API tools faq
paste
paladin316

SetACLx64_exe.json

paladin316
Jun 19th, 2019
2,175
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 66.51 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 0.0
  5.  
  6. [*] File Name: "SetACLx64.exe"
  7. [*] File Size: 559528
  8. [*] File Type: "PE32+ executable (console) x86-64, for MS Windows"
  9. [*] SHA256: "427ff43693cb3ca2812c4754f607f107a6b2d3f5a8b313addee57d89982df419"
  10. [*] MD5: "3e350eb5df15c06dec400a39dd1c6f29"
  11. [*] SHA1: "f1434cfef2c05fda919922b721ec1a17adb3194e"
  12. [*] SHA512: "b6b6cdfe2b08aa49254e48302385a3a2a8385e2228bdcffd3032757acf1a1d4abff1270f5488083cfa4480439ff161a9d0ea5f193cabc1eb1e7b1255ce262ab6"
  13. [*] CRC32: "727C755A"
  14. [*] SSDEEP: "12288:ZM9AwIce16TCkcgxjouFmQGzt/B6QziZUt2qaV7se:ZM9Sce16TCkcgxMuFmQGztZZiSAqA7R"
  15.  
  16. [*] Process Execution: [
  17. "SetACLx64.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: []
  21.  
  22. [*] Started Service: []
  23.  
  24. [*] Created Services: []
  25.  
  26. [*] Mutexes: []
  27.  
  28. [*] Modified Files: []
  29.  
  30. [*] Deleted Files: []
  31.  
  32. [*] Modified Registry Keys: []
  33.  
  34. [*] Deleted Registry Keys: []
  35.  
  36. [*] DNS Communications: []
  37.  
  38. [*] Domains: []
  39.  
  40. [*] Network Communication - ICMP: []
  41.  
  42. [*] Network Communication - HTTP: []
  43.  
  44. [*] Network Communication - SMTP: []
  45.  
  46. [*] Network Communication - Hosts: []
  47.  
  48. [*] Network Communication - IRC: []
  49.  
  50. [*] Static Analysis: {
  51. "pe": {
  52. "peid_signatures": null,
  53. "imports": [
  54. {
  55. "imports": [
  56. {
  57. "name": "GetUserNameExW",
  58. "address": "0x14005f580"
  59. }
  60. ],
  61. "dll": "Secur32.dll"
  62. },
  63. {
  64. "imports": [
  65. {
  66. "name": "VerQueryValueW",
  67. "address": "0x14005f5a0"
  68. }
  69. ],
  70. "dll": "VERSION.dll"
  71. },
  72. {
  73. "imports": [
  74. {
  75. "name": null,
  76. "address": "0x14005f000"
  77. }
  78. ],
  79. "dll": "ACTIVEDS.dll"
  80. },
  81. {
  82. "imports": [
  83. {
  84. "name": "CreateFileW",
  85. "address": "0x14005f178"
  86. },
  87. {
  88. "name": "WideCharToMultiByte",
  89. "address": "0x14005f180"
  90. },
  91. {
  92. "name": "MultiByteToWideChar",
  93. "address": "0x14005f188"
  94. },
  95. {
  96. "name": "GetStringTypeW",
  97. "address": "0x14005f190"
  98. },
  99. {
  100. "name": "EncodePointer",
  101. "address": "0x14005f198"
  102. },
  103. {
  104. "name": "DecodePointer",
  105. "address": "0x14005f1a0"
  106. },
  107. {
  108. "name": "Sleep",
  109. "address": "0x14005f1a8"
  110. },
  111. {
  112. "name": "GetCommandLineW",
  113. "address": "0x14005f1b0"
  114. },
  115. {
  116. "name": "RtlLookupFunctionEntry",
  117. "address": "0x14005f1b8"
  118. },
  119. {
  120. "name": "RtlUnwindEx",
  121. "address": "0x14005f1c0"
  122. },
  123. {
  124. "name": "RaiseException",
  125. "address": "0x14005f1c8"
  126. },
  127. {
  128. "name": "RtlPcToFileHeader",
  129. "address": "0x14005f1d0"
  130. },
  131. {
  132. "name": "GetCPInfo",
  133. "address": "0x14005f1d8"
  134. },
  135. {
  136. "name": "LCMapStringW",
  137. "address": "0x14005f1e0"
  138. },
  139. {
  140. "name": "TerminateProcess",
  141. "address": "0x14005f1e8"
  142. },
  143. {
  144. "name": "UnhandledExceptionFilter",
  145. "address": "0x14005f1f0"
  146. },
  147. {
  148. "name": "SetUnhandledExceptionFilter",
  149. "address": "0x14005f1f8"
  150. },
  151. {
  152. "name": "IsDebuggerPresent",
  153. "address": "0x14005f200"
  154. },
  155. {
  156. "name": "RtlVirtualUnwind",
  157. "address": "0x14005f208"
  158. },
  159. {
  160. "name": "RtlCaptureContext",
  161. "address": "0x14005f210"
  162. },
  163. {
  164. "name": "InitializeCriticalSectionAndSpinCount",
  165. "address": "0x14005f218"
  166. },
  167. {
  168. "name": "FlsGetValue",
  169. "address": "0x14005f220"
  170. },
  171. {
  172. "name": "FlsSetValue",
  173. "address": "0x14005f228"
  174. },
  175. {
  176. "name": "FlsFree",
  177. "address": "0x14005f230"
  178. },
  179. {
  180. "name": "SetLastError",
  181. "address": "0x14005f238"
  182. },
  183. {
  184. "name": "FindClose",
  185. "address": "0x14005f240"
  186. },
  187. {
  188. "name": "HeapSetInformation",
  189. "address": "0x14005f248"
  190. },
  191. {
  192. "name": "GetVersion",
  193. "address": "0x14005f250"
  194. },
  195. {
  196. "name": "HeapCreate",
  197. "address": "0x14005f258"
  198. },
  199. {
  200. "name": "GetStdHandle",
  201. "address": "0x14005f260"
  202. },
  203. {
  204. "name": "GetLocaleInfoW",
  205. "address": "0x14005f268"
  206. },
  207. {
  208. "name": "ExitProcess",
  209. "address": "0x14005f270"
  210. },
  211. {
  212. "name": "FreeEnvironmentStringsW",
  213. "address": "0x14005f278"
  214. },
  215. {
  216. "name": "GetEnvironmentStringsW",
  217. "address": "0x14005f280"
  218. },
  219. {
  220. "name": "SetHandleCount",
  221. "address": "0x14005f288"
  222. },
  223. {
  224. "name": "GetFileType",
  225. "address": "0x14005f290"
  226. },
  227. {
  228. "name": "GetStartupInfoW",
  229. "address": "0x14005f298"
  230. },
  231. {
  232. "name": "QueryPerformanceCounter",
  233. "address": "0x14005f2a0"
  234. },
  235. {
  236. "name": "GetTickCount",
  237. "address": "0x14005f2a8"
  238. },
  239. {
  240. "name": "GetCurrentProcessId",
  241. "address": "0x14005f2b0"
  242. },
  243. {
  244. "name": "GetSystemTimeAsFileTime",
  245. "address": "0x14005f2b8"
  246. },
  247. {
  248. "name": "HeapSize",
  249. "address": "0x14005f2c0"
  250. },
  251. {
  252. "name": "GetACP",
