7b7447e70e6b0d783f78502902177c6f_JaffaCakes118
- SHA256 7ba7d11ece7e85cb9f0978678d74ddeb5bf57c1660df5a149937403a602a7f5d
Overview
overview
10Static
static
10data/andro...er.apk
android-9-x86
data/andro...er.apk
android-10-x64
data/andro...er.apk
android-11-x64
data/andro...ge.apk
android-9-x86
data/andro...ge.apk
android-10-x64
data/andro...ge.apk
android-11-x64
data/andro...ll.apk
android-9-x86
data/andro...ll.apk
android-10-x64
data/andro...ll.apk
android-11-x64
data/meter...64.dll
windows7-x64
1data/meter...64.dll
windows10-2004-x64
1data/meter...86.dll
windows7-x64
3data/meter...86.dll
windows10-2004-x64
3data/meter...64.dll
windows7-x64
1data/meter...64.dll
windows10-2004-x64
1data/meter...86.dll
windows7-x64
3data/meter...86.dll
windows10-2004-x64
3data/meter...64.dll
windows7-x64
1data/meter...64.dll
windows10-2004-x64
1data/meter...86.dll
windows7-x64
3data/meter...86.dll
windows10-2004-x64
3data/meter...64.dll
windows7-x64
1data/meter...64.dll
windows10-2004-x64
1data/meter...86.dll
windows7-x64
3data/meter...86.dll
windows10-2004-x64
3data/meter...64.dll
windows7-x64
1data/meter...64.dll
windows10-2004-x64
1data/meter...86.dll
windows7-x64
3data/meter...86.dll
windows10-2004-x64
3data/meter...64.dll
windows7-x64
1data/meter...64.dll
windows10-2004-x64
1data/meter...86.dll
windows7-x64
3Behavioral task
behavioral1
Sample
data/android/meterpreter.apk
Resource
android-x86-arm-20240514-en
android-9-x86
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
data/android/meterpreter.apk
Resource
android-x64-20240514-en
android-10-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
data/android/meterpreter.apk
Resource
android-x64-arm64-20240514-en
android-11-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
data/android/metstage.apk
Resource
android-x86-arm-20240514-en
android-9-x86
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
data/android/metstage.apk
Resource
android-x64-20240514-en
android-10-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
data/android/metstage.apk
Resource
android-x64-arm64-20240514-en
android-11-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
data/android/shell.apk
Resource
android-x86-arm-20240514-en
android-9-x86
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
data/android/shell.apk
Resource
android-x64-20240514-en
android-10-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
data/android/shell.apk
Resource
android-x64-arm64-20240514-en
android-11-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
data/meterpreter/elevator.x64.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
data/meterpreter/elevator.x64.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
data/meterpreter/elevator.x86.dll
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
data/meterpreter/elevator.x86.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
data/meterpreter/ext_server_espia.x64.dll
Resource
win7-20240419-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
data/meterpreter/ext_server_espia.x64.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
data/meterpreter/ext_server_espia.x86.dll
Resource
win7-20240215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
data/meterpreter/ext_server_espia.x86.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
data/meterpreter/ext_server_extapi.x64.dll
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
data/meterpreter/ext_server_extapi.x64.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
data/meterpreter/ext_server_extapi.x86.dll
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral21
Sample
data/meterpreter/ext_server_extapi.x86.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
data/meterpreter/ext_server_incognito.x64.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
data/meterpreter/ext_server_incognito.x64.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
data/meterpreter/ext_server_incognito.x86.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
data/meterpreter/ext_server_incognito.x86.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
data/meterpreter/ext_server_kiwi.x64.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
data/meterpreter/ext_server_kiwi.x64.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
data/meterpreter/ext_server_kiwi.x86.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
data/meterpreter/ext_server_kiwi.x86.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral30
Sample
data/meterpreter/ext_server_lanattacks.x64.dll
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
data/meterpreter/ext_server_lanattacks.x64.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
data/meterpreter/ext_server_lanattacks.x86.dll
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
General
- Target 7b7447e70e6b0d783f78502902177c6f_JaffaCakes118
- Size 11.7MB
- Sample240528-dgr1fscc5z
- SHA256 7ba7d11ece7e85cb9f0978678d74ddeb5bf57c1660df5a149937403a602a7f5d
- MD5 7b7447e70e6b0d783f78502902177c6f
- SHA1 6a8d7425ba51458ce3b2121ab0c61e397749feeb
- SHA512 b22d3928f26fcbd09948ab2fa4ee59959095e6369f7bde742a81a1c6c6fd7f79038cb238c94e27421fa9c06247571b4a93eb316bddbf9d7d86160ed228bf733f
- SSDEEP 196608:trCQPyBqK8Jn/RmSgKz84j41mvi18m5Fn3mMLBjnP/BbwjWWUZGIyk7MUWf:1eq/npHgZ318U/FsTUoIyk7r
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Mimikatz family
- mimikatz is an open source tool to dump credentials on Windows 2 IoCs
resource yara_rule static1/unpack004/data/meterpreter/ext_server_kiwi.x64.dll mimikatz static1/unpack004/data/meterpreter/ext_server_kiwi.x86.dll mimikatz - Unsigned PE 34 IoCs
Checks for missing Authenticode signature.
resource unpack004/data/meterpreter/elevator.x64.dll unpack004/data/meterpreter/elevator.x86.dll unpack004/data/meterpreter/ext_server_espia.x64.dll unpack004/data/meterpreter/ext_server_espia.x86.dll unpack004/data/meterpreter/ext_server_extapi.x64.dll unpack004/data/meterpreter/ext_server_extapi.x86.dll unpack004/data/meterpreter/ext_server_incognito.x64.dll unpack004/data/meterpreter/ext_server_incognito.x86.dll unpack004/data/meterpreter/ext_server_kiwi.x64.dll unpack004/data/meterpreter/ext_server_kiwi.x86.dll unpack004/data/meterpreter/ext_server_lanattacks.x64.dll unpack004/data/meterpreter/ext_server_lanattacks.x86.dll unpack004/data/meterpreter/ext_server_mimikatz.x64.dll unpack004/data/meterpreter/ext_server_mimikatz.x86.dll unpack004/data/meterpreter/ext_server_peinjector.x64.dll unpack004/data/meterpreter/ext_server_peinjector.x86.dll unpack004/data/meterpreter/ext_server_powershell.x64.dll unpack004/data/meterpreter/ext_server_powershell.x86.dll unpack004/data/meterpreter/ext_server_priv.x64.dll unpack004/data/meterpreter/ext_server_priv.x86.dll unpack004/data/meterpreter/ext_server_python.x64.dll unpack004/data/meterpreter/ext_server_python.x86.dll unpack004/data/meterpreter/ext_server_sniffer.x64.dll unpack004/data/meterpreter/ext_server_sniffer.x86.dll unpack004/data/meterpreter/ext_server_stdapi.x64.dll unpack004/data/meterpreter/ext_server_stdapi.x86.dll unpack004/data/meterpreter/ext_server_unhook.x64.dll unpack004/data/meterpreter/ext_server_unhook.x86.dll unpack004/data/meterpreter/ext_server_winpmem.x64.dll unpack004/data/meterpreter/ext_server_winpmem.x86.dll unpack004/data/meterpreter/metsrv.x64.dll unpack004/data/meterpreter/metsrv.x86.dll unpack004/data/meterpreter/screenshot.x64.dll unpack004/data/meterpreter/screenshot.x86.dll
File Explorer
-
7b7447e70e6b0d783f78502902177c6f_JaffaCakes118.tar 11.7MB
-
checksums.yaml.gz.gz 266B
-
checksums.yaml418B
-
checksums.yaml.gz.sig256B
-
data.tar.gz.gz 11.7MB
-
data.tar.tar 22.4MB
-
.gitignore487B
-
CONTRIBUTING.md190B
-
Gemfile105B
-
LICENSE1KB
-
README.md1KB
-
Rakefile2KB
-
data/android/apk/AndroidManifest.xml6KB
-
data/android/apk/classes.dex.dex 19KB
-
data/android/apk/resources.arsc572B
-
data/android/meterpreter.dex.dex 173KB
-
data/android/meterpreter.jar.apk 69KB
-
data/android/metstage.jar.apk 1KB
-
data/android/shell.jar.apk 1KB
-
data/java/com/metasploit/meterpreter/MemoryBufferURLConnection.class2KB
-
data/java/com/metasploit/meterpreter/MemoryBufferURLStreamHandler.class559B
-
data/java/javapayload/stage/Meterpreter.class1KB
-
data/java/javapayload/stage/Shell.class1KB
-
data/java/javapayload/stage/Stage.class211B
-
data/java/javapayload/stage/StreamForwarder.class1KB
-
data/java/metasploit/AESEncryption.class1KB
-
data/java/metasploit/JMXPayload.class345B
-
data/java/metasploit/JMXPayloadMBean.class163B
-
data/java/metasploit/Payload.class8KB
-
data/java/metasploit/PayloadServlet.class812B
-
data/java/metasploit/PayloadTrustManager.class1KB
-
data/java/metasploit/RMILoader.class1KB
-
data/java/metasploit/RMIPayload.class498B
-
data/meterpreter/elevator.x64.dll.dll 88KB
-
data/meterpreter/elevator.x86.dll.dll 76KB
-
data/meterpreter/ext_server_espia.x64.dll.dll 199KB
-
data/meterpreter/ext_server_espia.x86.dll.dll 198KB
-
data/meterpreter/ext_server_extapi.x64.dll.dll 155KB
-
data/meterpreter/ext_server_extapi.x86.dll.dll 128KB
-
data/meterpreter/ext_server_incognito.x64.dll.dll 111KB
-
data/meterpreter/ext_server_incognito.x86.dll.dll 103KB
-
data/meterpreter/ext_server_kiwi.x64.dll.dll 991KB
-
data/meterpreter/ext_server_kiwi.x86.dll.dll 810KB
-
data/meterpreter/ext_server_lanattacks.x64.dll.dll 222KB
-
data/meterpreter/ext_server_lanattacks.x86.dll.dll 176KB
-
data/meterpreter/ext_server_mimikatz.x64.dll.dll 529KB
-
data/meterpreter/ext_server_mimikatz.x86.dll.dll 397KB
-
data/meterpreter/ext_server_peinjector.x64.dll.dll 117KB
-
data/meterpreter/ext_server_peinjector.x86.dll.dll 103KB
-
data/meterpreter/ext_server_powershell.x64.dll.dll 181KB
-
data/meterpreter/ext_server_powershell.x86.dll.dll 163KB
-
data/meterpreter/ext_server_priv.x64.dll.dll 128KB
-
data/meterpreter/ext_server_priv.x86.dll.dll 113KB
-
data/meterpreter/ext_server_python.x64.dll.dll 6.4MB
-
data/meterpreter/ext_server_python.x86.dll.dll 5.4MB
-
data/meterpreter/ext_server_sniffer.x64.dll.dll 423KB
-
data/meterpreter/ext_server_sniffer.x86.dll.dll 415KB
-
data/meterpreter/ext_server_stdapi.jar.jar 45KB
-
data/meterpreter/ext_server_stdapi.php.ps1 39KB
-
data/meterpreter/ext_server_stdapi.py.py .js 94KB
-
data/meterpreter/ext_server_stdapi.x64.dll.dll 407KB
-
data/meterpreter/ext_server_stdapi.x86.dll.dll 370KB
-
data/meterpreter/ext_server_unhook.x64.dll.dll 89KB
-
data/meterpreter/ext_server_unhook.x86.dll.dll 83KB
-
data/meterpreter/ext_server_winpmem.x64.dll.dll 1.3MB
-
data/meterpreter/ext_server_winpmem.x86.dll.dll 1.3MB
-
data/meterpreter/meterpreter.jar.jar 47KB
-
data/meterpreter/meterpreter.php.ps1 47KB
-
data/meterpreter/meterpreter.py.sh .js 52KB
-
data/meterpreter/metsrv.x64.dll.dll 200KB
-
data/meterpreter/metsrv.x86.dll.dll 175KB
-
data/meterpreter/screenshot.x64.dll.dll 198KB
-
data/meterpreter/screenshot.x86.dll.dll 198KB
-
lib/metasploit-payloads.rb4KB
-
lib/metasploit-payloads/version.rb114B
-
metasploit-payloads.gemspec2KB
-
data.tar.gz.sig256B
-
metadata.gz.gz 4KB
-
metadata9KB
-
metadata.gz.sig256B
checksums.yaml.gz
- SHA256 a531632c08fc5d67068da1068672f206d17a20cf10d0ec2631480e8c45dc9fb1
- MD5 ba20ade08651abc554d11b7311ca74fe
- SHA1 d892907c39900887d4eaab0811677e73ca07704e
- SHA512 08762282924cdb8fdc890c635945f0e4be1d33833dfa682d399651a2c6c5dac26932a0b159298601507b62891fd3451673daa046b294985df490d020437c57bd
- MD5 SHA1 SHA512
checksums.yaml
- SHA256 ee91e34cffd18239f2938767ba8d535eb2b9f7172dc7cdafdcaac863f695020e
- MD5 6e494a6792c048bbb985306d55d8fd13
- SHA1 e2c414da175b39e7d2559338c17fc9ea4d3a941f
- SHA512 2437a2c7f8ad33c85ac732319fc212a88ec58217faba56c5371e25dbd377eea51397b68bcadbaae264a00faff65e95f52e626c311d4005101aaba6b2dcd38fed
- MD5 SHA1 SHA512
checksums.yaml.gz.sig
- SHA256 4eb3f62c2fc8c55a659401ba8640615810e3f70cd3e90a2318c8d2293e5e5a34
- MD5 b96523f5460bc185ebc735b225099afd
- SHA1 0355b6e67c93078625c39320aa4748581b8c9a8e
- SHA512 c49c737daaddfe29670c94cc38ac407d8c55a563f85fb95c217e6d3287c7cb08a7cad208a21775c11c1477690a26fe40dff420d60324374cf3222c659ece7f2f
- MD5 SHA1 SHA512
data.tar.gz
- SHA256 4626455cbccbd50746623cf539e76d5e8214a7c973fc44c9ed0fbffff9c65e3e
- MD5 244f2b72e235df5677e9db76ed2cc104
- SHA1 5e5ee99f41c051880876e4895a3633f79b239cdb
- SHA512 5d842c3499f835d32b25dc0b4164266ad84b0cc3b9c6bba33fbed77e082eaa31c60ae1de411cc8eb2a42c4150d11c79b95d829a318f85ba6e11077fcffbeb5ad
- SSDEEP 196608:FrCQPyBqK8Jn/RmSgKz84j41mvi18m5Fn3mMLBjnP/BbwjWWUZGIyk7MUWfZ:9eq/npHgZ318U/FsTUoIyk7rM
- MD5 SHA1 SHA512 SSDEEP
data.tar
- SHA256 7dce1875380b33521ba701fdb7c7f5b7c30da6723b0984d23e7383eecca949a6
- MD5 8bb3635abbd1922d64d53244a24860ec
- SHA1 bc779efd834eb3d2e809bf0d20f99b3b7b9e0a31
- SHA512 d95e4ce34184acc6d8e7c109a28805f02790fad51a51a111ea2dd2df3dfd099d1a179f519bcd8128f22b2257c4f0bbb945ecbea15e6de7f07d581dacafb3a7fe
- SSDEEP 196608:J878tY+QV1JiZJVBW9SuE+pzDcNDwOYPE9332EzDcNDwmf0BAblw:J878CX1JiZJVBeU+rOkbqmsmblw
- MD5 SHA1 SHA512 SSDEEP
.gitignore
- SHA256 9d03413da95f50dcc161b7f12814f7255a2502145bd35452b328139e62c6679d
- MD5 600218541e07744160c45e46cba70873
- SHA1 7f1fd067d953f365a1da881f90f71cb6a147d0f9
- SHA512 13ec60712cea2f490855464cc40e9acddf0f3de043e0b248fcd8682309217119f853d983b18b6e67836a57d4759ef8706ef79dccf48b204fe446b513c713d68a
- MD5 SHA1 SHA512
CONTRIBUTING.md
- SHA256 b469669a873ea37fe14b2d0772c90115eee84350350608be3d6640bfd8219173
- MD5 a8054ede7c87f12319806ae1e09b084a
- SHA1 1c4765f4a65d809ceb39b98059eeff8481dd2ae9
- SHA512 7511babc845914435552b4e4b2a982321d88c69d9d82291ee0396cb4f94c777897771e1d128dd22e94ffd7898c40e7a56391eba9f1850345b7c746361114954a
- MD5 SHA1 SHA512
Gemfile
- SHA256 ab6da551c5aa30acd8a7e798bd30b176d6abcd346a90141478a6344f8d92f2f7
- MD5 27df4318d010d56d5a5024af31ea4341
- SHA1 cd04b16fb9142cb5b8e0b8980d20e44d6d83a6b0
- SHA512 e64f0bf68bcb9a8128058428ae221a78686f9ea1e50a51a80d903d149986f2831822fac573ac32985aff689e3b9d9bcfa9e172ccf66bbbf22b24944bcaca1da6
- MD5 SHA1 SHA512
LICENSE
- SHA256 4dee2476bf9d2adaa3f71d38875b4f3d84ff21ab9bc33e09ab953b95932cb9ac
- MD5 9309fb93d95db47d9d11c907d2473595
- SHA1 e04c9f1a06604dc036ff27803e83fb4fe1410f25
- SHA512 8d4b14c52a31267e9395c1b4f64a08362d8ef1d15555b47a3850f8fcab42feeb4a5a3a96c78d739bea9f5ad2a751ddbb7377fd62c765b673235da39206096ba2
- MD5 SHA1 SHA512
README.md
- SHA256 5f99ec219b733120e1b14b56837f659e585db5c6115885d730a6067539dfa7c5
- MD5 498ffd7da3cd74743179903050cced5e
- SHA1 6a54ed59620b2a410bcc4ff1d9815412e217f1a5
- SHA512 da8208994e343b0f6a5406351e20da45c90720806f1f863069f0f0f264c91449fb6db97fb54b51b570c28faef425b851876737f792f2884b3f807d4fc89b0074
- MD5 SHA1 SHA512
Rakefile
- SHA256 795eb4b96bfc54bb176a472bdf8cf91a4d55ee3f651253a9a94b8e3de2ae2838
- MD5 da0425a94b69d2db60c4e6a2ffc72d24
- SHA1 2570f786fdebee6d0158351f1963dad606844303
- SHA512 1a2c31675c44240065d2f36628196a23e47c4691725371d9690a7c8263f971371114e41c58bb549604eb75cfff85ae9ba80623c2e2bb38d911550abd73b9c6aa
- MD5 SHA1 SHA512
data/android/apk/AndroidManifest.xml
- SHA256 14e52da702f77a55640f72e805f4cbcdd44a6b22bf9520dad0edb7e003200c19
- MD5 b89ab8ae064809a2a5f9c3d7c4df7bd5
- SHA1 de2b54ef218b8688b15fe03f4e3f2a265290f062
- SHA512 51004073748f3a28838d3cfa5a1c3e50b694f676591bcccb748bccd62315e006f29fa40e6777479cbd4e7678f6a6f822ca060186eee52fb2865293e34776b57a
- SSDEEP 192:3gSnWybh3YboZtPJGe+vnv5FOfXyiIpKFbrYM0tV451UOSyrt+WFA:3gSWybh3YboZtPJGeQv5FOfXyiIpKFbE
- MD5 SHA1 SHA512 SSDEEP
data/android/apk/classes.dex
- SHA256 5958dc35e276cc36d12099b77450761851337a2622549b1d96edc3d6588b34e8
- MD5 b1d2d0b18e280a971b527e60d6608fee
- SHA1 5768cbf5ce9989130e3a7203e80b86307127d0ff
- SHA512 b0005a65325f79f10489f7f3d8d83239f2c3558b5dabfdc3898310152a3a632c1075e8731617c651d238f0c0ff508758c31cfa48455f8e8be0f9f049077b3f56
- SSDEEP 192:BMzAJKGWlwh9axVRO2SDqXY+oUImEHJoMle/Tx/:arGWqh9f2SDqorHJW/Tx/
- MD5 SHA1 SHA512 SSDEEP
data/android/apk/resources.arsc
- SHA256 5d36dc2c2f9a30563fcea2ccd7d595b365a6300b76d3e2c0b9103eda31094f5d
- MD5 563f0d79de64193775e0b8e706b4482e
- SHA1 abab4b159d149b8a36f93bf58938149a525f4d20
- SHA512 b03e228ac3ebf66e33bdface08cc2d17f44e405b80ad423bda1a5b75e19b23395d8c7e9bdd11396f471c50ca8a8d3c094873dfa115fcd25453914a6e4c7dc3e0
- MD5 SHA1 SHA512
data/android/meterpreter.dex
- SHA256 e8c38dc1a11a50e73be7bbc983455d104973f58361e8e1eb2dd18f0a9be5af2f
- MD5 7d9586906b538e34ac85e4fde8ea399c
- SHA1 1ba58815fc96669944adbfb5ec0252f500d4d72e
- SHA512 5753b0616fd87405210c4dd28ec94c6a645a1b7915ba85ca33615d081339064efa2667cbe7ed33290fa94e401e9a76340688e100ba98c1631ee10080cbfccc17
- SSDEEP 3072:ndD8V8yHIqLeE+RMQpvZcUe7DAJ8LdVG4c8XSRS6Kvr75AsNseBoIHDBLTJOl:dDp5EXkvZcUe7DAJYdVG4cIrayoIHDBC
- MD5 SHA1 SHA512 SSDEEP
data/android/meterpreter.jar
- SHA256 527d3ad9eec2ebe5c0c0b8ea90da48235bfd2859a61dc9b4db7358294957ad5a
- MD5 b17b4a3c890b248188833d62d3f3db53
- SHA1 021cb1d8339a9b695a0239287e04c5641f03b9e4
- SHA512 9b5c3260b9a1898bf1cf4105ed4edd8b8a790da804e11ea6a9e558ea823bbfc3db5a44e46877aee4ffdfe41bb76008e77b433382e7b1960b63b2e7cda9913ea6
- SSDEEP 1536:vaEh5XIcLkoxQRywHbjPJ5VQMuIfPexFxYIQcM3sipFiU45kc6:vVhpTLkrR3vhDdXeXx7QcE8xm
- MD5 SHA1 SHA512 SSDEEP
data/android/metstage.jar
- SHA256 086362514c5d043ab7d7a733f88fc92c29e71053457f157879c29b3dfb7fdf55
- MD5 cd2abb7f287f66688ae1bcdaecb2ddfd
- SHA1 7a911588d4bc8381be004663826ee2d1fa530c65
- SHA512 0a20421824c4416c3de9fcbbac60aa4359cf371f4420a6a99bc3b3b3cabc0764c8664a8862425b3d46fa84d9a8afd5f04f4737e5c5333bd14d5af04536867e58
- MD5 SHA1 SHA512
data/android/shell.jar
- SHA256 6068086aef2927bdd5878a334a3a8d2986c47d8e901da3568c03c01bc8f9a327
- MD5 ca09ab9053f634845c9036d44cbd78be
- SHA1 6087585584e85bcc16e50707ccfcd8c288647cae
- SHA512 5a3fa9e30df46fd8bbc82d13932f5c51beab1d043d8f719f46cec70891cd3e44f6db9c00c1e8f7d53426554184f609df0c02a28b04b1f2e28c798c40045db6bd
- MD5 SHA1 SHA512
data/java/com/metasploit/meterpreter/MemoryBufferURLConnection.class
- SHA256 2ae3e05c928fca9d8888566a12a95bf1bb83166692651a51377310305dda0333
- MD5 a0aca3ff5f34a5263ffa923e4783f666
- SHA1 24928a1a43afda7f7e1bd1d7eceaf050f2312cd2
- SHA512 5a817df4c2f7bef45dd5cbee0ac5812f6245e7b7c1bc76d3397a78b8373ede1599fd0849796e6bc4eb88d7ff147bd424cbc4412e4a8c2b2c83b6207c74324a56
- MD5 SHA1 SHA512
data/java/com/metasploit/meterpreter/MemoryBufferURLStreamHandler.class
- SHA256 e17f7e76c540d3b1cf314262bd32756ccf4e508ac201f115ec6b16f5e7a0dded
- MD5 cd2f61f20d45b812d5c2472a380d3b6f
- SHA1 310e0d5dc3d72ec0edb88634b50f18b69dad034b
- SHA512 1b095784a42dcbb8552147a0268ebe6fccabe54702f89621fdfef08c6ccdba8a7ee2144a7953b84ce0ab4b0df09a3cbc040565fcea43dec43a35e7fc810fddc5
- MD5 SHA1 SHA512
data/java/javapayload/stage/Meterpreter.class
- SHA256 6b7fc3ba4eb116a803ad6f8b7ee3be2ccf479a1106890f116f02aa06e96126d8
- MD5 2affb7e10add13e032cfcf7154392181
- SHA1 7d220a9a9808c0e63154d996d32ffa28f5995dbc
- SHA512 434f1dfb9cdd98da9ced3d5b4689d9a58707a304ed3d81a186e25253e8de3a176b9de5829dd222a0b9361ad112db074d1248dac29bcced23da79c52e399df30d
- MD5 SHA1 SHA512
data/java/javapayload/stage/Shell.class
- SHA256 211bf53e92ee841ad611902731f7b29a97ef45db2238d2464112cb23540af396
- MD5 aa461f60b4739ff79b3394d2e628821c
- SHA1 6ff1345917c18cf6bf21c26deac405989d46fce8
- SHA512 1c8386b02315470fe7f0a14932ca84b46cbd6beb1c24bc8d4890bdfaab58ade876e0750a72f1678cb824b880da662c40c1abd03897759f2b87be62d58bbfd8b2
- MD5 SHA1 SHA512
data/java/javapayload/stage/Stage.class
- SHA256 c0bdef98a4a29a70c34ca6b8866a50e9dd88924aea5fd2d62c9cfdf9aeb08235
- MD5 9ba4719f65a14ce08344e016299645ee
- SHA1 5f0c8580fd846c35aef1b709ea16fdb08af56571
- SHA512 f0897f9afa4fc493e28c7a330c300c982bafa1f00f8fef3e328192dd60abe02f68b8d9a7528208e5cf257dd134785636445aad7c083e0483d0da3558f516bb93
- MD5 SHA1 SHA512
data/java/javapayload/stage/StreamForwarder.class
- SHA256 76c8a99cdcecf9bfd1d4e03dd67fc0182271cb36d42cca93e31bb4ca5f5cc4d2
- MD5 14282f9002642627486bf322dda59410
- SHA1 d258813bd351a77e5dc8d65dd665b94e3b5a822f
- SHA512 661c7354790a1b6301dfccf4a52b7d76833dc09dc08ee8119387a194e19be4f7e2632af35ca329d08310dff7b7a5af6967b9355c3c8e20776472fef7d254b24e
- MD5 SHA1 SHA512
data/java/metasploit/AESEncryption.class
- SHA256 0998a55a7d786dd0db2720734521505e1168dc7ec0d75451a6732983894c084f
- MD5 1dca849762761218305efd77218ce62b
- SHA1 d93205ac29f4e8b2564e0b91eb5ab72b221f9a65
- SHA512 c37b83f4131f253b39aab838f444ae79d5713c4330a38e55e75cc02e6c540b38d0155c0c154a1ab27f07e049fecaadd8f7c61f36d15d7e208f130a51b7b7893e
- MD5 SHA1 SHA512
data/java/metasploit/JMXPayload.class
- SHA256 81ccd91f0bf5f11874534abc128c78365a87fdbba7cca2573a8c0409d890f619
- MD5 87756fd44d64e356f509e2c694f2db9b
- SHA1 181d26b709502f2dcf93011503ba6a90aac399d5
- SHA512 a3822941b4ed52bdc0598ee803378fe898fa1c6ed5997758817de59677f46c9485fcc11a73e7caa264096ed919d3d903febc9ff172649edca78f15f3eaaacd6a
- MD5 SHA1 SHA512
data/java/metasploit/JMXPayloadMBean.class
- SHA256 89a2395fe23607c41f5292f6aa22565e69d557bf529166f7c6e3c2d89b6c41b8
- MD5 085d95ceddf953cd94e138d0d8abce4b
- SHA1 ef1103236a4701921b00cb30241db80791aa62d4
- SHA512 ff5ddf968437180bd1b017e8fc3adcc2468bd68b35a5001ce909d69d5a9ae670971342e034dbf459bd2856fcee820ad33f29a362917e3c6d05c7b6bfe44ba6f4
- MD5 SHA1 SHA512
data/java/metasploit/Payload.class
- SHA256 93599b9c8d54a2198a10d4fe9b771515cc805fd1d0fd991d8c9a454d5c570f3a
- MD5 df67ee317a6aecfdd989bc3a4a66aec2
- SHA1 4e6c35d65a0b922154a482e1784d3be83390c288
- SHA512 c52a5644fcd5ee343bbf8a59954f0ee26e23567e089b07a5c06e0815812fdd08030cfa006f717a865743ac0d4d4bbae065cdba806966e7bc1c5e6941d1ebfd71
- SSDEEP 96:NP970D9S68FIBzIv1Dfjyxxocj9RNYCAInPqxkacHpleZsZQpPxRH6hAzaY4vsvj:N5iS6NG1SjtjfNYCFnPgZ64p
- MD5 SHA1 SHA512 SSDEEP
data/java/metasploit/PayloadServlet.class
- SHA256 9148a9b109f6e8ebde9d319c32d25de5437cb18ee223f72324c5479760ab8375
- MD5 fde9d6537fad39bd44159a8c14abe4d7
- SHA1 969ab78ed8999b229dc22bbc3e56b2dc3d53208d
- SHA512 511cb8521d82b2a38d7c66ec126d3f9ce388b4b635e097a78187293ec868b70928ac98297df4f8cd9e6c580c59919e2fc4310ff5b70b38eb92aad97fdf3a0293
- MD5 SHA1 SHA512
data/java/metasploit/PayloadTrustManager.class
- SHA256 ce3371d4eee2cc2f0fea99a9d68de2246fc63a0696b9fbddbad1882043bcc5ef
- MD5 84fb679f420903d9856a0c6d87374ec2
- SHA1 fdf23fcb24ca1180131ab1e72d90a21c899e4e0a
- SHA512 7424b673592ff24e2525a1428c4b1ddbaa39c162ea1a3afbc38f57ff8f4868c5f53f67a93046e245551cf4845afa76566a8a9593adc9bed0cbd66d7a0eb6aee3
- MD5 SHA1 SHA512
data/java/metasploit/RMILoader.class
- SHA256 1a68325ad4c8439cc2bb2ae0c598b91f1c37ea49cd1c2bf0966e82395444a0c6
- MD5 05307216ce549b035112880f1cfa3a4b
- SHA1 bafae576267e4ad441b3fe16b3f3407efeee772c
- SHA512 abed8a0ae674e4d1f2033642c403b7bd28f210026b47b92f2c97083d79f7db430ba7e37f72c96f6cd37618f48e58e299dafebff383052ea9ba4da6ebbbc97a7a
- MD5 SHA1 SHA512
data/java/metasploit/RMIPayload.class
- SHA256 508d587499d1eb10f3812c7c21243c1a29b630305a238c1cd6a917f60b655f02
- MD5 aa34354101bcbd4250f67fc046d5bc3e
- SHA1 12b24d65d7e0f684b009d9112cbbcbaf94b75a4f
- SHA512 58edbf1ccfb684811542089670f963c7fec33e5fb71a7c128de8ad21a5dd935c3632ccda73cb6312f2ca7dc6c54d360fed7718aa11bdd6384094d1bbefa334d1
- MD5 SHA1 SHA512
data/meterpreter/elevator.x64.dll
- IMPHASH db30ab1188e9f9fd120bcbcaad845d09
- SHA256 345c36cdd66c4e9dded155ca29ebf9ee511149e843597bad1ac8ee86ba51b41d
- MD5 2b6c2df1f5ff252475f4186c8bce48d5
- SHA1 434dc1cca582512de355d01c5d8650fab025c163
- SHA512 443cae23dcde182f9d5c0b21266cc03ad187ae63ee917278f9281ea6f460cb0857faf91b11e633007ab8b5c21e47d6aa3251f2a9f6da0fd740116405f0e577c1
- SSDEEP 1536:SUinI/YHATZcOZf8M7E9anDP2Floz7ykPVHdY8V/sW4daTm3Cc:ShIAgTSOV8M7E9anDP2SGG3gaT/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
6012
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
GetCurrentProcess
GetLastError
LoadLibraryA
CreateEventA
Sleep
WriteFile
SetEvent
WaitForSingleObject
CreateFileA
ExitThread
GetProcAddress
ExitProcess
