API tools faq
paste
paladin316

Exes_f43c5979a76db99509a30c33455125da_exe_2019-06-30_15_30.json

paladin316
Jun 30th, 2019
2,200
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 45.51 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Backdoor"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_f43c5979a76db99509a30c33455125da.exe"
  7. [*] File Size: 115415
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "99eb4b1ee171e79090e52783da2cb71c931102eb5ebeaf08a53a79d9c6b2ab09"
  10. [*] MD5: "f43c5979a76db99509a30c33455125da"
  11. [*] SHA1: "bb856e1e06890c6b794bf0592bd6b4e430d10f5d"
  12. [*] SHA512: "1525c3d5644074bd7808d947dfc0bffce7609cc040576b11a3564efe9a638f984d0bc3f5caf1f493988e473c73a7878200b5b13076ab492ad87b194875066143"
  13. [*] CRC32: "8B76B9C2"
  14. [*] SSDEEP: "3072:OHvUP38EbQ/+MMrvsBNoL+TZdCIO0qqD98J:Z6bFdZoC8"
  15.  
  16. [*] Process Execution: [
  17. "Exes_f43c5979a76db99509a30c33455125da.exe",
  18. "net.exe",
  19. "net1.exe",
  20. "net.exe",
  21. "net1.exe",
  22. "services.exe",
  23. "taskhost.exe",
  24. "svchost.exe",
  25. "WerFault.exe",
  26. "wermgr.exe"
  27. ]
  28.  
  29. [*] Signatures Detected: [
  30. {
  31. "Description": "At least one process apparently crashed during execution",
  32. "Details": []
  33. },
  34. {
  35. "Description": "Attempts to connect to a dead IP:Port (3 unique times)",
  36. "Details": [
  37. {
  38. "IP": "107.165.236.233:2011"
  39. },
  40. {
  41. "IP": "45.39.189.31:2011"
  42. },
  43. {
  44. "IP": "154.90.68.52:2011"
  45. }
  46. ]
  47. },
  48. {
  49. "Description": "Creates RWX memory",
  50. "Details": []
  51. },
  52. {
  53. "Description": "A process attempted to delay the analysis task.",
  54. "Details": [
  55. {
  56. "Process": "Exes_f43c5979a76db99509a30c33455125da.exe tried to sleep 1620 seconds, actually delayed analysis time by 0 seconds"
  57. }
  58. ]
  59. },
  60. {
  61. "Description": "Expresses interest in specific running processes",
  62. "Details": [
  63. {
  64. "process": "Exes_f43c5979a76db99509a30c33455125da.exe"
  65. }
  66. ]
  67. },
  68. {
  69. "Description": "A process created a hidden window",
  70. "Details": [
  71. {
  72. "Process": "Exes_f43c5979a76db99509a30c33455125da.exe -> C:\\Windows\\kk\\svchost.exe"
  73. },
  74. {
  75. "Process": "Exes_f43c5979a76db99509a30c33455125da.exe -> C:\\Windows\\tt\\svchost.exe"
  76. },
  77. {
  78. "Process": "Exes_f43c5979a76db99509a30c33455125da.exe -> C:\\Windows\\bb\\svchost.exe"
  79. }
  80. ]
  81. },
  82. {
  83. "Description": "The binary likely contains encrypted or compressed data.",
  84. "Details": [
  85. {
  86. "section": "name: .UPX1, entropy: 7.88, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0001bcd7, virtual_size: 0x00020206"
  87. }
  88. ]
  89. },
  90. {
  91. "Description": "Deletes its original binary from disk",
  92. "Details": []
  93. },
  94. {
  95. "Description": "Attempts to stop active services",
  96. "Details": [
  97. {
  98. "servicename": "WINDEFEND"
  99. }
  100. ]
  101. },
  102. {
  103. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  104. "Details": [
  105. {
  106. "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 11893556 times"
  107. }
  108. ]
  109. },
  110. {
  111. "Description": "Installs itself for autorun at Windows startup",
  112. "Details": [
  113. {
  114. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\DBDDA081"
  115. },
  116. {
  117. "data": "C:\\Windows\\DBDDA081\\svchsot.exe"
  118. }
  119. ]
  120. },
  121. {
  122. "Description": "File has been identified by 49 Antiviruses on VirusTotal as malicious",
  123. "Details": [
  124. {
  125. "MicroWorld-eScan": "Trojan.GenericKD.32095425"
  126. },
  127. {
  128. "FireEye": "Generic.mg.f43c5979a76db995"
  129. },
  130. {
  131. "McAfee": "Artemis!F43C5979A76D"
  132. },
  133. {
  134. "Cylance": "Unsafe"
  135. },
  136. {
  137. "Alibaba": "Backdoor:Win32/Zegost.7150ede9"
  138. },
  139. {
  140. "Cybereason": "malicious.e06890"
  141. },
  142. {
  143. "NANO-Antivirus": "Trojan.Win32.Gamania.frzyob"
  144. },
  145. {
  146. "F-Prot": "W32/RLPacked.B.gen!Eldorado"
  147. },
  148. {
  149. "Symantec": "ML.Attribute.HighConfidence"
  150. },
  151. {
  152. "ESET-NOD32": "a variant of Generik.CJMJIRS"
  153. },
  154. {
  155. "APEX": "Malicious"
  156. },
  157. {
  158. "Paloalto": "generic.ml"
  159. },
  160. {
  161. "Kaspersky": "Backdoor.Win32.Farfli.bkpm"
  162. },
  163. {
  164. "BitDefender": "Trojan.GenericKD.32095425"
  165. },
  166. {
  167. "ViRobot": "Trojan.Win32.Z.Zegost.115415"
  168. },
  169. {
  170. "Avast": "Win32:Evo-gen [Susp]"
  171. },
  172. {
  173. "Tencent": "Backdoor.Win32.Gh0st.e"
  174. },
  175. {
  176. "Endgame": "malicious (high confidence)"
  177. },
  178. {
  179. "Emsisoft": "Trojan.GenericKD.32095425 (B)"
  180. },
  181. {
  182. "F-Secure": "Trojan.TR/Crypt.XPACK.Gen"
  183. },
  184. {
  185. "DrWeb": "Trojan.PWS.Gamania.38463"
  186. },
  187. {
  188. "VIPRE": "Trojan.Win32.Generic!BT"
  189. },
  190. {
  191. "Invincea": "heuristic"
  192. },
  193. {
  194. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.cc"
  195. },
  196. {
  197. "Sophos": "Mal/EncPk-NQ"
  198. },
  199. {
  200. "SentinelOne": "DFI - Suspicious PE"
  201. },
  202. {
  203. "Cyren": "W32/RLPacked.B.gen!Eldorado"
  204. },
  205. {
  206. "Avira": "TR/Crypt.XPACK.Gen"
  207. },
  208. {
  209. "Microsoft": "Backdoor:Win32/Zegost.AD"
  210. },
  211. {
  212. "Arcabit": "Trojan.Generic.D1E9BCC1"
  213. },
  214. {
  215. "AhnLab-V3": "Malware/Win32.Generic.C3313824"
  216. },
  217. {
  218. "ZoneAlarm": "Backdoor.Win32.Farfli.bkpm"
  219. },
  220. {
  221. "GData": "Trojan.GenericKD.32095425"
  222. },
  223. {
  224. "Acronis": "suspicious"
  225. },
  226. {
  227. "VBA32": "BScope.Trojan.SvcHorse.01643"
  228. },
  229. {
  230. "ALYac": "Trojan.GenericKD.32095425"
  231. },
  232. {
