gafgyt | 7d69e0d82e74059115486fae5dd5ac6463c7fccd91dbbcaa9587117c7d201ddb

Resubmissions

22-04-2024 22:02

240422-1xtwbagh68 10

22-04-2024 19:25

240422-x42b7afa68 10

19-04-2024 03:02

240419-djmthsfh8w 10

Sharing

Copy URL

Twitter E-mail

Reason

could not process APK: could not decode AXML: sblock: string with idx 268435468 not found

General

Target

7d69e0d82e74059115486fae5dd5ac6463c7fccd91dbbcaa9587117c7d201ddb
Size

289.5MB
MD5

405394c381ca2000e01428e79d03cecb
SHA1

cb41f1d9e06c1b783378a43486c7d997a3635b68
SHA256

7d69e0d82e74059115486fae5dd5ac6463c7fccd91dbbcaa9587117c7d201ddb
SHA512

40266c79a3d2c010882cfc4b237c6d27989dc385fd23d8bafe89e4ff329a181fed4ba44dac91187ffd2698d51af44454917e901375aa0dc87624ec956f12f80d
SSDEEP

6291456:BN08aneiYsmfO6eRtz+WmPn4auzQgHDXuDFHVfuc1Fyn6RQuj3jN31S:j08aneo2eTTI2NHDXuDjxPyn6zj3jN3M

Score

10^/10

upx backdoor sora mirai hacked rat cheat tg pyinstaller gafgyt mirai xzutil blacknet triada dcrat zgrat xworm asyncrat redline sectoprat socks5systemz irata stealc adwind

Malware Config

Extracted

Family

gafgyt

94.156.64.4:42516

Extracted

Family

mirai

Botnet

SORA

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Family

blacknet

Botnet

HacKed

http://botnetera.pagekite.me/

Mutex

BN[pjClIrDI-2470224]

Attributes

antivm
true
elevate_uac
true
install_name
WindowsUpdate.exe
splitter
|BN|
start_name
35dcbc7eb742dd4f1edfbccf7826c724
startup
false
usb_spread
false

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Family

xworm

involved-hurt.gl.at.ply.gg:35238

Attributes

Install_directory
%LocalAppData%
install_file
WindowsHealthSystem.exe

Extracted

Family

redline

Botnet

cheat

0.tcp.eu.ngrok.io:18950

Extracted

Family

mirai

hoiiaz.iaz.coby

Extracted

Family

redline

Botnet

163.5.112.53:51523

Extracted

Family

stealc

http://185.216.70.109

Attributes

url_path
/eb488f9cb9d466ca.php

Extracted

Family

mirai

Botnet

SORA

Extracted

Family

mirai

Botnet

MIRAI

client.orxy.space

Extracted

Family

mirai

Botnet

MIRAI

Signatures

Adwind family
adwind

Android Triada payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/3476006a8f64bfe72a8b04477f6005293b5854cfbc58bee2ea28e59b58f0e316.apk	family_triada

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
static1/unpack001/547c07702129ea5e0ae2fb48e841c74ce957a4fa3f1c3742e588fe84c494232b.exe	family_asyncrat

Asyncrat family
asyncrat

BlackNET payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/2e4d8723602c5ffc6409dceb0cb4ced2e749e374a0fcd41fe92e0fd50f817c5b.exe	family_blacknet

Blacknet family
blacknet

Class file contains resources related to AdWind 2 IoCs

Processes:

resource	yara_rule
sample	family_adwind3
sample	family_adwind6

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
static1/unpack001/2e4d8723602c5ffc6409dceb0cb4ced2e749e374a0fcd41fe92e0fd50f817c5b.exe	disable_win_def

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
static1/unpack001/3b7b020f8ce69d4b810468c03b4bfd1cc6e56080c7b754cafebfd4ba500c7855.exe	dcrat
static1/unpack001/57bfb1ccdc00493daf0987426bc3744bfcc0f2777b78594e840832a776b32a9f.exe	dcrat
static1/unpack001/99e64babb02ebc1d5b30582b30d0fbe153cc33ebcc55dd382f9dce4abfe76ed0.exe	dcrat
static1/unpack001/de00660d0d96ff67cb8e89a8d8525567327b109bc54b9042e5fdd516dcc0e51a.exe	dcrat
static1/unpack001/e0acb3c17aac695ada5fd83580506ffa0e6972bd8551e961c3f7b6ecc22dc793.exe	dcrat
static1/unpack001/ec4949fff4b4320c7b50929a7d72b90fc1ca703d39c7819f31ec95a8e7e91ed7.exe	dcrat

Dcrat family
dcrat

Detect Socks5Systemz Payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/63c666636e07e95e5e56ccb4e92db6dc350986bc4fcb401975dbae538aa73d15.dll	family_socks5systemz

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe	family_xworm

Detect ZGRat V1 3 IoCs

Processes:

resource	yara_rule
static1/unpack001/403237121c807d41f44f036f65336713a673d5b98756abe86faa5e883a068ea7.exe	family_zgrat_v1
static1/unpack001/547c07702129ea5e0ae2fb48e841c74ce957a4fa3f1c3742e588fe84c494232b.exe	family_zgrat_v1
static1/unpack001/8058db39c9c75269344ca81e210acb61595abf9b3e4e7a67ec380ba9ba756400.exe	family_zgrat_v1

Detected Gafgyt variant 29 IoCs

Processes:

resource	yara_rule
static1/unpack001/0490e8427ac66951389e11dbd990c19cb1ee43102c33935b12db6a4eca7717c7.elf	family_gafgyt
static1/unpack001/1df6acbc1106e17265fde3ab54b2a83fa8f6f39656d7c55481b2dbd66f1114b7.elf	family_gafgyt
static1/unpack001/1f580428fa8afd15832fcd04f5d6832be9f7a7144ff17e19c89d2b07e7f51f2c.elf	family_gafgyt
static1/unpack001/2796760675e5efbef0319f0285c2e1d07c11b038311c02e16c2407ba57c38413.elf	family_gafgyt
static1/unpack001/2b4b073178b573aa181fdc6e8063c778c90f76235d640c186b99278186509e74.elf	family_gafgyt
static1/unpack001/377c3c3679e44acbc13388ca7ec69f2346b321aa42110fc6ee44a44c54d67105.elf	family_gafgyt
static1/unpack001/3c52855c535816927fd94405b87fef074296ca34994d04686b7fe141bb48d20d.elf	family_gafgyt
static1/unpack001/42f781f94b9df3f0625426ea2ae3f668a83b52faf78c8c5ddfccab1690967e90.elf	family_gafgyt
static1/unpack001/44243d0823b6951aa36d0c1a8aea39866bbf33f5d0bbb76dfa3b5290ffe83683.elf	family_gafgyt
static1/unpack001/49ebe60b13e18860b25f920c8c8ed486bd9f0789c47c65df1f32c6dcb1a2cb83.elf	family_gafgyt
static1/unpack001/6e6d31e5b9a61454a66a24114583d5bdc3d7f2472bfea10fb639580fc058a1c8.elf	family_gafgyt
static1/unpack001/706e63fa9b69849f7f9c518fff1314f02632bf0b9040c9c5f4ce506c0e11f25c.elf	family_gafgyt
static1/unpack001/71b748425fa7055b9060ac5d6587bc18948c46558e6789ddb213df076d379d0c.elf	family_gafgyt
static1/unpack001/868891f4f0e322d258224ca43c84c055c21babac5fe1ae87542b8888ab3f0b33.elf	family_gafgyt
static1/unpack001/8dba2039fd6f20170d4f1046a5a9d3413c58a657ce34658f5681e07296263d95.elf	family_gafgyt
static1/unpack001/8ffa8c43fdc61c96e1a017be3eadff98e0f9d35f08ee9ecdd6da7bf2776d730a.elf	family_gafgyt
static1/unpack001/9088a8c9590582ef92ac8b0c371d86fcf80fb37629d7d007585e8589fcb99be7.elf	family_gafgyt
static1/unpack001/91f974e26d0662021f8a33d76ae3ba59d530046ae6ddd9712b54bb411a163f41.elf	family_gafgyt
static1/unpack001/93baaaabfc573289b7cea910738e996f36b616b93a40a2ecfb84d14d1a2e5da2.elf	family_gafgyt
static1/unpack001/a508368a916bcc275163c40126bfdcaa26d5dc3294257356f16799a79ed7eebf.elf	family_gafgyt
static1/unpack001/a9dbdd95ebd8c9e6fb7de29c21103ddba18a62f2393bfa7ba365a491e37b342a.elf	family_gafgyt
static1/unpack001/aaef77108648df18c61d1da23ec384fa62fe17e559da38ec128911437cdf939c.elf	family_gafgyt
static1/unpack001/bcb2ec0810dd5fe31592e0b8c7739102620ce48b4bfc06bd3708de614896d180.elf	family_gafgyt
static1/unpack001/cd517989776d85f3669e300ab401543aa354f80b7d467fdb93824b1a287b9238.elf	family_gafgyt
static1/unpack001/ce88ab5d77ab447ef12a4e2859602ac2a167ac360078fa9c6d0eed2ba3bfec51.elf	family_gafgyt
static1/unpack001/d29ebdaa0a822094a12e32d12fd13b401385c2f78941c9f4e222db7b370abf5a.elf	family_gafgyt
static1/unpack001/df6ab7c6ac612aa19b1392455b4250f20e03381c64d6d7443859f319a61f1cb1.elf	family_gafgyt
static1/unpack001/e47c0cc3b00de906596cf4e63820d391d4e0e2ccc78a2c4f60cfe8d1991a345d.elf	family_gafgyt
static1/unpack001/f0ee3752736d8d62f1731e60c26db491dfec0fffe85075b6757ddda257056bee.elf	family_gafgyt

Gafgyt family
gafgyt
Irata family
irata

Irata payload 2 IoCs

Processes:

resource	yara_rule
static1/unpack001/77bd99fc14c25843d7ce183443119b5d7a1f524c00f5a9e2dcccc22f8dae6042.apk	family_irata3
static1/unpack001/77bd99fc14c25843d7ce183443119b5d7a1f524c00f5a9e2dcccc22f8dae6042.apk	family_irata4

Mirai family
mirai

RedLine payload 2 IoCs

Processes:

resource	yara_rule
static1/unpack001/5ecf0dade29bc4365035554275d07a72b112d0b6bc7487cef6a1c40ed50ea28e.exe	family_redline
static1/unpack001/8e28a0090832a76cf71c417cb1bf7990b9af86be258b732117a47f624387083c.exe	family_redline

Redline family
redline

SectopRAT payload 2 IoCs

Processes:

resource	yara_rule
static1/unpack001/5ecf0dade29bc4365035554275d07a72b112d0b6bc7487cef6a1c40ed50ea28e.exe	family_sectoprat
static1/unpack001/8e28a0090832a76cf71c417cb1bf7990b9af86be258b732117a47f624387083c.exe	family_sectoprat

Sectoprat family
sectoprat
Socks5systemz family
socks5systemz
Stealc family
stealc
Triada family
triada

XZUtil is a linux backdoor releated to the CVE-2024-3094. 1 IoCs

backdoor

Processes:

resource	yara_rule
static1/unpack001/257fc477b9684863e0822cbad3606d76c039be8dd51cdc13b73e74e93d7b04cc.elf	family_xzutil

Xworm family
xworm
Xzutil family
xzutil
Zgrat family
zgrat

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
static1/unpack001/547c07702129ea5e0ae2fb48e841c74ce957a4fa3f1c3742e588fe84c494232b.exe	net_reactor

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
static1/unpack001/087421ac222e935579dfd3b7a5120451fd9d9a663d3d1872c04b6154b238c894.elf	upx
static1/unpack001/0c4791a6b47491a0c43cea0ba54357e391a3c8b23aa28025489bbe43bb9ea6ea.elf	upx
static1/unpack001/0d9bd2ae2e4b023047b6c08684e9e5daae76e31cced4c3fdf4640136245f7eea.exe	upx
static1/unpack001/3545082c16d0e05faad342c614b27793ab0ec940a174ab5162dce1787ea8472e.elf	upx
static1/unpack001/42c1afa196dd457a3c9ec69e786c029b7b98f0b5be4041cfbd8b2910352435eb.elf	upx
static1/unpack001/77de41f017ba6908cf75448383dcdd01d3d54dc55fc3a38f3f5b60542c637cf8.elf	upx
static1/unpack001/9cddfa73a9c86cc4d92b6edac2dec8e66ffa5b809fd6e8da6a97d38da5ea4079.elf	upx
static1/unpack001/a216c05b201d5586208af929795cb944aa883aa8db9ba9c1b40df1a11ee3f8a1.elf	upx
static1/unpack001/a6c1a94828b01c0aacd96159919d36031dc10713a00da54945dca3676f1036be.elf	upx
static1/unpack001/b8c409f2545de5b25184b21e745ec3c1b44efc2c5707c8766494f43f91856611.elf	upx
static1/unpack001/b92ce8d8be97c7ba25eb090403e6cb0e3b1ebc9e899517acaefcbcb0e6a7a643.elf	upx
static1/unpack001/bb6c8c6772bc0e8ba9a3416e53e4791fcf2d753642c771c84ecce5f4a2fec948.elf	upx
static1/unpack001/c2655050d7396dc127478a94de8698cad30189dfc594f8e61bfbdf8c1307929f.elf	upx
static1/unpack001/c955e4df8eac2ab783ba558fecf707bf76f8268913cee596c6d85b2dffb24e5f.elf	upx
static1/unpack001/cd2d4fd57d36ab0e4bc6cca12eefad3c38e46df6964fa6e70534e8f66ef6209a.elf	upx
static1/unpack001/ded0b3101d0cf256b0a87535dd5d006176c0aa59c023bfbd2c6eac4fc6f0d40b.elf	upx
static1/unpack001/e180555303654e1f2b1c0337521988fdccc795a2d6ab246c9b50fee7b98f3012.elf	upx
static1/unpack001/f510c5adad382a960167228ddd818c4599a96a7cea5f0ac37cdb9f57f97692c4.elf	upx

Declares services with permission to bind to the system 3 IoCs

Processes:

description	ioc
Required by telecom connection services to bind with the system. Allows apps to manage phone call aspects such as call setup and notifications.	android.permission.BIND_TELECOM_CONNECTION_SERVICE
Required by remote views services to bind with the system. Allows apps to share and display views across different processes.	android.permission.BIND_REMOTEVIEWS
Required by chooser target services to bind with the system. Allows apps to modify targets that handle user actions.	android.permission.BIND_CHOOSER_TARGET_SERVICE

Requests dangerous framework permissions 24 IoCs

Processes:

description	ioc
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Required to be able to advertise and connect to nearby devices via Wi-Fi.	android.permission.NEARBY_WIFI_DEVICES
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to access any geographic locations persisted in the user's shared collection.	android.permission.ACCESS_MEDIA_LOCATION
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read audio files from external storage.	android.permission.READ_MEDIA_AUDIO
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read video files from external storage.	android.permission.READ_MEDIA_VIDEO
Allows an application to read image or video files from external storage that a user has selected via the permission prompt photo picker.	android.permission.READ_MEDIA_VISUAL_USER_SELECTED
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
static1/unpack003/out.upx	autoit_exe
static1/unpack001/717d6956f37bcd29a3f05cb5439f875b31729d4bece0a0d0bd3ad59ba572fd5d.exe	autoit_exe

Detects Pyinstaller 1 IoCs

pyinstaller

Processes:

resource	yara_rule
static1/unpack001/ec4949fff4b4320c7b50929a7d72b90fc1ca703d39c7819f31ec95a8e7e91ed7.exe	pyinstaller

Unsigned PE 71 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/068428a4acb65807251b3b4c0aee2101519fdaebf6db5376863da5add3471f26.exe
unpack001/0d9bd2ae2e4b023047b6c08684e9e5daae76e31cced4c3fdf4640136245f7eea.exe
unpack003/out.upx
unpack001/0fa00d4f4f8e8449883aef7f0459a0fb754d57d55af2b41f5e445f867000fa70.exe
unpack001/16e81343ecea6082d76bf1ab26818c3bf56929c92468fae8837c6384b62d05a5.exe
unpack001/17c24104e8e5350eeb7e2a162dec3f6a4d6c70f3f0849e6346fd383d998dcc12.exe
unpack007/$PLUGINSDIR/AccessControl.dll
unpack007/$PLUGINSDIR/nsProcess.dll
unpack007/CommandPost.exe
unpack007/Uninstall.exe
unpack001/1816cd993ddda970b791b090e6ecb501ef923bdcc0cc5f4a99e18dcdb7093228.exe
unpack001/2b5bf75c0aede1169e7aa2b4c760b1852f34990d5b8ce27ca2fa21efa35e0635.exe
unpack001/2e48ee0fb3ddd63efeecd900a9d2bde365e2fe1fcbb3c43c882362ae935c5066.exe
unpack001/2e4d8723602c5ffc6409dceb0cb4ced2e749e374a0fcd41fe92e0fd50f817c5b.exe
unpack001/31b6a608393ad6cadd7eadf286795aef37260c9b99e837f1d7a1aa4e9a7f901b.exe
unpack001/320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.exe
unpack001/38236f53a4ebd47d951837540ec9d965c21f15816de7dbd3291624ffbaaf506c.exe
unpack001/382c9aa9b4ec7137d69ebc20fe58b83acbb8bf0bce324d10fb58aba91b805c9f.exe
unpack001/385aeb4409a86678ca21a745b04350d1dd8593cec972d77524f83323b9160fa7.exe
unpack001/3b7b020f8ce69d4b810468c03b4bfd1cc6e56080c7b754cafebfd4ba500c7855.exe
unpack001/3c187ba3a074078ac5edd0382992f66e784eb26faff2fbd55b97b1d0b0740ae9.exe
unpack001/403237121c807d41f44f036f65336713a673d5b98756abe86faa5e883a068ea7.exe
unpack001/462113bece051066dcdbeda693499e8d79f439e30cd6daf3dd089ea1e42fd35a.exe
unpack001/4744b94d6954de78dc1394d5f1f8f4dce2179eae5b8d453f99d8adf93a3eb9a9.exe
unpack001/4a0007763fc1a326967ad2400f16fecdd8d540258dcbb555345d9a4e02092bb5.exe
unpack001/4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe
unpack001/51787c72e5315249cc7625f28609f16211a3774cbe839fe0df550bcaf3a27c56.exe
unpack001/547c07702129ea5e0ae2fb48e841c74ce957a4fa3f1c3742e588fe84c494232b.exe
unpack001/57bfb1ccdc00493daf0987426bc3744bfcc0f2777b78594e840832a776b32a9f.exe
unpack001/5ecf0dade29bc4365035554275d07a72b112d0b6bc7487cef6a1c40ed50ea28e.exe
unpack001/609ef2b560381e8385a71a4a961afc94a1e1d19352414a591cd05217e9314625.exe
unpack001/60f45dc57494e24ac5676556834ad9c30fc889bd9cceed706a4c4546e593cfa9.exe
unpack001/63c666636e07e95e5e56ccb4e92db6dc350986bc4fcb401975dbae538aa73d15.dll
unpack001/679d5cdadcc48fa79574ce12e8d0fd2e19823dc4b7e39a84b5b286672f45a72d.exe
unpack001/6ce6fd56b675cb8ffc6e5ecb11bb80640e24e58a09985f8a4f635ee9c3c2bf97.exe
unpack001/6dc7164ea78b8668d8a1492d543f24a9edaaad990403f4451c546a0d4115a3bd.exe
unpack001/6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957.exe
unpack001/717d6956f37bcd29a3f05cb5439f875b31729d4bece0a0d0bd3ad59ba572fd5d.exe
unpack001/72e63f73ced48b29f196e48030215273a17f7827c310f2747321cbc1f388c206.exe
unpack001/768ea7c6f1285d70a63d32bbd3f3a0e9c530fdbd1c16e10672c42485e35bc077.exe
unpack001/7822fa6c35cbd1cfb95c780970deef14d8b53c62ade3a4bcf63c494c3f2e5bbd.exe
unpack001/8058db39c9c75269344ca81e210acb61595abf9b3e4e7a67ec380ba9ba756400.exe
unpack001/8724a46a073a1f2395ca1d288d9e54364f286e69fba1b1606a17bb87c6bab2b3.exe
unpack001/8e28a0090832a76cf71c417cb1bf7990b9af86be258b732117a47f624387083c.exe
unpack001/92bb1f19f3a6337be028edfb89c898d49927cbb732f94796251c70d29e8ba9e1.exe
unpack001/956f3fe2d9989f0269cd72c70c00468a6f6dea368871a9745ba3836ec3a162c9.exe
unpack001/99e64babb02ebc1d5b30582b30d0fbe153cc33ebcc55dd382f9dce4abfe76ed0.exe
unpack001/a5d8c237485f07aae4b3e174009cd4d2f848a1bd3c98be4f33cd77f6c24572d4.exe
unpack001/a650788cbf36edbdae7bb666d8518c9766d22fa009a288de6127fd67a03d3687.exe
unpack001/a8c8ccccf9766d3bcd5dd78d4ae5a64aec55f961b8f3cf2bef74b4aef48422a3.exe
unpack001/a8cc7d8092e02077f21bf65badf8871748630912e3738a2410ff5cd18ead2fbb.exe
unpack001/ad8a91a51631f9084a5d6e95b621530de757b15aa2ae5efef2ca89cae6c4e8d6.exe
unpack001/af6208c1ff499c7748dd133582093281a7084e6828178dbaaea88b55a9a833a8.exe
unpack001/b1ffedb752d53a9bac21cb82ba09c524fc4831670b3e9cbbe3ad375c9b153083.exe
unpack001/bd817f08b4b45d7a6edcbf36a7149648bb61eb4bca360a3ecf6b21c1e8fc7519.exe
unpack001/c0b4860057005ee1549b38ec8c27f1ac5c7888d4deafdacf9a7698c3edf378f7.exe
unpack001/c5c3c6fc136b01b4c88c7f70afc99fe20fdeaf6292570946acd2c315a7a5e119.exe
unpack001/d89e00734a9bab127b81271423595b2fc6cc7e69020035a3696f472d42cc22d2.exe
unpack001/daada19cab8e9cf064bfe1b219398dfa5ed5fe45832bfef1d5f284be93b4347d.exe
unpack001/dd7e94e3adb6ccf95559adf51a9f0234763f972fd6480d7cf23916bdc1549507.exe
unpack001/de00660d0d96ff67cb8e89a8d8525567327b109bc54b9042e5fdd516dcc0e51a.exe
unpack001/dec9918265c77439780f448c5b6b06d8919ad2b7a23d714c25ab08a494df5340.exe
unpack001/dfde7c566bce1a75aff9f68348058a6986e8376d5b4dbea5cd62310e0c154d5e.exe
unpack001/e0acb3c17aac695ada5fd83580506ffa0e6972bd8551e961c3f7b6ecc22dc793.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
static1/unpack001/a7ab5280efdd1f09f7c15daafa507b5a889e30cb9bfa0060ae5cf29a64c9d410.exe	nsis_installer_1
static1/unpack001/a7ab5280efdd1f09f7c15daafa507b5a889e30cb9bfa0060ae5cf29a64c9d410.exe	nsis_installer_2

Files

7d69e0d82e74059115486fae5dd5ac6463c7fccd91dbbcaa9587117c7d201ddb
.zip

Password: infected
0490e8427ac66951389e11dbd990c19cb1ee43102c33935b12db6a4eca7717c7.elf
.elf linux
068428a4acb65807251b3b4c0aee2101519fdaebf6db5376863da5add3471f26.exe
.exe windows:6 windows x64 arch:x64

Password: infected

5929190c8765f5bc37b052ab5c6c53e7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AddAtomA
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileA
CreateIoCompletionPort
CreateMutexA
CreateSemaphoreA
CreateThread
CreateWaitableTimerExW
DeleteAtom
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FindAtomA
FormatMessageA
FreeEnvironmentStringsW
GetAtomNameA
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetErrorMode
GetHandleInformation
GetLastError
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
RaiseFailFastException
ReleaseMutex
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetLastError
SetProcessAffinityMask
SetProcessPriorityBoost
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WerGetFlags
WerSetFlags
WideCharToMultiByte
WriteConsoleW
WriteFile
__C_specific_handler

msvcrt

___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthread
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_fmode
_initterm
_lock
_memccpy
_onexit
_setjmp
_strdup
_ultoa
_unlock
abort
calloc
exit
fprintf
fputc
free
fwrite
localeconv
longjmp
malloc
memcpy
memmove
memset
printf
realloc
signal
strerror
strlen
strncmp
vfprintf
wcslen

Exports

Exports

_cgo_dummy_export

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 158KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 354KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 78B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
087421ac222e935579dfd3b7a5120451fd9d9a663d3d1872c04b6154b238c894.elf
.elf linux mipsel
0c4791a6b47491a0c43cea0ba54357e391a3c8b23aa28025489bbe43bb9ea6ea.elf
.elf linux arm
0d9bd2ae2e4b023047b6c08684e9e5daae76e31cced4c3fdf4640136245f7eea.exe
.exe windows:5 windows x86 arch:x86

Password: infected

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 644KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 264KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 201KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 514KB - Virtual size: 513KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 209KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0fa00d4f4f8e8449883aef7f0459a0fb754d57d55af2b41f5e445f867000fa70.exe
.dll windows:6 windows x64 arch:x64