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
EncodePointer
DecodePointer
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
MultiByteToWideChar
HeapAlloc
GetModuleHandleExW
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
LCMapStringW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
GetModuleFileNameW
LoadLibraryExW
HeapReAlloc
SetStdHandle
WriteConsoleW
OutputDebugStringW
HeapSize
FlushFileBuffers
CreateFileW
advapi32
AllocateAndInitializeSid
DuplicateTokenEx
SetThreadToken
OpenProcessToken
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
FreeSid
ReflectiveLoader
a
Name
.text
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=31, id=225, version=20806,
count=106, id=224, version=20806,
count=8, id=223, version=20806,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=92, id=1, productName=Unmarked objects,
count=3, id=228, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/elevator.x86.dll
- IMPHASH ac83dcf5b14ce9a671baa4aca9d1c533
- SHA256 a3eb3f5f0905b345ab48642e3cbff98208f4ae51c4a27ce8a89ed3dd36d3849b
- MD5 ff44f1e7bac85f527cab7bef9d91bf7f
- SHA1 2aaf12aefe339530c6d2c579ca56a5a549f7bd1c
- SHA512 f25cd338719befbd478c6e052979d55da7455258d9bb5d8dbc79492180fa5577f14d26189a3f1d0b1d20cfa994e84b5638a4f4c44804cd0752a954f8fbac466b
- SSDEEP 1536:lcWGtOgkEfV5cT8lmChewecbFxYcs/IHsWjcdvw:lcptDkofzhxAvw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
6057
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
GetCurrentProcess
GetLastError
LoadLibraryA
CreateEventA
Sleep
WriteFile
SetEvent
WaitForSingleObject
CreateFileA
ExitThread
GetProcAddress
ExitProcess
GetCommandLineA
GetCurrentThreadId
IsProcessorFeaturePresent
IsDebuggerPresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
MultiByteToWideChar
HeapAlloc
GetModuleHandleExW
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
LCMapStringW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
GetModuleFileNameW
LoadLibraryExW
RtlUnwind
HeapReAlloc
SetStdHandle
WriteConsoleW
OutputDebugStringW
HeapSize
FlushFileBuffers
CreateFileW
advapi32
AllocateAndInitializeSid
DuplicateTokenEx
SetThreadToken
OpenProcessToken
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
FreeSid
_ReflectiveLoader@4
_a@16
Name
.text
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=31, id=225, productName=VS2013 build 21005, version=21005,
count=17, id=223, productName=VS2013 build 21005, version=21005,
count=110, id=224, productName=VS2013 build 21005, version=21005,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=87, id=1, productName=Unmarked objects,
count=1, id=223, productName=VS2013 UPD4 build 31101, version=31101,
count=3, id=228, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_espia.x64.dll
- IMPHASH 08c5b4e8b3d7e279da32d10b0d63d540
- SHA256 1c5d0745e850f8269ed23e2131f2b1c59090dfcaab8bd63c4eddf13fd85a5f9d
- MD5 56f8f3232cddabc308e6ea2ffb6f8d80
- SHA1 0480395ffd07280f5008a988ea98bf611885ad66
- SHA512 bf24a4570f73c0ac7744dde1e4e440ab557047cd063f68e959e5ed961bc92b52fff554650ac029c5762f1f3f58eed39f621279bae0f76853c9113ee9f412f159
- SSDEEP 6144:V43ggA45AVlj6AENhib0WPn1TUaMws/1IancTGx/c:wAtKobfP+aB3ZC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
88756
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
WriteConsoleW
SetStdHandle
SetFilePointerEx
SetEnvironmentVariableA
CloseHandle
CreateFileW
ReadFile
LocalAlloc
GlobalFree
GlobalAlloc
SetUnhandledExceptionFilter
ExitThread
ExitProcess
GetStringTypeW
GetLastError
LCMapStringW
RaiseException
FreeLibrary
GetProcAddress
LoadLibraryExA
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineA
GetCurrentThreadId
EncodePointer
DecodePointer
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
IsDebuggerPresent
IsProcessorFeaturePresent
RtlUnwindEx
GetProcessHeap
GetStdHandle
WriteFile
GetModuleFileNameW
SetLastError
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
FlushFileBuffers
GetConsoleCP
GetConsoleMode
OutputDebugStringW
HeapSize
CompareStringW
ReadConsoleW
user32
GetSystemMetrics
SetWindowLongA
GetWindowLongA
ShowWindow
DestroyWindow
IsWindow
SendMessageA
GetDesktopWindow
ReleaseDC
GetDC
gdi32
SelectObject
GetDIBits
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
GetObjectA
avicap32
capCreateCaptureWindowA
capGetDriverDescriptionA
winmm
mciSendCommandA
DeinitServerExtension
GetExtensionName
InitServerExtension
ReflectiveLoader
controlcam
controlmic
Name
.text
Size
140KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=119, id=224, version=20806,
count=9, id=223, version=20806,
count=38, id=225, version=20806,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=24, id=207, productName=VS2012 UPD3 build 60610, version=60610,
count=115, id=1, productName=Unmarked objects,
count=6, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_espia.x86.dll
- IMPHASH 1d8c05c04a8f20d6e22dfd52c5b4ba86
- SHA256 ddfc94a4eabe54ce8036ed081756ea5d9ecda89565b77d0143ee842a9d05131f
- MD5 827d7088577ae38b1a5b7d065e206f87
- SHA1 b578c44dffb867cc74a30c4ee129741ae9c5cfcc
- SHA512 ed00d5b469b59ecd5246453c7097be6d8239972014bb368f47bbff2e64844b2251269b6ded702fb008b5f347a660177f12abe99e6250b0469d85de6dbadaba3b
- SSDEEP 3072:aKxphNiufd9Al6I4WWCUy4wd6wAsliJvS2/HfUgMgz1R4:aK73iWAl6I4WWCUy4wd6wA7r/HXMv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
110063
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
WriteConsoleW
SetStdHandle
SetFilePointerEx
SetEnvironmentVariableA
CloseHandle
CreateFileW
ReadFile
LocalAlloc
GlobalFree
GlobalAlloc
SetUnhandledExceptionFilter
ExitThread
ExitProcess
GetStringTypeW
GetLastError
LCMapStringW
RaiseException
FreeLibrary
GetProcAddress
LoadLibraryExA
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineA
GetCurrentThreadId
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcessHeap
GetStdHandle
WriteFile
GetModuleFileNameW
SetLastError
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
FlushFileBuffers
GetConsoleCP
GetConsoleMode
RtlUnwind
VirtualQuery
OutputDebugStringW
HeapSize
CompareStringW
ReadConsoleW
user32
GetSystemMetrics
SetWindowLongA
GetWindowLongA
ShowWindow
DestroyWindow
IsWindow
SendMessageA
GetDesktopWindow
ReleaseDC
GetDC
gdi32
SelectObject
GetDIBits
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
GetObjectA
avicap32
capCreateCaptureWindowA
capGetDriverDescriptionA
winmm
mciSendCommandA
DeinitServerExtension
GetExtensionName
InitServerExtension
_ReflectiveLoader@0
controlcam
controlmic
Name
.text
Size
159KB
Virtual Size
158KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=223, productName=VS2013 build 21005, version=21005,
count=125, id=224, productName=VS2013 build 21005, version=21005,
count=38, id=225, productName=VS2013 build 21005, version=21005,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=24, id=207, productName=VS2012 UPD3 build 60610, version=60610,
count=111, id=1, productName=Unmarked objects,
count=1, id=223, productName=VS2013 UPD4 build 31101, version=31101,
count=6, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_extapi.x64.dll
- IMPHASH 2cc392a77685bbbb068ec4f3526e525b
- SHA256 329f2b46e8364f3e7ffb7ce7014701bdc91308d00661f215fce082d13f8aecd2
- MD5 531890f212e30f9b2d22f798de81ee48
- SHA1 0f6aeb7c099b96dcb201ff0dcd78b6830d9cbedd
- SHA512 e94a7acd756b6248ef5821fab41e227384e783d82537afe1d15f845a031b8268cc206d2599dc8eaaeb301758d207e333660ac3fc0dfd9bdfb3813ae0c6b0d750
- SSDEEP 3072:8t2hrSrmhE3edSpLNTjpVr1e45tC6rOKKsqexc4htT:Xkrmy3egNTjr8UVrR3htT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
44112
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
gdiplus
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipDisposeImage
GdipSaveImageToStream
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromGdiDib
ws2_32
htonl
kernel32
SetLastError
CloseHandle
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
Sleep
FreeLibrary
LocalAlloc
FormatMessageA
GetStringTypeW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
OutputDebugStringW
LoadLibraryExW
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetModuleHandleW
GetDateFormatA
GetTimeFormatA
FileTimeToSystemTime
GetFileAttributesA
ExitThread
SetUnhandledExceptionFilter
ExitProcess
GetModuleHandleA
lstrlenA
lstrcmpA
GetSystemTime
WaitForMultipleObjects
GetLastError
LoadLibraryA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
RtlVirtualUnwind
RtlCaptureContext
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
GetStartupInfoW
DeleteCriticalSection
GetFileType
RtlPcToFileHeader
GetCPInfo
GetOEMCP
lstrlenW
LocalFree
GetProcAddress
GetACP
LCMapStringW
HeapSize
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileW
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
RaiseException
LoadLibraryExA
CreateThread
TerminateThread
ResumeThread
SetEvent
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateEventA
MultiByteToWideChar
WideCharToMultiByte
SystemTimeToFileTime
HeapFree
HeapReAlloc
HeapAlloc
RtlLookupFunctionEntry
RtlUnwindEx
GetCommandLineA
GetSystemTimeAsFileTime
GetProcessHeap
EncodePointer
DecodePointer
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
user32
DefWindowProcA
TranslateMessage
DispatchMessageA
PeekMessageA
SendMessageA
UnregisterClassA
RegisterClassExA
FindWindowW
SetWindowLongPtrA
GetWindowLongPtrA
ChangeClipboardChain
SetClipboardViewer
DestroyWindow
CreateWindowExA
advapi32
CryptDeriveKey
CryptDestroyKey
CryptGetHashParam
CryptEncrypt
CryptCreateHash
CryptReleaseContext
CryptDestroyHash
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
CryptHashData
CryptAcquireContextA
ole32
CoUninitialize
CreateStreamOnHGlobal
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoInitialize
oleaut32
VariantChangeType
VariantCopy
VariantClear
VariantInit
SafeArrayGetVartype
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SysFreeString
SysAllocString
SafeArrayGetDim
activeds
ord9
esent
JetTerm
JetBeginSession
JetOpenTable
JetInit
JetCreateInstance
JetSetSystemParameter
JetAttachDatabase
JetDetachDatabase
JetGetTableColumnInfo
JetOpenDatabase
JetCloseDatabase
JetRetrieveColumn
JetMove
JetEndSession
DeinitServerExtension
GetExtensionName
InitServerExtension
ReflectiveLoader
Name
.text
Size
95KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=117, id=224, version=20806,
count=10, id=223, version=20806,
count=53, id=225, version=20806,
count=1, id=136, version=30729,
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=207, id=1, productName=Unmarked objects,
count=3, id=225, productName=VS2013 UPD4 build 31101, version=31101,
count=17, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_extapi.x86.dll
- IMPHASH c90b1281bafc9431033947b7a9923d14
- SHA256 1b86603e7cff24a6256218f26ba01c32fec3935fd5c5e41ef48533728d091a86
- MD5 27f4d41b653b3a0236e2ec2b72b05211
- SHA1 6188df6dab32c6fed46e8dc3c8ae3091a17e699e
- SHA512 af458d3400ec310ac3bb64a1aa786e98c6f6a69bbe2714c8e765cc5c6d490525f6e2c14fd397b3faf57ae12aba9fd86242644fef186feda1eabd3e44f5cbe78c
- SSDEEP 1536:EC8MJqGJY5FH+Jsu0spROieWaWQfEHzN5PGRJNSc+B0FsWjcdPUxm/iDh:EC8MJqGJYrfExeWaWy0NWuBXPCm/i1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
38534
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
gdiplus
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipDisposeImage
GdipSaveImageToStream
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromGdiDib
ws2_32
htonl
kernel32
SetLastError
CloseHandle
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
Sleep
FreeLibrary
InterlockedDecrement
LocalAlloc
FormatMessageA
GetStringTypeW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
OutputDebugStringW
LoadLibraryExW
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetDateFormatA
GetTimeFormatA
FileTimeToSystemTime
GetFileAttributesA
ExitThread
SetUnhandledExceptionFilter
ExitProcess
GetModuleHandleA
lstrlenA
lstrcmpA
GetSystemTime
WaitForMultipleObjects
GetLastError
LoadLibraryA
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
GetStartupInfoW
DeleteCriticalSection
GetFileType
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
IsProcessorFeaturePresent
lstrlenW
IsDebuggerPresent
LocalFree
GetProcAddress
LCMapStringW
HeapSize
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileW
InitializeCriticalSectionAndSpinCount
VirtualQuery
RaiseException
LoadLibraryExA
CreateThread
TerminateThread
ResumeThread
SetEvent
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateEventA
MultiByteToWideChar
WideCharToMultiByte
SystemTimeToFileTime
HeapFree
HeapReAlloc
HeapAlloc
RtlUnwind
GetCommandLineA
GetSystemTimeAsFileTime
GetProcessHeap
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
user32
DefWindowProcA
TranslateMessage
DispatchMessageA
PeekMessageA
SendMessageA
UnregisterClassA
RegisterClassExA
FindWindowW
SetWindowLongA
GetWindowLongA
ChangeClipboardChain
SetClipboardViewer
DestroyWindow
CreateWindowExA
advapi32
CryptReleaseContext
CryptDeriveKey
CryptDestroyKey
CryptGetHashParam
CryptEncrypt
CryptCreateHash
CryptHashData
CryptDestroyHash
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
CryptAcquireContextA
ole32
CoUninitialize
CreateStreamOnHGlobal
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoInitialize
oleaut32
VariantChangeType
VariantCopy
VariantClear
VariantInit
SafeArrayGetVartype
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetDim
SysFreeString
SysAllocString
activeds
ord9
esent
JetMove
JetTerm
JetBeginSession
JetEndSession
JetOpenTable
JetInit
JetCreateInstance
JetSetSystemParameter
JetAttachDatabase
JetDetachDatabase
JetGetTableColumnInfo
JetOpenDatabase
JetCloseDatabase
JetRetrieveColumn
DeinitServerExtension
GetExtensionName
InitServerExtension
_ReflectiveLoader@0
Name
.text
Size
87KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=225, version=20806,
count=21, id=223, productName=VS2013 build 21005, version=21005,
count=124, id=224, productName=VS2013 build 21005, version=21005,
count=47, id=225, productName=VS2013 build 21005, version=21005,
count=1, id=223, productName=VS2013 UPD4 build 31101, version=31101,
count=203, id=1, productName=Unmarked objects,
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=225, productName=VS2013 UPD4 build 31101, version=31101,
count=17, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_incognito.x64.dll
- IMPHASH e5857969df34399c4145435fb57c01c3
- SHA256 7af336a52d2ffd481620be89e04efcdf922f869fda3f29e064ff813d47392300
- MD5 d659ba74acca138af6bb04131745425c
- SHA1 23800a4873d85ef99b247132cd3ecc01ffe3d0f7
- SHA512 7f3ddb12a9e068a471a3de7afd7603485600ef39e5d99c523b2c876a53155b7c7079a1005a5c4d6682f3cbff91b935161f81756c936217e2bdd2a797d9bcb867
- SSDEEP 3072:RpOsL59EOHAiRTtrDgZBvXnp/ThNUx5X:RJL59yiRTaZB3JF
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
24052
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
netapi32
NetLocalGroupAddMembers
NetGroupAddUser
NetUserAdd
mpr
WNetCancelConnection2W
WNetAddConnection2W
kernel32
ExitProcess
SetUnhandledExceptionFilter
ExitThread
GetProcAddress
CloseHandle
GetCurrentProcess
DuplicateHandle
GetModuleHandleA
GetLastError
GetCurrentThread
LoadLibraryExW
OutputDebugStringW
SetStdHandle
WriteConsoleW
HeapSize
FlushFileBuffers
OpenProcess
GetCPInfo
RaiseException
FreeLibrary
LoadLibraryExA
MultiByteToWideChar
WideCharToMultiByte
Sleep
GetSystemTime
SystemTimeToFileTime
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineA
GetCurrentThreadId
GetSystemTimeAsFileTime
RtlUnwindEx
GetProcessHeap
IsDebuggerPresent
EncodePointer
DecodePointer
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
CreateFileW
SetLastError
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
GetConsoleCP
GetConsoleMode
SetFilePointerEx
GetStringTypeW
LCMapStringW
advapi32
LookupAccountSidW
LookupPrivilegeNameW
GetTokenInformation
OpenProcessToken
DuplicateTokenEx
ImpersonateLoggedOnUser
OpenThreadToken
RevertToSelf
LookupPrivilegeValueA
DeinitServerExtension
GetExtensionName
InitServerExtension
ReflectiveLoader
Name
.text
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=111, id=224, version=20806,
count=10, id=223, version=20806,
count=33, id=225, version=20806,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=109, id=1, productName=Unmarked objects,
count=9, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_incognito.x86.dll
- IMPHASH bea7a0e9350143687fe8c144beb45ab8
- SHA256 3b8701266529d1e5ef1dcb55b9138d818d1affe949edce90d737293c04f79e14
- MD5 dfbe81a7bf36b40a08b934f5735dc56f
- SHA1 325ef8ab615bc9c844ec758fbeb5ab641752afbc
- SHA512 a7ac07b458b6d89140f1445b17f4cac8e7f84d35afbc1c00de212f776f8471161e26aac0f19682fa5a39cc50bce4d40f2f343c98a9b6641ee6f6a3e7a0e497b4
- SSDEEP 1536:C+rrrK9P7nrQ70Zjxm2Vsu0u4zluWalbFkybJZqVUBge4Yz5+Bac+cyfvtsWjcd1:C+EPCVHpKbFpKVrPB5yikqT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
22083
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
netapi32
NetLocalGroupAddMembers
NetGroupAddUser
NetUserAdd
mpr
WNetCancelConnection2W
WNetAddConnection2W
kernel32
ExitProcess
SetUnhandledExceptionFilter
ExitThread
GetProcAddress
CloseHandle
GetCurrentProcess
DuplicateHandle
GetModuleHandleA
GetLastError
GetCurrentThread
LoadLibraryExW
OutputDebugStringW
SetStdHandle
WriteConsoleW
HeapSize
FlushFileBuffers
OpenProcess
SetLastError
RaiseException
FreeLibrary
LoadLibraryExA
MultiByteToWideChar
WideCharToMultiByte
Sleep
GetSystemTime
SystemTimeToFileTime
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineA
GetCurrentThreadId
GetSystemTimeAsFileTime
GetProcessHeap
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
CreateFileW
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
RtlUnwind
VirtualQuery
EnterCriticalSection
LeaveCriticalSection
GetConsoleCP
GetConsoleMode
SetFilePointerEx
GetStringTypeW
LCMapStringW
advapi32
LookupAccountSidW
LookupPrivilegeNameW
GetTokenInformation
OpenProcessToken
DuplicateTokenEx
ImpersonateLoggedOnUser
OpenThreadToken
RevertToSelf
LookupPrivilegeValueA
DeinitServerExtension
GetExtensionName
InitServerExtension
_ReflectiveLoader@0
Name
.text
Size
71KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=223, productName=VS2013 build 21005, version=21005,
count=118, id=224, productName=VS2013 build 21005, version=21005,
count=33, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=105, id=1, productName=Unmarked objects,
count=1, id=223, productName=VS2013 UPD4 build 31101, version=31101,
count=9, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_kiwi.x64.dll
- IMPHASH 530a21e59982a70053ad157cf5179327
- SHA256 0f5836e1fd30ae95140fda289ef47972f6bd9b03d770700b1986fb8c76a16dc6
- MD5 27e52eecf50be30ad9f32023a483c4fc
- SHA1 0a6a3363abf9d25f81586f3f1f75a1a8194ce408
- SHA512 7a7e6c8545d535e38d8e85a82f455099189f1f37337f1bc85cd0a9d138d4b47826049b91286f7d1f6369c059f5268a5c037af94edc15b731cd38ac07e72a1413
- SSDEEP 12288:G01uBVjkHeieD3pndEf9Uqwyf3YmI2fzStqSqOrSgtx6+I:P+aHFeD3pndEVUqwyfy2mtqJO+gq
- MD5 SHA1 SHA512 SSDEEP
-
mimikatz is an open source tool to dump credentials on Windows
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
539708
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
ncrypt
BCryptDecrypt
BCryptEncrypt
BCryptGenerateSymmetricKey
BCryptSetProperty
BCryptGetProperty
NCryptExportKey
NCryptImportKey
NCryptSetProperty
NCryptGetProperty
NCryptOpenKey
NCryptFreeBuffer
NCryptEnumKeys
BCryptEnumRegisteredProviders
NCryptOpenStorageProvider
BCryptFreeBuffer
BCryptDestroyKey
BCryptImportKeyPair
BCryptExportKey
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
NCryptFreeObject
fltlib
FilterFindNext
FilterFindFirst
cabinet
ord14
ord13
ord10
ord11
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
winscard
SCardListReadersW
SCardControl
SCardGetAttrib
SCardConnectW
SCardFreeMemory
SCardGetCardTypeProviderNameW
SCardListCardsW
SCardEstablishContext
SCardReleaseContext
SCardDisconnect
advapi32
CryptGetUserKey
CreateServiceW
ControlService
CloseServiceHandle
FreeSid
AllocateAndInitializeSid
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
CreateProcessWithLogonW
CreateWellKnownSid
CopySid
CryptDuplicateKey
CryptEncrypt
CryptSetHashParam
CryptAcquireContextA
SystemFunction025
SystemFunction024
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSidSubAuthorityCount
GetSidSubAuthority
CredFree
CredEnumerateW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
LookupPrivilegeNameW
OpenThreadToken
IsValidSid
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
CreateProcessAsUserW
OpenProcessToken
LookupPrivilegeValueW
CheckTokenMembership
LookupAccountNameW
LookupAccountSidW
IsTextUnicode
BuildSecurityDescriptorW
StartServiceW
SetServiceObjectSecurity
QueryServiceStatusEx
QueryServiceObjectSecurity
OpenServiceW
OpenSCManagerW
CryptEnumProvidersW
ConvertSidToStringSidW
ConvertStringSidToSidW
LsaFreeMemory
CryptAcquireContextW
CryptReleaseContext
CryptSetKeyParam
CryptDecrypt
SetThreadToken
GetTokenInformation
DuplicateTokenEx
CryptGenKey
CryptDestroyKey
CryptGetKeyParam
CryptSetProvParam
CryptGetProvParam
DeleteService
CryptExportKey
CryptImportKey
CryptEnumProviderTypesW
SystemFunction006
SystemFunction007
ClearEventLogW
GetNumberOfEventLogRecords
OpenEventLogW
GetLengthSid
CryptDeriveKey
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptSignHashW
LsaClose
LsaOpenPolicy
LsaQueryInformationPolicy
LsaQueryTrustedDomainInfoByName
LsaEnumerateTrustedDomainsEx
LsaRetrievePrivateData
SystemFunction001
SystemFunction005
SystemFunction013
SystemFunction032
LsaOpenSecret
LsaQuerySecret
A_SHAUpdate
A_SHAFinal
A_SHAInit
crypt32
CryptProtectData
CryptBinaryToStringW
CryptStringToBinaryW
CryptUnprotectData
PFXExportCertStoreEx
CertAddEncodedCertificateToStore
CertSetCertificateContextProperty
CertGetNameStringW
CertNameToStrW
CryptEncodeObject
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptAcquireCertificatePrivateKey
CertAddCertificateContextToStore
CertEnumSystemStore
CryptSignAndEncodeCertificate
CryptExportPublicKeyInfo
CertGetCertificateContextProperty
cryptdll
CDLocateCSystem
MD5Final
MD5Update
MD5Init
CDLocateCheckSum
CDGenerateRandomBits
netapi32
NetServerGetInfo
NetApiBufferFree
NetSessionEnum
NetWkstaUserEnum
NetShareEnum
NetStatisticsGet
NetRemoteTOD
DsGetDcNameW
I_NetServerAuthenticate2
I_NetServerTrustPasswordsGet
I_NetServerReqChallenge
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
oleaut32
SysAllocString
SysFreeString
VariantInit
rpcrt4
MesDecodeIncrementalHandleCreate
RpcBindingFree
RpcBindingToStringBindingW
RpcBindingVectorFree
RpcStringFreeW
RpcServerInqBindings
RpcServerListen
RpcServerRegisterIf2
RpcServerUnregisterIfEx
RpcServerUseProtseqEpW
RpcMgmtStopServerListening
RpcEpResolveBinding
RpcServerRegisterAuthInfoW
RpcEpRegisterW
RpcEpUnregister
RpcMgmtEpEltInqBegin
RpcMgmtEpEltInqDone
RpcMgmtEpEltInqNextW
UuidCreate
I_RpcGetCurrentCallHandle
I_RpcBindingInqSecurityContext
RpcBindingSetOption
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcImpersonateClient
RpcRevertToSelf
RpcBindingInqAuthClientW
RpcBindingSetAuthInfoExW
RpcMgmtWaitServerListen
UuidToStringW
NdrServerCall2
NdrClientCall2
NdrMesTypeDecode2
NdrMesTypeEncode2
NdrMesTypeAlignSize2
MesHandleFree
MesIncrementalHandleReset
MesEncodeIncrementalHandleCreate
NdrMesTypeFree2
shlwapi
PathCombineW
PathIsDirectoryW
PathFindFileNameW
PathCanonicalizeW
PathIsRelativeW
samlib
SamLookupIdsInDomain
SamLookupNamesInDomain
SamEnumerateUsersInDomain
SamiChangePasswordUser
SamSetInformationUser
SamQueryInformationUser
SamOpenUser
SamOpenDomain
SamLookupDomainInSamServer
SamEnumerateDomainsInSamServer
SamConnect
SamFreeMemory
SamOpenGroup
SamOpenAlias
SamGetGroupsForUser
SamGetAliasMembership
SamGetMembersInGroup
SamGetMembersInAlias
SamEnumerateGroupsInDomain
SamEnumerateAliasesInDomain
SamRidToSid
SamCloseHandle
secur32
InitializeSecurityContextW
