API tools faq
paste
paladin316

Exes_1852d407254031794e850463d36b1526_exe_2019-07-02_04_30.json

paladin316
Jul 1st, 2019
2,122
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 46.97 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_1852d407254031794e850463d36b1526.exe"
  7. [*] File Size: 5691022
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
  9. [*] SHA256: "8c55c6a7572d3d203b1357d0077aafffee37528b19258956a9945c84dbc37483"
  10. [*] MD5: "1852d407254031794e850463d36b1526"
  11. [*] SHA1: "40b8ee2e2859d022e42c1968d666f810b3b33c6e"
  12. [*] SHA512: "5066b6137d6a6a52c2da67512f269e543f5032327380b0b2e5fcf77569aff08135b68e5175f7120de50057d613361a64b78886bc0e07bbe4b11daafc0ca3c561"
  13. [*] CRC32: "F709B7B7"
  14. [*] SSDEEP: "98304:XSa5SFbcdemV5ow4L3TW8IO2mqny+QaJeiCGn9NUAsakl231NGIWVsga:i1u4Lz/4QaJ3agCIWVU"
  15.  
  16. [*] Process Execution: [
  17. "Exes_1852d407254031794e850463d36b1526.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Reads data out of its own binary image",
  23. "Details": [
  24. {
  25. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x00000000, length: 0x00010000"
  26. },
  27. {
  28. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x0000ffec, length: 0x00010000"
  29. },
  30. {
  31. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x0001ffd8, length: 0x00010000"
  32. },
  33. {
  34. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x0002ffc4, length: 0x00010000"
  35. },
  36. {
  37. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x0003ffb0, length: 0x00010000"
  38. },
  39. {
  40. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x0004ff9c, length: 0x00010000"
  41. },
  42. {
  43. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x0005dc14, length: 0x00001000"
  44. },
  45. {
  46. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x0005dc28, length: 0x00000200"
  47. },
  48. {
  49. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x0005dc89, length: 0x00000200"
  50. },
  51. {
  52. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x0005dca5, length: 0x0000e200"
  53. },
  54. {
  55. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x0006bda7, length: 0x00000200"
  56. },
  57. {
  58. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x0006be70, length: 0x00000200"
  59. },
  60. {
  61. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x0010d7c8, length: 0x00000200"
  62. },
  63. {
  64. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x0010d891, length: 0x00000200"
  65. },
  66. {
  67. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x001aeb4f, length: 0x00000200"
  68. },
  69. {
  70. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x001aec18, length: 0x00000200"
  71. },
  72. {
  73. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x0025127a, length: 0x00000200"
  74. },
  75. {
  76. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x00251343, length: 0x00000200"
  77. },
  78. {
  79. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x002f5143, length: 0x00000200"
  80. },
  81. {
  82. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x002f520c, length: 0x00000200"
  83. },
  84. {
  85. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x00394df8, length: 0x00000200"
  86. },
  87. {
  88. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x00394ec1, length: 0x00000200"
  89. },
  90. {
  91. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x004347e1, length: 0x00000200"
  92. },
  93. {
  94. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x004348aa, length: 0x00000200"
  95. },
  96. {
  97. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x004d5686, length: 0x00000200"
  98. },
  99. {
  100. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x004d574f, length: 0x00000200"
  101. },
  102. {
  103. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x0056c3cd, length: 0x00000200"
  104. },
  105. {
  106. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x0056c4ae, length: 0x00000200"
  107. },
  108. {
  109. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x0056c5cd, length: 0x000010c1"
  110. },
  111. {
  112. "self_read": "process: Exes_1852d407254031794e850463d36b1526.exe, pid: 564, offset: 0x0056d686, length: 0x00000008"
  113. }
  114. ]
  115. },
  116. {
  117. "Description": "The binary likely contains encrypted or compressed data.",
  118. "Details": [
  119. {
  120. "section": "name: UPX1, entropy: 7.93, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00041e00, virtual_size: 0x00042000"
  121. },
  122. {
  123. "section": "name: .rsrc, entropy: 7.72, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0001ba00, virtual_size: 0x0001c000"
  124. }
  125. ]
  126. },
  127. {
  128. "Description": "The executable is compressed using UPX",
  129. "Details": [
  130. {
  131. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x0008a000"
  132. }
  133. ]
  134. },
  135. {
  136. "Description": "File has been identified by 13 Antiviruses on VirusTotal as malicious",
  137. "Details": [
  138. {
  139. "K7GW": "Riskware"
  140. },
  141. {
  142. "K7AntiVirus": "Riskware"
  143. },
  144. {
  145. "Symantec": "WS.Reputation.1"
  146. },
  147. {
  148. "Norman": "Suspicious_Gen4.FAGYD"
  149. },
  150. {
  151. "TrendMicro-HouseCall": "TROJ_GEN.R0CBH0AI813"
  152. },
  153. {
  154. "Agnitum": "Worm.Autoit.Gen"
  155. },
  156. {
  157. "Comodo": "UnclassifiedMalware"
  158. },
  159. {
  160. "VIPRE": "Trojan.Win32.Generic.pak!cobra"
  161. },
  162. {
  163. "Panda": "Suspicious file"
  164. },
  165. {
  166. "Kingsoft": "Win32.Troj.Generic.a.(kcloud)"
  167. },
  168. {
  169. "Commtouch": "W32/GenBl.1852D407!Olympus"
  170. },
  171. {
  172. "VBA32": "Trojan.Autoit.F"
  173. },
  174. {
  175. "ESET-NOD32": "Win32/Packed.Autoit.E.Gen"
  176. }
  177. ]
  178. }
  179. ]
  180.  
  181. [*] Started Service: []
  182.  
  183. [*] Executed Commands: []
  184.  
  185. [*] Mutexes: [
  186. "CicLoadWinStaWinSta0",
  187. "Local\\MSCTF.CtfMonitorInstMutexDefault1"
  188. ]
  189.  
  190. [*] Modified Files: [
  191. "C:\\Users\\user\\AppData\\Local\\Temp\\autA18C.tmp",
  192. "C:\\Users\\user\\AppData\\Local\\Temp\\grxzdkk"
  193. ]
  194.  
  195. [*] Deleted Files: [
  196. "C:\\Users\\user\\AppData\\Local\\Temp\\autA18C.tmp",
  197. "C:\\Users\\user\\AppData\\Local\\Temp\\grxzdkk"
  198. ]
  199.  
  200. [*] Modified Registry Keys: []
  201.  
  202. [*] Deleted Registry Keys: []
  203.  
  204. [*] DNS Communications: []
  205.  
  206. [*] Domains: []
  207.  
  208. [*] Network Communication - ICMP: []
  209.  
  210. [*] Network Communication - HTTP: []
  211.  
  212. [*] Network Communication - SMTP: []
  213.  
  214. [*] Network Communication - Hosts: []
  215.  