Password: infected

5304b37e58964835f00e3b016aebe4ef

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetVolumeInformationW
FindFirstFileW
FindNextFileW
WriteFile
TerminateProcess
GetModuleFileNameW
GetDynamicTimeZoneInformation
PeekNamedPipe
CreateMutexW
FindClose
WaitForSingleObject
CreateFileW
GetSystemDirectoryW
GetLogicalDriveStringsW
MultiByteToWideChar
Sleep
GetLastError
ReadFile
LoadLibraryW
GetProcAddress
GetFileSize
ExitProcess
GetComputerNameW
CreateProcessW
CopyFileW
GetComputerNameA
GetCurrentThreadId
TerminateThread
CreateThread
OpenThread
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetStartupInfoW
CloseHandle
CreateDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
HeapAlloc
HeapFree
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP

user32

wsprintfA
CharUpperW

shell32

SHGetFolderPathW

crypt32

CryptStringToBinaryA
CryptBinaryToStringA

Exports

Exports

DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
EnumDirTree
EnumDirTreeW
EnumerateLoadedModules
EnumerateLoadedModules64
EnumerateLoadedModulesEx
EnumerateLoadedModulesExW
EnumerateLoadedModulesW64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindDebugInfoFileExW
FindExecutableImage
FindExecutableImageEx
FindExecutableImageExW
FindFileInPath
FindFileInSearchPath
GetSymLoadError
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MiniDumpReadDumpStream
MiniDumpWriteDump
RangeMapAddPeImageSections
RangeMapCreate
RangeMapFree
RangeMapRead
RangeMapRemove
RangeMapWrite
RemoveInvalidModuleList
ReportSymbolLoadSummary
SearchTreeForFile
SearchTreeForFileW
SetCheckUserInterruptShared
SetSymLoadError
StackWalk
StackWalk64
StackWalkEx
SymAddSourceStream
SymAddSourceStreamA
SymAddSourceStreamW
SymAddSymbol
SymAddSymbolW
SymAddrIncludeInlineTrace
SymAllocDiaString
SymCleanup
SymCompareInlineTrace
SymDeleteSymbol
SymDeleteSymbolW
SymEnumLines
SymEnumLinesW
SymEnumProcesses
SymEnumSourceFileTokens
SymEnumSourceFiles
SymEnumSourceFilesW
SymEnumSourceLines
SymEnumSourceLinesW
SymEnumSym
SymEnumSymbols
SymEnumSymbolsEx
SymEnumSymbolsExW
SymEnumSymbolsForAddr
SymEnumSymbolsForAddrW
SymEnumSymbolsW
SymEnumTypes
SymEnumTypesByName
SymEnumTypesByNameW
SymEnumTypesW
SymEnumerateModules
SymEnumerateModules64
SymEnumerateModulesW64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindDebugInfoFile
SymFindDebugInfoFileW
SymFindExecutableImage
SymFindExecutableImageW
SymFindFileInPath
SymFindFileInPathW
SymFreeDiaString
SymFromAddr
SymFromAddrW
SymFromIndex
SymFromIndexW
SymFromInlineContext
SymFromInlineContextW
SymFromName
SymFromNameW
SymFromToken
SymFromTokenW
SymFunctionTableAccess
SymFunctionTableAccess64
SymFunctionTableAccess64AccessRoutines
SymGetDiaSession
SymGetExtendedOption
SymGetFileLineOffsets64
SymGetHomeDirectory
SymGetHomeDirectoryW
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromAddrEx
SymGetLineFromAddrW64
SymGetLineFromInlineContext
SymGetLineFromInlineContextW
SymGetLineFromName
SymGetLineFromName64
SymGetLineFromNameEx
SymGetLineFromNameW64
SymGetLineNext
SymGetLineNext64
SymGetLineNextEx
SymGetLineNextW64
SymGetLinePrev
SymGetLinePrev64
SymGetLinePrevEx
SymGetLinePrevW64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOmapBlockBase
SymGetOmaps
SymGetOptions
SymGetScope
SymGetScopeW
SymGetSearchPath
SymGetSearchPathW
SymGetSourceFile
SymGetSourceFileChecksum
SymGetSourceFileChecksumW
SymGetSourceFileFromToken
SymGetSourceFileFromTokenW
SymGetSourceFileToken
SymGetSourceFileTokenW
SymGetSourceFileW
SymGetSourceVarFromToken
SymGetSourceVarFromTokenW
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetSymbolFile
SymGetSymbolFileW
SymGetTypeFromName
SymGetTypeFromNameW
SymGetTypeInfo
SymGetTypeInfoEx
SymGetUnwindInfo
SymInitialize
SymInitializeW
SymLoadModule
SymLoadModule64
SymLoadModuleEx
SymLoadModuleExW
SymMatchFileName
SymMatchFileNameW
SymMatchString
SymMatchStringA
SymMatchStringW
SymNext
SymNextW
SymPrev
SymPrevW
SymQueryInlineTrace
SymRefreshModuleList
SymRegisterCallback
SymRegisterCallback64
SymRegisterCallbackW64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymSearch
SymSearchW
SymSetContext
SymSetDiaSession
SymSetExtendedOption
SymSetHomeDirectory
SymSetHomeDirectoryW
SymSetOptions
SymSetParentWindow
SymSetScopeFromAddr
SymSetScopeFromIndex
SymSetScopeFromInlineContext
SymSetSearchPath
SymSetSearchPathW
SymSrvDeltaName
SymSrvDeltaNameW
SymSrvGetFileIndexInfo
SymSrvGetFileIndexInfoW
SymSrvGetFileIndexString
SymSrvGetFileIndexStringW
SymSrvGetFileIndexes
SymSrvGetFileIndexesW
SymSrvGetSupplement
SymSrvGetSupplementW
SymSrvIsStore
SymSrvIsStoreW
SymSrvStoreFile
SymSrvStoreFileW
SymSrvStoreSupplement
SymSrvStoreSupplementW
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnDecorateSymbolNameW
WinDbgExtensionDllInit
WinNextCheckIfConfigIsAttributionWorthy
_EFN_DumpImage
block
chksym
dbghelp
dh
fptr
homedir
inlinedbg
itoldyouso
lmi
lminfo
omap
optdbgdump
optdbgdumpaddr
srcfiles
stack_force_ebp
stackdbg
sym
symsrv
vc7fpo

Sections

.text
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat
.bat .vbs
11571917015adbf3b5196509e1082c8d415f011cce88bd8b16e9d9c5a39ac432.exe
.exe windows:4 windows x86 arch:x86

Password: infected

b5a014d7eeb4c2042897567e1288a095

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:ad:e4:6d:b0:2a:2f:78:46:2a:29:37:27:e8:d8:74
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12-03-2021 00:00

Not After

08-06-2024 23:59

Subject

CN=Trend Micro\, Inc.,O=Trend Micro\, Inc.,L=Da’an District,ST=Taipei City,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

16-04-2020 18:36

Not After

16-04-2045 18:44

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:2a:56:3b:36:cd:48:0f:a3:a4:09:00:00:00:00:2a:56
Certificate

Issuer

CN=Microsoft ID Verified CS EOC CA 02,O=Microsoft Corporation,C=US

Not Before

20-09-2023 14:08

Not After

23-09-2023 14:08

Subject

CN=Trend Micro\, Inc.,O=Trend Micro\, Inc.,L=Taipei,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:2a:56:3b:36:cd:48:0f:a3:a4:09:00:00:00:00:2a:56
Certificate

Issuer

CN=Microsoft ID Verified CS EOC CA 02,O=Microsoft Corporation,C=US

Not Before

20-09-2023 14:08

Not After

23-09-2023 14:08

Subject

CN=Trend Micro\, Inc.,O=Trend Micro\, Inc.,L=Taipei,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:05:fb:7a:5c:32:13:61:df:5d:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Not Before

13-04-2021 17:31

Not After

13-04-2026 17:31

Subject

CN=Microsoft ID Verified CS EOC CA 02,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

01-04-2021 20:05

Not After

01-04-2036 20:15

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

19-11-2020 20:32

Not After

19-11-2035 20:42

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:27:af:ad:af:67:15:26:b8:e3:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Not Before

06-04-2023 18:44

Not After

04-04-2024 18:44

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7800-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

f1:f4:7a:b6:b0:5a:e3:44:7f:61:bc:4c:71:32:24:72:ff:16:8f:ae:fa:73:6b:34:c8:9a:15:29:ee:ef:1f:03
Signer

Actual PE Digest

f1:f4:7a:b6:b0:5a:e3:44:7f:61:bc:4c:71:32:24:72:ff:16:8f:ae:fa:73:6b:34:c8:9a:15:29:ee:ef:1f:03

Digest Algorithm

sha256

PE Digest Matches

false

f1:f4:7a:b6:b0:5a:e3:44:7f:61:bc:4c:71:32:24:72:ff:16:8f:ae:fa:73:6b:34:c8:9a:15:29:ee:ef:1f:03
Signer

Actual PE Digest

f1:f4:7a:b6:b0:5a:e3:44:7f:61:bc:4c:71:32:24:72:ff:16:8f:ae:fa:73:6b:34:c8:9a:15:29:ee:ef:1f:03

Digest Algorithm

sha256

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17

kernel32

GetFileAttributesW
CreateDirectoryW
WriteFile
GetStdHandle
VirtualFree
GetModuleHandleW
GetProcAddress
LoadLibraryA
LockResource
LoadResource
SizeofResource
FindResourceExA
MulDiv
GlobalFree
GlobalAlloc
lstrcmpiA
GetSystemDefaultLCID
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
MultiByteToWideChar
GetLocaleInfoW
lstrlenA
lstrcmpiW
GetEnvironmentVariableW
lstrcmpW
GlobalMemoryStatusEx
VirtualAlloc
WideCharToMultiByte
ExpandEnvironmentStringsW
RemoveDirectoryW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
SetThreadLocale
GetLocalTime
GetSystemTimeAsFileTime
lstrlenW
GetTempPathW
SetEnvironmentVariableW
CloseHandle
CreateFileW
GetDriveTypeW
SetCurrentDirectoryW
GetModuleFileNameW
GetCommandLineW
GetVersionExW
CreateEventW
SetEvent
ResetEvent
InitializeCriticalSection
TerminateThread
ResumeThread
SuspendThread
IsBadReadPtr
LocalFree
lstrcpyW
FormatMessageW
GetSystemDirectoryW
DeleteCriticalSection
GetFileSize
SetFilePointer
ReadFile
SetFileTime
SetEndOfFile
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
GetModuleHandleA
SystemTimeToFileTime
GetLastError
CreateThread
WaitForSingleObject
GetExitCodeThread
Sleep
SetLastError
SetFileAttributesW
GetDiskFreeSpaceExW
lstrcatW
ExitProcess
CompareFileTime
GetStartupInfoA

user32

CharUpperW
EndDialog
DestroyWindow
KillTimer
ReleaseDC
DispatchMessageW
GetMessageW
SetTimer
CreateWindowExW
ScreenToClient
GetWindowRect
wsprintfW
GetParent
GetSystemMenu
EnableMenuItem
EnableWindow
MessageBeep
LoadIconW
LoadImageW
wvsprintfW
IsWindow
DefWindowProcW
CallWindowProcW
DrawIconEx
DialogBoxIndirectParamW
GetWindow
ClientToScreen
GetDC
DrawTextW
ShowWindow
SystemParametersInfoW
SetFocus
SetWindowLongW
GetSystemMetrics
GetClientRect
GetDlgItem
GetKeyState
MessageBoxA
wsprintfA
SetWindowTextW
GetSysColor
GetWindowTextLengthW
GetWindowTextW
GetClassNameA
GetWindowLongW
GetMenu
SetWindowPos
CopyImage
SendMessageW
GetWindowDC

gdi32

GetCurrentObject
StretchBlt
SetStretchBltMode
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetObjectW
GetDeviceCaps
DeleteObject
CreateFontIndirectW
DeleteDC

shell32

SHGetFileInfoW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteExW
SHGetSpecialFolderPathW
ShellExecuteW

ole32

CoInitialize
CreateStreamOnHGlobal
CoCreateInstance

oleaut32

VariantClear
OleLoadPicture
SysAllocString

msvcrt

__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
_CxxThrowException
_beginthreadex
_EH_prolog
memset
_wcsnicmp
strncmp
malloc
memmove
_wtol
memcpy
free
memcmp
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
_except_handler3
_controlfp

Sections

.text
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
16e81343ecea6082d76bf1ab26818c3bf56929c92468fae8837c6384b62d05a5.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 183KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
17691f0962027e7110f727ae997f8af5885dd783674d1db023d467ec478515b7.elf
.elf linux mipsel
17c24104e8e5350eeb7e2a162dec3f6a4d6c70f3f0849e6346fd383d998dcc12.exe
.exe windows:4 windows x86 arch:x86

Password: infected

61259b55b8912888e90f516ca08dc514

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW

shell32

SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 152KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/AccessControl.dll
.dll windows:4 windows x86 arch:x86

Password: infected

6b225baf8d24583523d4f42890e12522

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
CloseHandle
lstrlenW
lstrcatW
lstrcmpiW
GetFileAttributesW
LocalAlloc
LoadLibraryA
GetCurrentProcess
GetProcAddress
lstrcpyW
GetLastError
LocalFree
GlobalFree
lstrcpynW

user32

wsprintfW

advapi32

GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSidSubAuthority
RegCloseKey
OpenProcessToken
RegGetKeySecurity
LookupAccountSidW
GetSidIdentifierAuthority
AdjustTokenPrivileges
LookupPrivilegeValueW
SetNamedSecurityInfoW
SetSecurityDescriptorDacl
RegOpenKeyExW
RegSetKeySecurity
IsValidSid
GetSecurityDescriptorDacl
GetUserNameW
GetNamedSecurityInfoW
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
GetSidSubAuthorityCount
InitializeSecurityDescriptor
LookupAccountNameW
SetEntriesInAclW

Exports

Exports

ClearOnFile
ClearOnRegKey
DenyOnFile
DenyOnRegKey
DisableFileInheritance
DisableRegKeyInheritance
EnableFileInheritance
EnableRegKeyInheritance
GetCurrentUserName
GetFileGroup
GetFileOwner
GetRegKeyGroup
GetRegKeyOwner
GrantOnFile
GrantOnRegKey
NameToSid
RevokeOnFile
RevokeOnRegKey
SetFileGroup
SetFileOwner
SetOnFile
SetOnRegKey
SetRegKeyGroup
SetRegKeyOwner
SidToName

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/nsProcess.dll
.dll windows:5 windows x86 arch:x86

Password: infected

a49b0342971aa199fc6349725b90146d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
TerminateProcess
WaitForSingleObject
GetExitCodeProcess
OpenProcess
lstrcpynA
lstrlenA
LoadLibraryA
lstrcmpiA
WideCharToMultiByte
FreeLibrary
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryW
GetVersionExA
GlobalFree
GlobalAlloc

user32

GetWindowThreadProcessId
EnumWindows
wsprintfA
PostMessageA

Exports

Exports

_CloseProcess
_FindProcess
_KillProcess
_Unload

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 910B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 250B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CommandPost.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\admin\source\repos\CommandPost\CommandPost\obj\Release\CommandPost.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 7.8MB - Virtual size: 7.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Uninstall.exe
.exe windows:4 windows x86 arch:x86

61259b55b8912888e90f516ca08dc514

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW

shell32

SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 152KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
icon.ico
1816cd993ddda970b791b090e6ecb501ef923bdcc0cc5f4a99e18dcdb7093228.exe
.exe windows:6 windows x86 arch:x86

e569e6f445d32ba23766ad67d1e3787f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetACP
GetExitCodeProcess
LocalFree
CloseHandle
SizeofResource
VirtualProtect
VirtualFree
GetFullPathNameW
ExitProcess
HeapAlloc
GetCPInfoExW
RtlUnwind
GetCPInfo
GetStdHandle
GetModuleHandleW
FreeLibrary
HeapDestroy
ReadFile
CreateProcessW
GetLastError
GetModuleFileNameW
SetLastError
FindResourceW
CreateThread
CompareStringW
LoadLibraryA
ResetEvent
GetVersion
RaiseException
FormatMessageW
SwitchToThread
GetExitCodeThread
GetCurrentThread
LoadLibraryExW
LockResource
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
VirtualQueryEx
Sleep
EnterCriticalSection
SetFilePointer
LoadResource
SuspendThread
GetTickCount
GetFileSize
GetStartupInfoW
GetFileAttributesW
InitializeCriticalSection
GetSystemWindowsDirectoryW
GetThreadPriority
SetThreadPriority
GetCurrentProcess
VirtualAlloc
GetSystemInfo
GetCommandLineW
LeaveCriticalSection
GetProcAddress
ResumeThread
GetVersionExW
VerifyVersionInfoW
HeapCreate
GetWindowsDirectoryW
VerSetConditionMask
GetDiskFreeSpaceW
FindFirstFileW
GetUserDefaultUILanguage
lstrlenW
QueryPerformanceCounter
SetEndOfFile
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
CreateFileW
GetLocaleInfoW
GetSystemDirectoryW
DeleteFileW
GetLocalTime
GetEnvironmentVariableW
WaitForSingleObject
WriteFile
ExitThread
DeleteCriticalSection
TlsGetValue
GetDateFormatW
SetErrorMode
IsValidLocale
TlsSetValue
CreateDirectoryW
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
GetUserDefaultLangID
RemoveDirectoryW
CreateEventW
SetThreadLocale
GetThreadLocale

comctl32

InitCommonControls

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

user32

CreateWindowExW
TranslateMessage
CharLowerBuffW
CallWindowProcW
CharUpperW
PeekMessageW
GetSystemMetrics
SetWindowLongW
MessageBoxW
DestroyWindow
CharUpperBuffW
CharNextW
MsgWaitForMultipleObjects
LoadStringW
ExitWindowsEx
DispatchMessageW

oleaut32

SysAllocStringLen
SafeArrayPtrOfIndex
VariantCopy
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
VariantClear
SysFreeString
SysReAllocStringLen
VariantChangeType
SafeArrayCreate

netapi32

NetWkstaGetInfo
NetApiBufferFree

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
AdjustTokenPrivileges
GetTokenInformation
ConvertSidToStringSidW
LookupPrivilegeValueW
RegCloseKey
OpenProcessToken
RegOpenKeyExW

Exports

Exports

TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr

Sections

.text
Size: 718KB - Virtual size: 718KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 27KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 154B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 93B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
1b8cda768ba75d723b2b0b34cf955f7ec9469b4e33c6fde6494eefd60a139d8a.elf
.elf linux arm
1df6acbc1106e17265fde3ab54b2a83fa8f6f39656d7c55481b2dbd66f1114b7.elf
.elf linux
1e7706ed0492572474cd866f13778cc66c42b614b3d0b1d9af35727c051a50b0.elf
.elf linux
1f580428fa8afd15832fcd04f5d6832be9f7a7144ff17e19c89d2b07e7f51f2c.elf
.elf linux arm
257fc477b9684863e0822cbad3606d76c039be8dd51cdc13b73e74e93d7b04cc.elf
.elf linux x64
262a10ee377a4945ce30e115e2ab1bf9ff2fc0f35741bbb72e40f145de24bd50.elf
.elf linux ppc
267909cf4a62955a35b0fe013afbfd62d7ae1a1eef6d7a24d7ce50db52d48ce7.bat
2796760675e5efbef0319f0285c2e1d07c11b038311c02e16c2407ba57c38413.elf
.elf linux
27cd090cf83877750416d37dc6ddd8ff319b4854414e4275d67f96652376bcf0.zip
.zip
27e181c699f14c3e53cabc89941ac40917165cc4be34d2c7f9d6eca0e16b508c.elf
.elf linux
2b4b073178b573aa181fdc6e8063c778c90f76235d640c186b99278186509e74.elf
.elf linux mipsbe
2b5bf75c0aede1169e7aa2b4c760b1852f34990d5b8ce27ca2fa21efa35e0635.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 181KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 170KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
2bac99f5be34b649749a4ce8ab7c8103f9dce863cbc490f273c27297b2c465ec.elf
.elf linux sparc
2cfeefaa133519defee56f4253c7c7f2396d784ed8e09d2212ab5bee6cf52b50.elf
.elf linux
2e48ee0fb3ddd63efeecd900a9d2bde365e2fe1fcbb3c43c882362ae935c5066.exe
.exe windows:4 windows x86 arch:x86

56a78d55f3f7af51443e58e0ce2fb5f6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW

shell32

SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
CreateFileW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
2e4d8723602c5ffc6409dceb0cb4ced2e749e374a0fcd41fe92e0fd50f817c5b.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
31b6a608393ad6cadd7eadf286795aef37260c9b99e837f1d7a1aa4e9a7f901b.exe
.exe windows:5 windows x86 arch:x86

6c17cd221979c51b4b1f1bc0b7dc863e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\noyiworerew.pdb

Imports

kernel32

SetThreadContext
GetConsoleAliasesLengthW
GetLocaleInfoA
GlobalAddAtomA
GetConsoleAliasA
QueryDosDeviceA
_lcreat
MoveFileWithProgressA
GetNumberFormatA
ReadConsoleW
GetConsoleCP
GetVolumeInformationA
GlobalFindAtomA
InitializeCriticalSectionAndSpinCount
ReadConsoleInputA
FindNextVolumeW
WriteConsoleW
FileTimeToSystemTime
FindResourceA
GetTempPathW
GetLastError
ChangeTimerQueueTimer
SetLastError
GetProcAddress
LoadLibraryA
InterlockedExchangeAdd
LocalAlloc
FindFirstVolumeMountPointW
RemoveDirectoryW
VirtualLock
GetModuleFileNameA
GetCurrentDirectoryA
GetWindowsDirectoryW
GetStringTypeW
OutputDebugStringW
FlushFileBuffers
CreateFileA
GetNumaNodeProcessorMask
ExitThread
GetEnvironmentVariableW
IsProcessorFeaturePresent
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineW
RaiseException
RtlUnwind
IsDebuggerPresent
HeapSize
HeapFree
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
WriteFile
GetModuleFileNameW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
GetProcessHeap
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
LCMapStringW
GetConsoleMode
SetFilePointerEx
SetStdHandle
CreateFileW

user32

CharUpperBuffA
DrawCaption

gdi32

SetTextColor

advapi32

ReadEventLogW

Sections

.text
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 192KB - Virtual size: 41.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.exe
.exe windows:1 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
3476006a8f64bfe72a8b04477f6005293b5854cfbc58bee2ea28e59b58f0e316.apk
.apk android arch:arm64 arch:arm

com.fmwhatsapp

com.fmwhatsapp.settings.SettingsNotifications

Activities

com.fmwhatsapp.migration.export.ui.ExportMigrationActivity

com.fmwhatsapp.intent.action.migrate.ios.START

com.fmwhatsapp.HomeActivity

android.nfc.action.NDEF_DISCOVERED
android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.VIEW

com.fmwhatsapp.payments.receiver.IndiaUpiPayIntentReceiverActivity

android.intent.action.VIEW

com.fmwhatsapp.Conversation

android.intent.action.VIEW
android.intent.action.SENDTO
com.fmwhatsapp.Conversation

com.fmwhatsapp.registration.VerifyPhoneNumber

android.intent.action.VIEW

com.fmwhatsapp.registration.MaacGrantConsentActivity

com.fmwhatsapp.intent.action.maac.consent

com.fmwhatsapp.contact.picker.ContactPicker

android.intent.action.PICK
android.intent.action.SEND
android.intent.action.SEND_MULTIPLE
android.intent.action.CREATE_SHORTCUT

com.fmwhatsapp.settings.SettingsNotifications

android.intent.action.MAIN

com.fmwhatsapp.settings.SettingsDataUsageActivity

android.intent.action.MANAGE_NETWORK_USAGE

com.whatsapp.stickers.thirdparty.AddThirdPartyStickerPackActivity

com.whatsapp.intent.action.ENABLE_STICKER_PACK

com.fmwhatsapp.accountsync.LoginActivity

android.intent.action.VIEW

com.fmwhatsapp.accountsync.ProfileActivity

android.intent.action.VIEW

com.fmwhatsapp.accountsync.CallContactLandingActivity

android.intent.action.VIEW

com.fmwhatsapp.authentication.AppAuthenticationActivity

android.appwidget.action.APPWIDGET_CONFIGURE

com.fmwhatsapp.identity.IdentityVerificationActivity

android.nfc.action.NDEF_DISCOVERED

com.fmwhatsapp.identity.ScanQrCodeActivity

android.nfc.action.NDEF_DISCOVERED

com.fmwhatsapp.camera.CameraActivity

android.intent.action.CREATE_SHORTCUT

com.fmwhatsapp.waquickpromotionclient.ui.PushPsaNotificationActivity

com.fmwhatsapp.waquickpromotionclient.ui.PushPsaNotificationAction

com.fmwhatsapp.Main

android.intent.action.MAIN

com.fmwhatsapp.VoiceMessagingActivity

com.google.android.voicesearch.SEND_MESSAGE_TO_CONTACTS

com.fmwhatsapp.xfamily.accountlinking.ui.AccountLinkingWebAuthActivity

android.intent.action.VIEW

androidx.test.core.app.InstrumentationActivityInvoker$BootstrapActivity

android.intent.action.MAIN

androidx.test.core.app.InstrumentationActivityInvoker$EmptyActivity

android.intent.action.MAIN

androidx.test.core.app.InstrumentationActivityInvoker$EmptyFloatingActivity

android.intent.action.MAIN

org.npci.upi.security.pinactivitycomponent.GetCredential

org.npci.upi.security.pinactivitycomponent.GetCredential

Permissions

android.permission.FOREGROUND_SERVICE_DATA_SYNC
android.permission.RECEIVE_SMS
android.permission.SYSTEM_ALERT_WINDOW
android.permission.READ_PHONE_STATE
android.permission.READ_PHONE_NUMBERS
android.permission.VIBRATE
android.permission.ACCESS_NETWORK_STATE
android.permission.FOREGROUND_SERVICE_MICROPHONE
android.permission.FOREGROUND_SERVICE_CAMERA
android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.USE_BIOMETRIC
android.permission.USE_FINGERPRINT
android.permission.SCHEDULE_EXACT_ALARM
android.permission.AUTHENTICATE_ACCOUNTS
android.permission.GET_ACCOUNTS
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.INTERNET
android.permission.NEARBY_WIFI_DEVICES
android.permission.CAMERA
android.permission.RECORD_AUDIO
android.permission.READ_EXTERNAL_STORAGE
android.permission.MANAGE_EXTERNAL_STORAGE
android.permission.MANAGE_OWN_CALLS
android.permission.ACCESS_MEDIA_LOCATION
android.permission.BLUETOOTH
android.permission.BROADCAST_STICKY
android.permission.CHANGE_NETWORK_STATE
android.permission.FOREGROUND_SERVICE_LOCATION
android.permission.GET_TASKS
android.permission.INSTALL_SHORTCUT
android.permission.MANAGE_ACCOUNTS
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.NFC
android.permission.READ_CONTACTS
android.permission.READ_PROFILE
android.permission.READ_SYNC_SETTINGS
android.permission.READ_SYNC_STATS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.SEND_SMS
android.permission.USE_CREDENTIALS
android.permission.WAKE_LOCK
android.permission.WRITE_CONTACTS
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_MEDIA_AUDIO
android.permission.READ_MEDIA_IMAGES
android.permission.READ_MEDIA_VIDEO
android.permission.READ_MEDIA_VISUAL_USER_SELECTED
android.permission.POST_NOTIFICATIONS
android.permission.WRITE_SYNC_SETTINGS
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.FOREGROUND_SERVICE
android.permission.USE_FULL_SCREEN_INTENT
com.android.launcher.permission.INSTALL_SHORTCUT
com.android.launcher.permission.UNINSTALL_SHORTCUT
com.google.android.c2dm.permission.RECEIVE
com.google.android.gms.permission.AD_ID
com.google.android.providers.gsf.permission.READ_GSERVICES
com.sec.android.provider.badge.permission.READ
com.sec.android.provider.badge.permission.WRITE
com.htc.launcher.permission.READ_SETTINGS
com.htc.launcher.permission.UPDATE_SHORTCUT
com.sonyericsson.home.permission.BROADCAST_BADGE
com.sonymobile.home.permission.PROVIDER_INSERT_BADGE
com.huawei.android.launcher.permission.READ_SETTINGS
com.huawei.android.launcher.permission.WRITE_SETTINGS
com.huawei.android.launcher.permission.CHANGE_BADGE
com.fmwhatsapp.permission.BROADCAST
com.fmwhatsapp.permission.MAPS_RECEIVE
com.fmwhatsapp.permission.REGISTRATION
com.whatsapp.sticker.READ
com.facebook.services.identity.FEO2
com.fmwhatsapp.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
android.permission.REORDER_TASKS
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