  253. "address": "0x14005f2c8"
  254. },
  255. {
  256. "name": "GetOEMCP",
  257. "address": "0x14005f2d0"
  258. },
  259. {
  260. "name": "IsValidCodePage",
  261. "address": "0x14005f2d8"
  262. },
  263. {
  264. "name": "GetUserDefaultLCID",
  265. "address": "0x14005f2e0"
  266. },
  267. {
  268. "name": "GetLocaleInfoA",
  269. "address": "0x14005f2e8"
  270. },
  271. {
  272. "name": "EnumSystemLocalesA",
  273. "address": "0x14005f2f0"
  274. },
  275. {
  276. "name": "IsValidLocale",
  277. "address": "0x14005f2f8"
  278. },
  279. {
  280. "name": "HeapReAlloc",
  281. "address": "0x14005f300"
  282. },
  283. {
  284. "name": "CompareStringW",
  285. "address": "0x14005f308"
  286. },
  287. {
  288. "name": "SetEnvironmentVariableW",
  289. "address": "0x14005f310"
  290. },
  291. {
  292. "name": "SetFilePointer",
  293. "address": "0x14005f318"
  294. },
  295. {
  296. "name": "GetConsoleCP",
  297. "address": "0x14005f320"
  298. },
  299. {
  300. "name": "GetConsoleMode",
  301. "address": "0x14005f328"
  302. },
  303. {
  304. "name": "FlushFileBuffers",
  305. "address": "0x14005f330"
  306. },
  307. {
  308. "name": "SetStdHandle",
  309. "address": "0x14005f338"
  310. },
  311. {
  312. "name": "WriteConsoleW",
  313. "address": "0x14005f340"
  314. },
  315. {
  316. "name": "SetEndOfFile",
  317. "address": "0x14005f348"
  318. },
  319. {
  320. "name": "ReadFile",
  321. "address": "0x14005f350"
  322. },
  323. {
  324. "name": "FindFirstFileW",
  325. "address": "0x14005f358"
  326. },
  327. {
  328. "name": "SetEvent",
  329. "address": "0x14005f360"
  330. },
  331. {
  332. "name": "ResetEvent",
  333. "address": "0x14005f368"
  334. },
  335. {
  336. "name": "ReleaseMutex",
  337. "address": "0x14005f370"
  338. },
  339. {
  340. "name": "CreateEventW",
  341. "address": "0x14005f378"
  342. },
  343. {
  344. "name": "CreateMutexW",
  345. "address": "0x14005f380"
  346. },
  347. {
  348. "name": "FindNextFileW",
  349. "address": "0x14005f388"
  350. },
  351. {
  352. "name": "MoveFileExW",
  353. "address": "0x14005f390"
  354. },
  355. {
  356. "name": "WriteFile",
  357. "address": "0x14005f398"
  358. },
  359. {
  360. "name": "SetFilePointerEx",
  361. "address": "0x14005f3a0"
  362. },
  363. {
  364. "name": "GetFileSizeEx",
  365. "address": "0x14005f3a8"
  366. },
  367. {
  368. "name": "GetCurrentThreadId",
  369. "address": "0x14005f3b0"
  370. },
  371. {
  372. "name": "GetLocalTime",
  373. "address": "0x14005f3b8"
  374. },
  375. {
  376. "name": "WaitForSingleObject",
  377. "address": "0x14005f3c0"
  378. },
  379. {
  380. "name": "CreateThread",
  381. "address": "0x14005f3c8"
  382. },
  383. {
  384. "name": "CompareFileTime",
  385. "address": "0x14005f3d0"
  386. },
  387. {
  388. "name": "LeaveCriticalSection",
  389. "address": "0x14005f3d8"
  390. },
  391. {
  392. "name": "EnterCriticalSection",
  393. "address": "0x14005f3e0"
  394. },
  395. {
  396. "name": "DeleteCriticalSection",
  397. "address": "0x14005f3e8"
  398. },
  399. {
  400. "name": "InitializeCriticalSection",
  401. "address": "0x14005f3f0"
  402. },
  403. {
  404. "name": "FreeLibrary",
  405. "address": "0x14005f3f8"
  406. },
  407. {
  408. "name": "LocalFree",
  409. "address": "0x14005f400"
  410. },
  411. {
  412. "name": "FormatMessageW",
  413. "address": "0x14005f408"
  414. },
  415. {
  416. "name": "LoadLibraryExW",
  417. "address": "0x14005f410"
  418. },
  419. {
  420. "name": "LoadLibraryW",
  421. "address": "0x14005f418"
  422. },
  423. {
  424. "name": "GetModuleFileNameW",
  425. "address": "0x14005f420"
  426. },
  427. {
  428. "name": "GetVersionExW",
  429. "address": "0x14005f428"
  430. },
  431. {
  432. "name": "GetComputerNameW",
  433. "address": "0x14005f430"
  434. },
  435. {
  436. "name": "FreeResource",
  437. "address": "0x14005f438"
  438. },
  439. {
  440. "name": "GetUserDefaultLangID",
  441. "address": "0x14005f440"
  442. },
  443. {
  444. "name": "LockResource",
  445. "address": "0x14005f448"
  446. },
  447. {
  448. "name": "LoadResource",
  449. "address": "0x14005f450"
  450. },
  451. {
  452. "name": "FindResourceW",
  453. "address": "0x14005f458"
  454. },
  455. {
  456. "name": "HeapFree",
  457. "address": "0x14005f460"
  458. },
  459. {
  460. "name": "GetProcessHeap",
  461. "address": "0x14005f468"
  462. },
  463. {
  464. "name": "HeapAlloc",
  465. "address": "0x14005f470"
  466. },
  467. {
  468. "name": "CloseHandle",
  469. "address": "0x14005f478"
  470. },
  471. {
  472. "name": "GetCurrentProcess",
  473. "address": "0x14005f480"
  474. },
  475. {
  476. "name": "GetProcAddress",
  477. "address": "0x14005f488"
  478. },
  479. {
  480. "name": "GetLastError",
  481. "address": "0x14005f490"
  482. },
  483. {
  484. "name": "GetModuleHandleW",
  485. "address": "0x14005f498"
  486. },
  487. {
  488. "name": "FlsAlloc",
  489. "address": "0x14005f4a0"
  490. },
  491. {
  492. "name": "CreateDirectoryW",
  493. "address": "0x14005f4a8"
  494. },
  495. {
  496. "name": "GetFileAttributesW",
  497. "address": "0x14005f4b0"
  498. },
  499. {
  500. "name": "DeleteFileW",
  501. "address": "0x14005f4b8"
  502. }
  503. ],
  504. "dll": "KERNEL32.dll"
  505. },
  506. {
  507. "imports": [
  508. {
  509. "name": "LoadStringW",
  510. "address": "0x14005f590"
  511. }
  512. ],
  513. "dll": "USER32.dll"
  514. },
  515. {
  516. "imports": [
  517. {
  518. "name": "LookupAccountNameW",
  519. "address": "0x14005f010"
  520. },
  521. {
  522. "name": "ConvertSidToStringSidW",
  523. "address": "0x14005f018"
  524. },
  525. {
  526. "name": "LookupAccountSidW",