  233. "MAX": "malware (ai score=100)"
  234. },
  235. {
  236. "Ad-Aware": "Trojan.GenericKD.32095425"
  237. },
  238. {
  239. "Malwarebytes": "Trojan.Agent.Generic"
  240. },
  241. {
  242. "TrendMicro-HouseCall": "TROJ_GEN.R002C0DFT19"
  243. },
  244. {
  245. "Rising": "Backdoor.Zegost!8.177 (CLOUD)"
  246. },
  247. {
  248. "Yandex": "Packed/RLPack"
  249. },
  250. {
  251. "Ikarus": "Generic.Trojan.Generic"
  252. },
  253. {
  254. "Fortinet": "W32/Generik.CJMJIRS!tr"
  255. },
  256. {
  257. "MaxSecure": "Trojan.Malware.300983.susgen"
  258. },
  259. {
  260. "AVG": "Win32:Evo-gen [Susp]"
  261. },
  262. {
  263. "Panda": "Trj/CI.A"
  264. },
  265. {
  266. "CrowdStrike": "win/malicious_confidence_100% (W)"
  267. },
  268. {
  269. "Qihoo-360": "Win32/Backdoor.Agent.RI"
  270. }
  271. ]
  272. },
  273. {
  274. "Description": "Checks the system manufacturer, likely for anti-virtualization",
  275. "Details": []
  276. },
  277. {
  278. "Description": "Anomalous binary characteristics",
  279. "Details": [
  280. {
  281. "anomaly": "Found duplicated section names"
  282. }
  283. ]
  284. },
  285. {
  286. "Description": "Created network traffic indicative of malicious activity",
  287. "Details": [
  288. {
  289. "signature": "ET TROJAN Backdoor family PCRat/Gh0st CnC traffic"
  290. }
  291. ]
  292. }
  293. ]
  294.  
  295. [*] Started Service: [
  296. "Schedule",
  297. "WerSvc"
  298. ]
  299.  
  300. [*] Executed Commands: [
  301. "net stop WinDefend",
  302. "net start \"Task Scheduler\"",
  303. "C:\\Windows\\kk\\svchost.exe ",
  304. "C:\\Windows\\tt\\svchost.exe ",
  305. "C:\\Windows\\bb\\svchost.exe ",
  306. "C:\\Windows\\system32\\net1 stop WinDefend",
  307. "C:\\Windows\\system32\\net1 start \"Task Scheduler\"",
  308. "taskhost.exe $(Arg0)",
  309. "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
  310. "C:\\Windows\\system32\\WerFault.exe -u -p 560 -s 288",
  311. "\"C:\\Windows\\system32\\wermgr.exe\" \"-queuereporting_svc\" \"C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_02542930\""
  312. ]
  313.  
  314. [*] Mutexes: [
  315. "14.33.65.161:2012127.0.0.1:2012127.0.0.1:2012",
  316. "Local\\WERReportingForProcess560",
  317. "Global\\\\xe5\\x88\\x90\\xc2\\x96",
  318. "Global\\\\xe1\\x9f\\xa0\\xc7\\x84",
  319. "WERUI_BEX64-e0bfc78dc22baf57413d9e3a2494cb68424d695b"
  320. ]
  321.  
  322. [*] Modified Files: [
  323. "C:\\Windows\\DBDDA081\\svchsot.exe",
  324. "\\??\\PIPE\\atsvc",
  325. "C:\\Windows\\sysnative\\LogFiles\\Scm\\4963ad21-c4a5-42a5-b9bd-e441d57204fe",
  326. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER9F40.tmp.appcompat.txt",
  327. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER4456.tmp.WERInternalMetadata.xml",
  328. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER4476.tmp.hdmp",
  329. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER4E0C.tmp.mdmp",
  330. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_02542930\\WER9F40.tmp.appcompat.txt",
  331. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_02542930\\WER4456.tmp.WERInternalMetadata.xml",
  332. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_02542930\\WER4476.tmp.hdmp",
  333. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_02542930\\WER4E0C.tmp.mdmp",
  334. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_02542930\\Report.wer",
  335. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_02542930\\Report.wer.tmp"
  336. ]
  337.  
  338. [*] Deleted Files: [
  339. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_f43c5979a76db99509a30c33455125da.exe",
  340. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER9F40.tmp",
  341. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER9F40.tmp.appcompat.txt",
  342. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER4456.tmp",
  343. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER4456.tmp.WERInternalMetadata.xml",
  344. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER4476.tmp",
  345. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER4476.tmp.hdmp",
  346. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER4E0C.tmp",
  347. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER4E0C.tmp.mdmp",
  348. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_02542930\\Report.wer.tmp"
  349. ]
  350.  
  351. [*] Modified Registry Keys: [
  352. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\DBDDA081",
  353. "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MediaResources\\msvideo",
  354. "HKEY_LOCAL_MACHINE\\SYSTEM\\InfoTime",
  355. "HKEY_LOCAL_MACHINE\\SYSTEM\\InfoTime\\InfoTime",
  356. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WerSvc\\Type",
  357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent",
  358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent"
  359. ]
  360.  
  361. [*] Deleted Registry Keys: []
  362.  
  363. [*] DNS Communications: [
  364. {
  365. "type": "A",
  366. "request": "www.wk1888.com",
  367. "answers": [
  368. {
  369. "data": "107.165.236.233",
  370. "type": "A"
  371. }
  372. ]
  373. },
  374. {
  375. "type": "A",
  376. "request": "www.af0575.com",
  377. "answers": [
  378. {
  379. "data": "af0575.com",
  380. "type": "CNAME"
  381. },
  382. {
  383. "data": "45.39.189.31",
  384. "type": "A"
  385. }
  386. ]
  387. },
  388. {
  389. "type": "A",
  390. "request": "www.fz0575.com",
  391. "answers": [
  392. {
  393. "data": "154.90.68.52",
  394. "type": "A"
  395. }
  396. ]
  397. }
  398. ]
  399.  
  400. [*] Domains: [
  401. {
  402. "ip": "45.39.189.31",
  403. "domain": "www.af0575.com"
  404. },
  405. {
  406. "ip": "107.165.236.233",
  407. "domain": "www.wk1888.com"
  408. },
  409. {
  410. "ip": "154.90.68.52",
  411. "domain": "www.fz0575.com"
  412. }
  413. ]
  414.  
  415. [*] Network Communication - ICMP: []
  416.  
  417. [*] Network Communication - HTTP: []
  418.  