Receivers

com.fmwhatsapp.registration.RegRetryVerificationReceiver

com.fmwhatsapp.alarm.REGISTRATION_RETRY

com.fmwhatsapp.migration.android.api.DeferredRestoreBroadcastReceiver

com.google.android.apps.pixelmigrate.IOS_APP_DATA_AVAILABLE

com.fmwhatsapp.otp.OtpRequestedReceiver

com.fmwhatsapp.otp.OTP_REQUESTED

com.fmwhatsapp.otp.OtpIdentityHashRequestedReceiver

com.fmwhatsapp.otp.ID_HASH_REQUESTED

com.fmwhatsapp.registration.RegistrationCompletedReceiver

com.fmwhatsapp.SMBRegistrationCompleted

com.fmwhatsapp.accountswitching.notifications.InactiveAccountNotificationReceiver

com.fmwhatsapp.accountswitching.inactiveaccount.IgnoreCall

com.fmwhatsapp.ExternalMediaManager$ExternalMediaStateReceiver

android.intent.action.MEDIA_BAD_REMOVAL
android.intent.action.MEDIA_EJECT
android.intent.action.MEDIA_MOUNTED
android.intent.action.MEDIA_REMOVED
android.intent.action.MEDIA_SHARED
android.intent.action.MEDIA_UNMOUNTED

com.fmwhatsapp.appwidget.WidgetProvider

android.appwidget.action.APPWIDGET_UPDATE

com.fmwhatsapp.registration.directmigration.MigrationProviderOrderedBroadcastReceiver

com.fmwhatsapp.registration.directmigration.initialMigrationInfoAction
com.fmwhatsapp.registration.directmigration.recoveryTokenAction
com.fmwhatsapp.registration.directmigration.setMigrationStateOnProviderSide

com.fmwhatsapp.registration.directmigration.MigrationRequesterBroadcastReceiver

com.fmwhatsapp.registration.directmigration.providerIsLoggedOutAction
com.fmwhatsapp.registration.directmigration.providerAppMigrationSpaceNeededAction

com.fmwhatsapp.accounttransfer.AccountTransferReceiver

com.google.android.gms.auth.START_ACCOUNT_EXPORT

com.fmwhatsapp.push.WAFbnsPreloadReceiver

com.facebook.rti.fbns.intent.RECEIVE

com.fmwhatsapp.phoneid.PhoneIdRequestReceiver

com.facebook.GET_PHONE_ID

com.fmwhatsapp.systemreceivers.boot.BootReceiver

android.intent.action.BOOT_COMPLETED

com.fmwhatsapp.systemreceivers.appupdated.AppUpdatedReceiver

android.intent.action.MY_PACKAGE_REPLACED

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY
android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW
android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

com.fmwhatsapp.yo.WidgetProvider

android.appwidget.action.APPWIDGET_UPDATE

com.fmwhatsapp.yo.autoschedreply.Receiver

android.intent.action.BOOT_COMPLETED

com.fmwhatsapp.yo.FMBackupReceiver

android.intent.action.BOOT_COMPLETED

Services

com.fmwhatsapp.instrumentation.api.InstrumentationService

com.fmwhatsapp.instrumentation.REQUEST

com.fmwhatsapp.contact.sync.ContactsSyncAdapterService

android.content.SyncAdapter

com.fmwhatsapp.accountsync.AccountAuthenticatorService

android.accounts.AccountAuthenticator

com.whatsapp.calling.telecom.SelfManagedConnectionService

android.telecom.ConnectionService

com.fmwhatsapp.wearos.WearOsListenerService

com.google.android.gms.wearable.BIND_LISTENER
com.google.android.gms.wearable.MESSAGE_RECEIVED

com.fmwhatsapp.push.GcmListenerService

com.google.firebase.MESSAGING_EVENT

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

androidx.sharetarget.ChooserTargetServiceCompat

android.service.chooser.ChooserTargetService

org.npci.upi.security.pinactivitycomponent.CLRemoteServiceImpl

org.npci.upi.security.services.CLRemoteService
3545082c16d0e05faad342c614b27793ab0ec940a174ab5162dce1787ea8472e.elf
.elf linux arm
377c3c3679e44acbc13388ca7ec69f2346b321aa42110fc6ee44a44c54d67105.elf
.elf linux x86
38236f53a4ebd47d951837540ec9d965c21f15816de7dbd3291624ffbaaf506c.exe
.exe windows:6 windows x86 arch:x86

e569e6f445d32ba23766ad67d1e3787f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetACP
GetExitCodeProcess
LocalFree
CloseHandle
SizeofResource
VirtualProtect
VirtualFree
GetFullPathNameW
ExitProcess
HeapAlloc
GetCPInfoExW
RtlUnwind
GetCPInfo
GetStdHandle
GetModuleHandleW
FreeLibrary
HeapDestroy
ReadFile
CreateProcessW
GetLastError
GetModuleFileNameW
SetLastError
FindResourceW
CreateThread
CompareStringW
LoadLibraryA
ResetEvent
GetVersion
RaiseException
FormatMessageW
SwitchToThread
GetExitCodeThread
GetCurrentThread
LoadLibraryExW
LockResource
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
VirtualQueryEx
Sleep
EnterCriticalSection
SetFilePointer
LoadResource
SuspendThread
GetTickCount
GetFileSize
GetStartupInfoW
GetFileAttributesW
InitializeCriticalSection
GetSystemWindowsDirectoryW
GetThreadPriority
SetThreadPriority
GetCurrentProcess
VirtualAlloc
GetSystemInfo
GetCommandLineW
LeaveCriticalSection
GetProcAddress
ResumeThread
GetVersionExW
VerifyVersionInfoW
HeapCreate
GetWindowsDirectoryW
VerSetConditionMask
GetDiskFreeSpaceW
FindFirstFileW
GetUserDefaultUILanguage
lstrlenW
QueryPerformanceCounter
SetEndOfFile
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
CreateFileW
GetLocaleInfoW
GetSystemDirectoryW
DeleteFileW
GetLocalTime
GetEnvironmentVariableW
WaitForSingleObject
WriteFile
ExitThread
DeleteCriticalSection
TlsGetValue
GetDateFormatW
SetErrorMode
IsValidLocale
TlsSetValue
CreateDirectoryW
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
GetUserDefaultLangID
RemoveDirectoryW
CreateEventW
SetThreadLocale
GetThreadLocale

comctl32

InitCommonControls

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

user32

CreateWindowExW
TranslateMessage
CharLowerBuffW
CallWindowProcW
CharUpperW
PeekMessageW
GetSystemMetrics
SetWindowLongW
MessageBoxW
DestroyWindow
CharUpperBuffW
CharNextW
MsgWaitForMultipleObjects
LoadStringW
ExitWindowsEx
DispatchMessageW

oleaut32

SysAllocStringLen
SafeArrayPtrOfIndex
VariantCopy
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
VariantClear
SysFreeString
SysReAllocStringLen
VariantChangeType
SafeArrayCreate

netapi32

NetWkstaGetInfo
NetApiBufferFree

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
AdjustTokenPrivileges
GetTokenInformation
ConvertSidToStringSidW
LookupPrivilegeValueW
RegCloseKey
OpenProcessToken
RegOpenKeyExW

Exports

Exports

TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr

Sections

.text
Size: 718KB - Virtual size: 718KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 27KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 154B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 93B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
382c9aa9b4ec7137d69ebc20fe58b83acbb8bf0bce324d10fb58aba91b805c9f.exe
.exe windows:6 windows x64 arch:x64

fb0a8b4a81655f744a37af985e009476

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\MeshAgent\MeshAgent\Release\MeshService64.pdb

Imports

comctl32

InitCommonControlsEx

dbghelp

SymInitialize
SymGetModuleBase64
SymGetLineFromAddr64
SymFunctionTableAccess64
SymFromAddr
StackWalk64
MiniDumpWriteDump

iphlpapi

GetAdaptersAddresses
SendARP
ConvertLengthToIpv4Mask
GetAdaptersInfo

ws2_32

WSACloseEvent
htons
htonl
gethostname
ntohs
ntohl
WSAGetLastError
ioctlsocket
recv
WSASetLastError
send
getsockname
WSASocketW
listen
closesocket
bind
accept
__WSAFDIsSet
setsockopt
socket
sendto
getsockopt
recvfrom
connect
shutdown
WSAIoctl
GetAddrInfoW
WSAResetEvent
WSAEventSelect
WSAStartup
WSACreateEvent
WSACleanup
FreeAddrInfoW
select

crypt32

CertFindCertificateInStore
CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CryptAcquireCertificatePrivateKey
CertAddEncodedCertificateToStore
CryptMsgClose
CryptMsgUpdate
CryptExportPublicKeyInfo
CertCreateSelfSignCertificate
CertFreeCertificateContext
CryptMsgOpenToEncode
CertAddCertificateContextToStore
PFXExportCertStore
CryptSignAndEncodeCertificate
CertCloseStore
CertStrToNameA
CryptMsgGetParam
CryptEncodeObject
CertSetCertificateContextProperty
CertGetCertificateContextProperty
CryptMsgCalculateEncodedLength
CertOpenStore
CertStrToNameW
CertEnumCertificatesInStore

gdiplus

GdipGetImageEncoders
GdiplusShutdown
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree
GdipGetImageEncodersSize
GdipLoadImageFromStream
GdipSaveImageToStream
GdiplusStartup

ncrypt

NCryptCreatePersistedKey
NCryptFreeObject
NCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptGenRandom
NCryptOpenStorageProvider
BCryptOpenAlgorithmProvider
NCryptFinalizeKey

kernel32

InitializeSListHead
GetStartupInfoW
RtlUnwindEx
GetFullPathNameW
GetStdHandle
WriteFile
LoadLibraryExA
GetModuleFileNameW
GetSystemPowerStatus
OpenProcess
MultiByteToWideChar
Sleep
GetLastError
CloseHandle
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcAddress
SetEnvironmentVariableA
CreateProcessW
FreeLibrary
WideCharToMultiByte
GetCurrentThreadId
GetModuleHandleA
WaitForSingleObjectEx
CreateThread
QueueUserAPC
OpenThread
ReadFile
LoadLibraryA
SleepEx
SetSystemPowerState
GetCurrentProcess
SetThreadExecutionState
HeapFree
HeapAlloc
GetProcessHeap
SystemTimeToFileTime
GetSystemTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
QueryPerformanceCounter
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreA
CancelIo
FindFirstFileW
FindNextFileW
RemoveDirectoryW
GetFinalPathNameByHandleW
GetDriveTypeA
SetFilePointer
FindFirstVolumeA
FindClose
CreateFileW
GetVolumePathNamesForVolumeNameA
GetFileAttributesExW
ReadDirectoryChangesW
FindNextVolumeA
FindVolumeClose
GetDiskFreeSpaceExA
CreateEventA
GetModuleHandleExA
WaitForMultipleObjectsEx
CreateNamedPipeA
DisconnectNamedPipe
CreateFileA
CancelIoEx
LocalFree
ConnectNamedPipe
SetConsoleMode
GetConsoleMode
SetConsoleOutputCP
IsDebuggerPresent
TerminateProcess
GetTempPathW
CancelSynchronousIo
SetEvent
ResetEvent
IsProcessorFeaturePresent
GetCurrentProcessId
GetEnvironmentStrings
FreeEnvironmentStringsA
CopyFileW
RtlCaptureContext
SuspendThread
ResumeThread
DuplicateHandle
GetTickCount64
GetCurrentThread
GetOverlappedResult
GetThreadContext
WTSGetActiveConsoleSessionId
GetExitCodeProcess
SetEndOfFile
DeleteFileW
SetFilePointerEx
SetConsoleCtrlHandler
FreeConsole
LoadLibraryExW
SetLastError
GetFileType
GetModuleHandleW
SwitchToFiber
DeleteFiber
CreateFiber
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
CreateDirectoryW
GetConsoleCP
MoveFileExW
SetEnvironmentVariableW
GetTimeZoneInformation
SetStdHandle
GetDriveTypeW
PeekNamedPipe
GetCommandLineA
GetCommandLineW
GetACP
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetStringTypeW
HeapReAlloc
FlushFileBuffers
WriteConsoleW
GetCPInfo
FindFirstFileExW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
GetThreadId
RtlVirtualUnwind
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
RaiseException
HeapSize
RtlPcToFileHeader
QueryPerformanceFrequency
EncodePointer

user32

EndDialog
SetWindowTextW
GetWindowPlacement
ShowWindow
GetDlgCtrlID
SetWindowPlacement
SetWindowTextA
IsDlgButtonChecked
GetDlgItem
CheckDlgButton
DialogBoxParamW
EnableWindow
MessageBeep
ExitWindowsEx
GetUserObjectInformationA
EnumDisplayMonitors
GetSystemMetrics
SetThreadDesktop
GetThreadDesktop
CloseDesktop
BlockInput
GetMonitorInfoA
OpenInputDesktop
GetKeyState
GetMessageA
GetMessageExtraInfo
SendMessageW
LoadCursorA
DestroyWindow
GetDC
PostMessageA
GetIconInfo
CallNextHookEx
GetCursorInfo
SetWindowsHookExA
MapVirtualKeyA
GetForegroundWindow
UnhookWindowsHookEx
DefWindowProcA
CreateWindowExA
TranslateMessage
UnregisterClassA
DrawIconEx
SetWinEventHook
RegisterClassExA
UnhookWinEvent
SetForegroundWindow
ReleaseDC
SendInput
SetProcessDPIAware
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
DispatchMessageA
CreateWindowExW
GetWindowRect

gdi32

SetBkMode
SetBkColor
CreateSolidBrush
BitBlt
StretchBlt
DeleteDC
SetStretchBltMode
CreateCompatibleBitmap
GetObjectA
SelectObject
CreateCompatibleDC
GetDIBits
DeleteObject
SetTextColor
GetStockObject

advapi32

CloseServiceHandle
AllocateAndInitializeSid
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
StartServiceCtrlDispatcherA
RegCreateKeyW
RegSetValueExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
OpenProcessToken
InitiateSystemShutdownA
LookupPrivilegeValueA
AdjustTokenPrivileges
CryptReleaseContext
RegSetValueExW
CryptDestroyKey
InitializeSecurityDescriptor
SetEntriesInAclA
SetSecurityDescriptorDacl
DuplicateTokenEx
CreateProcessAsUserW
SetTokenInformation
OpenServiceA
CheckTokenMembership
FreeSid
RegisterServiceCtrlHandlerExA
OpenSCManagerA
SetServiceStatus
QueryServiceStatus

shell32

ShellExecuteExW

ole32

CoInitializeEx
CreateStreamOnHGlobal
CoUninitialize

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 981KB - Virtual size: 981KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
385aeb4409a86678ca21a745b04350d1dd8593cec972d77524f83323b9160fa7.exe
.dll windows:6 windows x64 arch:x64

bb2ac363335230ef73bf96bf5001e65e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

shlwapi

StrStrW

kernel32

TlsFree
MultiByteToWideChar
WaitForSingleObject
GetLastError
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
WideCharToMultiByte
EncodePointer
DecodePointer
InitializeCriticalSectionEx
LCMapStringEx
GetStringTypeW
GetCPInfo
WriteConsoleW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
RtlUnwind
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
SetStdHandle
HeapSize
CreateFileW

Sections

.text
Size: 525KB - Virtual size: 525KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
38719e8104f65d7193c30dcd823b4a4d363f85b4c886f36316fa185f832a5bac.vbs
.vbs
3b7b020f8ce69d4b810468c03b4bfd1cc6e56080c7b754cafebfd4ba500c7855.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 813KB - Virtual size: 812KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
3c187ba3a074078ac5edd0382992f66e784eb26faff2fbd55b97b1d0b0740ae9.exe
.exe windows:5 windows x86 arch:x86

ba98ed9b6030d773e739745aeaf6e0bb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\nizavoyibam-vaha92\cin84 kubi-kobuwedataf\fiveja.pdb

Imports

kernel32

GetConsoleAliasA
QueryDosDeviceA
_lcreat
MoveFileWithProgressA
GetConsoleAliasesLengthA
GetNumberFormatA
ReadConsoleW
GetConsoleCP
GlobalFindAtomA
LoadLibraryW
TerminateThread
InitializeCriticalSectionAndSpinCount
ReadConsoleInputA
CopyFileW
FileTimeToSystemTime
GetEnvironmentVariableA
GetTempPathW
GetLastError
GetCurrentDirectoryW
GetLocaleInfoA
SetLastError
GetProcAddress
LoadLibraryA
WriteConsoleA
InterlockedExchangeAdd
LocalAlloc
FindFirstVolumeMountPointW
RemoveDirectoryW
VirtualLock
GetModuleFileNameA
GetFileAttributesExW
GetWindowsDirectoryW
GlobalAddAtomW
FindNextVolumeA
GetVolumeInformationW
WriteConsoleW
GetStringTypeW
OutputDebugStringW
FindResourceA
SetThreadContext
ChangeTimerQueueTimer
GetNumaNodeProcessorMask
FlushFileBuffers
SetStdHandle
SetFilePointerEx
GetConsoleMode
IsProcessorFeaturePresent
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineW
RaiseException
RtlUnwind
IsDebuggerPresent
HeapSize
HeapFree
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
WriteFile
GetModuleFileNameW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
GetProcessHeap
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
LCMapStringW
CreateFileW

user32

CharUpperBuffA
DrawCaption

gdi32

SetTextColor

advapi32

RegisterEventSourceW

ole32

CoGetPSClsid

winhttp

WinHttpSetDefaultProxyConfiguration

msimg32

AlphaBlend

Sections

.text
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 131KB - Virtual size: 41.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe
.exe .ps1 windows:4 windows x86 arch:x86 polyglot

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:01:94:cd:1e:31:42:20:51:35:d1:c6:36:e4:e9:ba
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

18-10-2022 00:00

Not After

15-10-2025 23:59

Subject

CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:09:5e:de:a2:12:7e:92:81:cc:00:00:00:00:01:09
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

14-09-2023 19:14

Not After

04-09-2024 19:14

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8f:92:b8:e1:1d:20:b7:c7:95:49:96:79:cd:17:08:f4:d6:ee:55:13:42:3f:5d:0a:84:0e:b4:2b:7c:56:74:f2
Signer

Actual PE Digest

8f:92:b8:e1:1d:20:b7:c7:95:49:96:79:cd:17:08:f4:d6:ee:55:13:42:3f:5d:0a:84:0e:b4:2b:7c:56:74:f2

Digest Algorithm

sha256

PE Digest Matches

false

8f:92:b8:e1:1d:20:b7:c7:95:49:96:79:cd:17:08:f4:d6:ee:55:13:42:3f:5d:0a:84:0e:b4:2b:7c:56:74:f2
Signer

Actual PE Digest

8f:92:b8:e1:1d:20:b7:c7:95:49:96:79:cd:17:08:f4:d6:ee:55:13:42:3f:5d:0a:84:0e:b4:2b:7c:56:74:f2

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\df5bxtbhflbbh\obj\Release\Laptop.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 211KB - Virtual size: 211KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
3c52855c535816927fd94405b87fef074296ca34994d04686b7fe141bb48d20d.elf
.elf linux sparc
3eaa57d60ec0a1932473ea109c3217a023aedd47f6921092b2f1ff2613e73926.elf
.elf linux x86
403237121c807d41f44f036f65336713a673d5b98756abe86faa5e883a068ea7.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
42c1afa196dd457a3c9ec69e786c029b7b98f0b5be4041cfbd8b2910352435eb.elf
.elf linux x86
42f781f94b9df3f0625426ea2ae3f668a83b52faf78c8c5ddfccab1690967e90.elf
.elf linux arm
44243d0823b6951aa36d0c1a8aea39866bbf33f5d0bbb76dfa3b5290ffe83683.elf
.elf linux x86
462113bece051066dcdbeda693499e8d79f439e30cd6daf3dd089ea1e42fd35a.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
4744b94d6954de78dc1394d5f1f8f4dce2179eae5b8d453f99d8adf93a3eb9a9.exe
.exe windows:5 windows x86 arch:x86

00be6e6c4f9e287672c8301b72bdabf3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

Imports

kernel32

GetLastError
SetLastError
GetCurrentProcess
DeviceIoControl
SetFileTime
CloseHandle
CreateDirectoryW
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
GetFileType
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
FindNextFileW
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FreeLibrary
GetProcAddress
GetCurrentProcessId
ExitProcess
SetThreadExecutionState
Sleep
LoadLibraryW
GetSystemDirectoryW
CompareStringW
AllocConsole
FreeConsole
AttachConsole
WriteConsoleW
GetProcessAffinityMask
CreateThread
SetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
GetTickCount
LockResource
GlobalLock
GlobalUnlock
GlobalFree
LoadResource
SizeofResource
SetCurrentDirectoryW
GetExitCodeProcess
GetLocalTime
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCommandLineW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
MoveFileExW
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
SetStdHandle
GetProcessHeap
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
RtlUnwind
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
QueryPerformanceFrequency
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapFree
HeapAlloc
HeapReAlloc
GetStringTypeW
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
DecodePointer

gdiplus

GdiplusShutdown
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc

Sections

.text
Size: 186KB - Virtual size: 185KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 498KB - Virtual size: 498KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
4884c907196c6492f16b3ecb2b2ab21b5642be51d7977047b2ef6154fc2f8ce5.elf
.elf linux arm
4978b11e4e9669aebe9e03adeeac643e6bbb44d9d3d2493065c915aacc549c48.elf
.elf linux arm
49ebe60b13e18860b25f920c8c8ed486bd9f0789c47c65df1f32c6dcb1a2cb83.elf
.elf linux sh
4a0007763fc1a326967ad2400f16fecdd8d540258dcbb555345d9a4e02092bb5.exe
.exe windows:6 windows x64 arch:x64

fb0a8b4a81655f744a37af985e009476

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\MeshAgent\MeshAgent\Release\MeshService64.pdb