  216. [*] Network Communication - IRC: []
  217.  
  218. [*] Static Analysis: {
  219. "pe": {
  220. "peid_signatures": null,
  221. "imports": [
  222. {
  223. "imports": [
  224. {
  225. "name": "LoadLibraryA",
  226. "address": "0x4e8708"
  227. },
  228. {
  229. "name": "GetProcAddress",
  230. "address": "0x4e870c"
  231. },
  232. {
  233. "name": "VirtualProtect",
  234. "address": "0x4e8710"
  235. },
  236. {
  237. "name": "VirtualAlloc",
  238. "address": "0x4e8714"
  239. },
  240. {
  241. "name": "VirtualFree",
  242. "address": "0x4e8718"
  243. },
  244. {
  245. "name": "ExitProcess",
  246. "address": "0x4e871c"
  247. }
  248. ],
  249. "dll": "KERNEL32.DLL"
  250. },
  251. {
  252. "imports": [
  253. {
  254. "name": "GetAce",
  255. "address": "0x4e8724"
  256. }
  257. ],
  258. "dll": "ADVAPI32.dll"
  259. },
  260. {
  261. "imports": [
  262. {
  263. "name": "ImageList_Remove",
  264. "address": "0x4e872c"
  265. }
  266. ],
  267. "dll": "COMCTL32.dll"
  268. },
  269. {
  270. "imports": [
  271. {
  272. "name": "GetSaveFileNameW",
  273. "address": "0x4e8734"
  274. }
  275. ],
  276. "dll": "COMDLG32.dll"
  277. },
  278. {
  279. "imports": [
  280. {
  281. "name": "LineTo",
  282. "address": "0x4e873c"
  283. }
  284. ],
  285. "dll": "GDI32.dll"
  286. },
  287. {
  288. "imports": [
  289. {
  290. "name": "WNetGetConnectionW",
  291. "address": "0x4e8744"
  292. }
  293. ],
  294. "dll": "MPR.dll"
  295. },
  296. {
  297. "imports": [
  298. {
  299. "name": "CoInitialize",
  300. "address": "0x4e874c"
  301. }
  302. ],
  303. "dll": "ole32.dll"
  304. },
  305. {
  306. "imports": [
  307. {
  308. "name": "SafeArrayUnaccessData",
  309. "address": "0x4e8754"
  310. }
  311. ],
  312. "dll": "OLEAUT32.dll"
  313. },
  314. {
  315. "imports": [
  316. {
  317. "name": "EnumProcesses",
  318. "address": "0x4e875c"
  319. }
  320. ],
  321. "dll": "PSAPI.DLL"
  322. },
  323. {
  324. "imports": [
  325. {
  326. "name": "DragFinish",
  327. "address": "0x4e8764"
  328. }
  329. ],
  330. "dll": "SHELL32.dll"
  331. },
  332. {
  333. "imports": [
  334. {
  335. "name": "GetDC",
  336. "address": "0x4e876c"
  337. }
  338. ],
  339. "dll": "USER32.dll"
  340. },
  341. {
  342. "imports": [
  343. {
  344. "name": "LoadUserProfileW",
  345. "address": "0x4e8774"
  346. }
  347. ],
  348. "dll": "USERENV.dll"
  349. },
  350. {
  351. "imports": [
  352. {
  353. "name": "VerQueryValueW",
  354. "address": "0x4e877c"
  355. }
  356. ],
  357. "dll": "VERSION.dll"
  358. },
  359. {
  360. "imports": [
  361. {
  362. "name": "FtpOpenFileW",
  363. "address": "0x4e8784"
  364. }
  365. ],
  366. "dll": "WININET.dll"
  367. },
  368. {
  369. "imports": [
  370. {
  371. "name": "timeGetTime",
  372. "address": "0x4e878c"
  373. }
  374. ],
  375. "dll": "WINMM.dll"
  376. },
  377. {
  378. "imports": [
  379. {
  380. "name": "recv",
  381. "address": "0x4e8794"
  382. }
  383. ],
  384. "dll": "WSOCK32.dll"
  385. }
  386. ],
  387. "digital_signers": null,
  388. "exported_dll_name": null,
  389. "actual_checksum": "0x00578f81",
  390. "overlay": {
  391. "size": "0x0050fa8e",
  392. "offset": "0x0005dc00"
  393. },
  394. "imagebase": "0x00400000",
  395. "reported_checksum": "0x00000000",
  396. "icon_hash": null,
  397. "entrypoint": "0x004ccbb0",
  398. "timestamp": "2010-04-16 07:47:33",
  399. "osversion": "5.0",
  400. "sections": [
  401. {
  402. "name": "UPX0",
  403. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  404. "virtual_address": "0x00001000",
  405. "size_of_data": "0x00000000",
  406. "entropy": "0.00",
  407. "raw_address": "0x00000400",
  408. "virtual_size": "0x0008a000",
  409. "characteristics_raw": "0xe0000080"
  410. },
  411. {
  412. "name": "UPX1",
  413. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  414. "virtual_address": "0x0008b000",
  415. "size_of_data": "0x00041e00",
  416. "entropy": "7.93",
  417. "raw_address": "0x00000400",
  418. "virtual_size": "0x00042000",
  419. "characteristics_raw": "0xe0000040"
  420. },
  421. {
  422. "name": ".rsrc",
  423. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  424. "virtual_address": "0x000cd000",
  425. "size_of_data": "0x0001ba00",
  426. "entropy": "7.72",
  427. "raw_address": "0x00042200",
  428. "virtual_size": "0x0001c000",
  429. "characteristics_raw": "0xc0000040"
  430. }
  431. ],
  432. "resources": [],
  433. "dirents": [
  434. {
  435. "virtual_address": "0x00000000",
  436. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  437. "size": "0x00000000"
  438. },
  439. {
  440. "virtual_address": "0x000e85b4",
  441. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  442. "size": "0x000003b0"
  443. },
  444. {
  445. "virtual_address": "0x000cd000",
  446. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  447. "size": "0x0001b5b4"
  448. },
  449. {
  450. "virtual_address": "0x00000000",
  451. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  452. "size": "0x00000000"
  453. },
  454. {
  455. "virtual_address": "0x00000000",
  456. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  457. "size": "0x00000000"
  458. },
  459. {
  460. "virtual_address": "0x00000000",
  461. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  462. "size": "0x00000000"
  463. },
  464. {
  465. "virtual_address": "0x00000000",
  466. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  467. "size": "0x00000000"
  468. },
  469. {
  470. "virtual_address": "0x00000000",
  471. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  472. "size": "0x00000000"
  473. },
  474. {
  475. "virtual_address": "0x00000000",
  476. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  477. "size": "0x00000000"
  478. },
  479. {
  480. "virtual_address": "0x00000000",
  481. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  482. "size": "0x00000000"
  483. },
  484. {
  485. "virtual_address": "0x00000000",
  486. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  487. "size": "0x00000000"
  488. },
  489. {
  490. "virtual_address": "0x00000000",
  491. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  492. "size": "0x00000000"
  493. },
  494. {
  495. "virtual_address": "0x00000000",
  496. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  497. "size": "0x00000000"
  498. },
  499. {
  500. "virtual_address": "0x00000000",
  501. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  502. "size": "0x00000000"
  503. },
  504. {
  505. "virtual_address": "0x00000000",
  506. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  507. "size": "0x00000000"
  508. },
  509. {
  510. "virtual_address": "0x00000000",
  511. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  512. "size": "0x00000000"
  513. }
  514. ],
  515. "exports": [],
  516. "guest_signers": {},
  517. "imphash": "77b2e5e9b52fbef7638f64ab65f0c58c",
  518. "icon_fuzzy": null,
  519. "icon": null,
  520. "pdbpath": null,
  521. "imported_dll_count": 16,
  522. "versioninfo": []
  523. }
  524. }
  525.  
