Oxygen-v2-main[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Oxygen-v2-main.zip
Size

22.4MB
MD5

4ebca3bad4e0a921765360f6ecc102ae
SHA1

caa3005ce988c3db74f3e251f5827c38cce2aa7a
SHA256

51bdf847ebe328917e74f3f0fc28794ce5691c974bdd29c54a3f73a35d75bc68
SHA512

f226c3d281932863a840bbe064ddb9423b59231183fa1dc635ff7a5a75ee0850511fddc05ed2af8dd516bbb31cc4b0c557f7b46057f27af14fb1b209816e81c1
SSDEEP

393216:Gq5CuDdN26VzjEUBFzhAUdeNEAFr4IBVWCiv6LICLvVFuDpq2b2Mkr2b2Mk3atU3:GqPDdNRhrBFz+8eSyrHWCg6Ljiq2K2cv

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/Oxygen-v2-main/Injector.vmp.exe	vmprotect

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Oxygen-v2-main/Injector.vmp.exe
unpack001/Oxygen-v2-main/Oxygen_API.dll
unpack001/Oxygen-v2-main/oxygen.dll
unpack001/Oxygen-v2-main/oxygen_auth.dll
unpack001/Oxygen-v2-main/oxygen_injector.dll
unpack002/oxygen_u/OxygenU.exe
unpack003/oxygen_u/OxygenU.exe

Files

Oxygen-v2-main.zip
.zip
Oxygen-v2-main/Injector.vmp.exe
.exe windows:6 windows x86 arch:x86

50ca805a824acdd145c856d5be6546cb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentDirectoryA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

msvcp140

?_Xlength_error@std@@YAXPBD@Z

shlwapi

PathAddBackslashA

vcruntime140

__std_terminate

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

wtsapi32

WTSSendMessageW

user32

GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

Sections

.text
Size: - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Oxygen-v2-main/Monaco.html
.html .js polyglot
Oxygen-v2-main/Oxygen_API.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Jack\source\repos\Oxygen API\Oxygen\obj\Release\Oxygen API.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 289KB - Virtual size: 289KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Oxygen-v2-main/changelog.txt
Oxygen-v2-main/docs.txt
Oxygen-v2-main/file.hash
Oxygen-v2-main/oxygen.dll
.dll windows:6 windows x86 arch:x86

7c8bade356a63f883c6fa6a79b6cc13d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

CryptAcquireContextA
CryptAcquireContextW
CryptCreateHash
CryptDecrypt
CryptDestroyHash
CryptDestroyKey
CryptEncrypt
CryptEnumProvidersW
CryptExportKey
CryptGenRandom
CryptGetHashParam
CryptGetProvParam
CryptGetUserKey
CryptHashData
CryptImportKey
CryptReleaseContext
CryptSetHashParam
CryptSignHashW
DeregisterEventSource
GetCurrentHwProfileA
RegisterEventSourceW
ReportEventW

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
AreFileApisANSI
CloseHandle
CompareStringW
CreateDirectoryW
CreateEventW
CreateFileA
CreateFileW
CreateThread
CreateToolhelp32Snapshot
DecodePointer
DeleteCriticalSection
DeleteFileW
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExitThread
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlushFileBuffers
FlushInstructionCache
FormatMessageA
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDriveTypeW
GetEnvironmentStringsW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetFileAttributesExW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetLocaleInfoEx
GetLocaleInfoW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryA
GetSystemTimeAsFileTime
GetThreadContext
GetTickCount64
GetTickCount
GetTimeZoneInformation
GetUserDefaultLCID
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
HeapAlloc
HeapCreate
HeapFree
HeapReAlloc
HeapSize
InitOnceBeginInitialize
InitOnceComplete
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
InitializeSRWLock
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringEx
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LocalFree
MoveFileExA
MultiByteToWideChar
OpenThread
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleA
ReadConsoleW
ReadFile
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ResetEvent
ResumeThread
RtlUnwind
SetConsoleCtrlHandler
SetConsoleMode
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFileInformationByHandle
SetFilePointerEx
SetLastError
SetStdHandle
SetThreadContext
SetUnhandledExceptionFilter
Sleep
SleepEx
SuspendThread
SystemTimeToTzSpecificLocalTime
TerminateProcess
Thread32First
Thread32Next
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
WriteFile
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

