刺客远程控制破解版修复免杀过传输报毒.zip
- SHA256 c15b7d2402be8884b7f0e7cbc263e3b3c034601e559b530c55aeb5640ece8822
Behavioral task
behavioral1
Sample
刺客远程控制破解版修复免杀过传输报毒.zip
Resource
win7-20240220-en
windows7-x64
0 signatures
1800 seconds
Behavioral task
behavioral2
Sample
刺客远程控制破解版修复免杀过传输报毒.zip
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
1800 seconds
Behavioral task
behavioral3
Sample
刺客远程控制破解版修复免杀过传输报毒.zip
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
1800 seconds
Behavioral task
behavioral4
Sample
刺客远程控制破解版修复免杀过传输报毒.zip
Resource
win11-20240419-en
windows11-21h2-x64
0 signatures
1800 seconds
General
- Target 刺客远程控制破解版修复免杀过传输报毒.zip
- Size 28.2MB
- Sample240512-sdwlssef22
- SHA256 c15b7d2402be8884b7f0e7cbc263e3b3c034601e559b530c55aeb5640ece8822
- MD5 33a5ef7be9a92b856270684810c822ce
- SHA1 ef7f1e074026c5f403dec1178913ed744d56f84c
- SHA512 daabc739cd92b6170b16fa8cf324d53eacd483e27d0defa26cbab91310019d94d03acf072fd37d789f82735ac84ccffbdb556890585ab6ac0a38bfd999361547
- SSDEEP 786432:1kbXX5Y+ExmlAYeUtDYgfBv+NvtCWPy5SU5CrPYn+EPU9SkKOw956RGxHg:iN5ExWm2YgfdytCWkSaCrPY+ErtxA
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Blackmoon family
- Detect Blackmoon payload 6 IoCs
resource yara_rule static1/unpack001/Cache/Api interface/dll_zz_th.dll family_blackmoon static1/unpack001/Cache/DAT/i.exp family_blackmoon static1/unpack001/Cache/DAT/install.pg family_blackmoon static1/unpack001/Cache/DAT/install.pg.dll family_blackmoon static1/unpack001/Cache/plugin/client/file_mame_0.8.dll family_blackmoon static1/unpack001/Cache/plugin/server/file_mame_0.9.dll family_blackmoon - ACProtect 1.3x - 1.4x DLL software 4 IoCs
Detects file using ACProtect software.
resource yara_rule static1/unpack001/Cache/Api interface/File Download Options.dll acprotect static1/unpack001/Cache/Api interface/grouping.dll acprotect static1/unpack001/Cache/Api interface/quick text editor.dll acprotect static1/unpack001/ssdl_data_thread.dll acprotect -
resource yara_rule static1/unpack001/Cache/Api interface/File Download Options.dll upx static1/unpack001/Cache/Api interface/grouping.dll upx static1/unpack001/Cache/Api interface/quick text editor.dll upx static1/unpack001/ssdl_data_thread.dll upx - Unsigned PE 29 IoCs
Checks for missing Authenticode signature.
resource unpack001/Cache/Api interface/File Download Options.dll unpack002/out.upx unpack001/Cache/Api interface/Systeam Setini.dll unpack001/Cache/Api interface/Windows Install.dll unpack001/Cache/Api interface/dll_zz_th.dll unpack001/Cache/Api interface/grouping.dll unpack003/out.upx unpack001/Cache/Api interface/quick text editor.dll unpack004/out.upx unpack001/Cache/DAT/i.exp unpack001/Cache/DAT/install.pg unpack001/Cache/DAT/install.pg.dll unpack001/Cache/Winpe/atl.dll unpack001/Cache/Winpe/crtdll.dll unpack001/Cache/plugin/client/WQPlXhOR0.1.dll unpack001/Cache/plugin/client/cmd_shell_0.1.dll unpack001/Cache/plugin/client/file_mame_0.8.dll unpack001/Cache/plugin/client/serv_server_0.1.dll unpack001/Cache/plugin/client/video_screen_0.5.dll unpack001/Cache/plugin/server/cmd_shell.dll unpack001/Cache/plugin/server/cmd_shell_0.1.dll unpack001/Cache/plugin/server/file_mame_0.9.dll unpack001/Cache/plugin/server/remote_screen_3.1.dll unpack001/Cache/plugin/server/serv_server_0.1.dll unpack001/Cache/plugin/server/video_screen_0.2.dll unpack001/ssdl_data_thread.dll unpack005/out.upx unpack001/winspool.drv unpack001/刺客远程管理.exe
File Explorer
-
刺客远程控制破解版修复免杀过传输报毒.zip.zip 28.2MB
-
Cache/Api interface/File Download Options.dll.dll 311KB
-
out.upx.dll 760KB
-
Cache/Api interface/Systeam Setini.dll.dll 936KB
-
Cache/Api interface/Windows Install.dll.dll 1020KB
-
Cache/Api interface/dll_zz_th.dll.dll 120KB
-
Cache/Api interface/grouping.dll.dll 313KB
-
out.upx.dll 752KB
-
Cache/Api interface/quick text editor.dll.dll 355KB
-
out.upx.dll 892KB
-
Cache/BUG/6817793 127.0.0.1.BUG.7620815941B
-
Cache/DAT/Copy.bat89B
-
Cache/DAT/i.exp.dll 268KB
-
Cache/DAT/install.dat.exe 28.2MB
-
Cache/DAT/install.pg.dll 384KB
-
Cache/DAT/install.pg.dll.dll 384KB
-
Cache/DAT/警告.txt76B
-
Cache/Quickaccess/Mylist.ini242B
-
Cache/Quickaccess/Quickaccess.ini1KB
-
Cache/Winpe/atl.dll.dll 79KB
-
Cache/Winpe/crtdll.dll.dll 145KB
-
Cache/Winpe/help.txt108B
-
Cache/ico/main.ico4KB
-
Cache/menu.main274B
-
Cache/menu.main2305B
-
Cache/menu.menu1KB
-
Cache/menu.regedit82B
-
Cache/plugin/client/WQPlXhOR0.1.dll.dll 124KB
-
Cache/plugin/client/cmd_shell.ini30B
-
Cache/plugin/client/cmd_shell_0.1.dll.dll 80KB
-
Cache/plugin/client/file_mame.ini30B
-
Cache/plugin/client/file_mame_0.8.dll.dll 160KB
-
Cache/plugin/client/loadname.txt21B
-
Cache/plugin/client/remote_screen.ini28B
-
Cache/plugin/client/serv_server.ini32B
-
Cache/plugin/client/serv_server_0.1.dll.dll 84KB
-
Cache/plugin/client/video_screen.ini33B
-
Cache/plugin/client/video_screen_0.5.dll.dll 136KB
-
Cache/plugin/server/cmd_shell.dll.dll 80KB
-
Cache/plugin/server/cmd_shell.ini30B
-
Cache/plugin/server/cmd_shell_0.1.dll.dll 412KB
-
Cache/plugin/server/file_mame.ini30B
-
Cache/plugin/server/file_mame_0.9.dll.dll 696KB
-
Cache/plugin/server/loadname.txt21B
-
Cache/plugin/server/remote_screen.ini34B
-
Cache/plugin/server/remote_screen_3.1.dll.dll 536KB
-
Cache/plugin/server/serv_server.ini32B
-
Cache/plugin/server/serv_server_0.1.dll.dll 524KB
-
Cache/plugin/server/video_screen.ini33B
-
Cache/plugin/server/video_screen_0.2.dll.dll 536KB
-
Cache/qqwry.dat9.9MB
-
Cache/release.bat138B
-
Cache/rule.txt211B
-
Cache/variable/variable.txt270B
-
Cache/windows/Advanced Customization/Main.ini231B
-
Cache/windows/Advanced Customization/主体窗口图标.png.png 214B
-
Cache/windows/win_main/list.txt197B
-
Cache/windows/win_main/safe.txt12KB
-
Cache/刺客远程管理.ini248B
-
ebxshouquan.dat466B
-
ico/1.ini1KB
-
ico/1.localstorage1KB
-
ico/1.md51KB
-
ico/1.sys1KB
-
ico/1.txt1KB
-
ico/1.url1KB
-
ico/1BOOTNXT1KB
-
ico/1bootmgr1KB
-
ico/wjj.bmp1KB
-
ssdl_data_thread.dll.dll 6KB
-
out.upx.dll 20KB
-
winspool.drv.dll 920KB
-
刺客远程管理.exe.exe 4.0MB
-
剪辑版拦截信息/192.168.1.28.txt29B
Cache/Api interface/File Download Options.dll
- SHA256 a116b965051c8d5ed7f335543762e5a2606ee5d36c7d8c627c15df8ad239888c
- MD5 7cb9b4401bba725beceea57e255f99f8
- SHA1 62aac0c140e46a989a5f72d9fd1ada0bb4cf4590
- SHA512 f2030d8519a8db218175f45726bc2b9704c7a9406da4c7209a244245fff785e553a2a336054348d9681938b72524c5059f1a70f8e8880965908f1ea7156f2dcc
- SSDEEP 6144:XhPkyVr9C2i8BNx3inFlhabFK9W6ZNwxulHGZv/ukFkFTu83GGN2r3vz5m:xR5Ur8BmF3aY9bZCZv/PeFa83a3vzc
- MD5 SHA1 SHA512 SSDEEP
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
871744
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
file_download_options
Name
UPX0
Size
Virtual Size
544KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
304KB
Virtual Size
304KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=43, id=14, version=7299,
count=185, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=86, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=12, version=7291,
count=44, id=19, version=8022,
count=21, id=19, version=8034,
count=591, id=1, productName=Unmarked objects,
count=74, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=25, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=31, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
out.upx
- SHA256 17394b3441015cb4d4364c796473d705471dd9e57f9673b821c065e5ea0b112e
- MD5 90fc9465d8c6193c3eac325f1108a435
- SHA1 65f4d207fc1a79c8f9b318fda1955984114be75c
- SHA512 61e1198653956aff3b7111a4f156b3992a73b73e925a7b10c77db63c43c046bd5a75ed456904a098ad01bf92322a6bc69cdb628f719d5f515cc2edc2d841910e
- SSDEEP 6144:jON8FnQDxlpv57udF/VjHJBY138xDToOIMAKfsDXs4XTn2GxPt2JO/JPAHSM:qUU/v57uvhnA89NAEhQx1TJE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
394145
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
508KB
Virtual Size
504KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
84KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
72KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=43, id=14, version=7299,
count=185, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=86, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=12, version=7291,
count=44, id=19, version=8022,
count=21, id=19, version=8034,
count=591, id=1, productName=Unmarked objects,
count=74, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=25, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=31, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Cache/Api interface/Systeam Setini.dll
- IMPHASH 95585fe4f2eee5fb6ec130132bbcb2ac
- SHA256 4e8a54b64e42ef27da8849ebfb51861e18d35cd58c768be05079f58cff0d0815
- MD5 3b8ed659cfc34c20045bc6e3db11ec7f
- SHA1 19bf1130f48261f1d588da41d08f0dee07f853f6
- SHA512 d00d55ce7655b7d66c636c3fa7ba9d4b06b0907d85019dd3e752f4836beb92e685633f974aa3c6aef4f041a2caf5b8d52cbdb0db907f273f745918b6147e94fd
- SSDEEP 24576:iIh4G0GuuXZnq8VcZ4Bo5y6z0HIiur6qvZDc:jh4qvZho5toQrhvpc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
528141
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
SetFilePointer
GetCurrentProcess
DuplicateHandle
lstrcpynA
SetLastError
FileTimeToLocalFileTime
FileTimeToSystemTime
LocalFree
InterlockedDecrement
SuspendThread
TerminateThread
ReleaseMutex
CreateMutexA
CreateSemaphoreA
ResumeThread
ReleaseSemaphore
EnterCriticalSection
LeaveCriticalSection
GetProfileStringA
SetStdHandle
IsBadCodePtr
IsBadReadPtr
CompareStringW
CompareStringA
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
IsBadWritePtr
VirtualAlloc
LCMapStringW
LCMapStringA
SetEnvironmentVariableA
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetACP
HeapSize
TerminateProcess
RaiseException
WriteFile
WaitForMultipleObjects
CreateFileA
SetEvent
FindResourceA
LoadResource
LockResource
ReadFile
GetModuleFileNameA
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThreadId
ExitProcess
GlobalSize
GlobalFree
DeleteCriticalSection
InitializeCriticalSection
lstrcatA
lstrlenA
WinExec
lstrcpyA
FindNextFileA
GlobalReAlloc
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
GetFullPathNameA
FreeLibrary
LoadLibraryA
GetLastError
GetVersionExA
WritePrivateProfileStringA
GetPrivateProfileStringA
CreateThread
CreateEventA
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
FindFirstFileA
FindClose
GetFileAttributesA
GetLocalTime
GetSystemTime
GetTimeZoneInformation
RtlUnwind
GetOEMCP
GetCPInfo
GetProcessVersion
SetErrorMode
GlobalFlags
GetCurrentThread
GetFileTime
GetFileSize
TlsGetValue
LocalReAlloc
TlsSetValue
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
lstrcmpA
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
SetCurrentDirectoryA
GetVolumeInformationA
GetModuleHandleA
GetProcAddress
GlobalDeleteAtom
lstrcmpiA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
MulDiv
GetCommandLineA
GetTickCount
WaitForSingleObject
CloseHandle
InterlockedIncrement
user32
SetParent
GetParent
GetFocus
GetClientRect
DestroyCursor
SendMessageA
SetWindowPos
MessageBoxA
GetCursorPos
GetSystemMetrics
IsWindow
InvalidateRect
ValidateRect
UpdateWindow
EqualRect
GetWindowRect
SetForegroundWindow
DestroyMenu
wsprintfA
CloseClipboard
GetClipboardData
OpenClipboard
SetClipboardData
PostMessageA
EmptyClipboard
GetMenuItemID
IsChild
ReleaseDC
IsRectEmpty
FillRect
GetDC
SetCursor
LoadCursorA
SetCursorPos
SetActiveWindow
GetSysColor
SetWindowLongA
GetWindowLongA
RedrawWindow
EnableWindow
IsWindowVisible
OffsetRect
PtInRect
DestroyIcon
IntersectRect
InflateRect
SetRect
SetScrollPos
SetScrollRange
GetScrollRange
SetCapture
GetCapture
ReleaseCapture
SetTimer
KillTimer
LoadIconA
TranslateMessage
DrawFrameControl
DrawEdge
DrawFocusRect
WindowFromPoint
GetMessageA
DispatchMessageA
SetRectEmpty
RegisterClipboardFormatA
CreateIconFromResourceEx
CreateIconFromResource
DrawIconEx
CreatePopupMenu
AppendMenuA
ModifyMenuA
CreateMenu
CreateAcceleratorTableA
GetDlgCtrlID
GetSubMenu
EnableMenuItem
ClientToScreen
EnumDisplaySettingsA
LoadImageA
SystemParametersInfoA
ShowWindow
IsWindowEnabled
TranslateAcceleratorA
GetKeyState
CopyAcceleratorTableA
PostQuitMessage
IsZoomed
GetClassInfoA
DefWindowProcA
GetSystemMenu
DeleteMenu
GetMenu
SetMenu
PeekMessageA
IsIconic
GetWindowTextA
GetWindowTextLengthA
CharUpperA
GetWindowDC
BeginPaint
EndPaint
TabbedTextOutA
DrawTextA
GrayStringA
GetDlgItem
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetNextDlgTabItem
GetWindowPlacement
RegisterWindowMessageA
GetForegroundWindow
GetLastActivePopup
GetMessageTime
RemovePropA
CallWindowProcA
GetPropA
UnhookWindowsHookEx
SetPropA
GetClassLongA
CallNextHookEx
SetWindowsHookExA
CreateWindowExA
WinHelpA
GetMenuItemCount
RegisterClassA
GetScrollPos
AdjustWindowRectEx
MapWindowPoints
SendDlgItemMessageA
ScrollWindowEx
IsDialogMessageA
SetWindowTextA
MoveWindow
CheckMenuItem
SetMenuItemBitmaps
GetMenuState
GetMenuCheckMarkDimensions
GetClassNameA
GetDesktopWindow
UnregisterClassA
LoadStringA
GetSysColorBrush
SetFocus
GetActiveWindow
GetWindow
DestroyAcceleratorTable
SetWindowRgn
GetMessagePos
ScreenToClient
ChildWindowFromPointEx
CopyRect
LoadBitmapA
GetTopWindow
gdi32
GetSystemPaletteEntries
CreatePalette
StretchBlt
SelectPalette
RealizePalette
GetDIBits
GetWindowExtEx
GetViewportOrgEx
GetWindowOrgEx
BeginPath
EndPath
PathToRegion
CreateEllipticRgn
CreateRoundRectRgn
GetTextColor
GetBkMode
GetBkColor
GetROP2
GetStretchBltMode
GetPolyFillMode
CreateCompatibleBitmap
CreateDCA
CreateBitmap
SelectObject
GetObjectA
CreatePen
PatBlt
CombineRgn
CreateDIBitmap
FillRgn
CreateSolidBrush
GetStockObject
CreateFontIndirectA
EndPage
EndDoc
DeleteDC
StartDocA
StartPage
BitBlt
CreateCompatibleDC
Ellipse
Rectangle
LPtoDP
DPtoLP
GetCurrentObject
RoundRect
GetTextExtentPoint32A
GetDeviceCaps
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
ExcludeClipRect
MoveToEx
LineTo
DeleteObject
SelectClipRgn
CreatePolygonRgn
GetClipRgn
SetStretchBltMode
CreateRectRgnIndirect
SetBkColor
CreateRectRgn
GetTextMetricsA
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetViewportExtEx
ExtSelectClipRgn
winmm
midiStreamRestart
midiStreamClose
midiOutReset
midiStreamStop
midiStreamOut
midiOutPrepareHeader
midiStreamProperty
midiStreamOpen
midiOutUnprepareHeader
waveOutOpen
waveOutGetNumDevs
waveOutClose
waveOutReset
waveOutPause
waveOutWrite
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutRestart
winspool.drv
ClosePrinter
DocumentPropertiesA
OpenPrinterA
advapi32
RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegQueryValueA
RegCreateKeyExA
shell32
ShellExecuteA
Shell_NotifyIconA
ole32
CLSIDFromString
OleUninitialize
OleInitialize
oleaut32
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
comctl32
ord17
ImageList_Destroy
ws2_32
inet_ntoa
WSACleanup
closesocket
WSAAsyncSelect
ntohl
accept
getpeername
recv
ioctlsocket
recvfrom
comdlg32
GetSaveFileNameA
GetOpenFileNameA
ChooseColorA
GetFileTitleA
Retini_Uninstall
Systeam_Setini
Name
.text
Size
644KB
Virtual Size
642KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
100KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
96KB
Virtual Size
295KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
80KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=43, id=14, version=7299,
count=3, id=12, version=7291,
count=44, id=19, version=8022,
count=21, id=19, version=8034,
count=596, id=1, productName=Unmarked objects,
count=102, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=206, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=78, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=27, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=36, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Cache/Api interface/Windows Install.dll
- IMPHASH cb93c75d19b9d01034d67df1b29deb2d
- SHA256 3b15c2bf5c1b6d5809c4df4db02220abdbcce060311322dd42171339c87a718f
- MD5 e1ca780e80c3a72824de5553b3cd4ce6
- SHA1 9b5c1388940f451d266987940949439837cd0ca5
- SHA512 b91199304a437f4edf07603427c3717d6ffe3de3f6d72f0db0421e5baf1e7266cd341a1a769eddd375e612f5d5851d9aa59b0804456aca2e72a7fd815abcb330
- SSDEEP 12288:RhhD5Uz2M3TiPBdw8og0N2qW7jvD+YYeBLGEaYgzuzeyQ/ZV8u76q2kj:vhDsDiZdj08qWKS+SzeyQf8un2kj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
579281
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LocalFree
InterlockedDecrement
SuspendThread
TerminateThread
ReleaseMutex
CreateMutexA
GetCurrentProcess
GetWindowsDirectoryA
GetSystemDirectoryA
CreateSemaphoreA
ResumeThread
ReleaseSemaphore
EnterCriticalSection
LeaveCriticalSection
GetProfileStringA
WriteFile
SetStdHandle
IsBadCodePtr
IsBadReadPtr
CompareStringW
CompareStringA
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
IsBadWritePtr
VirtualAlloc
LCMapStringW
LCMapStringA
SetEnvironmentVariableA
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetACP
HeapSize
TerminateProcess
RaiseException
WaitForMultipleObjects
CreateFileA
SetEvent
FindResourceA
LoadResource
LockResource
ReadFile
GetModuleFileNameA
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThreadId
ExitProcess
GlobalSize
GlobalFree
DeleteCriticalSection
InitializeCriticalSection
lstrcatA
lstrlenA
WinExec
lstrcpyA
FindNextFileA
GlobalReAlloc
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
GetFullPathNameA
FreeLibrary
LoadLibraryA
GetLastError
GetVersionExA
WritePrivateProfileStringA
GetPrivateProfileStringA
CreateThread
CreateEventA
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
GetTempPathA
FindFirstFileA
FindClose
GetFileAttributesA
SetCurrentDirectoryA
GetLocalTime
GetSystemTime
GetTimeZoneInformation
RtlUnwind
GetOEMCP
GetCPInfo
GetProcessVersion
SetErrorMode
GlobalFlags
GetCurrentThread
GetFileTime
GetFileSize
TlsGetValue
LocalReAlloc
TlsSetValue
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
lstrcmpA
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
GetVolumeInformationA
GetModuleHandleA
GetProcAddress
MulDiv
GetCommandLineA
GetTickCount
WaitForSingleObject
CloseHandle
lstrcmpiA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
DuplicateHandle
lstrcpynA
SetLastError
FileTimeToLocalFileTime
FileTimeToSystemTime
InterlockedIncrement
user32
GetCursorPos
MessageBoxA
SetWindowPos
SendMessageA
DestroyCursor
SetParent
IsWindow
PostMessageA
GetTopWindow
GetParent
GetFocus
GetClientRect
InvalidateRect
ValidateRect
UpdateWindow
EqualRect
GetWindowRect
SetForegroundWindow
DestroyMenu
EmptyClipboard
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
wsprintfA
GetSystemMetrics
IsChild
ReleaseDC
IsRectEmpty
FillRect
GetDC
SetCursor
LoadCursorA
SetCursorPos
SetActiveWindow
GetSysColor
SetWindowLongA
GetWindowLongA
RedrawWindow
EnableWindow
IsWindowVisible
OffsetRect
PtInRect
DestroyIcon
IntersectRect
InflateRect
SetRect
SetScrollPos
SetScrollRange
GetScrollRange
SetCapture
GetCapture
ReleaseCapture
SetTimer
KillTimer
WinHelpA
GetForegroundWindow
LoadIconA
TranslateMessage
DrawFrameControl
DrawEdge
DrawFocusRect
WindowFromPoint
GetMessageA
DispatchMessageA
SetRectEmpty
RegisterClipboardFormatA
CreateIconFromResourceEx
CreateIconFromResource
DrawIconEx
CreatePopupMenu
AppendMenuA
ModifyMenuA
CreateMenu
CreateAcceleratorTableA
GetDlgCtrlID
GetSubMenu
EnableMenuItem
ClientToScreen
EnumDisplaySettingsA
LoadImageA
SystemParametersInfoA
ShowWindow
IsWindowEnabled
TranslateAcceleratorA
GetKeyState
CopyAcceleratorTableA
PostQuitMessage
IsZoomed
GetClassInfoA
DefWindowProcA
GetSystemMenu
DeleteMenu
GetMenu
SetMenu
PeekMessageA
IsIconic
GetWindowTextA
GetWindowTextLengthA
CharUpperA
GetWindowDC
BeginPaint
EndPaint
TabbedTextOutA
DrawTextA
GrayStringA
GetDlgItem
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetNextDlgTabItem
GetWindowPlacement
RegisterWindowMessageA
GetLastActivePopup
GetMessageTime
RemovePropA
CallWindowProcA
GetPropA
UnhookWindowsHookEx
SetPropA
GetClassLongA
CallNextHookEx
SetWindowsHookExA
CreateWindowExA
GetMenuItemID
GetMenuItemCount
RegisterClassA
GetScrollPos
AdjustWindowRectEx
MapWindowPoints
SendDlgItemMessageA
ScrollWindowEx
IsDialogMessageA
SetWindowTextA
MoveWindow
CheckMenuItem
SetMenuItemBitmaps
GetMenuState
GetMenuCheckMarkDimensions
GetClassNameA
GetDesktopWindow
UnregisterClassA
LoadStringA
GetSysColorBrush
SetFocus
GetActiveWindow
GetWindow
DestroyAcceleratorTable
SetWindowRgn
GetMessagePos
ScreenToClient
ChildWindowFromPointEx
CopyRect
LoadBitmapA
gdi32
GetWindowOrgEx
BeginPath
EndPath
PathToRegion
CreateEllipticRgn
CreateRoundRectRgn
GetTextColor
GetBkMode
GetBkColor
GetROP2
GetStretchBltMode
GetPolyFillMode
CreateCompatibleBitmap
CreateDCA
CreateBitmap
SelectObject
GetObjectA
CreatePen
PatBlt
CombineRgn
CreateRectRgn
FillRgn
CreateSolidBrush
GetStockObject
CreateFontIndirectA
EndPage
EndDoc
CreateRectRgnIndirect
StartDocA
StartPage
BitBlt
GetViewportOrgEx
Ellipse
Rectangle
LPtoDP
DPtoLP
GetCurrentObject
RoundRect
GetTextExtentPoint32A
GetDeviceCaps
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
ExcludeClipRect
MoveToEx
LineTo
GetWindowExtEx
GetDIBits
RealizePalette
SelectPalette
StretchBlt
CreatePalette
GetSystemPaletteEntries
CreateDIBitmap
DeleteObject
SelectClipRgn
CreatePolygonRgn
GetClipRgn
SetStretchBltMode
CreateCompatibleDC
SetBkColor
DeleteDC
GetTextMetricsA
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetViewportExtEx
ExtSelectClipRgn
winmm
midiStreamRestart
midiStreamClose
midiOutReset
midiStreamStop
midiStreamOut
midiOutPrepareHeader
midiStreamProperty
midiStreamOpen
midiOutUnprepareHeader
waveOutOpen
waveOutGetNumDevs
waveOutClose
waveOutReset
waveOutPause
waveOutWrite
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutRestart
winspool.drv
ClosePrinter
DocumentPropertiesA
OpenPrinterA
advapi32
RegQueryValueA
RegSetValueExA
RegOpenKeyExA
RegCloseKey
RegCreateKeyExA
shell32
SHGetSpecialFolderPathA
Shell_NotifyIconA
ShellExecuteA
ole32
OleInitialize
OleUninitialize
CLSIDFromString
oleaut32
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
comctl32
ord17
ImageList_Destroy
ImageList_Read
ImageList_Duplicate
ImageList_GetIcon
ws2_32
inet_ntoa
gethostbyname
WSAStartup
WSACleanup
closesocket
WSAAsyncSelect
recvfrom
ntohl
accept
getpeername
ioctlsocket
recv
comdlg32
GetFileTitleA
GetOpenFileNameA
ChooseColorA
GetSaveFileNameA
Windows_Install_Main
_�����ӳ���
�ı�_����_�Ż�_NB
Name
.text
Size
696KB
Virtual Size
693KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
120KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
104KB
Virtual Size
337KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
84KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=43, id=14, version=7299,
count=3, id=12, version=7291,
count=44, id=19, version=8022,
count=21, id=19, version=8034,
count=608, id=1, productName=Unmarked objects,
count=223, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=108, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=78, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=27, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=37, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Cache/Api interface/dll_zz_th.dll
- IMPHASH 7f441486db7538317035591b470cfeb3
- SHA256 8a934ae5da64387e15ca4201e92227989ac4f231cb47cf89838fd4aa147e4b1f
- MD5 e908cba5f2f1831f83e8a4a887da3ad1
- SHA1 9df6b8ef4d73be5318a01a57e34630cf7969d0f3
- SHA512 d30c2d2af7cd9e134af6d30e9b2a98de2dcf59d703a6f983d865ba688d85d05604a2541d500957e59596263f3774f1c68ee68adfcde963338b8d0a6e8f94e92a
- SSDEEP 1536:ClWG8aDNiDs0cTgq1uC3r5waFOrTmjLJRUynWaG3p63L5tZN/x7Oz:C389dcCC9OGFhGZsdtZNx+
- MD5 SHA1 SHA512 SSDEEP
-
Detect Blackmoon payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
44457
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualAlloc
VirtualFree
LoadLibraryA
GetProcAddress
OpenProcess
LocalAlloc
LocalFree
lstrcatA
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
WriteFile
CreateFileA
ReadFile
GetFileSize
SetFilePointer
GetUserDefaultLCID
GetCommandLineA
FreeLibrary
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
CloseHandle
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
RtlUnwind
RaiseException
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetLastError
TlsGetValue
SetLastError
TlsFree
VirtualQueryEx
GetCurrentProcess
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetVersion
InterlockedDecrement
InterlockedIncrement
TerminateProcess
ole32
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
OleRun
CoInitialize
CoUninitialize
user32
DispatchMessageA
MessageBoxA
PeekMessageA
GetMessageA
TranslateMessage
wsprintfA
shlwapi
PathFileExistsA
oleaut32
RegisterTypeLi
SafeArrayDestroy
VariantClear
VariantTimeToSystemTime
VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
VarR8FromCy
VarR8FromBool
VariantChangeType
LoadTypeLi
LHashValOfNameSys
SysFreeString
VariantCopy
SafeArrayCreate
SysAllocString
dll_zz_th
�߳�_��ʼ��COM��
�߳�_ȡ��COM��
Name
.text
Size
72KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
28KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=22, id=14, version=7299,
count=114, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=134, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=45, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, productName=Unmarked objects (old),
count=3, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
Cache/Api interface/grouping.dll
- SHA256 ae5fb41a91013a118e5e600bf17496475b07b8b6626516033486b3e58baf43df
- MD5 51c10c386c992fe1cbef4c9ae58b38e4
- SHA1 2dc05ef9503f9142e28769f2ffaa481778917da7
- SHA512 b2e5a862d5ff6d50defe23b2c4fea700398dd2146847833b19be0cea7b3c3c1c80f41bf4886e078f51186e4a552ecdf8bfe8d5b98e0773c9b18424722ddd55d4
- SSDEEP 6144:ELQJcZL0+hObe19PQnmRJJKezLe6ZJmXU7lSE7qWCMLbAnROHFj8Vbn:wZLXOS1yngKyLhJmX0mAmkKbn
- MD5 SHA1 SHA512 SSDEEP
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
863856
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
����_���ķ���_��������
Name
UPX0
Size
Virtual Size
536KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
304KB
Virtual Size
308KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=43, id=14, version=7299,
count=185, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=86, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=12, version=7291,
count=44, id=19, version=8022,
count=21, id=19, version=8034,
count=591, id=1, productName=Unmarked objects,
count=74, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=25, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=31, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
out.upx
- SHA256 ee846e7a237aa8b65aa8c1f8b15c41083f9ce86b8fa45b07935138893f26d49e
- MD5 b4f18028f9c9ea5085e3405830a3d0fb
- SHA1 7bcd14c0a4d7d6d7b265c4446f09518a9ca1cb53
- SHA512 6c4035eaeb479953e635189346e47ccf08447347b191067348f7b22ef879478b2670caf6caad905869599e1346d8b0e3310c2a3d4abbd2792e1376eccbbdbc68
- SSDEEP 6144:MU0YrShzwdspJCznAOZJ6A9cif9nOc2wmrwUDsINesicvJvEjZYCu6LoG:MUGVwdspEbAi9cZbwkwYi4v2ZYCt
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
392245
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
504KB
Virtual Size
502KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
80KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
72KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=43, id=14, version=7299,
count=185, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=86, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=12, version=7291,
count=44, id=19, version=8022,
count=21, id=19, version=8034,
count=591, id=1, productName=Unmarked objects,
count=74, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=25, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=31, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Cache/Api interface/quick text editor.dll
- SHA256 a9188ed78e8b3381c3b915b61cb5c74b082834508fbc955699eb38a9e6922f1a
- MD5 b77041c0f17a14a638f1af8405739084
- SHA1 27b75b73574ea0750464f787f9345aa7f33fae34
- SHA512 5afaf6a008aed034f059247a1ad9a253e189942f740b25c3b5da5674e70b3fa54c2fde645050c357634370446e7ce3baac649924c368a29727f41c93520d291a
- SSDEEP 6144:lbtn2pWQl22zZc2sNAAb0n3YaVDykQAqPPY1yh9qsP9O4+ucNENbTipK/aN:lJn24Ql2CZONUn7DBQNPw1yv1O+oKSN
- MD5 SHA1 SHA512 SSDEEP
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1171648
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
quick_text_editor
Name
UPX0
Size
Virtual Size
792KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
349KB
Virtual Size
352KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=43, id=14, version=7299,
count=3, id=12, version=7291,
count=44, id=19, version=8022,
count=21, id=19, version=8034,
count=608, id=1, productName=Unmarked objects,
count=206, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=105, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=79, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=27, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=37, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
out.upx
- SHA256 ae4890aeabf519de4e80e5d27c0d7f1770fdea1a3db17d7252c96659a07b9610
- MD5 28bd4937d1b50197494bc96153b1b905
- SHA1 0e3602c6f78459040abfa3d525318b2daeec4d1d
- SHA512 e6ec6bacf21c8ee4dfdf54756bd2c467dc9765a666b8ea5402e67af19969dd426929d5eef1906f1a244ee6b096f791365f58b0e3670b99ce066e2ca6d9ede299
- SSDEEP 12288:N6YnYQQcWWEC8AJzQsDrsD2cxnCgJp1U2kbw:wYn9Q5WEDASsMgRbw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
498309
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
612KB
Virtual Size
611KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
88KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
96KB
Virtual Size
319KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
80KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=43, id=14, version=7299,
count=3, id=12, version=7291,
count=44, id=19, version=8022,
count=21, id=19, version=8034,
count=608, id=1, productName=Unmarked objects,
count=206, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=105, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=79, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=27, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=37, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Cache/BUG/6817793 127.0.0.1.BUG.7620815
- SHA256 bc9fbdec3bfd84eed97a3279bd0e02aab792da331c672b1bd5521403ae2866bf
- MD5 fb301e791203333f249c99baebd8543d
- SHA1 df752a5f2e02d94f1ea9481b15a471ff6fae4ae0
- SHA512 7efe6300716963b2b0327a5865f992201f82adb0c4a7ac43a5c3c44baf7fe19246b6ab1ca5bec65518a632c98b9c86f2ebc1e4b0e87be7d29af5068ed5ecbe81
- MD5 SHA1 SHA512
Cache/DAT/Copy.bat
- SHA256 34dd8484bc25e138881779e59573a2c36246fc750298b9ff45475ecc1a906d6f
- MD5 134dd7210f80b42292059ada1a9094bd
- SHA1 c897d7e919d4dcfda91b0a6b168384bc17cd1b74
- SHA512 4c6b026fdb3e3ffe5c5cbad0a277f14d13623bcc8b03f6183895e67af6599f4a850f2966c7f84fd21a6d482a58f8af67879137759057bdbc884a9065e35ccf77
- MD5 SHA1 SHA512
Cache/DAT/i.exp
- IMPHASH 478bf7d44bdab2cfdcb55f677c1b2ebd
- SHA256 54c07565f61c9ca5d9a56328ea922efc64cf2228ad694a7ccc5f29426a9d2719
- MD5 73df08f3759b3d15a11ca3f1a75d647c
- SHA1 dad072ef9fe1317f87b6df0fb582a4cb76f2d469
- SHA512 01c9e2311499b6257ea9d4b5bc9663804a5dacbb813db069cd82471abcc5b983394d802fd3e75450aaaed590b8b78388e6a967b00c1fdf494fcf8ec6e5794da6
- SSDEEP 6144:32DuHMbxsIKvbXkFkqH2aB3YdwS1x+wK7wxecHil47ZpCXGvYOPi:32DuHaxczXkm6B3YdwS1x+wK7wxecHiY
- MD5 SHA1 SHA512 SSDEEP
-
Detect Blackmoon payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
219200
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
winmm
timeKillEvent
timeSetEvent
kernel32
DeleteTimerQueueTimer
RtlMoveMemory
RtlZeroMemory
CreateTimerQueueTimer
InterlockedCompareExchange
CreateThread
SetThreadPriority
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreatePipe
CreateProcessA
CloseHandle
PeekNamedPipe
ReadFile
GetExitCodeProcess
CreateFileA
GlobalAlloc
GlobalFree
GetLogicalProcessorInformation
Sleep
lstrcpyn
LocalSize
GetFileSizeEx
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
SetFilePointerEx
SetEndOfFile
MapViewOfFileEx
FlushViewOfFile
GetLastError
GetFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateTimerQueue
CreateIoCompletionPort
DeleteTimerQueue
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
HeapCreate
HeapAlloc
HeapDestroy
GetProcessHeap
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
LeaveCriticalSection
DeleteCriticalSection
TryEnterCriticalSection
ExitProcess
HeapReAlloc
HeapFree
IsBadReadPtr
GetTickCount
CreateDirectoryA
DeleteFileA
CopyFileA
MoveFileA
GetModuleFileNameA
GetCommandLineA
FreeLibrary
LoadLibraryA
LCMapStringA
ws2_32
WSACleanup
freeaddrinfo
getaddrinfo
WSAStartup
recvfrom
bind
setsockopt
ioctlsocket
WSASocketA
sendto
closesocket
getsockname
inet_ntoa
ntohs
inet_addr
htons
user32
TranslateMessage
wsprintfA
GetMessageA
WaitForInputIdle
DispatchMessageA
PeekMessageA
MessageBoxA
msvcrt
floor
strncmp
memmove
??3@YAXPAX@Z
realloc
strchr
strrchr
_CIfmod
srand
__CxxFrameHandler
rand
malloc
atoi
_ftol
strtod
sprintf
modf
free
shlwapi
PathFileExistsA
UBroadcasts
UBuffAllocMem
UBuffCreate
UBuffDestory
UBuffFreeMem
UByteToTXT
UCRC32
UClose
UCloseAll
UCloseFile
UConnect
UConnectForwar
UCreate
UDestory
UForwarIf
UGetBind
UGetConnectINFO
UGetFileINFO
UGetForwarID
UGetIP
UGetIPv6
UGetMark1
UGetMark2
UGetOnlinelist
UGetPort
UGetRTT
UGetReceiveSpeed
UGetSendSpeed
UGetUUID
UGetUUIDLink
UGetVersion
UGetVersionLink
UHostNameToIP
UIsConnected
UKillTime
UNAT_PunchTy
UP2PConnect
UP2PConnectForwar
UP2PForwarServerLinkIf
UP2PGetEvents
UP2PGetID
UP2PServerLinkIf
UP2PSetForwarServer
UP2PSetLinkServerAUZ
UP2PSetServer
URecv
USend
USendFile
USend_UDP
USendto
USetCallback
USetFileRecv
USetMark1
USetMark2
USetPant
USetSpeed
USetSpeedLink
UShutDown
USocket
USocket_
UStartTime
UStartTime_
UTimeToTXT
Uinet_addr
Uinet_addr_Memcpy
Uinet_ntoa
Name
.text
Size
224KB
Virtual Size
222KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=2, id=4, version=8047,
count=2, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=122, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=53, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, productName=Unmarked objects (old),
count=3, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
Cache/DAT/install.dat
- SHA256 f3afa86b9ad5696ca13541ca74472cca71bcaeb1276bf93ff1705d91e4754f25
- MD5 02afebc79a9facd65ce69968380b903a
- SHA1 8849342dce6d668ad605b49bfa192a91b8869046
- SHA512 5cb7565c927eb4f0da8815782b23aaefef9c4226e5ec0045d21683c54c5babb2134ac7f4ddc21603edf2b7f967d2c52a5eafb5ed35a4235f89e235f00a407fe0
- SSDEEP 393216:ssjDMT4CJjn8sJKY9PT2lj+o2pvSwN+QSE2NCSuTOnP5Y0TTnJHuYE2NCSuTOnPY:UcRCTo/21/IE2TmOPVlRE2TmOPVlU
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
ee:62:4d:c6:1c:4d:9c:9a:13:11:7a:f6:4e:21:65:d7:99:42:07:ca:14:f6:a7:5a:72:94:60:91:26:46:ec:ca
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN
Chains
May 10, 2024
PE Signature issue
Digest
82:30:2c:4e:45:30:33:3f:8b:87:fb:da:23:28:5e:7c:eb:db:2b:83
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN
Chains
May 10, 2024
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:4b:e9:09:7d:bb:16:64
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN
Serial Number
51:60:4c:75:69:48:9b:d4
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 22, 2019 - Feb 4, 2023
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:4b:e9:09:7d:bb:16:64
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN
Serial Number
51:60:4c:75:69:48:9b:d4
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 22, 2019 - Feb 4, 2023
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
579826
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
728KB
Virtual Size
724KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
152KB
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
92KB
Virtual Size
252KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.!rc!
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
26.4MB
Virtual Size
26.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.enigma1
Size
340KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.enigma2
Size
284KB
Virtual Size
284KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
Cache/DAT/install.pg
- IMPHASH 39550e91dd36a97b4bddde0e00205002
- SHA256 8ee75390071e225b0ac4d2beff03053e962a26ac35c362b9527d2b8cf33912a3
- MD5 9a2c69af85c5c1180713535c0fe7f03a
- SHA1 e96c90e140a66043d20140434f56d6acc109093a
- SHA512 275f3f561b7c1c27cd2a711b017893d687358872620f51644de57331cb48ac63d0637fe0af637530a3472219f6478635d14e53bfb1333de6b5860c3523746356
- SSDEEP 6144:OQot+FyduxQrb3EnxsPiE1XmOs9swpytSFlXWpqYmdH8g:Odt+FpQrb3EniPiE1XmOsHpyEKk
- MD5 SHA1 SHA512 SSDEEP
-
Detect Blackmoon payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
273728
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcpynA
CreateWaitableTimerA
SetWaitableTimer
LocalSize
RtlMoveMemory
ExpandEnvironmentStringsW
MultiByteToWideChar
lstrcmpiA
IsBadReadPtr
GetCurrentProcessId
GetEnvironmentVariableA
SetEnvironmentVariableA
TlsAlloc
TlsGetValue
TlsSetValue
Module32First
Module32Next
GetCurrentThreadId
GlobalAlloc
GlobalFree
GetLocaleInfoA
GetDateFormatA
GetTimeFormatA
GetProcessTimes
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLogicalDriveStringsA
GetDiskFreeSpaceExA
GlobalMemoryStatusEx
GetModuleHandleA
CreateFileW
GetFileTime
GetFileAttributesW
QueryPerformanceFrequency
QueryPerformanceCounter
CreateDirectoryA
MoveFileA
lstrlenW
GetTempPathW
GetTickCount
GetProcessHeap
Process32Next
SetLastError
HeapAlloc
HeapFree
CreateProcessW
WaitForSingleObject
GetLastError
VirtualQuery
ExitProcess
GetCurrentThread
ExitThread
OpenThread
GetThreadTimes
FlushInstructionCache
VirtualProtect
HeapReAlloc
GetModuleFileNameA
FindNextFileA
FindFirstFileA
FindClose
LCMapStringA
GetLocalTime
DeleteFileA
RemoveDirectoryA
ReadFile
GetFileSize
CreateFileA
WriteFile
SetFilePointer
SetEndOfFile
GetUserDefaultLCID
CreateProcessA
GetStartupInfoA
GetCommandLineA
FreeLibrary
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Process32First
IsBadCodePtr
CreateToolhelp32Snapshot
LocalFree
CreateThread
LocalAlloc
WideCharToMultiByte
QueryDosDeviceW
OpenProcess
ReleaseMutex
GetProcAddress
LoadLibraryA
VirtualFree
VirtualAlloc
GlobalUnlock
GlobalSize
GlobalLock
lstrlenA
CloseHandle
VirtualQueryEx
TerminateProcess
GetCurrentProcess
user32
SwitchToThisWindow
OpenClipboard
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
MsgWaitForMultipleObjects
CharLowerA
GetDesktopWindow
EnumChildWindows
GetClassNameA
GetWindowTextLengthW
GetWindowTextW
IsWindowVisible
wvsprintfA
MessageBoxA
GetWindow
GetWindowThreadProcessId
SetClipboardViewer
SetWindowLongA
TranslateMessage
GetMessageA
PeekMessageA
RegisterRawInputDevices
CallWindowProcA
GetRawInputData
GetForegroundWindow
GetWindowTextA
GetLastInputInfo
PostMessageW
ShowScrollBar
CloseWindow
GetSystemMetrics
DispatchMessageA
SetClipboardData
wsprintfA
WaitForInputIdle
CloseDesktop
CreateDesktopW
EmptyClipboard
CloseWindowStation
BlockInput
SendMessageA
MoveWindow
GetWindowRect
SetForegroundWindow
PostMessageA
psapi
GetProcessImageFileNameW
shlwapi
PathFileExistsA
PathFindExtensionA
PathFindFileNameA
advapi32
RegDeleteValueA
RegCreateKeyExA
CloseServiceHandle
DeleteService
OpenServiceA
OpenSCManagerA
CreateProcessWithTokenW
DuplicateTokenEx
OpenProcessToken
CreateProcessAsUserW
LookupAccountSidA
GetUserNameA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
RegEnumValueA
RegDeleteKeyA
RegSetValueExA
oleaut32
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayDestroy
VariantClear
SysAllocString
SafeArrayCreate
VariantCopy
RegisterTypeLi
LHashValOfNameSys
LoadTypeLi
VariantChangeType
VariantInit
VarR8FromCy
VarR8FromBool
SysFreeString
SafeArrayGetElemsize
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayAllocData
SafeArrayAllocDescriptor
shell32
SHGetSpecialFolderPathW
ShellExecuteA
ws2_32
WSACleanup
htons
recvfrom
socket
bind
connect
closesocket
inet_ntoa
ntohs
WSAStartup
getpeername
getsockname
inet_addr
sendto
accept
recv
listen
send
netapi32
NetUserGetInfo
NetUserGetLocalGroups
NetApiBufferFree
NetUserAdd
NetLocalGroupAddMembers
NetUserDel
ole32
CoCreateInstance
CoUninitialize
CLSIDFromProgID
CLSIDFromString
OleRun
CoInitialize
dbghelp
MakeSureDirectoryPathExists
msvcrt
strchr
_CIfmod
_CIpow
??2@YAPAXI@Z
strncmp
??3@YAXPAX@Z
strncpy
strtod
malloc
strstr
free
rand
srand
atoi
sprintf
_ftol
floor
_stricmp
modf
realloc
calloc
strrchr
ServetGetip
UBroadcasts
UBuffAllocMem
UBuffCreate
UBuffDestory
UBuffFreeMem
UByteToTXT
UCRC32
UClose
UCloseAll
UCloseFile
UConnect
UConnectForwar
UCreate
UDestory
UForwarIf
UGetBind
UGetConnectINFO
UGetFileINFO
UGetForwarID
UGetIP
UGetMark1
UGetMark2
UGetOnlinelist
UGetPort
UGetRTT
UGetReceiveSpeed
UGetSendSpeed
UGetUUID
UGetUUIDLink
UGetVersion
UGetVersionLink
UHostNameToIP
UIsConnected
UKillTime
UNAT_PunchTy
UP2PConnect
UP2PConnectForwar
UP2PForwarServerLinkIf
UP2PGetEvents
UP2PGetID
UP2PServerLinkIf
UP2PSetForwarServer
UP2PSetLinkServerAUZ
UP2PSetServer
URecv
USend
USendFile
USend_UDP
USendto
USetCallback
USetFileRecv
USetMark1
USetMark2
USetPant
USetSpeed
USetSpeedLink
UShutDown
USocket
USocket_
UStartTime
UStartTime_
UTimeToTXT
Uinet_addr
Uinet_addr_Memcpy
Uinet_ntoa
data_CALL_������ָ���ָ�
������_ȡ�ı�W
ע����_ȡDWORD_32ֵ
Name
.text
Size
324KB
Virtual Size
321KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=4, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=14, version=7299,
count=2, id=4, version=8047,
count=15, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=274, id=1, productName=Unmarked objects,
count=27, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=100, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, productName=Unmarked objects (old),
count=4, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
Cache/DAT/install.pg.dll
- IMPHASH 39550e91dd36a97b4bddde0e00205002
- SHA256 8ee75390071e225b0ac4d2beff03053e962a26ac35c362b9527d2b8cf33912a3
- MD5 9a2c69af85c5c1180713535c0fe7f03a
- SHA1 e96c90e140a66043d20140434f56d6acc109093a
- SHA512 275f3f561b7c1c27cd2a711b017893d687358872620f51644de57331cb48ac63d0637fe0af637530a3472219f6478635d14e53bfb1333de6b5860c3523746356
- SSDEEP 6144:OQot+FyduxQrb3EnxsPiE1XmOs9swpytSFlXWpqYmdH8g:Odt+FpQrb3EniPiE1XmOsHpyEKk
- MD5 SHA1 SHA512 SSDEEP
-
Detect Blackmoon payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
273728
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcpynA
CreateWaitableTimerA
SetWaitableTimer
LocalSize
RtlMoveMemory
ExpandEnvironmentStringsW
MultiByteToWideChar
lstrcmpiA
IsBadReadPtr
GetCurrentProcessId
GetEnvironmentVariableA
SetEnvironmentVariableA
TlsAlloc
TlsGetValue
TlsSetValue
Module32First
Module32Next
GetCurrentThreadId
GlobalAlloc
GlobalFree
GetLocaleInfoA
GetDateFormatA
GetTimeFormatA
GetProcessTimes
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLogicalDriveStringsA
GetDiskFreeSpaceExA
GlobalMemoryStatusEx
GetModuleHandleA
CreateFileW
GetFileTime
GetFileAttributesW
QueryPerformanceFrequency
QueryPerformanceCounter
CreateDirectoryA
MoveFileA
lstrlenW
GetTempPathW
GetTickCount
GetProcessHeap
Process32Next
SetLastError
HeapAlloc
HeapFree
CreateProcessW