DeleteSecurityContext
FreeContextBuffer
EnumerateSecurityPackagesW
QueryContextAttributesW
FreeCredentialsHandle
AcquireCredentialsHandleW
LsaFreeReturnBuffer
LsaCallAuthenticationPackage
LsaConnectUntrusted
LsaDeregisterLogonProcess
LsaLookupAuthenticationPackage
shell32
CommandLineToArgvW
user32
PostMessageW
DefWindowProcW
UnregisterClassW
SendMessageW
CreateWindowExW
DestroyWindow
OpenClipboard
CloseClipboard
GetClipboardSequenceNumber
SetClipboardViewer
ChangeClipboardChain
GetClipboardData
EnumClipboardFormats
GetUserObjectInformationW
IsCharAlphaNumericW
DispatchMessageW
GetMessageW
GetKeyboardLayout
RegisterClassExW
TranslateMessage
hid
HidD_GetHidGuid
HidP_GetCaps
HidD_GetAttributes
HidD_GetPreparsedData
HidD_FreePreparsedData
setupapi
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList
wldap32
ord127
ord54
ord301
ord304
ord309
ord310
ord145
ord13
ord73
ord208
ord157
ord41
ord26
ord27
ord36
ord88
ord167
ord142
ord77
ord79
ord133
ord147
ord12
ord14
ord203
ord69
ord113
ord140
ord139
ord97
ord96
ord224
ord223
ord122
ntdll
NtCompareTokens
RtlCreateUserThread
RtlGetCurrentPeb
NtQueryInformationProcess
NtQuerySystemInformation
RtlDecompressBuffer
RtlCompressBuffer
RtlGetCompressionWorkSpaceSize
RtlDowncaseUnicodeString
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
NtQueryObject
RtlIpv6AddressToStringW
RtlIpv4AddressToStringW
RtlAnsiStringToUnicodeString
NtSetSystemEnvironmentValueEx
NtQuerySystemEnvironmentValueEx
NtTerminateProcess
NtSuspendProcess
RtlAdjustPrivilege
NtResumeProcess
RtlStringFromGUID
RtlFreeUnicodeString
RtlFreeOemString
RtlUpcaseUnicodeStringToOemString
RtlEqualUnicodeString
RtlGetNtVersionNumbers
RtlEqualString
RtlGUIDFromString
RtlInitUnicodeString
RtlUpcaseUnicodeString
RtlAppendUnicodeStringToString
NtEnumerateSystemEnvironmentValuesEx
msasn1
ASN1_CreateModule
ASN1_CloseModule
ASN1BERDotVal2Eoid
ASN1_CloseEncoder
ASN1_CreateDecoder
ASN1BEREoid2DotVal
ASN1_CloseDecoder
ASN1_FreeEncoded
ASN1_CreateEncoder
ASN1Free
winsta
WinStationConnectW
WinStationFreeMemory
WinStationEnumerateW
WinStationQueryInformationW
WinStationOpenServerW
WinStationCloseServer
kernel32
GetModuleHandleExW
LoadLibraryExW
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleFileNameW
GetStringTypeW
GetConsoleCP
GetConsoleMode
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
DecodePointer
EncodePointer
RtlUnwindEx
GetFileType
SetStdHandle
LoadLibraryExA
CreatePipe
SetHandleInformation
ReadFile
WaitForSingleObject
SystemTimeToFileTime
SetConsoleCtrlHandler
GetModuleHandleW
GlobalSize
SetLastError
TryEnterCriticalSection
GetFullPathNameW
GetFullPathNameA
HeapReAlloc
Sleep
CreateThread
GetSystemTimeAsFileTime
CreateFileW
LoadLibraryW
lstrlenA
GetProcAddress
FreeLibrary
GetLastError
CloseHandle
GetCurrentProcessId
OpenProcess
AllocConsole
lstrlenW
GetStdHandle
RaiseException
LocalFree
LocalAlloc
ExitThread
SetUnhandledExceptionFilter
ExitProcess
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
CreateEventW
GetTimeZoneInformation
GetSystemDirectoryW
SetCurrentDirectoryW
FillConsoleOutputCharacterW
GetConsoleScreenBufferInfo
CreateProcessW
SetConsoleCursorPosition
GetCurrentProcess
GetCurrentThread
ProcessIdToSessionId
GetComputerNameW
GetProcessId
FileTimeToSystemTime
TerminateThread
WriteFile
GetFileInformationByHandle
SetFilePointer
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetTempPathA
GetTempFileNameA
GetCurrentDirectoryA
CreateFileA
DeleteFileA
GetFileSizeEx
FlushFileBuffers
FindClose
ExpandEnvironmentStringsW
GetCurrentDirectoryW
GetFileAttributesW
FindFirstFileW
FindNextFileW
DuplicateHandle
DeviceIoControl
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
VirtualAllocEx
VirtualFreeEx
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
GetComputerNameExW
CreateRemoteThread
ClearCommError
PurgeComm
WideCharToMultiByte
GetTimeFormatW
GetDateFormatW
AreFileApisANSI
GetSystemTime
DeleteFileW
GetVersionExA
OutputDebugStringA
GetFileAttributesExW
GetSystemInfo
GetDiskFreeSpaceA
CreateFileMappingA
GetDiskFreeSpaceW
LockFileEx
HeapSize
GetTempPathW
MultiByteToWideChar
HeapValidate
HeapCreate
GetFileAttributesA
HeapDestroy
GetVersionExW
FormatMessageW
FormatMessageA
GetProcessHeap
UnlockFileEx
GetTickCount
OutputDebugStringW
WaitForSingleObjectEx
LockFile
FlushViewOfFile
CompareStringW
LCMapStringW
SetFilePointerEx
WriteConsoleW
ReadConsoleW
SetEnvironmentVariableA
UnlockFile
HeapFree
QueryPerformanceCounter
HeapAlloc
SetEndOfFile
GetFileSize
CreateMutexW
HeapCompact
DeinitServerExtension
GetExtensionName
InitServerExtension
ReflectiveLoader
powershell_reflective_mimikatz
Name
.text
Size
604KB
Virtual Size
604KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
326KB
Virtual Size
326KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
27KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=150, id=224, version=20806,
count=10, id=223, version=20806,
count=50, id=225, version=20806,
count=4, id=203, productName=VS2012 UPD4 build 61030, version=61030,
count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=203, productName=VS2012 UPD2 build 60315, version=60315,
count=2, id=135, version=30729,
count=10, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=554, id=1, productName=Unmarked objects,
count=89, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_kiwi.x86.dll
- IMPHASH 4a44c12f60961988c7984aba9ee3786d
- SHA256 ebabb0918c661e81b9b707508ad605496875e0181a1514d28ec1ebe2d5ee310c
- MD5 d62dc985f89939c275745aea215149b0
- SHA1 1fc0156a337bc9f049bdab9bd893d05b6b91aef8
- SHA512 49ca3a87ee74cb434d64d822c666c9d908a696030b7124de04ce5d34ee60e973ee6161d3ad5372ec07bbe4791ecfe370019756eaea474e330c0fbd02c9814bfc
- SSDEEP 12288:08DoCboJEAJsGLoNwGKgOO/NHQ70o7RcbcSX/to:08DZbSjJHGHOOVw0uRVf
- MD5 SHA1 SHA512 SSDEEP
-
mimikatz is an open source tool to dump credentials on Windows
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
438335
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
ncrypt
BCryptDecrypt
BCryptEncrypt
BCryptGenerateSymmetricKey
BCryptSetProperty
BCryptGetProperty
NCryptExportKey
NCryptImportKey
NCryptSetProperty
NCryptGetProperty
NCryptOpenKey
NCryptFreeBuffer
NCryptEnumKeys
BCryptEnumRegisteredProviders
NCryptOpenStorageProvider
BCryptFreeBuffer
BCryptDestroyKey
BCryptImportKeyPair
BCryptExportKey
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
NCryptFreeObject
fltlib
FilterFindNext
FilterFindFirst
cabinet
ord14
ord13
ord10
ord11
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
winscard
SCardListReadersW
SCardControl
SCardGetAttrib
SCardConnectW
SCardFreeMemory
SCardGetCardTypeProviderNameW
SCardListCardsW
SCardEstablishContext
SCardReleaseContext
SCardDisconnect
advapi32
CryptGetUserKey
CreateServiceW
ControlService
CloseServiceHandle
FreeSid
AllocateAndInitializeSid
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
CreateProcessWithLogonW
CreateWellKnownSid
CopySid
CryptDuplicateKey
CryptEncrypt
CryptSetHashParam
CryptAcquireContextA
SystemFunction025
SystemFunction024
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSidSubAuthorityCount
GetSidSubAuthority
CredFree
CredEnumerateW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
LookupPrivilegeNameW
OpenThreadToken
IsValidSid
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
CreateProcessAsUserW
OpenProcessToken
LookupPrivilegeValueW
CheckTokenMembership
LookupAccountNameW
LookupAccountSidW
IsTextUnicode
BuildSecurityDescriptorW
StartServiceW
SetServiceObjectSecurity
QueryServiceStatusEx
QueryServiceObjectSecurity
OpenServiceW
OpenSCManagerW
CryptEnumProvidersW
ConvertSidToStringSidW
ConvertStringSidToSidW
LsaFreeMemory
CryptAcquireContextW
CryptReleaseContext
CryptSetKeyParam
CryptDecrypt
SetThreadToken
GetTokenInformation
DuplicateTokenEx
CryptGenKey
CryptDestroyKey
CryptGetKeyParam
CryptSetProvParam
CryptGetProvParam
DeleteService
CryptExportKey
CryptImportKey
CryptEnumProviderTypesW
SystemFunction006
SystemFunction007
ClearEventLogW
GetNumberOfEventLogRecords
OpenEventLogW
GetLengthSid
CryptDeriveKey
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptSignHashW
LsaClose
LsaOpenPolicy
LsaQueryInformationPolicy
LsaQueryTrustedDomainInfoByName
LsaEnumerateTrustedDomainsEx
LsaRetrievePrivateData
SystemFunction001
SystemFunction005
SystemFunction013
SystemFunction032
LsaOpenSecret
LsaQuerySecret
A_SHAUpdate
A_SHAFinal
A_SHAInit
crypt32
CryptProtectData
CryptBinaryToStringW
CryptStringToBinaryW
CryptUnprotectData
PFXExportCertStoreEx
CertAddEncodedCertificateToStore
CertSetCertificateContextProperty
CertGetNameStringW
CertNameToStrW
CryptEncodeObject
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptAcquireCertificatePrivateKey
CertAddCertificateContextToStore
CertEnumSystemStore
CryptSignAndEncodeCertificate
CryptExportPublicKeyInfo
CertGetCertificateContextProperty
cryptdll
CDLocateCSystem
MD5Final
MD5Update
MD5Init
CDLocateCheckSum
CDGenerateRandomBits
netapi32
NetServerGetInfo
NetApiBufferFree
NetSessionEnum
NetWkstaUserEnum
NetShareEnum
NetStatisticsGet
NetRemoteTOD
DsGetDcNameW
I_NetServerAuthenticate2
I_NetServerTrustPasswordsGet
I_NetServerReqChallenge
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
oleaut32
SysAllocString
SysFreeString
VariantInit
rpcrt4
RpcBindingSetAuthInfoExW
RpcBindingFree
RpcBindingToStringBindingW
RpcBindingVectorFree
RpcStringFreeW
RpcServerInqBindings
RpcServerListen
RpcServerRegisterIf2
RpcServerUnregisterIfEx
RpcServerUseProtseqEpW
RpcMgmtStopServerListening
RpcEpResolveBinding
RpcServerRegisterAuthInfoW
RpcEpRegisterW
RpcEpUnregister
RpcMgmtEpEltInqBegin
RpcMgmtEpEltInqDone
RpcMgmtEpEltInqNextW
UuidCreate
I_RpcGetCurrentCallHandle
I_RpcBindingInqSecurityContext
RpcBindingSetOption
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcImpersonateClient
RpcRevertToSelf
RpcBindingInqAuthClientW
MesEncodeIncrementalHandleCreate
RpcMgmtWaitServerListen
UuidToStringW
NdrServerCall2
NdrClientCall2
NdrMesTypeDecode2
NdrMesTypeEncode2
NdrMesTypeAlignSize2
MesHandleFree
MesIncrementalHandleReset
MesDecodeIncrementalHandleCreate
NdrMesTypeFree2
shlwapi
PathCombineW
PathIsDirectoryW
PathFindFileNameW
PathCanonicalizeW
PathIsRelativeW
samlib
SamLookupIdsInDomain
SamLookupNamesInDomain
SamEnumerateUsersInDomain
SamiChangePasswordUser
SamSetInformationUser
SamQueryInformationUser
SamOpenUser
SamOpenDomain
SamLookupDomainInSamServer
SamEnumerateDomainsInSamServer
SamConnect
SamFreeMemory
SamOpenGroup
SamOpenAlias
SamGetGroupsForUser
SamGetAliasMembership
SamGetMembersInGroup
SamGetMembersInAlias
SamEnumerateGroupsInDomain
SamEnumerateAliasesInDomain
SamRidToSid
SamCloseHandle
secur32
InitializeSecurityContextW
DeleteSecurityContext
FreeContextBuffer
EnumerateSecurityPackagesW
QueryContextAttributesW
FreeCredentialsHandle
AcquireCredentialsHandleW
LsaFreeReturnBuffer
LsaCallAuthenticationPackage
LsaConnectUntrusted
LsaDeregisterLogonProcess
LsaLookupAuthenticationPackage
shell32
CommandLineToArgvW
user32
PostMessageW
DefWindowProcW
UnregisterClassW
SendMessageW
CreateWindowExW
DestroyWindow
OpenClipboard
CloseClipboard
GetClipboardSequenceNumber
SetClipboardViewer
ChangeClipboardChain
GetClipboardData
EnumClipboardFormats
GetUserObjectInformationW
IsCharAlphaNumericW
DispatchMessageW
GetMessageW
GetKeyboardLayout
RegisterClassExW
TranslateMessage
hid
HidD_GetHidGuid
HidP_GetCaps
HidD_GetAttributes
HidD_GetPreparsedData
HidD_FreePreparsedData
setupapi
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList
wldap32
ord167
ord54
ord301
ord304
ord309
ord310
ord145
ord13
ord73
ord208
ord41
ord26
ord27
ord36
ord127
ord12
ord142
ord77
ord79
ord133
ord147
ord88
ord14
ord203
ord157
ord69
ord113
ord140
ord139
ord97
ord96
ord224
ord223
ord122
ntdll
NtCompareTokens
RtlCreateUserThread
RtlGetCurrentPeb
NtQueryInformationProcess
NtQuerySystemInformation
RtlDecompressBuffer
RtlCompressBuffer
RtlGetCompressionWorkSpaceSize
RtlDowncaseUnicodeString
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
NtQueryObject
RtlIpv6AddressToStringW
RtlIpv4AddressToStringW
RtlAnsiStringToUnicodeString
NtSetSystemEnvironmentValueEx
NtQuerySystemEnvironmentValueEx
NtTerminateProcess
NtSuspendProcess
RtlAdjustPrivilege
NtResumeProcess
RtlStringFromGUID
RtlFreeUnicodeString
RtlFreeOemString
RtlUpcaseUnicodeStringToOemString
RtlEqualUnicodeString
RtlGetNtVersionNumbers
RtlEqualString
RtlGUIDFromString
RtlInitUnicodeString
RtlUpcaseUnicodeString
RtlAppendUnicodeStringToString
NtEnumerateSystemEnvironmentValuesEx
msasn1
ASN1_CreateModule
ASN1_CloseModule
ASN1BERDotVal2Eoid
ASN1_CloseEncoder
ASN1_CreateDecoder
ASN1BEREoid2DotVal
ASN1_CloseDecoder
ASN1_FreeEncoded
ASN1_CreateEncoder
ASN1Free
winsta
WinStationConnectW
WinStationFreeMemory
WinStationEnumerateW
WinStationQueryInformationW
WinStationOpenServerW
WinStationCloseServer
kernel32
SetStdHandle
GetFileType
GetModuleHandleExW
LoadLibraryExW
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStartupInfoW
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleFileNameW
RtlUnwind
GetStringTypeW
GetConsoleCP
GetConsoleMode
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryExA
TryEnterCriticalSection
GetFullPathNameW
GetFullPathNameA
HeapReAlloc
GetFileSize
WaitForSingleObject
SystemTimeToFileTime
SetConsoleCtrlHandler
GetModuleHandleW
GlobalSize
SetLastError
Sleep
CreateThread
GetSystemTimeAsFileTime
CreateMutexW
HeapCompact
SetEndOfFile
HeapAlloc
CreateFileW
LoadLibraryW
lstrlenA
GetProcAddress
FreeLibrary
GetLastError
CloseHandle
GetCurrentProcessId
OpenProcess
AllocConsole
lstrlenW
GetStdHandle
RaiseException
LocalFree
LocalAlloc
ExitThread
SetUnhandledExceptionFilter
ExitProcess
SetHandleInformation
CreatePipe
CreateProcessW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
CreateEventW
GetCurrentProcess
GetTimeZoneInformation
GetSystemDirectoryW
ReadFile
SetCurrentDirectoryW
IsWow64Process
FillConsoleOutputCharacterW
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
GetCurrentThread
ProcessIdToSessionId
GetComputerNameW
GetProcessId
FileTimeToSystemTime
TerminateThread
WriteFile
GetFileInformationByHandle
SetFilePointer
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetTempPathA
GetTempFileNameA
GetCurrentDirectoryA
CreateFileA
DeleteFileA
GetFileSizeEx
FlushFileBuffers
FindClose
ExpandEnvironmentStringsW
GetCurrentDirectoryW
GetFileAttributesW
FindFirstFileW
FindNextFileW
DuplicateHandle
DeviceIoControl
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
VirtualAllocEx
VirtualFreeEx
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
GetComputerNameExW
CreateRemoteThread
ClearCommError
PurgeComm
WideCharToMultiByte
GetTimeFormatW
GetDateFormatW
AreFileApisANSI
GetSystemTime
DeleteFileW
GetVersionExA
OutputDebugStringA
GetFileAttributesExW
GetSystemInfo
GetDiskFreeSpaceA
CreateFileMappingA
GetDiskFreeSpaceW
LockFileEx
HeapSize
GetTempPathW
MultiByteToWideChar
HeapValidate
HeapCreate
GetFileAttributesA
HeapDestroy
GetVersionExW
FormatMessageW
FormatMessageA
GetProcessHeap
UnlockFileEx
GetTickCount
OutputDebugStringW
WaitForSingleObjectEx
LockFile
CompareStringW
LCMapStringW
SetFilePointerEx
WriteConsoleW
ReadConsoleW
SetEnvironmentVariableA
FlushViewOfFile
UnlockFile
InterlockedCompareExchange
HeapFree
QueryPerformanceCounter
DeinitServerExtension
GetExtensionName
InitServerExtension
_ReflectiveLoader@0
powershell_reflective_mimikatz
Name
.text
Size
502KB
Virtual Size
502KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
264KB
Virtual Size
264KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=27, id=223, productName=VS2013 build 21005, version=21005,
count=159, id=224, productName=VS2013 build 21005, version=21005,
count=50, id=225, productName=VS2013 build 21005, version=21005,
count=1, id=223, productName=VS2013 UPD4 build 31101, version=31101,
count=4, id=203, productName=VS2012 UPD4 build 61030, version=61030,
count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=203, productName=VS2012 UPD2 build 60315, version=60315,
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=551, id=1, productName=Unmarked objects,
count=89, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_lanattacks.x64.dll
- IMPHASH 2422904d06a009c161ccd03cda20115c
- SHA256 523389e301629cbf18ee3f286d103561c9fa788fd6dcdf1190267dcc16c4d4d7
- MD5 b64f53405d5fdfb147a18efbac4ce352
- SHA1 8133a62e5d4053bda345fdee2cbe42300174404d
- SHA512 6d54391525cef3aca5f62b2da7164c200249f4a1d47f11ee4c7720abf8f89ace9c8ec7782b94a37a3428aa8ca7b527e56c7d7e462ac9275b81343220278af698
- SSDEEP 3072:RMmlQpCuIFxtXc28VvUSTDNOhSSEjmin3ng0Ls+gllnLNYveG2i:em4yVojThaSSEjmi3nCvQ2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
69420
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateThread
GetLastError
WaitForSingleObject
ExitProcess
SetUnhandledExceptionFilter
ExitThread
CloseHandle
CreateFileW
FlushFileBuffers
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
OutputDebugStringW
LoadLibraryExW
HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
RaiseException
FreeLibrary
GetProcAddress
LoadLibraryExA
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
GetStringTypeW
HeapFree
HeapAlloc
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
GetSystemTimeAsFileTime
GetCommandLineA
GetCurrentThreadId
GetCPInfo
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
IsProcessorFeaturePresent
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetModuleHandleExW
HeapSize
IsDebuggerPresent
GetProcessHeap
GetStdHandle
WriteFile
GetModuleFileNameW
IsValidCodePage
GetACP
GetOEMCP
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
ws2_32
ntohs
socket
setsockopt
sendto
select
recvfrom
ntohl
inet_addr
htons
htonl
getsockname
connect
closesocket
bind
DeinitServerExtension
GetExtensionName
InitServerExtension
ReflectiveLoader
Name
.text
Size
141KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=223, version=20806,
count=178, id=224, version=20806,
count=67, id=225, version=20806,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=108, id=1, productName=Unmarked objects,
count=2, id=225, productName=VS2013 UPD4 build 31101, version=31101,
count=3, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_lanattacks.x86.dll
- IMPHASH abd738afe96db62bfb8df5fd3e937142
- SHA256 0e14beac991bd5e5f87ebe1d772d26f60b384f4eafd6b21b8a1d4848cc25c762
- MD5 76e7fb30dc0ab4bcd914a5813ca999be
- SHA1 2ae9b19bc606ecb0e5cb268431ed3a97bf594d36
- SHA512 24f2e8bef2f018d55180a20e67d2f19f692f6b9c6a5a964e0e9ecfa9174643a4b2122187acdf0c64030f9320a0b8503b5881813f816e1934c6b447aeb8e611a2
- SSDEEP 3072:iHLE1KeCo7oZp/RVFp6ywMDHs+5oNb7Y2F+3:iHgdaR+ywSHsGSF+3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
57069
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateThread
GetLastError
WaitForSingleObject
ExitProcess
SetUnhandledExceptionFilter
ExitThread
CloseHandle
CreateFileW
FlushFileBuffers
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
OutputDebugStringW
LoadLibraryExW
HeapReAlloc
VirtualQuery
FreeEnvironmentStringsW
RaiseException
FreeLibrary
GetProcAddress
LoadLibraryExA
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetStringTypeW
HeapFree
HeapAlloc
RtlUnwind
GetSystemTimeAsFileTime
GetCommandLineA
GetCurrentThreadId
GetCPInfo
UnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
IsProcessorFeaturePresent
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetModuleHandleExW
HeapSize
GetProcessHeap
GetStdHandle
WriteFile
GetModuleFileNameW
IsDebuggerPresent
IsValidCodePage
GetACP
GetOEMCP
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
ws2_32
ntohs
socket
setsockopt
sendto
select
recvfrom
ntohl
inet_addr
htons
htonl
getsockname
connect
closesocket
bind
DeinitServerExtension
GetExtensionName
InitServerExtension
_ReflectiveLoader@0
Name
.text
Size
122KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=29, id=223, productName=VS2013 build 21005, version=21005,
count=180, id=224, productName=VS2013 build 21005, version=21005,
count=66, id=225, productName=VS2013 build 21005, version=21005,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=103, id=1, productName=Unmarked objects,
count=1, id=223, productName=VS2013 UPD4 build 31101, version=31101,
count=2, id=225, productName=VS2013 UPD4 build 31101, version=31101,
count=3, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_mimikatz.x64.dll
- IMPHASH 36e4d5414001278bb80d1f97ce1be672
- SHA256 b11108e180ed14bb4cd11fa284b4bb3bc4cebfae8200a38f650b5a63487a685c
- MD5 7e2c0c9278fd1bad3b6697daa7fc34ef
- SHA1 0d6bded901ed653b0092e20e843c3fa6dd5a85bf
- SHA512 a98c007b36a4336be0c5052cbe111d3cc0ad048acfeefd1a8bb12e2992e132f77e7449ec497fb66bf1cb165cc0b7f19d44f0e2545b695777f7c6fe72fca7e653
- SSDEEP 12288:WpT5AI3VPOIwp+znq+EYfp1fvJD8gpZnyqirp5zNELwWlxYzD/:WpDp1d8gpZnMpVSwWlxY/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
248148
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
psapi
GetModuleInformation
advapi32
LookupPrivilegeNameW
EnumServicesStatusExW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptImportKey
CryptDecrypt
CryptGetProvParam
CryptExportKey
CryptEnumProvidersW
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetKeyParam
CryptGetUserKey
CredEnumerateW
CredFree
OpenEncryptedFileRawW
ReadEncryptedFileRaw
CloseEncryptedFileRaw
QueryUsersOnEncryptedFile
QueryRecoveryAgentsOnEncryptedFile
FreeEncryptionCertificateHashList
ImpersonateLoggedOnUser
RevertToSelf
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
IsTextUnicode
CloseServiceHandle
CreateServiceW
OpenSCManagerW
OpenServiceW
StartServiceW
OpenProcessToken
GetTokenInformation
AdjustTokenPrivileges
LookupPrivilegeValueW
DeleteService
CreateProcessAsUserW
CreateProcessWithLogonW
AllocateAndInitializeSid
FreeSid
SetKernelObjectSecurity
LookupAccountSidW
DuplicateTokenEx
QueryServiceObjectSecurity
SetServiceObjectSecurity
BuildSecurityDescriptorW
ConvertSidToStringSidW
ControlService
user32
GetWindowThreadProcessId
UpdateWindow
InvalidateRect
PostThreadMessageW
EnumWindowStationsW
EnumDesktopsW
EnumWindows
WaitForInputIdle
secur32
LsaEnumerateLogonSessions
LsaFreeReturnBuffer
GetUserNameExW
LsaGetLogonSessionData
crypt32
CryptAcquireCertificatePrivateKey
CertEnumCertificatesInStore
PFXExportCertStoreEx
CertGetNameStringW
CertEnumSystemStore
CertAddCertificateContextToStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CertCloseStore
CertOpenStore
shlwapi
PathCombineW
PathIsRelativeW
PathCanonicalizeW
wtsapi32
WTSEnumerateSessionsW
WTSCloseServer
WTSEnumerateProcessesW
WTSOpenServerW
WTSFreeMemory
kernel32
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
GetOEMCP
GetACP
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryExW
SetStdHandle
OutputDebugStringW
WriteConsoleW
SetEndOfFile
VirtualProtect
IsValidCodePage
GetConsoleCP
GetModuleFileNameW
GetFileType
SetFilePointerEx
ReadConsoleW
GetConsoleMode
IsDebuggerPresent
GetProcessHeap
ExitProcess
SetUnhandledExceptionFilter
ExitThread
MultiByteToWideChar
WriteFile
ReadFile
CloseHandle
CreateFileW
FreeLibraryAndExitThread
GetProcAddress
Sleep
FreeLibrary
LoadLibraryW
GetLastError
FlushFileBuffers
SetLastError
GetModuleHandleW
VirtualAllocEx
VirtualFreeEx
OpenProcess
CreateRemoteThread
WaitForSingleObject
VirtualProtectEx
GetCurrentProcess
ReadProcessMemory
WriteProcessMemory
TerminateProcess
GetProcessId
DuplicateHandle
CreateJobObjectW
AssignProcessToJobObject
TerminateJobObject
ResumeThread
VirtualQueryEx
GetStdHandle
FillConsoleOutputCharacterW
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
GetNativeSystemInfo
ConnectNamedPipe
DisconnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeW
WaitNamedPipeW
DebugActiveProcess
CreateProcessW
IsBadReadPtr
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Module32FirstW
Module32NextW
LocalFree
FormatMessageW
