Chaos_2[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Chaos_2.zip
Size

1.9MB
MD5

3d85a695e32ac0c10f0c1d1d67668764
SHA1

0dd7845afd9ca1f1411f1f34ebac607e4e2ab551
SHA256

df02e27bf68e129c164642c55a72f1b3733be2329334579e18a435712832af8e
SHA512

dad61765a32d2866f8b233ef3df33c4ea007b90c8f83450158384a007dca704b34f178e1a453f4fa8f59edde5578a380495edec8119229b062db8a78fbdcbb7d
SSDEEP

49152:CzsGKRWlf79r+eq19rWM2Ky7fVPPVaHlw0GH3Zkz9F/PMBzyW:CzKRWV8BL6M0tPdaHkH3ZQzP8zT

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Chaos/ch.exe
unpack001/Chaos/pyarmor_runtime_000000/pyarmor_runtime.pyd

Files

Chaos_2.zip
.zip
Chaos/Chaos.py
.py .js
Chaos/ch.exe
.exe windows:6 windows x64 arch:x64

b67b812388a1094acd5db594749b4971

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\rbxfpsunlocker\rbxfpsunlocker\x64\Release\rbxfpsunlocker.pdb

Imports

kernel32

GetProcessId
CreateMutexA
DuplicateHandle
OpenProcess
Sleep
GetLastError
CloseHandle
ReadProcessMemory
VirtualQueryEx
GetExitCodeProcess
Process32First
CreateToolhelp32Snapshot
QueryFullProcessImageNameA
Process32Next
Module32FirstW
Module32NextW
IsWow64Process
SetConsoleTitleA
TerminateThread
FreeConsole
CreateThread
GetConsoleWindow
AllocConsole
GetStdHandle
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
SetConsoleTextAttribute
GetCurrentProcess
GetConsoleScreenBufferInfo
SetEndOfFile
WriteProcessMemory
LCMapStringW
HeapFree
HeapAlloc
GetFileType
SetFilePointerEx
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
AreFileApisANSI
GetModuleHandleW
GetProcAddress
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetCurrentThreadId
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
WakeAllConditionVariable
SleepConditionVariableSRW
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
WriteFile
GetFileSizeEx
RtlUnwind

user32

EnumWindows
GetWindowTextA
MessageBoxA
IsWindowVisible
GetSystemMenu
GetMessageA
CheckMenuRadioItem
DispatchMessageA
LoadCursorA
CreatePopupMenu
TrackPopupMenu
ShowWindow
DefWindowProcA
CreateWindowExA
TranslateMessage
LoadIconA
AppendMenuA
CheckMenuItem
PostQuitMessage
EnableMenuItem
RegisterClassExA
SetForegroundWindow
GetCursorPos
GetWindowThreadProcessId

gdi32

GetStockObject

advapi32

RegOpenKeyExA
RegQueryValueExA

shell32

Shell_NotifyIconA
ShellExecuteA
SHGetKnownFolderPath

wininet

InternetOpenA
InternetCloseHandle
InternetReadFile
InternetOpenUrlA

Sections

.text
Size: 367KB - Virtual size: 366KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Chaos/open.bat
.bat .vbs
Chaos/ps.py
.py .js
Chaos/pssuspend.exe
.exe windows:6 windows x86 arch:x86

32f7a5e0ecd105d509a9d9677d178190

Code Sign

33:00:00:02:cd:f3:64:bf:f8:d4:4c:5d:51:00:00:00:00:02:cd
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/05/2022, 20:46

Not After

11/05/2023, 20:46

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

94:b1:87:4b:67:89:c9:82:50:bf:08:9b:47:dc:4c:8d:ad:32:3d:6a:8a:78:50:b1:e5:a8:53:e5:2b:07:6b:61
Signer

Actual PE Digest

94:b1:87:4b:67:89:c9:82:50:bf:08:9b:47:dc:4c:8d:ad:32:3d:6a:8a:78:50:b1:e5:a8:53:e5:2b:07:6b:61

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\a\1\s\pssuspend\exe\Win32\Release\pssuspend.pdb