Imports

comctl32

InitCommonControlsEx

dbghelp

SymInitialize
SymGetModuleBase64
SymGetLineFromAddr64
SymFunctionTableAccess64
SymFromAddr
StackWalk64
MiniDumpWriteDump

iphlpapi

GetAdaptersAddresses
SendARP
ConvertLengthToIpv4Mask
GetAdaptersInfo

ws2_32

WSACloseEvent
htons
htonl
gethostname
ntohs
ntohl
WSAGetLastError
ioctlsocket
recv
WSASetLastError
send
getsockname
WSASocketW
listen
closesocket
bind
accept
__WSAFDIsSet
setsockopt
socket
sendto
getsockopt
recvfrom
connect
shutdown
WSAIoctl
GetAddrInfoW
WSAResetEvent
WSAEventSelect
WSAStartup
WSACreateEvent
WSACleanup
FreeAddrInfoW
select

crypt32

CertFindCertificateInStore
CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CryptAcquireCertificatePrivateKey
CertAddEncodedCertificateToStore
CryptMsgClose
CryptMsgUpdate
CryptExportPublicKeyInfo
CertCreateSelfSignCertificate
CertFreeCertificateContext
CryptMsgOpenToEncode
CertAddCertificateContextToStore
PFXExportCertStore
CryptSignAndEncodeCertificate
CertCloseStore
CertStrToNameA
CryptMsgGetParam
CryptEncodeObject
CertSetCertificateContextProperty
CertGetCertificateContextProperty
CryptMsgCalculateEncodedLength
CertOpenStore
CertStrToNameW
CertEnumCertificatesInStore

gdiplus

GdipGetImageEncoders
GdiplusShutdown
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree
GdipGetImageEncodersSize
GdipLoadImageFromStream
GdipSaveImageToStream
GdiplusStartup

ncrypt

NCryptCreatePersistedKey
NCryptFreeObject
NCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptGenRandom
NCryptOpenStorageProvider
BCryptOpenAlgorithmProvider
NCryptFinalizeKey

kernel32

InitializeSListHead
GetStartupInfoW
RtlUnwindEx
GetFullPathNameW
GetStdHandle
WriteFile
LoadLibraryExA
GetModuleFileNameW
GetSystemPowerStatus
OpenProcess
MultiByteToWideChar
Sleep
GetLastError
CloseHandle
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcAddress
SetEnvironmentVariableA
CreateProcessW
FreeLibrary
WideCharToMultiByte
GetCurrentThreadId
GetModuleHandleA
WaitForSingleObjectEx
CreateThread
QueueUserAPC
OpenThread
ReadFile
LoadLibraryA
SleepEx
SetSystemPowerState
GetCurrentProcess
SetThreadExecutionState
HeapFree
HeapAlloc
GetProcessHeap
SystemTimeToFileTime
GetSystemTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
QueryPerformanceCounter
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreA
CancelIo
FindFirstFileW
FindNextFileW
RemoveDirectoryW
GetFinalPathNameByHandleW
GetDriveTypeA
SetFilePointer
FindFirstVolumeA
FindClose
CreateFileW
GetVolumePathNamesForVolumeNameA
GetFileAttributesExW
ReadDirectoryChangesW
FindNextVolumeA
FindVolumeClose
GetDiskFreeSpaceExA
CreateEventA
GetModuleHandleExA
WaitForMultipleObjectsEx
CreateNamedPipeA
DisconnectNamedPipe
CreateFileA
CancelIoEx
LocalFree
ConnectNamedPipe
SetConsoleMode
GetConsoleMode
SetConsoleOutputCP
IsDebuggerPresent
TerminateProcess
GetTempPathW
CancelSynchronousIo
SetEvent
ResetEvent
IsProcessorFeaturePresent
GetCurrentProcessId
GetEnvironmentStrings
FreeEnvironmentStringsA
CopyFileW
RtlCaptureContext
SuspendThread
ResumeThread
DuplicateHandle
GetTickCount64
GetCurrentThread
GetOverlappedResult
GetThreadContext
WTSGetActiveConsoleSessionId
GetExitCodeProcess
SetEndOfFile
DeleteFileW
SetFilePointerEx
SetConsoleCtrlHandler
FreeConsole
LoadLibraryExW
SetLastError
GetFileType
GetModuleHandleW
SwitchToFiber
DeleteFiber
CreateFiber
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
CreateDirectoryW
GetConsoleCP
MoveFileExW
SetEnvironmentVariableW
GetTimeZoneInformation
SetStdHandle
GetDriveTypeW
PeekNamedPipe
GetCommandLineA
GetCommandLineW
GetACP
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetStringTypeW
HeapReAlloc
FlushFileBuffers
WriteConsoleW
GetCPInfo
FindFirstFileExW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
GetThreadId
RtlVirtualUnwind
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
RaiseException
HeapSize
RtlPcToFileHeader
QueryPerformanceFrequency
EncodePointer

user32

EndDialog
SetWindowTextW
GetWindowPlacement
ShowWindow
GetDlgCtrlID
SetWindowPlacement
SetWindowTextA
IsDlgButtonChecked
GetDlgItem
CheckDlgButton
DialogBoxParamW
EnableWindow
MessageBeep
ExitWindowsEx
GetUserObjectInformationA
EnumDisplayMonitors
GetSystemMetrics
SetThreadDesktop
GetThreadDesktop
CloseDesktop
BlockInput
GetMonitorInfoA
OpenInputDesktop
GetKeyState
GetMessageA
GetMessageExtraInfo
SendMessageW
LoadCursorA
DestroyWindow
GetDC
PostMessageA
GetIconInfo
CallNextHookEx
GetCursorInfo
SetWindowsHookExA
MapVirtualKeyA
GetForegroundWindow
UnhookWindowsHookEx
DefWindowProcA
CreateWindowExA
TranslateMessage
UnregisterClassA
DrawIconEx
SetWinEventHook
RegisterClassExA
UnhookWinEvent
SetForegroundWindow
ReleaseDC
SendInput
SetProcessDPIAware
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
DispatchMessageA
CreateWindowExW
GetWindowRect

gdi32

SetBkMode
SetBkColor
CreateSolidBrush
BitBlt
StretchBlt
DeleteDC
SetStretchBltMode
CreateCompatibleBitmap
GetObjectA
SelectObject
CreateCompatibleDC
GetDIBits
DeleteObject
SetTextColor
GetStockObject

advapi32

CloseServiceHandle
AllocateAndInitializeSid
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
StartServiceCtrlDispatcherA
RegCreateKeyW
RegSetValueExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
OpenProcessToken
InitiateSystemShutdownA
LookupPrivilegeValueA
AdjustTokenPrivileges
CryptReleaseContext
RegSetValueExW
CryptDestroyKey
InitializeSecurityDescriptor
SetEntriesInAclA
SetSecurityDescriptorDacl
DuplicateTokenEx
CreateProcessAsUserW
SetTokenInformation
OpenServiceA
CheckTokenMembership
FreeSid
RegisterServiceCtrlHandlerExA
OpenSCManagerA
SetServiceStatus
QueryServiceStatus

shell32

ShellExecuteExW

ole32

CoInitializeEx
CreateStreamOnHGlobal
CoUninitialize

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 981KB - Virtual size: 981KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
51787c72e5315249cc7625f28609f16211a3774cbe839fe0df550bcaf3a27c56.exe
.exe windows:5 windows x86 arch:x86

d0243dfde80694c4b1420314e367e553

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\WarZ\src\RSUpdate\Release\DomoZLauncher.pdb

Imports

d3dx9_43

D3DXCreateTextureFromFileInMemoryEx
D3DXCreateCubeTextureFromFileInMemoryEx
D3DXCreateFontA
D3DXSaveSurfaceToFileA
D3DXGetImageInfoFromFileInMemory
D3DXCreateVolumeTextureFromFileInMemoryEx
D3DXCreateTextureFromFileInMemory

d3d9

Direct3DCreate9

kernel32

FreeLibrary
GetFileSize
WriteFile
ReadFile
GetFileTime
FormatMessageA
GetComputerNameA
GetOEMCP
GetACP
CreateProcessA
LoadLibraryExW
GetSystemDirectoryW
LocalAlloc
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
SetStdHandle
GetTimeZoneInformation
LCMapStringW
GetTickCount
GetLocalTime
GetSystemTime
SystemTimeToFileTime
SetFileAttributesW
CreateDirectoryW
GetFileAttributesW
SetFilePointer
DeleteFileW
MoveFileW
GetTempPathA
GetTempPathW
GetCurrentDirectoryW
GetFullPathNameW
LocalFree
GetLastError
InterlockedIncrement
InitializeCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceA
SetFileAttributesA
MoveFileA
LCMapStringA
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
FileTimeToSystemTime
GetEnvironmentStrings
FreeEnvironmentStringsA
GetConsoleMode
DeleteCriticalSection
FlushFileBuffers
CreateThread
GetCurrentThreadId
CreateFileA
GetConsoleCP
IsValidCodePage
GetCPInfo
GetStdHandle
SetHandleCount
HeapSize
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
HeapReAlloc
ExitProcess
GetModuleHandleW
GetProcessHeap
GetFileType
GetDriveTypeA
FileTimeToLocalFileTime
HeapAlloc
HeapFree
RaiseException
RtlUnwind
GetStartupInfoA
GetCommandLineA
UnhandledExceptionFilter
ExitThread
GetSystemTimeAsFileTime
VirtualAlloc
VirtualFree
GetExitCodeProcess
SetUnhandledExceptionFilter
GetCurrentProcessId
CreateToolhelp32Snapshot
Module32First
Module32Next
InterlockedDecrement
CreateFileMappingA
UnmapViewOfFile
MulDiv
DuplicateHandle
GetCurrentThread
TryEnterCriticalSection
InterlockedExchangeAdd
SetEndOfFile
GetSystemInfo
MapViewOfFile
InterlockedExchange
GetFileAttributesA
CreateDirectoryA
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
DeleteFileA
SetConsoleTitleA
AllocConsole
Sleep
GlobalAlloc
GlobalUnlock
GlobalLock
GetCurrentProcess
TerminateProcess
GetCurrentDirectoryA
GetFullPathNameA
CreateEventA
SetEvent
OutputDebugStringA
OpenEventA
LeaveCriticalSection
EnterCriticalSection
CloseHandle
TerminateThread
WaitForSingleObject
GetVersionExA
GetProcAddress
GlobalMemoryStatusEx
CopyFileA
GetModuleFileNameA
MultiByteToWideChar
LoadLibraryA
FindFirstFileA
CreateFileW
FindClose
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleHandleA

user32

GetWindowLongA
SendMessageA
SetFocus
MessageBoxA
GetClientRect
ClientToScreen
ShowCursor
PostQuitMessage
RegisterClassA
CreateWindowExA
GetActiveWindow
InvalidateRect
UpdateWindow
PeekMessageW
GetMessageW
BeginPaint
EndPaint
ReleaseCapture
GetCursorPos
GetWindowRect
SetCapture
DefWindowProcA
SetWindowLongA
SetWindowTextA
ShowWindow
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
GetCaretBlinkTime
ClipCursor
GetFocus
GetKeyState
OpenClipboard
GetClipboardData
CloseClipboard
GetAsyncKeyState
SwitchToThisWindow
AdjustWindowRect
SetWindowPos
SetRect
LoadStringW
LoadCursorA
SetClipboardViewer
ChangeClipboardChain
LoadIconA

gdi32

SetTextAlign
SetBkColor
DeleteObject
GetTextExtentPoint32A
SelectObject
DeleteDC
GetDeviceCaps
CreateICA
GetStockObject
CreateFontA
CreateCompatibleDC
LineTo
MoveToEx
ExtTextOutA
CreatePen
SetMapMode
CreateDIBSection
SetTextColor

advapi32

RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegCloseKey
GetUserNameA
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
CryptExportKey
CryptDestroyKey
CryptGetUserKey
CryptEnumProvidersA
CryptGetProvParam
CryptAcquireContextW
RegOpenKeyExA

shell32

SHGetFolderPathA
ShellExecuteA

ole32

CoCreateInstance
CoInitializeEx
CoInitialize

oleaut32

SysAllocString
SysFreeString

iphlpapi

GetAdaptersInfo

dbghelp

MakeSureDirectoryPathExists
MiniDumpWriteDump

ws2_32

getsockopt
setsockopt
ioctlsocket
WSAGetLastError
socket
WSAStartup
ntohs
inet_ntoa
getsockname
gethostbyname
inet_addr
htons
connect
select
__WSAFDIsSet
bind
closesocket
shutdown
recv
send

dinput8

DirectInput8Create

crypt32

CryptDecodeObject
CertSetCertificateContextProperty
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertCreateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetSubjectCertificateFromStore
CryptMsgControl
CryptMsgGetParam
CryptMsgClose
CryptMsgUpdate
CryptMsgOpenToDecode
CryptDecryptMessage
CryptEncodeObject
CryptEncryptMessage
CertNameToStrW

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 754KB - Virtual size: 753KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 101KB - Virtual size: 784KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7.0MB - Virtual size: 7.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 163KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
5212ef58efb4b855a2aaf4bbaf81a4912810982631e2afaf246963fea954fe64.vbs
.vbs
52f0294f8dd4741d22f39e30ef4a1818523b8899a4462d437321b4e51ca4bcba.pdf
.pdf
547c07702129ea5e0ae2fb48e841c74ce957a4fa3f1c3742e588fe84c494232b.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 264KB - Virtual size: 264KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
561ba061b626753994e3d3389e2b5b74e42f39b4ab4b863b20a16bca6f1832fc.elf
.elf linux mipsbe
57bfb1ccdc00493daf0987426bc3744bfcc0f2777b78594e840832a776b32a9f.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 813KB - Virtual size: 813KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
58977c7fcf81b48cc636ed15cc410fe08d5d8a66291f3d2cc034cf41f57dec2f.vbs
.vbs
5d93c67ddde2e5fdc00a4e5777aa37d9ea4639227c633d044fb467b210640d28.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:01:94:cd:1e:31:42:20:51:35:d1:c6:36:e4:e9:ba
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

18-10-2022 00:00

Not After

15-10-2025 23:59

Subject

CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:09:5e:de:a2:12:7e:92:81:cc:00:00:00:00:01:09
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

14-09-2023 19:14

Not After

04-09-2024 19:14

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

eb:84:98:05:56:51:35:94:0c:54:a3:d5:e8:96:06:9e:6d:2a:c4:cb:21:d8:06:de:56:a8:dd:b3:55:8e:cb:8c
Signer

Actual PE Digest

eb:84:98:05:56:51:35:94:0c:54:a3:d5:e8:96:06:9e:6d:2a:c4:cb:21:d8:06:de:56:a8:dd:b3:55:8e:cb:8c

Digest Algorithm

sha256

PE Digest Matches

false

eb:84:98:05:56:51:35:94:0c:54:a3:d5:e8:96:06:9e:6d:2a:c4:cb:21:d8:06:de:56:a8:dd:b3:55:8e:cb:8c
Signer

Actual PE Digest

eb:84:98:05:56:51:35:94:0c:54:a3:d5:e8:96:06:9e:6d:2a:c4:cb:21:d8:06:de:56:a8:dd:b3:55:8e:cb:8c

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\9w7kjnhf\obj\Release\Laptop.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 363KB - Virtual size: 363KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
5ecf0dade29bc4365035554275d07a72b112d0b6bc7487cef6a1c40ed50ea28e.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
609ef2b560381e8385a71a4a961afc94a1e1d19352414a591cd05217e9314625.exe
.exe windows:5 windows x86 arch:x86

32a31bfad8ca2c4b8a1a523b9cceb9d8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\omtnkdoj\bnwv\yogisfk\cqf.pdb

Imports

comdlg32

GetOpenFileNameA
GetSaveFileNameA

gdi32

BitBlt
DeleteDC
CreateCompatibleDC
GetStockObject
SetBkColor
SetTextColor
SelectObject
GetDeviceCaps
CreateCompatibleBitmap
CreateBitmap
TextOutA
DeleteObject

kernel32

RtlUnwind
SetStdHandle
WideCharToMultiByte
GetSystemTimeAsFileTime
WriteFile
GetModuleHandleW
LeaveCriticalSection
DeleteCriticalSection
GetConsoleCP
SetConsoleCtrlHandler
Sleep
GetCurrentThreadId
RaiseException
GetStdHandle
MultiByteToWideChar
TerminateProcess
GetStringTypeW
EnumSystemLocalesW
LoadLibraryExW
ReadFile
OutputDebugStringW
GetCPInfo
HeapFree
GetModuleFileNameW
FormatMessageA
GetCurrentProcess
GetLastError
FreeEnvironmentStringsW
AreFileApisANSI
HeapSize
SetUnhandledExceptionFilter
GetModuleFileNameA
GetConsoleMode
GetEnvironmentStringsW
FlushFileBuffers
IsValidCodePage
CreateSemaphoreW
IsProcessorFeaturePresent
GetACP
EnterCriticalSection
LCMapStringW
FreeLibrary
GetProcAddress
DecodePointer
GetFileType
EncodePointer
CreateFileW
GetProcessHeap
GetOEMCP
TlsFree
CloseHandle
GetStartupInfoW
SetFilePointerEx
HeapAlloc
QueryPerformanceCounter
IsValidLocale
GetModuleHandleExW
TlsGetValue
GetLocaleInfoW
TlsSetValue
IsDebuggerPresent
CompareStringW
InitializeCriticalSectionAndSpinCount
GetDateFormatW
CreateFileA
UnhandledExceptionFilter
LoadLibraryW
SetPriorityClass
InterlockedDecrement
WriteConsoleW
GetTimeFormatW
GetModuleHandleA
HeapReAlloc
SetLastError
GetCurrentProcessId
GetCurrentThread
GetUserDefaultLCID
ExitProcess
FatalAppExitA
InterlockedExchange
InterlockedIncrement
TlsAlloc
GetCurrentDirectoryA

shell32

ShellExecuteA

user32

GetMessageA
InvalidateRect
SetDlgItemTextA
PostQuitMessage
SetCursor
PeekMessageA
DestroyWindow
AdjustWindowRect
MessageBoxA
LoadImageA
GetSystemMenu
IsIconic
DefWindowProcA
LoadStringA
RegisterClassExA
SetForegroundWindow
CloseWindow
GetCursorPos
ReleaseDC
GetSystemMetrics
LoadIconA
CreateWindowExA
ShowCursor
SetWindowPos
GetCursor
SendMessageA
RemoveMenu
GetDlgItemTextA
EndDialog
DialogBoxParamA
GetDC
LoadCursorA
DispatchMessageA
TranslateMessage
WaitMessage

winmm

timeKillEvent
PlaySoundA
timeSetEvent

Sections

.text
Size: 55KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 357KB - Virtual size: 361KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
60f45dc57494e24ac5676556834ad9c30fc889bd9cceed706a4c4546e593cfa9.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 714KB - Virtual size: 713KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
63c666636e07e95e5e56ccb4e92db6dc350986bc4fcb401975dbae538aa73d15.dll
.dll windows:5 windows x86 arch:x86

99f735f47b2cd370c9d9f10c289154e0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

InternetCloseHandle
InternetOpenA
InternetSetOptionA
InternetReadFile
InternetOpenUrlA

dnsapi

DnsFree
DnsQuery_A

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
VirtualQuery
CreateFileA
lstrlenA
TlsGetValue
SetWaitableTimer
InterlockedIncrement
GetQueuedCompletionStatus
InterlockedDecrement
QueryPerformanceCounter
InterlockedCompareExchange
SleepEx
WriteFile
InitializeCriticalSection
TlsSetValue
TerminateThread
InitializeCriticalSectionAndSpinCount
GetTickCount
GetProcessHeap
HeapAlloc
CreateEventA
GetCurrentProcess
HeapFree
WaitForSingleObject
SetEvent
Sleep
GetSystemTimeAsFileTime
LeaveCriticalSection
ReadFile
lstrcatA
InterlockedExchange
GetLastError
SetLastError
GetProcAddress
QueueUserAPC
EnterCriticalSection
InterlockedExchangeAdd
LocalAlloc
PostQueuedCompletionStatus
WaitForMultipleObjects
GetModuleFileNameA
CreateIoCompletionPort
GetModuleHandleA
DeleteCriticalSection
GetVersionExA
TlsAlloc
CloseHandle
CreateWaitableTimerA
LocalFree
TlsFree
DeleteFileA
CreateThread
FreeLibrary
LoadLibraryA
DeviceIoControl
HeapSize
GetModuleHandleW
GetModuleFileNameW
SetEndOfFile
CreateFileW
ReadConsoleW
FlushFileBuffers
WriteConsoleW
SetStdHandle
HeapReAlloc
OutputDebugStringW
SetFilePointerEx
LCMapStringW
GetStdHandle
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileType
GetConsoleMode
GetConsoleCP
FormatMessageA
OpenEventA
ReleaseSemaphore
GetCurrentProcessId
GetCurrentThreadId
ResetEvent
ResumeThread
EncodePointer
DecodePointer
ExitThread
LoadLibraryExW
GetCommandLineA
RaiseException
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
ExitProcess
GetModuleHandleExW
AreFileApisANSI
WideCharToMultiByte

user32

wsprintfA

shell32

SHGetSpecialFolderPathA

ws2_32

ioctlsocket
WSAStringToAddressA
connect
inet_ntoa
WSAStartup
ntohl
inet_addr
htonl
getaddrinfo
WSARecv
WSASend
select
htons
ntohs
getsockname
shutdown
setsockopt
WSACleanup
freeaddrinfo
WSASetLastError
closesocket
getsockopt
WSASocketA
WSAGetLastError

Sections

.text
Size: 151KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 411KB - Virtual size: 411KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
643afed61e85d74cfd348f181b699599588cdd4033d6cc5a8a6fddfb356e0f7b.vbs
.vbs
679d5cdadcc48fa79574ce12e8d0fd2e19823dc4b7e39a84b5b286672f45a72d.exe
.exe windows:5 windows x86 arch:x86

0ae9e38912ff6bd742a1b9e5c003576a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

Imports

kernel32

GetLastError
SetLastError
FormatMessageW
GetCurrentProcess
DeviceIoControl
SetFileTime
CloseHandle
CreateDirectoryW
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
GetFileType
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
GetCurrentProcessId
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
FindNextFileW
InterlockedDecrement
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FreeLibrary
GetProcAddress
ExitProcess
SetThreadExecutionState
Sleep
LoadLibraryW
GetSystemDirectoryW
CompareStringW
AllocConsole
FreeConsole
AttachConsole
WriteConsoleW
GetProcessAffinityMask
CreateThread
SetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
LockResource
GlobalLock
GlobalUnlock
GlobalFree
LoadResource
SizeofResource
SetCurrentDirectoryW
GetTimeFormatW
GetDateFormatW
LocalFree
GetExitCodeProcess
GetLocalTime
GetTickCount
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCommandLineW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
MoveFileExW
GetLocaleInfoW
GetNumberFormatW
DecodePointer
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
RtlUnwind
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
QueryPerformanceFrequency
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapFree
HeapReAlloc
HeapAlloc
GetStringTypeW
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage

oleaut32

SysAllocString
SysFreeString
VariantClear

gdiplus

GdipAlloc
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateHBITMAPFromBitmap
GdiplusStartup
GdiplusShutdown
GdipFree

Sections

.text
Size: 203KB - Virtual size: 203KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
6ce6fd56b675cb8ffc6e5ecb11bb80640e24e58a09985f8a4f635ee9c3c2bf97.exe
.exe windows:6 windows x64 arch:x64

5929190c8765f5bc37b052ab5c6c53e7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AddAtomA
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileA
CreateIoCompletionPort
CreateMutexA
CreateSemaphoreA
CreateThread
CreateWaitableTimerExW
DeleteAtom
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FindAtomA
FormatMessageA
FreeEnvironmentStringsW
GetAtomNameA
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetErrorMode
GetHandleInformation
GetLastError
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
RaiseFailFastException
ReleaseMutex
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetLastError
SetProcessAffinityMask
SetProcessPriorityBoost
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WerGetFlags
WerSetFlags
WideCharToMultiByte
WriteConsoleW
WriteFile
__C_specific_handler

msvcrt

___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthread
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_fmode
_initterm
_lock
_memccpy
_onexit
_setjmp
_strdup
_ultoa
_unlock
abort
calloc
exit
fprintf
fputc
free
fwrite
localeconv
longjmp
malloc
memcpy
memmove
memset
printf
realloc
signal
strerror
strlen
strncmp
vfprintf
wcslen

Exports

Exports

_cgo_dummy_export

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 158KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 354KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 78B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
6dc7164ea78b8668d8a1492d543f24a9edaaad990403f4451c546a0d4115a3bd.exe
.dll windows:6 windows x64 arch:x64

bb2ac363335230ef73bf96bf5001e65e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

shlwapi

StrStrW

kernel32

TlsFree
MultiByteToWideChar
WaitForSingleObject
GetLastError
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
WideCharToMultiByte
EncodePointer
DecodePointer
InitializeCriticalSectionEx
LCMapStringEx
GetStringTypeW
GetCPInfo
WriteConsoleW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
RtlUnwind
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
SetStdHandle
HeapSize
CreateFileW

Sections

.text
Size: 567KB - Virtual size: 566KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
6e6d31e5b9a61454a66a24114583d5bdc3d7f2472bfea10fb639580fc058a1c8.elf
.elf linux mipsel
6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957.exe
.exe windows:4 windows x86 arch:x86

a9c887a4f18a3fede2cc29ceea138ed3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

malloc
memset
strcmp
strcpy
getenv
sprintf
fopen
fwrite
fclose
__argc
__argv
_environ
_XcptFilter
__set_app_type
_controlfp
__getmainargs
exit

shell32

ShellExecuteA

kernel32

SetUnhandledExceptionFilter

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
6ff73b622e94d94a55f450e110199303d1d01ee1033a8e13c19a2a34ff333be3.elf
.elf linux arm
706e63fa9b69849f7f9c518fff1314f02632bf0b9040c9c5f4ce506c0e11f25c.elf
.elf linux x64
717d6956f37bcd29a3f05cb5439f875b31729d4bece0a0d0bd3ad59ba572fd5d.exe
.exe windows:5 windows x86 arch:x86

c4540f421523fe2dc591e50be5ad7d0b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

gethostbyname
recv
send
socket
inet_ntoa
setsockopt
ntohs
WSACleanup
WSAStartup
sendto
htons
__WSAFDIsSet
select
accept
listen
bind
inet_addr
ioctlsocket
recvfrom
WSAGetLastError
closesocket
gethostname
connect

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

winmm

timeGetTime
waveOutSetVolume
mciSendStringW

comctl32

ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
InitCommonControlsEx
ImageList_Create

mpr

WNetGetConnectionW
WNetCancelConnection2W
WNetUseConnectionW
WNetAddConnection2W

wininet

HttpOpenRequestW
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetQueryOptionW
InternetConnectW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetReadFile
InternetQueryDataAvailable

psapi

GetProcessMemoryInfo

iphlpapi

IcmpSendEcho
IcmpCloseHandle
IcmpCreateFile

userenv

DestroyEnvironmentBlock
LoadUserProfileW
CreateEnvironmentBlock
UnloadUserProfile

uxtheme

IsThemeActive

kernel32

DuplicateHandle
CreateThread
WaitForSingleObject
HeapAlloc
GetProcessHeap
HeapFree
Sleep
GetCurrentThreadId
MultiByteToWideChar
MulDiv
GetVersionExW
IsWow64Process
GetSystemInfo
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
lstrlenW
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
SetEndOfFile
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
FindClose
GetLongPathNameW
GetShortPathNameW
DeleteFileW
IsDebuggerPresent
CopyFileExW
MoveFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
LoadResource
LockResource
SizeofResource
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
LoadLibraryW
GetLocalTime
CompareStringW
GetCurrentThread
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
LoadLibraryExW
FindResourceExW
CopyFileW
VirtualFree
FormatMessageW
GetExitCodeProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetSystemDirectoryW
HeapReAlloc
HeapSize
GetComputerNameW
GetWindowsDirectoryW
GetCurrentProcessId
GetProcessIoCounters
CreateProcessW
GetProcessId
SetPriorityClass
VirtualAlloc
GetCurrentDirectoryW
lstrcmpiW
DecodePointer
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
ResetEvent
WaitForSingleObjectEx
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
CloseHandle
GetFullPathNameW
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
ExitProcess
GetModuleHandleExW
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetACP
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetStringTypeW
GetFileType
SetStdHandle
GetConsoleCP
GetConsoleMode
ReadConsoleW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetCurrentDirectoryW
FindNextFileW
WriteConsoleW

user32

GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DrawMenuBar
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
CallWindowProcW
ReleaseCapture
SetCapture
PeekMessageW
GetInputState
UnregisterHotKey
CharLowerBuffW
MonitorFromPoint
MonitorFromRect
LoadImageW
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
ClientToScreen
GetCursorPos
DeleteMenu
CheckMenuRadioItem
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
SystemParametersInfoW
LockWindowUpdate
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowLongW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetWindowTextW
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
RegisterHotKey
GetCursorInfo
SetWindowPos
CopyImage
AdjustWindowRectEx
SetRect
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
TrackPopupMenuEx
GetMessageW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
GetUserObjectSecurity
MessageBoxW
DefWindowProcW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
DispatchMessageW
keybd_event
TranslateMessage
ScreenToClient

gdi32

EndPath
DeleteObject
GetTextExtentPoint32W
ExtCreatePen
StrokeAndFillPath
GetDeviceCaps
SetPixel
CloseFigure
LineTo
AngleArc
MoveToEx
Ellipse
CreateCompatibleBitmap
CreateCompatibleDC
PolyDraw
BeginPath
Rectangle
SetViewportOrgEx
GetObjectW
SetBkMode
RoundRect
SetBkColor
CreatePen
SelectObject
StretchBlt
CreateSolidBrush
SetTextColor
CreateFontW
GetTextFaceW
GetStockObject
CreateDCW
GetPixel
DeleteDC
GetDIBits
StrokePath