  419. [*] Network Communication - SMTP: []
  420.  
  421. [*] Network Communication - Hosts: []
  422.  
  423. [*] Network Communication - IRC: []
  424.  
  425. [*] Static Analysis: {
  426. "pe": {
  427. "peid_signatures": null,
  428. "imports": [
  429. {
  430. "imports": [
  431. {
  432. "name": "LoadLibraryA",
  433. "address": "0x44af59"
  434. },
  435. {
  436. "name": "GetProcAddress",
  437. "address": "0x44af5d"
  438. },
  439. {
  440. "name": "VirtualAlloc",
  441. "address": "0x44af61"
  442. },
  443. {
  444. "name": "VirtualProtect",
  445. "address": "0x44af65"
  446. },
  447. {
  448. "name": "VirtualFree",
  449. "address": "0x44af69"
  450. },
  451. {
  452. "name": "GetModuleHandleA",
  453. "address": "0x44af6d"
  454. }
  455. ],
  456. "dll": "kernel32.dll"
  457. }
  458. ],
  459. "digital_signers": null,
  460. "exported_dll_name": "ESF94WERF8",
  461. "actual_checksum": "0x00022cce",
  462. "overlay": null,
  463. "imagebase": "0x00400000",
  464. "reported_checksum": "0x00000000",
  465. "icon_hash": null,
  466. "entrypoint": "0x00401000",
  467. "timestamp": "2017-04-01 16:59:32",
  468. "osversion": "4.0",
  469. "sections": [
  470. {
  471. "name": ".UPX1",
  472. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  473. "virtual_address": "0x00001000",
  474. "size_of_data": "0x00000200",
  475. "entropy": "1.36",
  476. "raw_address": "0x00000400",
  477. "virtual_size": "0x0002f000",
  478. "characteristics_raw": "0x60000020"
  479. },
  480. {
  481. "name": ".UPX1",
  482. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  483. "virtual_address": "0x00030000",
  484. "size_of_data": "0x0001bcd7",
  485. "entropy": "7.88",
  486. "raw_address": "0x00000600",
  487. "virtual_size": "0x00020206",
  488. "characteristics_raw": "0xe0000020"
  489. }
  490. ],
  491. "resources": [],
  492. "dirents": [
  493. {
  494. "virtual_address": "0x0004a36f",
  495. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  496. "size": "0x0000005f"
  497. },
  498. {
  499. "virtual_address": "0x0004af24",
  500. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  501. "size": "0x00000028"
  502. },
  503. {
  504. "virtual_address": "0x00030000",
  505. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  506. "size": "0x00005087"
  507. },
  508. {
  509. "virtual_address": "0x00000000",
  510. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  511. "size": "0x00000000"
  512. },
  513. {
  514. "virtual_address": "0x00000000",
  515. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  516. "size": "0x00000000"
  517. },
  518. {
  519. "virtual_address": "0x00000000",
  520. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  521. "size": "0x00000000"
  522. },
  523. {
  524. "virtual_address": "0x00000000",
  525. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  526. "size": "0x00000000"
  527. },
  528. {
  529. "virtual_address": "0x00000000",
  530. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  531. "size": "0x00000000"
  532. },
  533. {
  534. "virtual_address": "0x00000000",
  535. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  536. "size": "0x00000000"
  537. },
  538. {
  539. "virtual_address": "0x00000000",
  540. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  541. "size": "0x00000000"
  542. },
  543. {
  544. "virtual_address": "0x00000000",
  545. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  546. "size": "0x00000000"
  547. },
  548. {
  549. "virtual_address": "0x00000000",
  550. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  551. "size": "0x00000000"
  552. },
  553. {
  554. "virtual_address": "0x00000000",
  555. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  556. "size": "0x00000000"
  557. },
  558. {
  559. "virtual_address": "0x00000000",
  560. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  561. "size": "0x00000000"
  562. },
  563. {
  564. "virtual_address": "0x00000000",
  565. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  566. "size": "0x00000000"
  567. },
  568. {
  569. "virtual_address": "0x00000000",
  570. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  571. "size": "0x00000000"
  572. }
  573. ],
  574. "exports": [
  575. {
  576. "ordinal": 1,
  577. "name": "Hai",
  578. "address": "0x401b50"
  579. },
  580. {
  581. "ordinal": 2,
  582. "name": "Hai2",
  583. "address": "0x401b40"
  584. },
  585. {
  586. "ordinal": 3,
  587. "name": "zzzz",
  588. "address": "0x401b40"
  589. }
  590. ],
  591. "guest_signers": {},
  592. "imphash": "469b1bae2575baede5bf1f06a01b4767",
  593. "icon_fuzzy": null,
  594. "icon": null,
  595. "pdbpath": null,
  596. "imported_dll_count": 1,
  597. "versioninfo": []
  598. }
  599. }
  600.  
  601. [*] Resolved APIs: [
  602. "kernel32.dll.WinExec",
  603. "kernel32.dll.HeapAlloc",
  604. "kernel32.dll.GetProcessHeap",
  605. "kernel32.dll.GetCurrentProcessId",
  606. "kernel32.dll.VirtualAlloc",
  607. "kernel32.dll.Sleep",
  608. "kernel32.dll.VirtualProtect",
  609. "kernel32.dll.VirtualFree",
  610. "kernel32.dll.GetProcAddress",
  611. "kernel32.dll.LoadLibraryA",
  612. "kernel32.dll.IsBadReadPtr",
  613. "kernel32.dll.HeapFree",
  614. "kernel32.dll.FreeLibrary",
  615. "kernel32.dll.GetStartupInfoA",
  616. "kernel32.dll.GetModuleHandleA",
  617. "user32.dll.wsprintfA",
  618. "msvcrt.dll.??3@YAXPAX@Z",
  619. "msvcrt.dll.realloc",
  620. "msvcrt.dll.free",
  621. "msvcrt.dll.??2@YAPAXI@Z",
  622. "msvcrt.dll._exit",
  623. "msvcrt.dll._XcptFilter",