  527. "address": "0x14005f020"
  528. },
  529. {
  530. "name": "MapGenericMask",
  531. "address": "0x14005f028"
  532. },
  533. {
  534. "name": "GetSecurityDescriptorLength",
  535. "address": "0x14005f030"
  536. },
  537. {
  538. "name": "AddAccessAllowedAce",
  539. "address": "0x14005f038"
  540. },
  541. {
  542. "name": "AddAce",
  543. "address": "0x14005f040"
  544. },
  545. {
  546. "name": "InitializeAcl",
  547. "address": "0x14005f048"
  548. },
  549. {
  550. "name": "IsValidAcl",
  551. "address": "0x14005f050"
  552. },
  553. {
  554. "name": "DeleteAce",
  555. "address": "0x14005f058"
  556. },
  557. {
  558. "name": "MakeSelfRelativeSD",
  559. "address": "0x14005f060"
  560. },
  561. {
  562. "name": "SetSecurityDescriptorSacl",
  563. "address": "0x14005f068"
  564. },
  565. {
  566. "name": "SetSecurityDescriptorDacl",
  567. "address": "0x14005f070"
  568. },
  569. {
  570. "name": "SetSecurityDescriptorGroup",
  571. "address": "0x14005f078"
  572. },
  573. {
  574. "name": "SetSecurityDescriptorOwner",
  575. "address": "0x14005f080"
  576. },
  577. {
  578. "name": "SetNamedSecurityInfoW",
  579. "address": "0x14005f088"
  580. },
  581. {
  582. "name": "SetSecurityInfo",
  583. "address": "0x14005f090"
  584. },
  585. {
  586. "name": "IsValidSecurityDescriptor",
  587. "address": "0x14005f098"
  588. },
  589. {
  590. "name": "GetNamedSecurityInfoW",
  591. "address": "0x14005f0a0"
  592. },
  593. {
  594. "name": "GetKernelObjectSecurity",
  595. "address": "0x14005f0a8"
  596. },
  597. {
  598. "name": "ConvertStringSidToSidW",
  599. "address": "0x14005f0b0"
  600. },
  601. {
  602. "name": "EqualSid",
  603. "address": "0x14005f0b8"
  604. },
  605. {
  606. "name": "GetAce",
  607. "address": "0x14005f0c0"
  608. },
  609. {
  610. "name": "GetAclInformation",
  611. "address": "0x14005f0c8"
  612. },
  613. {
  614. "name": "ConvertSecurityDescriptorToStringSecurityDescriptorW",
  615. "address": "0x14005f0d0"
  616. },
  617. {
  618. "name": "GetSecurityDescriptorControl",
  619. "address": "0x14005f0d8"
  620. },
  621. {
  622. "name": "SetEntriesInAclW",
  623. "address": "0x14005f0e0"
  624. },
  625. {
  626. "name": "RegCreateKeyExW",
  627. "address": "0x14005f0e8"
  628. },
  629. {
  630. "name": "MakeAbsoluteSD",
  631. "address": "0x14005f0f0"
  632. },
  633. {
  634. "name": "ConvertStringSecurityDescriptorToSecurityDescriptorW",
  635. "address": "0x14005f0f8"
  636. },
  637. {
  638. "name": "ReportEventW",
  639. "address": "0x14005f100"
  640. },
  641. {
  642. "name": "DeregisterEventSource",
  643. "address": "0x14005f108"
  644. },
  645. {
  646. "name": "RegisterEventSourceW",
  647. "address": "0x14005f110"
  648. },
  649. {
  650. "name": "RegCloseKey",
  651. "address": "0x14005f118"
  652. },
  653. {
  654. "name": "RegOpenKeyExW",
  655. "address": "0x14005f120"
  656. },
  657. {
  658. "name": "RegConnectRegistryW",
  659. "address": "0x14005f128"
  660. },
  661. {
  662. "name": "RegEnumKeyExW",
  663. "address": "0x14005f130"
  664. },
  665. {
  666. "name": "CopySid",
  667. "address": "0x14005f138"
  668. },
  669. {
  670. "name": "GetLengthSid",
  671. "address": "0x14005f140"
  672. },
  673. {
  674. "name": "IsValidSid",
  675. "address": "0x14005f148"
  676. },
  677. {
  678. "name": "GetTokenInformation",
  679. "address": "0x14005f150"
  680. },
  681. {
  682. "name": "AdjustTokenPrivileges",
  683. "address": "0x14005f158"
  684. },
  685. {
  686. "name": "LookupPrivilegeValueW",
  687. "address": "0x14005f160"
  688. },
  689. {
  690. "name": "OpenProcessToken",
  691. "address": "0x14005f168"
  692. }
  693. ],
  694. "dll": "ADVAPI32.dll"
  695. },
  696. {
  697. "imports": [
  698. {
  699. "name": "CoCreateInstance",
  700. "address": "0x14005f5b0"
  701. },
  702. {
  703. "name": "CoInitialize",
  704. "address": "0x14005f5b8"
  705. },
  706. {
  707. "name": "CoInitializeSecurity",
  708. "address": "0x14005f5c0"
  709. },
  710. {
  711. "name": "CoUninitialize",
  712. "address": "0x14005f5c8"
  713. },
  714. {
  715. "name": "CoSetProxyBlanket",
  716. "address": "0x14005f5d0"
  717. },
  718. {
  719. "name": "CoQueryProxyBlanket",
  720. "address": "0x14005f5d8"
  721. }
  722. ],
  723. "dll": "ole32.dll"
  724. },
  725. {
  726. "imports": [
  727. {
  728. "name": "SysAllocStringLen",
  729. "address": "0x14005f518"
  730. },
  731. {
  732. "name": "SafeArrayGetUBound",
  733. "address": "0x14005f520"
  734. },
  735. {
  736. "name": "SafeArrayGetLBound",
  737. "address": "0x14005f528"
  738. },
  739. {
  740. "name": "VariantClear",
  741. "address": "0x14005f530"
  742. },
  743. {
  744. "name": "VariantInit",
  745. "address": "0x14005f538"
  746. },
  747. {
  748. "name": "SysStringByteLen",
  749. "address": "0x14005f540"
  750. },
  751. {
  752. "name": "SafeArrayUnaccessData",
  753. "address": "0x14005f548"
  754. },
  755. {
  756. "name": "SafeArrayAccessData",
  757. "address": "0x14005f550"
  758. },
  759. {
  760. "name": "SafeArrayCreate",
  761. "address": "0x14005f558"
  762. },
  763. {
  764. "name": "SysAllocString",
  765. "address": "0x14005f560"
  766. },
  767. {
  768. "name": "SysFreeString",
  769. "address": "0x14005f568"
  770. },
  771. {
  772. "name": "SysAllocStringByteLen",
  773. "address": "0x14005f570"
  774. }
  775. ],
  776. "dll": "OLEAUT32.dll"
  777. },
  778. {
  779. "imports": [
  780. {
  781. "name": "DsGetDcNameW",
  782. "address": "0x14005f4e8"
  783. },
  784. {
  785. "name": "NetShareSetInfo",
  786. "address": "0x14005f4f0"
  787. },
  788. {
  789. "name": "NetApiBufferFree",
  790. "address": "0x14005f4f8"
