VMRuntime
Overview
overview
3Static
static
3Anonymous.exe
windows7-x64
3Anonymous.exe
windows10-2004-x64
3DrakeUI.Framework.dll
windows7-x64
1DrakeUI.Framework.dll
windows10-2004-x64
1HVMRun64.dll
windows7-x64
1HVMRun64.dll
windows10-2004-x64
1HVMRuntm.dll
windows7-x64
1HVMRuntm.dll
windows10-2004-x64
1MetroSet UI.dll
windows7-x64
1MetroSet UI.dll
windows10-2004-x64
1NAudio.dll
windows7-x64
1NAudio.dll
windows10-2004-x64
1Newtonsoft.Json.dll
windows7-x64
1Newtonsoft.Json.dll
windows10-2004-x64
1WinMM.Net.dll
windows7-x64
1WinMM.Net.dll
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
Anonymous.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Anonymous.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
DrakeUI.Framework.dll
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
DrakeUI.Framework.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
HVMRun64.dll
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
HVMRun64.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral7
Sample
HVMRuntm.dll
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
HVMRuntm.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral9
Sample
MetroSet UI.dll
Resource
win7-20230831-en
Behavioral task
behavioral10
Sample
MetroSet UI.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral11
Sample
NAudio.dll
Resource
win7-20230831-en
Behavioral task
behavioral12
Sample
NAudio.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral13
Sample
Newtonsoft.Json.dll
Resource
win7-20230831-en
Behavioral task
behavioral14
Sample
Newtonsoft.Json.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral15
Sample
WinMM.Net.dll
Resource
win7-20230831-en
Behavioral task
behavioral16
Sample
WinMM.Net.dll
Resource
win10v2004-20230915-en
General
-
Target
Debug.zip
-
Size
52.4MB
-
MD5
cd84cbf6b7fda035aa03297c8ca74ae5
-
SHA1
0aaa2d7ae9334a64a4ffb27ada1447901a1e8b69
-
SHA256
3fcca48445101de1f0422849983773c062975ef8f8ccecca82931fb3d7a00503
-
SHA512
e50efad7a96a2b814b4919a4d6d92617733db143a2e48510c99e96c58420719418d2eaf885f88f21bbbf7737b59e45ff0d2bc98a0d2626ee4c912a48adb979da
-
SSDEEP
786432:zRKF6NmZ+a+8adpB5hTfHGiurhvtAwyfYK3VaCdgOYhLDp7VLI6EsgOKv0ouN:vNMKp5fH6hawyQK3DgxXpZLysW03N
Malware Config
Signatures
-
Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
resource unpack001/Anonymous.exe unpack001/DrakeUI.Framework.dll unpack001/HVMRun64.dll unpack001/HVMRuntm.dll unpack001/MetroSet UI.dll unpack001/NAudio.dll unpack001/WinMM.Net.dll
Files
-
Debug.zip.zip
-
Anonymous.exe.exe windows:4 windows x86
32c5de998b5f069b26c94c8143b13c06
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
kernel32
GetModuleFileNameW
user32
GetWindow
advapi32
RegDeleteKeyA
shell32
SHGetFolderPathW
Sections
.text Size: 45.4MB - Virtual size: 45.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 773KB - Virtual size: 776KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
DrakeUI.Framework.dll.dll windows:4 windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
HVMRun64.dll.dll windows:4 windows x64
2843de49dbfe3d6c40e1db4b51e9fa5e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentProcess
GetModuleFileNameA
__C_specific_handler
ReadFile
CloseHandle
CreateFileA
InitializeCriticalSection
GetModuleHandleA
IsBadReadPtr
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryA
WaitForSingleObject
GetCurrentThreadId
GetTickCount
CreateEventA
DisableThreadLibraryCalls
lstrcatA
VirtualProtect
lstrlenA
Sleep
SetEvent
GetVolumeInformationA
GetWindowsDirectoryA
GetCurrentProcessId
MultiByteToWideChar
GetLastError
CompareStringA
CompareStringW
HeapFree
GetProcessHeap
SetFilePointer
QueryPerformanceCounter
GetEnvironmentStringsW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
VirtualQuery
LeaveCriticalSection
EnterCriticalSection
SetEnvironmentVariableA
DeleteCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetConsoleMode
GetConsoleCP
HeapCreate
HeapSetInformation
SetStdHandle
WriteFile
IsValidCodePage
GetOEMCP
GetCPInfo
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetTimeZoneInformation
RtlVirtualUnwind
FlsAlloc
TlsSetValue
SetLastError
FlsFree
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
FlushFileBuffers
HeapDestroy
HeapAlloc
HeapReAlloc
HeapSize
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
GetSystemTimeAsFileTime
ExitThread
ResumeThread
CreateThread
ExitProcess
FlsSetValue
GetCommandLineA
FlsGetValue
TlsFree
user32
MessageBoxA
UnregisterClassA
wsprintfA
advapi32
RegQueryValueExA
RegCreateKeyExA
RegCloseKey
RegSetValueExA
oleaut32
SysAllocString
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayDestroyDescriptor
SafeArrayCreate
VariantCopyInd
VariantChangeType
SysStringLen
SafeArrayUnlock
SafeArrayLock