ClientToScreen
CloseClipboard
EmptyClipboard
GetClientRect
GetClipboardData
GetCursorPos
GetForegroundWindow
GetProcessWindowStation
GetUserObjectInformationW
IsChild
LoadCursorA
MessageBoxW
OpenClipboard
ScreenToClient
SetClipboardData
SetCursor
SetCursorPos
GetProcessWindowStation
GetUserObjectInformationW

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

shell32

SHGetFolderPathW

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

ws2_32

WSACleanup
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAIoctl
WSAResetEvent
WSASetLastError
WSAStartup
WSAWaitForMultipleEvents
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyaddr
gethostbyname
gethostname
getpeername
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
ioctlsocket
listen
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

crypt32

CertAddCertificateContextToStore
CertCloseStore
CertCreateCertificateChainEngine
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFindExtension
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertGetCertificateChain
CertGetCertificateContextProperty
CertGetNameStringA
CertOpenStore
CertOpenSystemStoreW
CryptDecodeObjectEx
CryptQueryObject
CryptStringToBinaryA
PFXImportCertStore

wldap32

ord301
ord45
ord22
ord32
ord26
ord30
ord35
ord143
ord200
ord41
ord33
ord27
ord50
ord211
ord60
ord217
ord46
ord79

normaliz

IdnToAscii

Exports

Exports

injector_call
setting_call

Sections

.text
Size: - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 338KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.voltbl
Size: - Virtual size: 190B

.astaghf
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.astaghf
Size: 5.3MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 223B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Oxygen-v2-main/oxygen_auth.dll
.dll windows:6 windows x86 arch:x86

048ee6e2acdf6f449ddf71b1f0a3e356

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSAIoctl

crypt32

CertFreeCertificateChain

wldap32

ord143

normaliz

IdnToAscii

kernel32

CreateFileA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

advapi32

GetCurrentHwProfileA

shell32

ShellExecuteA

msvcp140

?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ

vcruntime140

__CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

_cexit

api-ms-win-crt-string-l1-1-0

strncmp

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-stdio-l1-1-0

fread

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_access

wtsapi32

WTSSendMessageW

user32

GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

Exports

Exports

get_hwid
start_auth
verify_auth

Sections

.text
Size: - Virtual size: 329KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.auth0
Size: - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.auth1
Size: 5.6MB - Virtual size: 5.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 233B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Oxygen-v2-main/oxygen_injector.dll
.dll windows:6 windows x86 arch:x86

2029e2be23e3f835641622ba11684fa0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\iDev\Documents\54a4d5a3\injection\basic_injector\Release\oxygen_injector.pdb

Imports

kernel32

GetCurrentDirectoryA
OpenProcess
CreateToolhelp32Snapshot
GetExitCodeThread
LoadLibraryA
Process32Next
CloseHandle
GetProcAddress
VirtualAllocEx
LocalFree
ReadProcessMemory
CreateRemoteThread
Module32NextW
VirtualFreeEx
GetLastError
WaitForSingleObject
WriteProcessMemory
Module32FirstW
Process32First
AreFileApisANSI
GetFileAttributesExW
FindFirstFileW
FindClose
CreateFileW
GetLocaleInfoEx
FormatMessageA
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WideCharToMultiByte
MultiByteToWideChar
GetFileInformationByHandleEx

advapi32

SetEntriesInAclW
ConvertStringSidToSidW
GetNamedSecurityInfoA
SetNamedSecurityInfoA

msvcp140

?_Winerror_map@std@@YAHH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z

shlwapi

PathAddBackslashA

vcruntime140

__CxxFrameHandler3
__std_exception_destroy
__std_exception_copy
memmove
memset
_except_handler4_common
memcpy
_CxxThrowException
__std_type_info_destroy_list

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_register_onexit_function
_initialize_onexit_table
_configure_narrow_argv
_seh_filter_dll
_cexit
_initterm
_initterm_e
terminate
_execute_onexit_table
_invalid_parameter_noinfo_noreturn
_initialize_narrow_environment