  791. },
  792. {
  793. "name": "NetDfsGetClientInfo",
  794. "address": "0x14005f500"
  795. },
  796. {
  797. "name": "NetShareGetInfo",
  798. "address": "0x14005f508"
  799. }
  800. ],
  801. "dll": "NETAPI32.dll"
  802. },
  803. {
  804. "imports": [
  805. {
  806. "name": "WNetCloseEnum",
  807. "address": "0x14005f4c8"
  808. },
  809. {
  810. "name": "WNetEnumResourceW",
  811. "address": "0x14005f4d0"
  812. },
  813. {
  814. "name": "WNetOpenEnumW",
  815. "address": "0x14005f4d8"
  816. }
  817. ],
  818. "dll": "MPR.dll"
  819. }
  820. ],
  821. "digital_signers": null,
  822. "exported_dll_name": null,
  823. "actual_checksum": "0x000927e2",
  824. "overlay": {
  825. "size": "0x000017a8",
  826. "offset": "0x00087200"
  827. },
  828. "imagebase": "0x140000000",
  829. "reported_checksum": "0x000927e2",
  830. "icon_hash": null,
  831. "entrypoint": "0x140041638",
  832. "timestamp": "2012-09-10 20:23:45",
  833. "osversion": "5.2",
  834. "sections": [
  835. {
  836. "name": ".text",
  837. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  838. "virtual_address": "0x00001000",
  839. "size_of_data": "0x0005da00",
  840. "entropy": "6.31",
  841. "raw_address": "0x00000400",
  842. "virtual_size": "0x0005d982",
  843. "characteristics_raw": "0x60000020"
  844. },
  845. {
  846. "name": ".rdata",
  847. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  848. "virtual_address": "0x0005f000",
  849. "size_of_data": "0x00020200",
  850. "entropy": "4.55",
  851. "raw_address": "0x0005de00",
  852. "virtual_size": "0x0002011a",
  853. "characteristics_raw": "0x40000040"
  854. },
  855. {
  856. "name": ".data",
  857. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  858. "virtual_address": "0x00080000",
  859. "size_of_data": "0x00002c00",
  860. "entropy": "3.98",
  861. "raw_address": "0x0007e000",
  862. "virtual_size": "0x000054b0",
  863. "characteristics_raw": "0xc0000040"
  864. },
  865. {
  866. "name": ".pdata",
  867. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  868. "virtual_address": "0x00086000",
  869. "size_of_data": "0x00004000",
  870. "entropy": "5.75",
  871. "raw_address": "0x00080c00",
  872. "virtual_size": "0x00003e7c",
  873. "characteristics_raw": "0x40000040"
  874. },
  875. {
  876. "name": ".rsrc",
  877. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  878. "virtual_address": "0x0008a000",
  879. "size_of_data": "0x00001400",
  880. "entropy": "3.77",
  881. "raw_address": "0x00084c00",
  882. "virtual_size": "0x00001360",
  883. "characteristics_raw": "0x40000040"
  884. },
  885. {
  886. "name": ".reloc",
  887. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  888. "virtual_address": "0x0008c000",
  889. "size_of_data": "0x00001200",
  890. "entropy": "2.78",
  891. "raw_address": "0x00086000",
  892. "virtual_size": "0x00001130",
  893. "characteristics_raw": "0x42000040"
  894. }
  895. ],
  896. "resources": [],
  897. "dirents": [
  898. {
  899. "virtual_address": "0x00000000",
  900. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  901. "size": "0x00000000"
  902. },
  903. {
  904. "virtual_address": "0x0007dd74",
  905. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  906. "size": "0x000000dc"
  907. },
  908. {
  909. "virtual_address": "0x0008a000",
  910. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  911. "size": "0x00001360"
  912. },
  913. {
  914. "virtual_address": "0x00086000",
  915. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  916. "size": "0x00003e7c"
  917. },
  918. {
  919. "virtual_address": "0x00087200",
  920. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  921. "size": "0x000017a8"
  922. },
  923. {
  924. "virtual_address": "0x0008c000",
  925. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  926. "size": "0x0000069c"
  927. },
  928. {
  929. "virtual_address": "0x0005f6c0",
  930. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  931. "size": "0x0000001c"
  932. },
  933. {
  934. "virtual_address": "0x00000000",
  935. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  936. "size": "0x00000000"
  937. },
  938. {
  939. "virtual_address": "0x00000000",
  940. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  941. "size": "0x00000000"
  942. },
  943. {
  944. "virtual_address": "0x00000000",
  945. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  946. "size": "0x00000000"
  947. },
  948. {
  949. "virtual_address": "0x00000000",
  950. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  951. "size": "0x00000000"
  952. },
  953. {
  954. "virtual_address": "0x00000000",
  955. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  956. "size": "0x00000000"
  957. },
  958. {
  959. "virtual_address": "0x0005f000",
  960. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  961. "size": "0x000005e8"
  962. },
  963. {
  964. "virtual_address": "0x00000000",
  965. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  966. "size": "0x00000000"
  967. },
  968. {
  969. "virtual_address": "0x00000000",
  970. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  971. "size": "0x00000000"
  972. },
  973. {
  974. "virtual_address": "0x00000000",
  975. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  976. "size": "0x00000000"
  977. }
  978. ],
  979. "exports": [],
  980. "guest_signers": {},
  981. "imphash": "8ba0fb5dc3f82d59312179b110e138fe",
  982. "icon_fuzzy": null,
  983. "icon": null,
  984. "pdbpath": "D:\\Daten\\Helge\\Programmierung\\SetACL3\\Source\\SetACL.exe\\x64\\Release\\SetACL.pdb",
  985. "imported_dll_count": 10,
  986. "versioninfo": []
  987. }
  988. }
  989.  
  990. [*] Resolved APIs: []
  991.  