WaitForSingleObject
GetLastError
VirtualQuery
ExitProcess
GetCurrentThread
ExitThread
OpenThread
GetThreadTimes
FlushInstructionCache
VirtualProtect
HeapReAlloc
GetModuleFileNameA
FindNextFileA
FindFirstFileA
FindClose
LCMapStringA
GetLocalTime
DeleteFileA
RemoveDirectoryA
ReadFile
GetFileSize
CreateFileA
WriteFile
SetFilePointer
SetEndOfFile
GetUserDefaultLCID
CreateProcessA
GetStartupInfoA
GetCommandLineA
FreeLibrary
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Process32First
IsBadCodePtr
CreateToolhelp32Snapshot
LocalFree
CreateThread
LocalAlloc
WideCharToMultiByte
QueryDosDeviceW
OpenProcess
ReleaseMutex
GetProcAddress
LoadLibraryA
VirtualFree
VirtualAlloc
GlobalUnlock
GlobalSize
GlobalLock
lstrlenA
CloseHandle
VirtualQueryEx
TerminateProcess
GetCurrentProcess
user32
SwitchToThisWindow
OpenClipboard
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
MsgWaitForMultipleObjects
CharLowerA
GetDesktopWindow
EnumChildWindows
GetClassNameA
GetWindowTextLengthW
GetWindowTextW
IsWindowVisible
wvsprintfA
MessageBoxA
GetWindow
GetWindowThreadProcessId
SetClipboardViewer
SetWindowLongA
TranslateMessage
GetMessageA
PeekMessageA
RegisterRawInputDevices
CallWindowProcA
GetRawInputData
GetForegroundWindow
GetWindowTextA
GetLastInputInfo
PostMessageW
ShowScrollBar
CloseWindow
GetSystemMetrics
DispatchMessageA
SetClipboardData
wsprintfA
WaitForInputIdle
CloseDesktop
CreateDesktopW
EmptyClipboard
CloseWindowStation
BlockInput
SendMessageA
MoveWindow
GetWindowRect
SetForegroundWindow
PostMessageA
psapi
GetProcessImageFileNameW
shlwapi
PathFileExistsA
PathFindExtensionA
PathFindFileNameA
advapi32
RegDeleteValueA
RegCreateKeyExA
CloseServiceHandle
DeleteService
OpenServiceA
OpenSCManagerA
CreateProcessWithTokenW
DuplicateTokenEx
OpenProcessToken
CreateProcessAsUserW
LookupAccountSidA
GetUserNameA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
RegEnumValueA
RegDeleteKeyA
RegSetValueExA
oleaut32
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayDestroy
VariantClear
SysAllocString
SafeArrayCreate
VariantCopy
RegisterTypeLi
LHashValOfNameSys
LoadTypeLi
VariantChangeType
VariantInit
VarR8FromCy
VarR8FromBool
SysFreeString
SafeArrayGetElemsize
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayAllocData
SafeArrayAllocDescriptor
shell32
SHGetSpecialFolderPathW
ShellExecuteA
ws2_32
WSACleanup
htons
recvfrom
socket
bind
connect
closesocket
inet_ntoa
ntohs
WSAStartup
getpeername
getsockname
inet_addr
sendto
accept
recv
listen
send
netapi32
NetUserGetInfo
NetUserGetLocalGroups
NetApiBufferFree
NetUserAdd
NetLocalGroupAddMembers
NetUserDel
ole32
CoCreateInstance
CoUninitialize
CLSIDFromProgID
CLSIDFromString
OleRun
CoInitialize
dbghelp
MakeSureDirectoryPathExists
msvcrt
strchr
_CIfmod
_CIpow
??2@YAPAXI@Z
strncmp
??3@YAXPAX@Z
strncpy
strtod
malloc
strstr
free
rand
srand
atoi
sprintf
_ftol
floor
_stricmp
modf
realloc
calloc
strrchr
ServetGetip
UBroadcasts
UBuffAllocMem
UBuffCreate
UBuffDestory
UBuffFreeMem
UByteToTXT
UCRC32
UClose
UCloseAll
UCloseFile
UConnect
UConnectForwar
UCreate
UDestory
UForwarIf
UGetBind
UGetConnectINFO
UGetFileINFO
UGetForwarID
UGetIP
UGetMark1
UGetMark2
UGetOnlinelist
UGetPort
UGetRTT
UGetReceiveSpeed
UGetSendSpeed
UGetUUID
UGetUUIDLink
UGetVersion
UGetVersionLink
UHostNameToIP
UIsConnected
UKillTime
UNAT_PunchTy
UP2PConnect
UP2PConnectForwar
UP2PForwarServerLinkIf
UP2PGetEvents
UP2PGetID
UP2PServerLinkIf
UP2PSetForwarServer
UP2PSetLinkServerAUZ
UP2PSetServer
URecv
USend
USendFile
USend_UDP
USendto
USetCallback
USetFileRecv
USetMark1
USetMark2
USetPant
USetSpeed
USetSpeedLink
UShutDown
USocket
USocket_
UStartTime
UStartTime_
UTimeToTXT
Uinet_addr
Uinet_addr_Memcpy
Uinet_ntoa
data_CALL_������ָ���ָ�
������_ȡ�ı�W
ע����_ȡDWORD_32ֵ
Name
.text
Size
324KB
Virtual Size
321KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=4, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=14, version=7299,
count=2, id=4, version=8047,
count=15, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=274, id=1, productName=Unmarked objects,
count=27, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=100, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, productName=Unmarked objects (old),
count=4, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
Cache/DAT/警告.txt
- SHA256 0e8f08e479769f19078003fe1f463b850e963d1a7f04c03e2868486c7ffac1cb
- MD5 c96cc9f70f3917bb74fc81c55fc67d2a
- SHA1 875a2d16752f8db79932307f053dce512b588f4f
- SHA512 c67e27d43334664e30fde821b0f043da6690db14244bc961159520b27948cce8511021f54ee382cd7e34fef9caf0114ade2a1438cf5391f2f86b4d51d139c29f
- MD5 SHA1 SHA512
Cache/Quickaccess/Mylist.ini
- SHA256 98cd7887e9dd141277647b8296a32499d48fbdd9b9a7c028e5526987352e2219
- MD5 beb3050a1dd876765158f4cc6afe66f2
- SHA1 2f534d74031aff95edd5f1f110b9e3c997ad5deb
- SHA512 fcd573d9af04c3f95acb7ac233abb55502b1a484888a84df7020c333dfccd68d251add495507a4c1f67599c772ac9ea95e3033d4da8099cd8e479c4157bdc56f
- MD5 SHA1 SHA512
Cache/Quickaccess/Quickaccess.ini
- SHA256 fa4857926f39de48f455b89ef9501f75eb4c286f9bc0e559aa874c8c4ef4f83c
- MD5 9fa11dea7cf14c9ac7d8f9bb9d83b570
- SHA1 0535909549c0f899f70c3fa4cb0b9ec8e8744e66
- SHA512 866c2ba59d95ab47aba15913a938cb51785fc5e63b18e407e1626e679a4fb316f969f8abca9a7f453c0b96ca8ee307f377869633169da0ea9fbeb2f4eb69d9b4
- MD5 SHA1 SHA512
Cache/Winpe/atl.dll
- IMPHASH 9770a95c6b6c769aa3c12b78be296801
- SHA256 cd6e0a2cac3fbb5aa9e09cc3ebcb32a7029d4a0069edc3d4d608c366437a297d
- MD5 923acecf4bd6495d4ef30377d16af0b8
- SHA1 c98cebba24ea2916822baec4048e896ffd139a5b
- SHA512 c29774dfa6abaeb5522732b2b404a4c536e800289da9d2819bc61abd86fe920ee5ff690e1f41e00ee8eaaa7fcd130779bf192573f0d8cb6b492ac11306cdfd39
- SSDEEP 1536:lrbxbzkuiCB+xEkUjVn57t/xTuelU7mSpJ3A7m/8BzCxz/2oS6GO0aWE/TfAcXwn:bbAe+xEemSD3iGx6oS6oaWE/TMyq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
19584
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
atl.pdb
msvcrt
_except_handler4_common
_initterm
_XcptFilter
_callnewh
wcscat_s
realloc
free
_amsg_exit
wcscpy_s
malloc
memcpy
memcmp
memset
kernel32
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
GetProcessHeap
GetACP
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
IsProcessorFeaturePresent
DecodePointer
HeapAlloc
EncodePointer
LoadLibraryExA
WaitForSingleObject
GetCurrentProcess
FormatMessageW
HeapDestroy
GetModuleFileNameW
GetLastError
LoadLibraryExW
GetProcAddress
FreeLibrary
lstrcpyW
RaiseException
GetCurrentThreadId
UnhandledExceptionFilter
HeapFree
CreateFileW
GetFileSize
ReadFile
CloseHandle
FindResourceExW
SizeofResource
SetUnhandledExceptionFilter
TerminateProcess
MultiByteToWideChar
GetSystemInfo
WideCharToMultiByte
VirtualQuery
VirtualAlloc
VirtualProtect
lstrcpynW
lstrcmpiW
GetModuleHandleW
SetLastError
DisableThreadLibraryCalls
QueryPerformanceCounter
FindResourceA
GetCurrentProcessId
FreeResource
GetSystemTimeAsFileTime
GetTickCount
Sleep
ResolveDelayLoadedAPI
DelayLoadFailureHook
GlobalHandle
GlobalFree
lstrcmpW
LockResource
LoadResource
FindResourceW
GlobalUnlock
VirtualFree
GlobalLock
GlobalAlloc
user32
SetCapture
ReleaseCapture
InvalidateRect
InvalidateRgn
GetDlgItem
SendMessageW
GetDesktopWindow
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
CreateAcceleratorTableW
SetWindowLongW
DefWindowProcW
GetWindowLongW
GetClassNameW
GetParent
DialogBoxIndirectParamW
IsWindow
RedrawWindow
EndPaint
FillRect
DialogBoxIndirectParamA
CreateDialogIndirectParamW
CreateDialogIndirectParamA
RegisterWindowMessageW
GetClientRect
CallWindowProcW
DestroyWindow
BeginPaint
CreateWindowExW
GetWindow
SetFocus
GetFocus
IsChild
GetSysColor
UnregisterClassW
ReleaseDC
CharPrevW
GetDC
RegisterClassExW
wsprintfW
LoadCursorW
GetClassInfoExW
RegisterClassExA
wsprintfA
LoadCursorA
GetClassInfoExA
LoadStringW
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
CharNextW
SetWindowPos
gdi32
GetObjectW
DeleteDC
BitBlt
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
DeleteObject
CreateSolidBrush
GetDeviceCaps
CreateDCW
GetStockObject
AtlAdvise
AtlAxAttachControl
AtlAxCreateControl
AtlAxCreateControlEx
AtlAxCreateDialogA
AtlAxCreateDialogW
AtlAxDialogBoxA
AtlAxDialogBoxW
AtlAxGetControl
AtlAxGetHost
AtlAxWinInit
AtlComPtrAssign
AtlComQIPtrAssign
AtlCreateTargetDC
AtlDevModeW2A
AtlFreeMarshalStream
AtlGetObjectSourceInterface
AtlGetVersion
AtlHiMetricToPixel
AtlIPersistPropertyBag_Load
AtlIPersistPropertyBag_Save
AtlIPersistStreamInit_GetSizeMax
AtlIPersistStreamInit_Load
AtlIPersistStreamInit_Save
AtlInternalQueryInterface
AtlMarshalPtrInProc
AtlModuleAddCreateWndData
AtlModuleAddTermFunc
AtlModuleExtractCreateWndData
AtlModuleGetClassObject
AtlModuleInit
AtlModuleLoadTypeLib
AtlModuleRegisterClassObjects
AtlModuleRegisterServer
AtlModuleRegisterTypeLib
AtlModuleRegisterWndClassInfoA
AtlModuleRegisterWndClassInfoW
AtlModuleRevokeClassObjects
AtlModuleTerm
AtlModuleUnRegisterTypeLib
AtlModuleUnregisterServer
AtlModuleUnregisterServerEx
AtlModuleUpdateRegistryFromResourceD
AtlPixelToHiMetric
AtlRegisterClassCategoriesHelper
AtlSetErrorInfo
AtlSetErrorInfo2
AtlUnadvise
AtlUnmarshalPtr
AtlWaitWithMessageLoop
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
188B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=23, id=260, version=26715,
count=4, id=259, version=26715,
count=194, id=1, productName=Unmarked objects,
count=3, id=257, version=26715,
count=4, id=261, version=26715,
count=1, id=256, version=26715,
count=5, id=270, version=26715,
count=1, id=255, version=26715,
count=1, id=258, version=26715,
Cache/Winpe/crtdll.dll
- IMPHASH ac8a18458b5e230a01fe80ee9ebcb2c2
- SHA256 f6f4951f98185ba8ddcdaa43f13b8106b9b667bb7f5ee027dc51b4bca4556adc
- MD5 d17a0d5e0b6f95bb133c6dd761ee78fd
- SHA1 4c324fb8b01033b743a115c242a11e8c827522c4
- SHA512 ce4619c6da49b6f6c098346efdff6bb176cb07ba436591844ade601e2d9f4dae81eec881992f0eb18816402a59f52a117cc37d41288825e371b9d6bf6df56d13
- SSDEEP 3072:10G/tFLKTkoRUcrDFGRheXGoG5ohUfzQn+B+kZ/ALzywU1OoOQob6e8NB18ams:CiFLKTkomcrDqnomoyfPB+kZ/ALzyXyy
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7265
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetDiskFreeSpaceA
GetEnvironmentStrings
GetCommandLineA
LoadLibraryA
GetModuleFileNameA
UnhandledExceptionFilter
ExitProcess
GetLastError
SetConsoleCtrlHandler
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
GetCurrentThread
RtlUnwind
GetFileAttributesA
Sleep
Beep
ResumeThread
CreateThread
ExitThread
CloseHandle
SetConsoleMode
ReadConsoleA
GetConsoleMode
GetCurrentDirectoryA
SetCurrentDirectoryA
SetFileAttributesA
SetEndOfFile
FlushFileBuffers
WriteConsoleA
GetExitCodeProcess
WaitForSingleObject
DuplicateHandle
GetCurrentProcess
HeapReAlloc
FindFirstFileA
FindNextFileA
FindClose
FileTimeToSystemTime
GetFileInformationByHandle
GetFileType
GetLocalTime
SetFileTime
SystemTimeToFileTime
SetStdHandle
ReadConsoleInputA
PeekConsoleInputA
GetNumberOfConsoleInputEvents
GetVersion
GetProcAddress
GetLogicalDrives
GetCurrentProcessId
SetLocalTime
HeapValidate
GetProcessHeap
HeapUnlock
HeapWalk
HeapLock
HeapCompact
GetStringTypeW
MultiByteToWideChar
FreeLibrary
LockFile
UnlockFile
SetFilePointer
CreateDirectoryA
HeapSize
CreateFileA
CreatePipe
SetEnvironmentVariableA
ReadFile
RemoveDirectoryA
SetErrorMode
GetDriveTypeA
CompareStringW
WideCharToMultiByte
LCMapStringW
GetTimeZoneInformation
DeleteFileA
WriteFile
HeapAlloc
HeapFree
MoveFileA
GetSystemTime
GetStdHandle
GetStartupInfoA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateProcessA
GetCPInfo
GetLocaleInfoW
IsValidCodePage
GetOEMCP
GetUserDefaultLCID
RaiseException
??2@YAPAXI@Z
??3@YAXPAX@Z
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_HUGE_dll
_XcptFilter
__GetMainArgs
__argc_dll
__argv_dll
__dllonexit
__doserrno
__fpecode
__isascii
__iscsym
__iscsymf
__mb_cur_max_dll
__pxcptinfoptrs
__threadhandle
__threadid
__toascii
_abnormal_termination
_access
_acmdln_dll
_aexit_rtn_dll
_amsg_exit
_assert
_basemajor_dll
_baseminor_dll
_baseversion_dll
_beep
_beginthread
_c_exit
_cabs
_cexit
_cgets
_chdir
_chdrive
_chgsign
_chmod
_chsize
_clearfp
_close
_commit
_commode_dll
_control87
_controlfp
_copysign
_cprintf
_cpumode_dll
_cputs
_creat
_cscanf
_ctype
_cwait
_daylight_dll
_dup
_dup2
_ecvt
_endthread
_environ_dll
_eof
_errno
_except_handler2
_execl
_execle
_execlp
_execlpe
_execv
_execve
_execvp
_execvpe
_exit
_expand
_fcloseall
_fcvt
_fdopen
_fgetchar
_fgetwchar
_filbuf
_fileinfo_dll
_filelength
_fileno
_findclose
_findfirst
_findnext
_finite
_flsbuf
_flushall
_fmode_dll
_fpclass
_fpieee_flt
_fpreset
_fputchar
_fputwchar
_fsopen
_fstat
_ftime
_ftol
_fullpath
_futime
_gcvt
_get_osfhandle
_getch
_getche
_getcwd
_getdcwd
_getdiskfree
_getdllprocaddr
_getdrive
_getdrives
_getpid
_getsystime
_getw
_global_unwind2
_heapchk
_heapmin
_heapset
_heapwalk
_hypot
_initterm
_iob
_isatty
_isctype
_ismbbalnum
_ismbbalpha
_ismbbgraph
_ismbbkalnum
_ismbbkana
_ismbbkpunct
_ismbblead
_ismbbprint
_ismbbpunct
_ismbbtrail
_ismbcalpha
_ismbcdigit
_ismbchira
_ismbckata
_ismbcl0
_ismbcl1
_ismbcl2
_ismbclegal
_ismbclower
_ismbcprint
_ismbcspace
_ismbcsymbol
_ismbcupper
_ismbslead
_ismbstrail
_isnan
_itoa
_itow
_j0
_j1
_jn
_kbhit
_lfind
_loaddll
_local_unwind2
_locking
_logb
_lrotl
_lrotr
_lsearch
_lseek
_ltoa
_ltow
_makepath
_matherr
_mbbtombc
_mbbtype
_mbccpy
_mbcjistojms
_mbcjmstojis
_mbclen
_mbctohira
_mbctokata
_mbctolower
_mbctombb
_mbctoupper
_mbctype
_mbsbtype
_mbscat
_mbschr
_mbscmp
_mbscpy
_mbscspn
_mbsdec
_mbsdup
_mbsicmp
_mbsinc
_mbslen
_mbslwr
_mbsnbcat
_mbsnbcmp
_mbsnbcnt
_mbsnbcpy
_mbsnbicmp
_mbsnbset
_mbsncat
_mbsnccnt
_mbsncmp
_mbsncpy
_mbsnextc
_mbsnicmp
_mbsninc
_mbsnset
_mbspbrk
_mbsrchr
_mbsrev
_mbsset
_mbsspn
_mbsspnp
_mbsstr
_mbstok
_mbstrlen
_mbsupr
_memccpy
_memicmp
_mkdir
_mktemp
_msize
_nextafter
_onexit
_open
_open_osfhandle
_osmajor_dll
_osminor_dll
_osmode_dll
_osver_dll
_osversion_dll
_pclose
_pctype_dll
_pgmptr_dll
_pipe
_popen
_purecall
_putch
_putenv
_putw
_pwctype_dll
_read
_rmdir
_rmtmp
_rotl
_rotr
_scalb
_searchenv
_seterrormode
_setjmp
_setmode
_setsystime
_sleep
_snprintf
_snwprintf
_sopen
_spawnl
_spawnle
_spawnlp
_spawnlpe
_spawnv
_spawnve
_spawnvp
_spawnvpe
_splitpath
_stat
_statusfp
_strcmpi
_strdate
_strdec
_strdup
_strerror
_stricmp
_stricoll
_strinc
_strlwr
_strncnt
_strnextc
_strnicmp
_strninc
_strnset
_strrev
_strset
_strspnp
_strtime
_strupr
_swab
_sys_errlist
_sys_nerr_dll
_tell
_tempnam
_timezone_dll
_tolower
_toupper
_tzname
_tzset
_ultoa
_ultow
_umask
_ungetch
_unlink
_unloaddll
_utime
_vsnprintf
_vsnwprintf
_wcsdup
_wcsicmp
_wcsicoll
_wcslwr
_wcsnicmp
_wcsnset
_wcsrev
_wcsset
_wcsupr
_winmajor_dll
_winminor_dll
_winver_dll
_write
_wtoi
_wtol
_y0
_y1
_yn
abort
abs
acos
asctime
asin
atan
atan2
atexit
atof
atoi
atol
bsearch
calloc
ceil
clearerr
clock
cos
cosh
ctime
difftime
div
exit
exp
fabs
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fgetwc
floor
fmod
fopen
fprintf
fputc
fputs
fputwc
fread
free
freopen
frexp
fscanf
fseek
fsetpos
ftell
fwprintf
fwrite
fwscanf
getc
getchar
getenv
gets
gmtime
is_wctype
isalnum
isalpha
iscntrl
isdigit
isgraph
isleadbyte
islower
isprint
ispunct
isspace
isupper
iswalnum
iswalpha
iswascii
iswcntrl
iswctype
iswdigit
iswgraph
iswlower
iswprint
iswpunct
iswspace
iswupper
iswxdigit
isxdigit
labs
ldexp
ldiv
localeconv
localtime
log
log10
longjmp
malloc
mblen
mbstowcs
mbtowc
memchr
memcmp
memcpy
memmove
memset
mktime
modf
perror
pow
printf
putc
putchar
puts
qsort
raise
rand
realloc
remove
rename
rewind
scanf
setbuf
setlocale
setvbuf
signal
sin
sinh
sprintf
sqrt
srand
sscanf
strcat
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtod
strtok
strtol
strtoul
strxfrm
swprintf
swscanf
system
tan
tanh
time
tmpfile
tmpnam
tolower
toupper
towlower
towupper
ungetc
ungetwc
vfprintf
vfwprintf
vprintf
vsprintf
vswprintf
vwprintf
wcscat
wcschr
wcscmp
wcscoll
wcscpy
wcscspn
wcsftime
wcslen
wcsncat
wcsncmp
wcsncpy
wcspbrk
wcsrchr
wcsspn
wcsstr
wcstod
wcstok
wcstol
wcstombs
wcstoul
wcsxfrm
wctomb
wprintf
wscanf
Name
.text
Size
116KB
Virtual Size
115KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
22KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Cache/Winpe/help.txt
- SHA256 51512ebea4b4f667bd3f7140df697912d121041805e98d6576cbc76f30515d1a
- MD5 e3f3a47a2438fb40f74af8a6613e4a9c
- SHA1 8ae19d38333d8dd2ac11f407403e28fb2b5c15a1
- SHA512 f278be5f197d645e3842986c4f5f0559dc8e1eaf211508c39f58a8e500ba0f49d1c6734c64450b0f13f291188e4bfc27b5e67eaaacf594bf7e9802cb6492f88c
- MD5 SHA1 SHA512
Cache/ico/main.ico
- SHA256 5ba4c8edc7521e3746f6ee27f05bb2fef09516535d5570aaf5ffca5b7047ef60
- MD5 9c4f3ba4161fb4adfd23262bee2c24c5
- SHA1 cc34891ec380da8371bae0c5cd1b4b7c1fc72ab7
- SHA512 db2c6347d744d5f58e3d1e52a52bbf91731a62e8603ad22c3bff6e1d67b87880f2d520947f9fd9cc6baa89d27d7b35d60ce981d36534475bf4a121b16d16c362
- SSDEEP 48:dVMsssssssbsssssrplfhR91DA5juhlM93GI2PrjaQyz9oOswAVJx4BVdd3zE8za:dVMhi9xQ+GOyxspjE8zIH
- MD5 SHA1 SHA512 SSDEEP
Cache/menu.main
- SHA256 850254face854a50d4cf0a2439043f4e15d73ef5ce284dbd057233d4ad836dd3
- MD5 4c4809d72c2b7004d4793be7cee87860
- SHA1 8a4db03aa7393159c2d4f7da8424ed191c22887e
- SHA512 0931a1faaabb9205d9e2a426483dfc041c390ed66f7575de2ef097e0dc315f8bb577eea85b197ac90587f1ad4566bc0a65e149761a52a01e0c8cf605ba028d4e
- MD5 SHA1 SHA512
Cache/menu.main2
- SHA256 220d252801e347bd31604707c20259db5c5bc4727c4d0061604b9d9f29aacdbe
- MD5 1011f9f5df90025b862701e84b56135e
- SHA1 b68d1d162da88dca8b81874c5e5d55f9f73212da
- SHA512 35a95a8eeca030701851c8b65f44e412e618ae108c4a6217bc689e2a9e97f4149a6b44def87de8ded38dc3118c5a68fc71bac7dc3a08467772cbd048dcdd4a5e
- MD5 SHA1 SHA512
Cache/menu.menu
- SHA256 197d94511add0316167fe010d0f282a121ec52f4929ba182867717c4fc94c937
- MD5 2e822974eb0340b047c9917ea8f37ee2
- SHA1 6640fed616562fda1c7103f62f0b10664939362d
- SHA512 3752fa524a305f73db35438b0add8a328ba22a137d72e2cb87d5ed6453bde283d6ec8f5d994df507dc48647cbc2d758b147a311dbd226683d0aaa9b4dea30944
- MD5 SHA1 SHA512
Cache/menu.regedit
- SHA256 e279296c0dad6bb6e3dcf92f5a82ed2fc499bc5a45ee128643b9da0ea4098ce9
- MD5 d53e1630078cb6c7d0c171123a3dcef8
- SHA1 9f3411f089a70899c5576d47a2d82765adfb5996
- SHA512 5a99b81aef070b655b7a7e2551d20c6190e24e2724781fdc4ba26aa166e45f9ffbac85dd676cf44051d41df9b64ef2024174b6b39a67ed897bcf19b56ff58b49
- MD5 SHA1 SHA512
Cache/plugin/client/WQPlXhOR0.1.dll
- IMPHASH a5677514b3b4e52a8205f1faa2f34f6e
- SHA256 ff3f3e8e26ec871bad9046b0af0e6b94c95be440d04847d8918f35e9a9f25f67
- MD5 9490d768bdc9a9b7f7a1df03415c1d91
- SHA1 e0c201ee09bba23cb93b43104d0d9041867fe1ae
- SHA512 6aa01ddc19dd01495792ee28ff69fa7052bdd2a9d30c7330ed7135db86fe10b80a657abaab3fec0aaa36a564636e53318a7b6df77ae0e634fae79a2a824ba2bd
- SSDEEP 1536:vLnbhovnvpgF/0JSIOEiYtZNTb6IMZP4JjvP03A7OD4MtdUXNWhq:vLnmrJSlBSZFlJrb7OD4MtdUs
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
57769
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LoadLibraryA
RtlMoveMemory
lstrcpynA
GetVersionExA
GetProcAddress
lstrcpyn
GlobalLock
GlobalSize
GlobalUnlock
GlobalFree
GlobalAlloc
MultiByteToWideChar
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
WideCharToMultiByte
GetTickCount
FreeLibrary
CloseHandle
FlushFileBuffers
SetStdHandle
LCMapStringW
GetStringTypeW
GetStringTypeA
InterlockedIncrement
InterlockedDecrement
SetFilePointer
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
VirtualQueryEx
GetCurrentProcess
IsBadCodePtr
CreateThread
SetWaitableTimer
CreateWaitableTimerA
LocalFree
LCMapStringA
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualAlloc
RaiseException
WriteFile
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetLastError
TlsGetValue
SetLastError
GetCommandLineA
GetVersion
TerminateProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
user32
EnumDisplayDevicesW
EnumDisplaySettingsW
GetDesktopWindow
GetWindowRect
MsgWaitForMultipleObjects
OpenWindowStationA
SetProcessWindowStation
GetCursorInfo
GetDC
ReleaseDC
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
keybd_event
SendMessageA
CloseWindowStation
CloseDesktop
GetIconInfo
gdiplus
GdiplusShutdown
gdi32
DeleteDC
CreateDIBSection
GetDeviceCaps
CreateCompatibleDC
GdiFlush
BitBlt
DeleteObject
SelectObject
ole32
CreateStreamOnHGlobal
GetHGlobalFromStream
CLSIDFromString
CoInitialize
CoUninitialize
oleaut32
VariantTimeToSystemTime
data_call_back_entry
service_management
����_ȡ���괦���ھ���
Name
.text
Size
84KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=21, id=14, version=7299,
count=95, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=145, id=1, productName=Unmarked objects,
count=33, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, productName=Unmarked objects (old),
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
Cache/plugin/client/cmd_shell.ini
- SHA256 6f93d2b5e882a32dd658c028cdf3efa6ff8cde6b34a440bea319d45cb2edb82a
- MD5 b36b00976400ca9d8b6471fc24ba9bdc
- SHA1 d88dff8f515ac5a8f4d95963d65fdbeb7af8f694
- SHA512 2f0a2ef5df91aae0eb387d4c39b433ab65f28a4326fa4762e16b133166061e8520c6f2fb31094fc936d851c9ffaa257378c88c952f5d3760ce90ce2fc73c6cdc
- MD5 SHA1 SHA512
Cache/plugin/client/cmd_shell_0.1.dll
- IMPHASH 58357f4aecd39b72dc3f48fab8638c87
- SHA256 153b429bb97078e2b9ece389d9500d18f45941a9ce286c14c22790d6b1496d59
- MD5 44ba7880aaba593d00d12eb8ce70a6b8
- SHA1 89ff6389183109e3919d703d2c2131b7ed9d7820
- SHA512 adb8adc0a932760951d392ecfadbf97699ba79ea7c20b619729f1fdcd0ccf47c76e604508bf28b737dee7e4c424568d7621758c7fc92d320f38952ce8b197db8