  526. [*] Resolved APIs: [
  527. "kernel32.dll.HeapAlloc",
  528. "kernel32.dll.Sleep",
  529. "kernel32.dll.GetCurrentThreadId",
  530. "kernel32.dll.RaiseException",
  531. "kernel32.dll.MulDiv",
  532. "kernel32.dll.GetVersionExW",
  533. "kernel32.dll.GetSystemInfo",
  534. "kernel32.dll.MultiByteToWideChar",
  535. "kernel32.dll.WideCharToMultiByte",
  536. "kernel32.dll.GetModuleHandleW",
  537. "kernel32.dll.QueryPerformanceCounter",
  538. "kernel32.dll.VirtualFreeEx",
  539. "kernel32.dll.OpenProcess",
  540. "kernel32.dll.VirtualAllocEx",
  541. "kernel32.dll.WriteProcessMemory",
  542. "kernel32.dll.ReadProcessMemory",
  543. "kernel32.dll.CreateFileW",
  544. "kernel32.dll.SetFilePointerEx",
  545. "kernel32.dll.ReadFile",
  546. "kernel32.dll.WriteFile",
  547. "kernel32.dll.FlushFileBuffers",
  548. "kernel32.dll.TerminateProcess",
  549. "kernel32.dll.CreateToolhelp32Snapshot",
  550. "kernel32.dll.Process32FirstW",
  551. "kernel32.dll.Process32NextW",
  552. "kernel32.dll.SetFileTime",
  553. "kernel32.dll.GetFileAttributesW",
  554. "kernel32.dll.FindFirstFileW",
  555. "kernel32.dll.FindClose",
  556. "kernel32.dll.DeleteFileW",
  557. "kernel32.dll.FindNextFileW",
  558. "kernel32.dll.lstrcmpiW",
  559. "kernel32.dll.MoveFileW",
  560. "kernel32.dll.CopyFileW",
  561. "kernel32.dll.CreateDirectoryW",
  562. "kernel32.dll.RemoveDirectoryW",
  563. "kernel32.dll.SetSystemPowerState",
  564. "kernel32.dll.QueryPerformanceFrequency",
  565. "kernel32.dll.FindResourceW",
  566. "kernel32.dll.LoadResource",
  567. "kernel32.dll.LockResource",
  568. "kernel32.dll.SizeofResource",
  569. "kernel32.dll.GetProcessHeap",
  570. "kernel32.dll.OutputDebugStringW",
  571. "kernel32.dll.GetLocalTime",
  572. "kernel32.dll.CompareStringW",
  573. "kernel32.dll.CompareStringA",
  574. "kernel32.dll.InterlockedIncrement",
  575. "kernel32.dll.InterlockedDecrement",
  576. "kernel32.dll.DeleteCriticalSection",
  577. "kernel32.dll.EnterCriticalSection",
  578. "kernel32.dll.LeaveCriticalSection",
  579. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  580. "kernel32.dll.GetStdHandle",
  581. "kernel32.dll.CreatePipe",
  582. "kernel32.dll.InterlockedExchange",
  583. "kernel32.dll.TerminateThread",
  584. "kernel32.dll.GetTempPathW",
  585. "kernel32.dll.GetTempFileNameW",
  586. "kernel32.dll.VirtualFree",
  587. "kernel32.dll.FormatMessageW",
  588. "kernel32.dll.GetExitCodeProcess",
  589. "kernel32.dll.SetErrorMode",
  590. "kernel32.dll.GetPrivateProfileStringW",
  591. "kernel32.dll.WritePrivateProfileStringW",
  592. "kernel32.dll.GetPrivateProfileSectionW",
  593. "kernel32.dll.WritePrivateProfileSectionW",
  594. "kernel32.dll.GetPrivateProfileSectionNamesW",
  595. "kernel32.dll.FileTimeToLocalFileTime",
  596. "kernel32.dll.FileTimeToSystemTime",
  597. "kernel32.dll.SystemTimeToFileTime",
  598. "kernel32.dll.LocalFileTimeToFileTime",
  599. "kernel32.dll.GetDriveTypeW",
  600. "kernel32.dll.GetDiskFreeSpaceExW",
  601. "kernel32.dll.GetDiskFreeSpaceW",
  602. "kernel32.dll.GetVolumeInformationW",
  603. "kernel32.dll.SetVolumeLabelW",
  604. "kernel32.dll.CreateHardLinkW",
  605. "kernel32.dll.DeviceIoControl",
  606. "kernel32.dll.SetFileAttributesW",
  607. "kernel32.dll.GetShortPathNameW",
  608. "kernel32.dll.CreateEventW",
  609. "kernel32.dll.SetEvent",
  610. "kernel32.dll.GetEnvironmentVariableW",
  611. "kernel32.dll.SetEnvironmentVariableW",
  612. "kernel32.dll.GlobalLock",
  613. "kernel32.dll.GlobalUnlock",
  614. "kernel32.dll.GlobalAlloc",
  615. "kernel32.dll.GetFileSize",
  616. "kernel32.dll.GlobalFree",
  617. "kernel32.dll.GlobalMemoryStatusEx",
  618. "kernel32.dll.Beep",
  619. "kernel32.dll.GetComputerNameW",
  620. "kernel32.dll.GetWindowsDirectoryW",
  621. "kernel32.dll.GetSystemDirectoryW",
  622. "kernel32.dll.GetCurrentProcessId",
  623. "kernel32.dll.GetCurrentThread",
  624. "kernel32.dll.GetProcessIoCounters",
  625. "kernel32.dll.CreateProcessW",
  626. "kernel32.dll.SetPriorityClass",
  627. "kernel32.dll.LoadLibraryW",
  628. "kernel32.dll.VirtualAlloc",
  629. "kernel32.dll.LoadLibraryExW",
  630. "kernel32.dll.HeapFree",
  631. "kernel32.dll.WaitForSingleObject",
  632. "kernel32.dll.CreateThread",
  633. "kernel32.dll.DuplicateHandle",
  634. "kernel32.dll.GetLastError",
  635. "kernel32.dll.CloseHandle",
  636. "kernel32.dll.GetCurrentProcess",
  637. "kernel32.dll.GetProcAddress",
