },
  613. {
  614. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\c02ebc5353d9cd11975200aa004ae40e"
  615. },
  616. {
  617. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\NNTP User Name"
  618. },
  619. {
  620. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP User Name"
  621. },
  622. {
  623. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\NNTP Password"
  624. },
  625. {
  626. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  627. },
  628. {
  629. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP User Name"
  630. },
  631. {
  632. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP User"
  633. },
  634. {
  635. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 User"
  636. },
  637. {
  638. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\b22783abb139fe46b0aad551d64b60e7"
  639. },
  640. {
  641. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTP User"
  642. },
  643. {
  644. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001"
  645. },
  646. {
  647. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook"
  648. },
  649. {
  650. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 User Name"
  651. },
  652. {
  653. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\NNTP Server"
  654. },
  655. {
  656. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Password"
  657. },
  658. {
  659. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP User"
  660. },
  661. {
  662. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTPMail Server"
  663. },
  664. {
  665. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Server"
  666. },
  667. {
  668. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Password2"
  669. },
  670. {
  671. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Password2"
  672. },
  673. {
  674. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook"
  675. },
  676. {
  677. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 User"
  678. },
  679. {
  680. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Password2"
  681. },
  682. {
  683. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\NNTP Server"
  684. },
  685. {
  686. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Server"
  687. },
  688. {
  689. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\NNTP Email Address"
  690. },
  691. {
  692. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\NNTP Password2"
  693. },
  694. {
  695. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\Email"
  696. },
  697. {
  698. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Password2"
  699. },
  700. {
  701. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Email Address"
  702. },
  703. {
  704. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP User Name"
  705. },
  706. {
  707. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 User Name"
  708. },
  709. {
  710. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTP Server URL"
  711. },
  712. {
  713. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Password"
  714. },
  715. {
  716. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTPMail User Name"
  717. },
  718. {
  719. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a"
  720. },
  721. {
  722. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Port"
  723. },
  724. {
  725. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8503020000000000c000000000000046"
  726. },
  727. {
  728. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP User Name"
  729. },
  730. {
  731. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604"
  732. },
  733. {
  734. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8f92b60606058348930a96946cf329e1"
  735. },
  736. {
  737. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Password"
  738. },
  739. {
  740. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Server"
  741. },
  742. {
  743. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTP User"
  744. },
  745. {
  746. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Outlook\\OMI Account Manager\\Accounts"
  747. },
  748. {
  749. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Account Manager\\Accounts"
  750. },
  751. {
  752. "key": "HKEY_CURRENT_USER\\Identities\\{0A258175-2D14-4D69-9955-E200F247250F}\\Software\\Microsoft\\Internet Account Manager\\Accounts"
  753. }
  754. ]
  755. },
  756. {
  757. "Description": "Created network traffic indicative of malicious activity",
  758. "Details": [
  759. {
  760. "signature": "ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile"
  761. },
  762. {
  763. "signature": "ET TROJAN Fareit/Pony Downloader Checkin 2"
  764. },
  765. {
  766. "signature": "ET TROJAN EXE Download Request To Wordpress Folder Likely Malicious"
  767. },
  768. {
  769. "signature": "ET TROJAN Possible Metasploit Payload Common Construct Bind_API (from server)"
  770. }
  771. ]
  772. }
  773. ]
  774.  
  775. [*] Started Service: [
  776. "VaultSvc",
  777. "WerSvc",
  778. "W32Time"
  779. ]
  780.  
  781. [*] Executed Commands: [
  782. "cmd /K",
  783. "C:\\Users\\user\\AppData\\Local\\Temp\\BN65EA.tmp",
  784. "C:\\Users\\user\\AppData\\Local\\Temp\\BNB91.tmp",
  785. "C:\\Windows\\system32\\lsass.exe",
  786. "taskhost.exe $(Arg0)",
  787. "C:\\Windows\\system32\\sc.exe start w32time task_started",
  788. "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
  789. "C:\\Windows\\system32\\svchost.exe -k LocalService",
  790. "C:\\Windows\\system32\\WerFault.exe -u -p 3060 -s 288",
  791. "\"C:\\Windows\\system32\\wermgr.exe\" \"-queuereporting_svc\" \"C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0333223c\""
  792. ]
  793.  
  794. [*] Mutexes: [
  795. "DBWinMutex",
  796. "Local\\mtxLogMeInIgnition.IgnitionMutex",
  797. "Local\\WERReportingForProcess3060",
  798. "Global\\\\xe5\\x88\\x90\\xc2\\xa4",
  799. "Global\\\\xed\\x95\\xb0\\xc7\\x82",
  800. "WERUI_BEX64-eb71ef964c95de5826f5dbf6417783430b96dd1"
  801. ]
  802.  
  803. [*] Modified Files: [
  804. "\\??\\PIPE\\samr",
  805. "C:\\Users\\user\\AppData\\Local\\Temp\\BN65EA.tmp",
  806. "C:\\Users\\user\\AppData\\Local\\Temp\\BNB91.tmp",
  807. "C:\\Windows\\sysnative\\LogFiles\\Scm\\4963ad21-c4a5-42a5-b9bd-e441d57204fe",
  808. "C:\\Windows\\sysnative\\LogFiles\\Scm\\7bbc503c-5977-4798-a4ae-61483a7e030d",
  809. "C:\\Windows\\sysnative\\LogFiles\\Scm\\0efb1c2e-8bcc-468c-aa07-37b1f761840f",
  810. "\\??\\PIPE\\lsarpc",
  811. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WEREE4F.tmp.appcompat.txt",
  812. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERC19.tmp.WERInternalMetadata.xml",
  813. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERC49.tmp.hdmp",
  814. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER1795.tmp.mdmp",
  815. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0333223c\\WEREE4F.tmp.appcompat.txt",
  816. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0333223c\\WERC19.tmp.WERInternalMetadata.xml",
  817. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0333223c\\WERC49.tmp.hdmp",
  818. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0333223c\\WER1795.tmp.mdmp",
  819. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0333223c\\Report.wer",
  820. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0333223c\\Report.wer.tmp"
  821. ]
  822.  
  823. [*] Deleted Files: [
  824. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WEREE4F.tmp",
  825. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WEREE4F.tmp.appcompat.txt",
  826. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERC19.tmp",
  827. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERC19.tmp.WERInternalMetadata.xml",
  828. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERC49.tmp",
  829. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERC49.tmp.hdmp",
  830. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER1795.tmp",
  831. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER1795.tmp.mdmp",
  832. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0333223c\\Report.wer.tmp"
  833. ]
  834.  
  835. [*] Modified Registry Keys: [
  836. "HKEY_CURRENT_USER\\Software\\WinRAR",
  837. "HKEY_CURRENT_USER\\Software\\WinRAR\\HWID",
  838. "HKEY_CURRENT_USER\\Software\\WinRAR\\Client Hash",
  839. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WerSvc\\Type",
  840. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\Type",
  841. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\TimeProviders\\NtpClient\\SpecialPollTimeRemaining",
  842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent",
  843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent"
  844. ]
  845.  
  846. [*] Deleted Registry Keys: []
  847.  
  848. [*] DNS Communications: [
  849. {
  850. "type": "A",
  851. "request": "api.ipify.org",
  852. "answers": [
  853. {
  854. "data": "54.204.36.156",
  855. "type": "A"
  856. },
  857. {
  858. "data": "50.16.229.140",
  859. "type": "A"
  860. },
  861. {
  862. "data": "107.22.215.20",
  863. "type": "A"
  864. },
  865. {
  866. "data": "23.23.243.154",
  867. "type": "A"
  868. },
  869. {
  870. "data": "nagano-19599.herokussl.com",
  871. "type": "CNAME"
  872. },
  873. {
  874. "data": "23.21.121.219",
  875. "type": "A"
  876. },
  877. {
  878. "data": "54.243.147.226",
  879. "type": "A"
  880. },
  881. {
  882. "data": "54.235.124.112",
  883. "type": "A"
  884. },
  885. {
  886. "data": "elb097307-934924932.us-east-1.elb.amazonaws.com",
  887. "type": "CNAME"
  888. },
  889. {
  890. "data": "50.19.247.198",
  891. "type": "A"
  892. }
  893. ]
  894. },
  895. {
  896. "type": "A",
  897. "request": "andpartanthat.com",
  898. "answers": [
  899. {
  900. "data": "54.37.139.198",
  901. "type": "A"
  902. }
  903. ]
  904. },
  905. {
  906. "type": "A",
  907. "request": "geysirland.com",
  908. "answers": [
  909. {
  910. "data": "192.186.250.99",
  911. "type": "A"
  912. }
  913. ]
  914. },
  915. {
  916. "type": "A",
  917. "request": "www.gruenbaum.com.br",
  918. "answers": [
  919. {
  920. "data": "177.12.164.114",
  921. "type": "A"
  922. },
  923. {
  924. "data": "web2067.uni5.net",
  925. "type": "CNAME"
  926. }
  927. ]
  928. }
  929. ]
  930.  