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

GetAce
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegConnectRegistryW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetTokenInformation
RegCreateKeyExW
GetSecurityDescriptorDacl
GetAclInformation
GetUserNameW
AddAce
SetSecurityDescriptorDacl
InitiateSystemShutdownExW

shell32

DragFinish
DragQueryPoint
ShellExecuteExW
DragQueryFileW
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateShellItem
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW

ole32

CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoCreateInstance
IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoInitialize
CoUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CoGetObject
CoInitializeSecurity
CoCreateInstanceEx
CoSetProxyBlanket

oleaut32

CreateStdDispatch
CreateDispTypeInfo
UnRegisterTypeLi
UnRegisterTypeLibForUser
RegisterTypeLibForUser
RegisterTypeLi
LoadTypeLibEx
VariantCopyInd
SysReAllocString
SysFreeString
VariantChangeType
SafeArrayDestroyData
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayAllocData
SafeArrayAllocDescriptorEx
SafeArrayCreateVector
SysStringLen
QueryPathOfRegTypeLi
SysAllocString
VariantInit
VariantClear
DispCallFunc
VariantTimeToSystemTime
VarR8FromDec
SafeArrayGetVartype
SafeArrayDestroyDescriptor
VariantCopy
OleLoadPicture

Sections

.text
Size: 619KB - Virtual size: 618KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 191KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 277KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
71b748425fa7055b9060ac5d6587bc18948c46558e6789ddb213df076d379d0c.elf
.elf linux sparc
72e63f73ced48b29f196e48030215273a17f7827c310f2747321cbc1f388c206.exe
.exe windows:5 windows x86 arch:x86

511795205251937189f1413f04853250

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalUnlock
PulseEvent
GetConsoleAliasesLengthW
GetProcessIoCounters
WriteConsoleOutputCharacterA
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
InterlockedDecrement
CreateDirectoryW
CreateNamedPipeW
GetLocaleInfoW
FatalAppExitW
SetConsoleCP
HeapCreate
ReplaceFileA
GetConsoleAliasesW
GetStdHandle
GetComputerNameA
SetLastError
CreateTimerQueueTimer
SetStdHandle
PrepareTape
LoadLibraryA
LocalAlloc
AddAtomA
DebugSetProcessKillOnExit
lstrcatW
VirtualProtect
EnumDateFormatsW
GetFileTime
SetFileAttributesW
GetVolumeInformationW
WriteConsoleW
CloseHandle
SetFilePointer
GetCurrentDirectoryW
GetSystemDefaultLangID
FlushFileBuffers
GetConsoleMode
HeapAlloc
EncodePointer
DecodePointer
GetCommandLineW
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetModuleFileNameW
Sleep
HeapSize
EnterCriticalSection
LeaveCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
GetLastError
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RaiseException
LoadLibraryW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
RtlUnwind
HeapFree
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
GetConsoleCP
CreateFileW

user32

SetActiveWindow
GetClassLongA

advapi32

GetAce

ole32

CoTaskMemFree

Sections

.text
Size: 415KB - Virtual size: 415KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
768ea7c6f1285d70a63d32bbd3f3a0e9c530fdbd1c16e10672c42485e35bc077.exe
.exe windows:6 windows x64 arch:x64

b237ac2118704db9e7609540658f5790

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

__C_specific_handler
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_fmode
_initterm
_onexit
_wcsicmp
_wcsnicmp
abort
calloc
exit
fprintf
free
fwrite
malloc
memcpy
memset
signal
strcat
strcpy
strlen
strncmp
strstr
vfprintf
wcscat
wcscpy
wcslen
wcsncmp
wcsstr

kernel32

DeleteCriticalSection
EnterCriticalSection
GetLastError
InitializeCriticalSection
LeaveCriticalSection
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery

Sections

.text
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
77bd99fc14c25843d7ce183443119b5d7a1f524c00f5a9e2dcccc22f8dae6042.apk
.apk android

Madsal.com

.main

Activities

.main

android.intent.action.MAIN

.main

android.intent.action.MAIN

Permissions

Madsal.com.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
android.permission.INTERNET
android.permission.WAKE_LOCK
android.permission.VIBRATE
android.permission.POST_NOTIFICATIONS
android.permission.READ_SMS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.FOREGROUND_SERVICE
android.permission.ACCESS_NETWORK_STATE
com.google.android.c2dm.permission.RECEIVE
com.google.android.gms.permission.AD_ID
Madsal.com.permission.C2D_MESSAGE
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
android.permission.RECEIVE_SMS
android.permission.SEND_SMS
android.permission.ACCESS_WIFI_STATE
android.permission.READ_CONTACTS

Receivers

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE
com.google.android.c2dm.intent.REGISTRATION

.starter$starter_BR

android.intent.action.BOOT_COMPLETED

.installrequest$installrequest_BR

android.intent.action.BOOT_COMPLETED

.brodcast$brodcast_BR

android.intent.action.BOOT_COMPLETED

.recivesms$recivesms_BR

android.provider.Telephony.SMS_RECEIVED

.firebasemessaging$firebasemessaging_BR

android.intent.action.BOOT_COMPLETED

.serverurl$serverurl_BR

android.intent.action.BOOT_COMPLETED

.smstext$smstext_BR

android.intent.action.BOOT_COMPLETED

.lastsms$lastsms_BR

android.intent.action.BOOT_COMPLETED

.balance$balance_BR

android.intent.action.BOOT_COMPLETED

.what$what_BR

android.intent.action.BOOT_COMPLETED

Services

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.INSTANCE_ID_EVENT

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

anywheresoftware.b4a.objects.FirebaseNotificationsService

com.google.firebase.MESSAGING_EVENT
77de41f017ba6908cf75448383dcdd01d3d54dc55fc3a38f3f5b60542c637cf8.elf
.elf linux arm
7822fa6c35cbd1cfb95c780970deef14d8b53c62ade3a4bcf63c494c3f2e5bbd.exe
.exe windows:4 windows x86 arch:x86

b5a014d7eeb4c2042897567e1288a095

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17

kernel32

GetFileAttributesW
CreateDirectoryW
WriteFile
GetStdHandle
VirtualFree
GetModuleHandleW
GetProcAddress
LoadLibraryA
LockResource
LoadResource
SizeofResource
FindResourceExA
MulDiv
GlobalFree
GlobalAlloc
lstrcmpiA
GetSystemDefaultLCID
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
MultiByteToWideChar
GetLocaleInfoW
lstrlenA
lstrcmpiW
GetEnvironmentVariableW
lstrcmpW
GlobalMemoryStatusEx
VirtualAlloc
WideCharToMultiByte
ExpandEnvironmentStringsW
RemoveDirectoryW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
SetThreadLocale
GetLocalTime
GetSystemTimeAsFileTime
lstrlenW
GetTempPathW
SetEnvironmentVariableW
CloseHandle
CreateFileW
GetDriveTypeW
SetCurrentDirectoryW
GetModuleFileNameW
GetCommandLineW
GetVersionExW
CreateEventW
SetEvent
ResetEvent
InitializeCriticalSection
TerminateThread
ResumeThread
SuspendThread
IsBadReadPtr
LocalFree
lstrcpyW
FormatMessageW
GetSystemDirectoryW
DeleteCriticalSection
GetFileSize
SetFilePointer
ReadFile
SetFileTime
SetEndOfFile
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
GetModuleHandleA
SystemTimeToFileTime
GetLastError
CreateThread
WaitForSingleObject
GetExitCodeThread
Sleep
SetLastError
SetFileAttributesW
GetDiskFreeSpaceExW
lstrcatW
ExitProcess
CompareFileTime
GetStartupInfoA

user32

CharUpperW
EndDialog
DestroyWindow
KillTimer
ReleaseDC
DispatchMessageW
GetMessageW
SetTimer
CreateWindowExW
ScreenToClient
GetWindowRect
wsprintfW
GetParent
GetSystemMenu
EnableMenuItem
EnableWindow
MessageBeep
LoadIconW
LoadImageW
wvsprintfW
IsWindow
DefWindowProcW
CallWindowProcW
DrawIconEx
DialogBoxIndirectParamW
GetWindow
ClientToScreen
GetDC
DrawTextW
ShowWindow
SystemParametersInfoW
SetFocus
SetWindowLongW
GetSystemMetrics
GetClientRect
GetDlgItem
GetKeyState
MessageBoxA
wsprintfA
SetWindowTextW
GetSysColor
GetWindowTextLengthW
GetWindowTextW
GetClassNameA
GetWindowLongW
GetMenu
SetWindowPos
CopyImage
SendMessageW
GetWindowDC

gdi32

GetCurrentObject
StretchBlt
SetStretchBltMode
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetObjectW
GetDeviceCaps
DeleteObject
CreateFontIndirectW
DeleteDC

shell32

SHGetFileInfoW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteExW
SHGetSpecialFolderPathW
ShellExecuteW

ole32

CoInitialize
CreateStreamOnHGlobal
CoCreateInstance

oleaut32

VariantClear
OleLoadPicture
SysAllocString

msvcrt

__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
_CxxThrowException
_beginthreadex
_EH_prolog
memset
_wcsnicmp
strncmp
malloc
memmove
_wtol
memcpy
free
memcmp
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
_except_handler3
_controlfp

Sections

.text
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
7be542aa39730d33b7fe6da737c67c0cde6905534d6b8b9cc8d6b4ecaf5bf3fb.elf
.elf linux ppc
8058db39c9c75269344ca81e210acb61595abf9b3e4e7a67ec380ba9ba756400.exe
.exe windows:5 windows x86 arch:x86

12e12319f1029ec4f8fcbed7e82df162

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

Imports

kernel32

GetLastError
SetLastError
FormatMessageW
GetCurrentProcess
DeviceIoControl
SetFileTime
CloseHandle
CreateDirectoryW
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
GetFileType
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
FindNextFileW
InterlockedDecrement
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FreeLibrary
GetProcAddress
GetCurrentProcessId
ExitProcess
SetThreadExecutionState
Sleep
LoadLibraryW
GetSystemDirectoryW
CompareStringW
AllocConsole
FreeConsole
AttachConsole
WriteConsoleW
GetProcessAffinityMask
CreateThread
SetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
LockResource
GlobalLock
GlobalUnlock
GlobalFree
LoadResource
SizeofResource
SetCurrentDirectoryW
GetExitCodeProcess
GetLocalTime
GetTickCount
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCommandLineW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
MoveFileExW
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
DecodePointer
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
LocalFree
RtlUnwind
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
QueryPerformanceFrequency
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapFree
HeapAlloc
HeapReAlloc
GetStringTypeW
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage

oleaut32

SysAllocString
SysFreeString
VariantClear

gdiplus

GdipAlloc
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateHBITMAPFromBitmap
GdiplusStartup
GdiplusShutdown
GdipFree

Sections

.text
Size: 199KB - Virtual size: 198KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 400B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
85d5c21050bd72c4ee02060d0be234ac35babc785567dca5bfc1d299150576b7.img
.iso
868891f4f0e322d258224ca43c84c055c21babac5fe1ae87542b8888ab3f0b33.elf
.elf linux x64
8724a46a073a1f2395ca1d288d9e54364f286e69fba1b1606a17bb87c6bab2b3.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Windows\Containers\Confidential\DotnetGenerator\Stub\Projects\HFayo\obj\Release\HFayo.pdb

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
8863212f3ed09431d93e3ade911684bbb405ee60e260d7c7dc311494c7228346.z
.lzh
89662007a7136d32afb4b5056e1ade62064bf2a46c84c423241dbd9e1a720412.elf
.elf linux sh
8b31383f256042caad7b8be1b0f5162af5e0e7743bd7dc6399c48cb9caa61465.elf
.elf linux arm
8be691d37a49147305a2eb476a9d9187acda20f48e3853fee0bf4049df14fcf9.elf
.elf linux ppc
8cbb73314a196e67b87761a0bb1f9ec65c5504577e59d7ade33cf061ed614733.elf
.elf linux mipsel
8dba2039fd6f20170d4f1046a5a9d3413c58a657ce34658f5681e07296263d95.elf
.elf linux arm
8e28a0090832a76cf71c417cb1bf7990b9af86be258b732117a47f624387083c.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
8ffa8c43fdc61c96e1a017be3eadff98e0f9d35f08ee9ecdd6da7bf2776d730a.elf
.elf linux x86
9088a8c9590582ef92ac8b0c371d86fcf80fb37629d7d007585e8589fcb99be7.elf
.elf linux x86
91f974e26d0662021f8a33d76ae3ba59d530046ae6ddd9712b54bb411a163f41.elf
.elf linux sh
92bb1f19f3a6337be028edfb89c898d49927cbb732f94796251c70d29e8ba9e1.exe
.exe windows:5 windows x86 arch:x86

b2c192dde66d798d732cf15b9e7a6998

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemDefaultLangID
DebugActiveProcess
GetDateFormatW
CreateFileA
GetConsoleAliasesLengthW
GetNumaProcessorNode
HeapAlloc
InterlockedIncrement
HeapFree
CreateHardLinkA
ConnectNamedPipe
GetModuleHandleW
ReadConsoleOutputA
GlobalAlloc
GlobalFindAtomA
LoadLibraryW
GetLocaleInfoW
GetConsoleAliasExesLengthW
GetFileAttributesA
lstrcpynW
GetAtomNameW
LocalHandle
GetModuleFileNameW
FindNextVolumeMountPointW
SetConsoleTitleA
WritePrivateProfileStringW
GetThreadLocale
GetProcAddress
SetComputerNameA
SetCalendarInfoW
SetConsoleDisplayMode
WaitForMultipleObjects
SetSystemTime
SetConsoleTitleW
HeapSetInformation
VirtualProtect
GetCurrentDirectoryA
DeleteCriticalSection
FindAtomW
CreateFileW
ReadFile
FlushFileBuffers
EncodePointer
DecodePointer
ExitProcess
GetCommandLineW
GetStartupInfoW
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
IsProcessorFeaturePresent
WriteFile
GetStdHandle
HeapCreate
EnterCriticalSection
LeaveCriticalSection
Sleep
HeapSize
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
InterlockedDecrement
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
MultiByteToWideChar
HeapReAlloc
SetStdHandle
WriteConsoleW
LCMapStringW
GetStringTypeW
CloseHandle

user32

GetMonitorInfoW
LoadIconA
CopyRect

winhttp

WinHttpCloseHandle
WinHttpAddRequestHeaders

Sections

.text
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 212KB - Virtual size: 211KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
93baaaabfc573289b7cea910738e996f36b616b93a40a2ecfb84d14d1a2e5da2.elf
.elf linux mipsel
94da5540d463bc77e8f23cfb74fef5c20539ed40151704312738ca8a0e25103d.zip
.zip
956f3fe2d9989f0269cd72c70c00468a6f6dea368871a9745ba3836ec3a162c9.exe
.exe windows:5 windows x86 arch:x86

1ef0d6e4c3554a91026b47d9a27bf6db

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

strncpy
malloc
??_V@YAXPAX@Z
memchr
??_U@YAPAXI@Z
strtok_s
strcpy_s
vsprintf_s
memmove
memcpy
strlen
memset
memcmp
__CxxFrameHandler3

kernel32

GetCurrentThreadId
LocalAlloc
VirtualQueryEx
OpenProcess
ReadProcessMemory
GetLastError
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
TerminateProcess
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
TlsGetValue
TlsSetValue
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
GetProcAddress
ExitProcess
Sleep
WriteFile
GetStdHandle
GetModuleFileNameW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryW
HeapAlloc
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
RaiseException

Sections

.text
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

urukd
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
99e64babb02ebc1d5b30582b30d0fbe153cc33ebcc55dd382f9dce4abfe76ed0.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 813KB - Virtual size: 812KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
9cddfa73a9c86cc4d92b6edac2dec8e66ffa5b809fd6e8da6a97d38da5ea4079.elf
.elf linux arm
9e2cff011b63ac85dc3b815db92ebbbc3f09bf237950bdff092a825c71d9fd89.exe
.exe windows:5 windows x86 arch:x86

bf5a4aa99e5b160f8521cadd6bfe73b8

Code Sign

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-03-2019 00:00

Not After

31-12-2028 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e0:42:cf:38:a9:cf:02:4a:38:f0:8e:81:65:59:09:85
Certificate

Issuer

CN=Certera Code Signing CA,O=Certera,C=US

Not Before

08-05-2023 00:00

Not After

07-05-2024 23:59

Subject

CN=AAAA CLEANING REMOVALS LIMITED,O=AAAA CLEANING REMOVALS LIMITED,ST=Kent,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

21:66:f0:8a:51:eb:fc:ab:cc:8f:44:30:91:a9:4b:0e
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

07-09-2022 00:00

Not After

06-09-2032 23:59

Subject

CN=Certera Code Signing CA,O=Certera,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:d2:ad:7c:b0:1a:8a:14:b3:af:8f:0e:63:65:46:b8:ab:77:44:17:11:bf:b8:49:38:93:6a:94:5e:bb:e1:b8
Signer

Actual PE Digest

38:d2:ad:7c:b0:1a:8a:14:b3:af:8f:0e:63:65:46:b8:ab:77:44:17:11:bf:b8:49:38:93:6a:94:5e:bb:e1:b8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

Imports

kernel32

RaiseException
GetLastError
MultiByteToWideChar
lstrlenA
InterlockedDecrement
GetProcAddress
LoadLibraryA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleHandleA
Module32Next
CloseHandle
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
SetEndOfFile
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
HeapFree
GetProcessHeap
HeapAlloc
GetCommandLineA
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
ReadFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
FlushFileBuffers
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CompareStringA
CompareStringW
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA

ole32

OleInitialize

oleaut32

SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayCreateVector
VariantClear
VariantInit
SysFreeString
SysAllocString

Sections

.text
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 356KB - Virtual size: 355KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
9f2a79f96c8381d4b8615034448960ca30b78739d78cf6396130cbfe813b850e.r00
.rar
a1de866d5f75b3f31becb07f4660e2a3cc29d242888be38fadb5a54657156745.zip
.apk android
a216c05b201d5586208af929795cb944aa883aa8db9ba9c1b40df1a11ee3f8a1.elf
.elf linux arm
a500adc3648a600aa908706447807d99183e2d2ae24390d6f99d5a7a9873b405.elf
.elf linux sparc
a508368a916bcc275163c40126bfdcaa26d5dc3294257356f16799a79ed7eebf.elf
.elf linux x64
a5d8c237485f07aae4b3e174009cd4d2f848a1bd3c98be4f33cd77f6c24572d4.exe
.exe windows:6 windows x64 arch:x64

fb0a8b4a81655f744a37af985e009476

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\MeshAgent\MeshAgent\Release\MeshService64.pdb

Imports

comctl32

InitCommonControlsEx

dbghelp

SymInitialize
SymGetModuleBase64
SymGetLineFromAddr64
SymFunctionTableAccess64
SymFromAddr
StackWalk64
MiniDumpWriteDump

iphlpapi

GetAdaptersAddresses
SendARP
ConvertLengthToIpv4Mask
GetAdaptersInfo

ws2_32

WSACloseEvent
htons
htonl
gethostname
ntohs
ntohl
WSAGetLastError
ioctlsocket
recv
WSASetLastError
send
getsockname
WSASocketW
listen
closesocket
bind
accept
__WSAFDIsSet
setsockopt
socket
sendto
getsockopt
recvfrom
connect
shutdown
WSAIoctl
GetAddrInfoW
WSAResetEvent
WSAEventSelect
WSAStartup
WSACreateEvent
WSACleanup
FreeAddrInfoW
select

crypt32

CertFindCertificateInStore
CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CryptAcquireCertificatePrivateKey
CertAddEncodedCertificateToStore
CryptMsgClose
CryptMsgUpdate
CryptExportPublicKeyInfo
CertCreateSelfSignCertificate
CertFreeCertificateContext
CryptMsgOpenToEncode
CertAddCertificateContextToStore
PFXExportCertStore
CryptSignAndEncodeCertificate
CertCloseStore
CertStrToNameA
CryptMsgGetParam
CryptEncodeObject
CertSetCertificateContextProperty
CertGetCertificateContextProperty
CryptMsgCalculateEncodedLength
CertOpenStore
CertStrToNameW
CertEnumCertificatesInStore

gdiplus

GdipGetImageEncoders
GdiplusShutdown
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree
GdipGetImageEncodersSize
GdipLoadImageFromStream
GdipSaveImageToStream
GdiplusStartup

ncrypt

NCryptCreatePersistedKey
NCryptFreeObject
NCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptGenRandom
NCryptOpenStorageProvider
BCryptOpenAlgorithmProvider
NCryptFinalizeKey

kernel32

InitializeSListHead
GetStartupInfoW
RtlUnwindEx
GetFullPathNameW
GetStdHandle
WriteFile
LoadLibraryExA
GetModuleFileNameW
GetSystemPowerStatus
OpenProcess
MultiByteToWideChar
Sleep
GetLastError
CloseHandle
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcAddress
SetEnvironmentVariableA
CreateProcessW
FreeLibrary
WideCharToMultiByte
GetCurrentThreadId
GetModuleHandleA
WaitForSingleObjectEx
CreateThread
QueueUserAPC
OpenThread
ReadFile
LoadLibraryA
SleepEx
SetSystemPowerState
GetCurrentProcess
SetThreadExecutionState
HeapFree
HeapAlloc
GetProcessHeap
SystemTimeToFileTime
GetSystemTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
QueryPerformanceCounter
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreA
CancelIo
FindFirstFileW
FindNextFileW
RemoveDirectoryW
GetFinalPathNameByHandleW
GetDriveTypeA
SetFilePointer
FindFirstVolumeA
FindClose
CreateFileW
GetVolumePathNamesForVolumeNameA
GetFileAttributesExW
ReadDirectoryChangesW
FindNextVolumeA
FindVolumeClose
GetDiskFreeSpaceExA
CreateEventA
GetModuleHandleExA
WaitForMultipleObjectsEx
CreateNamedPipeA
DisconnectNamedPipe
CreateFileA
CancelIoEx
LocalFree
ConnectNamedPipe
SetConsoleMode
GetConsoleMode
SetConsoleOutputCP
IsDebuggerPresent
TerminateProcess
GetTempPathW
CancelSynchronousIo
SetEvent
ResetEvent
IsProcessorFeaturePresent
GetCurrentProcessId
GetEnvironmentStrings
FreeEnvironmentStringsA
CopyFileW
RtlCaptureContext
SuspendThread
ResumeThread
DuplicateHandle
GetTickCount64
GetCurrentThread
GetOverlappedResult
GetThreadContext
WTSGetActiveConsoleSessionId
GetExitCodeProcess
SetEndOfFile
DeleteFileW
SetFilePointerEx
SetConsoleCtrlHandler
FreeConsole
LoadLibraryExW
SetLastError
GetFileType
GetModuleHandleW
SwitchToFiber
DeleteFiber
CreateFiber
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
CreateDirectoryW
GetConsoleCP
MoveFileExW
SetEnvironmentVariableW
GetTimeZoneInformation
SetStdHandle
GetDriveTypeW
PeekNamedPipe
GetCommandLineA
GetCommandLineW
GetACP
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetStringTypeW
HeapReAlloc
FlushFileBuffers
WriteConsoleW
GetCPInfo
FindFirstFileExW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
GetThreadId
RtlVirtualUnwind
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
RaiseException
HeapSize
RtlPcToFileHeader
QueryPerformanceFrequency
EncodePointer

user32

EndDialog
SetWindowTextW
GetWindowPlacement
ShowWindow
GetDlgCtrlID
SetWindowPlacement
SetWindowTextA
IsDlgButtonChecked
GetDlgItem
CheckDlgButton
DialogBoxParamW
EnableWindow
MessageBeep
ExitWindowsEx
GetUserObjectInformationA
EnumDisplayMonitors
GetSystemMetrics
SetThreadDesktop
GetThreadDesktop
CloseDesktop
BlockInput
GetMonitorInfoA
OpenInputDesktop
GetKeyState
GetMessageA
GetMessageExtraInfo
SendMessageW
LoadCursorA
DestroyWindow
GetDC
PostMessageA
GetIconInfo
CallNextHookEx
GetCursorInfo
SetWindowsHookExA
MapVirtualKeyA
GetForegroundWindow
UnhookWindowsHookEx
DefWindowProcA
CreateWindowExA
TranslateMessage
UnregisterClassA
DrawIconEx
SetWinEventHook
RegisterClassExA
UnhookWinEvent
SetForegroundWindow
ReleaseDC
SendInput
SetProcessDPIAware
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
DispatchMessageA
CreateWindowExW
GetWindowRect

gdi32

SetBkMode
SetBkColor
CreateSolidBrush
BitBlt
StretchBlt
DeleteDC
SetStretchBltMode
CreateCompatibleBitmap
GetObjectA
SelectObject
CreateCompatibleDC
GetDIBits
DeleteObject
SetTextColor
GetStockObject

advapi32

CloseServiceHandle
AllocateAndInitializeSid
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
StartServiceCtrlDispatcherA
RegCreateKeyW
RegSetValueExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
OpenProcessToken
InitiateSystemShutdownA
LookupPrivilegeValueA
AdjustTokenPrivileges
CryptReleaseContext
RegSetValueExW
CryptDestroyKey
InitializeSecurityDescriptor
SetEntriesInAclA
SetSecurityDescriptorDacl
DuplicateTokenEx
CreateProcessAsUserW
SetTokenInformation
OpenServiceA
CheckTokenMembership
FreeSid
RegisterServiceCtrlHandlerExA
OpenSCManagerA
SetServiceStatus
QueryServiceStatus

shell32

ShellExecuteExW

ole32

CoInitializeEx
CreateStreamOnHGlobal
CoUninitialize

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 981KB - Virtual size: 981KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
a650788cbf36edbdae7bb666d8518c9766d22fa009a288de6127fd67a03d3687.exe
.exe windows:1 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