  624. "msvcrt.dll.exit",
  625. "msvcrt.dll._acmdln",
  626. "msvcrt.dll.__getmainargs",
  627. "msvcrt.dll._initterm",
  628. "msvcrt.dll.__setusermatherr",
  629. "msvcrt.dll._adjust_fdiv",
  630. "msvcrt.dll.__p__commode",
  631. "msvcrt.dll.__p__fmode",
  632. "msvcrt.dll.__set_app_type",
  633. "msvcrt.dll._except_handler3",
  634. "msvcrt.dll._controlfp",
  635. "msvcrt.dll._stricmp",
  636. "kernel32.dll.ExitProcess",
  637. "user32.dll.DefWindowProcA",
  638. "gdi32.dll.DeleteDC",
  639. "advapi32.dll.GetTokenInformation",
  640. "shell32.dll.ShellExecuteExA",
  641. "ole32.dll.CoInitialize",
  642. "oleaut32.dll.#6",
  643. "wininet.dll.InternetCloseHandle",
  644. "avicap32.dll.capGetDriverDescriptionA",
  645. "shlwapi.dll.PathRemoveExtensionA",
  646. "msvcrt.dll._mkdir",
  647. "netapi32.dll.NetScheduleJobAdd",
  648. "urlmon.dll.URLDownloadToFileA",
  649. "psapi.dll.GetProcessMemoryInfo",
  650. "winmm.dll.waveInUnprepareHeader",
  651. "ws2_32.dll.#57",
  652. "msvcp60.dll.?_Xran@std@@YAXXZ",
  653. "setupapi.dll.SetupDiGetDeviceRegistryPropertyA",
  654. "iphlpapi.dll.GetIfTable",
  655. "wtsapi32.dll.WTSQuerySessionInformationA",
  656. "version.dll.GetFileVersionInfoSizeA",
  657. "gdiplus.dll.GdipCreateBitmapFromGdiDib",
  658. "kernel32.dll.CreateProcessA",
  659. "kernel32.dll.GetPrivateProfileSectionNamesA",
  660. "kernel32.dll.lstrcmpA",
  661. "kernel32.dll.GetPrivateProfileStringA",
  662. "kernel32.dll.DeleteFileA",
  663. "kernel32.dll.GetFileAttributesA",
  664. "kernel32.dll.GetDriveTypeA",
  665. "kernel32.dll.FindClose",
  666. "kernel32.dll.LocalFree",
  667. "kernel32.dll.FindNextFileA",
  668. "kernel32.dll.LocalReAlloc",
  669. "kernel32.dll.LocalAlloc",
  670. "kernel32.dll.RemoveDirectoryA",
  671. "kernel32.dll.GetFileSize",
  672. "kernel32.dll.ReadFile",
  673. "kernel32.dll.SetFilePointer",
  674. "kernel32.dll.LocalSize",
  675. "kernel32.dll.OutputDebugStringA",
  676. "kernel32.dll.GetTempPathA",
  677. "kernel32.dll.TerminateProcess",
  678. "kernel32.dll.GetComputerNameA",
  679. "kernel32.dll.GlobalFree",
  680. "kernel32.dll.GlobalUnlock",
  681. "kernel32.dll.GlobalLock",
  682. "kernel32.dll.GlobalAlloc",
  683. "kernel32.dll.GlobalSize",
  684. "kernel32.dll.CreatePipe",
  685. "kernel32.dll.DisconnectNamedPipe",
  686. "kernel32.dll.WritePrivateProfileStringA",
  687. "kernel32.dll.SystemTimeToTzSpecificLocalTime",
  688. "kernel32.dll.GetPriorityClass",
  689. "kernel32.dll.Module32Next",
  690. "kernel32.dll.Module32First",
  691. "kernel32.dll.Thread32Next",
  692. "kernel32.dll.SuspendThread",
  693. "kernel32.dll.OpenThread",
  694. "kernel32.dll.Thread32First",
  695. "kernel32.dll.lstrcmpiA",
  696. "kernel32.dll.GetTempPathW",
  697. "kernel32.dll.WriteFile",
  698. "kernel32.dll.CancelIo",
  699. "kernel32.dll.lstrcpyA",
  700. "kernel32.dll.ResetEvent",
  701. "kernel32.dll.InterlockedExchange",
  702. "kernel32.dll.EnterCriticalSection",
  703. "kernel32.dll.LeaveCriticalSection",
  704. "kernel32.dll.DeleteCriticalSection",
  705. "kernel32.dll.InitializeCriticalSection",
  706. "kernel32.dll.ResumeThread",
  707. "kernel32.dll.SetEvent",
  708. "kernel32.dll.TerminateThread",
  709. "kernel32.dll.CreateEventA",
  710. "kernel32.dll.CreateMutexA",
  711. "kernel32.dll.CreateThread",
  712. "kernel32.dll.FindFirstFileA",
  713. "kernel32.dll.GetCurrentDirectoryA",
  714. "kernel32.dll.GetSystemDefaultLCID",
  715. "kernel32.dll.CreateToolhelp32Snapshot",
  716. "kernel32.dll.Process32First",
  717. "kernel32.dll.Process32Next",
  718. "kernel32.dll.GetLastError",
  719. "kernel32.dll.FormatMessageA",
  720. "kernel32.dll.GetModuleFileNameA",
  721. "kernel32.dll.GetWindowsDirectoryA",
  722. "kernel32.dll.lstrcatA",
  723. "kernel32.dll.CreateDirectoryA",
  724. "kernel32.dll.MoveFileA",
  725. "kernel32.dll.CopyFileA",
  726. "kernel32.dll.WideCharToMultiByte",
  727. "kernel32.dll.lstrlenA",
  728. "kernel32.dll.GetSystemDirectoryA",
  729. "kernel32.dll.MultiByteToWideChar",
  730. "kernel32.dll.CreateFileA",
  731. "kernel32.dll.DuplicateHandle",
  732. "kernel32.dll.GetCurrentProcess",
  733. "kernel32.dll.GetCurrentThreadId",
  734. "kernel32.dll.OpenProcess",
  735. "kernel32.dll.SetPriorityClass",
  736. "kernel32.dll.CloseHandle",
  737. "kernel32.dll.SetErrorMode",
  738. "kernel32.dll.OpenEventA",
  739. "kernel32.dll.GetTickCount",
  740. "kernel32.dll.WaitForSingleObject",
  741. "kernel32.dll.ReleaseMutex",
  742. "kernel32.dll.GetVersionExA",
  743. "kernel32.dll.GetSystemInfo",
  744. "kernel32.dll.GlobalMemoryStatus",
  745. "kernel32.dll.GlobalMemoryStatusEx",
  746. "kernel32.dll.GetLogicalDriveStringsA",
  747. "kernel32.dll.GetVolumeInformationA",
  748. "kernel32.dll.GetDiskFreeSpaceExA",
  749. "kernel32.dll.FileTimeToLocalFileTime",
  750. "kernel32.dll.FileTimeToSystemTime",
  751. "kernel32.dll.GetLocalTime",
  752. "user32.dll.DispatchMessageA",
  753. "user32.dll.TranslateMessage",
  754. "user32.dll.UpdateWindow",
  755. "user32.dll.ShowWindow",
  756. "user32.dll.CreateWindowExA",
  757. "user32.dll.FindWindowA",
  758. "user32.dll.LoadCursorA",
  759. "user32.dll.LoadIconA",
  760. "user32.dll.GetClientRect",
  761. "user32.dll.SendMessageA",
  762. "user32.dll.GetDlgItem",
  763. "user32.dll.SetDlgItemTextA",
  764. "user32.dll.PostMessageA",
  765. "user32.dll.SetWindowPos",
  766. "user32.dll.CreateDialogParamA",
  767. "user32.dll.EndDialog",
  768. "user32.dll.CharNextA",
  769. "user32.dll.GetWindowTextA",