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

Exports

Exports

_inject_dll@4
_run_script@4
_set_obs@4

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Oxygen-v2-main/oxygen_u.zip
.zip
oxygen_u/OxygenU.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\vanha\Documents\54a4d5a3\ui\OxygenU-V2-UI\OxygenURewrite\obj\Release\OxygenU.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Oxygen-v2-main/oxygen_u_lv.zip
.zip
oxygen_u/OxygenU.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\vanha\Documents\54a4d5a3\ui\OxygenU-V2-UI\OxygenURewrite\obj\Release\OxygenU.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Oxygen-v2-main/runtimes.zip
.zip
OxygenU.exe.WebView2/EBWebView/AutoLaunchProtocolsComponent/1.0.0.8/manifest.fingerprint
OxygenU.exe.WebView2/EBWebView/AutoLaunchProtocolsComponent/1.0.0.8/manifest.json
OxygenU.exe.WebView2/EBWebView/AutoLaunchProtocolsComponent/1.0.0.8/protocols.json
OxygenU.exe.WebView2/EBWebView/BrowserMetrics/BrowserMetrics-6463B5B6-2BF8.pma
OxygenU.exe.WebView2/EBWebView/BrowserMetrics/BrowserMetrics-6463B62C-6D50.pma
OxygenU.exe.WebView2/EBWebView/BrowserMetrics/BrowserMetrics-6463BEE0-1E24.pma
OxygenU.exe.WebView2/EBWebView/BrowserMetrics/BrowserMetrics-6463BFB9-7128.pma
OxygenU.exe.WebView2/EBWebView/CertificateRevocation/6498.2023.3.1/crl-set
OxygenU.exe.WebView2/EBWebView/CertificateRevocation/6498.2023.3.1/manifest.fingerprint
OxygenU.exe.WebView2/EBWebView/CertificateRevocation/6498.2023.3.1/manifest.json
OxygenU.exe.WebView2/EBWebView/Crashpad/settings.dat
OxygenU.exe.WebView2/EBWebView/Crashpad/throttle_store.dat
OxygenU.exe.WebView2/EBWebView/CrashpadMetrics-active.pma
OxygenU.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_0
OxygenU.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_1
OxygenU.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_2
OxygenU.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_3
OxygenU.exe.WebView2/EBWebView/Default/Cache/Cache_Data/index
OxygenU.exe.WebView2/EBWebView/Default/Code Cache/js/index
OxygenU.exe.WebView2/EBWebView/Default/Code Cache/js/index-dir/the-real-index
OxygenU.exe.WebView2/EBWebView/Default/Code Cache/wasm/index
OxygenU.exe.WebView2/EBWebView/Default/Code Cache/wasm/index-dir/the-real-index
OxygenU.exe.WebView2/EBWebView/Default/DawnCache/data_0
OxygenU.exe.WebView2/EBWebView/Default/DawnCache/data_1
OxygenU.exe.WebView2/EBWebView/Default/DawnCache/data_2
OxygenU.exe.WebView2/EBWebView/Default/DawnCache/data_3
OxygenU.exe.WebView2/EBWebView/Default/DawnCache/index
OxygenU.exe.WebView2/EBWebView/Default/EdgeEDrop/EdgeEDropSQLite.db
OxygenU.exe.WebView2/EBWebView/Default/Extension Rules/000003.log
OxygenU.exe.WebView2/EBWebView/Default/Extension Rules/CURRENT
OxygenU.exe.WebView2/EBWebView/Default/Extension Rules/LOG
OxygenU.exe.WebView2/EBWebView/Default/Extension Rules/MANIFEST-000001
OxygenU.exe.WebView2/EBWebView/Default/Extension Scripts/000003.log
OxygenU.exe.WebView2/EBWebView/Default/Extension Scripts/CURRENT
OxygenU.exe.WebView2/EBWebView/Default/Extension Scripts/LOG
OxygenU.exe.WebView2/EBWebView/Default/Extension Scripts/MANIFEST-000001
OxygenU.exe.WebView2/EBWebView/Default/Extension State/000003.log
OxygenU.exe.WebView2/EBWebView/Default/Extension State/CURRENT
OxygenU.exe.WebView2/EBWebView/Default/Extension State/LOG
OxygenU.exe.WebView2/EBWebView/Default/Extension State/LOG.old
OxygenU.exe.WebView2/EBWebView/Default/Extension State/MANIFEST-000001
OxygenU.exe.WebView2/EBWebView/Default/ExtensionActivityComp
OxygenU.exe.WebView2/EBWebView/Default/ExtensionActivityEdge
OxygenU.exe.WebView2/EBWebView/Default/Favicons
OxygenU.exe.WebView2/EBWebView/Default/GPUCache/data_0
OxygenU.exe.WebView2/EBWebView/Default/GPUCache/data_1
OxygenU.exe.WebView2/EBWebView/Default/GPUCache/data_2
OxygenU.exe.WebView2/EBWebView/Default/GPUCache/data_3
OxygenU.exe.WebView2/EBWebView/Default/GPUCache/index
OxygenU.exe.WebView2/EBWebView/Default/History
OxygenU.exe.WebView2/EBWebView/Default/Local Storage/leveldb/CURRENT
OxygenU.exe.WebView2/EBWebView/Default/Local Storage/leveldb/LOG
OxygenU.exe.WebView2/EBWebView/Default/Local Storage/leveldb/LOG.old
OxygenU.exe.WebView2/EBWebView/Default/Local Storage/leveldb/MANIFEST-000001
OxygenU.exe.WebView2/EBWebView/Default/Login Data
OxygenU.exe.WebView2/EBWebView/Default/Network Action Predictor
OxygenU.exe.WebView2/EBWebView/Default/Network/Cookies
OxygenU.exe.WebView2/EBWebView/Default/Network/Network Persistent State
OxygenU.exe.WebView2/EBWebView/Default/Network/Reporting and NEL
OxygenU.exe.WebView2/EBWebView/Default/Network/SCT Auditing Pending Reports
OxygenU.exe.WebView2/EBWebView/Default/Network/TransportSecurity
OxygenU.exe.WebView2/EBWebView/Default/Preferences
OxygenU.exe.WebView2/EBWebView/Default/PreferredApps
OxygenU.exe.WebView2/EBWebView/Default/README
OxygenU.exe.WebView2/EBWebView/Default/Secure Preferences
OxygenU.exe.WebView2/EBWebView/Default/Session Storage/000003.log
OxygenU.exe.WebView2/EBWebView/Default/Session Storage/CURRENT
OxygenU.exe.WebView2/EBWebView/Default/Session Storage/LOG
OxygenU.exe.WebView2/EBWebView/Default/Session Storage/LOG.old
OxygenU.exe.WebView2/EBWebView/Default/Session Storage/MANIFEST-000001
OxygenU.exe.WebView2/EBWebView/Default/Site Characteristics Database/000003.log
OxygenU.exe.WebView2/EBWebView/Default/Site Characteristics Database/CURRENT