  931. [*] Domains: [
  932. {
  933. "ip": "54.37.139.198",
  934. "domain": "andpartanthat.com"
  935. },
  936. {
  937. "ip": "23.23.243.154",
  938. "domain": "api.ipify.org"
  939. },
  940. {
  941. "ip": "192.186.250.99",
  942. "domain": "geysirland.com"
  943. },
  944. {
  945. "ip": "177.12.164.114",
  946. "domain": "www.gruenbaum.com.br"
  947. }
  948. ]
  949.  
  950. [*] Network Communication - ICMP: []
  951.  
  952. [*] Network Communication - HTTP: [
  953. {
  954. "count": 1,
  955. "body": "",
  956. "uri": "http://api.ipify.org/",
  957. "user-agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko",
  958. "method": "GET",
  959. "host": "api.ipify.org",
  960. "version": "1.1",
  961. "path": "/",
  962. "data": "GET / HTTP/1.1\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko\r\nHost: api.ipify.org\r\nCache-Control: no-cache\r\n\r\n",
  963. "port": 80
  964. },
  965. {
  966. "count": 13,
  967. "body": "GUID=13962712492586483736&BUILD=0207_349876&INFO=Host @ Host\\user&IP=0.0.0.0&TYPE=1&WIN=6.1(x64)",
  968. "uri": "http://andpartanthat.com/4/forum.php",
  969. "user-agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko",
  970. "method": "POST",
  971. "host": "andpartanthat.com",
  972. "version": "1.1",
  973. "path": "/4/forum.php",
  974. "data": "POST /4/forum.php HTTP/1.1\r\nAccept: */*\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko\r\nHost: andpartanthat.com\r\nContent-Length: 108\r\nCache-Control: no-cache\r\n\r\nGUID=13962712492586483736&BUILD=0207_349876&INFO=Host @ Host\\user&IP=0.0.0.0&TYPE=1&WIN=6.1(x64)",
  975. "port": 80
  976. },
  977. {
  978. "count": 1,
  979. "body": "",
  980. "uri": "http://geysirland.com/wp-content/plugins//1",
  981. "user-agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko",
  982. "method": "GET",
  983. "host": "geysirland.com",
  984. "version": "1.1",
  985. "path": "/wp-content/plugins//1",
  986. "data": "GET /wp-content/plugins//1 HTTP/1.1\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko\r\nHost: geysirland.com\r\nCache-Control: no-cache\r\n\r\n",
  987. "port": 80
  988. },
  989. {
  990. "count": 1,
  991. "body": "",
  992. "uri": "http://andpartanthat.com/mlu/forum.php",
  993. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  994. "method": "POST",
  995. "host": "andpartanthat.com",
  996. "version": "1.0",
  997. "path": "/mlu/forum.php",
  998. "data": "POST /mlu/forum.php HTTP/1.0\r\nHost: andpartanthat.com\r\nAccept: */*\r\nAccept-Encoding: identity, *;q=0\r\nAccept-Language: en-US\r\nContent-Length: 208\r\nContent-Type: application/octet-stream\r\nConnection: close\r\nContent-Encoding: binary\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\n\r\n",
  999. "port": 80
  1000. },
  1001. {
  1002. "count": 2,
  1003. "body": "",
  1004. "uri": "http://www.gruenbaum.com.br/wp-content/plugins/qtranslate/art2.exe",
  1005. "user-agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko",
  1006. "method": "GET",
  1007. "host": "www.gruenbaum.com.br",
  1008. "version": "1.1",
  1009. "path": "/wp-content/plugins/qtranslate/art2.exe",
  1010. "data": "GET /wp-content/plugins/qtranslate/art2.exe HTTP/1.1\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko\r\nHost: www.gruenbaum.com.br\r\nCache-Control: no-cache\r\n\r\n",
  1011. "port": 80
  1012. },
  1013. {
  1014. "count": 2,
  1015. "body": "",
  1016. "uri": "http://31.44.184.33/H7mp",
  1017. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.3; .NET CLR 2.0.50727)",
  1018. "method": "GET",
  1019. "host": "31.44.184.33",
  1020. "version": "1.1",
  1021. "path": "/H7mp",
  1022. "data": "GET /H7mp HTTP/1.1\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.3; .NET CLR 2.0.50727)\r\nHost: 31.44.184.33\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n",
  1023. "port": 80
  1024. },
  1025. {
  1026. "count": 23,
  1027. "body": "",
  1028. "uri": "http://31.44.184.33/ga.js",
  1029. "user-agent": "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; NP07; NP07)",
  1030. "method": "GET",
  1031. "host": "31.44.184.33",
  1032. "version": "1.1",
  1033. "path": "/ga.js",
  1034. "data": "GET /ga.js HTTP/1.1\r\nAccept: */*\r\nCookie: BQhbgA3gj6AlqOiphFfDaFALGhJBhY65cEJHIGEiYzXUKJU65KCihqYEvi/McWznEacMqwjzBbIKHtmbLe04t6V+fLJnAbJgEXwkvn/4mUMlC2RuDgc5W6A6PbeQR/YE9SfRxtnnLSpivZ97Mh9xn/FBMmgzMuYuyi+c29ItjgI=\r\nUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; NP07; NP07)\r\nHost: 31.44.184.33\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n",
  1035. "port": 80
  1036. },
  1037. {
  1038. "count": 19,
  1039. "body": "",
  1040. "uri": "http://31.44.184.33/ga.js",
  1041. "user-agent": "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; NP07; NP07)",
  1042. "method": "GET",
  1043. "host": "31.44.184.33",
  1044. "version": "1.1",
  1045. "path": "/ga.js",
  1046. "data": "GET /ga.js HTTP/1.1\r\nAccept: */*\r\nCookie: pc35X9XjDut8k/7XrpFmflAfwF4xwANLjFA2Qa6zjugXXeDzu1X9nwAoUwwBfgXDJLfHeXr+9MN+3LelFo0pPKigqXoQONvKd1ZsxSZMQoN1WqONUFqDYKlr9Sd2/ngqZJ3NOnuTTuQaZf/vdssE4SG+lUeRjwp1Ev1DnWOA6aA=\r\nUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; NP07; NP07)\r\nHost: 31.44.184.33\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n",
  1047. "port": 80
  1048. }
  1049. ]
  1050.  
  1051. [*] Network Communication - SMTP: []
  1052.  
  1053. [*] Network Communication - Hosts: []
  1054.  
  1055. [*] Network Communication - IRC: []
  1056.  