  770. "user32.dll.GetForegroundWindow",
  771. "user32.dll.GetAsyncKeyState",
  772. "user32.dll.GetKeyState",
  773. "user32.dll.MessageBoxA",
  774. "user32.dll.EnumWindows",
  775. "user32.dll.ExitWindowsEx",
  776. "user32.dll.DestroyCursor",
  777. "user32.dll.BlockInput",
  778. "user32.dll.SystemParametersInfoA",
  779. "user32.dll.keybd_event",
  780. "user32.dll.GetInputState",
  781. "user32.dll.PostThreadMessageA",
  782. "user32.dll.GetMessageA",
  783. "user32.dll.GetDlgItemTextA",
  784. "user32.dll.GetProcessWindowStation",
  785. "user32.dll.SetProcessWindowStation",
  786. "user32.dll.OpenWindowStationA",
  787. "user32.dll.GetThreadDesktop",
  788. "user32.dll.OpenDesktopA",
  789. "user32.dll.GetUserObjectInformationA",
  790. "user32.dll.OpenInputDesktop",
  791. "user32.dll.wsprintfW",
  792. "user32.dll.RegisterClassExA",
  793. "user32.dll.SetThreadDesktop",
  794. "user32.dll.CloseDesktop",
  795. "user32.dll.SetWindowTextA",
  796. "user32.dll.IsWindowVisible",
  797. "user32.dll.GetCursorPos",
  798. "user32.dll.GetCursorInfo",
  799. "user32.dll.ReleaseDC",
  800. "user32.dll.GetDesktopWindow",
  801. "user32.dll.GetDC",
  802. "user32.dll.SetRect",
  803. "user32.dll.GetSystemMetrics",
  804. "user32.dll.GetClipboardData",
  805. "user32.dll.OpenClipboard",
  806. "user32.dll.EmptyClipboard",
  807. "user32.dll.SetClipboardData",
  808. "user32.dll.CloseClipboard",
  809. "user32.dll.mouse_event",
  810. "user32.dll.SetCursorPos",
  811. "user32.dll.WindowFromPoint",
  812. "user32.dll.SetCapture",
  813. "user32.dll.MapVirtualKeyA",
  814. "gdi32.dll.GetDIBits",
  815. "gdi32.dll.CreateCompatibleDC",
  816. "gdi32.dll.CreateDIBSection",
  817. "gdi32.dll.CreateCompatibleBitmap",
  818. "gdi32.dll.DeleteObject",
  819. "gdi32.dll.BitBlt",
  820. "gdi32.dll.SelectObject",
  821. "advapi32.dll.LookupAccountSidA",
  822. "advapi32.dll.StartServiceA",
  823. "advapi32.dll.LockServiceDatabase",
  824. "advapi32.dll.ChangeServiceConfigA",
  825. "advapi32.dll.UnlockServiceDatabase",
  826. "advapi32.dll.EnumServicesStatusA",
  827. "advapi32.dll.RegCloseKey",
  828. "advapi32.dll.RegQueryValueExA",
  829. "advapi32.dll.RegOpenKeyA",
  830. "advapi32.dll.RegOpenKeyExA",
  831. "advapi32.dll.AdjustTokenPrivileges",
  832. "advapi32.dll.LookupPrivilegeValueA",
  833. "advapi32.dll.OpenProcessToken",
  834. "advapi32.dll.IsValidSid",
  835. "advapi32.dll.LookupAccountNameA",
  836. "advapi32.dll.LsaClose",
  837. "advapi32.dll.LsaRetrievePrivateData",
  838. "advapi32.dll.LsaOpenPolicy",
  839. "advapi32.dll.LsaFreeMemory",
  840. "advapi32.dll.RegQueryValueA",
  841. "advapi32.dll.CloseServiceHandle",
  842. "advapi32.dll.DeleteService",
  843. "advapi32.dll.ControlService",
  844. "advapi32.dll.QueryServiceStatus",
  845. "advapi32.dll.OpenServiceA",
  846. "advapi32.dll.OpenSCManagerA",
  847. "advapi32.dll.RegSetValueExA",
  848. "advapi32.dll.CloseEventLog",
  849. "advapi32.dll.ClearEventLogA",
  850. "advapi32.dll.OpenEventLogA",
  851. "advapi32.dll.RegDeleteValueA",
  852. "advapi32.dll.RegCreateKeyExA",
  853. "advapi32.dll.GetUserNameA",
  854. "advapi32.dll.RegEnumValueA",
  855. "advapi32.dll.RegEnumKeyExA",
  856. "advapi32.dll.RegDeleteKeyA",
  857. "advapi32.dll.RegQueryInfoKeyA",
  858. "advapi32.dll.QueryServiceConfig2A",
  859. "advapi32.dll.QueryServiceConfigA",
  860. "shell32.dll.SHGetSpecialFolderPathA",
  861. "shell32.dll.ShellExecuteA",
  862. "shell32.dll.SHGetFileInfoA",
  863. "ole32.dll.CoTaskMemFree",
  864. "ole32.dll.CoCreateInstance",
  865. "ole32.dll.CoUninitialize",
  866. "wininet.dll.InternetReadFile",
  867. "wininet.dll.InternetOpenUrlA",
  868. "wininet.dll.InternetOpenA",
  869. "shlwapi.dll.PathRemoveFileSpecA",
  870. "shlwapi.dll.StrStrIA",
  871. "shlwapi.dll.PathIsDirectoryA",
  872. "msvcrt.dll._strnicmp",
  873. "msvcrt.dll._strupr",
  874. "msvcrt.dll._strrev",
  875. "msvcrt.dll.calloc",
  876. "msvcrt.dll._onexit",
  877. "msvcrt.dll.__dllonexit",
  878. "msvcrt.dll.??1type_info@@UAE@XZ",
  879. "msvcrt.dll._strcmpi",
  880. "msvcrt.dll.wcscmp",
  881. "msvcrt.dll._beginthreadex",
  882. "msvcrt.dll.strncat",
  883. "msvcrt.dll.wcscpy",
  884. "msvcrt.dll._errno",
  885. "msvcrt.dll.strncmp",
  886. "msvcrt.dll.fopen",
  887. "msvcrt.dll.fwrite",
  888. "msvcrt.dll.fclose",
  889. "msvcrt.dll.strrchr",
  890. "msvcrt.dll.clock",
  891. "msvcrt.dll.srand",
  892. "msvcrt.dll.strcspn",
  893. "msvcrt.dll.strncpy",
  894. "msvcrt.dll.sprintf",
  895. "msvcrt.dll.rand",
  896. "msvcrt.dll._CxxThrowException",
  897. "msvcrt.dll._ftol",
  898. "msvcrt.dll.ceil",
  899. "msvcrt.dll.memmove",
  900. "msvcrt.dll.printf",
  901. "msvcrt.dll.__CxxFrameHandler",
  902. "msvcrt.dll.strstr",
  903. "msvcrt.dll.strchr",
  904. "msvcrt.dll.atoi",
  905. "msvcrt.dll.malloc",
  906. "netapi32.dll.NetApiBufferFree",
  907. "netapi32.dll.NetUserDel",
  908. "netapi32.dll.NetUserAdd",
  909. "netapi32.dll.NetLocalGroupAddMembers",
  910. "netapi32.dll.NetUserSetInfo",
  911. "netapi32.dll.NetScheduleJobEnum",
  912. "netapi32.dll.NetUserEnum",
  913. "netapi32.dll.NetScheduleJobDel",
  914. "psapi.dll.EnumProcessModules",
  915. "psapi.dll.GetModuleFileNameExA",
  916. "winmm.dll.waveOutClose",
  917. "winmm.dll.waveOutUnprepareHeader",
  918. "winmm.dll.waveOutReset",
  919. "winmm.dll.waveInClose",
  920. "winmm.dll.waveInOpen",
  921. "winmm.dll.waveInReset",
  922. "winmm.dll.waveInStop",
  923. "winmm.dll.waveOutWrite",
  924. "winmm.dll.waveInStart",
  925. "winmm.dll.waveInAddBuffer",