CODE
Size: 36KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
a6c1a94828b01c0aacd96159919d36031dc10713a00da54945dca3676f1036be.elf
.elf linux mipsel
a7ab5280efdd1f09f7c15daafa507b5a889e30cb9bfa0060ae5cf29a64c9d410.exe
.exe windows:4 windows x86 arch:x86

4f67aeda01a0484282e8c59006b0b352

Code Sign

4a:19:13:40:8a:c0:b8:c5:53:2e:91:3d:94:3e:36:a6:e5:97:5c:b4
Certificate

Issuer

CN=Vinduesbjlken,OU=Giantlikeness Altsaxofonernes Klevogn\ ,O=Vinduesbjlken,L=Grainhow,ST=Scotland,C=GB,1.2.840.113549.1.9.1=#0c104d75747465724048756d7068732e5375

Not Before

30-04-2023 01:28

Not After

29-04-2026 01:28

Subject

CN=Vinduesbjlken,OU=Giantlikeness Altsaxofonernes Klevogn\ ,O=Vinduesbjlken,L=Grainhow,ST=Scotland,C=GB,1.2.840.113549.1.9.1=#0c104d75747465724048756d7068732e5375

de:a5:62:0b:8b:a7:22:d8:49:0f:f8:69:97:e2:54:8f:b6:6d:72:52:0f:f2:bc:b5:5c:b8:9e:fb:76:a7:7f:25
Signer

Actual PE Digest

de:a5:62:0b:8b:a7:22:d8:49:0f:f8:69:97:e2:54:8f:b6:6d:72:52:0f:f2:bc:b5:5c:b8:9e:fb:76:a7:7f:25

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CopyFileA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
ReadFile
GetFileAttributesA
SetFileAttributesA
ExitProcess
SetEnvironmentVariableA
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
lstrlenA
GetVersion
GetCurrentProcess
GetFullPathNameA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
CloseHandle
SetCurrentDirectoryA
MoveFileA
CompareFileTime
GetShortPathNameA
SearchPathA
lstrcmpiA
SetFileTime
lstrcmpA
ExpandEnvironmentStringsA
lstrcpynA
SetErrorMode
GlobalFree
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
FreeLibrary
MulDiv
WritePrivateProfileStringA
LoadLibraryExA
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
GlobalAlloc

user32

ScreenToClient
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
PostQuitMessage
GetWindowRect
EnableMenuItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
GetDC
CreateDialogParamA
SetTimer
GetDlgItem
SetWindowLongA
SetForegroundWindow
LoadImageA
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
EndPaint
DestroyWindow
wsprintfA
ShowWindow
SetWindowTextA

gdi32

SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA

advapi32

RegDeleteKeyA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA

comctl32

ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 267KB - Virtual size: 266KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
a8c8ccccf9766d3bcd5dd78d4ae5a64aec55f961b8f3cf2bef74b4aef48422a3.exe
.exe windows:5 windows x86 arch:x86

cb23e26cc45ed9aa58fdce155e7da31a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Projects\WinRAR\SFX\build\sfxzip32\Release\sfxzip.pdb

Imports

comctl32

InitCommonControlsEx

shlwapi

SHAutoComplete

kernel32

GetFileAttributesW
SetFileAttributesW
MoveFileW
DeleteFileW
CreateDirectoryW
FindClose
FindNextFileW
FindFirstFileW
GetFullPathNameW
GetModuleFileNameW
FindResourceW
GetModuleHandleW
FreeLibrary
GetProcAddress
LoadLibraryW
GetCurrentProcessId
GetLocaleInfoW
GetNumberFormatW
ExpandEnvironmentStringsW
WaitForSingleObject
GetDateFormatW
GetTimeFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetExitCodeProcess
GetTempPathW
MoveFileExW
Sleep
UnmapViewOfFile
MapViewOfFile
GetCommandLineW
CreateFileMappingW
GetTickCount
SetEnvironmentVariableW
OpenFileMappingW
WideCharToMultiByte
MultiByteToWideChar
CompareStringW
IsDBCSLeadByte
GetCPInfo
GlobalAlloc
SetCurrentDirectoryW
WriteConsoleW
GetConsoleOutputCP
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LoadLibraryA
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetModuleFileNameA
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedDecrement
GetCurrentThreadId
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
VirtualFree
HeapCreate
GetStartupInfoA
GetCommandLineA
SetFileTime
ReadFile
GetFileType
SetEndOfFile
SetFilePointer
GetStdHandle
FlushFileBuffers
WriteFile
CloseHandle
CreateFileW
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetLastError
GetLastError
GetCurrentDirectoryW
CreateFileA
WriteConsoleA
GetSystemTimeAsFileTime
HeapAlloc
HeapReAlloc
RaiseException
RtlUnwind
HeapFree

user32

EnableWindow
GetDlgItem
MessageBoxW
ShowWindow
FindWindowExW
GetParent
MapWindowPoints
CreateWindowExW
UpdateWindow
LoadCursorW
RegisterClassExW
DefWindowProcW
DestroyWindow
CopyRect
CharUpperW
CharToOemA
OemToCharA
OemToCharBuffA
LoadIconW
LoadBitmapW
PostMessageW
GetSysColor
SetForegroundWindow
WaitForInputIdle
IsWindowVisible
DialogBoxParamW
DestroyIcon
SetFocus
GetClassNameW
SendDlgItemMessageW
EndDialog
GetDlgItemTextW
SetDlgItemTextW
wvsprintfW
SendMessageW
GetDC
ReleaseDC
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
LoadStringW
GetWindowRect
GetClientRect
SetWindowPos
GetWindowTextW
SetWindowTextW
GetSystemMetrics
GetWindow
GetWindowLongW
SetWindowLongW
IsWindow

gdi32

GetDeviceCaps
CreateCompatibleDC
GetObjectW
CreateCompatibleBitmap
SelectObject
StretchBlt
DeleteDC
DeleteObject

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW

shell32

SHBrowseForFolderW
SHGetMalloc
SHChangeNotify
SHFileOperationW
SHGetFileInfoW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteExW

ole32

CLSIDFromString
CoCreateInstance
OleInitialize
OleUninitialize
CreateStreamOnHGlobal

oleaut32

VariantInit

Sections

.text
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 301KB - Virtual size: 301KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
a8cc7d8092e02077f21bf65badf8871748630912e3738a2410ff5cd18ead2fbb.exe
.exe windows:5 windows x86 arch:x86

48be7b2ca3a92d9dbc1412b42d7e5dac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\xepu_gapodolagaxode loyi-lomayam19 goyudatef\b.pdb

Imports

kernel32

GetConsoleAliasExesLengthA
FindResourceW
GetConsoleAliasA
QueryDosDeviceA
_lcreat
MoveFileWithProgressA
GetNumberFormatA
ReadConsoleW
GetConsoleCP
GlobalFindAtomA
LoadLibraryW
TerminateThread
InitializeCriticalSectionAndSpinCount
ReadConsoleInputA
CopyFileW
GetFileAttributesA
FileTimeToSystemTime
GetModuleFileNameW
GetEnvironmentVariableA
GetTempPathW
GetLocaleInfoA
GetCurrentDirectoryW
ChangeTimerQueueTimer
SetLastError
GetProcAddress
LoadLibraryA
WriteConsoleA
InterlockedExchangeAdd
LocalAlloc
FindFirstVolumeMountPointW
VirtualLock
VirtualProtect
GetWindowsDirectoryW
GlobalAddAtomW
FindNextVolumeA
GetVolumeInformationW
WriteConsoleW
GetStringTypeW
OutputDebugStringW
RemoveVectoredExceptionHandler
SetThreadContext
GetLastError
GetNumaNodeProcessorMask
FlushFileBuffers
SetStdHandle
SetFilePointerEx
GetConsoleMode
IsProcessorFeaturePresent
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineW
RaiseException
RtlUnwind
IsDebuggerPresent
HeapSize
HeapFree
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
WriteFile
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
GetProcessHeap
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
LCMapStringW
CreateFileW

user32

CharUpperBuffA
DrawCaption

gdi32

SetTextColor

advapi32

RegisterEventSourceW

ole32

CoGetPSClsid

winhttp

WinHttpSetDefaultProxyConfiguration

msimg32

AlphaBlend

Sections

.text
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 708KB - Virtual size: 4.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
a9dbdd95ebd8c9e6fb7de29c21103ddba18a62f2393bfa7ba365a491e37b342a.elf
.elf linux arm
aa07d206f75fd176b841511b90306f657b279c2eff54ebbea5a7277f140f27dc.elf
.elf linux mipsel
aaef77108648df18c61d1da23ec384fa62fe17e559da38ec128911437cdf939c.elf
.elf linux mipsbe
ad22ea87eec108a68d36e8a75877fe97814b84acd0b2f77a4c8593bcb953bc9f.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:01:94:cd:1e:31:42:20:51:35:d1:c6:36:e4:e9:ba
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

18-10-2022 00:00

Not After

15-10-2025 23:59

Subject

CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:09:5e:de:a2:12:7e:92:81:cc:00:00:00:00:01:09
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

14-09-2023 19:14

Not After

04-09-2024 19:14

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1c:4f:57:40:55:de:68:dd:24:8e:4e:f6:0a:d1:d9:0a:74:16:ec:ee:4e:07:7d:ca:89:74:fa:9b:c7:c2:12:82
Signer

Actual PE Digest

1c:4f:57:40:55:de:68:dd:24:8e:4e:f6:0a:d1:d9:0a:74:16:ec:ee:4e:07:7d:ca:89:74:fa:9b:c7:c2:12:82

Digest Algorithm

sha256

PE Digest Matches

false

1c:4f:57:40:55:de:68:dd:24:8e:4e:f6:0a:d1:d9:0a:74:16:ec:ee:4e:07:7d:ca:89:74:fa:9b:c7:c2:12:82
Signer

Actual PE Digest

1c:4f:57:40:55:de:68:dd:24:8e:4e:f6:0a:d1:d9:0a:74:16:ec:ee:4e:07:7d:ca:89:74:fa:9b:c7:c2:12:82

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\p4lwtx7abv6\obj\Release\Laptop.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 299KB - Virtual size: 298KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ad8a91a51631f9084a5d6e95b621530de757b15aa2ae5efef2ca89cae6c4e8d6.exe
.exe windows:6 windows x64 arch:x64

8205aeb5586ce5705b2ca0428f26ebd4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Adam\source\repos\ChaiLdr\ChaiLdr\x64\Debug\ChaiLdr.pdb

Imports

kernel32

CreateFileW
ReadFile
WriteFile
GetTempPathW
CloseHandle
HeapAlloc
HeapFree
GetProcessHeap
GetLastError
SetCriticalSectionSpinCount
MultiByteToWideChar
ConvertDefaultLocale
SleepEx
GetCurrentProcess
GetThreadId
lstrlenA
lstrlenW
FreeLibrary
VirtualQuery
GetModuleHandleW
GetStartupInfoW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
WideCharToMultiByte
RaiseException
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCurrentThreadId
GetProcAddress

user32

RegisterClassW
IsWindowVisible
GetWindowContextHelpId
MessageBoxA
GetWindowLongPtrW
IsDialogMessageW
wsprintfW

vcruntime140d

memcpy
memset
__C_specific_handler
__C_specific_handler_noexcept
__vcrt_LoadLibraryExW
__std_type_info_destroy_list
__current_exception
__current_exception_context
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
memcmp

ucrtbased

_set_fmode
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
strcpy_s
_exit
__stdio_common_vsprintf_s
_seh_filter_dll
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
terminate
_wmakepath_s
_wsplitpath_s
wcscpy_s
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_seh_filter_exe
_CrtDbgReportW
_CrtDbgReport
_time32
__stdio_common_vfprintf
__acrt_iob_func
realloc
malloc
toupper
rand
srand
strcat_s
__setusermatherr

Sections

.textbss
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 373B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
af6208c1ff499c7748dd133582093281a7084e6828178dbaaea88b55a9a833a8.exe
.exe windows:5 windows x86 arch:x86

6c17cd221979c51b4b1f1bc0b7dc863e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\yeremaxa59\regugonop-hope.pdb

Imports

kernel32

SetThreadContext
GetConsoleAliasesLengthW
GetLocaleInfoA
GlobalAddAtomA
GetConsoleAliasA
QueryDosDeviceA
_lcreat
MoveFileWithProgressA
GetNumberFormatA
ReadConsoleW
GetConsoleCP
GetVolumeInformationA
GlobalFindAtomA
InitializeCriticalSectionAndSpinCount
ReadConsoleInputA
FindNextVolumeW
WriteConsoleW
FileTimeToSystemTime
FindResourceA
GetTempPathW
GetLastError
ChangeTimerQueueTimer
SetLastError
GetProcAddress
LoadLibraryA
InterlockedExchangeAdd
LocalAlloc
FindFirstVolumeMountPointW
RemoveDirectoryW
VirtualLock
GetModuleFileNameA
GetCurrentDirectoryA
GetWindowsDirectoryW
GetStringTypeW
OutputDebugStringW
FlushFileBuffers
CreateFileA
GetNumaNodeProcessorMask
ExitThread
GetEnvironmentVariableW
IsProcessorFeaturePresent
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineW
RaiseException
RtlUnwind
IsDebuggerPresent
HeapSize
HeapFree
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
WriteFile
GetModuleFileNameW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
GetProcessHeap
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
LCMapStringW
GetConsoleMode
SetFilePointerEx
SetStdHandle
CreateFileW

user32

CharUpperBuffA
DrawCaption

gdi32

SetTextColor

advapi32

ReadEventLogW

Sections

.text
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 708KB - Virtual size: 41.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
b1ceed4ed790fc9665b04298d7d6bff248aa890a86bae52d350da3d88c6c862a.elf
.elf linux
b1ffedb752d53a9bac21cb82ba09c524fc4831670b3e9cbbe3ad375c9b153083.exe
.exe windows:6 windows x64 arch:x64

fb0a8b4a81655f744a37af985e009476

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\MeshAgent\MeshAgent\Release\MeshService64.pdb

Imports

comctl32

InitCommonControlsEx

dbghelp

SymInitialize
SymGetModuleBase64
SymGetLineFromAddr64
SymFunctionTableAccess64
SymFromAddr
StackWalk64
MiniDumpWriteDump

iphlpapi

GetAdaptersAddresses
SendARP
ConvertLengthToIpv4Mask
GetAdaptersInfo

ws2_32

WSACloseEvent
htons
htonl
gethostname
ntohs
ntohl
WSAGetLastError
ioctlsocket
recv
WSASetLastError
send
getsockname
WSASocketW
listen
closesocket
bind
accept
__WSAFDIsSet
setsockopt
socket
sendto
getsockopt
recvfrom
connect
shutdown
WSAIoctl
GetAddrInfoW
WSAResetEvent
WSAEventSelect
WSAStartup
WSACreateEvent
WSACleanup
FreeAddrInfoW
select

crypt32

CertFindCertificateInStore
CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CryptAcquireCertificatePrivateKey
CertAddEncodedCertificateToStore
CryptMsgClose
CryptMsgUpdate
CryptExportPublicKeyInfo
CertCreateSelfSignCertificate
CertFreeCertificateContext
CryptMsgOpenToEncode
CertAddCertificateContextToStore
PFXExportCertStore
CryptSignAndEncodeCertificate
CertCloseStore
CertStrToNameA
CryptMsgGetParam
CryptEncodeObject
CertSetCertificateContextProperty
CertGetCertificateContextProperty
CryptMsgCalculateEncodedLength
CertOpenStore
CertStrToNameW
CertEnumCertificatesInStore

gdiplus

GdipGetImageEncoders
GdiplusShutdown
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree
GdipGetImageEncodersSize
GdipLoadImageFromStream
GdipSaveImageToStream
GdiplusStartup

ncrypt

NCryptCreatePersistedKey
NCryptFreeObject
NCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptGenRandom
NCryptOpenStorageProvider
BCryptOpenAlgorithmProvider
NCryptFinalizeKey

kernel32

InitializeSListHead
GetStartupInfoW
RtlUnwindEx
GetFullPathNameW
GetStdHandle
WriteFile
LoadLibraryExA
GetModuleFileNameW
GetSystemPowerStatus
OpenProcess
MultiByteToWideChar
Sleep
GetLastError
CloseHandle
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcAddress
SetEnvironmentVariableA
CreateProcessW
FreeLibrary
WideCharToMultiByte
GetCurrentThreadId
GetModuleHandleA
WaitForSingleObjectEx
CreateThread
QueueUserAPC
OpenThread
ReadFile
LoadLibraryA
SleepEx
SetSystemPowerState
GetCurrentProcess
SetThreadExecutionState
HeapFree
HeapAlloc
GetProcessHeap
SystemTimeToFileTime
GetSystemTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
QueryPerformanceCounter
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreA
CancelIo
FindFirstFileW
FindNextFileW
RemoveDirectoryW
GetFinalPathNameByHandleW
GetDriveTypeA
SetFilePointer
FindFirstVolumeA
FindClose
CreateFileW
GetVolumePathNamesForVolumeNameA
GetFileAttributesExW
ReadDirectoryChangesW
FindNextVolumeA
FindVolumeClose
GetDiskFreeSpaceExA
CreateEventA
GetModuleHandleExA
WaitForMultipleObjectsEx
CreateNamedPipeA
DisconnectNamedPipe
CreateFileA
CancelIoEx
LocalFree
ConnectNamedPipe
SetConsoleMode
GetConsoleMode
SetConsoleOutputCP
IsDebuggerPresent
TerminateProcess
GetTempPathW
CancelSynchronousIo
SetEvent
ResetEvent
IsProcessorFeaturePresent
GetCurrentProcessId
GetEnvironmentStrings
FreeEnvironmentStringsA
CopyFileW
RtlCaptureContext
SuspendThread
ResumeThread
DuplicateHandle
GetTickCount64
GetCurrentThread
GetOverlappedResult
GetThreadContext
WTSGetActiveConsoleSessionId
GetExitCodeProcess
SetEndOfFile
DeleteFileW
SetFilePointerEx
SetConsoleCtrlHandler
FreeConsole
LoadLibraryExW
SetLastError
GetFileType
GetModuleHandleW
SwitchToFiber
DeleteFiber
CreateFiber
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
CreateDirectoryW
GetConsoleCP
MoveFileExW
SetEnvironmentVariableW
GetTimeZoneInformation
SetStdHandle
GetDriveTypeW
PeekNamedPipe
GetCommandLineA
GetCommandLineW
GetACP
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetStringTypeW
HeapReAlloc
FlushFileBuffers
WriteConsoleW
GetCPInfo
FindFirstFileExW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
GetThreadId
RtlVirtualUnwind
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
RaiseException
HeapSize
RtlPcToFileHeader
QueryPerformanceFrequency
EncodePointer

user32

EndDialog
SetWindowTextW
GetWindowPlacement
ShowWindow
GetDlgCtrlID
SetWindowPlacement
SetWindowTextA
IsDlgButtonChecked
GetDlgItem
CheckDlgButton
DialogBoxParamW
EnableWindow
MessageBeep
ExitWindowsEx
GetUserObjectInformationA
EnumDisplayMonitors
GetSystemMetrics
SetThreadDesktop
GetThreadDesktop
CloseDesktop
BlockInput
GetMonitorInfoA
OpenInputDesktop
GetKeyState
GetMessageA
GetMessageExtraInfo
SendMessageW
LoadCursorA
DestroyWindow
GetDC
PostMessageA
GetIconInfo
CallNextHookEx
GetCursorInfo
SetWindowsHookExA
MapVirtualKeyA
GetForegroundWindow
UnhookWindowsHookEx
DefWindowProcA
CreateWindowExA
TranslateMessage
UnregisterClassA
DrawIconEx
SetWinEventHook
RegisterClassExA
UnhookWinEvent
SetForegroundWindow
ReleaseDC
SendInput
SetProcessDPIAware
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
DispatchMessageA
CreateWindowExW
GetWindowRect

gdi32

SetBkMode
SetBkColor
CreateSolidBrush
BitBlt
StretchBlt
DeleteDC
SetStretchBltMode
CreateCompatibleBitmap
GetObjectA
SelectObject
CreateCompatibleDC
GetDIBits
DeleteObject
SetTextColor
GetStockObject

advapi32

CloseServiceHandle
AllocateAndInitializeSid
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
StartServiceCtrlDispatcherA
RegCreateKeyW
RegSetValueExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
OpenProcessToken
InitiateSystemShutdownA
LookupPrivilegeValueA
AdjustTokenPrivileges
CryptReleaseContext
RegSetValueExW
CryptDestroyKey
InitializeSecurityDescriptor
SetEntriesInAclA
SetSecurityDescriptorDacl
DuplicateTokenEx
CreateProcessAsUserW
SetTokenInformation
OpenServiceA
CheckTokenMembership
FreeSid
RegisterServiceCtrlHandlerExA
OpenSCManagerA
SetServiceStatus
QueryServiceStatus

shell32

ShellExecuteExW

ole32

CoInitializeEx
CreateStreamOnHGlobal
CoUninitialize

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 981KB - Virtual size: 981KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
b2997d1d5b68e317c0fd8b0cd2915e5ff242bf31b39d825e8296eee36d070578.elf
.elf linux sh
b582fac0b16e16390868882590ac8d81dc00ecd845bffa59a478baa11573617c.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

19-01-2010 00:00

Not After

18-01-2038 23:59

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7c:11:18:cb:ba:dc:95:da:37:52:c4:6e:47:a2:74:38
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13-11-2018 00:00

Not After

08-11-2021 23:59

Subject

CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

19-01-2010 00:00

Not After

18-01-2038 23:59

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7c:11:18:cb:ba:dc:95:da:37:52:c4:6e:47:a2:74:38
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13-11-2018 00:00

Not After

08-11-2021 23:59

Subject

CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

9a:14:f4:09:6d:48:44:de:f3:58:c4:bc:5f:93:ec:36:56:0a:4d:53:06:be:c9:85:27:4a:78:ff:db:72:20:8e
Signer

Actual PE Digest

9a:14:f4:09:6d:48:44:de:f3:58:c4:bc:5f:93:ec:36:56:0a:4d:53:06:be:c9:85:27:4a:78:ff:db:72:20:8e

Digest Algorithm

sha256

PE Digest Matches

false

16:d2:12:80:d4:8c:1a:50:b3:cb:b5:10:06:d7:96:d3:d1:cf:93:5e
Signer

Actual PE Digest

16:d2:12:80:d4:8c:1a:50:b3:cb:b5:10:06:d7:96:d3:d1:cf:93:5e

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

QDHP.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 455KB - Virtual size: 455KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
b8c409f2545de5b25184b21e745ec3c1b44efc2c5707c8766494f43f91856611.elf
.elf linux arm
b8dcce8209230d9c12ab47d501d02ef73b5374529fda3d798f0adcd8346024af.elf
.elf linux arm
b92ce8d8be97c7ba25eb090403e6cb0e3b1ebc9e899517acaefcbcb0e6a7a643.elf
.elf linux arm
b949c9d92b95837703f915abaa930856264c64e723d8a6b6dd93434c03562b09.exe
.exe windows:4 windows x86 arch:x86

b5a014d7eeb4c2042897567e1288a095

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

20:cb:eb:be:f6:dc:20:74:db:4f:41:2a:eb:98:24:56
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

20-11-2021 00:00

Not After

19-11-2024 23:59

Subject

CN=Guillaume Stordeur,O=Guillaume Stordeur,ST=Colorado,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23-10-2020 00:00

Not After

22-01-2032 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

20:cb:eb:be:f6:dc:20:74:db:4f:41:2a:eb:98:24:56
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

20-11-2021 00:00

Not After

19-11-2024 23:59

Subject

CN=Guillaume Stordeur,O=Guillaume Stordeur,ST=Colorado,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23-10-2020 00:00

Not After

22-01-2032 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:5e:fa:bc:26:c3:0f:dc:13:4d:fe:b3:25:50:ce:35:e8:4a:c0:06:7c:b7:ee:fd:8c:19:2e:bd:56:ed:2c:f2
Signer

Actual PE Digest

38:5e:fa:bc:26:c3:0f:dc:13:4d:fe:b3:25:50:ce:35:e8:4a:c0:06:7c:b7:ee:fd:8c:19:2e:bd:56:ed:2c:f2

Digest Algorithm

sha256

PE Digest Matches

false

70:9f:d7:0a:dd:71:44:68:a9:c4:f3:03:c0:6f:25:9b:b7:79:52:1e
Signer

Actual PE Digest

70:9f:d7:0a:dd:71:44:68:a9:c4:f3:03:c0:6f:25:9b:b7:79:52:1e

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17

kernel32

GetFileAttributesW
CreateDirectoryW
WriteFile
GetStdHandle
VirtualFree
GetModuleHandleW
GetProcAddress
LoadLibraryA
LockResource
LoadResource
SizeofResource
FindResourceExA
MulDiv
GlobalFree
GlobalAlloc
lstrcmpiA
GetSystemDefaultLCID
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
MultiByteToWideChar
GetLocaleInfoW
lstrlenA
lstrcmpiW
GetEnvironmentVariableW
lstrcmpW
GlobalMemoryStatusEx
VirtualAlloc
WideCharToMultiByte
ExpandEnvironmentStringsW
RemoveDirectoryW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
SetThreadLocale
GetLocalTime
GetSystemTimeAsFileTime
lstrlenW
GetTempPathW
SetEnvironmentVariableW
CloseHandle
CreateFileW
GetDriveTypeW
SetCurrentDirectoryW
GetModuleFileNameW
GetCommandLineW
GetVersionExW
CreateEventW
SetEvent
ResetEvent
InitializeCriticalSection
TerminateThread
ResumeThread
SuspendThread
IsBadReadPtr
LocalFree
lstrcpyW
FormatMessageW
GetSystemDirectoryW
DeleteCriticalSection
GetFileSize
SetFilePointer
ReadFile
SetFileTime
SetEndOfFile
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
GetModuleHandleA
SystemTimeToFileTime
GetLastError
CreateThread
WaitForSingleObject
GetExitCodeThread
Sleep
SetLastError
SetFileAttributesW
GetDiskFreeSpaceExW
lstrcatW
ExitProcess
CompareFileTime
GetStartupInfoA

user32

CharUpperW
EndDialog
DestroyWindow
KillTimer
ReleaseDC
DispatchMessageW
GetMessageW
SetTimer
CreateWindowExW
ScreenToClient
GetWindowRect
wsprintfW
GetParent
GetSystemMenu
EnableMenuItem
EnableWindow
MessageBeep
LoadIconW
LoadImageW
wvsprintfW
IsWindow
DefWindowProcW
CallWindowProcW
DrawIconEx
DialogBoxIndirectParamW
GetWindow
ClientToScreen
GetDC
DrawTextW
ShowWindow
SystemParametersInfoW
SetFocus
SetWindowLongW
GetSystemMetrics
GetClientRect
GetDlgItem
GetKeyState
MessageBoxA
wsprintfA
SetWindowTextW
GetSysColor
GetWindowTextLengthW
GetWindowTextW
GetClassNameA
GetWindowLongW
GetMenu
SetWindowPos
CopyImage
SendMessageW
GetWindowDC

gdi32

GetCurrentObject
StretchBlt
SetStretchBltMode
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetObjectW
GetDeviceCaps
DeleteObject
CreateFontIndirectW
DeleteDC

shell32

SHGetFileInfoW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteExW
SHGetSpecialFolderPathW
ShellExecuteW

ole32

CoInitialize
CreateStreamOnHGlobal
CoCreateInstance

oleaut32

VariantClear
OleLoadPicture
SysAllocString

msvcrt

__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
_CxxThrowException
_beginthreadex
_EH_prolog
memset
_wcsnicmp
strncmp
malloc
memmove
_wtol
memcpy
free
memcmp
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
_except_handler3
_controlfp