  638. "kernel32.dll.LoadLibraryA",
  639. "kernel32.dll.FreeLibrary",
  640. "kernel32.dll.GetModuleFileNameW",
  641. "kernel32.dll.GetFullPathNameW",
  642. "kernel32.dll.ExitProcess",
  643. "kernel32.dll.ExitThread",
  644. "kernel32.dll.GetSystemTimeAsFileTime",
  645. "kernel32.dll.SetCurrentDirectoryW",
  646. "kernel32.dll.IsDebuggerPresent",
  647. "kernel32.dll.GetCurrentDirectoryW",
  648. "kernel32.dll.ResumeThread",
  649. "kernel32.dll.GetStartupInfoW",
  650. "kernel32.dll.TlsGetValue",
  651. "kernel32.dll.TlsAlloc",
  652. "kernel32.dll.TlsSetValue",
  653. "kernel32.dll.TlsFree",
  654. "kernel32.dll.SetLastError",
  655. "kernel32.dll.HeapSize",
  656. "kernel32.dll.GetCPInfo",
  657. "kernel32.dll.GetACP",
  658. "kernel32.dll.GetOEMCP",
  659. "kernel32.dll.IsValidCodePage",
  660. "kernel32.dll.UnhandledExceptionFilter",
  661. "kernel32.dll.SetUnhandledExceptionFilter",
  662. "kernel32.dll.GetModuleFileNameA",
  663. "kernel32.dll.HeapReAlloc",
  664. "kernel32.dll.HeapCreate",
  665. "kernel32.dll.SetHandleCount",
  666. "kernel32.dll.GetFileType",
  667. "kernel32.dll.GetStartupInfoA",
  668. "kernel32.dll.SetStdHandle",
  669. "kernel32.dll.GetConsoleCP",
  670. "kernel32.dll.GetConsoleMode",
  671. "kernel32.dll.LCMapStringW",
  672. "kernel32.dll.LCMapStringA",
  673. "kernel32.dll.RtlUnwind",
  674. "kernel32.dll.SetFilePointer",
  675. "kernel32.dll.GetTimeZoneInformation",
  676. "kernel32.dll.GetTimeFormatA",
  677. "kernel32.dll.GetDateFormatA",
  678. "kernel32.dll.FreeEnvironmentStringsW",
  679. "kernel32.dll.GetEnvironmentStringsW",
  680. "kernel32.dll.GetCommandLineW",
  681. "kernel32.dll.GetTickCount",
  682. "kernel32.dll.GetStringTypeA",
  683. "kernel32.dll.GetStringTypeW",
  684. "kernel32.dll.GetLocaleInfoA",
  685. "kernel32.dll.GetModuleHandleA",
  686. "kernel32.dll.WriteConsoleA",
  687. "kernel32.dll.GetConsoleOutputCP",
  688. "kernel32.dll.WriteConsoleW",
  689. "kernel32.dll.CreateFileA",
  690. "kernel32.dll.SetEndOfFile",
  691. "kernel32.dll.EnumResourceNamesW",
  692. "kernel32.dll.SetEnvironmentVariableA",
  693. "advapi32.dll.RegEnumValueW",
  694. "advapi32.dll.RegDeleteValueW",
  695. "advapi32.dll.RegDeleteKeyW",
  696. "advapi32.dll.RegSetValueExW",
  697. "advapi32.dll.RegCreateKeyExW",
  698. "advapi32.dll.GetUserNameW",
  699. "advapi32.dll.RegConnectRegistryW",
  700. "advapi32.dll.RegEnumKeyExW",
  701. "advapi32.dll.CloseServiceHandle",
  702. "advapi32.dll.UnlockServiceDatabase",
  703. "advapi32.dll.LockServiceDatabase",
  704. "advapi32.dll.OpenSCManagerW",
  705. "advapi32.dll.InitiateSystemShutdownExW",
  706. "advapi32.dll.AdjustTokenPrivileges",
  707. "advapi32.dll.RegCloseKey",
  708. "advapi32.dll.RegQueryValueExW",
  709. "advapi32.dll.RegOpenKeyExW",
  710. "advapi32.dll.OpenThreadToken",
  711. "advapi32.dll.OpenProcessToken",
  712. "advapi32.dll.LookupPrivilegeValueW",
  713. "advapi32.dll.DuplicateTokenEx",
  714. "advapi32.dll.CreateProcessAsUserW",
  715. "advapi32.dll.CreateProcessWithLogonW",
  716. "advapi32.dll.InitializeSecurityDescriptor",
  717. "advapi32.dll.InitializeAcl",
  718. "advapi32.dll.GetLengthSid",
  719. "advapi32.dll.SetSecurityDescriptorDacl",
  720. "advapi32.dll.CopySid",
  721. "advapi32.dll.LogonUserW",
  722. "advapi32.dll.GetTokenInformation",
  723. "advapi32.dll.GetAclInformation",
  724. "advapi32.dll.GetAce",
  725. "advapi32.dll.AddAce",
  726. "advapi32.dll.GetSecurityDescriptorDacl",
  727. "comctl32.dll.ImageList_Remove",
  728. "comctl32.dll.ImageList_SetDragCursorImage",
  729. "comctl32.dll.ImageList_BeginDrag",
  730. "comctl32.dll.ImageList_DragEnter",
  731. "comctl32.dll.ImageList_DragLeave",
  732. "comctl32.dll.ImageList_EndDrag",
  733. "comctl32.dll.ImageList_DragMove",
  734. "comctl32.dll.ImageList_ReplaceIcon",
  735. "comctl32.dll.ImageList_Create",
  736. "comctl32.dll.InitCommonControlsEx",
  737. "comctl32.dll.ImageList_Destroy",
  738. "comdlg32.dll.GetSaveFileNameW",
  739. "comdlg32.dll.GetOpenFileNameW",
  740. "gdi32.dll.DeleteObject",
  741. "gdi32.dll.GetObjectW",
  742. "gdi32.dll.GetTextExtentPoint32W",
  743. "gdi32.dll.ExtCreatePen",
  744. "gdi32.dll.StrokeAndFillPath",
  745. "gdi32.dll.StrokePath",
  746. "gdi32.dll.EndPath",
  747. "gdi32.dll.SetPixel",
  748. "gdi32.dll.CloseFigure",
  749. "gdi32.dll.CreateCompatibleBitmap",
  750. "gdi32.dll.CreateCompatibleDC",