OxygenU.exe.WebView2/EBWebView/Default/Site Characteristics Database/LOG
OxygenU.exe.WebView2/EBWebView/Default/Site Characteristics Database/LOG.old
OxygenU.exe.WebView2/EBWebView/Default/Site Characteristics Database/MANIFEST-000001
OxygenU.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/000003.log
OxygenU.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/CURRENT
OxygenU.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/LOG
OxygenU.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/LOG.old
OxygenU.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/MANIFEST-000001
OxygenU.exe.WebView2/EBWebView/Default/Top Sites
OxygenU.exe.WebView2/EBWebView/Default/Visited Links
OxygenU.exe.WebView2/EBWebView/Default/Web Data
OxygenU.exe.WebView2/EBWebView/Default/heavy_ad_intervention_opt_out.db
OxygenU.exe.WebView2/EBWebView/Default/shared_proto_db/000003.log
OxygenU.exe.WebView2/EBWebView/Default/shared_proto_db/CURRENT
OxygenU.exe.WebView2/EBWebView/Default/shared_proto_db/LOG
OxygenU.exe.WebView2/EBWebView/Default/shared_proto_db/LOG.old
OxygenU.exe.WebView2/EBWebView/Default/shared_proto_db/MANIFEST-000001
OxygenU.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/000003.log
OxygenU.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/CURRENT
OxygenU.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/LOG
OxygenU.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/LOG.old
OxygenU.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/MANIFEST-000001
OxygenU.exe.WebView2/EBWebView/GrShaderCache/data_0
OxygenU.exe.WebView2/EBWebView/GrShaderCache/data_1
OxygenU.exe.WebView2/EBWebView/GrShaderCache/data_2
OxygenU.exe.WebView2/EBWebView/GrShaderCache/data_3
OxygenU.exe.WebView2/EBWebView/GrShaderCache/f_000001
OxygenU.exe.WebView2/EBWebView/GrShaderCache/f_000002
OxygenU.exe.WebView2/EBWebView/GrShaderCache/index
OxygenU.exe.WebView2/EBWebView/Last Version
OxygenU.exe.WebView2/EBWebView/Local State
OxygenU.exe.WebView2/EBWebView/OriginTrials/0.0.1.4/manifest.fingerprint
OxygenU.exe.WebView2/EBWebView/OriginTrials/0.0.1.4/manifest.json
OxygenU.exe.WebView2/EBWebView/ShaderCache/data_0
OxygenU.exe.WebView2/EBWebView/ShaderCache/data_1
OxygenU.exe.WebView2/EBWebView/ShaderCache/data_2
OxygenU.exe.WebView2/EBWebView/ShaderCache/data_3
OxygenU.exe.WebView2/EBWebView/ShaderCache/index
OxygenU.exe.WebView2/EBWebView/SmartScreen/RemoteData/customSynchronousLookupUris
OxygenU.exe.WebView2/EBWebView/SmartScreen/RemoteData/customSynchronousLookupUris_0
OxygenU.exe.WebView2/EBWebView/SmartScreen/RemoteData/edgeSettings
OxygenU.exe.WebView2/EBWebView/SmartScreen/RemoteData/edgeSettings_2.0-0
OxygenU.exe.WebView2/EBWebView/SmartScreen/RemoteData/synchronousLookupUris
OxygenU.exe.WebView2/EBWebView/SmartScreen/RemoteData/synchronousLookupUris_636976985063396749.rel.v2
OxygenU.exe.WebView2/EBWebView/Variations
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/_metadata/verified_contents.json
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-as.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-be.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-bg.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-bn.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-cu.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-cy.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-da.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-de-1901.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-de-1996.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-de-ch-1901.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-en-gb.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-en-us.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-es.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-et.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-eu.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-fr.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-ga.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-gu.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-hi.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-hr.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-hu.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-hy.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-kn.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-la.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-ml.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-mn-cyrl.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-mr.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-nb.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-nn.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-or.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-pa.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-pt.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-sl.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-ta.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-te.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-tk.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-und-ethi.hyb
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/manifest.fingerprint
OxygenU.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/manifest.json
runtimes/win-x86/native/WebView2Loader.dll
.dll windows:5 windows x86 arch:x86