Sections

.text
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
bb6c8c6772bc0e8ba9a3416e53e4791fcf2d753642c771c84ecce5f4a2fec948.elf
.elf linux arm
bbb16e52cd7134b0d1de4aa9c449fc7d9f084783bb4e31b061414e2e3a7e86df.rar
.rar
bcb2ec0810dd5fe31592e0b8c7739102620ce48b4bfc06bd3708de614896d180.elf
.elf linux sh
bd817f08b4b45d7a6edcbf36a7149648bb61eb4bca360a3ecf6b21c1e8fc7519.exe
.exe windows:6 windows x64 arch:x64

5a10b1f71232200699719a8d6c2e95fa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\QQ670\Downloads\my_script_tools-main\360QVM_bypass-public\360Safe\RPAVWQ\target\release\deps\RPAVWQ.pdb

Imports

advapi32

RegQueryValueExW
RegCloseKey
SystemFunction036
RegOpenKeyExW

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

kernel32

CreateIoCompletionPort
WakeConditionVariable
IsDebuggerPresent
GetQueuedCompletionStatusEx
TryAcquireSRWLockExclusive
GetFinalPathNameByHandleW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetHandleInformation
SwitchToThread
ReleaseSRWLockExclusive
GetModuleHandleA
GetProcAddress
GetCurrentThread
GetStdHandle
GetConsoleMode
AcquireSRWLockExclusive
MultiByteToWideChar
WriteConsoleW
QueryPerformanceFrequency
GetModuleHandleW
FormatMessageW
GetCurrentProcess
GetEnvironmentVariableW
IsProcessorFeaturePresent
HeapReAlloc
HeapFree
SetFileCompletionNotificationModes
CreateThread
UnhandledExceptionFilter
ExitProcess
QueryPerformanceCounter
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
GetCurrentProcessId
CreateMutexA
WaitForSingleObjectEx
LoadLibraryA
ReleaseMutex
RtlVirtualUnwind
AcquireSRWLockShared
ReleaseSRWLockShared
SleepConditionVariableSRW
HeapAlloc
PostQueuedCompletionStatus
SetThreadStackGuarantee
AddVectoredExceptionHandler
Sleep
FindFirstFileW
GetFullPathNameW
SetLastError
CloseHandle
WaitForSingleObject
SetWaitableTimer
CreateWaitableTimerExW
GetProcessHeap
WakeAllConditionVariable
GetLastError
FindNextFileW
lstrlenW
SetUnhandledExceptionFilter
FindClose

ntdll

NtProtectVirtualMemory
NtWriteVirtualMemory
NtAllocateVirtualMemory
NtWaitForSingleObject
NtCreateFile
NtCreateThreadEx
NtCancelIoFileEx
RtlNtStatusToDosError
NtDeviceIoControlFile
NtWriteFile

ws2_32

ioctlsocket
connect
freeaddrinfo
closesocket
getsockopt
bind
WSASend
WSAIoctl
recv
send
WSACleanup
WSAStartup
getsockname
WSAGetLastError
getpeername
setsockopt
shutdown
WSASocketW
getaddrinfo

secur32

EncryptMessage
FreeContextBuffer
DeleteSecurityContext
QueryContextAttributesW
AcquireCredentialsHandleA
FreeCredentialsHandle
AcceptSecurityContext
InitializeSecurityContextW
DecryptMessage
ApplyControlToken

crypt32

CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertOpenStore
CertCloseStore
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertDuplicateStore
CertDuplicateCertificateChain

bcrypt

BCryptGenRandom

vcruntime140

memmove
__current_exception_context
memset
memcpy
__CxxFrameHandler3
memcmp
__C_specific_handler
__current_exception

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_initialize_narrow_environment
__p___argc
_register_thread_local_exe_atexit_callback
_cexit
_configure_narrow_argv
_set_app_type
_seh_filter_exe
_initialize_onexit_table
__p___argv
_register_onexit_function
_crt_atexit
_c_exit
terminate

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

Sections

.text
Size: 646KB - Virtual size: 646KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 820KB - Virtual size: 819KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 549KB - Virtual size: 549KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
be2346fa2bef1b558f011862043e37bf5cef8b2290202a64a450a08750820462.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:01:94:cd:1e:31:42:20:51:35:d1:c6:36:e4:e9:ba
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

18-10-2022 00:00

Not After

15-10-2025 23:59

Subject

CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:09:5e:de:a2:12:7e:92:81:cc:00:00:00:00:01:09
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

14-09-2023 19:14

Not After

04-09-2024 19:14

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9d:82:62:59:39:12:dc:a5:0d:dd:11:37:8a:bd:cf:cf:28:9e:25:32:10:38:06:7c:1f:81:90:80:73:d2:45:2f
Signer

Actual PE Digest

9d:82:62:59:39:12:dc:a5:0d:dd:11:37:8a:bd:cf:cf:28:9e:25:32:10:38:06:7c:1f:81:90:80:73:d2:45:2f

Digest Algorithm

sha256

PE Digest Matches

false

9d:82:62:59:39:12:dc:a5:0d:dd:11:37:8a:bd:cf:cf:28:9e:25:32:10:38:06:7c:1f:81:90:80:73:d2:45:2f
Signer

Actual PE Digest

9d:82:62:59:39:12:dc:a5:0d:dd:11:37:8a:bd:cf:cf:28:9e:25:32:10:38:06:7c:1f:81:90:80:73:d2:45:2f

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\75atu\obj\Release\Laptop.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 211KB - Virtual size: 211KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
c0b4860057005ee1549b38ec8c27f1ac5c7888d4deafdacf9a7698c3edf378f7.exe
.exe windows:5 windows x86 arch:x86

c4a60923dba9ba09eab802a43aae91ba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\gakiw\68\getikumofu\vohuh.pdb

Imports

kernel32

SetThreadContext
GetConsoleAliasesLengthW
GetLocaleInfoA
GlobalAddAtomA
GetConsoleAliasA
QueryDosDeviceA
_lcreat
MoveFileWithProgressA
GetNumberFormatA
ReadConsoleW
GetConsoleCP
GetVolumeInformationA
GlobalFindAtomA
InitializeCriticalSectionAndSpinCount
ReadConsoleInputA
FindNextVolumeW
WriteConsoleW
FileTimeToSystemTime
FindResourceA
GetTempPathW
GetLastError
ChangeTimerQueueTimer
SetLastError
GetProcAddress
LoadLibraryA
InterlockedExchangeAdd
LocalAlloc
FindFirstVolumeMountPointW
RemoveDirectoryW
VirtualLock
GetModuleFileNameA
GetCurrentDirectoryA
GetWindowsDirectoryW
GetStringTypeW
OutputDebugStringW
FlushFileBuffers
CreateFileA
GetNumaNodeProcessorMask
ExitThread
GetEnvironmentVariableW
SetStdHandle
SetFilePointerEx
GetConsoleMode
IsProcessorFeaturePresent
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineW
RaiseException
RtlUnwind
IsDebuggerPresent
HeapSize
HeapFree
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
WriteFile
GetModuleFileNameW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
GetProcessHeap
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
LCMapStringW
CreateFileW

user32

CharUpperBuffA
DrawCaption

gdi32

SetTextColor

advapi32

RegisterEventSourceW

ole32

CoGetPSClsid

winhttp

WinHttpSetDefaultProxyConfiguration

msimg32

AlphaBlend

Sections

.text
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 192KB - Virtual size: 41.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
c1539ba94c7dbafa391aa83f94a2b9a536097c8c8d6f1c522a93156941ce4c86.exe
.exe windows:6 windows x86 arch:x86

b92af7920132d9c164f3fefd70cac1d7

Code Sign

4a:b6:f2:ca:d3:e6:41:4a:ac:7d:42:1a:95:6d:71:1f
Certificate

Issuer

CN=SAMSUNG PRO B960-P WIFI DDR6,OU=Universal Gen Core Pentium,O=\ Intel,L=¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§,C=6G Bluetooth

Not Before

31-01-2024 10:51

Not After

06-06-2025 00:00

Subject

CN=SAMSUNG PRO B960-P WIFI DDR6,OU=Universal Gen Core Pentium,O=\ Intel,L=¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§¢ÖÙ™£ç¿™\<k_§,C=6G Bluetooth

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3f:f5:cd:fc:d5:19:fd:d7:25:33:50:da:46:8b:fa:da:c2:67:4d:4b:92:d1:d0:99:c9:b8:39:47:95:a4:c2:aa
Signer

Actual PE Digest

3f:f5:cd:fc:d5:19:fd:d7:25:33:50:da:46:8b:fa:da:c2:67:4d:4b:92:d1:d0:99:c9:b8:39:47:95:a4:c2:aa

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

advapi32

GetUserNameA

shell32

ShellExecuteA

ole32

CoCreateInstance

ws2_32

send

wtsapi32

WTSSendMessageW

user32

GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

Sections

.text
Size: - Virtual size: 442KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp2560
Size: - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp2561
Size: 6.3MB - Virtual size: 6.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
c2655050d7396dc127478a94de8698cad30189dfc594f8e61bfbdf8c1307929f.elf
.elf linux ppc
c4702d262bd679d87b1521b719809e170933f5510a9a7d40a6b858b8609ecbee.elf
.elf linux
c4edf7b8cdffb67fcd62ef81485c04648b11a14a8452f407133f131e2f74a57a.exe
.exe windows:5 windows x86 arch:x86

0b2f7445f02cff44b10bb9e8cd71c3c0

Code Sign

09:c1:ca:c4:ac:05:dd:06:02:10:20:f8:87:7a:e7:e8
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19-12-2020 00:00

Not After

22-12-2022 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Flash Player,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:c7:7c:e0:13:54:03:5d:4d:77:a1:99:d9:6e:d6:8f:db:a4:08:5a:81:cc:df:c0:ae:83:a1:11:12:8d:ab:aa
Signer

Actual PE Digest

11:c7:7c:e0:13:54:03:5d:4d:77:a1:99:d9:6e:d6:8f:db:a4:08:5a:81:cc:df:c0:ae:83:a1:11:12:8d:ab:aa

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

shell32

SHCreateDirectoryExW

shlwapi

UrlIsW

userenv

CreateEnvironmentBlock

gdi32

GetTextFaceW

advapi32

OpenSCManagerW

comctl32

_TrackMouseEvent

ole32

CoCreateInstance

oleaut32

SafeArrayUnaccessData

gdiplus

GdipCreateBitmapFromScan0

Sections

.text
Size: 2.1MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 54KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
c5c3c6fc136b01b4c88c7f70afc99fe20fdeaf6292570946acd2c315a7a5e119.exe
.dll windows:6 windows x64 arch:x64

bb2ac363335230ef73bf96bf5001e65e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

shlwapi

StrStrW

kernel32

TlsFree
MultiByteToWideChar
WaitForSingleObject
GetLastError
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
WideCharToMultiByte
EncodePointer
DecodePointer
InitializeCriticalSectionEx
LCMapStringEx
GetStringTypeW
GetCPInfo
WriteConsoleW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
RtlUnwind
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
SetStdHandle
HeapSize
CreateFileW

Sections

.text
Size: 588KB - Virtual size: 587KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
c7c643bc00955e3cb3d3c0b7286a0cf1c35864c42e91064d7108085e7eabfae9.elf
.elf linux arm
c845049d5b0e627fa7c6a07c416d510fa20c2544d8ae193349412e7245350eec.elf
.elf linux arm
c955e4df8eac2ab783ba558fecf707bf76f8268913cee596c6d85b2dffb24e5f.elf
.elf linux x86
caeb5b0338795678a139244858d2e19c0a7bd401604a02af1a17880a137258b1.zip
.zip
cbe27936a3beb1902517906f7da1d6d3f6ef8d1a0eda5e033f4da436df7cd88b.iso
.iso .vbs polyglot
cbf82db6eb47c89413ceb34f20db5fd67beca54befa14cdcd0e4be903e432c9f.elf
.elf linux x86
cd2d4fd57d36ab0e4bc6cca12eefad3c38e46df6964fa6e70534e8f66ef6209a.elf
.elf linux ppc
cd517989776d85f3669e300ab401543aa354f80b7d467fdb93824b1a287b9238.elf
.elf linux ppc
cd5578bdb5130615e3667f36e665a03cf4b8c943899ab8ea679653c224036d8b.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:01:94:cd:1e:31:42:20:51:35:d1:c6:36:e4:e9:ba
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

18-10-2022 00:00

Not After

15-10-2025 23:59

Subject

CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:09:5e:de:a2:12:7e:92:81:cc:00:00:00:00:01:09
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

14-09-2023 19:14

Not After

04-09-2024 19:14

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e0:62:70:23:78:f4:76:95:24:3b:5c:c0:3e:4c:1e:37:44:ac:f2:8a:cd:ec:f2:47:92:d1:ac:11:7b:5e:da:d9
Signer

Actual PE Digest

e0:62:70:23:78:f4:76:95:24:3b:5c:c0:3e:4c:1e:37:44:ac:f2:8a:cd:ec:f2:47:92:d1:ac:11:7b:5e:da:d9

Digest Algorithm

sha256

PE Digest Matches

false

e0:62:70:23:78:f4:76:95:24:3b:5c:c0:3e:4c:1e:37:44:ac:f2:8a:cd:ec:f2:47:92:d1:ac:11:7b:5e:da:d9
Signer

Actual PE Digest

e0:62:70:23:78:f4:76:95:24:3b:5c:c0:3e:4c:1e:37:44:ac:f2:8a:cd:ec:f2:47:92:d1:ac:11:7b:5e:da:d9

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\2tdtwsy6\obj\Release\Croco.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 309KB - Virtual size: 309KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
cd94340d01668e3f499ed9a694f2507bc7d6bc10a5dacb467d951297794f313b.elf
.elf linux sh
ce88ab5d77ab447ef12a4e2859602ac2a167ac360078fa9c6d0eed2ba3bfec51.elf
.elf linux mipsel
d29ebdaa0a822094a12e32d12fd13b401385c2f78941c9f4e222db7b370abf5a.elf
.elf linux x86
d5a372d3a991f01ec9b1deb385bed8eaaf63cdd637920abff57d0b115a36113b.elf
.elf linux arm
d5d2a698d3e63631ef0e23dabec79f49e4173105eb267d2d59309a8c39c3ba52.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:01:94:cd:1e:31:42:20:51:35:d1:c6:36:e4:e9:ba
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

18-10-2022 00:00

Not After

15-10-2025 23:59

Subject

CN=NVIDIA Corporation,OU=1-F,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:09:5e:de:a2:12:7e:92:81:cc:00:00:00:00:01:09
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

14-09-2023 19:14

Not After

04-09-2024 19:14

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8e:cd:ec:ba:37:5c:c7:67:80:32:83:bf:da:e1:d1:08:40:79:08:0d:2d:62:3f:60:12:73:bb:42:fe:af:8f:32
Signer

Actual PE Digest

8e:cd:ec:ba:37:5c:c7:67:80:32:83:bf:da:e1:d1:08:40:79:08:0d:2d:62:3f:60:12:73:bb:42:fe:af:8f:32

Digest Algorithm

sha256

PE Digest Matches

false

8e:cd:ec:ba:37:5c:c7:67:80:32:83:bf:da:e1:d1:08:40:79:08:0d:2d:62:3f:60:12:73:bb:42:fe:af:8f:32
Signer

Actual PE Digest

8e:cd:ec:ba:37:5c:c7:67:80:32:83:bf:da:e1:d1:08:40:79:08:0d:2d:62:3f:60:12:73:bb:42:fe:af:8f:32

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\0s0h5koezw\obj\Release\Laptop.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 309KB - Virtual size: 308KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
d89e00734a9bab127b81271423595b2fc6cc7e69020035a3696f472d42cc22d2.exe
.exe windows:6 windows x64 arch:x64

fb0a8b4a81655f744a37af985e009476

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\MeshAgent\MeshAgent\Release\MeshService64.pdb

Imports

comctl32

InitCommonControlsEx

dbghelp

SymInitialize
SymGetModuleBase64
SymGetLineFromAddr64
SymFunctionTableAccess64
SymFromAddr
StackWalk64
MiniDumpWriteDump

iphlpapi

GetAdaptersAddresses
SendARP
ConvertLengthToIpv4Mask
GetAdaptersInfo

ws2_32

WSACloseEvent
htons
htonl
gethostname
ntohs
ntohl
WSAGetLastError
ioctlsocket
recv
WSASetLastError
send
getsockname
WSASocketW
listen
closesocket
bind
accept
__WSAFDIsSet
setsockopt
socket
sendto
getsockopt
recvfrom
connect
shutdown
WSAIoctl
GetAddrInfoW
WSAResetEvent
WSAEventSelect
WSAStartup
WSACreateEvent
WSACleanup
FreeAddrInfoW
select

crypt32

CertFindCertificateInStore
CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CryptAcquireCertificatePrivateKey
CertAddEncodedCertificateToStore
CryptMsgClose
CryptMsgUpdate
CryptExportPublicKeyInfo
CertCreateSelfSignCertificate
CertFreeCertificateContext
CryptMsgOpenToEncode
CertAddCertificateContextToStore
PFXExportCertStore
CryptSignAndEncodeCertificate
CertCloseStore
CertStrToNameA
CryptMsgGetParam
CryptEncodeObject
CertSetCertificateContextProperty
CertGetCertificateContextProperty
CryptMsgCalculateEncodedLength
CertOpenStore
CertStrToNameW
CertEnumCertificatesInStore

gdiplus

GdipGetImageEncoders
GdiplusShutdown
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree
GdipGetImageEncodersSize
GdipLoadImageFromStream
GdipSaveImageToStream
GdiplusStartup

ncrypt

NCryptCreatePersistedKey
NCryptFreeObject
NCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptGenRandom
NCryptOpenStorageProvider
BCryptOpenAlgorithmProvider
NCryptFinalizeKey

kernel32

InitializeSListHead
GetStartupInfoW
RtlUnwindEx
GetFullPathNameW
GetStdHandle
WriteFile
LoadLibraryExA
GetModuleFileNameW
GetSystemPowerStatus
OpenProcess
MultiByteToWideChar
Sleep
GetLastError
CloseHandle
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcAddress
SetEnvironmentVariableA
CreateProcessW
FreeLibrary
WideCharToMultiByte
GetCurrentThreadId
GetModuleHandleA
WaitForSingleObjectEx
CreateThread
QueueUserAPC
OpenThread
ReadFile
LoadLibraryA
SleepEx
SetSystemPowerState
GetCurrentProcess
SetThreadExecutionState
HeapFree
HeapAlloc
GetProcessHeap
SystemTimeToFileTime
GetSystemTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
QueryPerformanceCounter
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreA
CancelIo
FindFirstFileW
FindNextFileW
RemoveDirectoryW
GetFinalPathNameByHandleW
GetDriveTypeA
SetFilePointer
FindFirstVolumeA
FindClose
CreateFileW
GetVolumePathNamesForVolumeNameA
GetFileAttributesExW
ReadDirectoryChangesW
FindNextVolumeA
FindVolumeClose
GetDiskFreeSpaceExA
CreateEventA
GetModuleHandleExA
WaitForMultipleObjectsEx
CreateNamedPipeA
DisconnectNamedPipe
CreateFileA
CancelIoEx
LocalFree
ConnectNamedPipe
SetConsoleMode
GetConsoleMode
SetConsoleOutputCP
IsDebuggerPresent
TerminateProcess
GetTempPathW
CancelSynchronousIo
SetEvent
ResetEvent
IsProcessorFeaturePresent
GetCurrentProcessId
GetEnvironmentStrings
FreeEnvironmentStringsA
CopyFileW
RtlCaptureContext
SuspendThread
ResumeThread
DuplicateHandle
GetTickCount64
GetCurrentThread
GetOverlappedResult
GetThreadContext
WTSGetActiveConsoleSessionId
GetExitCodeProcess
SetEndOfFile
DeleteFileW
SetFilePointerEx
SetConsoleCtrlHandler
FreeConsole
LoadLibraryExW
SetLastError
GetFileType
GetModuleHandleW
SwitchToFiber
DeleteFiber
CreateFiber
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
CreateDirectoryW
GetConsoleCP
MoveFileExW
SetEnvironmentVariableW
GetTimeZoneInformation
SetStdHandle
GetDriveTypeW
PeekNamedPipe
GetCommandLineA
GetCommandLineW
GetACP
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetStringTypeW
HeapReAlloc
FlushFileBuffers
WriteConsoleW
GetCPInfo
FindFirstFileExW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
GetThreadId
RtlVirtualUnwind
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
RaiseException
HeapSize
RtlPcToFileHeader
QueryPerformanceFrequency
EncodePointer

user32

EndDialog
SetWindowTextW
GetWindowPlacement
ShowWindow
GetDlgCtrlID
SetWindowPlacement
SetWindowTextA
IsDlgButtonChecked
GetDlgItem
CheckDlgButton
DialogBoxParamW
EnableWindow
MessageBeep
ExitWindowsEx
GetUserObjectInformationA
EnumDisplayMonitors
GetSystemMetrics
SetThreadDesktop
GetThreadDesktop
CloseDesktop
BlockInput
GetMonitorInfoA
OpenInputDesktop
GetKeyState
GetMessageA
GetMessageExtraInfo
SendMessageW
LoadCursorA
DestroyWindow
GetDC
PostMessageA
GetIconInfo
CallNextHookEx
GetCursorInfo
SetWindowsHookExA
MapVirtualKeyA
GetForegroundWindow
UnhookWindowsHookEx
DefWindowProcA
CreateWindowExA
TranslateMessage
UnregisterClassA
DrawIconEx
SetWinEventHook
RegisterClassExA
UnhookWinEvent
SetForegroundWindow
ReleaseDC
SendInput
SetProcessDPIAware
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
DispatchMessageA
CreateWindowExW
GetWindowRect

gdi32

SetBkMode
SetBkColor
CreateSolidBrush
BitBlt
StretchBlt
DeleteDC
SetStretchBltMode
CreateCompatibleBitmap
GetObjectA
SelectObject
CreateCompatibleDC
GetDIBits
DeleteObject
SetTextColor
GetStockObject

advapi32

CloseServiceHandle
AllocateAndInitializeSid
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
StartServiceCtrlDispatcherA
RegCreateKeyW
RegSetValueExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
OpenProcessToken
InitiateSystemShutdownA
LookupPrivilegeValueA
AdjustTokenPrivileges
CryptReleaseContext
RegSetValueExW
CryptDestroyKey
InitializeSecurityDescriptor
SetEntriesInAclA
SetSecurityDescriptorDacl
DuplicateTokenEx
CreateProcessAsUserW
SetTokenInformation
OpenServiceA
CheckTokenMembership
FreeSid
RegisterServiceCtrlHandlerExA
OpenSCManagerA
SetServiceStatus
QueryServiceStatus

shell32

ShellExecuteExW

ole32

CoInitializeEx
CreateStreamOnHGlobal
CoUninitialize

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 981KB - Virtual size: 981KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
daada19cab8e9cf064bfe1b219398dfa5ed5fe45832bfef1d5f284be93b4347d.exe
.exe windows:5 windows x86 arch:x86

6c17cd221979c51b4b1f1bc0b7dc863e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\zawicururis\ronecezuwupu_polagex69.pdb

Imports

kernel32

SetThreadContext
GetConsoleAliasesLengthW
GetLocaleInfoA
GlobalAddAtomA
GetConsoleAliasA
QueryDosDeviceA
_lcreat
MoveFileWithProgressA
GetNumberFormatA
ReadConsoleW
GetConsoleCP
GetVolumeInformationA
GlobalFindAtomA
InitializeCriticalSectionAndSpinCount
ReadConsoleInputA
FindNextVolumeW
WriteConsoleW
FileTimeToSystemTime
FindResourceA
GetTempPathW
GetLastError
ChangeTimerQueueTimer
SetLastError
GetProcAddress
LoadLibraryA
InterlockedExchangeAdd
LocalAlloc
FindFirstVolumeMountPointW
RemoveDirectoryW
VirtualLock
GetModuleFileNameA
GetCurrentDirectoryA
GetWindowsDirectoryW
GetStringTypeW
OutputDebugStringW
FlushFileBuffers
CreateFileA
GetNumaNodeProcessorMask
ExitThread
GetEnvironmentVariableW
IsProcessorFeaturePresent
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineW
RaiseException
RtlUnwind
IsDebuggerPresent
HeapSize
HeapFree
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
WriteFile
GetModuleFileNameW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
GetProcessHeap
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
LCMapStringW
GetConsoleMode
SetFilePointerEx
SetStdHandle
CreateFileW

user32

CharUpperBuffA
DrawCaption

gdi32

SetTextColor

advapi32

ReadEventLogW

Sections

.text
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 191KB - Virtual size: 41.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
dce5434e660c66954f7859390e33d969f0a493a77cc84f1e42df7b17ab9bfa53.elf
.elf linux arm
dd7e94e3adb6ccf95559adf51a9f0234763f972fd6480d7cf23916bdc1549507.exe
.exe windows:6 windows x64 arch:x64

fb0a8b4a81655f744a37af985e009476

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\MeshAgent\MeshAgent\Release\MeshService64.pdb