- SSDEEP 768:nlokye2WSCDs7VfrPk9/SjrQTfr4pcxCDJnkhB/RKEW4pkm7krGiB9wCtCRtyQuj:loky5WSCDsJfrPTQTfuS7fGmkXiKtd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23817
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentProcess
OpenProcess
LocalAlloc
LocalFree
CloseHandle
CreatePipe
GetStartupInfoA
CreateProcessA
lstrlenW
GetTempPathW
WideCharToMultiByte
CreateThread
IsBadCodePtr
ReadFile
WriteFile
GetExitCodeThread
TerminateThread
TerminateProcess
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
SetCurrentDirectoryA
GetCurrentDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
GetCommandLineA
GetVersion
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
SetFilePointer
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringW
SetStdHandle
FlushFileBuffers
user32
MessageBoxA
wsprintfA
shell32
SHGetSpecialFolderPathW
oleaut32
VariantTimeToSystemTime
data_call_back_entry
service_management
Name
.text
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=14, version=7299,
count=88, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=91, id=1, productName=Unmarked objects,
count=28, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, productName=Unmarked objects (old),
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
Cache/plugin/client/file_mame.ini
- SHA256 c38fc65910e6314f602eb3450c957f4c06317925be795d535ee980a5e185567f
- MD5 5f8e0cf25d85c6e5157fb4e39a7e3d7d
- SHA1 8d223a4190346aded51275e082593f70d76effb0
- SHA512 c3b8c763317bcb27b001c82465dd7fd48d61c4a4fdd2fd5cc3a3724a6f5caeccb331770eb9e72c5168fa91bf8d7666494d67e1e49b4cf8d610a37e2ccbfd6fe9
- MD5 SHA1 SHA512
Cache/plugin/client/file_mame_0.8.dll
- IMPHASH adc297eaaf76336387f01c34f49c4f40
- SHA256 ff8907a6a6c314fd72e8f9d9b1f6a91f6131e2c8fd87c356f241ee2879a95624
- MD5 ce840da317351c0c8d5625468007c9f4
- SHA1 09dc6185b049f164f59801d14fc5e64db5d54512
- SHA512 ac7629df4fd5491af43da3cdcccd758870733aea2cb5ee6b68de0e705ac5704e22d697aee45de511f0e86c2db8ca4e4fad7d671bf5faa34b75c9057f75738316
- SSDEEP 3072:q+9adtk4tnDusk7ggYOzOsaiyY1wtR0dApBA:v9Utk4tnisk9YFsLyY40K
- MD5 SHA1 SHA512 SSDEEP
-
Detect Blackmoon payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
86521
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
FindFirstFileW
FindClose
GetLogicalDriveStringsA
CreateFileA
DeviceIoControl
GetDiskFreeSpaceExA
ExpandEnvironmentStringsW
CreateToolhelp32Snapshot
Process32First
Process32Next
LocalAlloc
LocalFree
CreateFileW
GetFileTime
GetFileAttributesW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLocaleInfoA
GetDateFormatA
GetTimeFormatA
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
FindNextFileA
FindFirstFileA
SetFilePointer
MultiByteToWideChar
GetFileSize
CloseHandle
WriteFile
GetLocalTime
GetCommandLineA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
FlushFileBuffers
SetStdHandle
lstrlenW
CopyFileA
LCMapStringW
IsBadCodePtr
SetUnhandledExceptionFilter
WideCharToMultiByte
GetTempPathW
ReadFile
GetVersion
RtlUnwind
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RaiseException
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
InterlockedDecrement
InterlockedIncrement
GetStringTypeA
GetStringTypeW
user32
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
shell32
SHGetSpecialFolderPathW
shlwapi
PathFindFileNameA
PathFindExtensionA
advapi32
LookupAccountSidA
oleaut32
VariantTimeToSystemTime
SystemTimeToVariantTime
data_call_back_entry
service_management
Name
.text
Size
116KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=24, id=14, version=7299,
count=117, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=117, id=1, productName=Unmarked objects,
count=63, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, productName=Unmarked objects (old),
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
Cache/plugin/client/loadname.txt
- SHA256 24cffb7d6ef475b483fcc3c4bb5db4124526a4cf623499969d9d8da17d4447d0
- MD5 48c123c842a3d7dd8fb0f6cf29536b9b
- SHA1 013cd60ea3c7ed15a2ee70b6cbd81234f6f74976
- SHA512 ba4f0a9b3ceb6931339ae9dec8b77464f7caf1019f20d38ec80d073b33004fcdb9b8ea39bd4b4b01cfb8a06acaa83cc32c3f716c5308b5d18278d88a37c8c338
- MD5 SHA1 SHA512
Cache/plugin/client/remote_screen.ini
- SHA256 94110a7368912f870fbe8572bb07b3bc8d3b79f3dc4106340dfa03ab773109e6
- MD5 dc3ca6240d294e33c07cc49ec16e94f3
- SHA1 39d98d9a9ede52d07c350eb5d0b64affd680e680
- SHA512 6755f1ad2b0f4253c58a4b56a1623088da07a9b1c1bbf19ed1356d9fb3686e3c016559cf0281b8f7b2f6ffd42055433991b0ab44386c736c6c9290fc039bdefb
- MD5 SHA1 SHA512
Cache/plugin/client/serv_server.ini
- SHA256 0273f1bbc69cffb5b929abe2b4b699e54dfac23a2e99f518d37dc7218dfe7135
- MD5 17d74241c4e8a7b7221c86a8a8b89e36
- SHA1 acad20d69ddd95f34fe33ed1587d276eccd32e0b
- SHA512 f550494dd3151805efd1b66472fd5aefdeb456c4b07992b2c4240fc89f4ea609376dae5457ee73bf9b46a01b5fd2ab2f2e121ac73570024c17fbd1ff2d3dd565
- MD5 SHA1 SHA512
Cache/plugin/client/serv_server_0.1.dll
- IMPHASH 025115fac6ad0bf194728641ce9ac390
- SHA256 f376092442716e1da2bcac09289d2bc17c7f88e8f5df14b5e842541e43131337
- MD5 b90853fd000d449712c8a3e91ea2c679
- SHA1 d8fc3b192d4bebad9729a30b278513cb676fc1d5
- SHA512 8074002399f4fe2e3bcd1e9e7f7ed2d4f73856acb83b8a908cfe35f931e4fa0dedfe1909b266e6b472202179ff42714829a7495743c9b0e0bc59880c05421924
- SSDEEP 768:meDJUinO8KIUPy/5vOOuT+L5LcIAJhMv6wYOGwNKPrxGZ3iB9ItIkFTtMFPutqE4:dJUnfIU42OuT+j6HwNKxW9nTMUt
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24873
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
FreeLibrary
GetProcAddress
LoadLibraryA
GetProcessHeap
lstrcatA
GlobalAlloc
lstrcpyn
CloseHandle
LocalFree
LocalAlloc
OpenProcess
LCMapStringA
GetCurrentProcess
FlushFileBuffers
GetCommandLineA
GetVersion
TerminateProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
SetFilePointer
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringW
SetStdHandle
user32
GetMessageA
DispatchMessageA
wsprintfA
MessageBoxA
GetInputState
TranslateMessage
PeekMessageA
advapi32
QueryServiceConfigA
EnumServicesStatusA
ControlService
CloseServiceHandle
DeleteService
OpenServiceA
OpenSCManagerA
QueryServiceConfig2A
oleaut32
VariantTimeToSystemTime
data_call_back_entry
service_management
Name
.text
Size
52KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=14, version=7299,
count=88, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=95, id=1, productName=Unmarked objects,
count=28, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, productName=Unmarked objects (old),
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
Cache/plugin/client/video_screen.ini
- SHA256 cfd45fb2df133e20e2851a70411fc714fa596487602cef220fc9b6403c9a66c9
- MD5 896dcdc936b92025d99e550c1fbcbbfe
- SHA1 7c5eb4f76625b9e6ed0aac8c6202b4de52d5597b
- SHA512 f7b854dc2744f2b1657c4234a5cea26e2f7a3512050cdcad7900132a0d64c1be18ea7eb31d9728ecbce49aa1e5b7932d225b4bf531d7c362cff39d9266e04985
- MD5 SHA1 SHA512
Cache/plugin/client/video_screen_0.5.dll
- IMPHASH fce8bc078b54cc613ed6ccd836af7a62
- SHA256 4efbdd35cae67e4c4d4e9f8487b6cf128e48ec888a815789a3701a1137e1fb1b
- MD5 8376abe832be4f8c37e09861afbb21e3
- SHA1 3b3a40aa6fbb8d70f8c57561bacc3cbac490d0ba
- SHA512 8e8a1435069bf1b98b93b7f815530cf8e98b5dd3367c30d5af8c18b73ea8faa1e0df600d862ebc34988007498c462dac04524b93d780c8149411265fb0637e5d
- SSDEEP 1536:XIrbo+N1JSRYbmJfFtpQv1TDRW9ZOYKWijf3wVRfNO2RMtpQ2GgUZGtr:XIrhNuMQ6eu4iTQfNO2RMtnRUa
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
62169
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualQueryEx
LoadLibraryA
RtlMoveMemory
lstrcpynA
GetVersionExA
GetProcAddress
lstrcpyn
GlobalLock
GlobalSize
GlobalUnlock
GlobalFree
GlobalAlloc
MultiByteToWideChar
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
WideCharToMultiByte
GetTickCount
FreeLibrary
LCMapStringA
SetWaitableTimer
FlushFileBuffers
SetStdHandle
LCMapStringW
GetStringTypeW
GetStringTypeA
InterlockedIncrement
InterlockedDecrement
SetFilePointer
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualAlloc
RaiseException
CreateWaitableTimerA
IsBadCodePtr
CreateThread
CloseHandle
LocalFree
LocalAlloc
OpenProcess
GetCurrentProcess
WriteFile
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetLastError
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
TerminateProcess
GetVersion
GetCommandLineA
user32
MsgWaitForMultipleObjects
PostMessageW
GetDesktopWindow
EnumDisplayDevicesW
EnumDisplaySettingsW
GetWindowRect
GetDC
ShowWindow
SetWindowLongA
GetWindowLongA
SetLayeredWindowAttributes
PeekMessageA
wsprintfA
MessageBoxA
keybd_event
SendMessageA
CloseWindowStation
CloseDesktop
ReleaseDC
GetIconInfo
GetCursorInfo
SetProcessWindowStation
OpenWindowStationA
DispatchMessageA
TranslateMessage
GetMessageA
gdiplus
GdiplusStartup
GdiplusShutdown
gdi32
DeleteDC
CreateDIBSection
GetDeviceCaps
CreateCompatibleDC
GdiFlush
BitBlt
DeleteObject
SelectObject
ole32
CreateStreamOnHGlobal
GetHGlobalFromStream
CLSIDFromString
CoInitialize
CoUninitialize
oleaut32
VariantTimeToSystemTime
data_call_back_entry
service_management
����_ȡ���괦���ھ���
Name
.text
Size
88KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
28KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=21, id=14, version=7299,
count=95, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=152, id=1, productName=Unmarked objects,
count=32, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, productName=Unmarked objects (old),
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
Cache/plugin/server/cmd_shell.dll
- IMPHASH 58357f4aecd39b72dc3f48fab8638c87
- SHA256 a997a77e2e69fbf8fd18fd8f24a0830f7f456bc1f8f03702cbe1f80231155b0a
- MD5 ddb03f5c2461bfa10b12ebb59fadee04
- SHA1 6ff1b4a586e182f8c61e69702f8ceacfa7fd7f3e
- SHA512 9fba6376a079db996ce48ee6d94c7996e67c4246f79975c9bee8d2984fc88e6a98c3462e2fb8d697702f4e7987ad89bd3196d7a5cf16dd8b873b26da436f641c
- SSDEEP 768:gmljfWSCDcZVxrPk9/SjrQTfr4pcxCDJnkhB/RKEW4pkm7krGiB9wCtCRtyQutR8:gmlrWSCDcDxrPTQTfuS7fGmkXiKtkT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23817
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentProcess
OpenProcess
LocalAlloc
LocalFree
CloseHandle
CreatePipe
GetStartupInfoA
CreateProcessA
lstrlenW
GetTempPathW
WideCharToMultiByte
CreateThread
IsBadCodePtr
ReadFile
WriteFile
GetExitCodeThread
TerminateThread
TerminateProcess
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
SetCurrentDirectoryA
GetCurrentDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
GetCommandLineA
GetVersion
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
SetFilePointer
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringW
SetStdHandle
FlushFileBuffers
user32
MessageBoxA
wsprintfA
shell32
SHGetSpecialFolderPathW
oleaut32
VariantTimeToSystemTime
data_call_back_entry
service_management
Name
.text
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=14, version=7299,
count=88, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=91, id=1, productName=Unmarked objects,
count=28, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, productName=Unmarked objects (old),
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
Cache/plugin/server/cmd_shell.ini
- SHA256 6f93d2b5e882a32dd658c028cdf3efa6ff8cde6b34a440bea319d45cb2edb82a
- MD5 b36b00976400ca9d8b6471fc24ba9bdc
- SHA1 d88dff8f515ac5a8f4d95963d65fdbeb7af8f694
- SHA512 2f0a2ef5df91aae0eb387d4c39b433ab65f28a4326fa4762e16b133166061e8520c6f2fb31094fc936d851c9ffaa257378c88c952f5d3760ce90ce2fc73c6cdc
- MD5 SHA1 SHA512
Cache/plugin/server/cmd_shell_0.1.dll
- IMPHASH 8b6bf4c154caa645656c6fe3c78c12c8
- SHA256 abd1a11527d8be1dcd5a615932a0a9c43b1f1e7e478a4247795f57dbadcabde7
- MD5 7f338907ec131ff0d51441497adc8d15
- SHA1 e4c05bcda63692bf3b85e815bac53294aad7f659
- SHA512 a125dd5fae8c260dfed0fc7879a4c41f100d8255c0c7b9a9d10c0f162932ca44b79b353fa6332d1b2c289a43f30861e927e681d66c9f31ffc12deb88ea9deb94
- SSDEEP 12288:IEcwA+mA2pNl4dDHrHQBWUoC+5qg6M5lghTsfa/dI8wc+:IEa+mAMl4dDHrHQBWUoC+5qg6M5lghTr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
317529
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
shlwapi
PathFindExtensionA
PathRemoveFileSpecW
PathFindFileNameW
wvnsprintfW
StrToIntExW
StrTrimW
StrToIntW
PathFindFileNameA
kernel32
RtlZeroMemory
lstrcmpW
GetModuleHandleW
GetCommandLineW
GetModuleFileNameW
GlobalAlloc
GlobalLock
GlobalUnlock
GetModuleHandleA
ExitProcess
HeapReAlloc
IsBadReadPtr
GetModuleFileNameA
GetPrivateProfileStringA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
CloseHandle
FlushFileBuffers
RaiseException
lstrcmpiA
HeapDestroy
LCMapStringW
GetStringTypeW
GetStringTypeA
SetFilePointer
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualAlloc
WriteFile
VirtualFree
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetLastError
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetVersion
GetCommandLineA
HeapCreate
GetAtomNameW
WideCharToMultiByte
MultiByteToWideChar
lstrcatW
lstrcmpiW
lstrcmpA
lstrlenW
lstrlenA
LocalSize
HeapFree
InterlockedDecrement
InterlockedIncrement
RtlMoveMemory
HeapAlloc
GetProcessHeap
SetStdHandle
gdiplus
GdipInvertMatrix
GdipScaleMatrix
GdipShearMatrix
GdipTransformMatrixPoints
GdipMultiplyMatrix
GdipIsMatrixInvertible
GdipIsMatrixIdentity
GdipIsMatrixEqual
GdipGetMatrixElements
GdipSetMatrixElements
GdipCloneMatrix
GdipCreateMatrix3
GdipCreateMatrix2
GdipRotateMatrix
GdipTranslateMatrix
GdipCreateMatrix
GdipCreateSolidFill
GdipBitmapSetResolution
GdipCloneBitmapArea
GdipCreateBitmapFromResource
GdipCreateBitmapFromHICON
GdipSetClipHrgn
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipGetRegionScans
GdipGetRegionScansCount
GdipIsVisibleRegionRect
GdipIsVisibleRegionPoint
GdipIsEqualRegion
GdipIsInfiniteRegion
GdipIsEmptyRegion
GdipGetRegionHRgn
GdipGetRegionData
GdipGetRegionDataSize
GdipGetRegionBounds
GdipTransformRegion
GdipTranslateRegion
GdipCombineRegionPath
GdipCombineRegionRegion
GdipCombineRegionRect
GdipSetEmpty
GdipSetInfinite
GdipCloneRegion
GdipCreateRegionRgnData
GdipCreateRegionPath
GdipCreateRegionHrgn
GdipCreateRegionRect
GdipIsOutlineVisiblePathPoint
GdipIsVisiblePathPoint
GdipWarpPath
GdipWindingModeOutline
GdipWidenPath
GdipFlattenPath
GdipGetPathWorldBounds
GdipTransformPath
GdipAddPathString
GdipAddPathPath
GdipAddPathPolygon
GdipAddPathPie
GdipAddPathEllipse
GdipResetClip
GdipAddPathArcI
GdipAddPathLineI
GdipAddPathRectangle
GdipAddPathClosedCurve2
GdipAddPathClosedCurve
GdipAddPathCurve2
GdipAddPathCurve
GdipAddPathBezier
GdipAddPathArc
GdipAddPathLine
GdipGetPathLastPoint
GdipReversePath
GdipClearPathMarkers
GdipSetPathMarker
GdipClosePathFigures
GdipClosePathFigure
GdipStartPathFigure
GdipGetPathData
GdipGetPointCount
GdipSetPathFillMode
GdipGetPathFillMode
GdipResetPath
GdipClonePath
GdipCreatePath2
GdipCreatePath
GdipGetImageGraphicsContext
GdipCreateFromHWND
GdipGetLineSpacing
GdipGetCellDescent
GdipGetCellAscent
GdipGetEmHeight
GdipIsStyleAvailable
GdipGetFamilyName
GdipGetGenericFontFamilyMonospace
GdipGetGenericFontFamilySerif
GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipCloneFontFamily
GdipGetFontCollectionFamilyList
GdipGetFontCollectionFamilyCount
GdipPrivateAddMemoryFont
GdipPrivateAddFontFile
GdipNewPrivateFontCollection
GdipNewInstalledFontCollection
GdipCreateHICONFromBitmap
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipGetImageThumbnail
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageBounds
GdipGetImageDimension
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToStream
GdipGetImagePixelFormat
GdipGetImageRawFormat
GdipCloneImage
GdipLoadImageFromStream
GdipLoadImageFromFile
GdipEndContainer
GdipBeginContainer2
GdipBeginContainer
GdipRestoreGraphics
GdipSaveGraphics
GdipIsVisibleRect
GdipIsVisiblePoint
GdipIsVisibleClipEmpty
GdipIsClipEmpty
GdipGetVisibleClipBounds
GdipGetClipBounds
GdipGetClip
GdipTranslateClip
GdipVectorTransformMatrixPoints
GdipSetClipRegion
GdipSetClipRect
GdipSetClipPath
GdipSetClipGraphics
GdipDrawImagePointsRect
GdipDrawImagePointRect
GdipDrawImagePoints
GdipDrawImageRect
GdipDrawImageRectRect
GdipDrawImage
GdipDrawDriverString
GdipMeasureCharacterRanges
GdipCreateRegion
GdipMeasureString
GdipDrawString
GdipFillRegion
GdipFillClosedCurve2
GdipFillClosedCurve
GdipFillPath
GdipFillPie
GdipFillEllipse
GdipFillPolygon
GdipGraphicsClear
GdipDrawClosedCurve2
GdipDrawClosedCurve
GdipDrawCurve2
GdipDrawCurve
GdipDrawPath
GdipDrawPolygon
GdipDrawPie
GdipDrawEllipse
GdipDrawRectangle
GdipDrawBezier
GdipDrawArc
GdipDrawLine
GdipDeleteFont
GdipCreateTexture
GdipFillRectangle
GdipDeleteBrush
GdipDisposeImageAttributes
GdipDeleteGraphics
GdipDisposeImage
GdipCreateFont
GdipCreateFontFromLogfontW
GdipDeletePrivateFontCollection
GdipGetNearestColor
GdipTransformPointsI
GdipTransformPoints
GdipGetDpiY
GdipGetDpiX
GdipGetPageScale
GdipSetPageScale
GdipGetPageUnit
GdipSetPageUnit
GdipRotateWorldTransform
GdipScaleWorldTransform
GdipTranslateWorldTransform
GdipResetWorldTransform
GdipDeleteMatrix
GdipGetWorldTransform
GdipSetWorldTransform
GdipGetPixelOffsetMode
GdipSetPixelOffsetMode
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipGetInterpolationMode
GdipSetInterpolationMode
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipReleaseDC
GdipGetDC
GdipFlush
GdipCreateHBITMAPFromBitmap
GdipSetImageAttributesColorMatrix
GdipGetImageAttributesAdjustedPalette
GdipSetImageAttributesWrapMode
GdipSetImageAttributesRemapTable
GdipSetImageAttributesOutputChannelColorProfile
GdipSetImageAttributesOutputChannel
GdipSetImageAttributesColorKeys
GdipSetImageAttributesGamma
GdipSetImageAttributesNoOp
GdipSetImageAttributesThreshold
GdipResetImageAttributes
GdipSetImageAttributesToIdentity
GdipCloneImageAttributes
GdipCreateImageAttributes
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipDeleteRegion
GdipDeletePath
GdiplusStartup
GdipGetFontHeightGivenDPI
GdipGetFontHeight
GdipGetFontUnit
GdipGetFontSize
GdipGetFontStyle
GdipGetFamily
GdipGetLogFontA
GdipGetLogFontW
GdipCreateFromHDC
GdipCloneFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDeleteFontFamily
GdipCreateBitmapFromHBITMAP
user32
ShowWindow
PeekMessageA
GetMessageA
DispatchMessageA
wsprintfA
MessageBoxA
SetMenuDefaultItem
SetMenuItemInfoW
CheckMenuItem
RemoveMenu
MenuItemFromPoint
GetMenuDefaultItem
GetMenuState
GetMenuItemRect
GetMenuStringW
TrackPopupMenu
SetForegroundWindow
CheckMenuRadioItem
GetMenuItemID
GetSubMenu
SetMenuInfo
InsertMenuW
AppendMenuW
GetMenuItemInfoW
GetMenuItemCount
DestroyMenu
GetMenuInfo
LoadMenuW
GetSystemMenu
CreatePopupMenu
CreateMenu
CharLowerW
CharUpperW
LoadStringW
UpdateLayeredWindow
DrawIconEx
LoadImageW
CreateIconFromResourceEx
SystemParametersInfoW
RegisterWindowMessageW
DrawMenuBar
SetMenu
GetMenu
GetSystemMetrics
IsZoomed
IsIconic
SetRect
LoadIconW
PostQuitMessage
DispatchMessageW
TranslateMessage
IsDialogMessageW
TranslateAcceleratorW
TranslateMDISysAccel
IsChild
GetMessageW
EnumPropsExW
RemovePropA
RemovePropW
GetPropA
GetPropW
SetPropA
SetPropW
KillTimer
SetTimer
MessageBoxW
SetWindowTextW
SetParent
MoveWindow
ScreenToClient
UpdateWindow
ValidateRect
InvalidateRect
GetFocus
CopyIcon
PostMessageW
CallWindowProcW
CreateMDIWindowW
DialogBoxParamW
CreateDialogParamW
EndDialog
DialogBoxIndirectParamW
DestroyWindow
SetClassLongW
GetClassLongW
CreateDialogIndirectParamW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
GetIconInfo
SetWindowPos
EnableWindow
IsWindowEnabled
IsWindowVisible
DestroyAcceleratorTable
DestroyIcon
LoadCursorW
ReleaseCapture
SetCapture
ClientToScreen
FillRect
GetSysColor
GetWindowDC
DefWindowProcW
OffsetRect
GetClientRect
GetWindowRect
ReleaseDC
DrawTextA
GetDC
SetFocus
GetNextDlgTabItem
SetCursor
DestroyCursor
SendMessageW
GetWindowLongW
GetParent
GetWindowTextW
GetWindowTextLengthW
GetClassNameW
FindWindowExW
IsWindow
GetAsyncKeyState
SetWindowLongW
GetAncestor
GetDlgItem
TrackMouseEvent
EndPaint
BeginPaint
SetWindowRgn
shell32
DragQueryFileW
Shell_NotifyIconW
DragAcceptFiles
CommandLineToArgvW
DragFinish
gdi32
CreateSolidBrush
DeleteDC
SetTextColor
SelectObject
GetStockObject
SetBkColor
GetDIBits
CreatePatternBrush
CreateEllipticRgn
StretchBlt
SetStretchBltMode
GetStretchBltMode
BitBlt
CreateDIBSection
CreateCompatibleDC
CreateRoundRectRgn
CreateFontIndirectW
GetObjectW
DeleteObject
SetBkMode
crypt32
CryptStringToBinaryW
atl
ord42
comctl32
InitCommonControlsEx
msimg32
AlphaBlend
ole32
CoUninitialize
CoInitialize
CLSIDFromString
GetHGlobalFromStream
StringFromGUID2
CreateStreamOnHGlobal
oleaut32
VariantTimeToSystemTime
data_call_back_entry
service_management
socket_ssf_client
Name
.text
Size
344KB
Virtual Size
341KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=4, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=26, id=14, version=7299,
count=96, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=4, version=9782,
count=532, id=1, productName=Unmarked objects,
count=23, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=50, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, productName=Unmarked objects (old),
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
Cache/plugin/server/file_mame.ini
- SHA256 46a0e2b35b8bd652244ba30fdf6b99d60bdcc20bcafc780a0a8e789791e0e648
- MD5 988c76f5102eaeb3628913621874d9a1
- SHA1 9c158492fdb1868d014f93b8eed27709df262ebd
- SHA512 a4a156e15bfe698416716a4332fe9e2d4552415acf31067d4012e6f627fb87cff34a921591c5df9871f04f5fc6578010d25d491033729aeee2d0d7f731fdc02d
- MD5 SHA1 SHA512
Cache/plugin/server/file_mame_0.9.dll
- IMPHASH a82aa3bf7d3c67a7bd4f2457057102b4
- SHA256 b5b383acad3f26c9b4e011a05af9680ed4764a716605b11bdfa5ae9cbd5afb99