  1057. [*] Static Analysis: {
  1058. "pe": {
  1059. "peid_signatures": null,
  1060. "imports": [
  1061. {
  1062. "imports": [
  1063. {
  1064. "name": "FreeLibrary",
  1065. "address": "0x412000"
  1066. },
  1067. {
  1068. "name": "GetLastError",
  1069. "address": "0x412004"
  1070. },
  1071. {
  1072. "name": "VirtualProtect",
  1073. "address": "0x412008"
  1074. },
  1075. {
  1076. "name": "GetCommandLineW",
  1077. "address": "0x41200c"
  1078. },
  1079. {
  1080. "name": "GetModuleHandleW",
  1081. "address": "0x412010"
  1082. },
  1083. {
  1084. "name": "GetProcAddress",
  1085. "address": "0x412014"
  1086. },
  1087. {
  1088. "name": "InterlockedExchange",
  1089. "address": "0x412018"
  1090. },
  1091. {
  1092. "name": "ExitProcess",
  1093. "address": "0x41201c"
  1094. },
  1095. {
  1096. "name": "GetEnvironmentStringsW",
  1097. "address": "0x412020"
  1098. },
  1099. {
  1100. "name": "Sleep",
  1101. "address": "0x412024"
  1102. },
  1103. {
  1104. "name": "GetSystemDefaultLangID",
  1105. "address": "0x412028"
  1106. },
  1107. {
  1108. "name": "InterlockedCompareExchange",
  1109. "address": "0x41202c"
  1110. },
  1111. {
  1112. "name": "TerminateProcess",
  1113. "address": "0x412030"
  1114. },
  1115. {
  1116. "name": "GetCurrentProcess",
  1117. "address": "0x412034"
  1118. },
  1119. {
  1120. "name": "UnhandledExceptionFilter",
  1121. "address": "0x412038"
  1122. },
  1123. {
  1124. "name": "SetUnhandledExceptionFilter",
  1125. "address": "0x41203c"
  1126. },
  1127. {
  1128. "name": "GetSystemTimeAsFileTime",
  1129. "address": "0x412040"
  1130. },
  1131. {
  1132. "name": "GetCurrentProcessId",
  1133. "address": "0x412044"
  1134. },
  1135. {
  1136. "name": "GetCurrentThreadId",
  1137. "address": "0x412048"
  1138. },
  1139. {
  1140. "name": "GetProcessHeap",
  1141. "address": "0x41204c"
  1142. },
  1143. {
  1144. "name": "GetTickCount",
  1145. "address": "0x412050"
  1146. },
  1147. {
  1148. "name": "QueryPerformanceCounter",
  1149. "address": "0x412054"
  1150. },
  1151. {
  1152. "name": "GlobalAddAtomW",
  1153. "address": "0x412058"
  1154. },
  1155. {
  1156. "name": "IsDebuggerPresent",
  1157. "address": "0x41205c"
  1158. },
  1159. {
  1160. "name": "LoadLibraryExW",
  1161. "address": "0x412060"
  1162. }
  1163. ],
  1164. "dll": "KERNEL32.dll"
  1165. },
  1166. {
  1167. "imports": [
  1168. {
  1169. "name": "CoInitialize",
  1170. "address": "0x412068"
  1171. },
  1172. {
  1173. "name": "CoUninitialize",
  1174. "address": "0x41206c"
  1175. }
  1176. ],
  1177. "dll": "ole32.dll"
  1178. }
  1179. ],
  1180. "digital_signers": null,
  1181. "exported_dll_name": null,
  1182. "actual_checksum": "0x00018dec",
  1183. "overlay": null,
  1184. "imagebase": "0x00400000",
  1185. "reported_checksum": "0x00018dec",
  1186. "icon_hash": null,
  1187. "entrypoint": "0x0040a7af",
  1188. "timestamp": "2019-04-17 05:52:55",
  1189. "osversion": "4.0",
  1190. "sections": [
  1191. {
  1192. "name": ".text",
  1193. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1194. "virtual_address": "0x00001000",
  1195. "size_of_data": "0x00010e00",
  1196. "entropy": "5.14",
  1197. "raw_address": "0x00000400",
  1198. "virtual_size": "0x00010c90",
  1199. "characteristics_raw": "0x60000020"
  1200. },
  1201. {
  1202. "name": ".rdata",
  1203. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1204. "virtual_address": "0x00012000",
  1205. "size_of_data": "0x00000a00",
  1206. "entropy": "3.11",
  1207. "raw_address": "0x00011200",
  1208. "virtual_size": "0x0000092c",
  1209. "characteristics_raw": "0x40000040"
  1210. },
  1211. {
  1212. "name": ".data",
  1213. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1214. "virtual_address": "0x00013000",
  1215. "size_of_data": "0x00003c00",
  1216. "entropy": "1.08",
  1217. "raw_address": "0x00011c00",
  1218. "virtual_size": "0x00006cc0",
  1219. "characteristics_raw": "0xc0000040"
  1220. },
  1221. {
  1222. "name": ".rsrc",
  1223. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1224. "virtual_address": "0x0001a000",
  1225. "size_of_data": "0x00002000",
  1226. "entropy": "5.21",
  1227. "raw_address": "0x00015800",
  1228. "virtual_size": "0x00002000",
  1229. "characteristics_raw": "0x40000040"
  1230. }
  1231. ],
  1232. "resources": [],
  1233. "dirents": [
  1234. {
  1235. "virtual_address": "0x00002f10",
  1236. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1237. "size": "0x0000049c"
  1238. },
  1239. {
  1240. "virtual_address": "0x00012640",
  1241. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1242. "size": "0x0000003c"
  1243. },
  1244. {
  1245. "virtual_address": "0x0001a000",
  1246. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1247. "size": "0x00001328"
  1248. },
  1249. {
  1250. "virtual_address": "0x00000000",
  1251. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1252. "size": "0x00000000"
  1253. },
  1254. {
  1255. "virtual_address": "0x00000000",
  1256. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1257. "size": "0x00000000"
  1258. },
  1259. {
  1260. "virtual_address": "0x00000000",
  1261. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1262. "size": "0x00000000"
  1263. },
  1264. {
  1265. "virtual_address": "0x00000000",
  1266. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1267. "size": "0x00000000"
  1268. },
  1269. {
  1270. "virtual_address": "0x00000000",
  1271. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1272. "size": "0x00000000"
  1273. },
  1274. {
  1275. "virtual_address": "0x00000000",
  1276. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1277. "size": "0x00000000"
  1278. },
  1279. {
  1280. "virtual_address": "0x00000000",
  1281. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1282. "size": "0x00000000"
  1283. },
  1284. {
  1285. "virtual_address": "0x00000000",
  1286. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1287. "size": "0x00000000"
  1288. },
  1289. {
  1290. "virtual_address": "0x00000000",
  1291. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1292. "size": "0x00000000"
  1293. },
  1294. {
  1295. "virtual_address": "0x00012000",
  1296. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1297. "size": "0x00000074"
  1298. },
  1299. {
  1300. "virtual_address": "0x00000000",
  1301. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1302. "size": "0x00000000"
  1303. },
  1304. {
  1305. "virtual_address": "0x00000000",
  1306. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1307. "size": "0x00000000"
  1308. },
  1309. {
  1310. "virtual_address": "0x00000000",
  1311. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1312. "size": "0x00000000"
  1313. }
  1314. ],
  1315. "exports": [],
  1316. "guest_signers": {},
  1317. "imphash": "255baa199749cf1034252ceb61a58ccd",
  1318. "icon_fuzzy": null,
  1319. "icon": null,
  1320. "pdbpath": null,
  1321. "imported_dll_count": 2,
  1322. "versioninfo": []
  1323. }
  1324. }
  1325.  