Imports

ws2_32

WSAStartup
gethostname
gethostbyname
inet_ntoa

mpr

WNetCancelConnection2A
WNetAddConnection2A

version

GetFileVersionInfoA
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA
GetFileVersionInfoW
VerQueryValueW
VerQueryValueA

kernel32

GetFileType
GetModuleHandleA
GetProcAddress
LocalAlloc
LocalFree
GetModuleFileNameA
GetModuleFileNameW
VerSetConditionMask
CreateFileA
DeleteFileA
WriteFile
CloseHandle
WaitForSingleObject
GetCommandLineW
GetCurrentProcess
GetTickCount
GetSystemDirectoryA
FreeLibrary
LoadResource
LockResource
SizeofResource
FormatMessageA
FindResourceA
VerifyVersionInfoA
WideCharToMultiByte
GetConsoleScreenBufferInfo
OpenProcess
ReadFile
GetFileSizeEx
LoadLibraryExA
GetStdHandle
GetVersionExA
SetLastError
GetComputerNameA
GetLastError
SetFilePointerEx
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
HeapSize
WriteConsoleW
Sleep
VirtualProtect
RaiseException
GetSystemInfo
SetEndOfFile
VirtualQuery
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
GetStringTypeW
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetConsoleCP
ExitProcess
GetModuleHandleExW
SetStdHandle
CreateThread
ExitThread
FreeLibraryAndExitThread
GetCommandLineA
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
CreateFileW
SetConsoleMode
ReadConsoleInputW
ReadConsoleW

comdlg32

PrintDlgA

advapi32

StartServiceA
QueryServiceStatus
OpenServiceA
OpenSCManagerA
DeleteService
CreateServiceA
ControlService
CloseServiceHandle
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegCreateKeyA
RegCloseKey

Sections

.text
Size: 129KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 155KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Chaos/pyarmor_runtime_000000/__init__.py
Chaos/pyarmor_runtime_000000/__pycache__/__init__.cpython-312.pyc
Chaos/pyarmor_runtime_000000/pyarmor_runtime.pyd
.dll windows:4 windows x64 arch:x64