  992. [*] Static Analysis: {
  993. "pe": {
  994. "peid_signatures": null,
  995. "imports": [
  996. {
  997. "imports": [
  998. {
  999. "name": "GetUserNameExW",
  1000. "address": "0x14005f580"
  1001. }
  1002. ],
  1003. "dll": "Secur32.dll"
  1004. },
  1005. {
  1006. "imports": [
  1007. {
  1008. "name": "VerQueryValueW",
  1009. "address": "0x14005f5a0"
  1010. }
  1011. ],
  1012. "dll": "VERSION.dll"
  1013. },
  1014. {
  1015. "imports": [
  1016. {
  1017. "name": null,
  1018. "address": "0x14005f000"
  1019. }
  1020. ],
  1021. "dll": "ACTIVEDS.dll"
  1022. },
  1023. {
  1024. "imports": [
  1025. {
  1026. "name": "CreateFileW",
  1027. "address": "0x14005f178"
  1028. },
  1029. {
  1030. "name": "WideCharToMultiByte",
  1031. "address": "0x14005f180"
  1032. },
  1033. {
  1034. "name": "MultiByteToWideChar",
  1035. "address": "0x14005f188"
  1036. },
  1037. {
  1038. "name": "GetStringTypeW",
  1039. "address": "0x14005f190"
  1040. },
  1041. {
  1042. "name": "EncodePointer",
  1043. "address": "0x14005f198"
  1044. },
  1045. {
  1046. "name": "DecodePointer",
  1047. "address": "0x14005f1a0"
  1048. },
  1049. {
  1050. "name": "Sleep",
  1051. "address": "0x14005f1a8"
  1052. },
  1053. {
  1054. "name": "GetCommandLineW",
  1055. "address": "0x14005f1b0"
  1056. },
  1057. {
  1058. "name": "RtlLookupFunctionEntry",
  1059. "address": "0x14005f1b8"
  1060. },
  1061. {
  1062. "name": "RtlUnwindEx",
  1063. "address": "0x14005f1c0"
  1064. },
  1065. {
  1066. "name": "RaiseException",
  1067. "address": "0x14005f1c8"
  1068. },
  1069. {
  1070. "name": "RtlPcToFileHeader",
  1071. "address": "0x14005f1d0"
  1072. },
  1073. {
  1074. "name": "GetCPInfo",
  1075. "address": "0x14005f1d8"
  1076. },
  1077. {
  1078. "name": "LCMapStringW",
  1079. "address": "0x14005f1e0"
  1080. },
  1081. {
  1082. "name": "TerminateProcess",
  1083. "address": "0x14005f1e8"
  1084. },
  1085. {
  1086. "name": "UnhandledExceptionFilter",
  1087. "address": "0x14005f1f0"
  1088. },
  1089. {
  1090. "name": "SetUnhandledExceptionFilter",
  1091. "address": "0x14005f1f8"
  1092. },
  1093. {
  1094. "name": "IsDebuggerPresent",
  1095. "address": "0x14005f200"
  1096. },
  1097. {
  1098. "name": "RtlVirtualUnwind",
  1099. "address": "0x14005f208"
  1100. },
  1101. {
  1102. "name": "RtlCaptureContext",
  1103. "address": "0x14005f210"
  1104. },
  1105. {
  1106. "name": "InitializeCriticalSectionAndSpinCount",
  1107. "address": "0x14005f218"
  1108. },
  1109. {
  1110. "name": "FlsGetValue",
  1111. "address": "0x14005f220"
  1112. },
  1113. {
  1114. "name": "FlsSetValue",
  1115. "address": "0x14005f228"
  1116. },
  1117. {
  1118. "name": "FlsFree",
  1119. "address": "0x14005f230"
  1120. },
  1121. {
  1122. "name": "SetLastError",
  1123. "address": "0x14005f238"
  1124. },
  1125. {
  1126. "name": "FindClose",
  1127. "address": "0x14005f240"
  1128. },
  1129. {
  1130. "name": "HeapSetInformation",
  1131. "address": "0x14005f248"
  1132. },
  1133. {
  1134. "name": "GetVersion",
  1135. "address": "0x14005f250"
  1136. },
  1137. {
  1138. "name": "HeapCreate",
  1139. "address": "0x14005f258"
  1140. },
  1141. {
  1142. "name": "GetStdHandle",
  1143. "address": "0x14005f260"
  1144. },
  1145. {
  1146. "name": "GetLocaleInfoW",
  1147. "address": "0x14005f268"
  1148. },
  1149. {
  1150. "name": "ExitProcess",
  1151. "address": "0x14005f270"
  1152. },
  1153. {
  1154. "name": "FreeEnvironmentStringsW",
  1155. "address": "0x14005f278"
  1156. },
  1157. {
  1158. "name": "GetEnvironmentStringsW",
  1159. "address": "0x14005f280"
  1160. },
  1161. {
  1162. "name": "SetHandleCount",
  1163. "address": "0x14005f288"
  1164. },
  1165. {
  1166. "name": "GetFileType",
  1167. "address": "0x14005f290"
  1168. },
  1169. {
  1170. "name": "GetStartupInfoW",
  1171. "address": "0x14005f298"
  1172. },
  1173. {
  1174. "name": "QueryPerformanceCounter",
  1175. "address": "0x14005f2a0"
  1176. },
  1177. {
  1178. "name": "GetTickCount",
  1179. "address": "0x14005f2a8"
  1180. },
  1181. {
  1182. "name": "GetCurrentProcessId",
  1183. "address": "0x14005f2b0"
  1184. },
  1185. {
  1186. "name": "GetSystemTimeAsFileTime",
  1187. "address": "0x14005f2b8"
  1188. },
  1189. {
  1190. "name": "HeapSize",
  1191. "address": "0x14005f2c0"
  1192. },
  1193. {
  1194. "name": "GetACP",
  1195. "address": "0x14005f2c8"
  1196. },
  1197. {
  1198. "name": "GetOEMCP",
  1199. "address": "0x14005f2d0"
  1200. },
  1201. {
  1202. "name": "IsValidCodePage",
  1203. "address": "0x14005f2d8"
  1204. },
  1205. {
  1206. "name": "GetUserDefaultLCID",
  1207. "address": "0x14005f2e0"
  1208. },
  1209. {
  1210. "name": "GetLocaleInfoA",
  1211. "address": "0x14005f2e8"
  1212. },
  1213. {
  1214. "name": "EnumSystemLocalesA",
  1215. "address": "0x14005f2f0"
  1216. },
  1217. {
  1218. "name": "IsValidLocale",
  1219. "address": "0x14005f2f8"
  1220. },
  1221. {
  1222. "name": "HeapReAlloc",
  1223. "address": "0x14005f300"
  1224. },
  1225. {
  1226. "name": "CompareStringW",
  1227. "address": "0x14005f308"
  1228. },
  1229. {
  1230. "name": "SetEnvironmentVariableW",
  1231. "address": "0x14005f310"
  1232. },
  1233. {
  1234. "name": "SetFilePointer",
  1235. "address": "0x14005f318"
  1236. },
  1237. {
  1238. "name": "GetConsoleCP",
  1239. "address": "0x14005f320"
  1240. },
  1241. {
  1242. "name": "GetConsoleMode",
  1243. "address": "0x14005f328"
  1244. },
  1245. {
  1246. "name": "FlushFileBuffers",