  751. "gdi32.dll.SelectObject",
  752. "gdi32.dll.StretchBlt",
  753. "gdi32.dll.GetDIBits",
  754. "gdi32.dll.LineTo",
  755. "gdi32.dll.AngleArc",
  756. "gdi32.dll.MoveToEx",
  757. "gdi32.dll.Ellipse",
  758. "gdi32.dll.PolyDraw",
  759. "gdi32.dll.BeginPath",
  760. "gdi32.dll.Rectangle",
  761. "gdi32.dll.GetDeviceCaps",
  762. "gdi32.dll.SetBkMode",
  763. "gdi32.dll.RoundRect",
  764. "gdi32.dll.SetBkColor",
  765. "gdi32.dll.CreatePen",
  766. "gdi32.dll.CreateSolidBrush",
  767. "gdi32.dll.SetTextColor",
  768. "gdi32.dll.CreateFontW",
  769. "gdi32.dll.GetTextFaceW",
  770. "gdi32.dll.GetStockObject",
  771. "gdi32.dll.CreateDCW",
  772. "gdi32.dll.GetPixel",
  773. "gdi32.dll.DeleteDC",
  774. "gdi32.dll.SetViewportOrgEx",
  775. "mpr.dll.WNetCancelConnection2W",
  776. "mpr.dll.WNetGetConnectionW",
  777. "mpr.dll.WNetAddConnection2W",
  778. "mpr.dll.WNetUseConnectionW",
  779. "ole32.dll.OleSetMenuDescriptor",
  780. "ole32.dll.MkParseDisplayName",
  781. "ole32.dll.OleSetContainedObject",
  782. "ole32.dll.CoInitialize",
  783. "ole32.dll.CoUninitialize",
  784. "ole32.dll.CoCreateInstance",
  785. "ole32.dll.CreateStreamOnHGlobal",
  786. "ole32.dll.CoTaskMemAlloc",
  787. "ole32.dll.CoTaskMemFree",
  788. "ole32.dll.CLSIDFromString",
  789. "ole32.dll.StringFromCLSID",
  790. "ole32.dll.IIDFromString",
  791. "ole32.dll.StringFromIID",
  792. "ole32.dll.OleInitialize",
  793. "ole32.dll.CreateBindCtx",
  794. "ole32.dll.CLSIDFromProgID",
  795. "ole32.dll.CoInitializeSecurity",
  796. "ole32.dll.CoCreateInstanceEx",
  797. "ole32.dll.CoSetProxyBlanket",
  798. "ole32.dll.OleUninitialize",
  799. "oleaut32.dll.#37",
  800. "oleaut32.dll.#41",
  801. "oleaut32.dll.#2",
  802. "oleaut32.dll.#418",
  803. "oleaut32.dll.#77",
  804. "oleaut32.dll.#39",
  805. "oleaut32.dll.#23",
  806. "oleaut32.dll.#220",
  807. "oleaut32.dll.#185",
  808. "oleaut32.dll.#9",
  809. "oleaut32.dll.#10",
  810. "oleaut32.dll.#8",
  811. "oleaut32.dll.#38",
  812. "oleaut32.dll.#162",
  813. "oleaut32.dll.#35",
  814. "oleaut32.dll.#24",
  815. "psapi.dll.EnumProcesses",
  816. "psapi.dll.GetModuleBaseNameW",
  817. "psapi.dll.GetProcessMemoryInfo",
  818. "psapi.dll.EnumProcessModules",
  819. "shell32.dll.DragQueryPoint",
  820. "shell32.dll.ShellExecuteExW",
  821. "shell32.dll.SHGetFolderPathW",
  822. "shell32.dll.DragQueryFileW",
  823. "shell32.dll.SHEmptyRecycleBinW",
  824. "shell32.dll.SHBrowseForFolderW",
  825. "shell32.dll.SHFileOperationW",
  826. "shell32.dll.SHGetPathFromIDListW",
  827. "shell32.dll.SHGetDesktopFolder",
  828. "shell32.dll.SHGetMalloc",
  829. "shell32.dll.ExtractIconExW",
  830. "shell32.dll.Shell_NotifyIconW",
  831. "shell32.dll.ShellExecuteW",
  832. "shell32.dll.DragFinish",
  833. "user32.dll.SetWindowPos",
  834. "user32.dll.GetCursorInfo",
  835. "user32.dll.RegisterHotKey",
  836. "user32.dll.ClientToScreen",
  837. "user32.dll.GetKeyboardLayoutNameW",
  838. "user32.dll.IsCharAlphaW",
  839. "user32.dll.IsCharAlphaNumericW",
  840. "user32.dll.IsCharLowerW",
  841. "user32.dll.IsCharUpperW",
  842. "user32.dll.GetMenuStringW",
  843. "user32.dll.GetSubMenu",
  844. "user32.dll.GetCaretPos",
  845. "user32.dll.IsZoomed",
  846. "user32.dll.MonitorFromPoint",
  847. "user32.dll.GetMonitorInfoW",
  848. "user32.dll.SetWindowLongW",
  849. "user32.dll.SetLayeredWindowAttributes",
  850. "user32.dll.FlashWindow",
  851. "user32.dll.GetClassLongW",
  852. "user32.dll.TranslateAcceleratorW",
  853. "user32.dll.IsDialogMessageW",
  854. "user32.dll.GetSysColor",
  855. "user32.dll.InflateRect",
  856. "user32.dll.DrawFocusRect",
  857. "user32.dll.DrawTextW",
  858. "user32.dll.FrameRect",
  859. "user32.dll.DrawFrameControl",
  860. "user32.dll.FillRect",
  861. "user32.dll.PtInRect",
  862. "user32.dll.DestroyAcceleratorTable",
  863. "user32.dll.CreateAcceleratorTableW",
  864. "user32.dll.SetCursor",
  865. "user32.dll.GetWindowDC",
  866. "user32.dll.GetSystemMetrics",
  867. "user32.dll.GetActiveWindow",
  868. "user32.dll.CharNextW",
  869. "user32.dll.wsprintfW",
  870. "user32.dll.RedrawWindow",
  871. "user32.dll.DrawMenuBar",
  872. "user32.dll.DestroyMenu",
  873. "user32.dll.SetMenu",
  874. "user32.dll.GetWindowTextLengthW",
  875. "user32.dll.CreateMenu",
  876. "user32.dll.IsDlgButtonChecked",
  877. "user32.dll.DefDlgProcW",
  878. "user32.dll.ReleaseCapture",
  879. "user32.dll.SetCapture",