GetCurrentDirectoryW
GetComputerNameExW
GetVersionExW
OpenThread
TerminateThread
SuspendThread
Thread32First
Thread32Next
RaiseException
LoadLibraryExA
WideCharToMultiByte
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
HeapFree
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapAlloc
HeapReAlloc
GetCommandLineA
GetCurrentThreadId
GetCPInfo
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
IsProcessorFeaturePresent
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetModuleHandleExW
HeapSize
DeinitServerExtension
GetExtensionName
InitServerExtension
ReflectiveLoader
ping
Name
.text
Size
348KB
Virtual Size
348KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
148KB
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
760B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=223, version=20806,
count=200, id=224, version=20806,
count=2, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=72, id=225, version=20806,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=228, id=1, productName=Unmarked objects,
count=52, id=225, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_mimikatz.x86.dll
- IMPHASH afa6c44f705069d2018bca61eadff76f
- SHA256 54203ada76c66b3389819098c4706c1aec03e3d5ca5c3bff50cfb38106a49843
- MD5 e3c10d265ec131b91b5172f167f1c722
- SHA1 4438bf8a0ffc5ced931f1a0ee4a5712907647de3
- SHA512 93329608852a32bdae5d57638feda30e2867792650d97c1d67ddb573b1e6472d8eb7b2d9645646735034e6f250b531642edc3780aa958ba6877b31d88c7aacd7
- SSDEEP 6144:PiXCx8lbL8jfShDdMw2Iz8flAYnPP/eulBlq8VFqQy2Rk:KCxq8jfShDdYflAuP3eulBlqqqV4k
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
187190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
psapi
GetModuleInformation
advapi32
LookupPrivilegeNameW
EnumServicesStatusExW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptImportKey
CryptDecrypt
CryptGetProvParam
CryptExportKey
CryptEnumProvidersW
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetKeyParam
CryptGetUserKey
CredEnumerateW
CredFree
OpenEncryptedFileRawW
ReadEncryptedFileRaw
CloseEncryptedFileRaw
QueryUsersOnEncryptedFile
QueryRecoveryAgentsOnEncryptedFile
FreeEncryptionCertificateHashList
ImpersonateLoggedOnUser
RevertToSelf
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
IsTextUnicode
CloseServiceHandle
CreateServiceW
OpenSCManagerW
OpenServiceW
StartServiceW
OpenProcessToken
GetTokenInformation
AdjustTokenPrivileges
LookupPrivilegeValueW
DeleteService
CreateProcessAsUserW
CreateProcessWithLogonW
AllocateAndInitializeSid
FreeSid
SetKernelObjectSecurity
LookupAccountSidW
DuplicateTokenEx
QueryServiceObjectSecurity
SetServiceObjectSecurity
BuildSecurityDescriptorW
ConvertSidToStringSidW
ControlService
user32
GetWindowThreadProcessId
UpdateWindow
InvalidateRect
PostThreadMessageW
EnumWindowStationsW
EnumDesktopsW
EnumWindows
WaitForInputIdle
secur32
LsaEnumerateLogonSessions
LsaFreeReturnBuffer
GetUserNameExW
LsaGetLogonSessionData
crypt32
CryptAcquireCertificatePrivateKey
CertEnumCertificatesInStore
PFXExportCertStoreEx
CertGetNameStringW
CertEnumSystemStore
CertAddCertificateContextToStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CertCloseStore
CertOpenStore
shlwapi
PathCombineW
PathIsRelativeW
PathCanonicalizeW
wtsapi32
WTSEnumerateSessionsW
WTSCloseServer
WTSEnumerateProcessesW
WTSOpenServerW
WTSFreeMemory
kernel32
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
VirtualQuery
LoadLibraryExW
SetStdHandle
OutputDebugStringW
WriteConsoleW
SetEndOfFile
OpenProcess
GetACP
IsValidCodePage
GetConsoleCP
GetModuleFileNameW
GetFileType
SetFilePointerEx
ReadConsoleW
GetConsoleMode
IsDebuggerPresent
ExitProcess
SetUnhandledExceptionFilter
ExitThread
MultiByteToWideChar
WriteFile
ReadFile
CloseHandle
CreateFileW
FreeLibraryAndExitThread
GetProcAddress
Sleep
FreeLibrary
LoadLibraryW
GetLastError
FlushFileBuffers
SetLastError
GetModuleHandleW
VirtualAllocEx
VirtualFreeEx
CreateRemoteThread
WaitForSingleObject
VirtualProtect
VirtualProtectEx
GetCurrentProcess
ReadProcessMemory
WriteProcessMemory
TerminateProcess
GetProcessId
DuplicateHandle
CreateJobObjectW
AssignProcessToJobObject
TerminateJobObject
ResumeThread
VirtualQueryEx
GetStdHandle
FillConsoleOutputCharacterW
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
GetNativeSystemInfo
ConnectNamedPipe
DisconnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeW
WaitNamedPipeW
DebugActiveProcess
CreateProcessW
IsBadReadPtr
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Module32FirstW
Module32NextW
LocalFree
FormatMessageW
GetCurrentDirectoryW
GetComputerNameExW
GetVersionExW
OpenThread
TerminateThread
SuspendThread
Thread32First
Thread32Next
RaiseException
LoadLibraryExA
WideCharToMultiByte
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
HeapFree
RtlUnwind
HeapAlloc
HeapReAlloc
GetCommandLineA
GetCurrentThreadId
GetCPInfo
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
IsProcessorFeaturePresent
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetModuleHandleExW
HeapSize
GetProcessHeap
DeinitServerExtension
GetExtensionName
InitServerExtension
_ReflectiveLoader@0
ping
Name
.text
Size
275KB
Virtual Size
275KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
94KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
760B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=29, id=223, productName=VS2013 build 21005, version=21005,
count=202, id=224, productName=VS2013 build 21005, version=21005,
count=2, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=71, id=225, productName=VS2013 build 21005, version=21005,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=223, id=1, productName=Unmarked objects,
count=1, id=223, productName=VS2013 UPD4 build 31101, version=31101,
count=52, id=225, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_peinjector.x64.dll
- IMPHASH 6f35de51ce0a5d3b8536d2a97ecf2a8d
- SHA256 66611fb17b755e8028fbd17c34ebcb00f5e33efe5d323dae1fa24a26923dffd9
- MD5 08b69bc5e01f6fea441af4da0f408a07
- SHA1 7f8573b13734f4c79259440191fa7e09775d39ca
- SHA512 371bc2c9cdf34a8090f51bcf49664c8f4ad59102307d013d879f31cd165a3399bb88e9e67210d5f6088bd166528600a19044527c6cf4ce34193e5b306c8824dc
- SSDEEP 1536:+g9XNpR4q0Oq7NrocEUBO+VBJ0a1sKT+EEz1Tf7TaJM4WHPwy7eeS80G9qsW4der:TR/0bhrts+XOaCKT+BzVfvaJM4kTNve
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
29604
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
ExitProcess
SetUnhandledExceptionFilter
ExitThread
RaiseException
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExA
MultiByteToWideChar
WideCharToMultiByte
Sleep
GetSystemTime
SystemTimeToFileTime
ReadFile
HeapFree
HeapAlloc
HeapReAlloc
GetSystemTimeAsFileTime
GetCommandLineA
GetCurrentThreadId
RtlUnwindEx
IsDebuggerPresent
EncodePointer
DecodePointer
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
CloseHandle
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
WriteFile
GetConsoleCP
GetProcessHeap
GetModuleHandleExW
GetModuleFileNameW
SetLastError
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetStdHandle
FlushFileBuffers
WriteConsoleW
CreateFileW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
OutputDebugStringW
GetStringTypeW
SetEndOfFile
HeapSize
LCMapStringW
DeinitServerExtension
InitServerExtension
ReflectiveLoader
Name
.text
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=118, id=224, version=20806,
count=9, id=223, version=20806,
count=26, id=225, version=20806,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=96, id=1, productName=Unmarked objects,
count=10, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_peinjector.x86.dll
- IMPHASH 47ca254ac9e7c48f14cfc39eb47c484a
- SHA256 1abcfb40a9da1e0c997d8405ea1be9385b5b8bf7d9dfb38ba4ba17d4c5c2c594
- MD5 6c54c3842e928aec297bb80362734842
- SHA1 1be7342dc8f308e52fdd2a2461c5490b5caa4c2d
- SHA512 64fd12510694e43a409486446e7182a14ee65737174613e69fb2857deab876ee360d3f14011667c17cc77038f642555f28018c96bab2381576db3586f3a31046
- SSDEEP 1536:Xkry6wZ2fb05Csu04C5kpmQEXXYX0HBzbVwdTsowBG0n/chULMksWjcdYHgK:X06Zhomj4kHcdTso9FLqgK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
26134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
ExitProcess
SetUnhandledExceptionFilter
ExitThread
RaiseException
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExA
MultiByteToWideChar
WideCharToMultiByte
Sleep
GetSystemTime
SystemTimeToFileTime
ReadFile
HeapFree
HeapAlloc
HeapReAlloc
GetSystemTimeAsFileTime
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
CloseHandle
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
WriteFile
GetConsoleCP
RtlUnwind
GetProcessHeap
GetModuleHandleExW
GetModuleFileNameW
SetLastError
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
VirtualQuery
SetStdHandle
FlushFileBuffers
WriteConsoleW
CreateFileW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
OutputDebugStringW
GetStringTypeW
SetEndOfFile
HeapSize
LCMapStringW
DeinitServerExtension
InitServerExtension
_ReflectiveLoader@0
Name
.text
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=19, id=223, productName=VS2013 build 21005, version=21005,
count=125, id=224, productName=VS2013 build 21005, version=21005,
count=26, id=225, productName=VS2013 build 21005, version=21005,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=92, id=1, productName=Unmarked objects,
count=1, id=223, productName=VS2013 UPD4 build 31101, version=31101,
count=10, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_powershell.x64.dll
- IMPHASH 4c2a730e152625f31d76c35b84485f9a
- SHA256 e13cf0c9711ffeb9e9b4b485f947aa51df62a8f78e536ad6bf32ce67e581b524
- MD5 a2f1675c98d362a7cc7f202bb147c9bf
- SHA1 492cf335cd04813d0dd8dad8052eca65fb8bf249
- SHA512 7b58f5fa3c0e96dc9db6391393403c424a626b3ac20801b5c795bbb1b403c17595ee95ecca45fd9452bafe1751877156e15beaaa113047dd9da3e989f8d21943
- SSDEEP 3072:PLXw9WzmnqTHxj/9fh8LoT8B7shQoEyVX4Z/KaPVO2JsH:P7i/qTRJp8Lo4Ghc/k
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
24072
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ws2_32
ntohl
kernel32
GetCPInfo
LocalFree
ExitProcess
SetUnhandledExceptionFilter
ExitThread
LocalAlloc
GetProcAddress
GetLastError
SetEvent
ResetEvent
CloseHandle
CreateEventA
LoadLibraryA
lstrlenA
CreateFileW
FlushFileBuffers
WriteConsoleW
SetStdHandle
OutputDebugStringW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
LCMapStringW
RaiseException
FreeLibrary
LoadLibraryExA
CreateThread
GetCurrentThreadId
TerminateThread
ResumeThread
ReleaseMutex
WaitForSingleObject
CreateMutexA
Sleep
GetSystemTime
SystemTimeToFileTime
EncodePointer
DecodePointer
MultiByteToWideChar
HeapFree
RtlLookupFunctionEntry
RtlUnwindEx
GetCommandLineA
HeapAlloc
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
RtlPcToFileHeader
GetModuleHandleExW
WideCharToMultiByte
HeapSize
IsValidCodePage
GetACP
GetOEMCP
SetLastError
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
WriteFile
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
HeapReAlloc
GetStringTypeW
oleaut32
VariantClear
VariantInit
SafeArrayCreateVector
SafeArrayPutElement
SafeArrayUnlock
SafeArrayLock
SafeArrayDestroy
SafeArrayCreate
SysAllocStringByteLen
SysStringLen
SysFreeString
SysAllocString
DeinitServerExtension
GetExtensionName
InitServerExtension
ReflectiveLoader
StagelessInit
Name
.text
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
64KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=114, id=224, version=20806,
count=10, id=223, version=20806,
count=54, id=225, version=20806,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=134, id=1, productName=Unmarked objects,
count=6, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=3, id=225, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_powershell.x86.dll
- IMPHASH 7005679e99404ca384dba01425a000ab
- SHA256 8c7278dbdd3e120c446aa9767c0d31d74b130233c7d065a3c4cf14c6b1b4a433
- MD5 f2a4990f571f8242e229efe0a84a62c9
- SHA1 58ce90ab382b3e5ab3d9257ad8a70e9770c74b46
- SHA512 e0522fed04095b0197ed7b66dee4096097aa38a5c849e3f1da178d681af64538e3efc3688937d07984235131729620b0550fbc79e0932820de2ab77e270ec475
- SSDEEP 1536:wDuwYITysu0O+FasShGfz9PryrFrIAcWNupsWjcdjVFY6Z/KaPAKOYIx3jqc6tl:wDuwB5as2W1rnMpjVF9Z/KaPVO2tlmn
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
18937
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ws2_32
ntohl
kernel32
SetLastError
LocalFree
ExitProcess
SetUnhandledExceptionFilter
ExitThread
LocalAlloc
InterlockedDecrement
GetProcAddress
GetLastError
SetEvent
ResetEvent
CloseHandle
CreateEventA
LoadLibraryA
lstrlenA
CreateFileW
FlushFileBuffers
WriteConsoleW
SetStdHandle
OutputDebugStringW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
LCMapStringW
RaiseException
FreeLibrary
LoadLibraryExA
CreateThread
GetCurrentThreadId
TerminateThread
ResumeThread
ReleaseMutex
WaitForSingleObject
CreateMutexA
Sleep
GetSystemTime
SystemTimeToFileTime
MultiByteToWideChar
HeapFree
RtlUnwind
GetCommandLineA
HeapAlloc
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
GetModuleHandleExW
WideCharToMultiByte
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
WriteFile
GetModuleFileNameW
VirtualQuery
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
HeapReAlloc
GetStringTypeW
oleaut32
VariantClear
VariantInit
SafeArrayCreateVector
SafeArrayPutElement
SafeArrayUnlock
SafeArrayLock
SafeArrayDestroy
SafeArrayCreate
SysAllocStringByteLen
SysStringLen
SysFreeString
SysAllocString
DeinitServerExtension
GetExtensionName
InitServerExtension
StagelessInit
_ReflectiveLoader@0
Name
.text
Size
71KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
63KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=225, version=20806,
count=21, id=223, productName=VS2013 build 21005, version=21005,
count=121, id=224, productName=VS2013 build 21005, version=21005,
count=48, id=225, productName=VS2013 build 21005, version=21005,
count=130, id=1, productName=Unmarked objects,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=223, productName=VS2013 UPD4 build 31101, version=31101,
count=6, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=3, id=225, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_priv.x64.dll
- IMPHASH b075bbda511163243f6c78932d52a314
- SHA256 c818e485de2dcbb7c4ff8aaae0a70ba78e0ec2902729935854f2910ba802e23e
- MD5 5f0b2b8b5ed380f6bce72789e4ce844e
- SHA1 bc0740c1c62fbfa3e0a69f6f262d1d0298fa6bce
- SHA512 c7431ded4eef2561badc2eff23a83dd0f184df1e79094352bc31a723e0ada515693dc118eb4034b182c375f97997cdc192f17f6f3a00aea7b04db0a3b1d9f4c6
- SSDEEP 3072:lZ0cV38h8TOwiIKbSlW5jVHMw/vyn1EVHoj:UcV3TOQK2AJVZXDH+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
27120
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
psapi
GetModuleBaseNameA
EnumProcesses
kernel32
WaitForSingleObject
CloseHandle
CreateEventA
LoadLibraryA
SetLastError
Sleep
GetTickCount
GetCurrentThread
GetExitCodeThread
ReleaseSemaphore
WriteFile
ReadFile
GetHandleInformation
ConnectNamedPipe
DisconnectNamedPipe
SetEvent
GetTempPathA
CreateFileA
DeleteFileA
CreateNamedPipeA
GetVersionExA
GetCurrentThreadId
FindClose
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetModuleHandleA
CreateFileW
FindFirstFileW
FindNextFileW
WriteProcessMemory
ReadProcessMemory
GetLastError
GetCurrentProcess
OpenProcess
VirtualFreeEx
VirtualAllocEx
GetProcAddress
FreeLibrary
ExitThread
SetUnhandledExceptionFilter
ExitProcess
WriteConsoleW
FlushFileBuffers
CreateSemaphoreA
ReleaseMutex
RaiseException
LoadLibraryExA
CreateRemoteThread
GetThreadId
CreateThread
TerminateThread
ResumeThread
SetEnvironmentVariableA
CreateMutexA
MultiByteToWideChar
WideCharToMultiByte
GetSystemTime
VirtualProtectEx
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineA
GetSystemTimeAsFileTime
RtlUnwindEx
IsDebuggerPresent
EncodePointer
DecodePointer
IsProcessorFeaturePresent
GetProcessHeap
GetModuleHandleExW
GetStdHandle
GetModuleFileNameW
GetTimeZoneInformation
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
OutputDebugStringW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
HeapSize
CompareStringW
LCMapStringW
GetStringTypeW
SetStdHandle
advapi32
DuplicateToken
OpenThreadToken
ImpersonateNamedPipeClient
StartServiceA
QueryServiceStatusEx
OpenServiceA
OpenSCManagerA
DeleteService
CreateServiceA
ControlService
CloseServiceHandle
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
EnumServicesStatusA
DeinitServerExtension
GetExtensionName
InitServerExtension
ReflectiveLoader
control
Name
.text
Size
82KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=128, id=224, version=20806,
count=9, id=223, version=20806,
count=41, id=225, version=20806,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=149, id=1, productName=Unmarked objects,
count=14, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_priv.x86.dll
- IMPHASH 7a16fa323a59bec644e1c92890946ae0
- SHA256 6effafba056ed77684af9f0d40efbdf2958dfceb3193cba7897430957801978e
- MD5 432b33f4cffa38dc90425d9c56997c10
- SHA1 1e39ba78005364f8158a8abc5e71b0a44cba158e
- SHA512 7daaeff49f44b9239daea1f52c4e33217f104e82425776013b160a14000b748129140263919e3f385b42840dcb17291d840d89295e300bc5278dc5e7fdc153fd
- SSDEEP 1536:O1UdYS3RzXsu0PAaGHjG+tQubBvxzuwWGOsmEymV1wWYc9hsWjcdJwzHVJ:wUORCNyud5uwpOtEti4OaxJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
21166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
psapi
GetModuleBaseNameA
EnumProcesses
kernel32
WaitForSingleObject
CloseHandle
CreateEventA
LoadLibraryA
SetLastError
Sleep
GetTickCount
GetCurrentThread
GetExitCodeThread
ReleaseSemaphore
WriteFile
ReadFile
GetHandleInformation
ConnectNamedPipe
DisconnectNamedPipe
SetEvent
GetTempPathA
CreateFileA
DeleteFileA
CreateNamedPipeA
GetVersionExA
GetCurrentThreadId
FindClose
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetModuleHandleA
CreateFileW
FindFirstFileW
FindNextFileW
WriteProcessMemory
ReadProcessMemory
GetLastError
GetCurrentProcess
OpenProcess
VirtualFreeEx
VirtualAllocEx
GetProcAddress
FreeLibrary
ExitThread
SetUnhandledExceptionFilter
ExitProcess
WriteConsoleW
FlushFileBuffers
CreateSemaphoreA
TerminateThread
RaiseException
LoadLibraryExA
CreateRemoteThread
GetThreadId
CreateThread
SetEnvironmentVariableA
ResumeThread
ReleaseMutex
CreateMutexA
MultiByteToWideChar
WideCharToMultiByte
GetSystemTime
VirtualProtect
VirtualProtectEx
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineA
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcessHeap
GetModuleHandleExW
GetStdHandle
GetModuleFileNameW
GetTimeZoneInformation
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
RtlUnwind
VirtualQuery
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
OutputDebugStringW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
HeapSize
CompareStringW
LCMapStringW
GetStringTypeW
SetStdHandle
advapi32
DuplicateToken
OpenThreadToken
ImpersonateNamedPipeClient
StartServiceA
QueryServiceStatusEx
OpenServiceA
OpenSCManagerA
DeleteService
CreateServiceA
ControlService
CloseServiceHandle
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
EnumServicesStatusA
DeinitServerExtension
GetExtensionName
InitServerExtension
_ReflectiveLoader@0
control
Name
.text
Size
80KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=223, productName=VS2013 build 21005, version=21005,
count=133, id=224, productName=VS2013 build 21005, version=21005,
count=41, id=225, productName=VS2013 build 21005, version=21005,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=145, id=1, productName=Unmarked objects,
count=1, id=223, productName=VS2013 UPD4 build 31101, version=31101,
count=14, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_python.x64.dll
- IMPHASH f656523d0bded13b4a2535f60c388f12
- SHA256 9244bbfedbb0e9b7a4416d0d998b8f53a439161d1cc974b14b13c082fc1c835b
- MD5 9fb2b5e5378476cb5c6a8085467ec395
- SHA1 139bf1859c9317a11f525f9ac3b678048ba3c34a
- SHA512 6482e6aa72d2961a39608503c5d7049116fc61866bb9b5dca6d3628d91e8075af81c5d0e3dd89911981f91b12f505881d2b782dd7292fde0b1a8474dc2a5f388
- SSDEEP 98304:n1JiZJ6GBv+0YYW4H9tMzpXtDuLsPmCxuDd+u4kAB3V/XcNDvL4X:n1JiZJVBW9SuE+pzDcNDw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
2116448
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
crypt32
CertGetEnhancedKeyUsage
CertFreeCRLContext
CertEnumCRLsInStore
CertFreeCertificateContext
CertEnumCertificatesInStore
CertOpenSystemStoreA
CertCloseStore
ws2_32
socket
getnameinfo
freeaddrinfo
getaddrinfo
WSAIoctl
WSASetLastError
WSACleanup
WSAStartup
getprotobyname
getservbyname
getservbyport
__WSAFDIsSet
gethostbyname
gethostbyaddr
gethostname
shutdown
setsockopt
sendto
send
recvfrom
recv
ntohs
ntohl
listen
inet_ntoa
inet_addr
htons
htonl
getsockopt
getsockname
getpeername
ioctlsocket
connect
closesocket
bind
accept
WSAGetLastError
select
kernel32
ExitThread
ReadConsoleInputA
PeekConsoleInputA
GetNumberOfConsoleInputEvents
HeapCompact
WriteConsoleW
GetCurrentProcess
GetLastError
GetFileSize
SetEndOfFile
SetFilePointer
CloseHandle
DuplicateHandle
GetSystemInfo
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetVersion
GetProcessTimes
OpenProcess
TerminateProcess
GetExitCodeProcess
SetLastError
WaitForSingleObject
GetFileInformationByHandle
GetFileType
FindClose
SetFileTime
GetSystemTime
SystemTimeToFileTime
CreatePipe
GetModuleFileNameA
CreateProcessA
GetEnvironmentVariableA
SetEnvironmentVariableA
SetEnvironmentVariableW
SetCurrentDirectoryA
SetCurrentDirectoryW
GetCurrentDirectoryA
GetCurrentDirectoryW
CreateDirectoryA
CreateDirectoryW
RemoveDirectoryA
RemoveDirectoryW
GetFullPathNameA
GetFullPathNameW
CreateFileA
CreateFileW
SetFileAttributesA
SetFileAttributesW
GetFileAttributesA
GetFileAttributesW
GetFileAttributesExA
GetFileAttributesExW
DeleteFileA
DeleteFileW
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
MoveFileA
GenerateConsoleCtrlEvent
SetEvent
LoadLibraryExW
Sleep
CreateEventA
QueryPerformanceCounter
QueryPerformanceFrequency
SetConsoleCtrlHandler
DisableThreadLibraryCalls
FreeLibrary
LocalFree
FormatMessageA
LoadLibraryA
IsBadStringPtrA
IsBadStringPtrW
VirtualAlloc
GetProcAddress
GetACP
GetLocaleInfoA
WriteFile
ReadFile
GetTickCount
PeekNamedPipe
GetCurrentThreadId
ReleaseSemaphore
WaitForMultipleObjects
CreateSemaphoreA
ExitProcess
ConnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeA
WaitNamedPipeA
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleW
OutputDebugStringA
GetStdHandle
GetModuleHandleA
ExpandEnvironmentStringsW
SetErrorMode
LoadLibraryExA
OutputDebugStringW
GetConsoleCP
GetConsoleOutputCP
GetVersionExA
HeapAlloc
HeapFree
GetProcessHeap
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LockResource
VirtualQuery
LoadResource
FindResourceA
GetCurrentProcessId
GlobalMemoryStatus
LoadLibraryW
FlushConsoleInputBuffer
SetConsoleMode
ReadConsoleInputW
GetConsoleMode
UnlockFileEx
LockFileEx
RtlUnwindEx
GetTimeZoneInformation
GetCommandLineA
IsDebuggerPresent
GetModuleFileNameW
DeleteCriticalSection
GetStartupInfoW
ReadConsoleW
IsValidCodePage
GetOEMCP
GetCPInfo
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
FindFirstFileExW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
GetStringTypeW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetDateFormatW
GetTimeFormatW
CompareStringW
MoveFileW
GetSystemTimeAsFileTime
HeapSize
IsProcessorFeaturePresent
AreFileApisANSI
GetModuleHandleExW
DecodePointer
EncodePointer
GetTempPathA
SetFilePointerEx
FlushFileBuffers
RaiseException
CreateThread
TerminateThread
ResumeThread
ReleaseMutex
CreateMutexA
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
FileTimeToLocalFileTime
FileTimeToSystemTime
SetStdHandle
LCMapStringW
user32
GetDesktopWindow
CharPrevA
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
LoadStringA
advapi32
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegQueryValueA
RegConnectRegistryA
RegCreateKeyA
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptReleaseContext
RegSetValueExA
RegSetValueA
RegSaveKeyA
RegLoadKeyA
RegFlushKey
RegEnumValueA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
shell32
ShellExecuteW
ShellExecuteA
ole32
ProgIDFromCLSID
oleaut32
SysStringLen
SysAllocStringLen
GetErrorInfo
SysFreeString
CommandAdded
DeinitServerExtension
GetExtensionName
InitServerExtension
PyAST_Compile
PyAST_FromNode
PyArena_AddPyObject
PyArena_Free
PyArena_Malloc
PyArena_New
PyArg_Parse
PyArg_ParseTuple
PyArg_ParseTupleAndKeywords
PyArg_UnpackTuple
PyArg_VaParse
PyArg_VaParseTupleAndKeywords
PyBaseObject_Type
PyBaseString_Type
PyBool_FromLong
PyBool_Type
PyBuffer_FillContiguousStrides
PyBuffer_FillInfo
PyBuffer_FromContiguous
PyBuffer_FromMemory
PyBuffer_FromObject
PyBuffer_FromReadWriteMemory
PyBuffer_FromReadWriteObject
PyBuffer_GetPointer
PyBuffer_IsContiguous
PyBuffer_New
PyBuffer_Release
PyBuffer_ToContiguous
PyBuffer_Type
PyByteArrayIter_Type
PyByteArray_AsString
PyByteArray_Concat
PyByteArray_Fini
PyByteArray_FromObject
PyByteArray_FromStringAndSize
PyByteArray_Init
PyByteArray_Resize
PyByteArray_Size
PyByteArray_Type
PyCFunction_Call
PyCFunction_ClearFreeList
PyCFunction_Fini
PyCFunction_GetFlags
PyCFunction_GetFunction
PyCFunction_GetSelf
PyCFunction_New
PyCFunction_NewEx
PyCFunction_Type
PyCObject_AsVoidPtr
PyCObject_FromVoidPtr
PyCObject_FromVoidPtrAndDesc
PyCObject_GetDesc
PyCObject_Import
PyCObject_SetVoidPtr
PyCObject_Type
PyCallIter_New
PyCallIter_Type
PyCallable_Check
PyCapsule_GetContext
PyCapsule_GetDestructor
PyCapsule_GetName
PyCapsule_GetPointer
PyCapsule_Import
PyCapsule_IsValid
PyCapsule_New
PyCapsule_SetContext
PyCapsule_SetDestructor
PyCapsule_SetName
PyCapsule_SetPointer
PyCapsule_Type
PyCell_Get
PyCell_New
PyCell_Set
PyCell_Type
PyClassMethod_New
PyClassMethod_Type
PyClass_IsSubclass
PyClass_New
PyClass_Type
PyCode_Addr2Line
PyCode_New
PyCode_NewEmpty
PyCode_Optimize
PyCode_Type
PyCodec_BackslashReplaceErrors
PyCodec_Decode
PyCodec_Decoder
PyCodec_Encode
PyCodec_Encoder
PyCodec_IgnoreErrors
PyCodec_IncrementalDecoder
PyCodec_IncrementalEncoder
PyCodec_LookupError
PyCodec_Register
PyCodec_RegisterError
PyCodec_ReplaceErrors
PyCodec_StreamReader
PyCodec_StreamWriter
PyCodec_StrictErrors
PyCodec_XMLCharRefReplaceErrors
PyComplex_AsCComplex
PyComplex_FromCComplex
PyComplex_FromDoubles
PyComplex_ImagAsDouble
PyComplex_RealAsDouble
PyComplex_Type
PyDescr_NewClassMethod
PyDescr_NewGetSet
PyDescr_NewMember
PyDescr_NewMethod
PyDescr_NewWrapper
PyDictItems_Type
PyDictIterItem_Type
PyDictIterKey_Type
PyDictIterValue_Type
PyDictKeys_Type
PyDictProxy_New
PyDictProxy_Type
PyDictValues_Type
PyDict_Clear
PyDict_Contains
PyDict_Copy
PyDict_DelItem
PyDict_DelItemString
PyDict_Fini
PyDict_GetItem
PyDict_GetItemString
PyDict_Items
PyDict_Keys
PyDict_Merge
PyDict_MergeFromSeq2
PyDict_New
PyDict_Next
PyDict_SetItem
PyDict_SetItemString
PyDict_Size
PyDict_Type
PyDict_Update
PyDict_Values
PyEllipsis_Type
PyEnum_Type
PyErr_BadArgument
PyErr_BadInternalCall
PyErr_CheckSignals
PyErr_Clear
PyErr_Display
PyErr_ExceptionMatches
PyErr_Fetch
PyErr_Format
PyErr_GivenExceptionMatches
PyErr_NewException
PyErr_NewExceptionWithDoc
PyErr_NoMemory
PyErr_NormalizeException
PyErr_Occurred
PyErr_Print
PyErr_PrintEx
PyErr_ProgramText
PyErr_Restore
PyErr_SetExcFromWindowsErr
PyErr_SetExcFromWindowsErrWithFilename
PyErr_SetExcFromWindowsErrWithFilenameObject
PyErr_SetExcFromWindowsErrWithUnicodeFilename
PyErr_SetFromErrno
PyErr_SetFromErrnoWithFilename
PyErr_SetFromErrnoWithFilenameObject
PyErr_SetFromErrnoWithUnicodeFilename
PyErr_SetFromWindowsErr
PyErr_SetFromWindowsErrWithFilename
PyErr_SetFromWindowsErrWithUnicodeFilename
PyErr_SetInterrupt
PyErr_SetNone
PyErr_SetObject
PyErr_SetString
PyErr_SyntaxLocation
PyErr_Warn
PyErr_WarnEx
PyErr_WarnExplicit
PyErr_WriteUnraisable
PyEval_AcquireLock
PyEval_AcquireThread
PyEval_CallFunction
PyEval_CallMethod
PyEval_CallObjectWithKeywords
PyEval_EvalCode
PyEval_EvalCodeEx
PyEval_EvalFrame
PyEval_EvalFrameEx
PyEval_GetBuiltins
PyEval_GetCallStats
PyEval_GetFrame
PyEval_GetFuncDesc
PyEval_GetFuncName
PyEval_GetGlobals
PyEval_GetLocals
PyEval_GetRestricted
PyEval_InitThreads
PyEval_MergeCompilerFlags
PyEval_ReInitThreads
PyEval_ReleaseLock
PyEval_ReleaseThread
PyEval_RestoreThread
PyEval_SaveThread
PyEval_SetProfile
PyEval_SetTrace
PyEval_ThreadsInitialized
PyExc_ArithmeticError
PyExc_AssertionError
PyExc_AttributeError
PyExc_BaseException
PyExc_BufferError
PyExc_BytesWarning
PyExc_DeprecationWarning
PyExc_EOFError
PyExc_EnvironmentError
PyExc_Exception
PyExc_FloatingPointError
PyExc_FutureWarning
PyExc_GeneratorExit
PyExc_IOError
PyExc_ImportError
PyExc_ImportWarning
PyExc_IndentationError
PyExc_IndexError
PyExc_KeyError
PyExc_KeyboardInterrupt
PyExc_LookupError
PyExc_MemoryError
PyExc_MemoryErrorInst
PyExc_NameError
PyExc_NotImplementedError
PyExc_OSError
PyExc_OverflowError
PyExc_PendingDeprecationWarning
PyExc_RecursionErrorInst
PyExc_ReferenceError
PyExc_RuntimeError
PyExc_RuntimeWarning
PyExc_StandardError
PyExc_StopIteration
PyExc_SyntaxError
PyExc_SyntaxWarning
PyExc_SystemError
PyExc_SystemExit
PyExc_TabError
PyExc_TypeError
PyExc_UnboundLocalError
PyExc_UnicodeDecodeError
PyExc_UnicodeEncodeError
PyExc_UnicodeError
PyExc_UnicodeTranslateError
PyExc_UnicodeWarning
PyExc_UserWarning
PyExc_ValueError
PyExc_Warning
PyExc_WindowsError
PyExc_ZeroDivisionError
PyFile_AsFile
PyFile_DecUseCount
PyFile_FromFile
PyFile_FromString
PyFile_GetLine
PyFile_IncUseCount
PyFile_Name
PyFile_SetBufSize
PyFile_SetEncoding
PyFile_SetEncodingAndErrors
PyFile_SoftSpace
PyFile_Type
PyFile_WriteObject
PyFile_WriteString
PyFloat_AsDouble
PyFloat_AsReprString
PyFloat_AsString
PyFloat_ClearFreeList
PyFloat_Fini
PyFloat_FromDouble
PyFloat_FromString
PyFloat_GetInfo
PyFloat_GetMax
PyFloat_GetMin
PyFloat_Type
PyFrame_BlockPop
PyFrame_BlockSetup
PyFrame_ClearFreeList
PyFrame_FastToLocals
PyFrame_Fini
PyFrame_GetLineNumber
PyFrame_LocalsToFast
PyFrame_New
PyFrame_Type
PyFrozenSet_New
PyFrozenSet_Type
PyFunction_GetClosure
PyFunction_GetCode
PyFunction_GetDefaults
PyFunction_GetGlobals
PyFunction_GetModule
PyFunction_New
PyFunction_SetClosure
PyFunction_SetDefaults
PyFunction_Type
PyFuture_FromAST
PyGC_Collect
PyGILState_Ensure
PyGILState_GetThisThreadState
PyGILState_Release
PyGen_NeedsFinalizing
PyGen_New
PyGen_Type
PyGetSetDescr_Type
PyImport_AddModule
PyImport_AppendInittab
PyImport_Cleanup
PyImport_ExecCodeModule
PyImport_ExecCodeModuleEx
PyImport_ExtendInittab
PyImport_FrozenModules
PyImport_GetImporter
PyImport_GetMagicNumber
PyImport_GetModuleDict
PyImport_Import
PyImport_ImportFrozenModule
PyImport_ImportModule
PyImport_ImportModuleLevel
PyImport_ImportModuleNoBlock
PyImport_Inittab
PyImport_ReloadModule
PyInstance_New
PyInstance_NewRaw
PyInstance_Type
PyInt_AsLong
PyInt_AsSsize_t
PyInt_AsUnsignedLongLongMask
PyInt_AsUnsignedLongMask
PyInt_ClearFreeList
PyInt_Fini
PyInt_FromLong
PyInt_FromSize_t
PyInt_FromSsize_t
PyInt_FromString
PyInt_FromUnicode
PyInt_GetMax
PyInt_Type
PyInterpreterState_Clear
PyInterpreterState_Delete
PyInterpreterState_Head
PyInterpreterState_New
PyInterpreterState_Next
PyInterpreterState_ThreadHead
PyIter_Next
PyList_Append
PyList_AsTuple
PyList_Fini
PyList_GetItem
PyList_GetSlice
PyList_Insert
PyList_New
PyList_Reverse
PyList_SetItem
PyList_SetSlice
PyList_Size
PyList_Sort
PyList_Type
PyLong_AsDouble
PyLong_AsLong
PyLong_AsLongAndOverflow
PyLong_AsLongLong
PyLong_AsLongLongAndOverflow
PyLong_AsSsize_t
PyLong_AsUnsignedLong
PyLong_AsUnsignedLongLong
PyLong_AsUnsignedLongLongMask
PyLong_AsUnsignedLongMask
PyLong_AsVoidPtr
PyLong_FromDouble
PyLong_FromLong
PyLong_FromLongLong
PyLong_FromSize_t
PyLong_FromSsize_t
PyLong_FromString
PyLong_FromUnicode
PyLong_FromUnsignedLong
PyLong_FromUnsignedLongLong
PyLong_FromVoidPtr
PyLong_GetInfo
PyLong_Type
PyMapping_Check
PyMapping_GetItemString
PyMapping_HasKey
PyMapping_HasKeyString
PyMapping_Length
PyMapping_SetItemString
PyMapping_Size
PyMarshal_ReadLastObjectFromFile
PyMarshal_ReadLongFromFile
PyMarshal_ReadObjectFromFile
PyMarshal_ReadObjectFromString
PyMarshal_ReadShortFromFile
PyMarshal_WriteLongToFile
PyMarshal_WriteObjectToFile
PyMarshal_WriteObjectToString
PyMem_Free
PyMem_Malloc
PyMem_Realloc
PyMemberDescr_Type
PyMember_Get
PyMember_GetOne
PyMember_Set
PyMember_SetOne
PyMemoryView_FromBuffer
PyMemoryView_FromObject
PyMemoryView_GetContiguous
PyMemoryView_Type
PyMethod_Class
PyMethod_ClearFreeList
PyMethod_Fini
PyMethod_Function
PyMethod_New
PyMethod_Self
PyMethod_Type
PyModule_AddIntConstant
PyModule_AddObject
PyModule_AddStringConstant
PyModule_GetDict
PyModule_GetFilename
PyModule_GetName
PyModule_New
PyModule_Type
PyNode_AddChild
PyNode_Compile
PyNode_Free
PyNode_ListTree
PyNode_New
PyNullImporter_Type
PyNumber_Absolute
PyNumber_Add
PyNumber_And
PyNumber_AsSsize_t
PyNumber_Check
PyNumber_Coerce
PyNumber_CoerceEx
PyNumber_Divide
PyNumber_Divmod
PyNumber_Float
PyNumber_FloorDivide
PyNumber_InPlaceAdd
PyNumber_InPlaceAnd
PyNumber_InPlaceDivide
PyNumber_InPlaceFloorDivide
PyNumber_InPlaceLshift
PyNumber_InPlaceMultiply
PyNumber_InPlaceOr
PyNumber_InPlacePower
PyNumber_InPlaceRemainder
PyNumber_InPlaceRshift
PyNumber_InPlaceSubtract
PyNumber_InPlaceTrueDivide
PyNumber_InPlaceXor
PyNumber_Index
PyNumber_Int
PyNumber_Invert
PyNumber_Long
PyNumber_Lshift
PyNumber_Multiply
PyNumber_Negative
PyNumber_Or
PyNumber_Positive
PyNumber_Power
PyNumber_Remainder
PyNumber_Rshift
PyNumber_Subtract
PyNumber_ToBase
PyNumber_TrueDivide
PyNumber_Xor
PyOS_AfterFork
PyOS_FiniInterrupts
PyOS_InitInterrupts
PyOS_InputHook
PyOS_InterruptOccurred
PyOS_Readline
PyOS_ReadlineFunctionPointer
PyOS_ascii_atof
PyOS_ascii_formatd
PyOS_ascii_strtod
PyOS_double_to_string
PyOS_getsig
PyOS_mystricmp
PyOS_mystrnicmp
PyOS_setsig
PyOS_snprintf
PyOS_string_to_double
PyOS_strtol
PyOS_strtoul
PyOS_vsnprintf
PyObject_AsCharBuffer
PyObject_AsFileDescriptor
PyObject_AsReadBuffer
PyObject_AsWriteBuffer
PyObject_Call
PyObject_CallFunction
PyObject_CallFunctionObjArgs
PyObject_CallMethod
PyObject_CallMethodObjArgs
PyObject_CallObject
PyObject_CheckReadBuffer
PyObject_ClearWeakRefs
PyObject_Cmp
PyObject_Compare
PyObject_CopyData
PyObject_DelItem
PyObject_DelItemString
PyObject_Dir
PyObject_Format
PyObject_Free
PyObject_GC_Del
PyObject_GC_Track
PyObject_GC_UnTrack
PyObject_GenericGetAttr
PyObject_GenericSetAttr
PyObject_GetAttr
PyObject_GetAttrString
PyObject_GetBuffer
PyObject_GetItem
PyObject_GetIter
PyObject_HasAttr
PyObject_HasAttrString
PyObject_Hash
PyObject_HashNotImplemented
PyObject_Init
PyObject_InitVar
PyObject_IsInstance
PyObject_IsSubclass
PyObject_IsTrue
PyObject_Length
PyObject_Malloc
PyObject_Not
PyObject_Print
PyObject_Realloc
PyObject_Repr
PyObject_RichCompare
PyObject_RichCompareBool
PyObject_SelfIter
PyObject_SetAttr
PyObject_SetAttrString
PyObject_SetItem
PyObject_Size
PyObject_Str
PyObject_Type
PyObject_Unicode
PyParser_ASTFromFile
PyParser_ASTFromString
PyParser_ParseFile
PyParser_ParseFileFlags
PyParser_ParseFileFlagsEx
PyParser_ParseString
PyParser_ParseStringFlags
PyParser_ParseStringFlagsFilename
PyParser_ParseStringFlagsFilenameEx
PyParser_SetError
PyParser_SimpleParseFile
PyParser_SimpleParseFileFlags
PyParser_SimpleParseString
PyParser_SimpleParseStringFlags
PyProperty_Type
PyRange_Type
PyReversed_Type
PyRun_AnyFile
PyRun_AnyFileEx
PyRun_AnyFileExFlags
PyRun_AnyFileFlags
PyRun_File
PyRun_FileEx
PyRun_FileExFlags
PyRun_FileFlags
PyRun_InteractiveLoop
PyRun_InteractiveLoopFlags
PyRun_InteractiveOne
PyRun_InteractiveOneFlags
PyRun_SimpleFile
PyRun_SimpleFileEx
PyRun_SimpleFileExFlags
PyRun_SimpleString
PyRun_SimpleStringFlags
PyRun_String
PyRun_StringFlags
PySTEntry_Type
PyST_GetScope
PySeqIter_New
PySeqIter_Type
PySequence_Check
PySequence_Concat
PySequence_Contains
PySequence_Count
PySequence_DelItem
PySequence_DelSlice
PySequence_Fast
PySequence_GetItem
PySequence_GetSlice
PySequence_In
PySequence_InPlaceConcat
PySequence_InPlaceRepeat
PySequence_Index
PySequence_Length
PySequence_List
PySequence_Repeat
PySequence_SetItem
PySequence_SetSlice
PySequence_Size
PySequence_Tuple
PySet_Add
PySet_Clear
PySet_Contains
PySet_Discard
PySet_Fini
PySet_New
PySet_Pop
PySet_Size
PySet_Type
PySlice_GetIndices
PySlice_GetIndicesEx
PySlice_New
PySlice_Type
PyStaticMethod_New
PyStaticMethod_Type
PyString_AsDecodedObject
PyString_AsDecodedString
PyString_AsEncodedObject
PyString_AsEncodedString
PyString_AsString
PyString_AsStringAndSize
PyString_Concat
PyString_ConcatAndDel
PyString_Decode
PyString_DecodeEscape
PyString_Encode
PyString_Fini
PyString_Format
PyString_FromFormat
PyString_FromFormatV
PyString_FromString
PyString_FromStringAndSize
PyString_InternFromString
PyString_InternImmortal
PyString_InternInPlace
PyString_Repr
PyString_Size
PyString_Type
PyStructSequence_InitType
PyStructSequence_New
PySuper_Type
PySymtable_Build
PySymtable_Free
PySymtable_Lookup
PySys_AddWarnOption
PySys_GetFile
PySys_GetObject
PySys_HasWarnOptions
PySys_ResetWarnOptions
PySys_SetArgv
PySys_SetArgvEx
PySys_SetObject
PySys_SetPath
PySys_WriteStderr
PySys_WriteStdout
PyThreadState_Clear
PyThreadState_Delete
PyThreadState_DeleteCurrent
PyThreadState_Get
PyThreadState_GetDict
PyThreadState_New
PyThreadState_Next
PyThreadState_SetAsyncExc
PyThreadState_Swap
PyThread_ReInitTLS
PyThread_acquire_lock
PyThread_allocate_lock
PyThread_create_key
PyThread_delete_key
PyThread_delete_key_value
PyThread_exit_thread
PyThread_free_lock
PyThread_get_key_value
PyThread_get_stacksize
PyThread_get_thread_ident
PyThread_init_thread
PyThread_release_lock
PyThread_set_key_value
PyThread_set_stacksize
PyThread_start_new_thread
PyToken_OneChar
PyToken_ThreeChars
PyToken_TwoChars
PyTraceBack_Here
PyTraceBack_Print
PyTraceBack_Type
PyTuple_ClearFreeList
PyTuple_Fini
PyTuple_GetItem
PyTuple_GetSlice
PyTuple_New
PyTuple_Pack
PyTuple_SetItem
PyTuple_Size
PyTuple_Type
PyType_ClearCache
PyType_GenericAlloc
PyType_GenericNew
PyType_IsSubtype
PyType_Modified
PyType_Ready
PyType_Type
PyUnicodeDecodeError_Create
PyUnicodeDecodeError_GetEncoding
PyUnicodeDecodeError_GetEnd
PyUnicodeDecodeError_GetObject
PyUnicodeDecodeError_GetReason
PyUnicodeDecodeError_GetStart
PyUnicodeDecodeError_SetEnd
PyUnicodeDecodeError_SetReason
PyUnicodeDecodeError_SetStart
PyUnicodeEncodeError_Create
PyUnicodeEncodeError_GetEncoding
PyUnicodeEncodeError_GetEnd
PyUnicodeEncodeError_GetObject
PyUnicodeEncodeError_GetReason
PyUnicodeEncodeError_GetStart
PyUnicodeEncodeError_SetEnd
PyUnicodeEncodeError_SetReason
PyUnicodeEncodeError_SetStart
PyUnicodeTranslateError_Create
PyUnicodeTranslateError_GetEnd
PyUnicodeTranslateError_GetObject
PyUnicodeTranslateError_GetReason
PyUnicodeTranslateError_GetStart
PyUnicodeTranslateError_SetEnd
PyUnicodeTranslateError_SetReason
PyUnicodeTranslateError_SetStart
PyUnicodeUCS2_AsASCIIString
PyUnicodeUCS2_AsCharmapString
PyUnicodeUCS2_AsEncodedObject
PyUnicodeUCS2_AsEncodedString
PyUnicodeUCS2_AsLatin1String
PyUnicodeUCS2_AsRawUnicodeEscapeString
PyUnicodeUCS2_AsUTF16String
PyUnicodeUCS2_AsUTF32String
PyUnicodeUCS2_AsUTF8String
PyUnicodeUCS2_AsUnicode
PyUnicodeUCS2_AsUnicodeEscapeString
PyUnicodeUCS2_AsWideChar
PyUnicodeUCS2_ClearFreelist
PyUnicodeUCS2_Compare
PyUnicodeUCS2_Concat
PyUnicodeUCS2_Contains
PyUnicodeUCS2_Count
PyUnicodeUCS2_Decode
PyUnicodeUCS2_DecodeASCII
PyUnicodeUCS2_DecodeCharmap
PyUnicodeUCS2_DecodeLatin1
PyUnicodeUCS2_DecodeRawUnicodeEscape
PyUnicodeUCS2_DecodeUTF16
PyUnicodeUCS2_DecodeUTF16Stateful
PyUnicodeUCS2_DecodeUTF32
PyUnicodeUCS2_DecodeUTF32Stateful
PyUnicodeUCS2_DecodeUTF8
PyUnicodeUCS2_DecodeUTF8Stateful
PyUnicodeUCS2_DecodeUnicodeEscape
PyUnicodeUCS2_Encode
PyUnicodeUCS2_EncodeASCII
PyUnicodeUCS2_EncodeCharmap
PyUnicodeUCS2_EncodeDecimal
PyUnicodeUCS2_EncodeLatin1
PyUnicodeUCS2_EncodeRawUnicodeEscape
PyUnicodeUCS2_EncodeUTF16
PyUnicodeUCS2_EncodeUTF32
PyUnicodeUCS2_EncodeUTF8
PyUnicodeUCS2_EncodeUnicodeEscape
PyUnicodeUCS2_Find
PyUnicodeUCS2_Format
PyUnicodeUCS2_FromEncodedObject
PyUnicodeUCS2_FromFormat
PyUnicodeUCS2_FromFormatV
PyUnicodeUCS2_FromObject
PyUnicodeUCS2_FromOrdinal
PyUnicodeUCS2_FromString
PyUnicodeUCS2_FromStringAndSize
PyUnicodeUCS2_FromUnicode
PyUnicodeUCS2_FromWideChar
PyUnicodeUCS2_GetDefaultEncoding
PyUnicodeUCS2_GetMax
PyUnicodeUCS2_GetSize
PyUnicodeUCS2_Join
PyUnicodeUCS2_Partition
PyUnicodeUCS2_RPartition
PyUnicodeUCS2_RSplit
PyUnicodeUCS2_Replace
PyUnicodeUCS2_Resize
PyUnicodeUCS2_RichCompare
PyUnicodeUCS2_SetDefaultEncoding
PyUnicodeUCS2_Split
PyUnicodeUCS2_Splitlines
PyUnicodeUCS2_Tailmatch
PyUnicodeUCS2_Translate
PyUnicodeUCS2_TranslateCharmap
PyUnicode_AsMBCSString
PyUnicode_BuildEncodingMap
PyUnicode_DecodeMBCS
PyUnicode_DecodeMBCSStateful
PyUnicode_DecodeUTF7
PyUnicode_DecodeUTF7Stateful
PyUnicode_EncodeMBCS
PyUnicode_EncodeUTF7
PyUnicode_Type
PyWeakref_GetObject
PyWeakref_NewProxy
PyWeakref_NewRef
PyWrapperDescr_Type
PyWrapper_New
Py_AddPendingCall
Py_AtExit
Py_BuildValue
Py_BytesWarningFlag
Py_CompileString
Py_CompileStringFlags
Py_DebugFlag
Py_DecRef
Py_DivisionWarningFlag
Py_DontWriteBytecodeFlag
Py_EndInterpreter
Py_Exit
Py_FatalError
Py_FdIsInteractive
Py_FileSystemDefaultEncoding
Py_Finalize
Py_FindMethod
Py_FindMethodInChain
Py_FlushLine
Py_FrozenFlag
Py_GetBuildInfo
Py_GetCompiler
Py_GetCopyright
Py_GetExecPrefix
Py_GetPath
Py_GetPlatform
Py_GetPrefix
Py_GetProgramFullPath
Py_GetProgramName
Py_GetPythonHome
Py_GetRecursionLimit
Py_GetVersion
Py_HashRandomizationFlag
Py_IgnoreEnvironmentFlag
Py_IncRef
Py_InitModule4_64
Py_Initialize
Py_InitializeEx
Py_InspectFlag
Py_InteractiveFlag
Py_IsInitialized
Py_Main
Py_MakePendingCalls
Py_NewInterpreter
Py_NoSiteFlag
Py_NoUserSiteDirectory
Py_OptimizeFlag
Py_Py3kWarningFlag
Py_ReprEnter
Py_ReprLeave
Py_SetProgramName
Py_SetPythonHome
Py_SetRecursionLimit
Py_SubversionRevision
Py_SubversionShortBranch
Py_SymtableString
Py_TabcheckFlag
Py_UnicodeFlag
Py_UseClassExceptionsFlag
Py_VaBuildValue
Py_VerboseFlag
ReflectiveLoader
StagelessInit
_PyArg_NoKeywords
_PyArg_ParseTupleAndKeywords_SizeT
_PyArg_ParseTuple_SizeT
_PyArg_Parse_SizeT
_PyArg_VaParseTupleAndKeywords_SizeT
_PyArg_VaParse_SizeT
_PyBuiltin_Init
_PyByteArray_empty_string
_PyBytes_FormatAdvanced
_PyCode_CheckLineNumber
_PyCodecInfo_GetIncrementalDecoder
_PyCodecInfo_GetIncrementalEncoder
_PyCodec_DecodeText
_PyCodec_EncodeText
_PyCodec_Lookup
_PyCodec_LookupTextEncoding
_PyComplex_FormatAdvanced
_PyDict_Contains
_PyDict_MaybeUntrack
_PyDict_NewPresized
_PyDict_Next
_PyErr_BadInternalCall
_PyErr_ReplaceException
_PyEval_CallTracing
_PyEval_SliceIndex
_PyExc_Fini
_PyExc_Init
_PyFloat_FormatAdvanced
_PyFloat_Init
_PyFloat_Pack4
_PyFloat_Pack8
_PyFloat_Unpack4
_PyFloat_Unpack8
_PyFrame_Init
_PyImportHooks_Init
_PyImport_AcquireLock
_PyImport_FindExtension
_PyImport_FindModule
_PyImport_Fini
_PyImport_FixupExtension
_PyImport_Init
_PyImport_IsScript
_PyImport_ReInitLock
_PyImport_ReleaseLock
_PyInstance_Lookup
_PyInt_AsInt
_PyInt_Format
_PyInt_FormatAdvanced
_PyInt_Init
_PyList_Extend
_PyLong_AsByteArray
_PyLong_AsInt
_PyLong_Copy
_PyLong_DigitValue
_PyLong_Format
_PyLong_FormatAdvanced
_PyLong_Frexp
_PyLong_FromByteArray
_PyLong_Init
_PyLong_New
_PyLong_NumBits
_PyLong_Sign
_PyModule_Clear
_PyNode_SizeOf
_PyNumber_ConvertIntegralToInt
_PyOS_ReadlineTState
_PyOS_URandom
_PyObject_CallFunction_SizeT
_PyObject_CallMethod_SizeT
_PyObject_Dump
_PyObject_GC_Malloc
_PyObject_GC_New
_PyObject_GC_NewVar
_PyObject_GC_Resize
_PyObject_GenericGetAttrWithDict
_PyObject_GenericSetAttrWithDict
_PyObject_GetDictPtr
_PyObject_LengthHint
_PyObject_LookupSpecial
_PyObject_New
_PyObject_NewVar
_PyObject_NextNotImplemented
_PyObject_RealIsInstance
_PyObject_RealIsSubclass
_PyObject_Str
_PyParser_Grammar
_PyParser_TokenNames
_PyRandom_Fini
_PyRandom_Init
_PySequence_IterSearch
_PySet_Next
_PySet_NextEntry
_PySet_Update
_PySlice_FromIndices
_PyString_Eq
_PyString_FormatLong
_PyString_InsertThousandsGrouping
_PyString_Join
_PyString_Resize
_PySys_GetSizeOf
_PySys_Init
_PyThreadState_Current
_PyThreadState_GetFrame
_PyThreadState_Init
_PyThreadState_Prealloc
_PyThread_CurrentFrames
_PyTime_DoubleToTimet
_PyTime_FloatTime
_PyTrash_delete_later
_PyTrash_delete_nesting
_PyTrash_deposit_object
_PyTrash_destroy_chain
_PyTrash_thread_deposit_object
_PyTrash_thread_destroy_chain
_PyTuple_MaybeUntrack
_PyTuple_Resize
_PyType_Lookup
_PyUnicodeUCS2_AsDefaultEncodedString
_PyUnicodeUCS2_IsAlpha
_PyUnicodeUCS2_IsDecimalDigit
_PyUnicodeUCS2_IsDigit
_PyUnicodeUCS2_IsLinebreak
_PyUnicodeUCS2_IsLowercase
_PyUnicodeUCS2_IsNumeric
_PyUnicodeUCS2_IsTitlecase
_PyUnicodeUCS2_IsUppercase
_PyUnicodeUCS2_IsWhitespace
_PyUnicodeUCS2_ToDecimalDigit
_PyUnicodeUCS2_ToDigit
_PyUnicodeUCS2_ToLowercase
_PyUnicodeUCS2_ToNumeric
_PyUnicodeUCS2_ToTitlecase
_PyUnicodeUCS2_ToUppercase
_PyUnicode_FormatAdvanced
_PyUnicode_XStrip
_PyWarnings_Init
_PyWeakref_CallableProxyType
_PyWeakref_ClearRef
_PyWeakref_GetWeakrefCount
_PyWeakref_ProxyType
_PyWeakref_RefType
_Py_BuildValue_SizeT
_Py_CheckInterval
_Py_CheckRecursionLimit
_Py_CheckRecursiveCall
_Py_DisplaySourceLine
_Py_EllipsisObject
_Py_HashDouble
_Py_HashPointer
_Py_HashSecret
_Py_Mangle
_Py_NoneStruct
_Py_NotImplementedStruct
_Py_PackageContext
_Py_QnewFlag
_Py_ReleaseInternedStrings
_Py_SwappedOp
_Py_Ticker
_Py_TrueStruct
_Py_VaBuildValue_SizeT
_Py_ZeroStruct
_Py_add_one_to_index_C
_Py_add_one_to_index_F
_Py_ascii_whitespace
_Py_c_abs
_Py_c_diff
_Py_c_neg
_Py_c_pow
_Py_c_prod
_Py_c_quot
_Py_c_sum
_Py_ctype_table
_Py_ctype_tolower
_Py_ctype_toupper
_Py_dg_dtoa
_Py_dg_freedtoa
_Py_dg_strtod
_Py_double_round
_Py_hgidentifier
_Py_hgversion
_Py_parse_inf_or_nan
_Py_svnversion
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1.2MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=199, version=41118,
count=266, id=224, version=20806,
count=29, id=223, version=20806,
count=61, id=225, version=20806,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=287, id=1, productName=Unmarked objects,
count=603, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=223, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_python.x86.dll
- IMPHASH f5b0703e510c7a8a6ddc593fb02172a6
- SHA256 1a77728ef970b73c1647d4ec78b0d29833c1065ee080c64c9a9a5308b86489b9
- MD5 bca1af8750e5636245929dbd19d77ccf
- SHA1 42c8ef0b16c37c1932f878a4065e4a5f9f990e75
- SHA512 b6d2d793bff2e47139b35289232b9becea99eb312a76bbfb581ab79a6724e189f624e4d108443799eb8ff179edbcfbfd0ad9b36b9d47f3bc85bb5d68f622c879
- SSDEEP 98304:b9YR9SV07OcpBGyenHPSMl/3i60LsPmvPd+u4kAB3V/XcNDvL4Xm:hYPE9332EzDcNDwm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
1642258
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
crypt32
CertGetEnhancedKeyUsage
CertFreeCRLContext
CertEnumCRLsInStore
CertFreeCertificateContext
CertEnumCertificatesInStore
CertOpenSystemStoreA
CertCloseStore
ws2_32
setsockopt
WSAIoctl
WSASetLastError
WSACleanup
WSAStartup
getprotobyname
getservbyname
getservbyport
gethostname
gethostbyname
__WSAFDIsSet
socket
shutdown
gethostbyaddr
sendto
send
recvfrom
recv
ntohs
ntohl
listen
inet_ntoa
inet_addr
htons
htonl
getsockopt
getsockname
getpeername
ioctlsocket
connect
closesocket
bind
accept
WSAGetLastError
select
kernel32
ReadConsoleInputA
PeekConsoleInputA
GetNumberOfConsoleInputEvents
GetCurrentProcess
GetLastError
GetFileSize
SetEndOfFile
SetFilePointer
CloseHandle
DuplicateHandle
GetSystemInfo
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetVersion
GetProcessTimes
OpenProcess
TerminateProcess
GetExitCodeProcess
SetLastError
WaitForSingleObject
GetFileInformationByHandle
GetFileType
FindClose
SetFileTime
GetSystemTime
SystemTimeToFileTime
CreatePipe