  1326. [*] Resolved APIs: [
  1327. "kernel32.dll.GetModuleHandleA",
  1328. "kernel32.dll.LoadLibraryA",
  1329. "kernel32.dll.VirtualAlloc",
  1330. "kernel32.dll.VirtualFree",
  1331. "kernel32.dll.OutputDebugStringA",
  1332. "ntdll.dll._stricmp",
  1333. "ntdll.dll.memset",
  1334. "ntdll.dll.memcpy",
  1335. "wininet.dll.InternetOpenA",
  1336. "wininet.dll.HttpSendRequestA",
  1337. "wininet.dll.HttpQueryInfoA",
  1338. "wininet.dll.InternetCrackUrlA",
  1339. "wininet.dll.HttpOpenRequestA",
  1340. "wininet.dll.InternetSetOptionA",
  1341. "wininet.dll.InternetQueryOptionA",
  1342. "wininet.dll.InternetReadFile",
  1343. "wininet.dll.InternetConnectA",
  1344. "wininet.dll.InternetCloseHandle",
  1345. "iphlpapi.dll.GetAdaptersAddresses",
  1346. "psapi.dll.GetProcessImageFileNameA",
  1347. "psapi.dll.EnumProcesses",
  1348. "ntdll.dll.RtlDecompressBuffer",
  1349. "kernel32.dll.GetComputerNameA",
  1350. "kernel32.dll.CreateFileA",
  1351. "kernel32.dll.GetTempFileNameA",
  1352. "kernel32.dll.HeapAlloc",
  1353. "kernel32.dll.HeapFree",
  1354. "kernel32.dll.GetProcessHeap",
  1355. "kernel32.dll.VirtualQuery",
  1356. "kernel32.dll.GetVersion",
  1357. "kernel32.dll.lstrcpyA",
  1358. "kernel32.dll.lstrlenA",
  1359. "kernel32.dll.GetWindowsDirectoryA",
  1360. "kernel32.dll.GetVolumeInformationA",
  1361. "kernel32.dll.ExitProcess",
  1362. "kernel32.dll.Sleep",
  1363. "kernel32.dll.lstrcatA",
  1364. "kernel32.dll.GetModuleFileNameA",
  1365. "kernel32.dll.CreateProcessA",
  1366. "kernel32.dll.GetProcAddress",
  1367. "kernel32.dll.VirtualAllocEx",
  1368. "kernel32.dll.VirtualFreeEx",
  1369. "kernel32.dll.OpenProcess",
  1370. "kernel32.dll.TerminateProcess",
  1371. "kernel32.dll.CreateThread",
  1372. "kernel32.dll.GetProcessId",
  1373. "kernel32.dll.GetLastError",
  1374. "kernel32.dll.WriteProcessMemory",
  1375. "kernel32.dll.GetThreadContext",
  1376. "kernel32.dll.SetThreadContext",
  1377. "kernel32.dll.ResumeThread",
  1378. "kernel32.dll.WriteFile",
  1379. "kernel32.dll.CloseHandle",
  1380. "kernel32.dll.GetSystemInfo",
  1381. "kernel32.dll.lstrcmpiA",
  1382. "kernel32.dll.GetEnvironmentVariableA",
  1383. "kernel32.dll.GetTempPathA",
  1384. "user32.dll.wsprintfA",
  1385. "advapi32.dll.CryptDestroyHash",
  1386. "advapi32.dll.CryptHashData",
  1387. "advapi32.dll.CryptCreateHash",
  1388. "advapi32.dll.CryptDecrypt",
  1389. "advapi32.dll.CryptDestroyKey",
  1390. "advapi32.dll.CryptDeriveKey",
  1391. "advapi32.dll.CryptReleaseContext",
  1392. "advapi32.dll.CryptAcquireContextA",
  1393. "advapi32.dll.LookupAccountSidA",
  1394. "advapi32.dll.GetTokenInformation",
  1395. "advapi32.dll.OpenProcessToken",
  1396. "kernel32.dll.SortGetHandle",
  1397. "kernel32.dll.SortCloseHandle",
  1398. "sechost.dll.LookupAccountSidLocalA",
  1399. "rasapi32.dll.RasConnectionNotificationW",
  1400. "sechost.dll.NotifyServiceStatusChangeA",
  1401. "cryptbase.dll.SystemFunction036",
  1402. "kernel32.dll.GetNativeSystemInfo",
  1403. "cryptsp.dll.CryptAcquireContextA",
  1404. "cryptsp.dll.CryptCreateHash",
  1405. "cryptsp.dll.CryptHashData",
  1406. "cryptsp.dll.CryptDeriveKey",
  1407. "cryptsp.dll.CryptDecrypt",
  1408. "cryptsp.dll.CryptDestroyHash",
  1409. "cryptsp.dll.CryptDestroyKey",
  1410. "cryptsp.dll.CryptReleaseContext",
  1411. "wsock32.dll.inet_addr",
  1412. "wsock32.dll.gethostbyname",
  1413. "wsock32.dll.socket",
  1414. "wsock32.dll.connect",
  1415. "wsock32.dll.closesocket",
  1416. "wsock32.dll.send",
  1417. "wsock32.dll.select",
  1418. "wsock32.dll.recv",
  1419. "wsock32.dll.setsockopt",
  1420. "wsock32.dll.WSAStartup",
  1421. "kernel32.dll.ReadFile",
  1422. "kernel32.dll.GlobalLock",
  1423. "kernel32.dll.GlobalUnlock",
  1424. "kernel32.dll.LocalFree",
  1425. "kernel32.dll.LocalAlloc",
  1426. "kernel32.dll.GetTickCount",
  1427. "kernel32.dll.GetFileAttributesA",
  1428. "kernel32.dll.ExpandEnvironmentStringsA",
  1429. "kernel32.dll.GetFileSize",
  1430. "kernel32.dll.CreateFileMappingA",
  1431. "kernel32.dll.MapViewOfFile",
  1432. "kernel32.dll.UnmapViewOfFile",
  1433. "kernel32.dll.CreateDirectoryA",
  1434. "kernel32.dll.DeleteFileA",
  1435. "kernel32.dll.GetCurrentProcess",
  1436. "kernel32.dll.WideCharToMultiByte",
  1437. "kernel32.dll.lstrcmpA",
  1438. "kernel32.dll.CreateToolhelp32Snapshot",
  1439. "kernel32.dll.Process32First",
  1440. "kernel32.dll.Process32Next",
  1441. "kernel32.dll.FindFirstFileA",
  1442. "kernel32.dll.FindNextFileA",
  1443. "kernel32.dll.FindClose",
  1444. "kernel32.dll.GetVersionExA",
  1445. "kernel32.dll.GetLocaleInfoA",
  1446. "kernel32.dll.GetPrivateProfileStringA",
  1447. "kernel32.dll.SetCurrentDirectoryA",
  1448. "kernel32.dll.GetPrivateProfileSectionNamesA",
  1449. "kernel32.dll.GetPrivateProfileIntA",
  1450. "kernel32.dll.GetCurrentDirectoryA",
  1451. "kernel32.dll.lstrlenW",
  1452. "kernel32.dll.CreateMutexA",
  1453. "kernel32.dll.LCMapStringA",
  1454. "kernel32.dll.SetUnhandledExceptionFilter",
  1455. "urlmon.dll.ObtainUserAgentString",
  1456. "userenv.dll.LoadUserProfileA",
  1457. "userenv.dll.UnloadUserProfile",
  1458. "ole32.dll.CreateStreamOnHGlobal",
  1459. "ole32.dll.GetHGlobalFromStream",
  1460. "ole32.dll.CoCreateGuid",
  1461. "ole32.dll.CoTaskMemFree",
  1462. "ole32.dll.CoCreateInstance",
  1463. "ole32.dll.OleInitialize",
  1464. "user32.dll.FindWindowExA",
  1465. "user32.dll.SendMessageA",
  1466. "user32.dll.GetClassNameA",
  1467. "user32.dll.SendMessageW",
  1468. "advapi32.dll.RegOpenKeyExA",
  1469. "advapi32.dll.RegQueryValueExA",
  1470. "advapi32.dll.RegCloseKey",
  1471. "advapi32.dll.RegOpenKeyA",
  1472. "advapi32.dll.RegEnumKeyExA",
  1473. "advapi32.dll.RegCreateKeyA",
  1474. "advapi32.dll.RegSetValueExA",
  1475. "advapi32.dll.IsTextUnicode",