- MD5 e6261599145945d0206778d847b04f1d
- SHA1 cd1155fb3120b23a94467e65fe877cbf43a5e5d3
- SHA512 6d95d9952268912b1b00d6d256d51beb93920eb9ee0fc8084f21f14065b2cf7e1ba118f911c86a0f577ef682140e411b4d856de93f598148873aaa13be7c4651
- SSDEEP 12288:pQJKa+KxM63tmVHGekQonCuWJSYA0jK3NPe3cM5K6XVoItLA5wKNiyZKMqZ9kbHw:pQJt+KxM63tmlGekQtSYA0jK3NPe3h55
- MD5 SHA1 SHA512 SSDEEP
-
Detect Blackmoon payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
566089
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LCMapStringA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
RemoveDirectoryA
DeleteFileA
CreateDirectoryA
FindClose
FindFirstFileA
FindNextFileA
SetCurrentDirectoryA
GetCurrentDirectoryA
WriteFile
GetTickCount
FlushFileBuffers
SetStdHandle
GetFileSize
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
SetFilePointer
VirtualAlloc
RaiseException
VirtualFree
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
TerminateProcess
RtlUnwind
GetVersion
GetCurrentProcess
GetLastError
GetVersionExA
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
ReadFile
GetPrivateProfileStringA
GetModuleFileNameA
IsBadReadPtr
HeapReAlloc
ExitProcess
GetModuleHandleA
lstrcpyn
GlobalUnlock
GlobalLock
TryEnterCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
lstrcmpW
RtlZeroMemory
lstrcmpiA
HeapDestroy
HeapCreate
GetAtomNameW
GetModuleFileNameW
GetCommandLineW
GetModuleHandleW
InitializeCriticalSection
lstrcatW
lstrcmpiW
lstrcmpA
lstrlenA
LocalSize
CreateFileW
FlushViewOfFile
MapViewOfFileEx
SetEndOfFile
SetFilePointerEx
MapViewOfFile
WideCharToMultiByte
lstrlenW
LocalAlloc
MultiByteToWideChar
GlobalAlloc
CreateFileA
CreateFileMappingA
UnmapViewOfFile
GetFileSizeEx
GlobalFree
CloseHandle
HeapFree
InterlockedDecrement
InterlockedIncrement
RtlMoveMemory
HeapAlloc
IsBadCodePtr
GetProcessHeap
user32
SendMessageW
DestroyIcon
DestroyCursor
GetIconInfo
MsgWaitForMultipleObjects
SetWindowRgn
BeginPaint
EndPaint
TrackMouseEvent
GetDlgItem
CreateDialogIndirectParamA
SendMessageA
SetWindowTextA
SetWindowLongA
GetWindowLongA
GetWindowTextLengthA
GetWindowTextA
GetCursorPos
PeekMessageA
GetMessageA
DispatchMessageA
wsprintfA
MessageBoxA
CharLowerW
CharUpperW
LoadStringW
UpdateLayeredWindow
SystemParametersInfoW
RegisterWindowMessageW
GetAncestor
SetWindowLongW
GetAsyncKeyState
IsWindow
FindWindowExW
GetClassNameW
GetWindowTextLengthW
GetWindowTextW
GetParent
GetWindowLongW
SetCursor
GetClientRect
SetCapture
ReleaseCapture
LoadCursorW
DestroyAcceleratorTable
GetSysColor
IsWindowVisible
IsWindowEnabled
EnableWindow
SetWindowPos
GetWindowRect
GetNextDlgTabItem
SetFocus
GetDC
DrawTextA
ReleaseDC
OffsetRect
DefWindowProcW
GetWindowDC
FillRect
ClientToScreen
CreateIconFromResourceEx
LoadImageW
LoadIconW
CopyIcon
DrawIconEx
SetRect
CreateMenu
CreatePopupMenu
GetSystemMenu
LoadMenuW
GetMenuInfo
DestroyMenu
GetMenuItemCount
GetMenuItemInfoW
AppendMenuW
InsertMenuW
SetMenu
DrawMenuBar
SetMenuInfo
GetSubMenu
GetMenuItemID
GetMenu
CheckMenuRadioItem
SetForegroundWindow
TrackPopupMenu
GetMenuStringW
GetMenuItemRect
GetMenuState
GetMenuDefaultItem
MenuItemFromPoint
RemoveMenu
CheckMenuItem
SetMenuItemInfoW
SetMenuDefaultItem
GetFocus
GetMessageW
IsChild
TranslateMDISysAccel
TranslateAcceleratorW
IsDialogMessageW
TranslateMessage
DispatchMessageW
PostQuitMessage
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CreateDialogIndirectParamW
GetClassLongW
SetClassLongW
DestroyWindow
DialogBoxIndirectParamW
EndDialog
CreateDialogParamW
DialogBoxParamW
CreateMDIWindowW
CallWindowProcW
ShowWindow
PostMessageW
ScreenToClient
InvalidateRect
ValidateRect
UpdateWindow
MoveWindow
SetParent
SetWindowTextW
MessageBoxW
SetTimer
KillTimer
SetPropW
SetPropA
GetPropW
GetPropA
RemovePropW
RemovePropA
EnumPropsExW
IsIconic
IsZoomed
GetSystemMetrics
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfo
DragQueryFileW
DragFinish
Shell_NotifyIconW
CommandLineToArgvW
DragAcceptFiles
SHGetSpecialFolderPathA
ole32
CoTaskMemFree
CreateStreamOnHGlobal
GetHGlobalFromStream
StringFromGUID2
CoUninitialize
CoInitialize
CLSIDFromString
shlwapi
StrFormatByteSizeA
PathFileExistsA
StrToIntExW
wvnsprintfW
StrToIntW
StrTrimW
PathFindFileNameW
PathFindFileNameA
PathFindExtensionA
PathRemoveFileSpecW
gdi32
StretchBlt
SetStretchBltMode
GetStretchBltMode
BitBlt
CreateCompatibleBitmap
CreateDIBitmap
CreateFontIndirectW
GetDIBits
CreatePatternBrush
CreateDIBSection
CreateCompatibleDC
GetObjectW
CreateSolidBrush
DeleteObject
CreateRoundRectRgn
CreateEllipticRgn
GetStockObject
SetBkColor
SetBkMode
SetTextColor
DeleteDC
SelectObject
comdlg32
GetOpenFileNameA
gdiplus
GdipSaveGraphics
GdipRestoreGraphics
GdipBeginContainer
GdipBeginContainer2
GdipEndContainer
GdipLoadImageFromFile
GdipLoadImageFromStream
GdipCloneImage
GdipGetImageRawFormat
GdipGetImagePixelFormat
GdipSaveImageToStream
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipGetImageDimension
GdipGetImageBounds
GdipGetImageWidth
GdipGetImageHeight
GdipGetImageHorizontalResolution
GdipGetImageVerticalResolution
GdipGetImageThumbnail
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipCreateHICONFromBitmap
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromHICON
GdipCreateBitmapFromResource
GdipCloneBitmapArea
GdipBitmapSetResolution
GdipGetImageGraphicsContext
GdipCreateSolidFill
GdipCreateMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipCreateFromHWND
GdipCreatePath
GdipCreatePath2
GdipClonePath
GdipResetPath
GdipGetPathFillMode
GdipGetClipBounds
GdipGetPointCount
GdipGetPathData
GdipStartPathFigure
GdipClosePathFigure
GdipClosePathFigures
GdipSetPixelOffsetMode
GdipClearPathMarkers
GdipReversePath
GdipGetPathLastPoint
GdipAddPathLine
GdipAddPathArc
GdipAddPathBezier
GdipAddPathCurve
GdipAddPathCurve2
GdipAddPathClosedCurve
GdipAddPathClosedCurve2
GdipAddPathRectangle
GdipAddPathLineI
GdipAddPathArcI
GdipAddPathEllipse
GdipAddPathPie
GdipAddPathPolygon
GdipAddPathPath
GdipAddPathString
GdipTransformPath
GdipGetPathWorldBounds
GdipFlattenPath
GdipWidenPath
GdipWindingModeOutline
GdipWarpPath
GdipIsVisiblePathPoint
GdipIsOutlineVisiblePathPoint
GdipCreateRegionRect
GdipCreateRegionHrgn
GdipCreateRegionPath
GdipCreateRegionRgnData
GdipCloneRegion
GdipSetInfinite
GdipSetEmpty
GdipCombineRegionRect
GdipCombineRegionRegion
GdipCombineRegionPath
GdipTranslateRegion
GdipTransformRegion
GdipGetRegionBounds
GdipGetRegionDataSize
GdipGetRegionData
GdipGetRegionHRgn
GdipIsEmptyRegion
GdipIsInfiniteRegion
GdipIsEqualRegion
GdipIsVisibleRegionPoint
GdipIsVisibleRegionRect
GdipGetRegionScansCount
GdipGetRegionScans
GdipNewInstalledFontCollection
GdipNewPrivateFontCollection
GdipPrivateAddFontFile
GdipPrivateAddMemoryFont
GdipGetFontCollectionFamilyCount
GdipGetFontCollectionFamilyList
GdipCloneFontFamily
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipGetGenericFontFamilySerif
GdipGetGenericFontFamilyMonospace
GdipGetFamilyName
GdipIsStyleAvailable
GdipGetEmHeight
GdipGetCellAscent
GdipGetCellDescent
GdipGetLineSpacing
GdipCreateMatrix2
GdipCreateMatrix3
GdipCloneMatrix
GdipIsVisibleRect
GdipGetMatrixElements
GdipMultiplyMatrix
GdipInvertMatrix
GdipScaleMatrix
GdipShearMatrix
GdipTransformMatrixPoints
GdipVectorTransformMatrixPoints
GdipIsMatrixInvertible
GdipIsMatrixIdentity
GdipIsMatrixEqual
GdipGetClip
GdipTranslateClip
GdipResetClip
GdipSetClipHrgn
GdipSetClipRegion
GdipSetClipRect
GdipSetClipPath
GdipSetClipGraphics
GdipDrawImagePointsRect
GdipDrawImagePointRect
GdipDrawImagePoints
GdipDrawImageRect
GdipDrawImageRectRect
GdipDrawImage
GdipDrawDriverString
GdipMeasureCharacterRanges
GdipCreateRegion
GdipMeasureString
GdipDrawString
GdipFillRegion
GdipFillClosedCurve2
GdipFillClosedCurve
GdipFillPath
GdipFillPie
GdipFillEllipse
GdipFillPolygon
GdipGraphicsClear
GdipDrawClosedCurve2
GdipDrawClosedCurve
GdipDrawCurve2
GdipDrawCurve
GdipDrawPath
GdipDrawPolygon
GdipDrawPie
GdipDrawEllipse
GdipDrawRectangle
GdipDrawBezier
GdipDrawArc
GdipDrawLine
GdipGetNearestColor
GdipTransformPointsI
GdipTransformPoints
GdipGetDpiY
GdipGetDpiX
GdipGetPageScale
GdipSetPageScale
GdipGetPageUnit
GdipSetPageUnit
GdipRotateWorldTransform
GdipScaleWorldTransform
GdipTranslateWorldTransform
GdipResetWorldTransform
GdipDeleteMatrix
GdipGetWorldTransform
GdipSetWorldTransform
GdipGetPixelOffsetMode
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipGetInterpolationMode
GdipSetInterpolationMode
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipReleaseDC
GdipGetDC
GdipFlush
GdipCreateHBITMAPFromBitmap
GdipSetImageAttributesColorMatrix
GdipGetImageAttributesAdjustedPalette
GdipSetImageAttributesWrapMode
GdipSetImageAttributesRemapTable
GdipSetImageAttributesOutputChannelColorProfile
GdipSetImageAttributesOutputChannel
GdipSetImageAttributesColorKeys
GdipSetImageAttributesGamma
GdipSetImageAttributesNoOp
GdipSetImageAttributesThreshold
GdipResetImageAttributes
GdipSetImageAttributesToIdentity
GdipCloneImageAttributes
GdipCreateImageAttributes
GdipGetFontHeightGivenDPI
GdipGetFontHeight
GdipGetFontUnit
GdipGetFontSize
GdipGetFontStyle
GdipGetFamily
GdipGetLogFontA
GdipGetLogFontW
GdipCreateFromHDC
GdipCloneFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDeleteFontFamily
GdipDeletePrivateFontCollection
GdipCreateFontFromLogfontW
GdipCreateFont
GdipDeleteRegion
GdipDeletePath
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipDeleteFont
GdipDisposeImage
GdipDeleteGraphics
GdipDisposeImageAttributes
GdipDeleteBrush
GdipFillRectangle
GdipCreateTexture
GdipIsVisiblePoint
GdipIsVisibleClipEmpty
GdipIsClipEmpty
GdipSetMatrixElements
GdipGetVisibleClipBounds
GdipSetPathFillMode
GdipSetPathMarker
comctl32
ImageList_Copy
ImageList_Duplicate
ImageList_ReplaceIcon
ImageList_Replace
ImageList_Remove
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_GetIcon
ImageList_SetIconSize
ImageList_GetImageCount
ImageList_SetImageCount
ImageList_GetImageInfo
ImageList_Write
ImageList_Draw
ImageList_DrawEx
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_EndDrag
ImageList_AddMasked
ImageList_Add
ImageList_LoadImageW
ImageList_Read
ImageList_Create
InitCommonControlsEx
ImageList_Destroy
ImageList_AddIcon
ImageList_GetIconSize
atl
ord42
crypt32
CryptStringToBinaryW
msimg32
AlphaBlend
oleaut32
SystemTimeToVariantTime
VariantTimeToSystemTime
data_call_back_entry
service_management
socket_ssf_client
Name
.text
Size
592KB
Virtual Size
588KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
52KB
Virtual Size
139KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=6, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=33, id=14, version=7299,
count=139, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=2, id=4, version=9782,
count=29, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=627, id=1, productName=Unmarked objects,
count=90, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, productName=Unmarked objects (old),
count=3, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
Cache/plugin/server/loadname.txt
- SHA256 24cffb7d6ef475b483fcc3c4bb5db4124526a4cf623499969d9d8da17d4447d0
- MD5 48c123c842a3d7dd8fb0f6cf29536b9b
- SHA1 013cd60ea3c7ed15a2ee70b6cbd81234f6f74976
- SHA512 ba4f0a9b3ceb6931339ae9dec8b77464f7caf1019f20d38ec80d073b33004fcdb9b8ea39bd4b4b01cfb8a06acaa83cc32c3f716c5308b5d18278d88a37c8c338
- MD5 SHA1 SHA512
Cache/plugin/server/remote_screen.ini
- SHA256 327d7e3cd87d2d5df2e5b771a6f0211e4f2f7f1af6a7aa41ec481ec36a980169
- MD5 8a184b0973e9cac2779588c6dcd268c3
- SHA1 d2b4819ee31d933c4006f5e89ffd1904121b4bab
- SHA512 d1550c33f4e12195ffa9c6e15312605d9eb291baac6cb7732535b1eb279bc27ecc5782fa76e358f1d27dc055e287c69c9ac5cbcce378433025bb03aa614da509
- MD5 SHA1 SHA512
Cache/plugin/server/remote_screen_3.1.dll
- IMPHASH f5e9b45868e1171b433ae5da4f5762a8
- SHA256 4b78333710e257adf1ddde6e0134c4bb6be549787acb8d55647e55261ff042c3
- MD5 8b260015ac640408a0c4b7bc1d43aeab
- SHA1 3aa160a99f5350690fd5f6e1c9306e60ed65b7f0
- SHA512 9d1491b3d7f604efd2fa27894771a9ae1eee8b1df20f96f2b2707e993604e4c21879ed6f810c43d21e4d4981bd8da30da301ef420c1c195cfbe5e563905a8202
- SSDEEP 12288:K41wA2gc60xeSLjNLEN+ZXupG2YtCRzB9YE/ppREgDeRRFqujtYtlF3e2:K41cgc60xeSLjN4N+ZXupG2YtCRzBWEJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
422585
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
HeapCreate
HeapDestroy
lstrcmpiA
RtlZeroMemory
lstrcmpW
GetModuleHandleW
GetCommandLineW
GetModuleFileNameW
GetModuleHandleA
ExitProcess
HeapReAlloc
IsBadReadPtr
GetModuleFileNameA
GetPrivateProfileStringA
WritePrivateProfileStringA
FreeLibrary
GetProcAddress
LCMapStringA
CloseHandle
FlushFileBuffers
RaiseException
SetStdHandle
LCMapStringW
GetStringTypeW
GetAtomNameW
SetFilePointer
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
WriteFile
VirtualFree
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetLastError
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetVersion
GetCommandLineA
WideCharToMultiByte
GlobalFree
GlobalUnlock
WriteProcessMemory
GlobalLock
GlobalAlloc
VirtualAlloc
lstrcpynA
SetEvent
WaitForSingleObject
MultiByteToWideChar
lstrcatW
lstrcmpiW
lstrcmpA
lstrlenW
lstrlenA
HeapFree
InterlockedDecrement
InterlockedIncrement
LocalSize
HeapAlloc
GetProcessHeap
CreateEventA
LoadLibraryA
GetStringTypeA
RtlMoveMemory
user32
SetMenuItemInfoW
SetMenuDefaultItem
CreateIconFromResourceEx
LoadImageW
DrawIconEx
UpdateLayeredWindow
LoadStringW
CharUpperW
CheckMenuItem
MessageBoxA
wsprintfA
DispatchMessageA
GetMessageA
PeekMessageA
CloseClipboard
GetClipboardData
OpenClipboard
RemoveMenu
MenuItemFromPoint
GetMenuDefaultItem
GetMenuState
GetMenuItemRect
GetMenuStringW
TrackPopupMenu
CheckMenuRadioItem
SetForegroundWindow
GetMenuItemID
GetSubMenu
SetMenuInfo
InsertMenuW
CharLowerW
AppendMenuW
DrawMenuBar
SetMenu
GetMenu
GetSystemMetrics
IsZoomed
IsIconic
GetMenuItemInfoW
LoadIconW
EnumPropsExW
RemovePropA
RemovePropW
GetPropA
GetPropW
SetPropW
KillTimer
SetTimer
MessageBoxW
SetWindowTextW
SetParent
MoveWindow
GetAsyncKeyState
IsWindow
FindWindowExW
GetClassNameW
GetWindowTextLengthW
GetWindowTextW
GetParent
GetWindowLongW
SendMessageW
DestroyCursor
SetCursor
GetClientRect
SetCapture
ReleaseCapture
LoadCursorW
DestroyIcon
DestroyAcceleratorTable
GetSysColor
IsWindowVisible
IsWindowEnabled
EnableWindow
SetWindowPos
GetWindowRect
GetIconInfo
GetDC
ReleaseDC
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CreateDialogIndirectParamW
GetClassLongW
SetClassLongW
DestroyWindow
DialogBoxIndirectParamW
EndDialog
CreateDialogParamW
DialogBoxParamW
CreateMDIWindowW
CallWindowProcW
DefWindowProcW
ShowWindow
PostMessageW
GetMenuItemCount
DestroyMenu
GetMenuInfo
LoadMenuW
GetSystemMenu
CreatePopupMenu
CreateMenu
PostQuitMessage
IsDialogMessageW
TranslateMDISysAccel
IsChild
GetNextDlgTabItem
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
SystemParametersInfoW
GetMessageW
SetRect
RegisterWindowMessageW
CopyIcon
SetFocus
GetFocus
ScreenToClient
InvalidateRect
ValidateRect
GetAncestor
GetDlgItem
TrackMouseEvent
EndPaint
BeginPaint
SetWindowRgn
MsgWaitForMultipleObjects
CallWindowProcA
SetWindowLongA
SetPropA
SetWindowLongW
UpdateWindow
shlwapi
wvnsprintfW
PathFindFileNameW
PathRemoveFileSpecW
StrToIntW
StrTrimW
PathFindExtensionA
PathFindFileNameA
StrToIntExW
shell32
DragAcceptFiles
Shell_NotifyIconW
DragFinish
DragQueryFileW
CommandLineToArgvW
gdi32
CreateCompatibleDC
CreateRoundRectRgn
GetStockObject
CreateSolidBrush
CreatePatternBrush
GetObjectW
BitBlt
SetStretchBltMode
StretchBlt
CreateFontIndirectW
CreateEllipticRgn
GetDIBits
CreateDIBSection
GdiFlush
SetBkColor
DeleteDC
GetStretchBltMode
DeleteObject
SelectObject
gdiplus
GdipGetClipBoundsI
GdipGetVisibleClipBounds
GdipGetVisibleClipBoundsI
GdipIsClipEmpty
GdipIsVisibleClipEmpty
GdipIsVisiblePoint
GdipIsVisiblePointI
GdipIsVisibleRect
GdipIsVisibleRectI
GdipSetWorldTransform
GdipGetWorldTransform
GdipDeleteMatrix
GdipSetPageUnit
GdipGetPageUnit
GdipSetPageScale
GdipGetPageScale
GdipGetDpiX
GdipGetDpiY
GdipTransformPoints
GdipTransformPointsI
GdipGetNearestColor
GdipSetPenWidth
GdipSetPenColor
GdipGetBrushType
GdipSetTextRenderingHint
GdipGetTextRenderingHint
GdipSetInterpolationMode
GdipGetInterpolationMode
GdipSetPixelOffsetMode
GdipGetPixelOffsetMode
GdiplusStartup
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateImageAttributes
GdipCloneImageAttributes
GdipSetImageAttributesToIdentity
GdipResetImageAttributes
GdipSetImageAttributesThreshold
GdipSetImageAttributesNoOp
GdipSetImageAttributesGamma
GdipSetImageAttributesColorKeys
GdipSetImageAttributesOutputChannel
GdipSetImageAttributesOutputChannelColorProfile
GdipSetImageAttributesRemapTable
GdipSetImageAttributesWrapMode
GdipGetImageAttributesAdjustedPalette
GdipSetImageAttributesColorMatrix
GdipCreateHBITMAPFromBitmap
GdipCreateFromHDC
GdipGetDC
GdipReleaseDC
GdipGraphicsClear
GdipCreateRegion
GdipMeasureCharacterRanges
GdipSetClipHrgn
GdipSaveGraphics
GdipRestoreGraphics
GdipBeginContainer
GdipBeginContainer2
GdipEndContainer
GdipLoadImageFromFile
GdipLoadImageFromStream
GdipCloneImage
GdipGetImageRawFormat
GdipGetImagePixelFormat
GdipSaveImageToStream
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipGetImageDimension
GdipGetClipBounds
GdipGetImageWidth
GdipGetImageHeight
GdipGetImageHorizontalResolution
GdipGetImageVerticalResolution
GdipGetImageThumbnail
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipCreateHICONFromBitmap
GdipCreateFromHWND
GdipGetImageGraphicsContext
GdipCreateFont
GdipCreateFontFromLogfontW
GdipDeletePrivateFontCollection
GdipDeleteFontFamily
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipCloneFont
GdipGetLogFontW
GdipGetLogFontA
GdipGetFamily
GdipGetFontStyle
GdipGetFontSize
GdipGetFontUnit
GdipGetFontHeight
GdipGetFontHeightGivenDPI
GdipCreatePath
GdipCreatePath2
GdipClonePath
GdipResetPath
GdipGetPathFillMode
GdipSetPathFillMode
GdipGetPointCount
GdipGetPathData
GdipStartPathFigure
GdipClosePathFigure
GdipClosePathFigures
GdipSetPathMarker
GdipClearPathMarkers
GdipReversePath
GdipGetPathLastPoint
GdipAddPathLine
GdipAddPathArc
GdipAddPathBezier
GdipAddPathCurve
GdipAddPathCurve2
GdipAddPathClosedCurve
GdipAddPathClosedCurve2
GdipAddPathRectangle
GdipAddPathLineI
GdipAddPathArcI
GdipAddPathEllipse
GdipAddPathPie
GdipAddPathPolygon
GdipAddPathPath
GdipAddPathString
GdipTransformPath
GdipGetPathWorldBounds
GdipGetClip
GdipWidenPath
GdipWindingModeOutline
GdipWarpPath
GdipIsVisiblePathPoint
GdipIsOutlineVisiblePathPoint
GdipCreateRegionRect
GdipCreateRegionHrgn
GdipCreateRegionPath
GdipCreateRegionRgnData
GdipCloneRegion
GdipSetInfinite
GdipSetEmpty
GdipCombineRegionRect
GdipCombineRegionRegion
GdipCombineRegionPath
GdipTranslateRegion
GdipTransformRegion
GdipGetRegionBounds
GdipGetRegionDataSize
GdipGetRegionData
GdipGetRegionHRgn
GdipIsEmptyRegion
GdipIsInfiniteRegion
GdipIsEqualRegion
GdipIsVisibleRegionPoint
GdipIsVisibleRegionRect
GdipGetRegionScansCount
GdipGetRegionScans
GdipCreatePen1
GdipCreatePen2
GdipClonePen
GdipGetPenWidth
GdipGetPenUnit
GdipSetPenUnit
GdipSetPenLineCap197819
GdipSetPenStartCap
GdipSetPenEndCap
GdipSetPenDashCap197819
GdipGetPenStartCap
GdipGetPenEndCap
GdipGetPenDashCap197819
GdipSetPenLineJoin
GdipGetPenLineJoin
GdipSetPenCustomStartCap
GdipGetPenCustomStartCap
GdipSetPenCustomEndCap
GdipGetPenCustomEndCap
GdipSetPenMiterLimit
GdipGetPenMiterLimit
GdipSetPenMode
GdipGetPenMode
GdipSetPenTransform
GdipGetPenTransform
GdipResetPenTransform
GdipMultiplyPenTransform
GdipRotatePenTransform
GdipTranslatePenTransform
GdipScalePenTransform
GdipGetPenColor
GdipSetPenBrushFill
GdipGetPenBrushFill
GdipGetPenFillType
GdipSetPenDashStyle
GdipGetPenDashStyle
GdipGetPenDashOffset
GdipSetPenDashOffset
GdipGetPenDashCount
GdipGetPenDashArray
GdipSetPenDashArray
GdipSetPenCompoundArray
GdipGetPenCompoundCount
GdipGetPenCompoundArray
GdipCloneBrush
GdipCreateSolidFill
GdipSetSolidFillColor
GdipGetSolidFillColor
GdipCreateStringFormat
GdipStringFormatGetGenericDefault
GdipStringFormatGetGenericTypographic
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipGetStringFormatFlags
GdipSetStringFormatAlign
GdipGetStringFormatAlign
GdipSetStringFormatLineAlign
GdipGetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipGetStringFormatTrimming
GdipSetStringFormatHotkeyPrefix
GdipGetStringFormatHotkeyPrefix
GdipSetStringFormatTabStops
GdipGetStringFormatTabStopCount
GdipGetStringFormatTabStops
GdipSetStringFormatDigitSubstitution
GdipGetStringFormatDigitSubstitution
GdipSetStringFormatMeasurableCharacterRanges
GdipGetStringFormatMeasurableCharacterRangeCount
GdipCreateMatrix
GdipCreateMatrix2
GdipCreateMatrix3
GdipCloneMatrix
GdipSetMatrixElements
GdipGetMatrixElements
GdipMultiplyMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipInvertMatrix
GdipScaleMatrix
GdipShearMatrix
GdipTransformMatrixPoints
GdipVectorTransformMatrixPoints
GdipIsMatrixInvertible
GdipIsMatrixIdentity
GdipIsMatrixEqual
GdipCreateHatchBrush
GdipGetHatchStyle
GdipGetHatchForegroundColor
GdipGetHatchBackgroundColor
GdipCreateTexture2
GdipGetTextureTransform
GdipSetTextureTransform
GdipResetTextureTransform
GdipMultiplyTextureTransform
GdipTranslateTextureTransform
GdipScaleTextureTransform
GdipRotateTextureTransform
GdipGetTextureWrapMode
GdipSetTextureWrapMode
GdipGetTextureImage
GdipCreateLineBrush
GdipCreateLineBrushFromRect
GdipCreateLineBrushFromRectWithAngle
GdipGetLineColors
GdipSetLineColors
GdipGetLineRect
GdipSetLineGammaCorrection