GetModuleFileNameA
CreateProcessA
GetEnvironmentVariableA
SetEnvironmentVariableA
SetEnvironmentVariableW
SetCurrentDirectoryA
SetCurrentDirectoryW
GetCurrentDirectoryA
GetCurrentDirectoryW
CreateDirectoryA
CreateDirectoryW
RemoveDirectoryA
RemoveDirectoryW
GetFullPathNameA
GetFullPathNameW
CreateFileA
CreateFileW
SetFileAttributesA
SetFileAttributesW
GetFileAttributesA
GetFileAttributesW
GetFileAttributesExA
GetFileAttributesExW
DeleteFileA
DeleteFileW
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
MoveFileA
MoveFileW
GenerateConsoleCtrlEvent
FreeLibrary
GetCPInfo
LoadLibraryA
GetSystemDirectoryA
VirtualProtect
ResetEvent
Sleep
CreateEventA
QueryPerformanceCounter
QueryPerformanceFrequency
SetConsoleCtrlHandler
DisableThreadLibraryCalls
LocalFree
FormatMessageA
IsBadStringPtrA
IsBadStringPtrW
VirtualAlloc
GetACP
GetLocaleInfoA
WriteFile
ReadFile
GetTickCount
PeekNamedPipe
GetCurrentThreadId
ReleaseSemaphore
WaitForMultipleObjects
CreateSemaphoreA
ExitProcess
ConnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeA
WaitNamedPipeA
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleW
OutputDebugStringA
GetStdHandle
GetModuleHandleA
ExpandEnvironmentStringsW
SetErrorMode
LoadLibraryExA
OutputDebugStringW
GetConsoleCP
GetConsoleOutputCP
GetVersionExA
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
HeapAlloc
HeapFree
GetProcessHeap
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LockResource
VirtualQuery
LoadResource
FindResourceA
GetCurrentProcessId
GlobalMemoryStatus
FlushConsoleInputBuffer
HeapCompact
WriteConsoleW
SetConsoleMode
ReadConsoleInputW
GetConsoleMode
UnlockFileEx
LockFileEx
ExitThread
LoadLibraryExW
GetCommandLineA
IsDebuggerPresent
GetModuleFileNameW
DeleteCriticalSection
GetStartupInfoW
ReadConsoleW
IsValidCodePage
SetEvent
GetOEMCP
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
FindFirstFileExW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
GetStringTypeW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetDateFormatW
GetTimeFormatW
CompareStringW
GetProcAddress
GetTimeZoneInformation
GetSystemTimeAsFileTime
HeapSize
IsProcessorFeaturePresent
AreFileApisANSI
GetModuleHandleExW
GetTempPathA
SetFilePointerEx
FlushFileBuffers
SetStdHandle
RaiseException
CreateThread
TerminateThread
ResumeThread
ReleaseMutex
CreateMutexA
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
FileTimeToLocalFileTime
FileTimeToSystemTime
LCMapStringW
user32
GetDesktopWindow
CharPrevA
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
LoadStringA
advapi32
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegQueryValueA
RegConnectRegistryA
RegCreateKeyA
ReportEventA
RegisterEventSourceA
DeregisterEventSource
CryptReleaseContext
RegSetValueExA
RegSetValueA
RegSaveKeyA
RegLoadKeyA
RegFlushKey
RegEnumValueA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
shell32
ShellExecuteW
ShellExecuteA
ole32
ProgIDFromCLSID
oleaut32
SysStringLen
SysAllocStringLen
GetErrorInfo
SysFreeString
CommandAdded
DeinitServerExtension
GetExtensionName
InitServerExtension
PyAST_Compile
PyAST_FromNode
PyArena_AddPyObject
PyArena_Free
PyArena_Malloc
PyArena_New
PyArg_Parse
PyArg_ParseTuple
PyArg_ParseTupleAndKeywords
PyArg_UnpackTuple
PyArg_VaParse
PyArg_VaParseTupleAndKeywords
PyBaseObject_Type
PyBaseString_Type
PyBool_FromLong
PyBool_Type
PyBuffer_FillContiguousStrides
PyBuffer_FillInfo
PyBuffer_FromContiguous
PyBuffer_FromMemory
PyBuffer_FromObject
PyBuffer_FromReadWriteMemory
PyBuffer_FromReadWriteObject
PyBuffer_GetPointer
PyBuffer_IsContiguous
PyBuffer_New
PyBuffer_Release
PyBuffer_ToContiguous
PyBuffer_Type
PyByteArrayIter_Type
PyByteArray_AsString
PyByteArray_Concat
PyByteArray_Fini
PyByteArray_FromObject
PyByteArray_FromStringAndSize
PyByteArray_Init
PyByteArray_Resize
PyByteArray_Size
PyByteArray_Type
PyCFunction_Call
PyCFunction_ClearFreeList
PyCFunction_Fini
PyCFunction_GetFlags
PyCFunction_GetFunction
PyCFunction_GetSelf
PyCFunction_New
PyCFunction_NewEx
PyCFunction_Type
PyCObject_AsVoidPtr
PyCObject_FromVoidPtr
PyCObject_FromVoidPtrAndDesc
PyCObject_GetDesc
PyCObject_Import
PyCObject_SetVoidPtr
PyCObject_Type
PyCallIter_New
PyCallIter_Type
PyCallable_Check
PyCapsule_GetContext
PyCapsule_GetDestructor
PyCapsule_GetName
PyCapsule_GetPointer
PyCapsule_Import
PyCapsule_IsValid
PyCapsule_New
PyCapsule_SetContext
PyCapsule_SetDestructor
PyCapsule_SetName
PyCapsule_SetPointer
PyCapsule_Type
PyCell_Get
PyCell_New
PyCell_Set
PyCell_Type
PyClassMethod_New
PyClassMethod_Type
PyClass_IsSubclass
PyClass_New
PyClass_Type
PyCode_Addr2Line
PyCode_New
PyCode_NewEmpty
PyCode_Optimize
PyCode_Type
PyCodec_BackslashReplaceErrors
PyCodec_Decode
PyCodec_Decoder
PyCodec_Encode
PyCodec_Encoder
PyCodec_IgnoreErrors
PyCodec_IncrementalDecoder
PyCodec_IncrementalEncoder
PyCodec_LookupError
PyCodec_Register
PyCodec_RegisterError
PyCodec_ReplaceErrors
PyCodec_StreamReader
PyCodec_StreamWriter
PyCodec_StrictErrors
PyCodec_XMLCharRefReplaceErrors
PyComplex_AsCComplex
PyComplex_FromCComplex
PyComplex_FromDoubles
PyComplex_ImagAsDouble
PyComplex_RealAsDouble
PyComplex_Type
PyDescr_NewClassMethod
PyDescr_NewGetSet
PyDescr_NewMember
PyDescr_NewMethod
PyDescr_NewWrapper
PyDictItems_Type
PyDictIterItem_Type
PyDictIterKey_Type
PyDictIterValue_Type
PyDictKeys_Type
PyDictProxy_New
PyDictProxy_Type
PyDictValues_Type
PyDict_Clear
PyDict_Contains
PyDict_Copy
PyDict_DelItem
PyDict_DelItemString
PyDict_Fini
PyDict_GetItem
PyDict_GetItemString
PyDict_Items
PyDict_Keys
PyDict_Merge
PyDict_MergeFromSeq2
PyDict_New
PyDict_Next
PyDict_SetItem
PyDict_SetItemString
PyDict_Size
PyDict_Type
PyDict_Update
PyDict_Values
PyEllipsis_Type
PyEnum_Type
PyErr_BadArgument
PyErr_BadInternalCall
PyErr_CheckSignals
PyErr_Clear
PyErr_Display
PyErr_ExceptionMatches
PyErr_Fetch
PyErr_Format
PyErr_GivenExceptionMatches
PyErr_NewException
PyErr_NewExceptionWithDoc
PyErr_NoMemory
PyErr_NormalizeException
PyErr_Occurred
PyErr_Print
PyErr_PrintEx
PyErr_ProgramText
PyErr_Restore
PyErr_SetExcFromWindowsErr
PyErr_SetExcFromWindowsErrWithFilename
PyErr_SetExcFromWindowsErrWithFilenameObject
PyErr_SetExcFromWindowsErrWithUnicodeFilename
PyErr_SetFromErrno
PyErr_SetFromErrnoWithFilename
PyErr_SetFromErrnoWithFilenameObject
PyErr_SetFromErrnoWithUnicodeFilename
PyErr_SetFromWindowsErr
PyErr_SetFromWindowsErrWithFilename
PyErr_SetFromWindowsErrWithUnicodeFilename
PyErr_SetInterrupt
PyErr_SetNone
PyErr_SetObject
PyErr_SetString
PyErr_SyntaxLocation
PyErr_Warn
PyErr_WarnEx
PyErr_WarnExplicit
PyErr_WriteUnraisable
PyEval_AcquireLock
PyEval_AcquireThread
PyEval_CallFunction
PyEval_CallMethod
PyEval_CallObjectWithKeywords
PyEval_EvalCode
PyEval_EvalCodeEx
PyEval_EvalFrame
PyEval_EvalFrameEx
PyEval_GetBuiltins
PyEval_GetCallStats
PyEval_GetFrame
PyEval_GetFuncDesc
PyEval_GetFuncName
PyEval_GetGlobals
PyEval_GetLocals
PyEval_GetRestricted
PyEval_InitThreads
PyEval_MergeCompilerFlags
PyEval_ReInitThreads
PyEval_ReleaseLock
PyEval_ReleaseThread
PyEval_RestoreThread
PyEval_SaveThread
PyEval_SetProfile
PyEval_SetTrace
PyEval_ThreadsInitialized
PyExc_ArithmeticError
PyExc_AssertionError
PyExc_AttributeError
PyExc_BaseException
PyExc_BufferError
PyExc_BytesWarning
PyExc_DeprecationWarning
PyExc_EOFError
PyExc_EnvironmentError
PyExc_Exception
PyExc_FloatingPointError
PyExc_FutureWarning
PyExc_GeneratorExit
PyExc_IOError
PyExc_ImportError
PyExc_ImportWarning
PyExc_IndentationError
PyExc_IndexError
PyExc_KeyError
PyExc_KeyboardInterrupt
PyExc_LookupError
PyExc_MemoryError
PyExc_MemoryErrorInst
PyExc_NameError
PyExc_NotImplementedError
PyExc_OSError
PyExc_OverflowError
PyExc_PendingDeprecationWarning
PyExc_RecursionErrorInst
PyExc_ReferenceError
PyExc_RuntimeError
PyExc_RuntimeWarning
PyExc_StandardError
PyExc_StopIteration
PyExc_SyntaxError
PyExc_SyntaxWarning
PyExc_SystemError
PyExc_SystemExit
PyExc_TabError
PyExc_TypeError
PyExc_UnboundLocalError
PyExc_UnicodeDecodeError
PyExc_UnicodeEncodeError
PyExc_UnicodeError
PyExc_UnicodeTranslateError
PyExc_UnicodeWarning
PyExc_UserWarning
PyExc_ValueError
PyExc_Warning
PyExc_WindowsError
PyExc_ZeroDivisionError
PyFile_AsFile
PyFile_DecUseCount
PyFile_FromFile
PyFile_FromString
PyFile_GetLine
PyFile_IncUseCount
PyFile_Name
PyFile_SetBufSize
PyFile_SetEncoding
PyFile_SetEncodingAndErrors
PyFile_SoftSpace
PyFile_Type
PyFile_WriteObject
PyFile_WriteString
PyFloat_AsDouble
PyFloat_AsReprString
PyFloat_AsString
PyFloat_ClearFreeList
PyFloat_Fini
PyFloat_FromDouble
PyFloat_FromString
PyFloat_GetInfo
PyFloat_GetMax
PyFloat_GetMin
PyFloat_Type
PyFrame_BlockPop
PyFrame_BlockSetup
PyFrame_ClearFreeList
PyFrame_FastToLocals
PyFrame_Fini
PyFrame_GetLineNumber
PyFrame_LocalsToFast
PyFrame_New
PyFrame_Type
PyFrozenSet_New
PyFrozenSet_Type
PyFunction_GetClosure
PyFunction_GetCode
PyFunction_GetDefaults
PyFunction_GetGlobals
PyFunction_GetModule
PyFunction_New
PyFunction_SetClosure
PyFunction_SetDefaults
PyFunction_Type
PyFuture_FromAST
PyGC_Collect
PyGILState_Ensure
PyGILState_GetThisThreadState
PyGILState_Release
PyGen_NeedsFinalizing
PyGen_New
PyGen_Type
PyGetSetDescr_Type
PyImport_AddModule
PyImport_AppendInittab
PyImport_Cleanup
PyImport_ExecCodeModule
PyImport_ExecCodeModuleEx
PyImport_ExtendInittab
PyImport_FrozenModules
PyImport_GetImporter
PyImport_GetMagicNumber
PyImport_GetModuleDict
PyImport_Import
PyImport_ImportFrozenModule
PyImport_ImportModule
PyImport_ImportModuleLevel
PyImport_ImportModuleNoBlock
PyImport_Inittab
PyImport_ReloadModule
PyInstance_New
PyInstance_NewRaw
PyInstance_Type
PyInt_AsLong
PyInt_AsSsize_t
PyInt_AsUnsignedLongLongMask
PyInt_AsUnsignedLongMask
PyInt_ClearFreeList
PyInt_Fini
PyInt_FromLong
PyInt_FromSize_t
PyInt_FromSsize_t
PyInt_FromString
PyInt_FromUnicode
PyInt_GetMax
PyInt_Type
PyInterpreterState_Clear
PyInterpreterState_Delete
PyInterpreterState_Head
PyInterpreterState_New
PyInterpreterState_Next
PyInterpreterState_ThreadHead
PyIter_Next
PyList_Append
PyList_AsTuple
PyList_Fini
PyList_GetItem
PyList_GetSlice
PyList_Insert
PyList_New
PyList_Reverse
PyList_SetItem
PyList_SetSlice
PyList_Size
PyList_Sort
PyList_Type
PyLong_AsDouble
PyLong_AsLong
PyLong_AsLongAndOverflow
PyLong_AsLongLong
PyLong_AsLongLongAndOverflow
PyLong_AsSsize_t
PyLong_AsUnsignedLong
PyLong_AsUnsignedLongLong
PyLong_AsUnsignedLongLongMask
PyLong_AsUnsignedLongMask
PyLong_AsVoidPtr
PyLong_FromDouble
PyLong_FromLong
PyLong_FromLongLong
PyLong_FromSize_t
PyLong_FromSsize_t
PyLong_FromString
PyLong_FromUnicode
PyLong_FromUnsignedLong
PyLong_FromUnsignedLongLong
PyLong_FromVoidPtr
PyLong_GetInfo
PyLong_Type
PyMapping_Check
PyMapping_GetItemString
PyMapping_HasKey
PyMapping_HasKeyString
PyMapping_Length
PyMapping_SetItemString
PyMapping_Size
PyMarshal_ReadLastObjectFromFile
PyMarshal_ReadLongFromFile
PyMarshal_ReadObjectFromFile
PyMarshal_ReadObjectFromString
PyMarshal_ReadShortFromFile
PyMarshal_WriteLongToFile
PyMarshal_WriteObjectToFile
PyMarshal_WriteObjectToString
PyMem_Free
PyMem_Malloc
PyMem_Realloc
PyMemberDescr_Type
PyMember_Get
PyMember_GetOne
PyMember_Set
PyMember_SetOne
PyMemoryView_FromBuffer
PyMemoryView_FromObject
PyMemoryView_GetContiguous
PyMemoryView_Type
PyMethod_Class
PyMethod_ClearFreeList
PyMethod_Fini
PyMethod_Function
PyMethod_New
PyMethod_Self
PyMethod_Type
PyModule_AddIntConstant
PyModule_AddObject
PyModule_AddStringConstant
PyModule_GetDict
PyModule_GetFilename
PyModule_GetName
PyModule_New
PyModule_Type
PyNode_AddChild
PyNode_Compile
PyNode_Free
PyNode_ListTree
PyNode_New
PyNullImporter_Type
PyNumber_Absolute
PyNumber_Add
PyNumber_And
PyNumber_AsSsize_t
PyNumber_Check
PyNumber_Coerce
PyNumber_CoerceEx
PyNumber_Divide
PyNumber_Divmod
PyNumber_Float
PyNumber_FloorDivide
PyNumber_InPlaceAdd
PyNumber_InPlaceAnd
PyNumber_InPlaceDivide
PyNumber_InPlaceFloorDivide
PyNumber_InPlaceLshift
PyNumber_InPlaceMultiply
PyNumber_InPlaceOr
PyNumber_InPlacePower
PyNumber_InPlaceRemainder
PyNumber_InPlaceRshift
PyNumber_InPlaceSubtract
PyNumber_InPlaceTrueDivide
PyNumber_InPlaceXor
PyNumber_Index
PyNumber_Int
PyNumber_Invert
PyNumber_Long
PyNumber_Lshift
PyNumber_Multiply
PyNumber_Negative
PyNumber_Or
PyNumber_Positive
PyNumber_Power
PyNumber_Remainder
PyNumber_Rshift
PyNumber_Subtract
PyNumber_ToBase
PyNumber_TrueDivide
PyNumber_Xor
PyOS_AfterFork
PyOS_CheckStack
PyOS_FiniInterrupts
PyOS_InitInterrupts
PyOS_InputHook
PyOS_InterruptOccurred
PyOS_Readline
PyOS_ReadlineFunctionPointer
PyOS_ascii_atof
PyOS_ascii_formatd
PyOS_ascii_strtod
PyOS_double_to_string
PyOS_getsig
PyOS_mystricmp
PyOS_mystrnicmp
PyOS_setsig
PyOS_snprintf
PyOS_string_to_double
PyOS_strtol
PyOS_strtoul
PyOS_vsnprintf
PyObject_AsCharBuffer
PyObject_AsFileDescriptor
PyObject_AsReadBuffer
PyObject_AsWriteBuffer
PyObject_Call
PyObject_CallFunction
PyObject_CallFunctionObjArgs
PyObject_CallMethod
PyObject_CallMethodObjArgs
PyObject_CallObject
PyObject_CheckReadBuffer
PyObject_ClearWeakRefs
PyObject_Cmp
PyObject_Compare
PyObject_CopyData
PyObject_DelItem
PyObject_DelItemString
PyObject_Dir
PyObject_Format
PyObject_Free
PyObject_GC_Del
PyObject_GC_Track
PyObject_GC_UnTrack
PyObject_GenericGetAttr
PyObject_GenericSetAttr
PyObject_GetAttr
PyObject_GetAttrString
PyObject_GetBuffer
PyObject_GetItem
PyObject_GetIter
PyObject_HasAttr
PyObject_HasAttrString
PyObject_Hash
PyObject_HashNotImplemented
PyObject_Init
PyObject_InitVar
PyObject_IsInstance
PyObject_IsSubclass
PyObject_IsTrue
PyObject_Length
PyObject_Malloc
PyObject_Not
PyObject_Print
PyObject_Realloc
PyObject_Repr
PyObject_RichCompare
PyObject_RichCompareBool
PyObject_SelfIter
PyObject_SetAttr
PyObject_SetAttrString
PyObject_SetItem
PyObject_Size
PyObject_Str
PyObject_Type
PyObject_Unicode
PyParser_ASTFromFile
PyParser_ASTFromString
PyParser_ParseFile
PyParser_ParseFileFlags
PyParser_ParseFileFlagsEx
PyParser_ParseString
PyParser_ParseStringFlags
PyParser_ParseStringFlagsFilename
PyParser_ParseStringFlagsFilenameEx
PyParser_SetError
PyParser_SimpleParseFile
PyParser_SimpleParseFileFlags
PyParser_SimpleParseString
PyParser_SimpleParseStringFlags
PyProperty_Type
PyRange_Type
PyReversed_Type
PyRun_AnyFile
PyRun_AnyFileEx
PyRun_AnyFileExFlags
PyRun_AnyFileFlags
PyRun_File
PyRun_FileEx
PyRun_FileExFlags
PyRun_FileFlags
PyRun_InteractiveLoop
PyRun_InteractiveLoopFlags
PyRun_InteractiveOne
PyRun_InteractiveOneFlags
PyRun_SimpleFile
PyRun_SimpleFileEx
PyRun_SimpleFileExFlags
PyRun_SimpleString
PyRun_SimpleStringFlags
PyRun_String
PyRun_StringFlags
PySTEntry_Type
PyST_GetScope
PySeqIter_New
PySeqIter_Type
PySequence_Check
PySequence_Concat
PySequence_Contains
PySequence_Count
PySequence_DelItem
PySequence_DelSlice
PySequence_Fast
PySequence_GetItem
PySequence_GetSlice
PySequence_In
PySequence_InPlaceConcat
PySequence_InPlaceRepeat
PySequence_Index
PySequence_Length
PySequence_List
PySequence_Repeat
PySequence_SetItem
PySequence_SetSlice
PySequence_Size
PySequence_Tuple
PySet_Add
PySet_Clear
PySet_Contains
PySet_Discard
PySet_Fini
PySet_New
PySet_Pop
PySet_Size
PySet_Type
PySlice_GetIndices
PySlice_GetIndicesEx
PySlice_New
PySlice_Type
PyStaticMethod_New
PyStaticMethod_Type
PyString_AsDecodedObject
PyString_AsDecodedString
PyString_AsEncodedObject
PyString_AsEncodedString
PyString_AsString
PyString_AsStringAndSize
PyString_Concat
PyString_ConcatAndDel
PyString_Decode
PyString_DecodeEscape
PyString_Encode
PyString_Fini
PyString_Format
PyString_FromFormat
PyString_FromFormatV
PyString_FromString
PyString_FromStringAndSize
PyString_InternFromString
PyString_InternImmortal
PyString_InternInPlace
PyString_Repr
PyString_Size
PyString_Type
PyStructSequence_InitType
PyStructSequence_New
PySuper_Type
PySymtable_Build
PySymtable_Free
PySymtable_Lookup
PySys_AddWarnOption
PySys_GetFile
PySys_GetObject
PySys_HasWarnOptions
PySys_ResetWarnOptions
PySys_SetArgv
PySys_SetArgvEx
PySys_SetObject
PySys_SetPath
PySys_WriteStderr
PySys_WriteStdout
PyThreadState_Clear
PyThreadState_Delete
PyThreadState_DeleteCurrent
PyThreadState_Get
PyThreadState_GetDict
PyThreadState_New
PyThreadState_Next
PyThreadState_SetAsyncExc
PyThreadState_Swap
PyThread_ReInitTLS
PyThread_acquire_lock
PyThread_allocate_lock
PyThread_create_key
PyThread_delete_key
PyThread_delete_key_value
PyThread_exit_thread
PyThread_free_lock
PyThread_get_key_value
PyThread_get_stacksize
PyThread_get_thread_ident
PyThread_init_thread
PyThread_release_lock
PyThread_set_key_value
PyThread_set_stacksize
PyThread_start_new_thread
PyToken_OneChar
PyToken_ThreeChars
PyToken_TwoChars
PyTraceBack_Here
PyTraceBack_Print
PyTraceBack_Type
PyTuple_ClearFreeList
PyTuple_Fini
PyTuple_GetItem
PyTuple_GetSlice
PyTuple_New
PyTuple_Pack
PyTuple_SetItem
PyTuple_Size
PyTuple_Type
PyType_ClearCache
PyType_GenericAlloc
PyType_GenericNew
PyType_IsSubtype
PyType_Modified
PyType_Ready
PyType_Type
PyUnicodeDecodeError_Create
PyUnicodeDecodeError_GetEncoding
PyUnicodeDecodeError_GetEnd
PyUnicodeDecodeError_GetObject
PyUnicodeDecodeError_GetReason
PyUnicodeDecodeError_GetStart
PyUnicodeDecodeError_SetEnd
PyUnicodeDecodeError_SetReason
PyUnicodeDecodeError_SetStart
PyUnicodeEncodeError_Create
PyUnicodeEncodeError_GetEncoding
PyUnicodeEncodeError_GetEnd
PyUnicodeEncodeError_GetObject
PyUnicodeEncodeError_GetReason
PyUnicodeEncodeError_GetStart
PyUnicodeEncodeError_SetEnd
PyUnicodeEncodeError_SetReason
PyUnicodeEncodeError_SetStart
PyUnicodeTranslateError_Create
PyUnicodeTranslateError_GetEnd
PyUnicodeTranslateError_GetObject
PyUnicodeTranslateError_GetReason
PyUnicodeTranslateError_GetStart
PyUnicodeTranslateError_SetEnd
PyUnicodeTranslateError_SetReason
PyUnicodeTranslateError_SetStart
PyUnicodeUCS2_AsASCIIString
PyUnicodeUCS2_AsCharmapString
PyUnicodeUCS2_AsEncodedObject
PyUnicodeUCS2_AsEncodedString
PyUnicodeUCS2_AsLatin1String
PyUnicodeUCS2_AsRawUnicodeEscapeString
PyUnicodeUCS2_AsUTF16String
PyUnicodeUCS2_AsUTF32String
PyUnicodeUCS2_AsUTF8String
PyUnicodeUCS2_AsUnicode
PyUnicodeUCS2_AsUnicodeEscapeString
PyUnicodeUCS2_AsWideChar
PyUnicodeUCS2_ClearFreelist
PyUnicodeUCS2_Compare
PyUnicodeUCS2_Concat
PyUnicodeUCS2_Contains
PyUnicodeUCS2_Count
PyUnicodeUCS2_Decode
PyUnicodeUCS2_DecodeASCII
PyUnicodeUCS2_DecodeCharmap
PyUnicodeUCS2_DecodeLatin1
PyUnicodeUCS2_DecodeRawUnicodeEscape
PyUnicodeUCS2_DecodeUTF16
PyUnicodeUCS2_DecodeUTF16Stateful
PyUnicodeUCS2_DecodeUTF32
PyUnicodeUCS2_DecodeUTF32Stateful
PyUnicodeUCS2_DecodeUTF8
PyUnicodeUCS2_DecodeUTF8Stateful
PyUnicodeUCS2_DecodeUnicodeEscape
PyUnicodeUCS2_Encode
PyUnicodeUCS2_EncodeASCII
PyUnicodeUCS2_EncodeCharmap
PyUnicodeUCS2_EncodeDecimal
PyUnicodeUCS2_EncodeLatin1
PyUnicodeUCS2_EncodeRawUnicodeEscape
PyUnicodeUCS2_EncodeUTF16
PyUnicodeUCS2_EncodeUTF32
PyUnicodeUCS2_EncodeUTF8
PyUnicodeUCS2_EncodeUnicodeEscape
PyUnicodeUCS2_Find
PyUnicodeUCS2_Format
PyUnicodeUCS2_FromEncodedObject
PyUnicodeUCS2_FromFormat
PyUnicodeUCS2_FromFormatV
PyUnicodeUCS2_FromObject
PyUnicodeUCS2_FromOrdinal
PyUnicodeUCS2_FromString
PyUnicodeUCS2_FromStringAndSize
PyUnicodeUCS2_FromUnicode
PyUnicodeUCS2_FromWideChar
PyUnicodeUCS2_GetDefaultEncoding
PyUnicodeUCS2_GetMax
PyUnicodeUCS2_GetSize
PyUnicodeUCS2_Join
PyUnicodeUCS2_Partition
PyUnicodeUCS2_RPartition
PyUnicodeUCS2_RSplit
PyUnicodeUCS2_Replace
PyUnicodeUCS2_Resize
PyUnicodeUCS2_RichCompare
PyUnicodeUCS2_SetDefaultEncoding
PyUnicodeUCS2_Split
PyUnicodeUCS2_Splitlines
PyUnicodeUCS2_Tailmatch
PyUnicodeUCS2_Translate
PyUnicodeUCS2_TranslateCharmap
PyUnicode_AsMBCSString
PyUnicode_BuildEncodingMap
PyUnicode_DecodeMBCS
PyUnicode_DecodeMBCSStateful
PyUnicode_DecodeUTF7
PyUnicode_DecodeUTF7Stateful
PyUnicode_EncodeMBCS
PyUnicode_EncodeUTF7
PyUnicode_Type
PyWeakref_GetObject
PyWeakref_NewProxy
PyWeakref_NewRef
PyWrapperDescr_Type
PyWrapper_New
Py_AddPendingCall
Py_AtExit
Py_BuildValue
Py_BytesWarningFlag
Py_CompileString
Py_CompileStringFlags
Py_DebugFlag
Py_DecRef
Py_DivisionWarningFlag
Py_DontWriteBytecodeFlag
Py_EndInterpreter
Py_Exit
Py_FatalError
Py_FdIsInteractive
Py_FileSystemDefaultEncoding
Py_Finalize
Py_FindMethod
Py_FindMethodInChain
Py_FlushLine
Py_FrozenFlag
Py_GetBuildInfo
Py_GetCompiler
Py_GetCopyright
Py_GetExecPrefix
Py_GetPath
Py_GetPlatform
Py_GetPrefix
Py_GetProgramFullPath
Py_GetProgramName
Py_GetPythonHome
Py_GetRecursionLimit
Py_GetVersion
Py_HashRandomizationFlag
Py_IgnoreEnvironmentFlag
Py_IncRef
Py_InitModule4
Py_Initialize
Py_InitializeEx
Py_InspectFlag
Py_InteractiveFlag
Py_IsInitialized
Py_Main
Py_MakePendingCalls
Py_NewInterpreter
Py_NoSiteFlag
Py_NoUserSiteDirectory
Py_OptimizeFlag
Py_Py3kWarningFlag
Py_ReprEnter
Py_ReprLeave
Py_SetProgramName
Py_SetPythonHome
Py_SetRecursionLimit
Py_SubversionRevision
Py_SubversionShortBranch
Py_SymtableString
Py_TabcheckFlag
Py_UnicodeFlag
Py_UseClassExceptionsFlag
Py_VaBuildValue
Py_VerboseFlag
StagelessInit
_PyArg_NoKeywords
_PyArg_ParseTupleAndKeywords_SizeT
_PyArg_ParseTuple_SizeT
_PyArg_Parse_SizeT
_PyArg_VaParseTupleAndKeywords_SizeT
_PyArg_VaParse_SizeT
_PyBuiltin_Init
_PyByteArray_empty_string
_PyBytes_FormatAdvanced
_PyCode_CheckLineNumber
_PyCodecInfo_GetIncrementalDecoder
_PyCodecInfo_GetIncrementalEncoder
_PyCodec_DecodeText
_PyCodec_EncodeText
_PyCodec_Lookup
_PyCodec_LookupTextEncoding
_PyComplex_FormatAdvanced
_PyDict_Contains
_PyDict_MaybeUntrack
_PyDict_NewPresized
_PyDict_Next
_PyErr_BadInternalCall
_PyErr_ReplaceException
_PyEval_CallTracing
_PyEval_SliceIndex
_PyExc_Fini
_PyExc_Init
_PyFloat_FormatAdvanced
_PyFloat_Init
_PyFloat_Pack4
_PyFloat_Pack8
_PyFloat_Unpack4
_PyFloat_Unpack8
_PyFrame_Init
_PyImportHooks_Init
_PyImport_AcquireLock
_PyImport_FindExtension
_PyImport_FindModule
_PyImport_Fini
_PyImport_FixupExtension
_PyImport_Init
_PyImport_IsScript
_PyImport_ReInitLock
_PyImport_ReleaseLock
_PyInstance_Lookup
_PyInt_AsInt
_PyInt_Format
_PyInt_FormatAdvanced
_PyInt_Init
_PyList_Extend
_PyLong_AsByteArray
_PyLong_AsInt
_PyLong_Copy
_PyLong_DigitValue
_PyLong_Format
_PyLong_FormatAdvanced
_PyLong_Frexp
_PyLong_FromByteArray
_PyLong_Init
_PyLong_New
_PyLong_NumBits
_PyLong_Sign
_PyModule_Clear
_PyNode_SizeOf
_PyNumber_ConvertIntegralToInt
_PyOS_ReadlineTState
_PyOS_URandom
_PyObject_CallFunction_SizeT
_PyObject_CallMethod_SizeT
_PyObject_Dump
_PyObject_GC_Malloc
_PyObject_GC_New
_PyObject_GC_NewVar
_PyObject_GC_Resize
_PyObject_GenericGetAttrWithDict
_PyObject_GenericSetAttrWithDict
_PyObject_GetDictPtr
_PyObject_LengthHint
_PyObject_LookupSpecial
_PyObject_New
_PyObject_NewVar
_PyObject_NextNotImplemented
_PyObject_RealIsInstance
_PyObject_RealIsSubclass
_PyObject_Str
_PyParser_Grammar
_PyParser_TokenNames
_PyRandom_Fini
_PyRandom_Init
_PySequence_IterSearch
_PySet_Next
_PySet_NextEntry
_PySet_Update
_PySlice_FromIndices
_PyString_Eq
_PyString_FormatLong
_PyString_InsertThousandsGrouping
_PyString_Join
_PyString_Resize
_PySys_GetSizeOf
_PySys_Init
_PyThreadState_Current
_PyThreadState_GetFrame
_PyThreadState_Init
_PyThreadState_Prealloc
_PyThread_CurrentFrames
_PyTime_DoubleToTimet
_PyTime_FloatTime
_PyTrash_delete_later
_PyTrash_delete_nesting
_PyTrash_deposit_object
_PyTrash_destroy_chain
_PyTrash_thread_deposit_object
_PyTrash_thread_destroy_chain
_PyTuple_MaybeUntrack
_PyTuple_Resize
_PyType_Lookup
_PyUnicodeUCS2_AsDefaultEncodedString
_PyUnicodeUCS2_IsAlpha
_PyUnicodeUCS2_IsDecimalDigit
_PyUnicodeUCS2_IsDigit
_PyUnicodeUCS2_IsLinebreak
_PyUnicodeUCS2_IsLowercase
_PyUnicodeUCS2_IsNumeric
_PyUnicodeUCS2_IsTitlecase
_PyUnicodeUCS2_IsUppercase
_PyUnicodeUCS2_IsWhitespace
_PyUnicodeUCS2_ToDecimalDigit
_PyUnicodeUCS2_ToDigit
_PyUnicodeUCS2_ToLowercase
_PyUnicodeUCS2_ToNumeric
_PyUnicodeUCS2_ToTitlecase
_PyUnicodeUCS2_ToUppercase
_PyUnicode_FormatAdvanced
_PyUnicode_XStrip
_PyWarnings_Init
_PyWeakref_CallableProxyType
_PyWeakref_ClearRef
_PyWeakref_GetWeakrefCount
_PyWeakref_ProxyType
_PyWeakref_RefType
_Py_BuildValue_SizeT
_Py_CheckInterval