  926. "winmm.dll.waveInPrepareHeader",
  927. "winmm.dll.waveInGetNumDevs",
  928. "winmm.dll.waveOutPrepareHeader",
  929. "winmm.dll.waveOutOpen",
  930. "winmm.dll.waveOutGetNumDevs",
  931. "ws2_32.dll.#6",
  932. "ws2_32.dll.#116",
  933. "ws2_32.dll.#52",
  934. "ws2_32.dll.#115",
  935. "ws2_32.dll.#151",
  936. "ws2_32.dll.#17",
  937. "ws2_32.dll.#13",
  938. "ws2_32.dll.#1",
  939. "ws2_32.dll.#5",
  940. "ws2_32.dll.#2",
  941. "ws2_32.dll.WSASocketA",
  942. "ws2_32.dll.#8",
  943. "ws2_32.dll.#20",
  944. "ws2_32.dll.#12",
  945. "ws2_32.dll.#11",
  946. "ws2_32.dll.#21",
  947. "ws2_32.dll.#4",
  948. "ws2_32.dll.#19",
  949. "ws2_32.dll.#18",
  950. "ws2_32.dll.#3",
  951. "ws2_32.dll.#16",
  952. "ws2_32.dll.#15",
  953. "ws2_32.dll.#9",
  954. "ws2_32.dll.WSAIoctl",
  955. "ws2_32.dll.#23",
  956. "msvcp60.dll.?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB",
  957. "msvcp60.dll.??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ",
  958. "msvcp60.dll.?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z",
  959. "msvcp60.dll.?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z",
  960. "msvcp60.dll.?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z",
  961. "msvcp60.dll.?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ",
  962. "msvcp60.dll.?_Xlen@std@@YAXXZ",
  963. "msvcp60.dll.?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z",
  964. "msvcp60.dll.??1_Winit@std@@QAE@XZ",
  965. "msvcp60.dll.??0_Winit@std@@QAE@XZ",
  966. "msvcp60.dll.??1Init@ios_base@std@@QAE@XZ",
  967. "msvcp60.dll.??0Init@ios_base@std@@QAE@XZ",
  968. "msvcp60.dll.?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z",
  969. "msvcp60.dll.?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ",
  970. "msvcp60.dll.?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z",
  971. "msvcp60.dll.?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB",
  972. "msvcp60.dll.?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z",
  973. "msvcp60.dll.?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z",
  974. "msvcp60.dll.?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z",
  975. "msvcp60.dll.??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z",
  976. "msvcp60.dll.?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z",
  977. "setupapi.dll.SetupDiGetClassDevsA",
  978. "setupapi.dll.SetupDiEnumDeviceInfo",
  979. "setupapi.dll.SetupDiDestroyDeviceInfoList",
  980. "wtsapi32.dll.WTSDisconnectSession",
  981. "wtsapi32.dll.WTSLogoffSession",
  982. "wtsapi32.dll.WTSEnumerateProcessesA",
  983. "wtsapi32.dll.WTSFreeMemory",
  984. "wtsapi32.dll.WTSEnumerateSessionsA",
  985. "version.dll.GetFileVersionInfoA",
  986. "version.dll.VerQueryValueA",
  987. "gdiplus.dll.GdipGetImageEncodersSize",
  988. "gdiplus.dll.GdiplusStartup",
  989. "gdiplus.dll.GdiplusShutdown",
  990. "gdiplus.dll.GdipSaveImageToFile",
  991. "gdiplus.dll.GdipGetImageEncoders",
  992. "gdiplus.dll.GdipDisposeImage",
  993. "kernel32.dll.PeekNamedPipe",
  994. "kernel32.dll.WaitForMultipleObjects",
  995. "kernel32.dll.SortGetHandle",
  996. "kernel32.dll.SortCloseHandle",
  997. "exes_f43c5979a76db99509a30c33455125da.exe.Hai",
  998. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  999. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  1000. "comctl32.dll.#332",
  1001. "ntdll.dll.NtQuerySystemInformation",
  1002. "comctl32.dll.#386",
  1003. "sechost.dll.LookupAccountSidLocalW",
  1004. "secur32.dll.InitSecurityInterfaceW",
  1005. "cryptsp.dll.SystemFunction035",
  1006. "msv1_0.dll.SpUserModeInitialize",
  1007. "rasapi32.dll.RasConnectionNotificationW",
  1008. "sechost.dll.NotifyServiceStatusChangeA",
  1009. "cryptbase.dll.SystemFunction036",
  1010. "urlmon.dll.CoInternetCreateSecurityManager",
  1011. "urlmon.dll.CoInternetCreateZoneManager",
  1012. "urlmon.dll.CoInternetIsFeatureEnabledForUrl",
  1013. "rpcrt4.dll.I_RpcSNCHOption",
  1014. "sechost.dll.OpenSCManagerW",
  1015. "sechost.dll.OpenServiceW",
  1016. "sechost.dll.ControlService",
  1017. "sechost.dll.CloseServiceHandle",
  1018. "sechost.dll.QueryServiceStatus",
  1019. "sechost.dll.StartServiceW",
  1020. "sechost.dll.LookupAccountNameLocalW",
  1021. "advapi32.dll.LookupAccountSidW",
  1022. "wersvc.dll.ServiceMain",
  1023. "wersvc.dll.SvchostPushServiceGlobals",
  1024. "advapi32.dll.RegGetValueW",
  1025. "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  1026. "faultrep.dll.WerpInitiateCrashReporting",
  1027. "wer.dll.WerpCreateMachineStore",
  1028. "shell32.dll.SHGetFolderPathEx",
  1029. "ole32.dll.StringFromGUID2",
  1030. "profapi.dll.#104",
  1031. "userenv.dll.CreateEnvironmentBlock",
  1032. "sechost.dll.ConvertSidToStringSidW",
  1033. "sspicli.dll.GetUserNameExW",
  1034. "userenv.dll.DestroyEnvironmentBlock",
  1035. "wer.dll.WerpSvcReportFromMachineQueue",
  1036. "advapi32.dll.DuplicateToken",
  1037. "advapi32.dll.AllocateAndInitializeSid",
  1038. "advapi32.dll.CheckTokenMembership",
  1039. "advapi32.dll.FreeSid",
  1040. "wtsapi32.dll.WTSQueryUserToken",
  1041. "winsta.dll.WinStationQueryInformationW",
  1042. "advapi32.dll.CreateWellKnownSid",
  1043. "rpcrt4.dll.RpcStringBindingComposeW",
  1044. "rpcrt4.dll.RpcBindingFromStringBindingW",
  1045. "rpcrt4.dll.RpcStringFreeW",
  1046. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  1047. "rpcrt4.dll.NdrClientCall3",
  1048. "rpcrt4.dll.RpcBindingFree",
  1049. "advapi32.dll.ImpersonateLoggedOnUser",
  1050. "advapi32.dll.CreateProcessAsUserW",
  1051. "advapi32.dll.RevertToSelf",