  1476. "advapi32.dll.RegOpenCurrentUser",
  1477. "advapi32.dll.GetUserNameA",
  1478. "wininet.dll.InternetCreateUrlA",
  1479. "shlwapi.dll.StrStrIA",
  1480. "shlwapi.dll.StrRChrIA",
  1481. "shlwapi.dll.StrToIntA",
  1482. "shlwapi.dll.StrCmpNIA",
  1483. "shlwapi.dll.StrStrIW",
  1484. "shlwapi.dll.StrStrA",
  1485. "uxtheme.dll.ThemeInitApiHook",
  1486. "user32.dll.IsProcessDPIAware",
  1487. "ole32.dll.StgOpenStorage",
  1488. "crypt32.dll.CryptUnprotectData",
  1489. "crypt32.dll.CertOpenSystemStoreA",
  1490. "crypt32.dll.CertEnumCertificatesInStore",
  1491. "crypt32.dll.CertCloseStore",
  1492. "crypt32.dll.CryptAcquireCertificatePrivateKey",
  1493. "advapi32.dll.AllocateAndInitializeSid",
  1494. "advapi32.dll.CheckTokenMembership",
  1495. "advapi32.dll.FreeSid",
  1496. "advapi32.dll.CredEnumerateA",
  1497. "advapi32.dll.CredFree",
  1498. "advapi32.dll.CryptGetUserKey",
  1499. "advapi32.dll.CryptExportKey",
  1500. "advapi32.dll.RevertToSelf",
  1501. "advapi32.dll.ImpersonateLoggedOnUser",
  1502. "advapi32.dll.ConvertSidToStringSidA",
  1503. "advapi32.dll.LogonUserA",
  1504. "advapi32.dll.LookupPrivilegeValueA",
  1505. "advapi32.dll.AdjustTokenPrivileges",
  1506. "advapi32.dll.CreateProcessAsUserA",
  1507. "shell32.dll.SHGetFolderPathA",
  1508. "netapi32.dll.NetApiBufferFree",
  1509. "netapi32.dll.NetUserEnum",
  1510. "kernel32.dll.WTSGetActiveConsoleSessionId",
  1511. "kernel32.dll.ProcessIdToSessionId",
  1512. "vaultcli.dll.VaultOpenVault",
  1513. "vaultcli.dll.VaultEnumerateItems",
  1514. "vaultcli.dll.VaultGetItem",
  1515. "vaultcli.dll.VaultCloseVault",
  1516. "vaultcli.dll.VaultFree",
  1517. "msi.dll.MsiGetComponentPathA",
  1518. "pstorec.dll.PStoreCreateInstance",
  1519. "userenv.dll.CreateEnvironmentBlock",
  1520. "userenv.dll.DestroyEnvironmentBlock",
  1521. "kernel32.dll.IsWow64Process",
  1522. "mlang.dll.#112",
  1523. "wininet.dll.FindFirstUrlCacheEntryA",
  1524. "urlmon.dll.CreateUri",
  1525. "kernel32.dll.InitializeSRWLock",
  1526. "kernel32.dll.AcquireSRWLockExclusive",
  1527. "kernel32.dll.AcquireSRWLockShared",
  1528. "kernel32.dll.ReleaseSRWLockExclusive",
  1529. "kernel32.dll.ReleaseSRWLockShared",
  1530. "wininet.dll.FindNextUrlCacheEntryA",
  1531. "urlmon.dll.CreateIUriBuilder",
  1532. "urlmon.dll.IntlPercentEncodeNormalize",
  1533. "wininet.dll.FindCloseUrlCache",
  1534. "samlib.dll.SamConnect",
  1535. "rpcrt4.dll.NdrClientCall2",
  1536. "rpcrt4.dll.RpcStringBindingComposeW",
  1537. "rpcrt4.dll.RpcBindingFromStringBindingW",
  1538. "rpcrt4.dll.RpcStringFreeW",
  1539. "rpcrt4.dll.RpcBindingFree",
  1540. "samlib.dll.SamGetCompatibilityMode",
  1541. "samlib.dll.SamOpenDomain",
  1542. "samlib.dll.SamEnumerateDomainsInSamServer",
  1543. "samlib.dll.SamLookupDomainInSamServer",
  1544. "samlib.dll.SamFreeMemory",
  1545. "samlib.dll.SamEnumerateUsersInDomain",
  1546. "samlib.dll.SamOpenUser",
  1547. "samlib.dll.SamQueryInformationUser",
  1548. "samlib.dll.SamQuerySecurityObject",
  1549. "samlib.dll.SamGetGroupsForUser",
  1550. "samlib.dll.SamRidToSid",
  1551. "samlib.dll.SamGetAliasMembership",
  1552. "samlib.dll.SamCloseHandle",
  1553. "sspicli.dll.LogonUserExExW",
  1554. "kernel32.dll.SetThreadUILanguage",
  1555. "kernel32.dll.CopyFileExW",
  1556. "kernel32.dll.IsDebuggerPresent",
  1557. "kernel32.dll.SetConsoleInputExeNameW",
  1558. "kernel32.dll.DeleteCriticalSection",
  1559. "kernel32.dll.EnterCriticalSection",
  1560. "kernel32.dll.FreeLibrary",
  1561. "kernel32.dll.GetCurrentProcessId",
  1562. "kernel32.dll.GetCurrentThreadId",
  1563. "kernel32.dll.GetStartupInfoA",
  1564. "kernel32.dll.GetSystemTimeAsFileTime",
  1565. "kernel32.dll.InitializeCriticalSection",
  1566. "kernel32.dll.LeaveCriticalSection",
  1567. "kernel32.dll.LoadLibraryW",
  1568. "kernel32.dll.QueryPerformanceCounter",
  1569. "kernel32.dll.TlsGetValue",
  1570. "kernel32.dll.UnhandledExceptionFilter",
  1571. "kernel32.dll.VirtualProtect",
  1572. "msvcrt.dll.__dllonexit",
  1573. "msvcrt.dll.__getmainargs",
  1574. "msvcrt.dll.__initenv",
  1575. "msvcrt.dll.__lconv_init",
  1576. "msvcrt.dll.__set_app_type",
  1577. "msvcrt.dll.__setusermatherr",
  1578. "msvcrt.dll._acmdln",
  1579. "msvcrt.dll._amsg_exit",
  1580. "msvcrt.dll._cexit",
  1581. "msvcrt.dll._fmode",
  1582. "msvcrt.dll._initterm",
  1583. "msvcrt.dll._iob",
  1584. "msvcrt.dll._lock",
  1585. "msvcrt.dll._onexit",
  1586. "msvcrt.dll._unlock",
  1587. "msvcrt.dll._winmajor",
  1588. "msvcrt.dll.abort",
  1589. "msvcrt.dll.calloc",
  1590. "msvcrt.dll.exit",
  1591. "msvcrt.dll.fprintf",
  1592. "msvcrt.dll.free",
  1593. "msvcrt.dll.fwrite",
  1594. "msvcrt.dll.malloc",
  1595. "msvcrt.dll.memcpy",
  1596. "msvcrt.dll.signal",
  1597. "msvcrt.dll.strlen",
  1598. "msvcrt.dll.strncmp",
  1599. "msvcrt.dll.vfprintf",
  1600. "kernel32.dll.UpdateProcThreadAttribute",
  1601. "kernel32.dll.CreateRemoteThread",
  1602. "kernel32.dll.VirtualProtectEx",
  1603. "kernel32.dll.DuplicateHandle",
  1604. "kernel32.dll.InitializeProcThreadAttributeList",
  1605. "kernel32.dll.Thread32First",
  1606. "kernel32.dll.Thread32Next",
  1607. "kernel32.dll.SetLastError",
  1608. "kernel32.dll.OpenThread",
  1609. "kernel32.dll.SuspendThread",
  1610. "kernel32.dll.PeekNamedPipe",
  1611. "kernel32.dll.WaitNamedPipeA",
  1612. "kernel32.dll.SetNamedPipeHandleState",
  1613. "kernel32.dll.DeleteProcThreadAttributeList",
  1614. "kernel32.dll.MoveFileA",
  1615. "kernel32.dll.CopyFileA",
  1616. "kernel32.dll.FileTimeToSystemTime",
  1617. "kernel32.dll.GetLogicalDrives",
  1618. "kernel32.dll.SystemTimeToTzSpecificLocalTime",
  1619. "kernel32.dll.GetFullPathNameA",
  1620. "kernel32.dll.CreateNamedPipeA",
  1621. "kernel32.dll.GetCurrentThread",