3ca83ed88704daa0d964c26afdceb846

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

python312

PyBuffer_FillInfo
PyBuffer_Release
PyBytes_AsString
PyBytes_AsStringAndSize
PyBytes_FromStringAndSize
PyBytes_Type
PyCFunction_GetSelf
PyCFunction_Type
PyCMethod_New
PyCell_Get
PyCell_New
PyCell_Set
PyCode_GetCode
PyCode_Type
PyComplex_FromCComplex
PyComplex_ImagAsDouble
PyComplex_RealAsDouble
PyComplex_Type
PyDict_Copy
PyDict_DelItem
PyDict_GetItem
PyDict_GetItemString
PyDict_New
PyDict_Next
PyDict_SetItem
PyDict_SetItemString
PyDict_Type
PyDict_Update
PyErr_CheckSignals
PyErr_Clear
PyErr_ExceptionMatches
PyErr_Fetch
PyErr_Format
PyErr_GivenExceptionMatches
PyErr_NoMemory
PyErr_NormalizeException
PyErr_Occurred
PyErr_Restore
PyErr_SetFromWindowsErr
PyErr_SetObject
PyErr_SetString
PyEval_EvalCode
PyEval_GetBuiltins
PyEval_GetFrame
PyEval_GetGlobals
PyExc_AttributeError
PyExc_EOFError
PyExc_ImportError
PyExc_NotImplementedError
PyExc_RuntimeError
PyExc_StopIteration
PyExc_SystemError
PyExc_SystemExit
PyExc_TypeError
PyExc_UnboundLocalError
PyExc_ValueError
PyException_SetCause
PyException_SetContext
PyException_SetTraceback
PyFloat_FromDouble
PyFloat_Pack8
PyFloat_Type
PyFloat_Unpack8
PyFrame_GetCode
PyFrozenSet_New
PyFrozenSet_Type
PyFunction_GetCode
PyFunction_NewWithQualName
PyImport_ExecCodeModuleObject
PyImport_GetModule
PyImport_GetModuleDict
PyImport_ImportModule
PyImport_ImportModuleLevel
PyImport_ImportModuleLevelObject
PyIter_Next
PyList_Append
PyList_AsTuple
PyList_GetItem
PyList_New
PyList_Sort
PyList_Type
PyLong_AsLong
PyLong_AsLongAndOverflow
PyLong_AsVoidPtr
PyLong_FromLong
PyLong_FromVoidPtr
PyLong_Type
PyMarshal_WriteObjectToString
PyMem_Free
PyMem_Malloc
PyMem_Realloc
PyMemoryView_FromBuffer
PyMethod_Function
PyMethod_Type
PyModule_Create2
PyModule_GetDict
PyModule_GetFilenameObject
PyModule_GetName
PyModule_Type
PyNumber_Add
PyNumber_And
PyNumber_AsSsize_t
PyNumber_FloorDivide
PyNumber_InPlaceAdd
PyNumber_InPlaceAnd
PyNumber_InPlaceFloorDivide
PyNumber_InPlaceLshift
PyNumber_InPlaceMatrixMultiply
PyNumber_InPlaceMultiply
PyNumber_InPlaceOr
PyNumber_InPlacePower
PyNumber_InPlaceRemainder
PyNumber_InPlaceRshift
PyNumber_InPlaceSubtract
PyNumber_InPlaceTrueDivide
PyNumber_InPlaceXor
PyNumber_Invert
PyNumber_Lshift
PyNumber_MatrixMultiply
PyNumber_Multiply
PyNumber_Negative
PyNumber_Or
PyNumber_Positive
PyNumber_Power
PyNumber_Remainder
PyNumber_Rshift
PyNumber_Subtract
PyNumber_TrueDivide
PyNumber_Xor
PyOS_double_to_string
PyOS_string_to_double
PyObject_ASCII
PyObject_Call
PyObject_CallFunction
PyObject_CallFunctionObjArgs
PyObject_CallMethod
PyObject_CheckBuffer
PyObject_DelItem
PyObject_Format
PyObject_GetAttr
PyObject_GetAttrString
PyObject_GetBuffer
PyObject_GetItem
PyObject_GetIter
PyObject_IsSubclass
PyObject_IsTrue
PyObject_Repr
PyObject_RichCompare
PyObject_SetAttr
PyObject_SetItem
PyObject_Str
PyObject_VectorcallDict
PySequence_Check
PySequence_Contains
PySequence_List
PySequence_Tuple
PySet_Add
PySet_New
PySet_Type
PySlice_New
PySys_GetObject
PyThreadState_Get
PyTraceBack_Here
PyTuple_GetItem
PyTuple_GetSlice
PyTuple_New
PyTuple_Pack
PyTuple_SetItem
PyTuple_Size
PyTuple_Type
PyType_IsSubtype
PyUnicode_AsEncodedString
PyUnicode_AsUTF8
PyUnicode_AsUTF8AndSize
PyUnicode_DecodeUTF8
PyUnicode_FromFormat
PyUnicode_FromKindAndData
PyUnicode_FromString
PyUnicode_InternInPlace
PyUnicode_New
PyUnicode_Type
Py_BuildValue
Py_DecRef
Py_IncRef
Py_InspectFlag
_PyArg_ParseTuple_SizeT
_PyBytes_Resize
_PyCode_Validate
_PyDict_GetItemWithError
_PyErr_Clear
_PyErr_ExceptionMatches
_PyErr_Format
_PyErr_GetTopmostException
_PyErr_SetObject
_PyErr_SetString
_PyList_Extend
_PyLong_AsInt
_PyLong_FromByteArray
_PyLong_New
_PyModuleSpec_IsInitializing
_PyObject_CallFunction_SizeT
_PyObject_CallMethod
_PyObject_CallMethod_SizeT
_PyObject_FastCall
_PyObject_LookupAttr
_PyObject_LookupSpecialId
_PyObject_MakeTpCall
_PyObject_NewVar
_PyRuntime
_PySet_NextEntry
_PyThreadState_GetCurrent
_PyUnicode_JoinArray
_Py_BuildValue_SizeT
_Py_CheckFunctionResult
_Py_Dealloc
_Py_EllipsisObject
_Py_FalseStruct
_Py_NoneStruct
_Py_TrueStruct
_Py_ctype_table
_Py_hashtable_compare_direct
_Py_hashtable_destroy
_Py_hashtable_hash_ptr
_Py_hashtable_new_full
_Py_hashtable_set