Imports

comctl32

InitCommonControlsEx

dbghelp

SymInitialize
SymGetModuleBase64
SymGetLineFromAddr64
SymFunctionTableAccess64
SymFromAddr
StackWalk64
MiniDumpWriteDump

iphlpapi

GetAdaptersAddresses
SendARP
ConvertLengthToIpv4Mask
GetAdaptersInfo

ws2_32

WSACloseEvent
htons
htonl
gethostname
ntohs
ntohl
WSAGetLastError
ioctlsocket
recv
WSASetLastError
send
getsockname
WSASocketW
listen
closesocket
bind
accept
__WSAFDIsSet
setsockopt
socket
sendto
getsockopt
recvfrom
connect
shutdown
WSAIoctl
GetAddrInfoW
WSAResetEvent
WSAEventSelect
WSAStartup
WSACreateEvent
WSACleanup
FreeAddrInfoW
select

crypt32

CertFindCertificateInStore
CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CryptAcquireCertificatePrivateKey
CertAddEncodedCertificateToStore
CryptMsgClose
CryptMsgUpdate
CryptExportPublicKeyInfo
CertCreateSelfSignCertificate
CertFreeCertificateContext
CryptMsgOpenToEncode
CertAddCertificateContextToStore
PFXExportCertStore
CryptSignAndEncodeCertificate
CertCloseStore
CertStrToNameA
CryptMsgGetParam
CryptEncodeObject
CertSetCertificateContextProperty
CertGetCertificateContextProperty
CryptMsgCalculateEncodedLength
CertOpenStore
CertStrToNameW
CertEnumCertificatesInStore

gdiplus

GdipGetImageEncoders
GdiplusShutdown
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree
GdipGetImageEncodersSize
GdipLoadImageFromStream
GdipSaveImageToStream
GdiplusStartup

ncrypt

NCryptCreatePersistedKey
NCryptFreeObject
NCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptGenRandom
NCryptOpenStorageProvider
BCryptOpenAlgorithmProvider
NCryptFinalizeKey

kernel32

InitializeSListHead
GetStartupInfoW
RtlUnwindEx
GetFullPathNameW
GetStdHandle
WriteFile
LoadLibraryExA
GetModuleFileNameW
GetSystemPowerStatus
OpenProcess
MultiByteToWideChar
Sleep
GetLastError
CloseHandle
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcAddress
SetEnvironmentVariableA
CreateProcessW
FreeLibrary
WideCharToMultiByte
GetCurrentThreadId
GetModuleHandleA
WaitForSingleObjectEx
CreateThread
QueueUserAPC
OpenThread
ReadFile
LoadLibraryA
SleepEx
SetSystemPowerState
GetCurrentProcess
SetThreadExecutionState
HeapFree
HeapAlloc
GetProcessHeap
SystemTimeToFileTime
GetSystemTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
QueryPerformanceCounter
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreA
CancelIo
FindFirstFileW
FindNextFileW
RemoveDirectoryW
GetFinalPathNameByHandleW
GetDriveTypeA
SetFilePointer
FindFirstVolumeA
FindClose
CreateFileW
GetVolumePathNamesForVolumeNameA
GetFileAttributesExW
ReadDirectoryChangesW
FindNextVolumeA
FindVolumeClose
GetDiskFreeSpaceExA
CreateEventA
GetModuleHandleExA
WaitForMultipleObjectsEx
CreateNamedPipeA
DisconnectNamedPipe
CreateFileA
CancelIoEx
LocalFree
ConnectNamedPipe
SetConsoleMode
GetConsoleMode
SetConsoleOutputCP
IsDebuggerPresent
TerminateProcess
GetTempPathW
CancelSynchronousIo
SetEvent
ResetEvent
IsProcessorFeaturePresent
GetCurrentProcessId
GetEnvironmentStrings
FreeEnvironmentStringsA
CopyFileW
RtlCaptureContext
SuspendThread
ResumeThread
DuplicateHandle
GetTickCount64
GetCurrentThread
GetOverlappedResult
GetThreadContext
WTSGetActiveConsoleSessionId
GetExitCodeProcess
SetEndOfFile
DeleteFileW
SetFilePointerEx
SetConsoleCtrlHandler
FreeConsole
LoadLibraryExW
SetLastError
GetFileType
GetModuleHandleW
SwitchToFiber
DeleteFiber
CreateFiber
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
CreateDirectoryW
GetConsoleCP
MoveFileExW
SetEnvironmentVariableW
GetTimeZoneInformation
SetStdHandle
GetDriveTypeW
PeekNamedPipe
GetCommandLineA
GetCommandLineW
GetACP
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetStringTypeW
HeapReAlloc
FlushFileBuffers
WriteConsoleW
GetCPInfo
FindFirstFileExW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
GetThreadId
RtlVirtualUnwind
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
RaiseException
HeapSize
RtlPcToFileHeader
QueryPerformanceFrequency
EncodePointer

user32

EndDialog
SetWindowTextW
GetWindowPlacement
ShowWindow
GetDlgCtrlID
SetWindowPlacement
SetWindowTextA
IsDlgButtonChecked
GetDlgItem
CheckDlgButton
DialogBoxParamW
EnableWindow
MessageBeep
ExitWindowsEx
GetUserObjectInformationA
EnumDisplayMonitors
GetSystemMetrics
SetThreadDesktop
GetThreadDesktop
CloseDesktop
BlockInput
GetMonitorInfoA
OpenInputDesktop
GetKeyState
GetMessageA
GetMessageExtraInfo
SendMessageW
LoadCursorA
DestroyWindow
GetDC
PostMessageA
GetIconInfo
CallNextHookEx
GetCursorInfo
SetWindowsHookExA
MapVirtualKeyA
GetForegroundWindow
UnhookWindowsHookEx
DefWindowProcA
CreateWindowExA
TranslateMessage
UnregisterClassA
DrawIconEx
SetWinEventHook
RegisterClassExA
UnhookWinEvent
SetForegroundWindow
ReleaseDC
SendInput
SetProcessDPIAware
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
DispatchMessageA
CreateWindowExW
GetWindowRect

gdi32

SetBkMode
SetBkColor
CreateSolidBrush
BitBlt
StretchBlt
DeleteDC
SetStretchBltMode
CreateCompatibleBitmap
GetObjectA
SelectObject
CreateCompatibleDC
GetDIBits
DeleteObject
SetTextColor
GetStockObject

advapi32

CloseServiceHandle
AllocateAndInitializeSid
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
StartServiceCtrlDispatcherA
RegCreateKeyW
RegSetValueExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
OpenProcessToken
InitiateSystemShutdownA
LookupPrivilegeValueA
AdjustTokenPrivileges
CryptReleaseContext
RegSetValueExW
CryptDestroyKey
InitializeSecurityDescriptor
SetEntriesInAclA
SetSecurityDescriptorDacl
DuplicateTokenEx
CreateProcessAsUserW
SetTokenInformation
OpenServiceA
CheckTokenMembership
FreeSid
RegisterServiceCtrlHandlerExA
OpenSCManagerA
SetServiceStatus
QueryServiceStatus

shell32

ShellExecuteExW

ole32

CoInitializeEx
CreateStreamOnHGlobal
CoUninitialize

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 981KB - Virtual size: 981KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
de00660d0d96ff67cb8e89a8d8525567327b109bc54b9042e5fdd516dcc0e51a.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dec9918265c77439780f448c5b6b06d8919ad2b7a23d714c25ab08a494df5340.exe
.exe windows:6 windows x86 arch:x86

90a754824211c648b161e0e146d30cbf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoGetObjectContext

kernel32

SetEndOfFile
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

Sections

.text
Size: - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cSs
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.t_m
Size: - Virtual size: 5.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.p N
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

..i%
Size: 12.2MB - Virtual size: 12.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ded0b3101d0cf256b0a87535dd5d006176c0aa59c023bfbd2c6eac4fc6f0d40b.elf
.elf linux mipsbe
df6ab7c6ac612aa19b1392455b4250f20e03381c64d6d7443859f319a61f1cb1.elf
.elf linux arm
dfde7c566bce1a75aff9f68348058a6986e8376d5b4dbea5cd62310e0c154d5e.exe
.exe windows:4 windows x64 arch:x64

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 705KB - Virtual size: 705KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
e0807ac9d5c0eefe90916de1c25e6ad9a3e1e82d36a8e10a560a62e4dd85f7cf.elf
.elf linux sh
e0acb3c17aac695ada5fd83580506ffa0e6972bd8551e961c3f7b6ecc22dc793.exe
.exe windows:5 windows x86 arch:x86

fcf1390e9ce472c7270447fc5c61a0c1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

Imports

kernel32

GetLastError
SetLastError
FormatMessageW
GetCurrentProcess
DeviceIoControl
SetFileTime
CloseHandle
CreateDirectoryW
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
GetFileType
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
FindNextFileW
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FreeLibrary
GetProcAddress
GetCurrentProcessId
ExitProcess
SetThreadExecutionState
Sleep
LoadLibraryW
GetSystemDirectoryW
CompareStringW
AllocConsole
FreeConsole
AttachConsole
WriteConsoleW
GetProcessAffinityMask
CreateThread
SetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
LockResource
GlobalLock
GlobalUnlock
GlobalFree
LoadResource
SizeofResource
SetCurrentDirectoryW
GetExitCodeProcess
GetLocalTime
GetTickCount
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCommandLineW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
MoveFileExW
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
SetStdHandle
GetProcessHeap
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
RtlUnwind
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
QueryPerformanceFrequency
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapFree
HeapAlloc
HeapReAlloc
GetStringTypeW
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
DecodePointer

gdiplus

GdiplusShutdown
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc

Sections

.text
Size: 196KB - Virtual size: 196KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 392B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
e180555303654e1f2b1c0337521988fdccc795a2d6ab246c9b50fee7b98f3012.elf
.elf linux x64
e3327c6ff58afd7a0d8d49713b2dea034598ec4608ff26f93059b5ce9ab6981f.r00
.rar
e47c0cc3b00de906596cf4e63820d391d4e0e2ccc78a2c4f60cfe8d1991a345d.elf
.elf linux mipsbe
e5f6faf2edd6464c3c9de112d5b1eb2ebbb4fce6cefd3ebb58fdb67fba948204.exe
.exe windows:1 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 37KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
e741af35bc6e35843115dbe5d50ecfc1ab9cd76ddeb223a79635238b11529141.zip
.zip
e98c4cfd56efe46b3de730a430ba2f7adcd30b0988d64f9c9f962383d4e44a68.exe
.exe windows:5 windows x86 arch:x86

12e12319f1029ec4f8fcbed7e82df162

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

Imports

kernel32

GetLastError
SetLastError
FormatMessageW
GetCurrentProcess
DeviceIoControl
SetFileTime
CloseHandle
CreateDirectoryW
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
GetFileType
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
FindNextFileW
InterlockedDecrement
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FreeLibrary
GetProcAddress
GetCurrentProcessId
ExitProcess
SetThreadExecutionState
Sleep
LoadLibraryW
GetSystemDirectoryW
CompareStringW
AllocConsole
FreeConsole
AttachConsole
WriteConsoleW
GetProcessAffinityMask
CreateThread
SetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
LockResource
GlobalLock
GlobalUnlock
GlobalFree
LoadResource
SizeofResource
SetCurrentDirectoryW
GetExitCodeProcess
GetLocalTime
GetTickCount
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCommandLineW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
MoveFileExW
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
DecodePointer
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
LocalFree
RtlUnwind
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
QueryPerformanceFrequency
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapFree
HeapAlloc
HeapReAlloc
GetStringTypeW
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage

oleaut32

SysAllocString
SysFreeString
VariantClear

gdiplus

GdipAlloc
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateHBITMAPFromBitmap
GdiplusStartup
GdiplusShutdown
GdipFree

Sections

.text
Size: 199KB - Virtual size: 198KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 400B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ec4949fff4b4320c7b50929a7d72b90fc1ca703d39c7819f31ec95a8e7e91ed7.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 770B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9.3MB - Virtual size: 9.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ed6110fc7d2bb1b2cfee09b42f3796446ed3e562611ab7e3302d00d6c9dca5b2.elf
.elf linux arm
eed7407407a9058c06504a43cc841a5b83cb468a5659b4037b5e0020a477c1c7.elf
.elf linux arm
ef5c5bc8a2823eded5167c858c649dc6509f653109fe7a45be71bae0474c70f9.elf
.elf linux mipsbe
efe8773c0e8f211fc8a8a8fe4d033d5dcd03556d2c9b9a31028a77f9f4f0a00d.elf
.elf linux x86
f06ca39ee01d7599cbeaad5da92e51d282f5e6ae6a8375e9e3b819fd793c6070.exe
.exe windows:6 windows x86 arch:x86

14a56f4323bef2c2e58c808d9d77b789

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtect
GetProcAddress
Sleep
VirtualAllocEx
WaitForSingleObject
LoadLibraryA
CreateThread
lstrlenW
VirtualAlloc
FreeConsole
GetCurrentThreadId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
WideCharToMultiByte
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
CreateFileW
RaiseException
RtlUnwind
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapFree
HeapAlloc
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
CloseHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
HeapSize
WriteConsoleW

Sections

.text
Size: 340KB - Virtual size: 339KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 345KB - Virtual size: 344KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
f0ee3752736d8d62f1731e60c26db491dfec0fffe85075b6757ddda257056bee.elf
.elf linux arm
f0efcd8945cee60e24c6642fdba101d894c182f60ca05d8a011890974ec5499a.exe
.exe windows:5 windows x86 arch:x86

bf5a4aa99e5b160f8521cadd6bfe73b8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

Imports

kernel32

RaiseException
GetLastError
MultiByteToWideChar
lstrlenA
InterlockedDecrement
GetProcAddress
LoadLibraryA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleHandleA
Module32Next
CloseHandle
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
SetEndOfFile
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
HeapFree
GetProcessHeap
HeapAlloc
GetCommandLineA
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
ReadFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
FlushFileBuffers
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CompareStringA
CompareStringW
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA

ole32

OleInitialize

oleaut32

SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayCreateVector
VariantClear
VariantInit
SysFreeString
SysAllocString

Sections

.text
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
f1177ed5175645c04536f34ceb702a955e53f5aebbc0df99a71ee3f9e6f2db7a.elf
.elf linux x86
f2fa5a8697826c7c7c292cf2b646dd74a26048b810583d32c0eeea36f15e6ae4.elf
.elf linux arm
f510c5adad382a960167228ddd818c4599a96a7cea5f0ac37cdb9f57f97692c4.elf
.elf linux x86
f8ddcfdadfced3f3f98483aeb191fa8d7a2314c5156dc2a52bde756ac3358977.exe
.exe windows:6 windows x64 arch:x64

fb0a8b4a81655f744a37af985e009476

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\MeshAgent\MeshAgent\Release\MeshService64.pdb

Imports

comctl32

InitCommonControlsEx

dbghelp

SymInitialize
SymGetModuleBase64
SymGetLineFromAddr64
SymFunctionTableAccess64
SymFromAddr
StackWalk64
MiniDumpWriteDump

iphlpapi

GetAdaptersAddresses
SendARP
ConvertLengthToIpv4Mask
GetAdaptersInfo

ws2_32

WSACloseEvent
htons
htonl
gethostname
ntohs
ntohl
WSAGetLastError
ioctlsocket
recv
WSASetLastError
send
getsockname
WSASocketW
listen
closesocket
bind
accept
__WSAFDIsSet
setsockopt
socket
sendto
getsockopt
recvfrom
connect
shutdown
WSAIoctl
GetAddrInfoW
WSAResetEvent
WSAEventSelect
WSAStartup
WSACreateEvent
WSACleanup
FreeAddrInfoW
select

crypt32

CertFindCertificateInStore
CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CryptAcquireCertificatePrivateKey
CertAddEncodedCertificateToStore
CryptMsgClose
CryptMsgUpdate
CryptExportPublicKeyInfo
CertCreateSelfSignCertificate
CertFreeCertificateContext
CryptMsgOpenToEncode
CertAddCertificateContextToStore
PFXExportCertStore
CryptSignAndEncodeCertificate
CertCloseStore
CertStrToNameA
CryptMsgGetParam
CryptEncodeObject
CertSetCertificateContextProperty
CertGetCertificateContextProperty
CryptMsgCalculateEncodedLength
CertOpenStore
CertStrToNameW
CertEnumCertificatesInStore

gdiplus

GdipGetImageEncoders
GdiplusShutdown
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree
GdipGetImageEncodersSize
GdipLoadImageFromStream
GdipSaveImageToStream
GdiplusStartup

ncrypt

NCryptCreatePersistedKey
NCryptFreeObject
NCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptGenRandom
NCryptOpenStorageProvider
BCryptOpenAlgorithmProvider
NCryptFinalizeKey

kernel32

InitializeSListHead
GetStartupInfoW
RtlUnwindEx
GetFullPathNameW
GetStdHandle
WriteFile
LoadLibraryExA
GetModuleFileNameW
GetSystemPowerStatus
OpenProcess
MultiByteToWideChar
Sleep
GetLastError
CloseHandle
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcAddress
SetEnvironmentVariableA
CreateProcessW
FreeLibrary
WideCharToMultiByte
GetCurrentThreadId
GetModuleHandleA
WaitForSingleObjectEx
CreateThread
QueueUserAPC
OpenThread
ReadFile
LoadLibraryA
SleepEx
SetSystemPowerState
GetCurrentProcess
SetThreadExecutionState
HeapFree
HeapAlloc
GetProcessHeap
SystemTimeToFileTime
GetSystemTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
QueryPerformanceCounter
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreA
CancelIo
FindFirstFileW
FindNextFileW
RemoveDirectoryW
GetFinalPathNameByHandleW
GetDriveTypeA
SetFilePointer
FindFirstVolumeA
FindClose
CreateFileW
GetVolumePathNamesForVolumeNameA
GetFileAttributesExW
ReadDirectoryChangesW
FindNextVolumeA
FindVolumeClose
GetDiskFreeSpaceExA
CreateEventA
GetModuleHandleExA
WaitForMultipleObjectsEx
CreateNamedPipeA
DisconnectNamedPipe
CreateFileA
CancelIoEx
LocalFree
ConnectNamedPipe
SetConsoleMode
GetConsoleMode
SetConsoleOutputCP
IsDebuggerPresent
TerminateProcess
GetTempPathW
CancelSynchronousIo
SetEvent
ResetEvent
IsProcessorFeaturePresent
GetCurrentProcessId
GetEnvironmentStrings
FreeEnvironmentStringsA
CopyFileW
RtlCaptureContext
SuspendThread
ResumeThread
DuplicateHandle
GetTickCount64
GetCurrentThread
GetOverlappedResult
GetThreadContext
WTSGetActiveConsoleSessionId
GetExitCodeProcess
SetEndOfFile
DeleteFileW
SetFilePointerEx
SetConsoleCtrlHandler
FreeConsole
LoadLibraryExW
SetLastError
GetFileType
GetModuleHandleW
SwitchToFiber
DeleteFiber
CreateFiber
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
CreateDirectoryW
GetConsoleCP
MoveFileExW
SetEnvironmentVariableW
GetTimeZoneInformation
SetStdHandle
GetDriveTypeW
PeekNamedPipe
GetCommandLineA
GetCommandLineW
GetACP
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetStringTypeW
HeapReAlloc
FlushFileBuffers
WriteConsoleW
GetCPInfo
FindFirstFileExW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
GetThreadId
RtlVirtualUnwind
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
RaiseException
HeapSize
RtlPcToFileHeader
QueryPerformanceFrequency
EncodePointer

user32

EndDialog
SetWindowTextW
GetWindowPlacement
ShowWindow
GetDlgCtrlID
SetWindowPlacement
SetWindowTextA
IsDlgButtonChecked
GetDlgItem
CheckDlgButton
DialogBoxParamW
EnableWindow
MessageBeep
ExitWindowsEx
GetUserObjectInformationA
EnumDisplayMonitors
GetSystemMetrics
SetThreadDesktop
GetThreadDesktop
CloseDesktop
BlockInput
GetMonitorInfoA
OpenInputDesktop
GetKeyState
GetMessageA
GetMessageExtraInfo
SendMessageW
LoadCursorA
DestroyWindow
GetDC
PostMessageA
GetIconInfo
CallNextHookEx
GetCursorInfo
SetWindowsHookExA
MapVirtualKeyA
GetForegroundWindow
UnhookWindowsHookEx
DefWindowProcA
CreateWindowExA
TranslateMessage
UnregisterClassA
DrawIconEx
SetWinEventHook
RegisterClassExA
UnhookWinEvent
SetForegroundWindow
ReleaseDC
SendInput
SetProcessDPIAware
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
DispatchMessageA
CreateWindowExW
GetWindowRect

gdi32

SetBkMode
SetBkColor
CreateSolidBrush
BitBlt
StretchBlt
DeleteDC
SetStretchBltMode
CreateCompatibleBitmap
GetObjectA
SelectObject
CreateCompatibleDC
GetDIBits
DeleteObject
SetTextColor
GetStockObject

advapi32

CloseServiceHandle
AllocateAndInitializeSid
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
StartServiceCtrlDispatcherA
RegCreateKeyW
RegSetValueExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
OpenProcessToken
InitiateSystemShutdownA
LookupPrivilegeValueA
AdjustTokenPrivileges
CryptReleaseContext
RegSetValueExW
CryptDestroyKey
InitializeSecurityDescriptor
SetEntriesInAclA
SetSecurityDescriptorDacl
DuplicateTokenEx
CreateProcessAsUserW
SetTokenInformation
OpenServiceA
CheckTokenMembership
FreeSid
RegisterServiceCtrlHandlerExA
OpenSCManagerA
SetServiceStatus
QueryServiceStatus

shell32

ShellExecuteExW

ole32

CoInitializeEx
CreateStreamOnHGlobal
CoUninitialize

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 981KB - Virtual size: 981KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
f986080126053f75b9e364d584fd9ef321858356610066c3eb4b3be37e809581.elf
.elf linux
fca1c84d387959435ca272cd08a56301b08610279a787efa38f1d023dad28119.elf
.elf linux arm
fce4211fa64e7c108ca2cf317e8f76bdf2cedd7f09283ad161a2befa755e48cc.jar
.jar
ff750e0026cb14b5121b065eeba0b573b847aebb030f934c82c330bf1192716a.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Files

Password: infected

Password: infected

5929190c8765f5bc37b052ab5c6c53e7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.data Size: 158KB - Virtual size: 158KB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.pdata Size: 28KB - Virtual size: 28KB

.xdata Size: 3KB - Virtual size: 3KB

.bss Size: - Virtual size: 354KB

.edata Size: 512B - Virtual size: 78B

.idata Size: 5KB - Virtual size: 4KB

.CRT Size: 512B - Virtual size: 112B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 22KB - Virtual size: 21KB

Password: infected

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 644KB

UPX1 Size: 264KB - Virtual size: 268KB

.rsrc Size: 201KB - Virtual size: 204KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 514KB - Virtual size: 513KB

.rdata Size: 56KB - Virtual size: 55KB

.data Size: 26KB - Virtual size: 105KB

.rsrc Size: 209KB - Virtual size: 208KB

Password: infected

5304b37e58964835f00e3b016aebe4ef

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

crypt32

Exports

Exports

Sections

.text Size: 90KB - Virtual size: 89KB

.rdata Size: 48KB - Virtual size: 47KB

.data Size: 3KB - Virtual size: 9KB

.pdata Size: 5KB - Virtual size: 4KB

_RDATA Size: 512B - Virtual size: 148B

.reloc Size: 2KB - Virtual size: 1KB

Password: infected

.text
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 158KB - Virtual size: 158KB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.pdata
Size: 28KB - Virtual size: 28KB

.xdata
Size: 3KB - Virtual size: 3KB

.bss
Size: - Virtual size: 354KB

.edata
Size: 512B - Virtual size: 78B

.idata
Size: 5KB - Virtual size: 4KB

.CRT
Size: 512B - Virtual size: 112B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 22KB - Virtual size: 21KB

UPX0
Size: - Virtual size: 644KB

UPX1
Size: 264KB - Virtual size: 268KB

.rsrc
Size: 201KB - Virtual size: 204KB

.text
Size: 514KB - Virtual size: 513KB

.rdata
Size: 56KB - Virtual size: 55KB

.data
Size: 26KB - Virtual size: 105KB

.rsrc
Size: 209KB - Virtual size: 208KB

.text
Size: 90KB - Virtual size: 89KB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 3KB - Virtual size: 9KB

.pdata
Size: 5KB - Virtual size: 4KB

_RDATA
Size: 512B - Virtual size: 148B

.reloc
Size: 2KB - Virtual size: 1KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

05:ad:e4:6d:b0:2a:2f:78:46:2a:29:37:27:e8:d8:74
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Certificate

33:00:00:2a:56:3b:36:cd:48:0f:a3:a4:09:00:00:00:00:2a:56
Certificate

33:00:00:2a:56:3b:36:cd:48:0f:a3:a4:09:00:00:00:00:2a:56
Certificate

33:00:00:00:05:fb:7a:5c:32:13:61:df:5d:00:00:00:00:00:05
Certificate

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Certificate

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

33:00:00:00:27:af:ad:af:67:15:26:b8:e3:00:00:00:00:00:27
Certificate

f1:f4:7a:b6:b0:5a:e3:44:7f:61:bc:4c:71:32:24:72:ff:16:8f:ae:fa:73:6b:34:c8:9a:15:29:ee:ef:1f:03
Signer

f1:f4:7a:b6:b0:5a:e3:44:7f:61:bc:4c:71:32:24:72:ff:16:8f:ae:fa:73:6b:34:c8:9a:15:29:ee:ef:1f:03
Signer

.text
Size: 69KB - Virtual size: 68KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 99KB - Virtual size: 99KB

.text
Size: 180KB - Virtual size: 180KB

.rsrc
Size: 183KB - Virtual size: 183KB

.reloc
Size: 512B - Virtual size: 12B