GdipGetLineGammaCorrection
GdipSetLineBlend
GdipGetLineBlendCount
GdipGetLineBlend
GdipSetLinePresetBlend
GdipGetLinePresetBlendCount
GdipGetLinePresetBlend
GdipSetLineSigmaBlend
GdipSetLineLinearBlend
GdipGetLineWrapMode
GdipSetLineWrapMode
GdipGetLineTransform
GdipSetLineTransform
GdipResetLineTransform
GdipMultiplyLineTransform
GdipTranslateLineTransform
GdipScaleLineTransform
GdipRotateLineTransform
GdipCreatePathGradient
GdipCreatePathGradientFromPath
GdipGetPathGradientCenterColor
GdipSetPathGradientCenterColor
GdipGetPathGradientPointCount
GdipGetPathGradientSurroundColorCount
GdipGetPathGradientSurroundColorsWithCount
GdipSetPathGradientSurroundColorsWithCount
GdipGetPathGradientPath
GdipSetPathGradientPath
GdipGetPathGradientCenterPoint
GdipSetPathGradientCenterPoint
GdipGetPathGradientRect
GdipSetPathGradientGammaCorrection
GdipGetPathGradientGammaCorrection
GdipGetPathGradientBlendCount
GdipSetPathGradientBlend
GdipGetPathGradientBlend
GdipGetPathGradientPresetBlendCount
GdipSetPathGradientPresetBlend
GdipGetPathGradientPresetBlend
GdipSetPathGradientSigmaBlend
GdipSetPathGradientLinearBlend
GdipGetPathGradientFocusScales
GdipSetPathGradientFocusScales
GdipGetPathGradientWrapMode
GdipSetPathGradientWrapMode
GdipGetPathGradientTransform
GdipSetPathGradientTransform
GdipResetPathGradientTransform
GdipMultiplyPathGradientTransform
GdipTranslatePathGradientTransform
GdipScalePathGradientTransform
GdipRotatePathGradientTransform
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromHICON
GdipCreateBitmapFromResource
GdipCloneBitmapArea
GdipBitmapSetResolution
GdipNewInstalledFontCollection
GdipNewPrivateFontCollection
GdipPrivateAddFontFile
GdipPrivateAddMemoryFont
GdipGetFontCollectionFamilyCount
GdipGetFontCollectionFamilyList
GdipCloneFontFamily
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipGetGenericFontFamilySerif
GdipGetGenericFontFamilyMonospace
GdipGetFamilyName
GdipIsStyleAvailable
GdipGetEmHeight
GdipGetCellAscent
GdipGetCellDescent
GdipGetLineSpacing
GdipTranslateClipI
GdipTranslateClip
GdipResetClip
GdipSetClipRegion
GdipSetClipRectI
GdipSetClipRect
GdipSetClipPath
GdipSetClipGraphics
GdipDrawImagePointsRectI
GdipDrawImagePointsRect
GdipDrawImagePointRectI
GdipDrawImagePointRect
GdipDrawImagePointsI
GdipDrawImagePoints
GdipDrawImageRectI
GdipDrawImageRect
GdipDrawImageRectRectI
GdipDrawImageRectRect
GdipDrawImageI
GdipDrawImage
GdipDrawDriverString
GdipMeasureString
GdipDrawString
GdipFillRegion
GdipFillClosedCurve2I
GdipFillClosedCurve2
GdipFillClosedCurveI
GdipFillClosedCurve
GdipFillPieI
GdipFillPie
GdipFillEllipse
GdipFillPolygonI
GdipFillPolygon
GdipFillPath
GdipFillRectangleI
GdipDrawClosedCurve2I
GdipDrawClosedCurveI
GdipDrawClosedCurve2
GdipDrawClosedCurve
GdipDrawCurve2I
GdipDrawCurveI
GdipDrawCurve2
GdipDrawCurve
GdipDrawPath
GdipDrawPolygonI
GdipDrawPolygon
GdipDrawPieI
GdipDrawPie
GdipDrawEllipseI
GdipDrawEllipse
GdipSetSmoothingMode
GdipGetSmoothingMode
GdipDrawRectangleI
GdipDrawRectangle
GdipDrawBezierI
GdipDrawBezier
GdipDrawArcI
GdipDrawArc
GdipDrawLineI
GdipDrawLine
GdipRotateWorldTransform
GdipScaleWorldTransform
GdipTranslateWorldTransform
GdipResetWorldTransform
GdipFlush
GdipDeleteStringFormat
GdipDeletePen
GdipDeleteRegion
GdipDeletePath
GdipDeleteFont
GdiplusShutdown
GdipDisposeImage
GdipDeleteGraphics
GdipDisposeImageAttributes
GdipDeleteBrush
GdipFillRectangle
GdipCreateTexture
GdipFlattenPath
GdipGetImageBounds
ole32
CoUninitialize
CoInitialize
CLSIDFromString
GetHGlobalFromStream
StringFromGUID2
CreateStreamOnHGlobal
crypt32
CryptStringToBinaryW
atl
ord42
comctl32
InitCommonControlsEx
msimg32
AlphaBlend
oleaut32
VariantTimeToSystemTime
data_call_back_entry
service_management
socket_ssf_client
Name
.text
Size
448KB
Virtual Size
444KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=4, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=26, id=14, version=7299,
count=96, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=4, version=9782,
count=23, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=714, id=1, productName=Unmarked objects,
count=55, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, productName=Unmarked objects (old),
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
Cache/plugin/server/serv_server.ini
- SHA256 0273f1bbc69cffb5b929abe2b4b699e54dfac23a2e99f518d37dc7218dfe7135
- MD5 17d74241c4e8a7b7221c86a8a8b89e36
- SHA1 acad20d69ddd95f34fe33ed1587d276eccd32e0b
- SHA512 f550494dd3151805efd1b66472fd5aefdeb456c4b07992b2c4240fc89f4ea609376dae5457ee73bf9b46a01b5fd2ab2f2e121ac73570024c17fbd1ff2d3dd565
- MD5 SHA1 SHA512
Cache/plugin/server/serv_server_0.1.dll
- IMPHASH c58db1b36018cb0c005d88e872a0e7e4
- SHA256 df5fdb5581ee38f56cb2370620e39c8aa8431a44b16db193de3ac51e591d1516
- MD5 3ef30dbb03f32978c60272fbb495f4b3
- SHA1 ddf968524b649cb012005b500e69f9acf6b59d1c
- SHA512 2018fcbbbd8eb96ee582c69feaf11772af1f09f385d45a67ca68913c017be18b83163412c3655e79dff444dab953661d71641b51ff0075127d6c584b65216a57
- SSDEEP 12288:mKcmW/X1mLqns8INdFqQl2o6twm+yS3V2s38axY37DnO2RnFtIfniq2kGGR:moW/X1mLqns8INdFqQl2o6twm+yS3Vhs
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
418953
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
shlwapi
PathRemoveFileSpecW
PathFindExtensionA
PathFindFileNameW
wvnsprintfW
StrToIntExW
StrTrimW
StrToIntW
PathFindFileNameA
kernel32
FlushFileBuffers
RaiseException
SetStdHandle
LCMapStringW
GetStringTypeW
GetStringTypeA
SetFilePointer
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
GlobalAlloc
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualAlloc
VirtualFree
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoA
GetFileType
SetHandleCount
GetLastError
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetVersion
GetCommandLineA
LCMapStringA
LoadLibraryA
GetProcAddress
FreeLibrary
WriteFile
GetTickCount
CreateFileA
GetFileSize
ReadFile
CloseHandle
GetPrivateProfileStringA
GetModuleFileNameW
GetCommandLineW
GetModuleHandleW
lstrcmpW
RtlZeroMemory
lstrcmpiA
HeapDestroy
HeapCreate
GetAtomNameW
WideCharToMultiByte
MultiByteToWideChar
lstrcatW
lstrcmpiW
lstrcmpA
lstrlenW
lstrlenA
HeapFree
InterlockedDecrement
InterlockedIncrement
RtlMoveMemory
LocalSize
HeapAlloc
GetProcessHeap
GetModuleFileNameA
IsBadReadPtr
HeapReAlloc
ExitProcess
GetModuleHandleA
GlobalUnlock
GetStdHandle
GlobalLock
user32
GetCursorPos
PeekMessageA
GetMessageA
DispatchMessageA
wsprintfA
MessageBoxA
CharLowerW
CharUpperW
LoadStringW
UpdateLayeredWindow
DrawIconEx
LoadImageW
CreateIconFromResourceEx
SystemParametersInfoW
RegisterWindowMessageW
GetMenu
GetSystemMetrics
IsZoomed
IsIconic
SetRect
LoadIconW
UpdateWindow
PostQuitMessage
GetWindowTextLengthW
GetWindowTextW
GetParent
GetWindowLongW
SendMessageW
DestroyCursor
SetCursor
GetClientRect
SetCapture
ReleaseCapture
LoadCursorW
DestroyIcon
DestroyAcceleratorTable
GetSysColor
IsWindowVisible
IsWindowEnabled
EnableWindow
SetWindowPos
GetWindowRect
GetIconInfo
CreateMenu
CreatePopupMenu
GetSystemMenu
LoadMenuW
GetMenuInfo
DestroyMenu
GetMenuItemCount
GetMenuItemInfoW
AppendMenuW
InsertMenuW
SetMenu
DrawMenuBar
SetMenuInfo
GetSubMenu
GetMenuItemID
CheckMenuRadioItem
SetForegroundWindow
TrackPopupMenu
GetMenuStringW
GetMenuItemRect
GetMenuState
GetMenuDefaultItem
MenuItemFromPoint
RemoveMenu
CheckMenuItem
SetMenuItemInfoW
SetMenuDefaultItem
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CreateDialogIndirectParamW
GetClassLongW
SetClassLongW
DestroyWindow
DialogBoxIndirectParamW
EndDialog
CreateDialogParamW
DialogBoxParamW
CreateMDIWindowW
FindWindowExW
IsWindow
GetAsyncKeyState
SetWindowLongW
GetAncestor
GetDlgItem
TrackMouseEvent
EndPaint
BeginPaint
SetWindowRgn
CallWindowProcW
DefWindowProcW
ShowWindow
PostMessageW
CopyIcon
SetFocus
DispatchMessageW
GetFocus
ScreenToClient
InvalidateRect
ValidateRect
MoveWindow
SetParent
SetWindowTextW
MessageBoxW
GetDC
ReleaseDC
SetTimer
KillTimer
SetPropW
SetPropA
GetPropW
GetPropA
RemovePropW
RemovePropA
EnumPropsExW
GetNextDlgTabItem
DrawTextA
OffsetRect
GetWindowDC
FillRect
ClientToScreen
GetMessageW
IsChild
TranslateMDISysAccel
TranslateAcceleratorW
IsDialogMessageW
TranslateMessage
GetClassNameW
shell32
DragAcceptFiles
DragFinish
DragQueryFileW
CommandLineToArgvW
Shell_NotifyIconW
gdi32
CreatePatternBrush
GetStockObject
SetTextColor
SetBkMode
CreateSolidBrush
DeleteDC
DeleteObject
CreateEllipticRgn
GetDIBits
CreateDIBitmap
StretchBlt
SetStretchBltMode
GetStretchBltMode
BitBlt
CreateDIBSection
CreateCompatibleDC
CreateFontIndirectW
GetObjectW
CreateRoundRectRgn
SetBkColor
SelectObject
gdiplus
GdipTranslateClip
GdipGetClip
GdipGetClipBounds
GdipGetVisibleClipBounds
GdipIsClipEmpty
GdipIsVisibleClipEmpty
GdipIsVisiblePoint
GdipIsVisibleRect
GdipSaveGraphics
GdipRestoreGraphics
GdipBeginContainer
GdipBeginContainer2
GdipEndContainer
GdipLoadImageFromFile
GdipLoadImageFromStream
GdipCloneImage
GdipGetImageRawFormat
GdipGetImagePixelFormat
GdipSaveImageToStream
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipGetImageDimension
GdipGetImageBounds
GdipGetImageWidth
GdipGetImageHeight
GdipGetImageHorizontalResolution
GdipGetImageVerticalResolution
GdipGetImageThumbnail
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipCreateHICONFromBitmap
GdipCreateFromHWND
GdipGetImageGraphicsContext
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromHICON
GdipCreateBitmapFromResource
GdipCloneBitmapArea
GdipBitmapSetResolution
GdipCreateSolidFill
GdipCreateMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipCreatePath
GdipCreatePath2
GdipClonePath
GdipResetPath
GdipGetPathFillMode
GdipSetPathFillMode
GdipGetPointCount
GdipGetPathData
GdipStartPathFigure
GdipClosePathFigure
GdipClosePathFigures
GdipResetClip
GdipClearPathMarkers
GdipReversePath
GdipGetPathLastPoint
GdipAddPathLine
GdipAddPathArc
GdipAddPathBezier
GdipAddPathCurve
GdipAddPathCurve2
GdipAddPathClosedCurve
GdipAddPathClosedCurve2
GdipAddPathRectangle
GdipAddPathLineI
GdipAddPathArcI
GdipAddPathEllipse
GdipAddPathPie
GdipAddPathPolygon
GdipAddPathPath
GdipAddPathString
GdipTransformPath
GdipGetPathWorldBounds
GdipFlattenPath
GdipWidenPath
GdipWindingModeOutline
GdipWarpPath
GdipIsVisiblePathPoint
GdipIsOutlineVisiblePathPoint
GdipCreateRegionRect
GdipCreateRegionHrgn
GdipCreateRegionPath
GdipCreateRegionRgnData
GdipCloneRegion
GdipSetInfinite
GdipSetEmpty
GdipCombineRegionRect
GdipCombineRegionRegion
GdipCombineRegionPath
GdipTranslateRegion
GdipTransformRegion
GdipGetRegionBounds
GdipGetRegionDataSize
GdipGetRegionData
GdipGetRegionHRgn
GdipIsEmptyRegion
GdipIsInfiniteRegion
GdipIsEqualRegion
GdipIsVisibleRegionPoint
GdipIsVisibleRegionRect
GdipGetRegionScansCount
GdipGetRegionScans
GdipNewInstalledFontCollection
GdipNewPrivateFontCollection
GdipPrivateAddFontFile
GdipPrivateAddMemoryFont
GdipGetFontCollectionFamilyCount
GdipGetFontCollectionFamilyList
GdipCloneFontFamily
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipGetGenericFontFamilySerif
GdipGetGenericFontFamilyMonospace
GdipGetFamilyName
GdipIsStyleAvailable
GdipGetEmHeight
GdipGetCellAscent
GdipGetCellDescent
GdipGetLineSpacing
GdipCreateMatrix2
GdipCreateMatrix3
GdipCloneMatrix
GdipSetMatrixElements
GdipGetMatrixElements
GdipMultiplyMatrix
GdipInvertMatrix
GdipScaleMatrix
GdipShearMatrix
GdipTransformMatrixPoints
GdipVectorTransformMatrixPoints
GdipIsMatrixInvertible
GdipIsMatrixIdentity
GdipIsMatrixEqual
GdipSetClipHrgn
GdipSetClipRegion
GdipSetClipRect
GdipSetClipPath
GdipSetClipGraphics
GdipDrawImagePointsRect
GdipDrawImagePointRect
GdipDrawImagePoints
GdipDrawImageRect
GdipDrawImageRectRect
GdipDrawImage
GdipDrawDriverString
GdipMeasureCharacterRanges
GdipCreateRegion
GdipMeasureString
GdipDrawString
GdipFillRegion
GdipFillClosedCurve2
GdipFillClosedCurve
GdipFillPath
GdipFillPie
GdipFillEllipse
GdipFillPolygon
GdipGraphicsClear
GdipDrawClosedCurve2
GdipDrawClosedCurve
GdipDrawCurve2
GdipDrawCurve
GdipDrawPath
GdipDrawPolygon
GdipDrawPie
GdipDrawRectangle
GdipDrawBezier
GdipDrawArc
GdipDrawLine
GdipGetNearestColor
GdipTransformPointsI
GdipTransformPoints
GdipGetDpiY
GdipGetDpiX
GdipGetPageScale
GdipSetPageScale
GdipGetPageUnit
GdipSetPageUnit
GdipRotateWorldTransform
GdipScaleWorldTransform
GdipTranslateWorldTransform
GdipResetWorldTransform
GdipDeleteMatrix
GdipGetWorldTransform
GdipSetWorldTransform
GdipGetPixelOffsetMode
GdipSetPixelOffsetMode
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipGetInterpolationMode
GdipSetInterpolationMode
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipReleaseDC
GdipGetDC
GdipFlush
GdipCreateHBITMAPFromBitmap
GdipSetImageAttributesColorMatrix
GdipGetImageAttributesAdjustedPalette
GdipSetImageAttributesWrapMode
GdipSetImageAttributesRemapTable
GdipSetImageAttributesOutputChannelColorProfile
GdipSetImageAttributesOutputChannel
GdipSetImageAttributesColorKeys
GdipSetImageAttributesGamma
GdipSetImageAttributesNoOp
GdipSetImageAttributesThreshold
GdipResetImageAttributes
GdipSetImageAttributesToIdentity
GdipCloneImageAttributes
GdipCreateImageAttributes
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetFontHeightGivenDPI
GdipGetFontHeight
GdipGetFontUnit
GdipGetFontSize
GdipGetFontStyle
GdipGetFamily
GdipGetLogFontA
GdipGetLogFontW
GdipCreateFromHDC
GdipCloneFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDeleteFontFamily
GdipDeletePrivateFontCollection
GdipCreateFontFromLogfontW
GdipCreateFont
GdipDeleteRegion
GdipDeletePath
GdiplusStartup
GdipDeleteFont
GdipDisposeImage
GdipDeleteGraphics
GdipDisposeImageAttributes
GdipDeleteBrush
GdipFillRectangle
GdipCreateTexture
GdipSetPathMarker
GdipDrawEllipse
crypt32
CryptStringToBinaryW
comctl32
ImageList_Add
ImageList_AddMasked
ImageList_Copy
ImageList_Duplicate
ImageList_ReplaceIcon
ImageList_Replace
ImageList_Remove
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_GetIcon
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_SetImageCount
ImageList_GetImageInfo
ImageList_Write
ImageList_Draw
ImageList_DrawEx
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_EndDrag
ImageList_GetImageCount
ImageList_LoadImageW
ImageList_Read
ImageList_Create
InitCommonControlsEx
ImageList_Destroy
ImageList_AddIcon
atl
ord42
msimg32
AlphaBlend
ole32
CoUninitialize
CoInitialize
CLSIDFromString
GetHGlobalFromStream
StringFromGUID2
CreateStreamOnHGlobal
oleaut32
VariantTimeToSystemTime
SystemTimeToVariantTime
data_call_back_entry
service_management
socket_ssf_client
Name
.text
Size
444KB
Virtual Size
440KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
36KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=4, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=26, id=14, version=7299,
count=97, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=4, version=9782,
count=568, id=1, productName=Unmarked objects,
count=23, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=61, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, productName=Unmarked objects (old),
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
Cache/plugin/server/video_screen.ini
- SHA256 1721a0ef24b07fe1c487d9e8e750e170c621593bccdee3ad700e8ace10eebcf8
- MD5 aa94b00cfa93f0d42a78d9a838cd4883
- SHA1 d60d69666ba4d4ab5b4dedb8409d8e049d7624fb
- SHA512 5940db4bac1ce530f020ec696a81980634bcbc3c1c107fccccfef412701547c9eef2dda8eca9407e1b80dab3be84b36eb496e58923202f6826b253bdd35456c4
- MD5 SHA1 SHA512
Cache/plugin/server/video_screen_0.2.dll
- IMPHASH f5e9b45868e1171b433ae5da4f5762a8
- SHA256 2ee5c1f5d9f1867e6b571b3c45b511235eb12203ab517d0b17bf930461d8bc78
- MD5 7f655a33d1c4c4b356eaed85e7206f18
- SHA1 7f77cfae137223fe5a1280268385e5841195c3a1
- SHA512 a8db20969b334b3c3c274e8879a5340541b2a2e99abfea15469d8d130e355e91bf05a64681ea78d55331ae32b09e285ade840b5d5ede6e8f2c58d793a38a9be3
- SSDEEP 12288:L117C3MkAzxVFevEtrx6qZzeqR4VNb7z8F8ZuLO3gDYl985ujtYtl333n:L117GMkAzxVFevEBx6qZzeqR4VNb7z4V
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
422585
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
HeapCreate
HeapDestroy
lstrcmpiA
RtlZeroMemory
lstrcmpW
GetModuleHandleW
GetCommandLineW
GetModuleFileNameW
GetModuleHandleA
ExitProcess
HeapReAlloc
IsBadReadPtr
GetModuleFileNameA
GetPrivateProfileStringA
WritePrivateProfileStringA
FreeLibrary
GetProcAddress
LCMapStringA
CloseHandle
FlushFileBuffers
RaiseException
SetStdHandle
LCMapStringW
GetStringTypeW
GetAtomNameW
SetFilePointer
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
WriteFile
VirtualFree
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetLastError
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetVersion
GetCommandLineA
WideCharToMultiByte
GlobalFree
GlobalUnlock
WriteProcessMemory
GlobalLock
GlobalAlloc
VirtualAlloc
lstrcpynA
SetEvent
WaitForSingleObject
MultiByteToWideChar
lstrcatW
lstrcmpiW
lstrcmpA
lstrlenW
lstrlenA
HeapFree
InterlockedDecrement
InterlockedIncrement
LocalSize
HeapAlloc
GetProcessHeap
CreateEventA
LoadLibraryA
GetStringTypeA
RtlMoveMemory
user32
SetMenuItemInfoW
SetMenuDefaultItem
CreateIconFromResourceEx
LoadImageW
DrawIconEx
UpdateLayeredWindow
LoadStringW
CharUpperW
CheckMenuItem
MessageBoxA
wsprintfA
DispatchMessageA
GetMessageA
PeekMessageA
CloseClipboard
GetClipboardData
OpenClipboard
RemoveMenu
MenuItemFromPoint
GetMenuDefaultItem
GetMenuState
GetMenuItemRect
GetMenuStringW
TrackPopupMenu
CheckMenuRadioItem
SetForegroundWindow
GetMenuItemID
GetSubMenu
SetMenuInfo
InsertMenuW
CharLowerW
AppendMenuW
DrawMenuBar
SetMenu
GetMenu
GetSystemMetrics
IsZoomed
IsIconic
GetMenuItemInfoW
LoadIconW
EnumPropsExW
RemovePropA
RemovePropW
GetPropA
GetPropW
SetPropW
KillTimer
SetTimer
MessageBoxW
SetWindowTextW
SetParent
MoveWindow
GetAsyncKeyState
IsWindow
FindWindowExW
GetClassNameW
GetWindowTextLengthW
GetWindowTextW
GetParent
GetWindowLongW
SendMessageW
DestroyCursor
SetCursor
GetClientRect
SetCapture
ReleaseCapture
LoadCursorW
DestroyIcon
DestroyAcceleratorTable
GetSysColor
IsWindowVisible
IsWindowEnabled
EnableWindow
SetWindowPos
GetWindowRect
GetIconInfo
GetDC
ReleaseDC
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CreateDialogIndirectParamW
GetClassLongW
SetClassLongW
DestroyWindow
DialogBoxIndirectParamW
EndDialog
CreateDialogParamW
DialogBoxParamW
CreateMDIWindowW
CallWindowProcW
DefWindowProcW
ShowWindow
PostMessageW
GetMenuItemCount
DestroyMenu
GetMenuInfo
LoadMenuW
GetSystemMenu
CreatePopupMenu
CreateMenu
PostQuitMessage
IsDialogMessageW
TranslateMDISysAccel
IsChild
GetNextDlgTabItem
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
SystemParametersInfoW
GetMessageW
SetRect
RegisterWindowMessageW
CopyIcon
SetFocus
GetFocus
ScreenToClient
InvalidateRect
ValidateRect
GetAncestor
GetDlgItem
TrackMouseEvent
EndPaint
BeginPaint
SetWindowRgn
MsgWaitForMultipleObjects
CallWindowProcA
SetWindowLongA
SetPropA
SetWindowLongW
UpdateWindow
shlwapi
wvnsprintfW
PathFindFileNameW
PathRemoveFileSpecW
StrToIntW
StrTrimW
PathFindExtensionA
PathFindFileNameA
StrToIntExW
shell32
DragAcceptFiles
Shell_NotifyIconW
DragFinish
DragQueryFileW
CommandLineToArgvW
gdi32
CreateCompatibleDC
CreateRoundRectRgn
GetStockObject
CreateSolidBrush
CreatePatternBrush
GetObjectW
BitBlt
SetStretchBltMode
StretchBlt
CreateFontIndirectW
CreateEllipticRgn
GetDIBits
CreateDIBSection
GdiFlush
SetBkColor
DeleteDC
GetStretchBltMode
DeleteObject
SelectObject
gdiplus
GdipGetClipBoundsI
GdipGetVisibleClipBounds
GdipGetVisibleClipBoundsI
GdipIsClipEmpty
GdipIsVisibleClipEmpty
GdipIsVisiblePoint
GdipIsVisiblePointI
GdipIsVisibleRect
GdipIsVisibleRectI
GdipSetWorldTransform
GdipGetWorldTransform
GdipDeleteMatrix
GdipSetPageUnit
GdipGetPageUnit
GdipSetPageScale
GdipGetPageScale
GdipGetDpiX
GdipGetDpiY
GdipTransformPoints
GdipTransformPointsI
GdipGetNearestColor
GdipSetPenWidth
GdipSetPenColor
GdipGetBrushType
GdipSetTextRenderingHint
GdipGetTextRenderingHint
GdipSetInterpolationMode
GdipGetInterpolationMode
GdipSetPixelOffsetMode
GdipGetPixelOffsetMode
GdiplusStartup
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateImageAttributes
GdipCloneImageAttributes
GdipSetImageAttributesToIdentity
GdipResetImageAttributes
GdipSetImageAttributesThreshold
GdipSetImageAttributesNoOp
GdipSetImageAttributesGamma
GdipSetImageAttributesColorKeys
GdipSetImageAttributesOutputChannel
GdipSetImageAttributesOutputChannelColorProfile
GdipSetImageAttributesRemapTable
GdipSetImageAttributesWrapMode
GdipGetImageAttributesAdjustedPalette
GdipSetImageAttributesColorMatrix
GdipCreateHBITMAPFromBitmap
GdipCreateFromHDC
GdipGetDC
GdipReleaseDC
GdipGraphicsClear
GdipCreateRegion
GdipMeasureCharacterRanges
GdipSetClipHrgn
GdipSaveGraphics
GdipRestoreGraphics
GdipBeginContainer
GdipBeginContainer2
GdipEndContainer
GdipLoadImageFromFile
GdipLoadImageFromStream
GdipCloneImage
GdipGetImageRawFormat
GdipGetImagePixelFormat
GdipSaveImageToStream
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipGetImageDimension
GdipGetClipBounds
GdipGetImageWidth
GdipGetImageHeight
GdipGetImageHorizontalResolution
GdipGetImageVerticalResolution
GdipGetImageThumbnail
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipCreateHICONFromBitmap
GdipCreateFromHWND
GdipGetImageGraphicsContext
GdipCreateFont
GdipCreateFontFromLogfontW
GdipDeletePrivateFontCollection
GdipDeleteFontFamily
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipCloneFont
GdipGetLogFontW
GdipGetLogFontA
GdipGetFamily
GdipGetFontStyle
GdipGetFontSize
GdipGetFontUnit
GdipGetFontHeight
GdipGetFontHeightGivenDPI
GdipCreatePath