  880. "user32.dll.WindowFromPoint",
  881. "user32.dll.CreateIconFromResourceEx",
  882. "user32.dll.mouse_event",
  883. "user32.dll.ExitWindowsEx",
  884. "user32.dll.SetActiveWindow",
  885. "user32.dll.FindWindowExW",
  886. "user32.dll.EnumThreadWindows",
  887. "user32.dll.SetMenuDefaultItem",
  888. "user32.dll.InsertMenuItemW",
  889. "user32.dll.IsMenu",
  890. "user32.dll.TrackPopupMenuEx",
  891. "user32.dll.GetCursorPos",
  892. "user32.dll.DeleteMenu",
  893. "user32.dll.CheckMenuRadioItem",
  894. "user32.dll.CopyImage",
  895. "user32.dll.GetMenuItemCount",
  896. "user32.dll.SetMenuItemInfoW",
  897. "user32.dll.GetMenuItemInfoW",
  898. "user32.dll.SetForegroundWindow",
  899. "user32.dll.IsIconic",
  900. "user32.dll.FindWindowW",
  901. "user32.dll.SystemParametersInfoW",
  902. "user32.dll.PeekMessageW",
  903. "user32.dll.SendInput",
  904. "user32.dll.GetAsyncKeyState",
  905. "user32.dll.SetKeyboardState",
  906. "user32.dll.GetKeyboardState",
  907. "user32.dll.GetKeyState",
  908. "user32.dll.VkKeyScanW",
  909. "user32.dll.LoadStringW",
  910. "user32.dll.DialogBoxParamW",
  911. "user32.dll.MessageBeep",
  912. "user32.dll.EndDialog",
  913. "user32.dll.SendDlgItemMessageW",
  914. "user32.dll.GetDlgItem",
  915. "user32.dll.SetWindowTextW",
  916. "user32.dll.CopyRect",
  917. "user32.dll.ReleaseDC",
  918. "user32.dll.GetDC",
  919. "user32.dll.EndPaint",
  920. "user32.dll.BeginPaint",
  921. "user32.dll.GetClientRect",
  922. "user32.dll.GetMenu",
  923. "user32.dll.DestroyWindow",
  924. "user32.dll.EnumWindows",
  925. "user32.dll.GetDesktopWindow",
  926. "user32.dll.IsWindow",
  927. "user32.dll.IsWindowEnabled",
  928. "user32.dll.IsWindowVisible",
  929. "user32.dll.EnableWindow",
  930. "user32.dll.InvalidateRect",
  931. "user32.dll.GetWindowThreadProcessId",
  932. "user32.dll.AttachThreadInput",
  933. "user32.dll.GetFocus",
  934. "user32.dll.GetWindowTextW",
  935. "user32.dll.ScreenToClient",
  936. "user32.dll.SendMessageTimeoutW",
  937. "user32.dll.EnumChildWindows",
  938. "user32.dll.CharUpperBuffW",
  939. "user32.dll.GetClassNameW",
  940. "user32.dll.GetParent",
  941. "user32.dll.GetDlgCtrlID",
  942. "user32.dll.SendMessageW",
  943. "user32.dll.MapVirtualKeyW",
  944. "user32.dll.PostMessageW",
  945. "user32.dll.GetWindowRect",
  946. "user32.dll.SetUserObjectSecurity",
  947. "user32.dll.GetUserObjectSecurity",
  948. "user32.dll.CloseDesktop",
  949. "user32.dll.CloseWindowStation",
  950. "user32.dll.OpenDesktopW",
  951. "user32.dll.SetProcessWindowStation",
  952. "user32.dll.GetProcessWindowStation",
  953. "user32.dll.OpenWindowStationW",
  954. "user32.dll.MessageBoxW",
  955. "user32.dll.DefWindowProcW",
  956. "user32.dll.MoveWindow",
  957. "user32.dll.AdjustWindowRectEx",
  958. "user32.dll.SetRect",
  959. "user32.dll.SetClipboardData",
  960. "user32.dll.EmptyClipboard",
  961. "user32.dll.CountClipboardFormats",
  962. "user32.dll.CloseClipboard",
  963. "user32.dll.GetClipboardData",
  964. "user32.dll.IsClipboardFormatAvailable",
  965. "user32.dll.OpenClipboard",
  966. "user32.dll.BlockInput",
  967. "user32.dll.GetMessageW",
  968. "user32.dll.LockWindowUpdate",
  969. "user32.dll.DispatchMessageW",
  970. "user32.dll.GetMenuItemID",
  971. "user32.dll.TranslateMessage",
  972. "user32.dll.SetFocus",
  973. "user32.dll.PostQuitMessage",
  974. "user32.dll.KillTimer",
  975. "user32.dll.CreatePopupMenu",
  976. "user32.dll.RegisterWindowMessageW",
  977. "user32.dll.SetTimer",
  978. "user32.dll.ShowWindow",
  979. "user32.dll.CreateWindowExW",
  980. "user32.dll.RegisterClassExW",
  981. "user32.dll.LoadIconW",
  982. "user32.dll.LoadCursorW",
  983. "user32.dll.GetSysColorBrush",
  984. "user32.dll.GetForegroundWindow",
  985. "user32.dll.MessageBoxA",
  986. "user32.dll.DestroyIcon",
  987. "user32.dll.UnregisterHotKey",
  988. "user32.dll.CharLowerBuffW",
  989. "user32.dll.MonitorFromRect",
  990. "user32.dll.keybd_event",
  991. "user32.dll.LoadImageW",
  992. "user32.dll.GetWindowLongW",
  993. "userenv.dll.CreateEnvironmentBlock",
  994. "userenv.dll.DestroyEnvironmentBlock",
  995. "userenv.dll.UnloadUserProfile",
  996. "userenv.dll.LoadUserProfileW",
  997. "version.dll.VerQueryValueW",
  998. "version.dll.GetFileVersionInfoW",
  999. "version.dll.GetFileVersionInfoSizeW",
  1000. "wininet.dll.InternetReadFile",
  1001. "wininet.dll.InternetCloseHandle",