  1052. "imm32.dll.ImmDisableIME",
  1053. "psapi.dll.GetModuleFileNameExW",
  1054. "version.dll.GetFileVersionInfoSizeW",
  1055. "version.dll.GetFileVersionInfoW",
  1056. "version.dll.VerQueryValueW",
  1057. "wer.dll.WerpCreateIntegratorReportId",
  1058. "wer.dll.WerReportCreate",
  1059. "wer.dll.WerpSetIntegratorReportId",
  1060. "wer.dll.WerReportSetParameter",
  1061. "dbgeng.dll.DebugCreate",
  1062. "ntdll.dll.CsrGetProcessId",
  1063. "ntdll.dll.DbgBreakPoint",
  1064. "ntdll.dll.DbgPrint",
  1065. "ntdll.dll.DbgPrompt",
  1066. "ntdll.dll.DbgUiConvertStateChangeStructure",
  1067. "ntdll.dll.DbgUiGetThreadDebugObject",
  1068. "ntdll.dll.DbgUiIssueRemoteBreakin",
  1069. "ntdll.dll.DbgUiSetThreadDebugObject",
  1070. "ntdll.dll.NtAllocateVirtualMemory",
  1071. "ntdll.dll.NtClose",
  1072. "ntdll.dll.NtCreateDebugObject",
  1073. "ntdll.dll.NtCreateFile",
  1074. "ntdll.dll.NtDebugActiveProcess",
  1075. "ntdll.dll.NtDebugContinue",
  1076. "ntdll.dll.NtFreeVirtualMemory",
  1077. "ntdll.dll.NtOpenProcess",
  1078. "ntdll.dll.NtOpenThread",
  1079. "ntdll.dll.NtQueryInformationProcess",
  1080. "ntdll.dll.NtQueryInformationThread",
  1081. "ntdll.dll.NtQueryMutant",
  1082. "ntdll.dll.NtQueryObject",
  1083. "ntdll.dll.NtRemoveProcessDebug",
  1084. "ntdll.dll.NtResumeThread",
  1085. "ntdll.dll.NtSetInformationDebugObject",
  1086. "ntdll.dll.NtSetInformationProcess",
  1087. "ntdll.dll.NtSystemDebugControl",
  1088. "ntdll.dll.NtWaitForDebugEvent",
  1089. "ntdll.dll.RtlAnsiStringToUnicodeString",
  1090. "ntdll.dll.RtlCreateProcessParameters",
  1091. "ntdll.dll.RtlCreateUserProcess",
  1092. "ntdll.dll.RtlDestroyProcessParameters",
  1093. "ntdll.dll.RtlDosPathNameToNtPathName_U",
  1094. "ntdll.dll.RtlFindMessage",
  1095. "ntdll.dll.RtlFreeHeap",
  1096. "ntdll.dll.RtlFreeUnicodeString",
  1097. "ntdll.dll.RtlGetFunctionTableListHead",
  1098. "ntdll.dll.RtlGetUnloadEventTrace",
  1099. "ntdll.dll.RtlGetUnloadEventTraceEx",
  1100. "ntdll.dll.RtlInitAnsiString",
  1101. "ntdll.dll.RtlInitUnicodeString",
  1102. "ntdll.dll.RtlTryEnterCriticalSection",
  1103. "ntdll.dll.RtlUnicodeStringToAnsiString",
  1104. "ntdll.dll.NtOpenProcessToken",
  1105. "ntdll.dll.NtOpenThreadToken",
  1106. "ntdll.dll.NtQueryInformationToken",
  1107. "kernel32.dll.CloseProfileUserMapping",
  1108. "kernel32.dll.DebugActiveProcessStop",
  1109. "kernel32.dll.DebugBreak",
  1110. "kernel32.dll.DebugBreakProcess",
  1111. "kernel32.dll.DebugSetProcessKillOnExit",
  1112. "kernel32.dll.Module32FirstW",
  1113. "kernel32.dll.Module32NextW",
  1114. "kernel32.dll.Process32FirstW",
  1115. "kernel32.dll.Process32NextW",
  1116. "kernel32.dll.ProcessIdToSessionId",
  1117. "kernel32.dll.SetProcessShutdownParameters",
  1118. "kernel32.dll.GetTimeZoneInformation",
  1119. "kernel32.dll.Wow64GetThreadSelectorEntry",
  1120. "advapi32.dll.CreateServiceA",
  1121. "advapi32.dll.CreateServiceW",
  1122. "advapi32.dll.EnumServicesStatusExA",
  1123. "advapi32.dll.EnumServicesStatusExW",
  1124. "advapi32.dll.GetEventLogInformation",
  1125. "advapi32.dll.OpenSCManagerW",
  1126. "advapi32.dll.OpenServiceW",
  1127. "advapi32.dll.StartServiceW",
  1128. "advapi32.dll.GetSidSubAuthority",
  1129. "advapi32.dll.GetSidSubAuthorityCount",
  1130. "version.dll.GetFileVersionInfoSizeExW",
  1131. "version.dll.GetFileVersionInfoExW",
  1132. "dbghelp.dll.WinDbgExtensionDllInit",
  1133. "dbghelp.dll.ExtensionApiVersion",
  1134. "wer.dll.WerpSetDynamicParameter",
  1135. "wer.dll.WerReportAddDump",
  1136. "wer.dll.WerpSetCallBack",
  1137. "wer.dll.WerReportSetUIOption",
  1138. "wer.dll.WerpAddRegisteredDataToReport",
  1139. "wer.dll.WerReportSubmit",
  1140. "advapi32.dll.RegOpenKeyExW",
  1141. "user32.dll.LoadStringW",
  1142. "advapi32.dll.RegCreateKeyExW",
  1143. "advapi32.dll.RegSetValueExW",
  1144. "advapi32.dll.RegQueryValueExW",
  1145. "sensapi.dll.IsNetworkAlive",
  1146. "user32.dll.CharUpperW",
  1147. "wer.dll.WerpAddAppCompatData",
  1148. "apphelp.dll.SdbGetFileAttributes",
  1149. "apphelp.dll.SdbFormatAttribute",
  1150. "apphelp.dll.SdbFreeFileAttributes",
  1151. "cryptsp.dll.CryptAcquireContextW",
  1152. "cryptsp.dll.CryptCreateHash",
  1153. "cryptsp.dll.CryptHashData",
  1154. "cryptsp.dll.CryptGetHashParam",
  1155. "cryptsp.dll.CryptDestroyHash",
  1156. "cryptsp.dll.CryptReleaseContext",
  1157. "dbghelp.dll.MiniDumpWriteDump",
  1158. "kernel32.dll.GetLongPathNameA",
  1159. "kernel32.dll.GetLongPathNameW",
  1160. "kernel32.dll.GetProcessTimes",
  1161. "powrprof.dll.CallNtPowerInformation",
  1162. "verifier.dll.VerifierEnumerateResource",
  1163. "ntdll.dll.NtSuspendProcess",
  1164. "ntdll.dll.NtResumeProcess",
  1165. "advapi32.dll.QueryTraceW",
  1166. "advapi32.dll.GetLengthSid",
  1167. "advapi32.dll.CopySid",
  1168. "advapi32.dll.InitializeAcl",
  1169. "advapi32.dll.AddAccessAllowedAceEx",
  1170. "advapi32.dll.InitializeSecurityDescriptor",
  1171. "advapi32.dll.SetSecurityDescriptorDacl",
  1172. "advapi32.dll.RegisterEventSourceW",
  1173. "advapi32.dll.ReportEventW",
  1174. "advapi32.dll.DeregisterEventSource",
  1175. "wer.dll.WerpGetStoreLocation",
  1176. "wer.dll.WerpGetStoreType",
  1177. "wer.dll.WerReportCloseHandle",
  1178. "user32.dll.MsgWaitForMultipleObjects",
  1179. "wer.dll.WerpFreeString",
  1180. "user32.dll.GetUserObjectInformationW",
  1181. "werui.dll.WerUICreate",
  1182. "werui.dll.WerUIStart",
  1183. "werui.dll.WerUITerminate",
  1184. "werui.dll.WerUIDelete"
  1185. ]
  1186.  