a64b009ff2c9503726050a45e231f4c9

Code Sign

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ef:48:48:0d:6c:07:82:58:c1:fc:21:13:53:29:95:ef:4d:db:1d:23:5c:fd:bb:71:c3:61:e3:00:15:44:2e:2e
Signer

Actual PE Digest

ef:48:48:0d:6c:07:82:58:c1:fc:21:13:53:29:95:ef:4d:db:1d:23:5c:fd:bb:71:c3:61:e3:00:15:44:2e:2e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

WebView2Loader.dll.pdb

Imports

kernel32

CloseHandle
CreateEventW
CreateFileW
DecodePointer
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
MultiByteToWideChar
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ResetEvent
RtlUnwind
SetEvent
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
WriteFile

Exports

Exports

CompareBrowserVersions
CreateCoreWebView2Environment
CreateCoreWebView2EnvironmentWithOptions
GetAvailableCoreWebView2BrowserVersionString

Sections

.text
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.voltbl
Size: 512B - Virtual size: 72B

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Oxygen-v2-main/ui_version.txt
Oxygen-v2-main/version.txt
Oxygen-v2-main/vs.zip
.zip
vs/base/worker/workerMain.js
.js
vs/basic-languages/bat/bat.js
vs/basic-languages/coffee/coffee.js
vs/basic-languages/cpp/cpp.js
vs/basic-languages/csharp/csharp.js
vs/basic-languages/csp/csp.js
vs/basic-languages/css/css.js
vs/basic-languages/dockerfile/dockerfile.js
vs/basic-languages/fsharp/fsharp.js
vs/basic-languages/go/go.js
vs/basic-languages/handlebars/handlebars.js
.js
vs/basic-languages/html/html.js
.js
vs/basic-languages/ini/ini.js
vs/basic-languages/java/java.js
vs/basic-languages/less/less.js
vs/basic-languages/lua/lua.js
vs/basic-languages/markdown/markdown.js
.js
vs/basic-languages/msdax/msdax.js
vs/basic-languages/mysql/mysql.js
vs/basic-languages/objective-c/objective-c.js
vs/basic-languages/pgsql/pgsql.js
vs/basic-languages/php/php.js
vs/basic-languages/postiats/postiats.js
vs/basic-languages/powershell/powershell.js
vs/basic-languages/pug/pug.js
vs/basic-languages/python/python.js
vs/basic-languages/r/r.js
vs/basic-languages/razor/razor.js
.js
vs/basic-languages/redis/redis.js
vs/basic-languages/redshift/redshift.js
vs/basic-languages/ruby/ruby.js
vs/basic-languages/rust/rust.js
vs/basic-languages/sb/sb.js
vs/basic-languages/scss/scss.js
vs/basic-languages/solidity/solidity.js
vs/basic-languages/sql/sql.js
vs/basic-languages/st/st.js
vs/basic-languages/swift/swift.js
vs/basic-languages/vb/vb.js
vs/basic-languages/xml/xml.js
vs/basic-languages/yaml/yaml.js
vs/editor/contrib/suggest/media/String_16x.svg
vs/editor/contrib/suggest/media/String_inverse_16x.svg
vs/editor/editor.main.css
vs/editor/editor.main.js
.js
vs/editor/editor.main.nls.de.js
vs/editor/editor.main.nls.es.js
vs/editor/editor.main.nls.fr.js
vs/editor/editor.main.nls.it.js
vs/editor/editor.main.nls.ja.js
vs/editor/editor.main.nls.js
vs/editor/editor.main.nls.ko.js
vs/editor/editor.main.nls.ru.js
vs/editor/editor.main.nls.zh-cn.js
vs/editor/editor.main.nls.zh-tw.js
vs/editor/standalone/browser/quickOpen/symbol-sprite.svg
vs/language/css/cssMode.js
.js
vs/language/css/cssWorker.js
.js
vs/language/html/htmlMode.js
.js
vs/language/html/htmlWorker.js
.js
vs/language/json/jsonMode.js
.js
vs/language/json/jsonWorker.js
.js
vs/language/typescript/lib/typescriptServices.js
.js
vs/language/typescript/tsMode.js
.js
vs/language/typescript/tsWorker.js
.js
vs/loader.js
.js