  1247. "address": "0x14005f330"
  1248. },
  1249. {
  1250. "name": "SetStdHandle",
  1251. "address": "0x14005f338"
  1252. },
  1253. {
  1254. "name": "WriteConsoleW",
  1255. "address": "0x14005f340"
  1256. },
  1257. {
  1258. "name": "SetEndOfFile",
  1259. "address": "0x14005f348"
  1260. },
  1261. {
  1262. "name": "ReadFile",
  1263. "address": "0x14005f350"
  1264. },
  1265. {
  1266. "name": "FindFirstFileW",
  1267. "address": "0x14005f358"
  1268. },
  1269. {
  1270. "name": "SetEvent",
  1271. "address": "0x14005f360"
  1272. },
  1273. {
  1274. "name": "ResetEvent",
  1275. "address": "0x14005f368"
  1276. },
  1277. {
  1278. "name": "ReleaseMutex",
  1279. "address": "0x14005f370"
  1280. },
  1281. {
  1282. "name": "CreateEventW",
  1283. "address": "0x14005f378"
  1284. },
  1285. {
  1286. "name": "CreateMutexW",
  1287. "address": "0x14005f380"
  1288. },
  1289. {
  1290. "name": "FindNextFileW",
  1291. "address": "0x14005f388"
  1292. },
  1293. {
  1294. "name": "MoveFileExW",
  1295. "address": "0x14005f390"
  1296. },
  1297. {
  1298. "name": "WriteFile",
  1299. "address": "0x14005f398"
  1300. },
  1301. {
  1302. "name": "SetFilePointerEx",
  1303. "address": "0x14005f3a0"
  1304. },
  1305. {
  1306. "name": "GetFileSizeEx",
  1307. "address": "0x14005f3a8"
  1308. },
  1309. {
  1310. "name": "GetCurrentThreadId",
  1311. "address": "0x14005f3b0"
  1312. },
  1313. {
  1314. "name": "GetLocalTime",
  1315. "address": "0x14005f3b8"
  1316. },
  1317. {
  1318. "name": "WaitForSingleObject",
  1319. "address": "0x14005f3c0"
  1320. },
  1321. {
  1322. "name": "CreateThread",
  1323. "address": "0x14005f3c8"
  1324. },
  1325. {
  1326. "name": "CompareFileTime",
  1327. "address": "0x14005f3d0"
  1328. },
  1329. {
  1330. "name": "LeaveCriticalSection",
  1331. "address": "0x14005f3d8"
  1332. },
  1333. {
  1334. "name": "EnterCriticalSection",
  1335. "address": "0x14005f3e0"
  1336. },
  1337. {
  1338. "name": "DeleteCriticalSection",
  1339. "address": "0x14005f3e8"
  1340. },
  1341. {
  1342. "name": "InitializeCriticalSection",
  1343. "address": "0x14005f3f0"
  1344. },
  1345. {
  1346. "name": "FreeLibrary",
  1347. "address": "0x14005f3f8"
  1348. },
  1349. {
  1350. "name": "LocalFree",
  1351. "address": "0x14005f400"
  1352. },
  1353. {
  1354. "name": "FormatMessageW",
  1355. "address": "0x14005f408"
  1356. },
  1357. {
  1358. "name": "LoadLibraryExW",
  1359. "address": "0x14005f410"
  1360. },
  1361. {
  1362. "name": "LoadLibraryW",
  1363. "address": "0x14005f418"
  1364. },
  1365. {
  1366. "name": "GetModuleFileNameW",
  1367. "address": "0x14005f420"
  1368. },
  1369. {
  1370. "name": "GetVersionExW",
  1371. "address": "0x14005f428"
  1372. },
  1373. {
  1374. "name": "GetComputerNameW",
  1375. "address": "0x14005f430"
  1376. },
  1377. {
  1378. "name": "FreeResource",
  1379. "address": "0x14005f438"
  1380. },
  1381. {
  1382. "name": "GetUserDefaultLangID",
  1383. "address": "0x14005f440"
  1384. },
  1385. {
  1386. "name": "LockResource",
  1387. "address": "0x14005f448"
  1388. },
  1389. {
  1390. "name": "LoadResource",
  1391. "address": "0x14005f450"
  1392. },
  1393. {
  1394. "name": "FindResourceW",
  1395. "address": "0x14005f458"
  1396. },
  1397. {
  1398. "name": "HeapFree",
  1399. "address": "0x14005f460"
  1400. },
  1401. {
  1402. "name": "GetProcessHeap",
  1403. "address": "0x14005f468"
  1404. },
  1405. {
  1406. "name": "HeapAlloc",
  1407. "address": "0x14005f470"
  1408. },
  1409. {
  1410. "name": "CloseHandle",
  1411. "address": "0x14005f478"
  1412. },
  1413. {
  1414. "name": "GetCurrentProcess",
  1415. "address": "0x14005f480"
  1416. },
  1417. {
  1418. "name": "GetProcAddress",
  1419. "address": "0x14005f488"
  1420. },
  1421. {
  1422. "name": "GetLastError",
  1423. "address": "0x14005f490"
  1424. },
  1425. {
  1426. "name": "GetModuleHandleW",
  1427. "address": "0x14005f498"
  1428. },
  1429. {
  1430. "name": "FlsAlloc",
  1431. "address": "0x14005f4a0"
  1432. },
  1433. {
  1434. "name": "CreateDirectoryW",
  1435. "address": "0x14005f4a8"
  1436. },
  1437. {
  1438. "name": "GetFileAttributesW",
  1439. "address": "0x14005f4b0"
  1440. },
  1441. {
  1442. "name": "DeleteFileW",
  1443. "address": "0x14005f4b8"
  1444. }
  1445. ],
  1446. "dll": "KERNEL32.dll"
  1447. },
  1448. {
  1449. "imports": [
  1450. {
  1451. "name": "LoadStringW",
  1452. "address": "0x14005f590"
  1453. }
  1454. ],
  1455. "dll": "USER32.dll"
  1456. },
  1457. {
  1458. "imports": [
  1459. {
  1460. "name": "LookupAccountNameW",
  1461. "address": "0x14005f010"
  1462. },
  1463. {
  1464. "name": "ConvertSidToStringSidW",
  1465. "address": "0x14005f018"
  1466. },
  1467. {
  1468. "name": "LookupAccountSidW",
  1469. "address": "0x14005f020"
  1470. },
  1471. {
  1472. "name": "MapGenericMask",
  1473. "address": "0x14005f028"
  1474. },
  1475. {
  1476. "name": "GetSecurityDescriptorLength",
  1477. "address": "0x14005f030"
  1478. },
  1479. {
  1480. "name": "AddAccessAllowedAce",
  1481. "address": "0x14005f038"
  1482. },
  1483. {
  1484. "name": "AddAce",
  1485. "address": "0x14005f040"
  1486. },
  1487. {
  1488. "name": "InitializeAcl",
  1489. "address": "0x14005f048"
  1490. },
  1491. {
  1492. "name": "IsValidAcl",
  1493. "address": "0x14005f050"
  1494. },
  1495. {
  1496. "name": "DeleteAce",
  1497. "address": "0x14005f058"
  1498. },
  1499. {
  1500. "name": "MakeSelfRelativeSD",
  1501. "address": "0x14005f060"