GdipCreatePath2
GdipClonePath
GdipResetPath
GdipGetPathFillMode
GdipSetPathFillMode
GdipGetPointCount
GdipGetPathData
GdipStartPathFigure
GdipClosePathFigure
GdipClosePathFigures
GdipSetPathMarker
GdipClearPathMarkers
GdipReversePath
GdipGetPathLastPoint
GdipAddPathLine
GdipAddPathArc
GdipAddPathBezier
GdipAddPathCurve
GdipAddPathCurve2
GdipAddPathClosedCurve
GdipAddPathClosedCurve2
GdipAddPathRectangle
GdipAddPathLineI
GdipAddPathArcI
GdipAddPathEllipse
GdipAddPathPie
GdipAddPathPolygon
GdipAddPathPath
GdipAddPathString
GdipTransformPath
GdipGetPathWorldBounds
GdipGetClip
GdipWidenPath
GdipWindingModeOutline
GdipWarpPath
GdipIsVisiblePathPoint
GdipIsOutlineVisiblePathPoint
GdipCreateRegionRect
GdipCreateRegionHrgn
GdipCreateRegionPath
GdipCreateRegionRgnData
GdipCloneRegion
GdipSetInfinite
GdipSetEmpty
GdipCombineRegionRect
GdipCombineRegionRegion
GdipCombineRegionPath
GdipTranslateRegion
GdipTransformRegion
GdipGetRegionBounds
GdipGetRegionDataSize
GdipGetRegionData
GdipGetRegionHRgn
GdipIsEmptyRegion
GdipIsInfiniteRegion
GdipIsEqualRegion
GdipIsVisibleRegionPoint
GdipIsVisibleRegionRect
GdipGetRegionScansCount
GdipGetRegionScans
GdipCreatePen1
GdipCreatePen2
GdipClonePen
GdipGetPenWidth
GdipGetPenUnit
GdipSetPenUnit
GdipSetPenLineCap197819
GdipSetPenStartCap
GdipSetPenEndCap
GdipSetPenDashCap197819
GdipGetPenStartCap
GdipGetPenEndCap
GdipGetPenDashCap197819
GdipSetPenLineJoin
GdipGetPenLineJoin
GdipSetPenCustomStartCap
GdipGetPenCustomStartCap
GdipSetPenCustomEndCap
GdipGetPenCustomEndCap
GdipSetPenMiterLimit
GdipGetPenMiterLimit
GdipSetPenMode
GdipGetPenMode
GdipSetPenTransform
GdipGetPenTransform
GdipResetPenTransform
GdipMultiplyPenTransform
GdipRotatePenTransform
GdipTranslatePenTransform
GdipScalePenTransform
GdipGetPenColor
GdipSetPenBrushFill
GdipGetPenBrushFill
GdipGetPenFillType
GdipSetPenDashStyle
GdipGetPenDashStyle
GdipGetPenDashOffset
GdipSetPenDashOffset
GdipGetPenDashCount
GdipGetPenDashArray
GdipSetPenDashArray
GdipSetPenCompoundArray
GdipGetPenCompoundCount
GdipGetPenCompoundArray
GdipCloneBrush
GdipCreateSolidFill
GdipSetSolidFillColor
GdipGetSolidFillColor
GdipCreateStringFormat
GdipStringFormatGetGenericDefault
GdipStringFormatGetGenericTypographic
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipGetStringFormatFlags
GdipSetStringFormatAlign
GdipGetStringFormatAlign
GdipSetStringFormatLineAlign
GdipGetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipGetStringFormatTrimming
GdipSetStringFormatHotkeyPrefix
GdipGetStringFormatHotkeyPrefix
GdipSetStringFormatTabStops
GdipGetStringFormatTabStopCount
GdipGetStringFormatTabStops
GdipSetStringFormatDigitSubstitution
GdipGetStringFormatDigitSubstitution
GdipSetStringFormatMeasurableCharacterRanges
GdipGetStringFormatMeasurableCharacterRangeCount
GdipCreateMatrix
GdipCreateMatrix2
GdipCreateMatrix3
GdipCloneMatrix
GdipSetMatrixElements
GdipGetMatrixElements
GdipMultiplyMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipInvertMatrix
GdipScaleMatrix
GdipShearMatrix
GdipTransformMatrixPoints
GdipVectorTransformMatrixPoints
GdipIsMatrixInvertible
GdipIsMatrixIdentity
GdipIsMatrixEqual
GdipCreateHatchBrush
GdipGetHatchStyle
GdipGetHatchForegroundColor
GdipGetHatchBackgroundColor
GdipCreateTexture2
GdipGetTextureTransform
GdipSetTextureTransform
GdipResetTextureTransform
GdipMultiplyTextureTransform
GdipTranslateTextureTransform
GdipScaleTextureTransform
GdipRotateTextureTransform
GdipGetTextureWrapMode
GdipSetTextureWrapMode
GdipGetTextureImage
GdipCreateLineBrush
GdipCreateLineBrushFromRect
GdipCreateLineBrushFromRectWithAngle
GdipGetLineColors
GdipSetLineColors
GdipGetLineRect
GdipSetLineGammaCorrection
GdipGetLineGammaCorrection
GdipSetLineBlend
GdipGetLineBlendCount
GdipGetLineBlend
GdipSetLinePresetBlend
GdipGetLinePresetBlendCount
GdipGetLinePresetBlend
GdipSetLineSigmaBlend
GdipSetLineLinearBlend
GdipGetLineWrapMode
GdipSetLineWrapMode
GdipGetLineTransform
GdipSetLineTransform
GdipResetLineTransform
GdipMultiplyLineTransform
GdipTranslateLineTransform
GdipScaleLineTransform
GdipRotateLineTransform
GdipCreatePathGradient
GdipCreatePathGradientFromPath
GdipGetPathGradientCenterColor
GdipSetPathGradientCenterColor
GdipGetPathGradientPointCount
GdipGetPathGradientSurroundColorCount
GdipGetPathGradientSurroundColorsWithCount
GdipSetPathGradientSurroundColorsWithCount
GdipGetPathGradientPath
GdipSetPathGradientPath
GdipGetPathGradientCenterPoint
GdipSetPathGradientCenterPoint
GdipGetPathGradientRect
GdipSetPathGradientGammaCorrection
GdipGetPathGradientGammaCorrection
GdipGetPathGradientBlendCount
GdipSetPathGradientBlend
GdipGetPathGradientBlend
GdipGetPathGradientPresetBlendCount
GdipSetPathGradientPresetBlend
GdipGetPathGradientPresetBlend
GdipSetPathGradientSigmaBlend
GdipSetPathGradientLinearBlend
GdipGetPathGradientFocusScales
GdipSetPathGradientFocusScales
GdipGetPathGradientWrapMode
GdipSetPathGradientWrapMode
GdipGetPathGradientTransform
GdipSetPathGradientTransform
GdipResetPathGradientTransform
GdipMultiplyPathGradientTransform
GdipTranslatePathGradientTransform
GdipScalePathGradientTransform
GdipRotatePathGradientTransform
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromHICON
GdipCreateBitmapFromResource
GdipCloneBitmapArea
GdipBitmapSetResolution
GdipNewInstalledFontCollection
GdipNewPrivateFontCollection
GdipPrivateAddFontFile
GdipPrivateAddMemoryFont
GdipGetFontCollectionFamilyCount
GdipGetFontCollectionFamilyList
GdipCloneFontFamily
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipGetGenericFontFamilySerif
GdipGetGenericFontFamilyMonospace
GdipGetFamilyName
GdipIsStyleAvailable
GdipGetEmHeight
GdipGetCellAscent
GdipGetCellDescent
GdipGetLineSpacing
GdipTranslateClipI
GdipTranslateClip
GdipResetClip
GdipSetClipRegion
GdipSetClipRectI
GdipSetClipRect
GdipSetClipPath
GdipSetClipGraphics
GdipDrawImagePointsRectI
GdipDrawImagePointsRect
GdipDrawImagePointRectI
GdipDrawImagePointRect
GdipDrawImagePointsI
GdipDrawImagePoints
GdipDrawImageRectI
GdipDrawImageRect
GdipDrawImageRectRectI
GdipDrawImageRectRect
GdipDrawImageI
GdipDrawImage
GdipDrawDriverString
GdipMeasureString
GdipDrawString
GdipFillRegion
GdipFillClosedCurve2I
GdipFillClosedCurve2
GdipFillClosedCurveI
GdipFillClosedCurve
GdipFillPieI
GdipFillPie
GdipFillEllipse
GdipFillPolygonI
GdipFillPolygon
GdipFillPath
GdipFillRectangleI
GdipDrawClosedCurve2I
GdipDrawClosedCurveI
GdipDrawClosedCurve2
GdipDrawClosedCurve
GdipDrawCurve2I
GdipDrawCurveI
GdipDrawCurve2
GdipDrawCurve
GdipDrawPath
GdipDrawPolygonI
GdipDrawPolygon
GdipDrawPieI
GdipDrawPie
GdipDrawEllipseI
GdipDrawEllipse
GdipSetSmoothingMode
GdipGetSmoothingMode
GdipDrawRectangleI
GdipDrawRectangle
GdipDrawBezierI
GdipDrawBezier
GdipDrawArcI
GdipDrawArc
GdipDrawLineI
GdipDrawLine
GdipRotateWorldTransform
GdipScaleWorldTransform
GdipTranslateWorldTransform
GdipResetWorldTransform
GdipFlush
GdipDeleteStringFormat
GdipDeletePen
GdipDeleteRegion
GdipDeletePath
GdipDeleteFont
GdiplusShutdown
GdipDisposeImage
GdipDeleteGraphics
GdipDisposeImageAttributes
GdipDeleteBrush
GdipFillRectangle
GdipCreateTexture
GdipFlattenPath
GdipGetImageBounds
ole32
CoUninitialize
CoInitialize
CLSIDFromString
GetHGlobalFromStream
StringFromGUID2
CreateStreamOnHGlobal
crypt32
CryptStringToBinaryW
atl
ord42
comctl32
InitCommonControlsEx
msimg32
AlphaBlend
oleaut32
VariantTimeToSystemTime
data_call_back_entry
service_management
socket_ssf_client
Name
.text
Size
448KB
Virtual Size
444KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=4, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=26, id=14, version=7299,
count=96, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=4, version=9782,
count=23, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=714, id=1, productName=Unmarked objects,
count=55, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, productName=Unmarked objects (old),
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
Cache/qqwry.dat
- SHA256 ef638f571bb65fda75e60f2bf220e445aad81929f67d701c7148433f1802243b
- MD5 e27608e424bea79d7249678307cb3088
- SHA1 e5b5ad17356b7e840415451b991a94d7501dcc21
- SHA512 c6a6b62205b856c39d20de5c378f4d1a6e59b11bf9147e7cbbf9010a293cef2f0c2bad78680e41ba7bfe79e7419326f5f37dc331742cf2243215de4667bc47fb
- SSDEEP 196608:pE7LX4Sa5zL/syVIOjz7c77fSqgOqSm05kYLUaYOP/fs0a9gbOKW4Lh5WB3:67d8v0yVIqzYXfhplUZysH9DKla3
- MD5 SHA1 SHA512 SSDEEP
Cache/release.bat
- SHA256 39b4954555d5d59ffa59faf0985577f89749fac71d7dfb722c5a9fe068d90f39
- MD5 a0420b144ac24f47a96d2a5497c34890
- SHA1 aa9c4442fed73ab0390566e1ea3fc1e399918eb2
- SHA512 f4721afea99a5a2a93843fc47b4aa0c6f275a8c94bdc81cf23f26f24a3bffa58e3dcc0d0f77c85ef951b3c863ed8639b3e13235f623f0b7e71fe15f04fcf28b8
- MD5 SHA1 SHA512
Cache/rule.txt
- SHA256 3dbb34aa35df0e1bd88f03bda510f9328bdbfda12429b25a242dc6563f2d0ae2
- MD5 04f688da1e9524f1f1c40b41cc9817e4
- SHA1 59533e8f4d2eb5b1d4ee2ad397ce2781687a5b2e
- SHA512 07bebd7ad4dc0877530c5a61f3c1e8be4c30c58145e1a29c8092a3f1a28f578a1a7091fbfcd73153e546a4d35e53ade13dbcd9ec52e0b8e38949d96626924293
- MD5 SHA1 SHA512
Cache/variable/variable.txt
- SHA256 d100c5c2b8c7369a230d8fb31017f7de2c6566ae20f062c4ee4f8878ee35b71d
- MD5 9b53a5afbb50441e2e27f033c7988141
- SHA1 c45a754c39e4c00c1353da100feff8aa98b46731
- SHA512 841c42ebf737f17efca2887b434303b4eccbab09850758515882fb447006ff0d2bbae41e582dc899f5169451fc2fca27c075447985bcc5cd318173df2bf9ddc3
- MD5 SHA1 SHA512
Cache/windows/Advanced Customization/Main.ini
- SHA256 df8296b136232f84a33eabd718c57a7950ae81b396cd9849ab3e8f4d60039921
- MD5 d2f7d4370786bcd9b22f3f6a0b54b533
- SHA1 7f410e97ab2b23b7c062841aa19090df9d01ef9f
- SHA512 1a0586075b2a7e169c8b8914cfd4737ee4556dff00680913ddb590b69f30f012ecf47733be1a09feadb4e4f2995f9e210f7b0b8075d707c063b5286919795f04
- MD5 SHA1 SHA512
Cache/windows/Advanced Customization/主体窗口图标.png
- SHA256 d38bfe5d28f2be82c6b086ad94e6172fac5e95a0c2a05ef0838b5b6190f77f98
- MD5 8c756f460bdf0291d167c2f89aa0a7d7
- SHA1 b703a422b0827da94f2c1f8f718dba6727a8ccac
- SHA512 a570d9f199e1db309c30fed1aa189a497b7aa486c0a5cb7576e8e4355fc3b376f045e333174b1b3e09904aae79c4fd00cab662bd3b93c8dab5be6c0320df326f
- MD5 SHA1 SHA512
Cache/windows/win_main/list.txt
- SHA256 3ec842c97566289bb70bb228c85b11872f9dea092a7321af04e98106c171d846
- MD5 525f5aa8bcf8fa9993dd86db711f9916
- SHA1 48f1f5b9a757663b42f62a24e5f73c73eeec5cdb
- SHA512 53d800ae65ed70b13b88c4942b91038df222f529e82f3c4dcc13a0946a20aee5ea2f8fc7fab61ff3ee567a7810afc10d363f69926d558587cd76714c415322f4
- MD5 SHA1 SHA512
Cache/windows/win_main/safe.txt
- SHA256 d96a8b0394ffd2f60783b8c179640c1ab377ffbed92666c355dbede08414485a
- MD5 e17e1c5072d326d859783d093686acf1
- SHA1 828a9ea0d908b0cf20b65a64ee25029161c7dcc3
- SHA512 b77f38be10d8eee2d882668f4b09a3229edfe8a4b1604336d26046e992cd29a69f3c43d383885b1d3497ba746060df42ddb9a0bb96465c408ba49700f93a5beb
- SSDEEP 192:RnfEQI+g7OWYgMClgo6cfw0BT79EUVSadG:RcbO2uww0BTxIag
- MD5 SHA1 SHA512 SSDEEP
Cache/刺客远程管理.ini
- SHA256 26cd90371e29c5b1c4dee08025e75c5615bd60cbdb5281b3c50606936c3159c5
- MD5 80a281e563fc40faa333bb639b53a40d
- SHA1 35d3dab74f30c893145d3c4dbc7fb138308c9e2f
- SHA512 98ccc367bc0972d0ad47b99b2b5806c400b865c56f9819a0e49f0970cdb4a94100afcbbfb785034132fe578db11a5a0f30737a04de83594d45459d3d6d428960
- MD5 SHA1 SHA512
ebxshouquan.dat
- SHA256 b672865196898fe884c678852e2f86043377767b14f17fe1999e17d9eab389ac
- MD5 4b8c5c187244551b2cda13ab45b8e8ba
- SHA1 8683ed6b6230c2195406cd36348ba4039aacab63
- SHA512 3ed73a71cc43a23ee4f2f75a8ff6b5a19fc4f1acb9b37489c2f6cd83425d9ebf963f60c3365ade13ca13c09800d5bdf31db99cd6f1092c1841e23e602c724987
- MD5 SHA1 SHA512
ico/1.ini
- SHA256 5557960e36a6fff05660f7479d29901a64a4200aa9a227249d30d88412f95bdd
- MD5 a18238f1d77a31fd983691779d7dc282
- SHA1 8d782602f5ad7e61324257d8671b577dcb8f3bb2
- SHA512 1c31226b78e1e04dd4690f71a278b727d67456531e36728e97e885a7a21dc406dbd37f4ad050f0fec52b99064301a62d2db33576ad55ffb3427feec2b2456957
- MD5 SHA1 SHA512
ico/1.localstorage
- SHA256 ba474fd1af9876f6e50ddbbf9259bcb1754fff87d267275867bea253a8f53930
- MD5 dd3d9b251ae0028ca124c1b19fc127d7
- SHA1 22d236f46144cd2ba197a4f2223ba173fb70d286
- SHA512 bf921868ff9d3adc26f65fa647acdbab8d1fe2a79af6e5c4ff01090def46433fa2002d5448b9fa8a4b354e750cdd8f95973de2ffa6cda9261e67538373fdc183
- MD5 SHA1 SHA512
ico/1.md5
- SHA256 0eab08a5281defdb3989cc73ae53de9fd1472735bcd5254c2f26a9ad858e7837
- MD5 2f3112dc05aff0eee167b989bdac5ff5
- SHA1 7135d2ab3d95148dfa6b9a22eff035be0efda6b5
- SHA512 dad4587d9afa5ebff0124251683b2240bb7480afc39025cf52cd665273f2f12092c56c976c7679156b6116411a22aec81844e5624fcf11fc3745235c83e09c6f
- MD5 SHA1 SHA512
ico/1.sys
- SHA256 d61d60ddd04e6b60d7c25c039c60d3f6cf4ceeb8c6cdadc49a0708101391d12f
- MD5 712f45001571a89b4c780584f2fe32d2
- SHA1 2a386777a9ce6a86b9c9a79027ea494de539c76b
- SHA512 6a10d10ed83345bbfba5da29f4eb0816a5064f4941ea6c2fdc35a15c86e5c1d6382c0f36e93ea472005c1dbffd42a163a1347b43c8540db511911dced75d08ce
- MD5 SHA1 SHA512
ico/1.txt
- SHA256 97e661d2521c7b4598771920489bceadbbffd3c8ae415b8d9b95c01f152ba695
- MD5 603ea1844876e38011a63fb571fb62b0
- SHA1 e8ca2064550cc12c8b0d7dcdbb593b840dd4d6d1
- SHA512 933b77039f5e067a5ecec1a8ddffaa0d13c1c021660f75eea5c55a47fca285e0c6ca1832d08b05685fad0dca595e0192ce3e564ec06bf5fbcc4bb71dc1b97c27
- MD5 SHA1 SHA512
ico/1.url
- SHA256 f8434faac018d95c6b29037436bfdf150d6c4dc40ddaa67dd4ff8435565f6df9
- MD5 a1c56665489b415712693ad32335e808
- SHA1 b112f7b8c4f229aaa659c2d5ee7610b328b92e63
- SHA512 655630f79dd6bda536c4d1a35e85d531e24887d6edadcdcf67fb654ee8847d2d64539b8be857f200cc2e68ef1f1beb3af0832b12a3aa78a568dff9a996900f62
- MD5 SHA1 SHA512
ico/1BOOTNXT
- SHA256 ba474fd1af9876f6e50ddbbf9259bcb1754fff87d267275867bea253a8f53930
- MD5 dd3d9b251ae0028ca124c1b19fc127d7
- SHA1 22d236f46144cd2ba197a4f2223ba173fb70d286
- SHA512 bf921868ff9d3adc26f65fa647acdbab8d1fe2a79af6e5c4ff01090def46433fa2002d5448b9fa8a4b354e750cdd8f95973de2ffa6cda9261e67538373fdc183
- MD5 SHA1 SHA512
ico/1bootmgr
- SHA256 ba474fd1af9876f6e50ddbbf9259bcb1754fff87d267275867bea253a8f53930
- MD5 dd3d9b251ae0028ca124c1b19fc127d7
- SHA1 22d236f46144cd2ba197a4f2223ba173fb70d286
- SHA512 bf921868ff9d3adc26f65fa647acdbab8d1fe2a79af6e5c4ff01090def46433fa2002d5448b9fa8a4b354e750cdd8f95973de2ffa6cda9261e67538373fdc183
- MD5 SHA1 SHA512
ico/wjj.bmp
- SHA256 0b73d1f1fe37d0ad5babeea37342115f4069bf4fdc0372f328d18ce522b2ff39
- MD5 370beadfcbcf7d4eed450082fc38120c
- SHA1 823b586244bd81751cec97dd02bf7c86826b8293
- SHA512 970a50782083080894ddd5454bb5fd48e6a87e86056c977c889dc0182f4d87f1e267b01c45253ffa2a5ba597d0b297aa8b9154c542e9a3e67ac2a7988234776b
- MD5 SHA1 SHA512
ssdl_data_thread.dll
- SHA256 1b9724acd14eef5c69764d1dcf7a13982c85683210cbcd08a92a100fb20f3e2a
- MD5 89c4890ee1e790977b6dc9f4113ae5c7
- SHA1 cdaa88bbf99d81c911f4f7305749bd7861099ebe
- SHA512 8ec0beb6f8f8cff413d807aebba6282707f40156cfc7095f20e2d1bcf924a1c7b49632568b281bb10eb580f92c182f93ea88d7b94ec807a439582e899022e1f8
- SSDEEP 96:fFx8iSbiG4HaOQmCy2kd3NIOnEpCfC4f7Xw53GTf3LkZ8YLO:fFGvJiIyfIeJjDo
- MD5 SHA1 SHA512 SSDEEP
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28448
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Call6P
ssdl_data_thread
Ŀ¼_ȡ����Ŀ¼
Name
UPX0
Size
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=4, version=8047,
count=18, id=1, productName=Unmarked objects,
count=5, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=7, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, productName=Unmarked objects (old),
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
out.upx
- SHA256 dd0953cc6de74b14c93ec4aa46473f0fb840550b8e1b3df1977734aabb6f6b84
- MD5 b183beeb80a72c944bb883acb50aa64f
- SHA1 75b2f1bd2a84f1aa52333b2fdaf7637dd9806a6a
- SHA512 02866457ba53a5bd0abd011aa4e9f319895cb2c2020c0a89d6d5571c9e2c086dcad3b5c26a2f1147b31472397f25c3eea730c56828abf17d8a7bc6684f542fd4
- SSDEEP 96:Be/KtMALHi0JXGGF2MQ6+5oEoc4T5fm1iluyuVw03+IPZNm9g+eRihiuf3X3X3fP:0/50bk57UT5fmQluys1Sghu5nnnnnn
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6048
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
563B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
366B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=4, version=8047,
count=18, id=1, productName=Unmarked objects,
count=5, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=7, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, productName=Unmarked objects (old),
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
winspool.drv
- IMPHASH 1ce67502847c1640ec74e4b2bde67460
- SHA256 f5a0cb05f5379078d7f78036e511cb54e4604bb64130efd76ebe49bbad58862d
- MD5 a6bf842e6f67053bfdca833ce6f8b50c
- SHA1 062010167a93aed46b24e24b6279e90bd7dce0df
- SHA512 033379e9fdd8e1d63f2d883157dfffe55d11be70273dcc74eb9dacc688259108f604abad64ed9d80c978d3d39d51a6275af55fbec88985d12aa7f11c36e8d33b
- SSDEEP 12288:GfW0yaYWnIaviOZXwElZQ6FH01fGONPfnOY0kw7WpG8Dt:G+BaYWIa6OZAEX/GOY09Cp3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
504031
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
FindFirstFileA
GlobalUnlock
SetStdHandle
IsBadCodePtr
IsBadReadPtr
CompareStringW
CompareStringA
SetUnhandledExceptionFilter
GetStringTypeW
FindClose
IsBadWritePtr
VirtualAlloc
LCMapStringW
LCMapStringA
SetEnvironmentVariableA
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetACP
HeapSize
TerminateProcess
RaiseException
GetLocalTime
GetSystemTime
GetTimeZoneInformation
RtlUnwind
GetOEMCP
GetCPInfo
GetProcessVersion
SetErrorMode
GlobalFlags
GetCurrentThread
GetFileTime
GetFileSize
SuspendThread
ReleaseMutex
CreateMutexA
TerminateThread
CreateSemaphoreA
ResumeThread
ReleaseSemaphore
EnterCriticalSection
LeaveCriticalSection
GetProfileStringA
WriteFile
ReadFile
WaitForMultipleObjects
CreateFileA
SetEvent
FindResourceA
LoadResource
LockResource
GetModuleFileNameA
GetCurrentThreadId
ExitProcess
GlobalSize
GlobalFree
DeleteCriticalSection
InitializeCriticalSection
lstrcatA
lstrlenA
WinExec
lstrcpyA
FindNextFileA
GlobalReAlloc
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
GetFullPathNameA
FreeLibrary
LoadLibraryA
GetLastError
GetVersionExA
WritePrivateProfileStringA
CreateThread
CreateEventA
Sleep
GlobalAlloc
GlobalLock
TlsGetValue
LocalReAlloc
TlsSetValue
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
lstrcmpA
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpiA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
GetCurrentProcess
GetFileAttributesA
SetCurrentDirectoryA
DuplicateHandle
lstrcpynA
SetLastError
FileTimeToLocalFileTime
FileTimeToSystemTime
LocalFree
MultiByteToWideChar
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
GetVolumeInformationA
GetModuleHandleA
GetProcAddress
MulDiv
GetCommandLineA
GetTickCount
WaitForSingleObject
GetStringTypeA
CloseHandle
user32
OpenClipboard
GetClipboardData
CloseClipboard
SetClipboardData
EmptyClipboard
GetSystemMetrics
wsprintfA
AdjustWindowRectEx
GetCursorPos
MessageBoxA
SetWindowPos
SendMessageA
DestroyCursor
SetParent
IsWindow
PostMessageA
GetTopWindow
GetParent
GetFocus
GetClientRect
InvalidateRect
ValidateRect
UpdateWindow
EqualRect
GetWindowRect
SetForegroundWindow
DestroyMenu
IsChild
TranslateMessage
LoadIconA
DrawFrameControl
DrawEdge
DrawFocusRect
WindowFromPoint
GetMessageA
DispatchMessageA
SetRectEmpty
RegisterClipboardFormatA
CreateIconFromResourceEx
CreateIconFromResource
DrawIconEx
CreatePopupMenu
AppendMenuA
ModifyMenuA
CreateMenu
CreateAcceleratorTableA
SystemParametersInfoA
ShowWindow
IsWindowEnabled
TranslateAcceleratorA
CopyAcceleratorTableA
PostQuitMessage
IsZoomed
GetDlgCtrlID
GetSubMenu
EnableMenuItem
ClientToScreen
EnumDisplaySettingsA
LoadImageA
GetClassInfoA
DefWindowProcA
GetKeyState
GetMenu
SetMenu
PeekMessageA
IsIconic
SetFocus
GetActiveWindow
GetWindow
DestroyAcceleratorTable
SetWindowRgn
GetMessagePos
ScreenToClient
ChildWindowFromPointEx
CopyRect
LoadBitmapA
WinHelpA
KillTimer
SetTimer
ReleaseCapture
GetWindowTextA
GetWindowTextLengthA
CharUpperA
GetWindowDC
BeginPaint
EndPaint
TabbedTextOutA
DrawTextA
GrayStringA
GetDlgItem
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetNextDlgTabItem
GetWindowPlacement
RegisterWindowMessageA
GetForegroundWindow
GetLastActivePopup
ReleaseDC
RemovePropA
CallWindowProcA
GetPropA
UnhookWindowsHookEx
SetPropA
GetClassLongA
CallNextHookEx
SetWindowsHookExA
CreateWindowExA
GetMenuItemID
GetMenuItemCount
RegisterClassA
GetScrollPos
GetMessageTime
MapWindowPoints
SendDlgItemMessageA
ScrollWindowEx
IsDialogMessageA
SetWindowTextA
MoveWindow
CheckMenuItem
SetMenuItemBitmaps
GetMenuState
GetMenuCheckMarkDimensions
GetClassNameA
GetDesktopWindow
UnregisterClassA
LoadStringA
GetSysColorBrush
GetCapture
SetCapture
GetScrollRange
SetScrollRange
SetScrollPos
SetRect
InflateRect
IntersectRect
DestroyIcon
PtInRect
OffsetRect
IsWindowVisible
EnableWindow
RedrawWindow
GetWindowLongA
SetWindowLongA
GetSysColor
SetActiveWindow
SetCursorPos
LoadCursorA
SetCursor
GetDC
FillRect
IsRectEmpty
gdi32
RestoreDC
SetBkColor
CreateRectRgnIndirect
SetStretchBltMode
GetClipRgn
CreatePolygonRgn
SelectClipRgn
DeleteObject
CreateDIBitmap
GetSystemPaletteEntries
CreatePalette
StretchBlt
SelectPalette
RealizePalette
GetDIBits
BeginPath
EndPath
PathToRegion
CreateEllipticRgn
CreateRoundRectRgn
GetWindowExtEx
GetViewportOrgEx
GetWindowOrgEx
GetTextColor
GetBkMode
GetBkColor
GetROP2
GetStretchBltMode
GetPolyFillMode
CreateCompatibleBitmap
CreateDCA
CreateBitmap
SelectObject
GetObjectA
CreatePen
PatBlt
CombineRgn
CreateRectRgn
FillRgn
CreateSolidBrush