  1187. [*] Static Analysis: {
  1188. "pe": {
  1189. "peid_signatures": null,
  1190. "imports": [
  1191. {
  1192. "imports": [
  1193. {
  1194. "name": "LoadLibraryA",
  1195. "address": "0x44af59"
  1196. },
  1197. {
  1198. "name": "GetProcAddress",
  1199. "address": "0x44af5d"
  1200. },
  1201. {
  1202. "name": "VirtualAlloc",
  1203. "address": "0x44af61"
  1204. },
  1205. {
  1206. "name": "VirtualProtect",
  1207. "address": "0x44af65"
  1208. },
  1209. {
  1210. "name": "VirtualFree",
  1211. "address": "0x44af69"
  1212. },
  1213. {
  1214. "name": "GetModuleHandleA",
  1215. "address": "0x44af6d"
  1216. }
  1217. ],
  1218. "dll": "kernel32.dll"
  1219. }
  1220. ],
  1221. "digital_signers": null,
  1222. "exported_dll_name": "ESF94WERF8",
  1223. "actual_checksum": "0x00022cce",
  1224. "overlay": null,
  1225. "imagebase": "0x00400000",
  1226. "reported_checksum": "0x00000000",
  1227. "icon_hash": null,
  1228. "entrypoint": "0x00401000",
  1229. "timestamp": "2017-04-01 16:59:32",
  1230. "osversion": "4.0",
  1231. "sections": [
  1232. {
  1233. "name": ".UPX1",
  1234. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1235. "virtual_address": "0x00001000",
  1236. "size_of_data": "0x00000200",
  1237. "entropy": "1.36",
  1238. "raw_address": "0x00000400",
  1239. "virtual_size": "0x0002f000",
  1240. "characteristics_raw": "0x60000020"
  1241. },
  1242. {
  1243. "name": ".UPX1",
  1244. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1245. "virtual_address": "0x00030000",
  1246. "size_of_data": "0x0001bcd7",
  1247. "entropy": "7.88",
  1248. "raw_address": "0x00000600",
  1249. "virtual_size": "0x00020206",
  1250. "characteristics_raw": "0xe0000020"
  1251. }
  1252. ],
  1253. "resources": [],
  1254. "dirents": [
  1255. {
  1256. "virtual_address": "0x0004a36f",
  1257. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1258. "size": "0x0000005f"
  1259. },
  1260. {
  1261. "virtual_address": "0x0004af24",
  1262. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1263. "size": "0x00000028"
  1264. },
  1265. {
  1266. "virtual_address": "0x00030000",
  1267. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1268. "size": "0x00005087"
  1269. },
  1270. {
  1271. "virtual_address": "0x00000000",
  1272. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1273. "size": "0x00000000"
  1274. },
  1275. {
  1276. "virtual_address": "0x00000000",
  1277. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1278. "size": "0x00000000"
  1279. },
  1280. {
  1281. "virtual_address": "0x00000000",
  1282. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1283. "size": "0x00000000"
  1284. },
  1285. {
  1286. "virtual_address": "0x00000000",
  1287. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1288. "size": "0x00000000"
  1289. },
  1290. {
  1291. "virtual_address": "0x00000000",
  1292. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1293. "size": "0x00000000"
  1294. },
  1295. {
  1296. "virtual_address": "0x00000000",
  1297. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1298. "size": "0x00000000"
  1299. },
  1300. {
  1301. "virtual_address": "0x00000000",
  1302. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1303. "size": "0x00000000"
  1304. },
  1305. {
  1306. "virtual_address": "0x00000000",
  1307. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1308. "size": "0x00000000"
  1309. },
  1310. {
  1311. "virtual_address": "0x00000000",
  1312. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1313. "size": "0x00000000"
  1314. },
  1315. {
  1316. "virtual_address": "0x00000000",
  1317. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1318. "size": "0x00000000"
  1319. },
  1320. {
  1321. "virtual_address": "0x00000000",
  1322. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1323. "size": "0x00000000"
  1324. },
  1325. {
  1326. "virtual_address": "0x00000000",
  1327. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1328. "size": "0x00000000"
  1329. },
  1330. {
  1331. "virtual_address": "0x00000000",
  1332. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1333. "size": "0x00000000"
  1334. }
  1335. ],
  1336. "exports": [
  1337. {
  1338. "ordinal": 1,
  1339. "name": "Hai",
  1340. "address": "0x401b50"
  1341. },
  1342. {
  1343. "ordinal": 2,
  1344. "name": "Hai2",
  1345. "address": "0x401b40"
  1346. },
  1347. {
  1348. "ordinal": 3,
  1349. "name": "zzzz",
  1350. "address": "0x401b40"
  1351. }
  1352. ],
  1353. "guest_signers": {},
  1354. "imphash": "469b1bae2575baede5bf1f06a01b4767",
  1355. "icon_fuzzy": null,
  1356. "icon": null,
  1357. "pdbpath": null,
  1358. "imported_dll_count": 1,
  1359. "versioninfo": []
  1360. }
  1361. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!