  1502. },
  1503. {
  1504. "name": "SetSecurityDescriptorSacl",
  1505. "address": "0x14005f068"
  1506. },
  1507. {
  1508. "name": "SetSecurityDescriptorDacl",
  1509. "address": "0x14005f070"
  1510. },
  1511. {
  1512. "name": "SetSecurityDescriptorGroup",
  1513. "address": "0x14005f078"
  1514. },
  1515. {
  1516. "name": "SetSecurityDescriptorOwner",
  1517. "address": "0x14005f080"
  1518. },
  1519. {
  1520. "name": "SetNamedSecurityInfoW",
  1521. "address": "0x14005f088"
  1522. },
  1523. {
  1524. "name": "SetSecurityInfo",
  1525. "address": "0x14005f090"
  1526. },
  1527. {
  1528. "name": "IsValidSecurityDescriptor",
  1529. "address": "0x14005f098"
  1530. },
  1531. {
  1532. "name": "GetNamedSecurityInfoW",
  1533. "address": "0x14005f0a0"
  1534. },
  1535. {
  1536. "name": "GetKernelObjectSecurity",
  1537. "address": "0x14005f0a8"
  1538. },
  1539. {
  1540. "name": "ConvertStringSidToSidW",
  1541. "address": "0x14005f0b0"
  1542. },
  1543. {
  1544. "name": "EqualSid",
  1545. "address": "0x14005f0b8"
  1546. },
  1547. {
  1548. "name": "GetAce",
  1549. "address": "0x14005f0c0"
  1550. },
  1551. {
  1552. "name": "GetAclInformation",
  1553. "address": "0x14005f0c8"
  1554. },
  1555. {
  1556. "name": "ConvertSecurityDescriptorToStringSecurityDescriptorW",
  1557. "address": "0x14005f0d0"
  1558. },
  1559. {
  1560. "name": "GetSecurityDescriptorControl",
  1561. "address": "0x14005f0d8"
  1562. },
  1563. {
  1564. "name": "SetEntriesInAclW",
  1565. "address": "0x14005f0e0"
  1566. },
  1567. {
  1568. "name": "RegCreateKeyExW",
  1569. "address": "0x14005f0e8"
  1570. },
  1571. {
  1572. "name": "MakeAbsoluteSD",
  1573. "address": "0x14005f0f0"
  1574. },
  1575. {
  1576. "name": "ConvertStringSecurityDescriptorToSecurityDescriptorW",
  1577. "address": "0x14005f0f8"
  1578. },
  1579. {
  1580. "name": "ReportEventW",
  1581. "address": "0x14005f100"
  1582. },
  1583. {
  1584. "name": "DeregisterEventSource",
  1585. "address": "0x14005f108"
  1586. },
  1587. {
  1588. "name": "RegisterEventSourceW",
  1589. "address": "0x14005f110"
  1590. },
  1591. {
  1592. "name": "RegCloseKey",
  1593. "address": "0x14005f118"
  1594. },
  1595. {
  1596. "name": "RegOpenKeyExW",
  1597. "address": "0x14005f120"
  1598. },
  1599. {
  1600. "name": "RegConnectRegistryW",
  1601. "address": "0x14005f128"
  1602. },
  1603. {
  1604. "name": "RegEnumKeyExW",
  1605. "address": "0x14005f130"
  1606. },
  1607. {
  1608. "name": "CopySid",
  1609. "address": "0x14005f138"
  1610. },
  1611. {
  1612. "name": "GetLengthSid",
  1613. "address": "0x14005f140"
  1614. },
  1615. {
  1616. "name": "IsValidSid",
  1617. "address": "0x14005f148"
  1618. },
  1619. {
  1620. "name": "GetTokenInformation",
  1621. "address": "0x14005f150"
  1622. },
  1623. {
  1624. "name": "AdjustTokenPrivileges",
  1625. "address": "0x14005f158"
  1626. },
  1627. {
  1628. "name": "LookupPrivilegeValueW",
  1629. "address": "0x14005f160"
  1630. },
  1631. {
  1632. "name": "OpenProcessToken",
  1633. "address": "0x14005f168"
  1634. }
  1635. ],
  1636. "dll": "ADVAPI32.dll"
  1637. },
  1638. {
  1639. "imports": [
  1640. {
  1641. "name": "CoCreateInstance",
  1642. "address": "0x14005f5b0"
  1643. },
  1644. {
  1645. "name": "CoInitialize",
  1646. "address": "0x14005f5b8"
  1647. },
  1648. {
  1649. "name": "CoInitializeSecurity",
  1650. "address": "0x14005f5c0"
  1651. },
  1652. {
  1653. "name": "CoUninitialize",
  1654. "address": "0x14005f5c8"
  1655. },
  1656. {
  1657. "name": "CoSetProxyBlanket",
  1658. "address": "0x14005f5d0"
  1659. },
  1660. {
  1661. "name": "CoQueryProxyBlanket",
  1662. "address": "0x14005f5d8"
  1663. }
  1664. ],
  1665. "dll": "ole32.dll"
  1666. },
  1667. {
  1668. "imports": [
  1669. {
  1670. "name": "SysAllocStringLen",
  1671. "address": "0x14005f518"
  1672. },
  1673. {
  1674. "name": "SafeArrayGetUBound",
  1675. "address": "0x14005f520"
  1676. },
  1677. {
  1678. "name": "SafeArrayGetLBound",
  1679. "address": "0x14005f528"
  1680. },
  1681. {
  1682. "name": "VariantClear",
  1683. "address": "0x14005f530"
  1684. },
  1685. {
  1686. "name": "VariantInit",
  1687. "address": "0x14005f538"
  1688. },
  1689. {
  1690. "name": "SysStringByteLen",
  1691. "address": "0x14005f540"
  1692. },
  1693. {
  1694. "name": "SafeArrayUnaccessData",
  1695. "address": "0x14005f548"
  1696. },
  1697. {
  1698. "name": "SafeArrayAccessData",
  1699. "address": "0x14005f550"
  1700. },
  1701. {
  1702. "name": "SafeArrayCreate",
  1703. "address": "0x14005f558"
  1704. },
  1705. {
  1706. "name": "SysAllocString",
  1707. "address": "0x14005f560"
  1708. },
  1709. {
  1710. "name": "SysFreeString",
  1711. "address": "0x14005f568"
  1712. },
  1713. {
  1714. "name": "SysAllocStringByteLen",
  1715. "address": "0x14005f570"
  1716. }
  1717. ],
  1718. "dll": "OLEAUT32.dll"
  1719. },
  1720. {
  1721. "imports": [
  1722. {
  1723. "name": "DsGetDcNameW",
  1724. "address": "0x14005f4e8"
  1725. },
  1726. {
  1727. "name": "NetShareSetInfo",
  1728. "address": "0x14005f4f0"
  1729. },
  1730. {
  1731. "name": "NetApiBufferFree",
  1732. "address": "0x14005f4f8"
  1733. },
  1734. {
  1735. "name": "NetDfsGetClientInfo",
  1736. "address": "0x14005f500"
  1737. },
  1738. {
  1739. "name": "NetShareGetInfo",
  1740. "address": "0x14005f508"
  1741. }
  1742. ],
  1743. "dll": "NETAPI32.dll"
  1744. },
  1745. {
  1746. "imports": [
  1747. {
  1748. "name": "WNetCloseEnum",