GetStockObject
CreateFontIndirectA
EndPage
EndDoc
DeleteDC
StartDocA
StartPage
BitBlt
CreateCompatibleDC
Ellipse
Rectangle
LPtoDP
DPtoLP
GetCurrentObject
RoundRect
GetTextExtentPoint32A
GetDeviceCaps
SaveDC
SetBkMode
SetPolyFillMode
SetROP2
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
GetTextMetricsA
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetViewportExtEx
ExtSelectClipRgn
LineTo
MoveToEx
ExcludeClipRect
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
winmm
waveOutOpen
midiStreamRestart
midiStreamClose
midiOutReset
midiStreamStop
midiStreamOut
midiOutPrepareHeader
midiStreamProperty
midiStreamOpen
midiOutUnprepareHeader
waveOutGetNumDevs
waveOutClose
waveOutReset
waveOutPause
waveOutWrite
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutRestart
advapi32
RegQueryValueA
RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
shell32
Shell_NotifyIconA
ShellExecuteA
ole32
OleUninitialize
OleInitialize
CLSIDFromString
oleaut32
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
comctl32
ImageList_Destroy
ord17
ws2_32
recv
accept
ntohl
inet_ntoa
WSACleanup
closesocket
WSAAsyncSelect
getpeername
recvfrom
ioctlsocket
comdlg32
GetFileTitleA
GetSaveFileNameA
GetOpenFileNameA
ChooseColorA
ADVANCEDSETUPDIALOG
AbortPrinter
AddFormA
AddFormW
AddJobA
AddJobW
AddMonitorA
AddMonitorW
AddPortA
AddPortExA
AddPortExW
AddPortW
AddPrintProcessorA
AddPrintProcessorW
AddPrintProvidorA
AddPrintProvidorW
AddPrinterA
AddPrinterConnection2A
AddPrinterConnection2W
AddPrinterConnectionA
AddPrinterConnectionW
AddPrinterDriverA
AddPrinterDriverExA
AddPrinterDriverExW
AddPrinterDriverW
AddPrinterW
AdvancedDocumentPropertiesA
AdvancedDocumentPropertiesW
AdvancedSetupDialog
ClosePrinter
CloseSpoolFileHandle
CommitSpoolData
ConfigurePortA
ConfigurePortW
ConnectToPrinterDlg
ConvertAnsiDevModeToUnicodeDevmode
ConvertUnicodeDevModeToAnsiDevmode
CorePrinterDriverInstalledA
CorePrinterDriverInstalledW
CreatePrintAsyncNotifyChannel
CreatePrinterIC
DEVICECAPABILITIES
DEVICEMODE
DeleteFormA
DeleteFormW
DeleteMonitorA
DeleteMonitorW
DeletePortA
DeletePortW
DeletePrintProcessorA
DeletePrintProcessorW
DeletePrintProvidorA
DeletePrintProvidorW
DeletePrinter
DeletePrinterConnectionA
DeletePrinterConnectionW
DeletePrinterDataA
DeletePrinterDataExA
DeletePrinterDataExW
DeletePrinterDataW
DeletePrinterDriverA
DeletePrinterDriverExA
DeletePrinterDriverExW
DeletePrinterDriverPackageA
DeletePrinterDriverPackageW
DeletePrinterDriverW
DeletePrinterIC
DeletePrinterKeyA
DeletePrinterKeyW
DevQueryPrint
DevQueryPrintEx
DeviceCapabilities
DeviceCapabilitiesA
DeviceCapabilitiesW
DeviceMode
DevicePropertySheets
DocumentEvent
DocumentPropertiesA
DocumentPropertiesW
DocumentPropertySheets
EXTDEVICEMODE
EndDocPrinter
EndPagePrinter
EnumFormsA
EnumFormsW
EnumJobsA
EnumJobsW
EnumMonitorsA
EnumMonitorsW
EnumPortsA
EnumPortsW
EnumPrintProcessorDatatypesA
EnumPrintProcessorDatatypesW
EnumPrintProcessorsA
EnumPrintProcessorsW
EnumPrinterDataA
EnumPrinterDataExA
EnumPrinterDataExW
EnumPrinterDataW
EnumPrinterDriversA
EnumPrinterDriversW
EnumPrinterKeyA
EnumPrinterKeyW
EnumPrintersA
EnumPrintersW
ExtDeviceMode
FindClosePrinterChangeNotification
FindFirstPrinterChangeNotification
FindNextPrinterChangeNotification
FlushPrinter
FreePrinterNotifyInfo
GetCorePrinterDriversA
GetCorePrinterDriversW
GetDefaultPrinterA
GetDefaultPrinterW
GetFormA
GetFormW
GetJobA
GetJobW
GetPrintExecutionData
GetPrintProcessorDirectoryA
GetPrintProcessorDirectoryW
GetPrinterA
GetPrinterDataA
GetPrinterDataExA
GetPrinterDataExW
GetPrinterDataW
GetPrinterDriver2A
GetPrinterDriver2W
GetPrinterDriverA
GetPrinterDriverDirectoryA
GetPrinterDriverDirectoryW
GetPrinterDriverPackagePathA
GetPrinterDriverPackagePathW
GetPrinterDriverW
GetPrinterW
GetSpoolFileHandle
ID100
ID101
ID102
ID103
ID205
ID206
ID207
ID208
ID209
ID210
ID211
ID212
ID213
ID214
ID215
ID216
ID217
ID218
ID219
ID220
InstallPrinterDriverFromPackageA
InstallPrinterDriverFromPackageW
IsValidDevmodeA
IsValidDevmodeW
OpenPrinter2A
OpenPrinter2W
OpenPrinterA
OpenPrinterW
PerfClose
PerfCollect
PerfOpen
PlayGdiScriptOnPrinterIC
PrinterMessageBoxA
PrinterMessageBoxW
PrinterProperties
QueryColorProfile
QueryRemoteFonts
QuerySpoolMode
ReadPrinter
RegisterForPrintAsyncNotifications
ReportJobProcessingProgress
ResetPrinterA
ResetPrinterW
ScheduleJob
SeekPrinter
SetDefaultPrinterA
SetDefaultPrinterW
SetFormA
SetFormW
SetJobA
SetJobW
SetPortA
SetPortW
SetPrinterA
SetPrinterDataA
SetPrinterDataExA
SetPrinterDataExW
SetPrinterDataW
SetPrinterW
SplDriverUnloadComplete
SpoolerDevQueryPrintW
SpoolerPrinterEvent
StartDocDlgA
StartDocDlgW
StartDocPrinterA
StartDocPrinterW
StartPagePrinter
UnRegisterForPrintAsyncNotifications
UploadPrinterDriverPackageA
UploadPrinterDriverPackageW
WaitForPrinterChange
WritePrinter
XcvDataW
��������
Name
.text
Size
616KB
Virtual Size
612KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
96KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
92KB
Virtual Size
246KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
76KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=12, version=7291,
count=43, id=14, version=7299,
count=44, id=19, version=8022,
count=19, id=19, version=8034,
count=585, id=1, productName=Unmarked objects,
count=101, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=206, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=76, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=27, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=31, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
刺客远程管理.exe
- IMPHASH 99901b9697bda9f2bb9bfaa466d7b500
- SHA256 afb1e4a8f16351c79d06b942918037d8b08d4153029b800a77d4c8905abf0ad5
- MD5 85a70e7b83914eee9f0cb56004f148d7
- SHA1 231cf8c9c38c2fea588f822c560c5d7158ded778
- SHA512 e1bc595eededd6439dd23aa8637f124920ef41442f60a2b119d52ea4dbea32e4b916d6ee5adfeb1c2532f69ebd7765d5594f805f1883be92ff48dc6e8f58a1fb
- SSDEEP 98304:c6dHNkKQazyvNqkQFYV4n3y8orVxps0wWsyVaQxQfL2KS:NvzuAkQFe4nKWu8yKS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
5599224
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GlobalDeleteAtom
LocalFree
GlobalHandle
TlsFree
GlobalReAlloc
LocalReAlloc
GlobalFlags
lstrcpyA
SetLastError
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetVersion
FindResourceA
DeleteCriticalSection
SetErrorMode
FlushFileBuffers
GetCPInfo
GetOEMCP
GetStartupInfoA
RtlUnwind
TerminateProcess
RaiseException
HeapSize
GetACP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
IsBadWritePtr
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
SetStdHandle
GetLastError
GetVersionExA
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
LCMapStringA
FreeLibrary
GetCommandLineA
SetFilePointer
GetUserDefaultLCID
WritePrivateProfileStringA
GetTickCount
GetModuleFileNameA
CreateFileA
GetPrivateProfileStringA
HeapReAlloc
MulDiv
WriteFile
ReadFile
GetFileSize
CreateFileW
WaitForSingleObject
Sleep
SetEvent
CreateEventW
ResetEvent
VirtualProtect
FlushInstructionCache
GetModuleFileNameW
GetCommandLineW
GetModuleHandleW
LoadLibraryW
GetModuleHandleExW
lstrcmpW
HeapDestroy
HeapCreate
GlobalUnlock
GlobalLock
GetAtomNameW
WideCharToMultiByte
GetThreadTimes
OpenThread
ExitThread
GetCurrentThread
GetModuleHandleA
ExitProcess
VirtualQuery
GetProcAddress
LoadLibraryA
VirtualFree
RtlZeroMemory
LockResource
LoadResource
FindResourceW
lstrcatW
lstrcmpiW
lstrcmpA
lstrlenW
lstrlenA
HeapFree
InterlockedDecrement
InterlockedIncrement
LocalSize
HeapAlloc
GetProcessHeap
lstrcpyn
MultiByteToWideChar
CreateProcessW
GetLocalTime
lstrcatA
GlobalFree
GlobalAlloc
GetCurrentThreadId
Module32Next
Module32First
CreateToolhelp32Snapshot
TlsSetValue
TlsGetValue
TlsAlloc
VirtualAlloc
RtlMoveMemory
SetEnvironmentVariableA
GetEnvironmentVariableA
GetCurrentProcessId
IsBadReadPtr
lstrcmpiA
IsBadCodePtr
CreateThread
LocalAlloc
GetCurrentProcess
lstrcpynA
CloseHandle
VirtualQueryEx
GetProcessVersion
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowTextLengthA
GetWindowTextA
OpenClipboard
EmptyClipboard
CloseClipboard
GetWindowLongA
GetMessageA
DispatchMessageA
wsprintfA
SendDlgItemMessageW
SetDlgItemTextW
GetDlgItemTextW
SetDlgItemInt
GetDlgItemInt
SetWindowLongA
SetWindowTextA
SendMessageA
CreateDialogIndirectParamA
IsWindow
PeekMessageA
GetAsyncKeyState
SetWindowLongW
GetAncestor
GetDlgItem
TrackMouseEvent
EndPaint
BeginPaint
SetWindowRgn
SetClipboardData
GetClassNameA
GetWindowThreadProcessId
GetWindow
GetDesktopWindow
MessageBoxA
wvsprintfA
MsgWaitForMultipleObjects
FindWindowExW
MapDialogRect
GetDialogBaseUnits
CallWindowProcA
CharLowerW
CharUpperW
LoadStringW
PostQuitMessage
IsDialogMessageW
TranslateMDISysAccel
IsChild
DrawIconEx
LoadImageW
CreateIconFromResourceEx
MapWindowPoints
PtInRect
DrawFrameControl
PostThreadMessageA
UnregisterClassA
LoadStringA
GetSysColorBrush
LoadCursorA
LoadIconA
AdjustWindowRectEx
CopyRect
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
CreateWindowExA
GetClassLongA
DefWindowProcA
GetMessageTime
GetMessagePos
RegisterWindowMessageA
SystemParametersInfoA
GetWindowPlacement
IsDialogMessageA
SendDlgItemMessageA
GrayStringA
TabbedTextOutA
UnhookWindowsHookEx
GetDlgCtrlID
RegisterClipboardFormatA
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
SetMenuItemBitmaps
EnableMenuItem
GetKeyState
CallNextHookEx
SetWindowsHookExA
GetLastActivePopup
PostMessageA
GetClassNameW
SetActiveWindow
GetActiveWindow
GetForegroundWindow
DrawFocusRect
CheckRadioButton
FindWindowExA
UpdateLayeredWindow
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
SystemParametersInfoW
RegisterWindowMessageW
GetMenu
GetSystemMetrics
IsZoomed
IsIconic
LoadIconW
EnumPropsExW
RemovePropA
RemovePropW
GetPropW
SetPropW
KillTimer
SetTimer
MessageBoxW
SetWindowTextW
SetParent
UpdateWindow
ValidateRect
InvalidateRect
GetFocus
CopyIcon
PostMessageW
CreateMDIWindowW
DialogBoxParamW
CreateDialogParamW
EndDialog
DialogBoxIndirectParamW
DestroyWindow
SetClassLongW
GetClassLongW
CreateDialogIndirectParamW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
SetMenuDefaultItem
SetMenuItemInfoW
CheckMenuItem
RemoveMenu
MenuItemFromPoint
GetMenuDefaultItem
GetMenuState
GetMenuItemRect
GetMenuStringW
TrackPopupMenu
SetForegroundWindow
CheckMenuRadioItem
GetMenuItemID
GetSubMenu
SetMenuInfo
DrawMenuBar
SetMenu
InsertMenuW
AppendMenuW
GetMenuItemInfoW
GetMenuItemCount
DestroyMenu
GetMenuInfo
LoadMenuW
GetSystemMenu
CreatePopupMenu
CreateMenu
GetIconInfo
CallWindowProcW
GetPropA
SetPropA
ScreenToClient
GetCursorPos
ShowWindow
SetRect
MoveWindow
ClientToScreen
FillRect
GetWindowDC
DefWindowProcW
OffsetRect
ReleaseDC
DrawTextA
GetDC
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetParent
GetWindowLongW
SendMessageW
DestroyCursor
SetCursor
GetClientRect
SetCapture
ReleaseCapture
LoadCursorW
DestroyIcon
DestroyAcceleratorTable
GetSysColor
IsWindowVisible
IsWindowEnabled
EnableWindow
GetNextDlgTabItem
GetWindowRect
SetWindowPos
GetProcessWindowStation
GetUserObjectInformationW
shell32
SHGetSpecialFolderPathA
ShellExecuteA
DragQueryFileW
DragFinish
Shell_NotifyIconW
DragAcceptFiles
CommandLineToArgvW
ole32
OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
StringFromGUID2
CLSIDFromProgID
CoCreateInstance
OleRun
StgCreateDocfile
CLSIDFromString
GetHGlobalFromStream
shlwapi
PathFindExtensionA
PathAddBackslashW
PathFindFileNameA
PathFileExistsA
StrTrimW
StrToIntExW
wvnsprintfW
PathFindFileNameW
PathRemoveFileSpecW
StrToIntW
ws2_32
bind
getpeername
getsockname
closesocket
inet_ntoa
socket
inet_addr
htons
WSAStartup
connect
send
listen
recv
accept
sendto
recvfrom
ntohs
oleaut32
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
VarR8FromCy
VarR8FromBool
VariantChangeType
SafeArrayGetElemsize
LHashValOfNameSys
RegisterTypeLi
VariantCopy
SafeArrayDestroy
SysFreeString
VariantClear
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
SysAllocString
VariantInit
VariantTimeToSystemTime
SystemTimeToVariantTime
LoadTypeLi
gdi32
GetClipBox
SetViewportOrgEx
SetWindowExtEx
ScaleViewportExtEx
SetMapMode
RestoreDC
SaveDC
CreateBitmap
StretchBlt
SetStretchBltMode
GetStretchBltMode
CreateDIBSection
CreateCompatibleDC
BitBlt
CreateRoundRectRgn
CreatePatternBrush
CreateSolidBrush
GetStockObject
OffsetViewportOrgEx
GetDeviceCaps
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetObjectA
GetDIBits
CreateDIBitmap
CreateEllipticRgn
CreateFontIndirectW
SetViewportExtEx
GetObjectW
SetBkColor
SetTextColor
DeleteDC
SelectObject
ScaleWindowExtEx
SetBkMode
DeleteObject
gdiplus
GdipGetPenDashOffset
GdipSetPenDashOffset
GdipGetPenDashCount
GdipGetPenDashArray
GdipSetPenDashArray
GdipSetPenCompoundArray
GdipGetPenCompoundCount
GdipGetPenCompoundArray
GdipGetPenDashStyle
GdipSetPenDashStyle
GdipGetPenFillType
GdipGetPenBrushFill
GdipSetPenBrushFill
GdipSetPenColor
GdipGetPenColor
GdipScalePenTransform
GdipTranslatePenTransform
GdipRotatePenTransform
GdipMultiplyPenTransform
GdipResetPenTransform
GdipGetPenTransform
GdipSetPenTransform
GdipGetPenMode
GdipSetPenMode
GdipGetPenMiterLimit
GdipSetPenMiterLimit
GdipGetPenCustomEndCap
GdipSetPenCustomEndCap
GdipGetPenCustomStartCap
GdipSetPenCustomStartCap
GdipGetPenLineJoin
GdipSetPenLineJoin
GdipGetPenDashCap197819
GdipGetPenEndCap
GdipGetPenStartCap
GdipSetPenDashCap197819
GdipSetPenEndCap
GdipSetPenStartCap
GdipSetPenLineCap197819
GdipSetPenUnit
GdipGetPenUnit
GdipSetPenWidth
GdipGetPenWidth
GdipClonePen
GdipCreatePen2
GdipCreatePen1
GdipGetLineSpacing
GdipGetCellDescent
GdipGetCellAscent
GdipGetEmHeight
GdipIsStyleAvailable
GdipGetFamilyName
GdipGetGenericFontFamilyMonospace
GdipGetGenericFontFamilySerif
GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipCloneFontFamily
GdipGetFontCollectionFamilyList
GdipGetFontCollectionFamilyCount
GdipPrivateAddMemoryFont
GdipPrivateAddFontFile
GdipNewPrivateFontCollection
GdipNewInstalledFontCollection
GdipDeletePen
GdipGetSolidFillColor
GdipSetSolidFillColor
GdipGetBrushType
GdipCreateTexture
GdipFillRectangle
GdipCloneBrush
GdipGetStringFormatMeasurableCharacterRangeCount
GdipSetStringFormatMeasurableCharacterRanges
GdipGetStringFormatDigitSubstitution
GdipSetStringFormatDigitSubstitution
GdipGetStringFormatTabStops
GdipGetStringFormatTabStopCount
GdipSetStringFormatTabStops
GdipGetStringFormatHotkeyPrefix
GdipSetStringFormatHotkeyPrefix
GdipGetStringFormatTrimming
GdipSetStringFormatTrimming
GdipGetStringFormatLineAlign
GdipSetStringFormatLineAlign
GdipGetStringFormatAlign
GdipSetStringFormatAlign
GdipGetStringFormatFlags
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipStringFormatGetGenericTypographic
GdipStringFormatGetGenericDefault
GdipCreateStringFormat
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipCreateSolidFill
GdipBitmapSetResolution
GdipCloneBitmapArea
GdipCreateBitmapFromResource
GdipCreateBitmapFromHICON
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipIsMatrixEqual
GdipIsMatrixIdentity
GdipIsMatrixInvertible
GdipVectorTransformMatrixPoints
GdipTransformMatrixPoints
GdipShearMatrix
GdipScaleMatrix
GdipInvertMatrix
GdipRotateMatrix
GdipTranslateMatrix
GdipMultiplyMatrix
GdipGetMatrixElements
GdipSetMatrixElements
GdipCloneMatrix
GdipCreateMatrix3
GdipCreateMatrix2
GdipCreateMatrix
GdipGetRegionScans
GdipGetRegionScansCount
GdipIsVisibleRegionRect
GdipIsVisibleRegionPoint
GdipIsEqualRegion
GdipIsInfiniteRegion
GdipIsEmptyRegion
GdipGetRegionHRgn
GdipGetRegionData
GdipGetRegionDataSize
GdipGetRegionBounds
GdipTransformRegion
GdipTranslateRegion
GdipCombineRegionPath
GdipCombineRegionRegion
GdipCombineRegionRect
GdipSetEmpty
GdipSetInfinite
GdipCloneRegion
GdipCreateRegionRgnData
GdipCreateRegionPath
GdipCreateRegionHrgn
GdipCreateRegionRect
GdipIsOutlineVisiblePathPoint
GdipIsVisiblePathPoint
GdipWarpPath
GdipWindingModeOutline
GdipWidenPath
GdipFlattenPath
GdipGetPathWorldBounds
GdipTransformPath
GdipAddPathString
GdipAddPathPath
GdipAddPathPolygon
GdipAddPathPie
GdipAddPathEllipse
GdipAddPathArcI
GdipAddPathLineI
GdipAddPathRectangle
GdipAddPathClosedCurve2
GdipAddPathClosedCurve
GdipAddPathCurve2
GdipAddPathCurve
GdipAddPathBezier
GdipAddPathLine
GdipGetPathLastPoint
GdipReversePath
GdipClearPathMarkers
GdipSetPathMarker
GdipClosePathFigures
GdipClosePathFigure
GdipStartPathFigure
GdipGetPathData
GdipGetPointCount
GdipSetPathFillMode
GdipGetPathFillMode
GdipResetPath
GdipClonePath
GdipCreatePath2
GdipCreatePath
GdipGetImageGraphicsContext
GdipCreateFromHWND
GdipGetFontHeightGivenDPI
GdipGetFontHeight
GdipGetFontUnit
GdipGetFontSize
GdipGetFontStyle
GdipGetFamily
GdipGetLogFontA
GdipGetLogFontW
GdipCloneFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDeleteFontFamily
GdipDeletePrivateFontCollection
GdipCreateFontFromLogfontW
GdipCreateFont
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipDeleteStringFormat
GdipCreateHICONFromBitmap
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipGetImageThumbnail
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageBounds
GdipGetImageDimension
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToStream
GdipGetImagePixelFormat
GdipGetImageRawFormat
GdipCloneImage
GdipLoadImageFromStream
GdipLoadImageFromFile
GdipEndContainer
GdipBeginContainer2
GdipBeginContainer
GdipRestoreGraphics
GdipSaveGraphics
GdipIsVisibleRect
GdipIsVisiblePoint
GdipIsVisibleClipEmpty
GdipIsClipEmpty
GdipGetVisibleClipBounds
GdipGetClipBounds
GdipGetClip
GdipTranslateClip
GdipResetClip
GdipSetClipHrgn
GdipSetClipRegion
GdipSetClipRect
GdipSetClipPath
GdipSetClipGraphics
GdipDrawImagePointsRect
GdipDrawImagePointRect
GdipDrawImagePoints
GdipDrawImageRect
GdipDrawImageRectRect
GdipDrawImage
GdipDrawDriverString
GdipMeasureCharacterRanges
GdipCreateRegion
GdipMeasureString
GdipDrawString
GdipFillRegion
GdipFillClosedCurve2
GdipDeleteBrush
GdipDisposeImageAttributes
GdipDeleteGraphics
GdipDisposeImage
GdipDeleteFont
GdipDeletePath
GdipDeleteRegion
GdipCreateImageAttributes
GdipCloneImageAttributes
GdipSetImageAttributesToIdentity
GdipResetImageAttributes
GdipSetImageAttributesThreshold
GdipSetImageAttributesNoOp
GdipSetImageAttributesGamma
GdipSetImageAttributesColorKeys
GdipSetImageAttributesOutputChannel
GdipSetImageAttributesOutputChannelColorProfile
GdipSetImageAttributesRemapTable
GdipSetImageAttributesWrapMode
GdipGetImageAttributesAdjustedPalette
GdipSetImageAttributesColorMatrix
GdipCreateHBITMAPFromBitmap
GdipCreateFromHDC
GdipFlush
GdipFillClosedCurve
GdipFillPath
GdipFillPie
GdipFillEllipse
GdipFillPolygon
GdipGraphicsClear
GdipDrawClosedCurve2
GdipDrawClosedCurve
GdipDrawCurve2
GdipDrawCurve
GdipDrawPath
GdipDrawPolygon
GdipDrawPie
GdipDrawEllipse
GdipDrawRectangle
GdipDrawBezier
GdipDrawArc
GdipDrawLine
GdipGetNearestColor
GdipTransformPointsI
GdipTransformPoints
GdipGetDpiY
GdipGetDpiX
GdipGetPageScale
GdipSetPageScale
GdipGetPageUnit
GdipSetPageUnit
GdipRotateWorldTransform
GdipScaleWorldTransform
GdipTranslateWorldTransform
GdipResetWorldTransform
GdipDeleteMatrix
GdipGetWorldTransform
GdipSetWorldTransform
GdipGetPixelOffsetMode
GdipSetPixelOffsetMode
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipGetInterpolationMode
GdipSetInterpolationMode
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipReleaseDC
GdipGetDC
GdipAddPathArc
wininet
InternetOpenUrlA
HttpQueryInfoA
InternetOpenA
msimg32
AlphaBlend
crypt32
CryptStringToBinaryW
comctl32
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_DragEnter
ImageList_BeginDrag
ImageList_DrawEx
ImageList_Draw
ImageList_Write
ImageList_GetImageInfo
ImageList_SetImageCount
ImageList_GetImageCount
ImageList_SetIconSize
ImageList_GetIcon
ImageList_SetBkColor
ImageList_GetBkColor
ImageList_Remove
ImageList_Replace
ImageList_ReplaceIcon
ImageList_Duplicate
ImageList_Copy
ImageList_AddMasked
ImageList_Add
ImageList_GetIconSize
ImageList_AddIcon
ImageList_LoadImageW
ImageList_Read
ImageList_Create
InitCommonControlsEx
ImageList_Destroy
ImageList_EndDrag
ord17
atl
ord47
ord39
ord42
ord11
ord10
uxtheme
CloseThemeData
DrawThemeBackground
SetWindowTheme
OpenThemeData
comdlg32
ChooseColorW
GetSaveFileNameW
GetOpenFileNameW
ChooseFontW
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
oledlg
ord8
advapi32
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
Name
.text
Size
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
204KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.IjzIL0
Size
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.test
Size
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_MEM_EXECUTE
Name
.IjzIL1
Size
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.IjzIL2
Size
4.0MB
Virtual Size
4.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=7, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=37, id=14, version=7299,
count=175, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=2, id=4, version=9782,
count=1003, id=1, productName=Unmarked objects,
count=39, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=180, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, productName=Unmarked objects (old),
count=4, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
剪辑版拦截信息/192.168.1.28.txt
- SHA256 fd2a2ea189af42f5280fa5f61cdcd41286bf3f96e743c7f8c61e29b8d97b3484
- MD5 cedf3ee271491c9116bb420ea99e07dd
- SHA1 eab7e240f3bb094101860ba78977cb94d64e31ca
- SHA512 1d5b535452c23850f86993b64b07555bc9feced9b703b6b76b1ce9d7ea0f16989cf5d7ccc2f14317067898e80deab58970aba411bb8886bcb867ce681431e168
- MD5 SHA1 SHA512