_Py_CheckRecursionLimit
_Py_CheckRecursiveCall
_Py_DisplaySourceLine
_Py_EllipsisObject
_Py_HashDouble
_Py_HashPointer
_Py_HashSecret
_Py_Mangle
_Py_NoneStruct
_Py_NotImplementedStruct
_Py_PackageContext
_Py_QnewFlag
_Py_ReleaseInternedStrings
_Py_SwappedOp
_Py_Ticker
_Py_TrueStruct
_Py_VaBuildValue_SizeT
_Py_ZeroStruct
_Py_add_one_to_index_C
_Py_add_one_to_index_F
_Py_ascii_whitespace
_Py_c_abs
_Py_c_diff
_Py_c_neg
_Py_c_pow
_Py_c_prod
_Py_c_quot
_Py_c_sum
_Py_ctype_table
_Py_ctype_tolower
_Py_ctype_toupper
_Py_dg_dtoa
_Py_dg_freedtoa
_Py_dg_strtod
_Py_double_round
_Py_hgidentifier
_Py_hgversion
_Py_parse_inf_or_nan
_Py_svnversion
_ReflectiveLoader@0
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
112KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=199, version=41118,
count=69, id=223, productName=VS2013 build 21005, version=21005,
count=258, id=224, productName=VS2013 build 21005, version=21005,
count=61, id=225, productName=VS2013 build 21005, version=21005,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=283, id=1, productName=Unmarked objects,
count=1, id=223, productName=VS2013 UPD4 build 31101, version=31101,
count=604, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_sniffer.x64.dll
- IMPHASH 96451f6bcbc1cd981d3c3690c6a2589f
- SHA256 2243e9ddb35ed62091fb77883554b2389a644e4c4d29bd77f12ab9ced33c1f23
- MD5 6212a8cfb4a3146aa9a11327c065b816
- SHA1 92581d9e2580756d3bdc864caa87a152828f96df
- SHA512 e6762cf72b7f6d8e7bc9c1c037607451fa27c8e87adf09fb54f3c7853e88c46da3b8096783dc52a97ede39fe913e2b5d9711365e36089d15233efa8ace8f4873
- SSDEEP 6144:+wHARMoRSw1Y04iETZmc66dn40TLmuETzoGiC1Q6F/8/rv+GV7OXg42Zws7o:HHIhYnZmccyeTzQzF2j2a8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
152076
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ws2_32
ntohs
htonl
getpeername
kernel32
CompareStringW
GetCurrentProcessId
VirtualAlloc
VirtualFree
GetProcessWorkingSetSize
SetProcessWorkingSetSize
OpenProcess
CreateThread
SetThreadPriority
ReleaseSemaphore
WaitForMultipleObjects
WaitForSingleObjectEx
CreateEventA
CreateSemaphoreA
VirtualLock
VirtualUnlock
TerminateThread
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SetEvent
WaitForSingleObject
Sleep
DeviceIoControl
IsBadReadPtr
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
GetCurrentProcess
GetSystemInfo
GetFileAttributesW
CreateFileW
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
GetFileSize
ReadFile
ResetEvent
FreeLibrary
GetProcAddress
LoadLibraryW
GlobalAlloc
GlobalReAlloc
GlobalLock
GlobalHandle
GlobalUnlock
GlobalFree
WriteFile
SetEndOfFile
SetFilePointer
VirtualProtect
WriteConsoleW
SetStdHandle
GetStringTypeW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
CreateFileA
GetSystemDirectoryW
GetLocalTime
CloseHandle
InitializeCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
MultiByteToWideChar
PulseEvent
GetLastError
ExitThread
SetUnhandledExceptionFilter
ExitProcess
FlushFileBuffers
ReadConsoleW
GetVersionExA
LCMapStringW
OutputDebugStringW
RaiseException
LoadLibraryExA
ResumeThread
ReleaseMutex
CreateMutexA
LoadLibraryA
GetSystemTime
SystemTimeToFileTime
GetCommandLineA
EncodePointer
DecodePointer
RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry
GetModuleHandleExW
GetStdHandle
GetModuleFileNameW
IsDebuggerPresent
IsProcessorFeaturePresent
SetLastError
GetFileType
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
HeapSize
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
user32
LoadCursorW
MessageBoxW
wsprintfA
SetCursor
EnumThreadWindows
GetParent
GetDesktopWindow
IsWindowVisible
wsprintfW
advapi32
RegCreateKeyExW
UnlockServiceDatabase
StartServiceW
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
LockServiceDatabase
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfigW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ole32
CoInitializeEx
CoCreateInstance
CoUninitialize
DeinitServerExtension
GetExtensionName
InitServerExtension
ReflectiveLoader
Name
.text
Size
245KB
Virtual Size
244KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
90KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
69KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=194, id=224, version=20806,
count=11, id=223, version=20806,
count=73, id=225, version=20806,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=177, id=1, productName=Unmarked objects,
count=40, id=225, productName=VS2013 build 21005, version=21005,
count=5, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_sniffer.x86.dll
- IMPHASH a982a0156f78161688814494d07e12ec
- SHA256 67a2c2d0a8214fef102ac57a8001f4d62ad30a8cb656e96a62ff365b6483d80b
- MD5 b9449349f238de62ee1bb9537aab6c71
- SHA1 36084e6e78e10ab3042348328d7fe3fa74ada2cd
- SHA512 b863ce673b294fd41895c58e3d857414604a79863c4fe5febba59253330640dd79c57672167c603bb715338b630521358ab40299db37c283c86f1580fca33eb4
- SSDEEP 6144:FIoK1O2KgCNVmOkltzaptmFRet8nY0a9txznHxk9TcGaKu6ejpOXg42ZwHaCu:FFK1O9xNkvapSY5pzny9gd6j2a6Cu
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
128177
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ws2_32
htonl
ntohs
getpeername
kernel32
GetCurrentProcessId
VirtualAlloc
VirtualFree
GetProcessWorkingSetSize
SetProcessWorkingSetSize
OpenProcess
CreateThread
SetThreadPriority
ReleaseSemaphore
WaitForMultipleObjects
WaitForSingleObjectEx
CreateEventA
CreateSemaphoreA
VirtualLock
VirtualUnlock
TerminateThread
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SetEvent
ResetEvent
WaitForSingleObject
Sleep
DeviceIoControl
IsBadReadPtr
GetTickCount
InterlockedIncrement
InterlockedDecrement
InterlockedExchangeAdd
GetCurrentThreadId
GetSystemTimeAsFileTime
GetCurrentProcess
CompareStringW
GetFileAttributesW
GetVersionExA
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
GetFileSize
ReadFile
FreeLibrary
GetProcAddress
LoadLibraryW
GlobalAlloc
GlobalReAlloc
GlobalLock
GlobalHandle
GlobalUnlock
GlobalFree
WriteFile
SetEndOfFile
SetFilePointer
VirtualProtect
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetConsoleMode
LCMapStringW
OutputDebugStringW
DeleteFileA
CreateFileW
CreateFileA
GetSystemDirectoryW
GetSystemDirectoryA
GetLocalTime
CloseHandle
lstrcmpA
InitializeCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
MultiByteToWideChar
PulseEvent
GetLastError
ExitThread
SetUnhandledExceptionFilter
ExitProcess
FlushFileBuffers
ReadConsoleW
GetSystemInfo
WriteConsoleW
SetStdHandle
GetStringTypeW
SetFilePointerEx
RaiseException
LoadLibraryExA
ResumeThread
ReleaseMutex
CreateMutexA
LoadLibraryA
GetSystemTime
SystemTimeToFileTime
GetCommandLineA
RtlUnwind
GetModuleHandleExW
GetStdHandle
GetModuleFileNameW
IsProcessorFeaturePresent
IsDebuggerPresent
SetLastError
GetFileType
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
HeapSize
VirtualQuery
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
user32
EnumThreadWindows
GetParent
GetDesktopWindow
LoadCursorW
SetCursor
wsprintfA
MessageBoxW
wsprintfW
IsWindowVisible
advapi32
StartServiceW
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
LockServiceDatabase
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfigW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyExW
RegQueryValueExW
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExW
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
UnlockServiceDatabase
ole32
CoUninitialize
CoInitializeEx
CoCreateInstance
DeinitServerExtension
GetExtensionName
InitServerExtension
_ReflectiveLoader@0
Name
.text
Size
214KB
Virtual Size
214KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
130KB
Virtual Size
153KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=30, id=223, productName=VS2013 build 21005, version=21005,
count=196, id=224, productName=VS2013 build 21005, version=21005,
count=182, id=1, productName=Unmarked objects,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=112, id=225, productName=VS2013 build 21005, version=21005,
count=1, id=223, productName=VS2013 UPD4 build 31101, version=31101,
count=5, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_stdapi.jar
- SHA256 681ae1a9ebfb03a3abd9da5cd7ed35833162c775728df751b00c1cd4f061ba43
- MD5 8549575407c734804e4f6f2d930086ea
- SHA1 ed1d3de990188d51a56fea787cad2b95d940096c
- SHA512 aa8e292e81a859c1c039bff15d9df1da9812b559494411211b4b7e0e04345f2aa3eb2a29d22f3a2b273b97d0e124cbf49f7edde5ce8f9003ab4658656450922a
- SSDEEP 768:5ClBYwWCI9l/CdOOCJnRvacp2i2hAMXiHUbjRw+ce2cywVQSy33lv3PmVv:AeFCsl/wOOCJnRScpvMXisjRw+ceNywt
- MD5 SHA1 SHA512 SSDEEP
data/meterpreter/ext_server_stdapi.php
- SHA256 5265654c25fec64c027af56afb9853c066476a811ea646638f085c5904e0623a
- MD5 966a78d3ed4a5732da24355d2ade3f09
- SHA1 cb02a6abb29fc0122f080bece6a0349cdb18e1e1
- SHA512 beb45a69c91beca47c100ec2b618941a749859f42f1217494f970fd01be7992302ae2302a3694181f84ad783fdc2b43cb977483f79a16d77caa29da53859ac0a
- SSDEEP 384:AzncZofv2vmKrEaNYAjYMhNu3AKczmy82Q2AIODjkCravheCiDJT:jZAKrRZjYMkczmJ2Q2A3DqeCi5
- MD5 SHA1 SHA512 SSDEEP
data/meterpreter/ext_server_stdapi.py
- SHA256 3327737e7c066dc1a6449d2d38a5379f8e98984df44ff295ff848715d5feb564
- MD5 2fbf9efefaa02c5429ba1b9f13f13dec
- SHA1 19e12abac0b42cca0815808b19edfddc9aac1b6a
- SHA512 87729731db22cc094f851cfd140cca7ee8c5b0f7bcdbb0f4b69885bff76933fa32e655704f0517c928daac5f1b5149a62429ff620a396ed8387221d32eada727
- SSDEEP 768:QUUoxOfhTlomqtlpXBjgSddHz4EDpznG4BmfYEvKbtBtaRMAGMZDszpmhlBs0qyW:zc1loPXBj7dZDdUQtBtBA5ZnszyW
- MD5 SHA1 SHA512 SSDEEP
data/meterpreter/ext_server_stdapi.x64.dll
- IMPHASH fd63c0a48290039784ebb6b5b4c0616d
- SHA256 9021f9334b739c1ef7b0951164c685fdde97dc372896dd3eca1b0bfdf513463e
- MD5 03d30cfec4e90584054110fc331c4c33
- SHA1 48d1ff3473cf8cdf0952df7eb0caa160e3ba2e18
- SHA512 e64ff1b6f245ea2520e615cd7ddac146e8c821e0ef8c357335519da70e6a832412bb19d4c591e9ed3c1e922d416709b8175dcfe4611f22c314412eafba162dac
- SSDEEP 6144:/43ggA4qUh86WEYHQSj9oJSlHEL9oSN9XDBbch49Fom20+OTsYE93WMGiec5OZYC:R9TwS5oIlHELjNxDBbcm2miLBWTr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
181644
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
psapi
EnumDeviceDrivers
GetDeviceDriverBaseNameW
GetDeviceDriverFileNameW
winmm
waveInAddBuffer
waveInStart
waveInStop
sndPlaySoundA
waveInOpen
waveInPrepareHeader
iphlpapi
GetIpNetTable
GetUdpTable
GetIfEntry
GetIpAddrTable
GetIpForwardTable
CreateIpForwardEntry
DeleteIpForwardEntry
GetTcpTable
shlwapi
SHDeleteKeyW
ws2_32
getsockname
bind
accept
WSASocketA
WSAEventSelect
WSACreateEvent
shutdown
send
select
recv
connect
closesocket
WSAGetLastError
WSASetLastError
WSACleanup
WSAStartup
getservbyname
getservbyport
gethostbyname
gethostbyaddr
inet_ntoa
inet_addr
htons
ntohs
htonl
listen
setsockopt
recvfrom
sendto
ntohl
kernel32
DeleteCriticalSection
GetFileType
SetFilePointerEx
ReadConsoleW
GetLastError
GetLogicalDriveStringsA
GetDriveTypeA
GetDiskFreeSpaceExA
GetProcAddress
CloseHandle
GetModuleHandleA
FreeLibrary
GlobalFree
LoadLibraryA
GetSystemDirectoryA
ExitProcess
SetUnhandledExceptionFilter
ExitThread
SetLastError
FindClose
lstrcmpiW
lstrcpyW
lstrlenW
ExpandEnvironmentStringsW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesW
GetFileAttributesExW
DeleteFileW
FindFirstFileW
FindNextFileW
CopyFileW
MoveFileW
GetLogicalDrives
GetDriveTypeW
GetSystemDefaultLCID
GetVersionExA
ResetEvent
Sleep
OpenProcess
GetCurrentProcess
VirtualAlloc
VirtualAllocEx
TerminateProcess
ReadProcessMemory
WriteProcessMemory
GetThreadContext
SetThreadContext
ResumeThread
VirtualFreeEx
VirtualProtectEx
VirtualQueryEx
VirtualLock
VirtualUnlock
GetCurrentProcessId
GetCurrentThread
WaitForSingleObject
RtlVirtualUnwind
ReadFile
CreatePipe
PeekNamedPipe
CreateProcessA
WideCharToMultiByte
OpenThread
TerminateThread
SuspendThread
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetExitCodeThread
WaitForSingleObjectEx
LocalFree
GetStartupInfoW
GetTimeZoneInformation
GetEnvironmentVariableW
GetComputerNameA
GetLocaleInfoA
GetHandleInformation
GetTickCount
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeA
HeapAlloc
HeapFree
GetProcessHeap
CreateThread
GetSystemTime
GetTimeFormatW
GetDateFormatW
LockResource
LoadResource
SizeofResource
ExpandEnvironmentStringsA
FindResourceA
GetFileAttributesA
DeleteFileA
FormatMessageA
SetEvent
CreateEventA
GetConsoleMode
UnhandledExceptionFilter
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
IsProcessorFeaturePresent
IsDebuggerPresent
GetModuleFileNameW
GetStdHandle
AreFileApisANSI
GetModuleHandleExW
GetSystemTimeAsFileTime
GetCommandLineA
DecodePointer
EncodePointer
RtlUnwindEx
HeapReAlloc
SystemTimeToFileTime
GetThreadId
CreateRemoteThread
VirtualFree
CreateMutexA
ReleaseMutex
GetCurrentThreadId
MultiByteToWideChar
LoadLibraryExA
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
LoadLibraryExW
OutputDebugStringW
GetStringTypeW
CompareStringW
GetConsoleCP
RtlPcToFileHeader
GetModuleFileNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
GetLocalTime
RtlLookupFunctionEntry
LCMapStringW
SetStdHandle
FlushFileBuffers
WriteConsoleW
CreateFileW
HeapSize
SetEndOfFile
WriteFile
SetEnvironmentVariableA
user32
wsprintfW
OpenDesktopA
GetSystemMetrics
GetWindowThreadProcessId
EnumChildWindows
GetForegroundWindow
MapVirtualKeyA
SendInput
GetKeyNameTextW
GetKeyboardState
GetAsyncKeyState
GetKeyState
DestroyWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
DefWindowProcA
SendMessageA
DispatchMessageA
TranslateMessage
GetMessageA
ToUnicodeEx
GetProcessWindowStation
SetProcessWindowStation
CloseWindowStation
EnumWindowStationsA
OpenWindowStationA
CloseDesktop
SetThreadDesktop
SwitchDesktop
EnumDesktopsA
ExitWindowsEx
advapi32
OpenEventLogA
ConvertSidToStringSidA
ImpersonateLoggedOnUser
GetNumberOfEventLogRecords
CloseEventLog
ClearEventLogA
RegUnLoadKeyW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegQueryInfoKeyA
RegOpenKeyExW
RegOpenKeyW
RegLoadKeyW
RegEnumValueW
RegEnumKeyW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegConnectRegistryW
RegCloseKey
LookupAccountSidA
GetTokenInformation
DuplicateTokenEx
CreateProcessAsUserA
OpenThreadToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
ReadEventLogA
RevertToSelf
LookupAccountSidW
GetOldestEventLogRecord
ole32
CoUninitialize
CoCreateInstance
CoInitialize
oleaut32
VariantInit
VariantClear
mpr
WNetGetUniversalNameA
netapi32
NetWkstaGetInfo
DeinitServerExtension
GetExtensionName
InitServerExtension
ReflectiveLoader
Name
.text
Size
248KB
Virtual Size
247KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
71KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
30KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=207, productName=VS2012 UPD3 build 60610, version=60610,
count=155, id=224, version=20806,
count=11, id=223, version=20806,
count=56, id=225, version=20806,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=135, version=30729,
count=25, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=336, id=1, productName=Unmarked objects,
count=47, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=225, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_stdapi.x86.dll
- IMPHASH 327f19daaa9bfee0f9cc27197fccbf1d
- SHA256 71d40ff442c60fe264f27dd1ffbbeb51a8e9a240e6ae9256967ea9376b97c4bc
- MD5 f993d91f46eb8018f5d17fbf5b5c1890
- SHA1 4472411065a4fe8480f7527603997d5f86af2d2a
- SHA512 6b2a266aab9bac2c67bf7339f0c53c289e24fa769e1bdf95cb640689ad8881d7d70beea799b3da8824b8d943443566c16aba653aaca4e7cf03de0b8b3a55512d
- SSDEEP 6144:Vvbv9L1uwetI4WWCUp4wd6wRb6upVI9wmpmRdlYoNwjMzRr0:VR1u1tI4WWCULVyERdlYoNy
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
185913
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
psapi
GetDeviceDriverFileNameW
GetDeviceDriverBaseNameW
EnumDeviceDrivers
winmm
waveInAddBuffer
waveInStart
waveInStop
sndPlaySoundA
waveInOpen
waveInPrepareHeader
iphlpapi
GetIpNetTable
GetUdpTable
GetIfEntry
GetIpAddrTable
GetIpForwardTable
CreateIpForwardEntry
DeleteIpForwardEntry
GetTcpTable
shlwapi
SHDeleteKeyW
ws2_32
getsockname
bind
accept
WSASocketA
WSAEventSelect
WSACreateEvent
shutdown
send
select
recv
connect
closesocket
WSAGetLastError
WSASetLastError
WSACleanup
WSAStartup
getservbyname
getservbyport
gethostbyname
gethostbyaddr
inet_ntoa
inet_addr
htons
ntohs
htonl
listen
setsockopt
recvfrom
sendto
ntohl
kernel32
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetCPInfo
GetLastError
GetLogicalDriveStringsA
GetDriveTypeA
GetDiskFreeSpaceExA
GetProcAddress
CloseHandle
GetModuleHandleA
FreeLibrary
GlobalFree
LoadLibraryA
GetSystemDirectoryA
ExitProcess
SetUnhandledExceptionFilter
ExitThread
SetLastError
FindClose
lstrcmpiW
lstrcpyW
lstrlenW
ExpandEnvironmentStringsW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesW
GetFileAttributesExW
DeleteFileW
FindFirstFileW
FindNextFileW
CopyFileW
MoveFileW
GetLogicalDrives
GetDriveTypeW
GetSystemDefaultLCID
GetVersionExA
ResetEvent
Sleep
OpenProcess
GetCurrentProcess
VirtualAllocEx
WriteProcessMemory
GetThreadContext
SetThreadContext
VirtualFreeEx
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
VirtualLock
VirtualUnlock
GetCurrentProcessId
TerminateProcess
GetCurrentThread
FreeEnvironmentStringsW
WaitForSingleObject
WriteFile
ReadFile
CreatePipe
PeekNamedPipe
CreateProcessA
WideCharToMultiByte
OpenThread
TerminateThread
SuspendThread
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetExitCodeThread
WaitForSingleObjectEx
GetFileType
GetLocalTime
GetTimeZoneInformation
GetEnvironmentVariableW
GetComputerNameA
GetLocaleInfoA
GetHandleInformation
GetTickCount
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeA
HeapAlloc
HeapFree
GetProcessHeap
CreateThread
GetSystemTime
GetTimeFormatW
GetDateFormatW
LockResource
LoadResource
SizeofResource
ExpandEnvironmentStringsA
FindResourceA
GetFileAttributesA
DeleteFileA
FormatMessageA
SetEvent
CreateEventA
UnhandledExceptionFilter
GetOEMCP
GetACP
IsValidCodePage
GetModuleFileNameW
GetStdHandle
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
IsDebuggerPresent
LeaveCriticalSection
EnterCriticalSection
AreFileApisANSI
GetModuleHandleExW
GetCommandLineA
HeapReAlloc
VirtualProtect
SystemTimeToFileTime
GetThreadId
CreateRemoteThread
VirtualFree
VirtualAlloc
CreateMutexA
ReleaseMutex
GetCurrentThreadId
MultiByteToWideChar
LoadLibraryExA
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
LoadLibraryExW
FlushFileBuffers
OutputDebugStringW
GetStringTypeW
DeleteCriticalSection
GetStartupInfoW
GetConsoleCP
RtlUnwind
VirtualQuery
GetModuleFileNameA
QueryPerformanceCounter
LocalFree
GetEnvironmentStringsW
CompareStringW
LCMapStringW
SetStdHandle
WriteConsoleW
CreateFileW
HeapSize
SetEnvironmentVariableA
ResumeThread
SetEndOfFile
user32
ExitWindowsEx
OpenDesktopA
GetSystemMetrics
GetWindowThreadProcessId
EnumChildWindows
GetForegroundWindow
MapVirtualKeyA
SendInput
GetKeyNameTextW
GetKeyboardState
GetAsyncKeyState
GetKeyState
DestroyWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
DefWindowProcA
SendMessageA
DispatchMessageA
TranslateMessage
GetMessageA
ToUnicodeEx
GetProcessWindowStation
SetProcessWindowStation
CloseWindowStation
EnumWindowStationsA
OpenWindowStationA
CloseDesktop
SetThreadDesktop
SwitchDesktop
EnumDesktopsA
wsprintfW
advapi32
ClearEventLogA
ConvertSidToStringSidA
ImpersonateLoggedOnUser
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegQueryInfoKeyA
RegOpenKeyExW
RegOpenKeyW
RegLoadKeyW
RegEnumValueW
RegEnumKeyW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegConnectRegistryW
RegCloseKey
LookupAccountSidA
GetTokenInformation
DuplicateTokenEx
CreateProcessAsUserA
OpenThreadToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
CloseEventLog
GetNumberOfEventLogRecords
GetOldestEventLogRecord
OpenEventLogA
ReadEventLogA
RevertToSelf
LookupAccountSidW
RegUnLoadKeyW
ole32
CoCreateInstance
CoUninitialize
CoInitialize
oleaut32
VariantClear
VariantInit
mpr
WNetGetUniversalNameA
netapi32
NetWkstaGetInfo
DeinitServerExtension
GetExtensionName
InitServerExtension
_ReflectiveLoader@0
Name
.text
Size
250KB
Virtual Size
249KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
25KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=223, productName=VS2013 build 21005, version=21005,
count=161, id=224, productName=VS2013 build 21005, version=21005,
count=56, id=225, productName=VS2013 build 21005, version=21005,
count=24, id=207, productName=VS2012 UPD3 build 60610, version=60610,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=223, productName=VS2013 UPD4 build 31101, version=31101,
count=25, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=331, id=1, productName=Unmarked objects,
count=47, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=225, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_unhook.x64.dll
- IMPHASH 7266d93370465e3d388f4abe41855b39
- SHA256 aa18dabc989f57a1a79bba33d8e3ab4e0416d1bab31563470260eacccb21bfdb
- MD5 1c5b88c3d60b6c863943049755b1dc9a
- SHA1 528ef984a8dec1802a19dbb66d2d2c684e45a293
- SHA512 01585f45e2e81804ee953549a89d694242119615118897798d303d9bb2901eb4dd358b16019af689abef32d6efdeeb59f25553045a974207524af063ffc04890
- SSDEEP 1536:BDy44uuv5KTs7WfBWhOrLyToU3xbS1lXQ17KYMU8mnsW4d0ZEVEuV:BDH47vUTsSfWOrLGxxbae1ygo0eVEuV
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
14376
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualAlloc
VirtualFree
VirtualProtect
CloseHandle
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
LoadLibraryW
GetModuleHandleW
CreateFileW
ExitProcess
SetUnhandledExceptionFilter
ExitThread
RaiseException
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExA
HeapFree
MultiByteToWideChar
GetCommandLineA
GetCurrentThreadId
RtlUnwindEx
IsDebuggerPresent
EncodePointer
DecodePointer
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
HeapAlloc
GetProcessHeap
GetModuleHandleExW
WideCharToMultiByte
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
LCMapStringW
WriteFile
GetModuleFileNameW
LoadLibraryExW
HeapReAlloc
OutputDebugStringW
HeapSize
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
DeinitServerExtension
InitServerExtension
ReflectiveLoader
Name
.text
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=99, id=224, version=20806,
count=9, id=223, version=20806,
count=27, id=225, version=20806,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=94, id=1, productName=Unmarked objects,
count=5, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_unhook.x86.dll
- IMPHASH 6e4722a2d72172de112c119c9480172a
- SHA256 ab44dd0eb0c2c5ae66bd9d3f4c228512bec20e32a146a60c04b9ce70723ab27a
- MD5 38c758f7e713b71b68e639a9dbb69549
- SHA1 6ef5f856348c07610c0bf9f23512d14f963e078d
- SHA512 7a8cebcb4e6295a9bed07aff06c5967210edff556611d646f4fa21da6dd648a60a99c0d63c882a3480992ba913f06a49d7ab756d24b75a33da4a62430d5afead
- SSDEEP 1536:Asu0IYzaLgzy797pkvku9xI29kjUceNsWjcd/zO:bQ71O3Gcy/zO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
18760
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualAlloc
VirtualFree
VirtualProtect
CloseHandle
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
LoadLibraryW
GetModuleHandleW
CreateFileW
ExitProcess
SetUnhandledExceptionFilter
ExitThread
RaiseException
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExA
HeapFree
MultiByteToWideChar
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
HeapAlloc
GetProcessHeap
GetModuleHandleExW
WideCharToMultiByte
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlUnwind
VirtualQuery
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
LCMapStringW
WriteFile
GetModuleFileNameW
LoadLibraryExW
HeapReAlloc
OutputDebugStringW
HeapSize
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
DeinitServerExtension
InitServerExtension
_ReflectiveLoader@0
Name
.text
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=223, productName=VS2013 build 21005, version=21005,