  1749. "address": "0x14005f4c8"
  1750. },
  1751. {
  1752. "name": "WNetEnumResourceW",
  1753. "address": "0x14005f4d0"
  1754. },
  1755. {
  1756. "name": "WNetOpenEnumW",
  1757. "address": "0x14005f4d8"
  1758. }
  1759. ],
  1760. "dll": "MPR.dll"
  1761. }
  1762. ],
  1763. "digital_signers": null,
  1764. "exported_dll_name": null,
  1765. "actual_checksum": "0x000927e2",
  1766. "overlay": {
  1767. "size": "0x000017a8",
  1768. "offset": "0x00087200"
  1769. },
  1770. "imagebase": "0x140000000",
  1771. "reported_checksum": "0x000927e2",
  1772. "icon_hash": null,
  1773. "entrypoint": "0x140041638",
  1774. "timestamp": "2012-09-10 20:23:45",
  1775. "osversion": "5.2",
  1776. "sections": [
  1777. {
  1778. "name": ".text",
  1779. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1780. "virtual_address": "0x00001000",
  1781. "size_of_data": "0x0005da00",
  1782. "entropy": "6.31",
  1783. "raw_address": "0x00000400",
  1784. "virtual_size": "0x0005d982",
  1785. "characteristics_raw": "0x60000020"
  1786. },
  1787. {
  1788. "name": ".rdata",
  1789. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1790. "virtual_address": "0x0005f000",
  1791. "size_of_data": "0x00020200",
  1792. "entropy": "4.55",
  1793. "raw_address": "0x0005de00",
  1794. "virtual_size": "0x0002011a",
  1795. "characteristics_raw": "0x40000040"
  1796. },
  1797. {
  1798. "name": ".data",
  1799. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1800. "virtual_address": "0x00080000",
  1801. "size_of_data": "0x00002c00",
  1802. "entropy": "3.98",
  1803. "raw_address": "0x0007e000",
  1804. "virtual_size": "0x000054b0",
  1805. "characteristics_raw": "0xc0000040"
  1806. },
  1807. {
  1808. "name": ".pdata",
  1809. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1810. "virtual_address": "0x00086000",
  1811. "size_of_data": "0x00004000",
  1812. "entropy": "5.75",
  1813. "raw_address": "0x00080c00",
  1814. "virtual_size": "0x00003e7c",
  1815. "characteristics_raw": "0x40000040"
  1816. },
  1817. {
  1818. "name": ".rsrc",
  1819. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1820. "virtual_address": "0x0008a000",
  1821. "size_of_data": "0x00001400",
  1822. "entropy": "3.77",
  1823. "raw_address": "0x00084c00",
  1824. "virtual_size": "0x00001360",
  1825. "characteristics_raw": "0x40000040"
  1826. },
  1827. {
  1828. "name": ".reloc",
  1829. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1830. "virtual_address": "0x0008c000",
  1831. "size_of_data": "0x00001200",
  1832. "entropy": "2.78",
  1833. "raw_address": "0x00086000",
  1834. "virtual_size": "0x00001130",
  1835. "characteristics_raw": "0x42000040"
  1836. }
  1837. ],
  1838. "resources": [],
  1839. "dirents": [
  1840. {
  1841. "virtual_address": "0x00000000",
  1842. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1843. "size": "0x00000000"
  1844. },
  1845. {
  1846. "virtual_address": "0x0007dd74",
  1847. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1848. "size": "0x000000dc"
  1849. },
  1850. {
  1851. "virtual_address": "0x0008a000",
  1852. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1853. "size": "0x00001360"
  1854. },
  1855. {
  1856. "virtual_address": "0x00086000",
  1857. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1858. "size": "0x00003e7c"
  1859. },
  1860. {
  1861. "virtual_address": "0x00087200",
  1862. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1863. "size": "0x000017a8"
  1864. },
  1865. {
  1866. "virtual_address": "0x0008c000",
  1867. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1868. "size": "0x0000069c"
  1869. },
  1870. {
  1871. "virtual_address": "0x0005f6c0",
  1872. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1873. "size": "0x0000001c"
  1874. },
  1875. {
  1876. "virtual_address": "0x00000000",
  1877. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1878. "size": "0x00000000"
  1879. },
  1880. {
  1881. "virtual_address": "0x00000000",
  1882. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1883. "size": "0x00000000"
  1884. },
  1885. {
  1886. "virtual_address": "0x00000000",
  1887. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1888. "size": "0x00000000"
  1889. },
  1890. {
  1891. "virtual_address": "0x00000000",
  1892. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1893. "size": "0x00000000"
  1894. },
  1895. {
  1896. "virtual_address": "0x00000000",
  1897. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1898. "size": "0x00000000"
  1899. },
  1900. {
  1901. "virtual_address": "0x0005f000",
  1902. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1903. "size": "0x000005e8"
  1904. },
  1905. {
  1906. "virtual_address": "0x00000000",
  1907. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1908. "size": "0x00000000"
  1909. },
  1910. {
  1911. "virtual_address": "0x00000000",
  1912. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1913. "size": "0x00000000"
  1914. },
  1915. {
  1916. "virtual_address": "0x00000000",
  1917. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1918. "size": "0x00000000"
  1919. }
  1920. ],
  1921. "exports": [],
  1922. "guest_signers": {},
  1923. "imphash": "8ba0fb5dc3f82d59312179b110e138fe",
  1924. "icon_fuzzy": null,
  1925. "icon": null,
  1926. "pdbpath": "D:\\Daten\\Helge\\Programmierung\\SetACL3\\Source\\SetACL.exe\\x64\\Release\\SetACL.pdb",
  1927. "imported_dll_count": 10,
  1928. "versioninfo": []
  1929. }
  1930. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!