  1002. "wininet.dll.InternetOpenW",
  1003. "wininet.dll.InternetSetOptionW",
  1004. "wininet.dll.InternetCrackUrlW",
  1005. "wininet.dll.HttpQueryInfoW",
  1006. "wininet.dll.InternetConnectW",
  1007. "wininet.dll.HttpOpenRequestW",
  1008. "wininet.dll.HttpSendRequestW",
  1009. "wininet.dll.FtpOpenFileW",
  1010. "wininet.dll.FtpGetFileSize",
  1011. "wininet.dll.InternetOpenUrlW",
  1012. "wininet.dll.InternetQueryOptionW",
  1013. "wininet.dll.InternetQueryDataAvailable",
  1014. "winmm.dll.timeGetTime",
  1015. "winmm.dll.waveOutSetVolume",
  1016. "winmm.dll.mciSendStringW",
  1017. "wsock32.dll.#151",
  1018. "wsock32.dll.#21",
  1019. "wsock32.dll.#15",
  1020. "wsock32.dll.#17",
  1021. "wsock32.dll.#20",
  1022. "wsock32.dll.#9",
  1023. "wsock32.dll.#18",
  1024. "wsock32.dll.#13",
  1025. "wsock32.dll.#115",
  1026. "wsock32.dll.#2",
  1027. "wsock32.dll.#3",
  1028. "wsock32.dll.#4",
  1029. "wsock32.dll.#23",
  1030. "wsock32.dll.#19",
  1031. "wsock32.dll.#116",
  1032. "wsock32.dll.#10",
  1033. "wsock32.dll.#1",
  1034. "wsock32.dll.#111",
  1035. "wsock32.dll.#11",
  1036. "wsock32.dll.#52",
  1037. "wsock32.dll.#57",
  1038. "wsock32.dll.#16",
  1039. "kernel32.dll.FlsAlloc",
  1040. "kernel32.dll.FlsGetValue",
  1041. "kernel32.dll.FlsSetValue",
  1042. "kernel32.dll.FlsFree",
  1043. "kernel32.dll.IsProcessorFeaturePresent",
  1044. "kernel32.dll.IsWow64Process",
  1045. "kernel32.dll.GetNativeSystemInfo",
  1046. "uxtheme.dll.IsThemeActive",
  1047. "ole32.dll.CoGetMalloc",
  1048. "ole32.dll.CoGetApartmentType",
  1049. "kernel32.dll.SortGetHandle",
  1050. "kernel32.dll.SortCloseHandle",
  1051. "comctl32.dll.#236",
  1052. "oleaut32.dll.#6",
  1053. "comctl32.dll.#320",
  1054. "ole32.dll.StringFromGUID2",
  1055. "comctl32.dll.#324",
  1056. "comctl32.dll.#323",
  1057. "comctl32.dll.#388",
  1058. "comctl32.dll.#328",
  1059. "comctl32.dll.#334",
  1060. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  1061. "advapi32.dll.RegEnumKeyW",
  1062. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  1063. "advapi32.dll.IsTextUnicode",
  1064. "comctl32.dll.#332",
  1065. "comctl32.dll.#338",
  1066. "comctl32.dll.#339",
  1067. "shell32.dll.#102",
  1068. "ole32.dll.CoInitializeEx",
  1069. "cryptbase.dll.SystemFunction036",
  1070. "ole32.dll.CoRegisterInitializeSpy",
  1071. "ole32.dll.CoRevokeInitializeSpy",
  1072. "oleaut32.dll.#500",
  1073. "comctl32.dll.#386",
  1074. "dwmapi.dll.DwmIsCompositionEnabled",
  1075. "comctl32.dll.RegisterClassNameW",
  1076. "uxtheme.dll.OpenThemeData",
  1077. "uxtheme.dll.GetThemeBool",
  1078. "imm32.dll.ImmGetContext",
  1079. "imm32.dll.ImmReleaseContext",
  1080. "imm32.dll.ImmAssociateContext",
  1081. "imm32.dll.ImmIsIME",
  1082. "comctl32.dll.HIMAGELIST_QueryInterface",
  1083. "comctl32.dll.DrawShadowText",
  1084. "comctl32.dll.DrawSizeBox",
  1085. "comctl32.dll.DrawScrollBar",
  1086. "comctl32.dll.SizeBoxHwnd",
  1087. "comctl32.dll.ScrollBar_MouseMove",
  1088. "comctl32.dll.ScrollBar_Menu",
  1089. "comctl32.dll.HandleScrollCmd",
  1090. "comctl32.dll.DetachScrollBars",
  1091. "comctl32.dll.AttachScrollBars",
  1092. "comctl32.dll.CCSetScrollInfo",
  1093. "comctl32.dll.CCGetScrollInfo",
  1094. "comctl32.dll.CCEnableScrollBar",
  1095. "comctl32.dll.QuerySystemGestureStatus",
  1096. "uxtheme.dll.#49",
  1097. "shell32.dll.#66",
  1098. "gdi32.dll.GetLayout",
  1099. "gdi32.dll.GdiRealizationInfo",
  1100. "gdi32.dll.FontIsLinked",
  1101. "advapi32.dll.RegQueryInfoKeyW",
  1102. "gdi32.dll.GetTextFaceAliasW",
  1103. "gdi32.dll.GetFontAssocStatus",
  1104. "advapi32.dll.RegQueryValueExA",
  1105. "uxtheme.dll.EnableThemeDialogTexture",
  1106. "gdi32.dll.GdiIsMetaPrintDC",
  1107. "uxtheme.dll.BufferedPaintInit",
  1108. "uxtheme.dll.BufferedPaintRenderAnimation",
  1109. "uxtheme.dll.GetThemeTransitionDuration",
  1110. "uxtheme.dll.BeginBufferedAnimation",
  1111. "uxtheme.dll.IsThemeBackgroundPartiallyTransparent",
  1112. "uxtheme.dll.DrawThemeParentBackground",
  1113. "uxtheme.dll.DrawThemeBackground",
  1114. "uxtheme.dll.GetThemeBackgroundContentRect",
  1115. "uxtheme.dll.DrawThemeText",
  1116. "uxtheme.dll.EndBufferedAnimation",
  1117. "uxtheme.dll.CloseThemeData",
  1118. "uxtheme.dll.BufferedPaintStopAllAnimations",
  1119. "uxtheme.dll.BufferedPaintUnInit",
  1120. "comctl32.dll.#321"
  1121. ]
  1122.  