Sharing

General

Malware Config

Signatures

Files

50ca805a824acdd145c856d5be6546cb

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcp140

shlwapi

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

wtsapi32

user32

Sections

.text Size: - Virtual size: 23KB

.rdata Size: - Virtual size: 8KB

.data Size: - Virtual size: 1KB

.vmp0 Size: - Virtual size: 3.2MB

.vmp1 Size: 5.2MB - Virtual size: 5.2MB

.rsrc Size: 512B - Virtual size: 469B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 289KB - Virtual size: 289KB

.rsrc Size: 1024B - Virtual size: 888B

.reloc Size: 512B - Virtual size: 12B

7c8bade356a63f883c6fa6a79b6cc13d

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

shell32

imm32

d3dcompiler_47

ws2_32

crypt32

wldap32

normaliz

Exports

Exports

Sections

.text Size: - Virtual size: 2.9MB

.rdata Size: - Virtual size: 1.7MB

.data Size: - Virtual size: 338KB

.00cfg Size: - Virtual size: 8B

.tls Size: - Virtual size: 4KB

.voltbl Size: - Virtual size: 190B

.astaghf Size: - Virtual size: 1.5MB

.astaghf Size: 5.3MB - Virtual size: 5.3MB

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 223B

048ee6e2acdf6f449ddf71b1f0a3e356

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

crypt32

wldap32

normaliz

kernel32

advapi32

.text
Size: - Virtual size: 23KB

.rdata
Size: - Virtual size: 8KB

.data
Size: - Virtual size: 1KB

.vmp0
Size: - Virtual size: 3.2MB

.vmp1
Size: 5.2MB - Virtual size: 5.2MB

.rsrc
Size: 512B - Virtual size: 469B

.text
Size: 289KB - Virtual size: 289KB

.rsrc
Size: 1024B - Virtual size: 888B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: - Virtual size: 2.9MB

.rdata
Size: - Virtual size: 1.7MB

.data
Size: - Virtual size: 338KB

.00cfg
Size: - Virtual size: 8B

.tls
Size: - Virtual size: 4KB

.voltbl
Size: - Virtual size: 190B

.astaghf
Size: - Virtual size: 1.5MB

.astaghf
Size: 5.3MB - Virtual size: 5.3MB

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 223B

.text
Size: - Virtual size: 329KB

.rdata
Size: - Virtual size: 59KB

.data
Size: - Virtual size: 2KB

.auth0
Size: - Virtual size: 3.2MB

.auth1
Size: 5.6MB - Virtual size: 5.6MB

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 233B

.text
Size: 20KB - Virtual size: 20KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 2.4MB - Virtual size: 2.4MB

.rsrc
Size: 153KB - Virtual size: 153KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 2.4MB - Virtual size: 2.4MB

.rsrc
Size: 153KB - Virtual size: 153KB

.reloc
Size: 512B - Virtual size: 12B

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2
Certificate