  1622. "kernel32.dll.ConnectNamedPipe",
  1623. "kernel32.dll.GetFileTime",
  1624. "kernel32.dll.CreatePipe",
  1625. "kernel32.dll.GetCurrentDirectoryW",
  1626. "kernel32.dll.FlushFileBuffers",
  1627. "kernel32.dll.DisconnectNamedPipe",
  1628. "kernel32.dll.MultiByteToWideChar",
  1629. "kernel32.dll.SetFileTime",
  1630. "kernel32.dll.WaitForSingleObject",
  1631. "kernel32.dll.SetEnvironmentVariableW",
  1632. "kernel32.dll.SetEnvironmentVariableA",
  1633. "kernel32.dll.CompareStringW",
  1634. "kernel32.dll.CompareStringA",
  1635. "kernel32.dll.SetEndOfFile",
  1636. "kernel32.dll.GetStringTypeW",
  1637. "kernel32.dll.GetStringTypeA",
  1638. "kernel32.dll.LCMapStringW",
  1639. "kernel32.dll.GetModuleFileNameW",
  1640. "kernel32.dll.SetStdHandle",
  1641. "kernel32.dll.WriteConsoleW",
  1642. "kernel32.dll.GetConsoleOutputCP",
  1643. "kernel32.dll.WriteConsoleA",
  1644. "kernel32.dll.HeapSize",
  1645. "kernel32.dll.IsValidCodePage",
  1646. "kernel32.dll.GetCPInfo",
  1647. "kernel32.dll.DebugBreak",
  1648. "kernel32.dll.RaiseException",
  1649. "kernel32.dll.GetEnvironmentStringsW",
  1650. "kernel32.dll.FreeEnvironmentStringsW",
  1651. "kernel32.dll.GetOEMCP",
  1652. "kernel32.dll.GetLocalTime",
  1653. "kernel32.dll.GetACP",
  1654. "kernel32.dll.GetEnvironmentStrings",
  1655. "kernel32.dll.FreeEnvironmentStringsA",
  1656. "kernel32.dll.SetFilePointer",
  1657. "kernel32.dll.GetFileType",
  1658. "kernel32.dll.GetModuleHandleW",
  1659. "kernel32.dll.RemoveDirectoryA",
  1660. "kernel32.dll.GetCommandLineA",
  1661. "kernel32.dll.HeapCreate",
  1662. "kernel32.dll.HeapDestroy",
  1663. "kernel32.dll.HeapReAlloc",
  1664. "kernel32.dll.GetStdHandle",
  1665. "kernel32.dll.TlsAlloc",
  1666. "kernel32.dll.TlsSetValue",
  1667. "kernel32.dll.TlsFree",
  1668. "kernel32.dll.InterlockedIncrement",
  1669. "kernel32.dll.InterlockedDecrement",
  1670. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  1671. "kernel32.dll.RtlUnwind",
  1672. "kernel32.dll.GetConsoleCP",
  1673. "kernel32.dll.GetConsoleMode",
  1674. "kernel32.dll.SetHandleCount",
  1675. "advapi32.dll.RegEnumValueA",
  1676. "advapi32.dll.CloseServiceHandle",
  1677. "advapi32.dll.CreateProcessWithLogonW",
  1678. "advapi32.dll.DeleteService",
  1679. "advapi32.dll.CryptGenRandom",
  1680. "advapi32.dll.DuplicateTokenEx",
  1681. "advapi32.dll.SetSecurityDescriptorDacl",
  1682. "advapi32.dll.InitializeSecurityDescriptor",
  1683. "advapi32.dll.RegEnumKeyA",
  1684. "advapi32.dll.ControlService",
  1685. "advapi32.dll.QueryServiceStatusEx",
  1686. "advapi32.dll.ImpersonateNamedPipeClient",
  1687. "advapi32.dll.OpenThreadToken",
  1688. "advapi32.dll.OpenServiceA",
  1689. "advapi32.dll.OpenSCManagerA",
  1690. "advapi32.dll.QueryServiceStatus",
  1691. "advapi32.dll.CreateProcessWithTokenW",
  1692. "advapi32.dll.StartServiceA",
  1693. "advapi32.dll.CreateServiceA",
  1694. "wininet.dll.InternetQueryDataAvailable",
  1695. "dnsapi.dll.DnsFree",
  1696. "dnsapi.dll.DnsQuery_A",
  1697. "iphlpapi.dll.GetIfEntry",
  1698. "iphlpapi.dll.GetIpAddrTable",
  1699. "secur32.dll.LsaCallAuthenticationPackage",
  1700. "secur32.dll.LsaConnectUntrusted",
  1701. "secur32.dll.LsaLookupAuthenticationPackage",
  1702. "kernel32.dll.FlsAlloc",
  1703. "kernel32.dll.FlsGetValue",
  1704. "kernel32.dll.FlsSetValue",
  1705. "kernel32.dll.FlsFree",
  1706. "cryptsp.dll.CryptGenRandom",
  1707. "sechost.dll.LookupAccountNameLocalW",
  1708. "advapi32.dll.LookupAccountSidW",
  1709. "sechost.dll.LookupAccountSidLocalW",
  1710. "wersvc.dll.ServiceMain",
  1711. "wersvc.dll.SvchostPushServiceGlobals",
  1712. "advapi32.dll.RegGetValueW",
  1713. "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  1714. "faultrep.dll.WerpInitiateCrashReporting",
  1715. "wer.dll.WerpCreateMachineStore",
  1716. "shell32.dll.SHGetFolderPathEx",
  1717. "ole32.dll.StringFromGUID2",
  1718. "profapi.dll.#104",
  1719. "sechost.dll.ConvertSidToStringSidW",
  1720. "sspicli.dll.GetUserNameExW",
  1721. "wer.dll.WerpSvcReportFromMachineQueue",
  1722. "advapi32.dll.DuplicateToken",
  1723. "wtsapi32.dll.WTSQueryUserToken",
  1724. "winsta.dll.WinStationQueryInformationW",
  1725. "advapi32.dll.CreateWellKnownSid",
  1726. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  1727. "rpcrt4.dll.NdrClientCall3",
  1728. "advapi32.dll.CreateProcessAsUserW",
  1729. "ole32.dll.CoInitializeEx",
  1730. "ole32.dll.CoInitializeSecurity",
  1731. "w32time.dll.SvchostEntry_W32Time",
  1732. "w32time.dll.SvchostPushServiceGlobals",
  1733. "ws2_32.dll.#115",
  1734. "ws2_32.dll.WSASocketW",
  1735. "ws2_32.dll.WSAIoctl",
  1736. "ws2_32.dll.#111",
  1737. "userenv.dll.RegisterGPNotification",
  1738. "gpapi.dll.RegisterGPNotificationInternal",
  1739. "sechost.dll.OpenSCManagerW",
  1740. "sechost.dll.OpenServiceW",
  1741. "sechost.dll.CloseServiceHandle",
  1742. "sechost.dll.QueryServiceConfigW",
  1743. "dsrole.dll.DsRoleGetPrimaryDomainInformation",
  1744. "dsrole.dll.DsRoleFreeMemory",
  1745. "sspicli.dll.LsaRegisterPolicyChangeNotification",
  1746. "w32time.dll.TimeProvClose",
  1747. "w32time.dll.TimeProvCommand",
  1748. "w32time.dll.TimeProvOpen",
  1749. "ws2_32.dll.getaddrinfo",
  1750. "ws2_32.dll.freeaddrinfo",
  1751. "ws2_32.dll.#23",
  1752. "ws2_32.dll.#21",
  1753. "ws2_32.dll.#2",
  1754. "ws2_32.dll.WSAEventSelect",
  1755. "vmictimeprovider.dll.TimeProvClose",
  1756. "vmictimeprovider.dll.TimeProvCommand",
  1757. "vmictimeprovider.dll.TimeProvOpen",
  1758. "advapi32.dll.EventRegister",
  1759. "advapi32.dll.EventEnabled",
  1760. "ws2_32.dll.GetAddrInfoW",
  1761. "advapi32.dll.EventWrite",
  1762. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  1763. "ws2_32.dll.FreeAddrInfoW",
  1764. "ws2_32.dll.WSAAddressToStringW",
  1765. "ws2_32.dll.#3",