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElement
SafeArrayDestroy
SafeArrayPutElement
VariantInit
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
GetErrorInfo
VariantClear
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Exports
Exports
Sections
.text Size: 353KB - Virtual size: 352KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 115KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hvm0 Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1014B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
HVMRuntm.dll.dll windows:4 windows x86
b2ff0f091ba14e9fe411060ab1560c66
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentProcess
GetModuleFileNameA
ReadFile
CloseHandle
CreateFileA
InitializeCriticalSection
GetModuleHandleA
InterlockedDecrement
IsBadReadPtr
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryA
WaitForSingleObject
GetCurrentThreadId
GetTickCount
CreateEventA
DisableThreadLibraryCalls
lstrcatA
VirtualProtect
lstrlenA
Sleep
SetEvent
GetVolumeInformationA
GetWindowsDirectoryA
SetEnvironmentVariableA
GetCurrentProcessId
InterlockedExchange
MultiByteToWideChar
GetLastError
CompareStringA
CompareStringW
InterlockedIncrement
HeapFree
GetProcessHeap
SetFilePointer
QueryPerformanceCounter
GetEnvironmentStringsW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
VirtualQuery
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetStdHandle
GetConsoleMode
GetConsoleCP
HeapCreate
VirtualFree
WriteFile
IsValidCodePage
GetOEMCP
GetCPInfo
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetTimeZoneInformation
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
FlushFileBuffers
HeapDestroy
HeapAlloc
HeapReAlloc
HeapSize
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetSystemTimeAsFileTime
ExitThread
ResumeThread
CreateThread
ExitProcess
VirtualAlloc
GetCommandLineA
user32
MessageBoxA
UnregisterClassA
wsprintfA
advapi32
RegQueryValueExA
RegCreateKeyExA
RegCloseKey
RegSetValueExA
oleaut32
SysAllocString
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayDestroyDescriptor
SafeArrayCreate
VariantCopyInd
VariantChangeType
SysStringLen
SafeArrayUnlock
SafeArrayLock
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElement
SafeArrayDestroy
SafeArrayPutElement
VariantClear
VariantInit
SysFreeString
SysStringByteLen
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
GetErrorInfo
SysAllocStringByteLen
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Exports
Exports
VMRuntime
Sections
.text Size: 264KB - Virtual size: 263KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 112KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hvm0 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 1010B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
MetroSet UI.dll.dll windows:4 windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 433KB - Virtual size: 433KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
NAudio.dll.dll windows:4 windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 496KB - Virtual size: 495KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 936B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Newtonsoft.Json.dll.dll windows:4 windows x86
dae02f32a21e03ce65412f6e56942daa
Code Sign
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20Certificate
IssuerCN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=USNot Before15/01/2021, 00:00Not After14/01/2046, 23:59SubjectCN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73Certificate
IssuerCN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=USNot Before15/07/2021, 00:00Not After14/07/2031, 23:59SubjectCN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29Certificate
IssuerCN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=USNot Before13/08/2021, 00:00Not After29/10/2024, 23:59SubjectSERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6eExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate
IssuerCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USNot Before21/09/2022, 00:00Not After21/11/2033, 23:59SubjectCN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before23/03/2022, 00:00Not After22/03/2037, 23:59SubjectCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01/08/2022, 00:00Not After09/11/2031, 23:59SubjectCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9bSigner
Actual PE Digest38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9bDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 681KB - Virtual size: 680KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Newtonsoft.Json.xml.xml
-
WinMM.Net.dll.dll windows:4 windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
config.json
-
安卓远控.exe.config.xml
-
安卓远控.key
-
安卓远控.xml.xml