count=105, id=224, productName=VS2013 build 21005, version=21005,
count=27, id=225, productName=VS2013 build 21005, version=21005,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=90, id=1, productName=Unmarked objects,
count=1, id=223, productName=VS2013 UPD4 build 31101, version=31101,
count=5, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_winpmem.x64.dll
- IMPHASH c76bc389fb7e5b56cb8c2b250ac3be3f
- SHA256 e2ae495646ea385fc30472067ce2942c98d8e5de90d080f5dcd9a546c2e17a83
- MD5 1b5bf2ffaa4b3ab88c2da52f3ce66e37
- SHA1 4c10d94edc041666c30c779c8be42a1429a9bafe
- SHA512 644a0bd031f75a64ee2a3c25b2c2f09ca46674be651717120940764fab60143c5a4b539c5051e92acb73874d46ca8c328df5dab5b254405c9ee8b838023e274e
- SSDEEP 24576:l1Ea91phi0jr8maTFWHyJxLNMMvkTk3NUY/EgQ2F154:zLHImaTFWHyJxLNMMvkTk3NU532354
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
19752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
DeviceIoControl
SetFilePointerEx
CloseHandle
SetHandleInformation
GetNativeSystemInfo
CreatePipe
CreateProcessW
FindResourceW
GetTempPathW
ReadFile
GetFullPathNameW
CreateFileW
DeleteFileW
ExitProcess
SetUnhandledExceptionFilter
GetCurrentThreadId
ExitThread
OutputDebugStringA
WriteFile
GetStdHandle
SizeofResource
LoadResource
GetLastError
GlobalMemoryStatusEx
GetTempFileNameW
LockResource
RaiseException
FreeLibrary
GetProcAddress
LoadLibraryExA
EncodePointer
DecodePointer
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
RtlLookupFunctionEntry
RtlUnwindEx
GetCommandLineA
IsProcessorFeaturePresent
RtlPcToFileHeader
GetProcessHeap
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameW
IsDebuggerPresent
SetLastError
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
LCMapStringW
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
OutputDebugStringW
GetConsoleCP
GetConsoleMode
HeapReAlloc
HeapSize
GetStringTypeW
SetStdHandle
WriteConsoleW
FlushFileBuffers
advapi32
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
StartServiceW
DeinitServerExtension
InitServerExtension
ReflectiveLoader
Name
.text
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=199, version=41118,
count=116, id=224, version=20806,
count=10, id=223, version=20806,
count=2, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=47, id=225, version=20806,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=115, id=1, productName=Unmarked objects,
count=2, id=225, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/ext_server_winpmem.x86.dll
- IMPHASH 0535f114ca261fa565d7cc03d9869104
- SHA256 9b226df8aa13b545c0fd0dd7fa3a58bb9d2015a8539f7b2fa85063980bdb1d96
- MD5 02979fe37d67e4b15a247c051f162222
- SHA1 a357f25a5fdb72311af04e802959550933b1e840
- SHA512 7aefe5ea7cf5f52d148772a2e7a559439e13b311af8a7576a179d2d899b39aa344639c0dcc360447a5a6ac0fabe6f584ff2909604fda16c7da74e7475933780b
- SSDEEP 24576:Ta91phi0jr8maTFWHyJxLNMMvkTk3NUY/EgQ2F154:qLHImaTFWHyJxLNMMvkTk3NU532354
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
15697
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
DeviceIoControl
SetFilePointerEx
CloseHandle
SetHandleInformation
GetNativeSystemInfo
CreatePipe
CreateProcessW
FindResourceW
GetTempPathW
ReadFile
GetFullPathNameW
CreateFileW
DeleteFileW
ExitProcess
SetUnhandledExceptionFilter
GetCurrentThreadId
ExitThread
OutputDebugStringA
WriteFile
GetStdHandle
SizeofResource
LoadResource
GetLastError
GlobalMemoryStatusEx
GetTempFileNameW
LockResource
RaiseException
FreeLibrary
GetProcAddress
LoadLibraryExA
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
RtlUnwind
GetCommandLineA
IsProcessorFeaturePresent
GetProcessHeap
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameW
IsDebuggerPresent
SetLastError
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
VirtualQuery
LCMapStringW
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
OutputDebugStringW
GetConsoleCP
GetConsoleMode
HeapReAlloc
HeapSize
GetStringTypeW
SetStdHandle
WriteConsoleW
FlushFileBuffers
advapi32
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
StartServiceW
DeinitServerExtension
InitServerExtension
_ReflectiveLoader@0
Name
.text
Size
65KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=199, version=41118,
count=21, id=223, productName=VS2013 build 21005, version=21005,
count=124, id=224, productName=VS2013 build 21005, version=21005,
count=2, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=46, id=225, productName=VS2013 build 21005, version=21005,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=110, id=1, productName=Unmarked objects,
count=1, id=223, productName=VS2013 UPD4 build 31101, version=31101,
count=2, id=225, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/meterpreter.jar
- SHA256 de5f61669b7b21eb50b69100ae658c90848c2a1ddfd10afc6b95595039c58c04
- MD5 54af77348780da1e525caf61e67716e2
- SHA1 5048deb6fdc2fed27bdb93ed46f48889c23bc5a5
- SHA512 c3db3647a6a395b5035616772e7112a2312d278cb2cc7b85a655381beedee8a76ca7f788a81daee27664d4a3ac70beb7e1ef9f4c54eed188a6046b6170629bda
- SSDEEP 768:xrpRsT08g3EtYdQfTNmW5lQh4bSHBf5k60b3hfYlHsh/VypNMFTh9NEnJe:xrpRsT08gUtgenG4+HBRk60bdYmhty7G
- MD5 SHA1 SHA512 SSDEEP
data/meterpreter/meterpreter.php
- SHA256 39f958f18242cfd21632240908bf16886792619a06b9e639e5434c9fa0f8ed53
- MD5 3b708a1aa844f7ef68ec7923adfad4df
- SHA1 c340eb3068f5441cb3432f05bf925d1cc680a92d
- SHA512 962004222933a64765d3273a63ac706b0bc73074aa38a9229671332407eaba687e07c5e104a79c36dccb09c578b45cbdfb74cf147b73017ec271da4939aa0f0c
- SSDEEP 384:Lj/oc6I6xGZupxkMRR3y4PfV8YyaNHjWHOI9u1ejC9B5HC:Lz76dxJkARyeV8YyaNH6C5i
- MD5 SHA1 SHA512 SSDEEP
data/meterpreter/meterpreter.py
- SHA256 dbd8856b90ebd09f9f23d71580bc7da8b44946d91367b5f4c5474062adb73f9a
- MD5 76aee899204f3f5b8206f82dc1e2bc47
- SHA1 7c030fdc7cca9ccff2eae6872fa752668cc5f3f4
- SHA512 e3e2be30fef0654db872bad5c62d7fed5b1bc293aa5d6c7055feb034596f03bb46341a3583de4e6ef19d8b78ea6faa6babe69c882c996cb2eb902efd621c7443
- SSDEEP 768:7n+k/eJr7VUgxMYB7iEnzbvb8UbdjbAxoz/P2lIO:7n+LUgxMYB7xzbvvTc
- MD5 SHA1 SHA512 SSDEEP
data/meterpreter/metsrv.x64.dll
- IMPHASH 9a9051067ad471b1d048919084f55c99
- SHA256 50aca3202ad71d113c8742769edc231d20dfdf7d56cb1fadc898cb79cd037400
- MD5 5d02306adf2b04a5d56698d27f5eb359
- SHA1 a44787221f3ef3d65a850d931df95c8675698e5e
- SHA512 4cd38a754e1d92ec212b71541576dd630696669eebdf7fe6ef5ec962b6d6ce8f551f9111c384eab4dd5f9c91e02980c8a10376896ea9d133100a277a5e848ef0
- SSDEEP 3072:byA1o8E7GrAZ4husjiqXS96wdq7tTtyV/AgjaUVu7UPlZXJsUtc+Uhi:byGoOAvsFSzdSTMV/AuvVuIe
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
90620
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ws2_32
recv
select
ntohl
WSASetLastError
send
setsockopt
socket
gethostbyaddr
gethostbyname
getservbyport
getservbyname
WSAStartup
htons
WSADuplicateSocketA
WSAGetLastError
ntohs
listen
inet_ntoa
inet_addr
connect
closesocket
bind
accept
htonl
crypt32
CryptImportPublicKeyInfo
CryptDecodeObjectEx
CryptStringToBinaryA
CertGetCertificateContextProperty
wininet
InternetOpenW
InternetCloseHandle
InternetConnectW
InternetReadFile
InternetSetOptionW
HttpOpenRequestW
HttpSendRequestW
HttpQueryInfoW
InternetCrackUrlW
winhttp
WinHttpReadData
WinHttpQueryOption
WinHttpSetOption
WinHttpOpenRequest
WinHttpConnect
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpCloseHandle
WinHttpOpen
WinHttpCrackUrl
WinHttpSendRequest
kernel32
HeapSize
LCMapStringW
GetStringTypeW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
OutputDebugStringW
LoadLibraryExW
LeaveCriticalSection
EnterCriticalSection
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
FlushInstructionCache
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WriteProcessMemory
LoadLibraryA
LoadLibraryW
GetModuleHandleA
ExitProcess
SetUnhandledExceptionFilter
ExitThread
GetLastError
GetSystemDirectoryW
GetVolumeInformationW
SetStdHandle
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
SetLastError
GetModuleHandleW
LocalAlloc
GetOverlappedResult
ResetEvent
WriteFile
ReadFile
CloseHandle
ConnectNamedPipe
CreateEventW
CreateNamedPipeA
Sleep
DuplicateHandle
SetHandleInformation
SetNamedPipeHandleState
PeekNamedPipe
CreateFileW
CreateNamedPipeW
GetSystemDirectoryA
GlobalFree
TlsAlloc
TerminateProcess
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetModuleFileNameA
GetStartupInfoW
DeleteCriticalSection
GetFileType
GetCPInfo
GetOEMCP
GetACP
WriteConsoleW
ResumeThread
GetComputerNameW
GetFileSize
CreateFileA
CreateThread
TerminateThread
IsValidCodePage
SetEvent
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateEventA
WaitForMultipleObjects
GetSystemTime
SystemTimeToFileTime
LocalFree
VirtualAllocEx
OpenProcess
OpenThread
SuspendThread
GetVersionExA
CreateToolhelp32Snapshot
Thread32First
Thread32Next
CreateRemoteThread
GetThreadId
HeapFree
HeapAlloc
HeapReAlloc
GetSystemTimeAsFileTime
RtlUnwindEx
WideCharToMultiByte
GetCommandLineA
MultiByteToWideChar
IsDebuggerPresent
EncodePointer
DecodePointer
IsProcessorFeaturePresent
GetProcessHeap
GetModuleHandleExW
GetStdHandle
GetModuleFileNameW
FlushFileBuffers
user32
GetProcessWindowStation
GetUserObjectInformationW
GetThreadDesktop
advapi32
SetEntriesInAclW
CryptDuplicateKey
CryptDecrypt
CryptEncrypt
CryptImportKey
CryptGenRandom
CryptSetKeyParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextA
ImpersonateLoggedOnUser
LookupPrivilegeValueA
LookupPrivilegeValueW
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
ole32
CoCreateGuid
Init
ReflectiveLoader
buffer_from_file
buffer_to_file
channel_close
channel_create
channel_create_datagram
channel_create_pool
channel_create_stream
channel_default_io_handler
channel_destroy
channel_exists
channel_find_by_id
channel_get_buffered_io_context
channel_get_class
channel_get_flags
channel_get_id
channel_get_native_io_context
channel_get_type
channel_interact
channel_is_flag
channel_is_interactive
channel_open
channel_read
channel_read_from_buffered
channel_set_buffered_io_handler
channel_set_flags
channel_set_interactive
channel_set_native_io_context
channel_set_type
channel_write
channel_write_to_buffered
channel_write_to_remote
command_deregister
command_deregister_all
command_handle
command_join_threads
command_register
command_register_all
core_update_desktop
core_update_thread_token
packet_add_completion_handler
packet_add_exception
packet_add_group
packet_add_request_id
packet_add_tlv_bool
packet_add_tlv_group
packet_add_tlv_qword
packet_add_tlv_raw
packet_add_tlv_string
packet_add_tlv_uint
packet_add_tlv_wstring
packet_add_tlv_wstring_len
packet_add_tlvs
packet_call_completion_handlers
packet_create
packet_create_group
packet_create_response
packet_destroy
packet_enum_tlv
packet_get_tlv
packet_get_tlv_group_entry
packet_get_tlv_meta
packet_get_tlv_string
packet_get_tlv_value_bool
packet_get_tlv_value_qword
packet_get_tlv_value_raw
packet_get_tlv_value_string
packet_get_tlv_value_uint
packet_get_tlv_value_wstring
packet_get_type
packet_is_tlv_null_terminated
packet_remove_completion_handler
packet_transmit
packet_transmit_empty_response
packet_transmit_response
scheduler_destroy
scheduler_initialize
scheduler_insert_waitable
scheduler_signal_waitable
scheduler_waitable_thread
Name
.text
Size
136KB
Virtual Size
135KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=36, id=225, version=20806,
count=124, id=224, version=20806,
count=10, id=223, version=20806,
count=1, id=135, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=204, id=1, productName=Unmarked objects,
count=30, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/metsrv.x86.dll
- IMPHASH b369089eef97f01fa6e25e5b6fe83274
- SHA256 a4065bed8e900bbf31136de996765d1fa7a9c6d00c86ab4c908011c41f8a7aee
- MD5 7ed787a575b64ca8d315ed6be816fe4f
- SHA1 5a9ba024e366b3b26f09e6bed3e427ee736a5183
- SHA512 dca1184a617092d76b862a5c1a8b8eaa02807eef31a16d23e8a5047e98d00330f4ee91bb2e93fac39c27f2dacaae5b59e483aaf3f62d7b266115c1402d552a83
- SSDEEP 3072:lwJH7DE9fbG810rg1SpywPq4YeMrUi7I9/t9s56Jw:S89fb1klHCPkM5Mw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
81437
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ws2_32
recv
select
ntohl
WSASetLastError
send
setsockopt
socket
gethostbyaddr
gethostbyname
getservbyport
getservbyname
WSAStartup
htons
WSADuplicateSocketA
WSAGetLastError
ntohs
listen
inet_ntoa
inet_addr
connect
closesocket
bind
accept
htonl
crypt32
CryptDecodeObjectEx
CryptImportPublicKeyInfo
CryptStringToBinaryA
CertGetCertificateContextProperty
wininet
InternetOpenW
InternetCloseHandle
InternetConnectW
InternetReadFile
InternetSetOptionW
HttpOpenRequestW
HttpSendRequestW
HttpQueryInfoW
InternetCrackUrlW
winhttp
WinHttpReadData
WinHttpQueryOption
WinHttpSetOption
WinHttpOpenRequest
WinHttpConnect
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpCloseHandle
WinHttpOpen
WinHttpCrackUrl
WinHttpSendRequest
kernel32
HeapSize
LCMapStringW
GetStringTypeW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
OutputDebugStringW
LoadLibraryExW
LeaveCriticalSection
EnterCriticalSection
RaiseException
TlsFree
TlsSetValue
GetProcAddress
FlushInstructionCache
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WriteProcessMemory
LoadLibraryA
LoadLibraryW
GetModuleHandleA
ExitProcess
SetUnhandledExceptionFilter
ExitThread
GetLastError
GetSystemDirectoryW
GetVolumeInformationW
SetStdHandle
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
SetLastError
GetModuleHandleW
LocalAlloc
GetOverlappedResult
ResetEvent
WriteFile
ReadFile
CloseHandle
ConnectNamedPipe
CreateEventW
CreateNamedPipeA
Sleep
DuplicateHandle
SetHandleInformation
SetNamedPipeHandleState
PeekNamedPipe
CreateFileW
CreateNamedPipeW
GetSystemDirectoryA
GlobalFree
TlsGetValue
TlsAlloc
TerminateProcess
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetModuleFileNameA
GetStartupInfoW
DeleteCriticalSection
GetFileType
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
RtlUnwind
CreateThread
WriteConsoleW
GetComputerNameW
GetFileSize
CreateFileA
TerminateThread
ResumeThread
SetEvent
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateEventA
WaitForMultipleObjects
GetSystemTime
SystemTimeToFileTime
LocalFree
VirtualAllocEx
OpenProcess
VirtualQueryEx
OpenThread
SuspendThread
GetVersionExA
CreateToolhelp32Snapshot
Thread32First
Thread32Next
CreateRemoteThread
GetThreadId
VirtualProtectEx
HeapFree
HeapAlloc
HeapReAlloc
GetSystemTimeAsFileTime
WideCharToMultiByte
GetCommandLineA
MultiByteToWideChar
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcessHeap
GetModuleHandleExW
GetStdHandle
GetModuleFileNameW
FlushFileBuffers
user32
GetProcessWindowStation
GetUserObjectInformationW
GetThreadDesktop
advapi32
SetSecurityDescriptorSacl
CryptDuplicateKey
CryptDecrypt
CryptEncrypt
CryptImportKey
CryptGenRandom
CryptSetKeyParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextA
ImpersonateLoggedOnUser
SetEntriesInAclW
LookupPrivilegeValueW
LookupPrivilegeValueA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
ole32
CoCreateGuid
Init
_ReflectiveLoader@0
_scheduler_waitable_thread@4
buffer_from_file
buffer_to_file
channel_close
channel_create
channel_create_datagram
channel_create_pool
channel_create_stream
channel_default_io_handler
channel_destroy
channel_exists
channel_find_by_id
channel_get_buffered_io_context
channel_get_class
channel_get_flags
channel_get_id
channel_get_native_io_context
channel_get_type
channel_interact
channel_is_flag
channel_is_interactive
channel_open
channel_read
channel_read_from_buffered
channel_set_buffered_io_handler
channel_set_flags
channel_set_interactive
channel_set_native_io_context
channel_set_type
channel_write
channel_write_to_buffered
channel_write_to_remote
command_deregister
command_deregister_all
command_handle
command_join_threads
command_register
command_register_all
core_update_desktop
core_update_thread_token
packet_add_completion_handler
packet_add_exception
packet_add_group
packet_add_request_id
packet_add_tlv_bool
packet_add_tlv_group
packet_add_tlv_qword
packet_add_tlv_raw
packet_add_tlv_string
packet_add_tlv_uint
packet_add_tlv_wstring
packet_add_tlv_wstring_len
packet_add_tlvs
packet_call_completion_handlers
packet_create
packet_create_group
packet_create_response
packet_destroy
packet_enum_tlv
packet_get_tlv
packet_get_tlv_group_entry
packet_get_tlv_meta
packet_get_tlv_string
packet_get_tlv_value_bool
packet_get_tlv_value_qword
packet_get_tlv_value_raw
packet_get_tlv_value_string
packet_get_tlv_value_uint
packet_get_tlv_value_wstring
packet_get_type
packet_is_tlv_null_terminated
packet_remove_completion_handler
packet_transmit
packet_transmit_empty_response
packet_transmit_response
scheduler_destroy
scheduler_initialize
scheduler_insert_waitable
scheduler_signal_waitable
Name
.text
Size
128KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=36, id=225, productName=VS2013 build 21005, version=21005,
count=23, id=223, productName=VS2013 build 21005, version=21005,
count=132, id=224, productName=VS2013 build 21005, version=21005,
count=201, id=1, productName=Unmarked objects,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=223, productName=VS2013 UPD4 build 31101, version=31101,
count=30, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/screenshot.x64.dll
- IMPHASH 448cc6134851742b014a9872c79fc4a2
- SHA256 ed1880534f6826dffec2e516c693a65984e26da213ca294ca3dda1a11086cc5b
- MD5 124a6630c3fc4acc0641de593d53d5b8
- SHA1 b1f4e6abcda1e190393d0621f42ff3bd912fa120
- SHA512 da82ee6866e7c49389fa2f25066a0fa3820699e1732601d3a60acdf561b8ebcd1f6ea203e38eb271c21655d648f1c1a97c10d68d53d7739c80b5a12eccbbbe24
- SSDEEP 6144:i43ggA4FdWh6bExVCYlc/5dTt72fZR/pQ8KzcG8jgq/:B7ekYK/5f0Z7gI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
88396
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateFileA
GetVersionExA
ReadFile
CreateFileW
SetEnvironmentVariableA
WriteConsoleW
LoadLibraryA
HeapSize
HeapReAlloc
LCMapStringW
CompareStringW
CloseHandle
WriteFile
GetLastError
ExitThread
GetCurrentThreadId
GetProcAddress
FreeLibrary
GlobalFree
LocalAlloc
SetStdHandle
GlobalAlloc
HeapFree
HeapAlloc
GetCommandLineA
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcessHeap
GetStdHandle
GetModuleFileNameW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
RtlUnwindEx
LoadLibraryExW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
OutputDebugStringW
SetFilePointerEx
GetStringTypeW
ReadConsoleW
user32
GetDesktopWindow
ReleaseDC
GetDC
GetSystemMetrics
GetProcessWindowStation
SetProcessWindowStation
CloseWindowStation
OpenWindowStationA
GetThreadDesktop
CloseDesktop
SetThreadDesktop
OpenInputDesktop
gdi32
SelectObject
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectA
GetDIBits
StretchBlt
advapi32
RevertToSelf
ReflectiveLoader
Name
.text
Size
142KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=38, id=225, version=20806,
count=121, id=224, version=20806,
count=8, id=223, version=20806,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=109, id=1, productName=Unmarked objects,
count=24, id=207, productName=VS2012 UPD3 build 60610, version=60610,
count=2, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
data/meterpreter/screenshot.x86.dll
- IMPHASH 2fe88963b5bfb23726c0440e28530088
- SHA256 a5f9e866512647aa44144beb121d6367ec175e3b5ec4751f6ffa34d9e72fc80e
- MD5 d19bd7f212217afcab1de224515c9643
- SHA1 1d87dc8892318e4ec195639073f3093b5846dca1
- SHA512 5903559a297af5dc878499bd877579ec3953537024cfaf822193ff22d8c7d54f2eec034109bf15f3814da4e4222bc5dacfdb5bee981b6648110937440ba262dd
- SSDEEP 6144:ErxkIK+UbI4WWCUB4wd6wX7GOMKO+5M2:TIKhbI4WWCUQOXO+h
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
110306
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateFileA
GetVersionExA
ReadFile
CreateFileW
SetEnvironmentVariableA
WriteConsoleW
LoadLibraryA
HeapSize
HeapReAlloc
RtlUnwind
LCMapStringW
CompareStringW
CloseHandle
WriteFile
GetLastError
ExitThread
GetCurrentThreadId
GetProcAddress
FreeLibrary
GlobalFree
LocalAlloc
SetStdHandle
GlobalAlloc
HeapFree
HeapAlloc
GetCommandLineA
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcessHeap
GetStdHandle
GetModuleFileNameW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
LoadLibraryExW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
OutputDebugStringW
SetFilePointerEx
GetStringTypeW
ReadConsoleW
user32
GetDesktopWindow
ReleaseDC
GetDC
GetSystemMetrics
GetProcessWindowStation
SetProcessWindowStation
CloseWindowStation
OpenWindowStationA
GetThreadDesktop
CloseDesktop
SetThreadDesktop
OpenInputDesktop
gdi32
SelectObject
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectA
GetDIBits
StretchBlt
advapi32
RevertToSelf
_ReflectiveLoader@4
Name
.text
Size
161KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=38, id=225, productName=VS2013 build 21005, version=21005,
count=18, id=223, productName=VS2013 build 21005, version=21005,
count=124, id=224, productName=VS2013 build 21005, version=21005,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=104, id=1, productName=Unmarked objects,
count=24, id=207, productName=VS2012 UPD3 build 60610, version=60610,
count=1, id=223, productName=VS2013 UPD4 build 31101, version=31101,
count=2, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
lib/metasploit-payloads.rb
- SHA256 aed4a7712e05d6222c4387cd1db0d5d96195df7db59fdf23d53c4148b8f129d1
- MD5 cf0709fd12414a6b26a8d2adaee5f433
- SHA1 27017947ef15289a6509a72335fe63e2e1561e72
- SHA512 2d6d28ec1d0216f7e193f7d0005a91eb4ba2281fae5014ac1d185c43ed1e9c52d9c41fb55b60915ca5280d1762b3948cb9731bb0d57c5c30c02ce3a024525756
- SSDEEP 96:dkwkYUnDSpf2xSX3ONjd9EC1S0bdsUczggk:dwYCSYoX3ONB9EC1StUH
- MD5 SHA1 SHA512 SSDEEP
lib/metasploit-payloads/version.rb
- SHA256 b7f4bb475f27788675e99f63b01cc6f095e82644744eef8ec11fdd7c415dc270
- MD5 6fb9219e16e05826831ae8f4bf33ac5f
- SHA1 c9e8a7d7475efeea42fb25a014ef208ef3294fe4
- SHA512 5febdeeccf6b3d094b3dced766ea7174b9d5cdee2d67c4cb46ff2a1e224bc881b8ddae61fcfac0ac2c4f5032364b7412bfcd880ad1f3ab05ab59dc37c839ae0b
- MD5 SHA1 SHA512
metasploit-payloads.gemspec
- SHA256 6e17223668da9da3c54f5897925201e56c51615c764d0343f54fa5737e3cd922
- MD5 7cc3ffc6f5fe9e7112cc43089ffd2ea8
- SHA1 29ffc06e900852bef435bfe405d76b83e50c2459
- SHA512 a065638de04ee09408c6ee7abe3966b3f6024be0d0b9ead0640395bde044855143615d05b2fcc63188707ab015452c25b3a8859aadece0daac2a43ad6f7ac4f1
- MD5 SHA1 SHA512
data.tar.gz.sig
- SHA256 8e94f6ec8e7a33d2d3295664e5920580fd9f1161c970a705b92ca1e09e631ee3
- MD5 265d18f14ce56d12a30e2d843a5a4cd0
- SHA1 654e1a7c28b506f000ae0f2a22d1096e15e2514f
- SHA512 f5dd1f72a2f66b37234c6cb93b75c7774df3e88bc9ffe80835438895112888383988585fde49e98f1a111fb76f7571bac6b001001745d2247a8a286b422a4bcc
- MD5 SHA1 SHA512
metadata.gz
- SHA256 979d1b06545f62720e3a145231657e6512dbfa511346059fdb65c93d59f6c2aa
- MD5 5beeb29a9419f46a30a20ff678d23fd8
- SHA1 250ed53399435b356cb6ba11c8f3737bb9d711e0
- SHA512 d680a5ac66fbd8fd32a10f7ca583de9d9988eb9fe2fa2bdf3f0ee93c41dc2ab5857b80fbcb8fef18dad6d41474c287e4a1ddcc7f3eff56b2d51739b81047d66a
- SSDEEP 96:j9xdO+vffgqZqN+q4oYNU5FTWqmERXIaKUI:j9xAcfFZqN+XoiqXR4v
- MD5 SHA1 SHA512 SSDEEP
metadata
- SHA256 d62df121fc6e4da0e49278547d41842ef39dfcf80a480542d5eddd8047b289a6
- MD5 0eaf678192d4dda2b987569bbcd9bf50
- SHA1 bd4a408f8e1d50e2b7254db3bddbbd10aee5cbcf
- SHA512 fa183cd2d59dedbaabea239bd5e7f97876bb248d542dbf9f562d9eef689c898b2f6ece66ef46626a1ee9f44125549e559925308ac48e63d18147b459093aeb67
- SSDEEP 192:K7NsxQu73xDyw/MeHIZN7VhBBSA9//H8GUF/Fb3ZbLc:KXE3IWcpVnBSQ/PaM
- MD5 SHA1 SHA512 SSDEEP
metadata.gz.sig
- SHA256 9bcdd1cce32d31fc8b22df7028117cadc40a24b2b249c7a8f35f68ec8a8aebb3
- MD5 a652ff920e0b6e673d320ad0077288ae
- SHA1 b1a4c611db7d21dcfbf648aa544f34d9da5b91d2
- SHA512 c95d683678d828b889caa6eb742cd2fd2490a6b220ae4608062db781f52e2afeec77004a93383007137f6a6e35485b0bfc3061f710f7f67e869ff09053c78212
- MD5 SHA1 SHA512