  1766. "ws2_32.dll.#116",
  1767. "advapi32.dll.EventUnregister",
  1768. "sspicli.dll.LsaUnregisterPolicyChangeNotification",
  1769. "userenv.dll.UnregisterGPNotification",
  1770. "gpapi.dll.UnregisterGPNotificationInternal",
  1771. "imm32.dll.ImmDisableIME",
  1772. "psapi.dll.GetModuleFileNameExW",
  1773. "version.dll.GetFileVersionInfoSizeW",
  1774. "version.dll.GetFileVersionInfoW",
  1775. "version.dll.VerQueryValueW",
  1776. "wer.dll.WerpCreateIntegratorReportId",
  1777. "wer.dll.WerReportCreate",
  1778. "wer.dll.WerpSetIntegratorReportId",
  1779. "wer.dll.WerReportSetParameter",
  1780. "dbgeng.dll.DebugCreate",
  1781. "ntdll.dll.CsrGetProcessId",
  1782. "ntdll.dll.DbgBreakPoint",
  1783. "ntdll.dll.DbgPrint",
  1784. "ntdll.dll.DbgPrompt",
  1785. "ntdll.dll.DbgUiConvertStateChangeStructure",
  1786. "ntdll.dll.DbgUiGetThreadDebugObject",
  1787. "ntdll.dll.DbgUiIssueRemoteBreakin",
  1788. "ntdll.dll.DbgUiSetThreadDebugObject",
  1789. "ntdll.dll.NtAllocateVirtualMemory",
  1790. "ntdll.dll.NtClose",
  1791. "ntdll.dll.NtCreateDebugObject",
  1792. "ntdll.dll.NtCreateFile",
  1793. "ntdll.dll.NtDebugActiveProcess",
  1794. "ntdll.dll.NtDebugContinue",
  1795. "ntdll.dll.NtFreeVirtualMemory",
  1796. "ntdll.dll.NtOpenProcess",
  1797. "ntdll.dll.NtOpenThread",
  1798. "ntdll.dll.NtQueryInformationProcess",
  1799. "ntdll.dll.NtQueryInformationThread",
  1800. "ntdll.dll.NtQueryMutant",
  1801. "ntdll.dll.NtQueryObject",
  1802. "ntdll.dll.NtQuerySystemInformation",
  1803. "ntdll.dll.NtRemoveProcessDebug",
  1804. "ntdll.dll.NtResumeThread",
  1805. "ntdll.dll.NtSetInformationDebugObject",
  1806. "ntdll.dll.NtSetInformationProcess",
  1807. "ntdll.dll.NtSystemDebugControl",
  1808. "ntdll.dll.NtWaitForDebugEvent",
  1809. "ntdll.dll.RtlAnsiStringToUnicodeString",
  1810. "ntdll.dll.RtlCreateProcessParameters",
  1811. "ntdll.dll.RtlCreateUserProcess",
  1812. "ntdll.dll.RtlDestroyProcessParameters",
  1813. "ntdll.dll.RtlDosPathNameToNtPathName_U",
  1814. "ntdll.dll.RtlFindMessage",
  1815. "ntdll.dll.RtlFreeHeap",
  1816. "ntdll.dll.RtlFreeUnicodeString",
  1817. "ntdll.dll.RtlGetFunctionTableListHead",
  1818. "ntdll.dll.RtlGetUnloadEventTrace",
  1819. "ntdll.dll.RtlGetUnloadEventTraceEx",
  1820. "ntdll.dll.RtlInitAnsiString",
  1821. "ntdll.dll.RtlInitUnicodeString",
  1822. "ntdll.dll.RtlTryEnterCriticalSection",
  1823. "ntdll.dll.RtlUnicodeStringToAnsiString",
  1824. "ntdll.dll.NtOpenProcessToken",
  1825. "ntdll.dll.NtOpenThreadToken",
  1826. "ntdll.dll.NtQueryInformationToken",
  1827. "kernel32.dll.CloseProfileUserMapping",
  1828. "kernel32.dll.DebugActiveProcessStop",
  1829. "kernel32.dll.DebugBreakProcess",
  1830. "kernel32.dll.DebugSetProcessKillOnExit",
  1831. "kernel32.dll.Module32First",
  1832. "kernel32.dll.Module32FirstW",
  1833. "kernel32.dll.Module32Next",
  1834. "kernel32.dll.Module32NextW",
  1835. "kernel32.dll.Process32FirstW",
  1836. "kernel32.dll.Process32NextW",
  1837. "kernel32.dll.SetProcessShutdownParameters",
  1838. "kernel32.dll.GetTimeZoneInformation",
  1839. "kernel32.dll.Wow64GetThreadSelectorEntry",
  1840. "advapi32.dll.CreateServiceW",
  1841. "advapi32.dll.EnumServicesStatusExA",
  1842. "advapi32.dll.EnumServicesStatusExW",
  1843. "advapi32.dll.GetEventLogInformation",
  1844. "advapi32.dll.OpenSCManagerW",
  1845. "advapi32.dll.OpenServiceW",
  1846. "advapi32.dll.StartServiceW",
  1847. "advapi32.dll.GetSidSubAuthority",
  1848. "advapi32.dll.GetSidSubAuthorityCount",
  1849. "version.dll.GetFileVersionInfoSizeExW",
  1850. "version.dll.GetFileVersionInfoExW",
  1851. "dbghelp.dll.WinDbgExtensionDllInit",
  1852. "dbghelp.dll.ExtensionApiVersion",
  1853. "wer.dll.WerpSetDynamicParameter",
  1854. "wer.dll.WerReportAddDump",
  1855. "wer.dll.WerpSetCallBack",
  1856. "wer.dll.WerReportSetUIOption",
  1857. "wer.dll.WerpAddRegisteredDataToReport",
  1858. "wer.dll.WerReportSubmit",
  1859. "advapi32.dll.RegOpenKeyExW",
  1860. "user32.dll.LoadStringW",
  1861. "advapi32.dll.RegCreateKeyExW",
  1862. "advapi32.dll.RegSetValueExW",
  1863. "advapi32.dll.RegQueryValueExW",
  1864. "sensapi.dll.IsNetworkAlive",
  1865. "user32.dll.CharUpperW",
  1866. "wer.dll.WerpAddAppCompatData",
  1867. "apphelp.dll.SdbGetFileAttributes",
  1868. "apphelp.dll.SdbFormatAttribute",
  1869. "apphelp.dll.SdbFreeFileAttributes",
  1870. "cryptsp.dll.CryptAcquireContextW",
  1871. "cryptsp.dll.CryptGetHashParam",
  1872. "dbghelp.dll.MiniDumpWriteDump",
  1873. "kernel32.dll.GetLongPathNameA",
  1874. "kernel32.dll.GetLongPathNameW",
  1875. "kernel32.dll.GetProcessTimes",
  1876. "powrprof.dll.CallNtPowerInformation",
  1877. "psapi.dll.EnumProcessModules",
  1878. "version.dll.GetFileVersionInfoSizeA",
  1879. "version.dll.GetFileVersionInfoA",
  1880. "version.dll.VerQueryValueA",
  1881. "verifier.dll.VerifierEnumerateResource",
  1882. "ntdll.dll.NtSuspendProcess",
  1883. "ntdll.dll.NtResumeProcess",
  1884. "advapi32.dll.QueryTraceW",
  1885. "advapi32.dll.IsValidSid",
  1886. "advapi32.dll.GetLengthSid",
  1887. "advapi32.dll.CopySid",
  1888. "advapi32.dll.InitializeAcl",
  1889. "advapi32.dll.AddAccessAllowedAceEx",
  1890. "advapi32.dll.RegisterEventSourceW",
  1891. "advapi32.dll.ReportEventW",
  1892. "advapi32.dll.DeregisterEventSource",
  1893. "wer.dll.WerpGetStoreLocation",
  1894. "wer.dll.WerpGetStoreType",
  1895. "wer.dll.WerReportCloseHandle",
  1896. "user32.dll.MsgWaitForMultipleObjects",
  1897. "wer.dll.WerpFreeString",
  1898. "user32.dll.GetProcessWindowStation",
  1899. "user32.dll.GetThreadDesktop",
  1900. "user32.dll.GetUserObjectInformationW",
  1901. "werui.dll.WerUICreate",
  1902. "werui.dll.WerUIStart",
  1903. "werui.dll.WerUITerminate",
  1904. "werui.dll.WerUIDelete"
  1905. ]
  1906.  