  1123. [*] Static Analysis: {
  1124. "pe": {
  1125. "peid_signatures": null,
  1126. "imports": [
  1127. {
  1128. "imports": [
  1129. {
  1130. "name": "LoadLibraryA",
  1131. "address": "0x4e8708"
  1132. },
  1133. {
  1134. "name": "GetProcAddress",
  1135. "address": "0x4e870c"
  1136. },
  1137. {
  1138. "name": "VirtualProtect",
  1139. "address": "0x4e8710"
  1140. },
  1141. {
  1142. "name": "VirtualAlloc",
  1143. "address": "0x4e8714"
  1144. },
  1145. {
  1146. "name": "VirtualFree",
  1147. "address": "0x4e8718"
  1148. },
  1149. {
  1150. "name": "ExitProcess",
  1151. "address": "0x4e871c"
  1152. }
  1153. ],
  1154. "dll": "KERNEL32.DLL"
  1155. },
  1156. {
  1157. "imports": [
  1158. {
  1159. "name": "GetAce",
  1160. "address": "0x4e8724"
  1161. }
  1162. ],
  1163. "dll": "ADVAPI32.dll"
  1164. },
  1165. {
  1166. "imports": [
  1167. {
  1168. "name": "ImageList_Remove",
  1169. "address": "0x4e872c"
  1170. }
  1171. ],
  1172. "dll": "COMCTL32.dll"
  1173. },
  1174. {
  1175. "imports": [
  1176. {
  1177. "name": "GetSaveFileNameW",
  1178. "address": "0x4e8734"
  1179. }
  1180. ],
  1181. "dll": "COMDLG32.dll"
  1182. },
  1183. {
  1184. "imports": [
  1185. {
  1186. "name": "LineTo",
  1187. "address": "0x4e873c"
  1188. }
  1189. ],
  1190. "dll": "GDI32.dll"
  1191. },
  1192. {
  1193. "imports": [
  1194. {
  1195. "name": "WNetGetConnectionW",
  1196. "address": "0x4e8744"
  1197. }
  1198. ],
  1199. "dll": "MPR.dll"
  1200. },
  1201. {
  1202. "imports": [
  1203. {
  1204. "name": "CoInitialize",
  1205. "address": "0x4e874c"
  1206. }
  1207. ],
  1208. "dll": "ole32.dll"
  1209. },
  1210. {
  1211. "imports": [
  1212. {
  1213. "name": "SafeArrayUnaccessData",
  1214. "address": "0x4e8754"
  1215. }
  1216. ],
  1217. "dll": "OLEAUT32.dll"
  1218. },
  1219. {
  1220. "imports": [
  1221. {
  1222. "name": "EnumProcesses",
  1223. "address": "0x4e875c"
  1224. }
  1225. ],
  1226. "dll": "PSAPI.DLL"
  1227. },
  1228. {
  1229. "imports": [
  1230. {
  1231. "name": "DragFinish",
  1232. "address": "0x4e8764"
  1233. }
  1234. ],
  1235. "dll": "SHELL32.dll"
  1236. },
  1237. {
  1238. "imports": [
  1239. {
  1240. "name": "GetDC",
  1241. "address": "0x4e876c"
  1242. }
  1243. ],
  1244. "dll": "USER32.dll"
  1245. },
  1246. {
  1247. "imports": [
  1248. {
  1249. "name": "LoadUserProfileW",
  1250. "address": "0x4e8774"
  1251. }
  1252. ],
  1253. "dll": "USERENV.dll"
  1254. },
  1255. {
  1256. "imports": [
  1257. {
  1258. "name": "VerQueryValueW",
  1259. "address": "0x4e877c"
  1260. }
  1261. ],
  1262. "dll": "VERSION.dll"
  1263. },
  1264. {
  1265. "imports": [
  1266. {
  1267. "name": "FtpOpenFileW",
  1268. "address": "0x4e8784"
  1269. }
  1270. ],
  1271. "dll": "WININET.dll"
  1272. },
  1273. {
  1274. "imports": [
  1275. {
  1276. "name": "timeGetTime",
  1277. "address": "0x4e878c"
  1278. }
  1279. ],
  1280. "dll": "WINMM.dll"
  1281. },
  1282. {
  1283. "imports": [
  1284. {
  1285. "name": "recv",
  1286. "address": "0x4e8794"
  1287. }
  1288. ],
  1289. "dll": "WSOCK32.dll"
  1290. }
  1291. ],
  1292. "digital_signers": null,
  1293. "exported_dll_name": null,
  1294. "actual_checksum": "0x00578f81",
  1295. "overlay": {
  1296. "size": "0x0050fa8e",
  1297. "offset": "0x0005dc00"
  1298. },
  1299. "imagebase": "0x00400000",
  1300. "reported_checksum": "0x00000000",
  1301. "icon_hash": null,
  1302. "entrypoint": "0x004ccbb0",
  1303. "timestamp": "2010-04-16 07:47:33",
  1304. "osversion": "5.0",
  1305. "sections": [
  1306. {
  1307. "name": "UPX0",
  1308. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1309. "virtual_address": "0x00001000",
  1310. "size_of_data": "0x00000000",
  1311. "entropy": "0.00",
  1312. "raw_address": "0x00000400",
  1313. "virtual_size": "0x0008a000",
  1314. "characteristics_raw": "0xe0000080"
  1315. },
  1316. {
  1317. "name": "UPX1",
  1318. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1319. "virtual_address": "0x0008b000",
  1320. "size_of_data": "0x00041e00",
  1321. "entropy": "7.93",
  1322. "raw_address": "0x00000400",
  1323. "virtual_size": "0x00042000",
  1324. "characteristics_raw": "0xe0000040"
  1325. },
  1326. {
  1327. "name": ".rsrc",
  1328. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1329. "virtual_address": "0x000cd000",
  1330. "size_of_data": "0x0001ba00",
  1331. "entropy": "7.72",
  1332. "raw_address": "0x00042200",
  1333. "virtual_size": "0x0001c000",
  1334. "characteristics_raw": "0xc0000040"
  1335. }
  1336. ],
  1337. "resources": [],
  1338. "dirents": [
  1339. {
  1340. "virtual_address": "0x00000000",
  1341. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1342. "size": "0x00000000"
  1343. },
  1344. {
  1345. "virtual_address": "0x000e85b4",
  1346. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1347. "size": "0x000003b0"
  1348. },
  1349. {
  1350. "virtual_address": "0x000cd000",
  1351. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1352. "size": "0x0001b5b4"
  1353. },
  1354. {
  1355. "virtual_address": "0x00000000",
  1356. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1357. "size": "0x00000000"
  1358. },
  1359. {
  1360. "virtual_address": "0x00000000",
  1361. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1362. "size": "0x00000000"
  1363. },
  1364. {
  1365. "virtual_address": "0x00000000",
  1366. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1367. "size": "0x00000000"
  1368. },
  1369. {
  1370. "virtual_address": "0x00000000",
  1371. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1372. "size": "0x00000000"
  1373. },
  1374. {
  1375. "virtual_address": "0x00000000",
  1376. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1377. "size": "0x00000000"
  1378. },
  1379. {
  1380. "virtual_address": "0x00000000",
  1381. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1382. "size": "0x00000000"
  1383. },
  1384. {
  1385. "virtual_address": "0x00000000",
  1386. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1387. "size": "0x00000000"
  1388. },
  1389. {
  1390. "virtual_address": "0x00000000",
  1391. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1392. "size": "0x00000000"
  1393. },
  1394. {
  1395. "virtual_address": "0x00000000",
  1396. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1397. "size": "0x00000000"
  1398. },
  1399. {
  1400. "virtual_address": "0x00000000",
  1401. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1402. "size": "0x00000000"
  1403. },
  1404. {
  1405. "virtual_address": "0x00000000",
  1406. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1407. "size": "0x00000000"
  1408. },
  1409. {
  1410. "virtual_address": "0x00000000",
  1411. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1412. "size": "0x00000000"
  1413. },
  1414. {
  1415. "virtual_address": "0x00000000",
  1416. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1417. "size": "0x00000000"
  1418. }
  1419. ],
  1420. "exports": [],
  1421. "guest_signers": {},
  1422. "imphash": "77b2e5e9b52fbef7638f64ab65f0c58c",
  1423. "icon_fuzzy": null,
  1424. "icon": null,
  1425. "pdbpath": null,
  1426. "imported_dll_count": 16,
  1427. "versioninfo": []
  1428. }
  1429. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!