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegCloseKey
RegEnumKeyExA
RegGetValueA
RegOpenKeyExA

iphlpapi

GetAdaptersAddresses
GetNetworkParams

kernel32

CloseHandle
CreateFileA
CreateFileMappingA
DeleteCriticalSection
DeviceIoControl
EnterCriticalSection
FlushViewOfFile
FormatMessageA
GetComputerNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetTickCount
GlobalAlloc
GlobalFree
HeapAlloc
HeapFree
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LocalFree
MapViewOfFile
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualLock
VirtualProtect
VirtualQuery
VirtualUnlock

msvcrt

__iob_func
_amsg_exit
_errno
_get_osfhandle
_initterm
_lock
_mktime64
_snprintf
_stat64
_time64
_unlock
_vsnprintf
abort
calloc
clock
exit
fprintf
fputc
fread
free
fwrite
getc
getenv
isprint
isxdigit
malloc
memcmp
memcpy
memmove
memset
rand
realloc
signal
sprintf
srand
strchr
strcmp
strerror
strlen
strncmp
strncpy
strrchr
strstr
toupper
vfprintf

user32

wsprintfA

ws2_32

WSACleanup
WSAGetLastError
WSAStartup
closesocket
connect
gethostbyname
htons
inet_ntoa
ioctlsocket
ntohl
recv
recvfrom
select
send
sendto
setsockopt
socket

Exports

Exports

PyInit_pyarmor_runtime

Sections

.text
Size: 520KB - Virtual size: 519KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 25KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 93B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 676B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b67b812388a1094acd5db594749b4971

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

wininet

Sections

.text Size: 367KB - Virtual size: 366KB

.rdata Size: 107KB - Virtual size: 106KB

.data Size: 7KB - Virtual size: 14KB

.pdata Size: 18KB - Virtual size: 17KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 162KB - Virtual size: 161KB

.reloc Size: 3KB - Virtual size: 2KB

32f7a5e0ecd105d509a9d9677d178190

Code Sign

33:00:00:02:cd:f3:64:bf:f8:d4:4c:5d:51:00:00:00:00:02:cdCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

94:b1:87:4b:67:89:c9:82:50:bf:08:9b:47:dc:4c:8d:ad:32:3d:6a:8a:78:50:b1:e5:a8:53:e5:2b:07:6b:61Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

mpr

version

kernel32

comdlg32

advapi32

Sections

.text Size: 129KB - Virtual size: 128KB

.rdata Size: 78KB - Virtual size: 77KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 155KB - Virtual size: 155KB

.reloc Size: 7KB - Virtual size: 6KB

3ca83ed88704daa0d964c26afdceb846

Headers

File Characteristics

Imports

python312

advapi32

iphlpapi

kernel32

msvcrt

user32

ws2_32

Exports

Exports

Sections

.text Size: 520KB - Virtual size: 519KB

.data Size: 17KB - Virtual size: 17KB

.rdata Size: 49KB - Virtual size: 49KB

.pdata Size: 9KB - Virtual size: 9KB

.xdata Size: 10KB - Virtual size: 9KB

.bss Size: - Virtual size: 25KB

.edata Size: 512B - Virtual size: 93B

.idata Size: 13KB - Virtual size: 13KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 1024B - Virtual size: 676B

.text
Size: 367KB - Virtual size: 366KB

.rdata
Size: 107KB - Virtual size: 106KB

.data
Size: 7KB - Virtual size: 14KB

.pdata
Size: 18KB - Virtual size: 17KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 162KB - Virtual size: 161KB

.reloc
Size: 3KB - Virtual size: 2KB

33:00:00:02:cd:f3:64:bf:f8:d4:4c:5d:51:00:00:00:00:02:cd
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

94:b1:87:4b:67:89:c9:82:50:bf:08:9b:47:dc:4c:8d:ad:32:3d:6a:8a:78:50:b1:e5:a8:53:e5:2b:07:6b:61
Signer

.text
Size: 129KB - Virtual size: 128KB

.rdata
Size: 78KB - Virtual size: 77KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 155KB - Virtual size: 155KB

.reloc
Size: 7KB - Virtual size: 6KB

.text
Size: 520KB - Virtual size: 519KB

.data
Size: 17KB - Virtual size: 17KB

.rdata
Size: 49KB - Virtual size: 49KB

.pdata
Size: 9KB - Virtual size: 9KB

.xdata
Size: 10KB - Virtual size: 9KB

.bss
Size: - Virtual size: 25KB

.edata
Size: 512B - Virtual size: 93B

.idata
Size: 13KB - Virtual size: 13KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 1024B - Virtual size: 676B