  1907. [*] Static Analysis: {
  1908. "pe": {
  1909. "peid_signatures": null,
  1910. "imports": [
  1911. {
  1912. "imports": [
  1913. {
  1914. "name": "FreeLibrary",
  1915. "address": "0x412000"
  1916. },
  1917. {
  1918. "name": "GetLastError",
  1919. "address": "0x412004"
  1920. },
  1921. {
  1922. "name": "VirtualProtect",
  1923. "address": "0x412008"
  1924. },
  1925. {
  1926. "name": "GetCommandLineW",
  1927. "address": "0x41200c"
  1928. },
  1929. {
  1930. "name": "GetModuleHandleW",
  1931. "address": "0x412010"
  1932. },
  1933. {
  1934. "name": "GetProcAddress",
  1935. "address": "0x412014"
  1936. },
  1937. {
  1938. "name": "InterlockedExchange",
  1939. "address": "0x412018"
  1940. },
  1941. {
  1942. "name": "ExitProcess",
  1943. "address": "0x41201c"
  1944. },
  1945. {
  1946. "name": "GetEnvironmentStringsW",
  1947. "address": "0x412020"
  1948. },
  1949. {
  1950. "name": "Sleep",
  1951. "address": "0x412024"
  1952. },
  1953. {
  1954. "name": "GetSystemDefaultLangID",
  1955. "address": "0x412028"
  1956. },
  1957. {
  1958. "name": "InterlockedCompareExchange",
  1959. "address": "0x41202c"
  1960. },
  1961. {
  1962. "name": "TerminateProcess",
  1963. "address": "0x412030"
  1964. },
  1965. {
  1966. "name": "GetCurrentProcess",
  1967. "address": "0x412034"
  1968. },
  1969. {
  1970. "name": "UnhandledExceptionFilter",
  1971. "address": "0x412038"
  1972. },
  1973. {
  1974. "name": "SetUnhandledExceptionFilter",
  1975. "address": "0x41203c"
  1976. },
  1977. {
  1978. "name": "GetSystemTimeAsFileTime",
  1979. "address": "0x412040"
  1980. },
  1981. {
  1982. "name": "GetCurrentProcessId",
  1983. "address": "0x412044"
  1984. },
  1985. {
  1986. "name": "GetCurrentThreadId",
  1987. "address": "0x412048"
  1988. },
  1989. {
  1990. "name": "GetProcessHeap",
  1991. "address": "0x41204c"
  1992. },
  1993. {
  1994. "name": "GetTickCount",
  1995. "address": "0x412050"
  1996. },
  1997. {
  1998. "name": "QueryPerformanceCounter",
  1999. "address": "0x412054"
  2000. },
  2001. {
  2002. "name": "GlobalAddAtomW",
  2003. "address": "0x412058"
  2004. },
  2005. {
  2006. "name": "IsDebuggerPresent",
  2007. "address": "0x41205c"
  2008. },
  2009. {
  2010. "name": "LoadLibraryExW",
  2011. "address": "0x412060"
  2012. }
  2013. ],
  2014. "dll": "KERNEL32.dll"
  2015. },
  2016. {
  2017. "imports": [
  2018. {
  2019. "name": "CoInitialize",
  2020. "address": "0x412068"
  2021. },
  2022. {
  2023. "name": "CoUninitialize",
  2024. "address": "0x41206c"
  2025. }
  2026. ],
  2027. "dll": "ole32.dll"
  2028. }
  2029. ],
  2030. "digital_signers": null,
  2031. "exported_dll_name": null,
  2032. "actual_checksum": "0x00018dec",
  2033. "overlay": null,
  2034. "imagebase": "0x00400000",
  2035. "reported_checksum": "0x00018dec",
  2036. "icon_hash": null,
  2037. "entrypoint": "0x0040a7af",
  2038. "timestamp": "2019-04-17 05:52:55",
  2039. "osversion": "4.0",
  2040. "sections": [
  2041. {
  2042. "name": ".text",
  2043. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  2044. "virtual_address": "0x00001000",
  2045. "size_of_data": "0x00010e00",
  2046. "entropy": "5.14",
  2047. "raw_address": "0x00000400",
  2048. "virtual_size": "0x00010c90",
  2049. "characteristics_raw": "0x60000020"
  2050. },
  2051. {
  2052. "name": ".rdata",
  2053. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2054. "virtual_address": "0x00012000",
  2055. "size_of_data": "0x00000a00",
  2056. "entropy": "3.11",
  2057. "raw_address": "0x00011200",
  2058. "virtual_size": "0x0000092c",
  2059. "characteristics_raw": "0x40000040"
  2060. },
  2061. {
  2062. "name": ".data",
  2063. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2064. "virtual_address": "0x00013000",
  2065. "size_of_data": "0x00003c00",
  2066. "entropy": "1.08",
  2067. "raw_address": "0x00011c00",
  2068. "virtual_size": "0x00006cc0",
  2069. "characteristics_raw": "0xc0000040"
  2070. },
  2071. {
  2072. "name": ".rsrc",
  2073. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2074. "virtual_address": "0x0001a000",
  2075. "size_of_data": "0x00002000",
  2076. "entropy": "5.21",
  2077. "raw_address": "0x00015800",
  2078. "virtual_size": "0x00002000",
  2079. "characteristics_raw": "0x40000040"
  2080. }
  2081. ],
  2082. "resources": [],
  2083. "dirents": [
  2084. {
  2085. "virtual_address": "0x00002f10",
  2086. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  2087. "size": "0x0000049c"
  2088. },
  2089. {
  2090. "virtual_address": "0x00012640",
  2091. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  2092. "size": "0x0000003c"
  2093. },
  2094. {
  2095. "virtual_address": "0x0001a000",
  2096. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  2097. "size": "0x00001328"
  2098. },
  2099. {
  2100. "virtual_address": "0x00000000",
  2101. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  2102. "size": "0x00000000"
  2103. },
  2104. {
  2105. "virtual_address": "0x00000000",
  2106. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  2107. "size": "0x00000000"
  2108. },
  2109. {
  2110. "virtual_address": "0x00000000",
  2111. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  2112. "size": "0x00000000"
  2113. },
  2114. {
  2115. "virtual_address": "0x00000000",
  2116. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  2117. "size": "0x00000000"
  2118. },
  2119. {
  2120. "virtual_address": "0x00000000",
  2121. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  2122. "size": "0x00000000"
  2123. },
  2124. {
  2125. "virtual_address": "0x00000000",
  2126. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  2127. "size": "0x00000000"
  2128. },
  2129. {
  2130. "virtual_address": "0x00000000",
  2131. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  2132. "size": "0x00000000"
  2133. },
  2134. {
  2135. "virtual_address": "0x00000000",
  2136. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  2137. "size": "0x00000000"
  2138. },
  2139. {
  2140. "virtual_address": "0x00000000",
  2141. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  2142. "size": "0x00000000"
  2143. },
  2144. {
  2145. "virtual_address": "0x00012000",
  2146. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  2147. "size": "0x00000074"
  2148. },
  2149. {
  2150. "virtual_address": "0x00000000",
  2151. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  2152. "size": "0x00000000"
  2153. },
  2154. {
  2155. "virtual_address": "0x00000000",
  2156. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  2157. "size": "0x00000000"
  2158. },
  2159. {
  2160. "virtual_address": "0x00000000",
  2161. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  2162. "size": "0x00000000"
  2163. }
  2164. ],
  2165. "exports": [],
  2166. "guest_signers": {},
  2167. "imphash": "255baa199749cf1034252ceb61a58ccd",
  2168. "icon_fuzzy": null,
  2169. "icon": null,
  2170. "pdbpath": null,
  2171. "imported_dll_count": 2,
  2172. "versioninfo": []
  2173. }
  2174. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!