mudfish-5[.]13[.]0-x86_64-win2k-setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

mudfish-5.13.0-x86_64-win2k-setup.exe
Size

13.6MB
MD5

9e089efa0e5f9d311b4a2499ea333552
SHA1

ebcb43cecb353babec6b0afb851f962bff0f753e
SHA256

f96086e606e94cd65e4238865bf02c56fb4385c8d31820e6a24e5279083b8831
SHA512

b5a970bc0b2adbca837f8fd83d3bde908aff5e6c885c84d14347738c36962b582c87c0a390a1be46fe9d2ebf1f830abdf38dcf73ce770d84df07914aae20faea
SSDEEP

196608:ZbT/7Aa0mVA1NThvOvOWJQiS5mQNlEhaz0QcwU64kbSxNl7XErCXQn6rFqZPz6xs:ZcxThrWWpNyjQRf4gOuChQ57d9j

Score

3^/10

Malware Config

Signatures

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/devcon.exe
unpack001/tap0901.sys
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/nsExec.dll

Files

mudfish-5.13.0-x86_64-win2k-setup.exe
.exe windows:4 windows x86 arch:x86

56a78d55f3f7af51443e58e0ce2fb5f6

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15/01/2024, 00:00

Not After

14/04/2035, 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ea:07:e8:ec:e3:5e:0d:20:9b:77:9b:e1:7e:62:70:f2
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

25/04/2024, 00:00

Not After

25/04/2027, 23:59

Subject

CN=Mudfish Networks,O=Mudfish Networks,ST=Gyeongsangnam-do,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22/03/2021, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:a4:c0:44:62:77:64:62:b7:c9:42:c4:6c:88:05:aa:b8:02:83:c2
Signer

Actual PE Digest

29:a4:c0:44:62:77:64:62:b7:c9:42:c4:6c:88:05:aa:b8:02:83:c2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW

shell32

SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
CreateFileW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

fc0224e99e736751432961db63a41b76

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfW

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 662B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:4 windows x86 arch:x86

5e62e8e248e7364886b604bd1fcf4c13

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
OpenThreadToken
GetUserNameW

kernel32

GlobalFree
GetVersion
GlobalAlloc
CloseHandle
GetModuleHandleA
GetLastError
GetCurrentProcess
GetCurrentThread
GetProcAddress
lstrcpynW

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 714B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 705B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsExec.dll
.dll windows:4 windows x86 arch:x86

c1c7505e1e6e929ebb6b9100e55b050a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
IsTextUnicode

user32

wsprintfW
CharNextExA
SendMessageW
FindWindowExW
CharNextW
CharPrevW

kernel32

CreatePipe
DeleteFileW
lstrcmpiW
GetCommandLineW
ExitProcess
Sleep
TerminateProcess
GlobalReAlloc
MultiByteToWideChar
IsDBCSLeadByteEx
ReadFile
PeekNamedPipe
GetExitCodeProcess
WaitForSingleObject
GetTickCount
lstrcpyW
CreateProcessW
GetStartupInfoW
CreateFileMappingW
GetVersion
GetCurrentProcess
lstrcpynW
lstrlenW
lstrcatW
CloseHandle
UnmapViewOfFile
MapViewOfFile
GlobalFree
CreateFileW
CopyFileW
GetTempFileNameW
GlobalAlloc
GetModuleFileNameW
GetProcAddress
GetModuleHandleA

Exports

Exports

Exec
ExecToLog
ExecToStack

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MUDWFP.sys
.sys windows:10 windows x64 arch:x64

ec41525d638f59cfaf3f5a108c626e22

Code Sign

33:00:00:00:4d:e5:97:a7:75:e3:15:7f:7b:00:00:00:00:00:4d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/09/2021, 19:15

Not After

01/09/2022, 19:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

53:e3:04:27:93:57:bf:97:80:72:fe:62:a7:41:38:95:3c:d5:ab:c2:61:bd:0e:64:97:35:e3:50:22:78:20:a5
Signer

Actual PE Digest

53:e3:04:27:93:57:bf:97:80:72:fe:62:a7:41:38:95:3c:d5:ab:c2:61:bd:0e:64:97:35:e3:50:22:78:20:a5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Work\ttol\bin\mudwfp\x64\Release\MUDWFP.pdb

Imports

ntoskrnl.exe

ExFreePoolWithTag
IoFreeIrp
RtlLengthSid
wcsncpy
wcsstr
KeInitializeEvent
KeClearEvent
KeWaitForSingleObject
MmBuildMdlForNonPagedPool
PsTerminateSystemThread
IoAllocateIrp
IoAllocateMdl
KeSetEvent
ZwClose
ObfDereferenceObject
ObReferenceObjectByHandle
PsCreateSystemThread
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
KeInitializeSpinLock
PsSetCreateProcessNotifyRoutine
IoFreeMdl
RtlCopyUnicodeString
ExAllocatePoolWithTag
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
wcscpy_s

netio.sys

WskCaptureProviderNPI
WskRegister
WskReleaseProviderNPI
WskDeregister

ndis.sys

NdisFreeGenericObject
NdisAllocateNetBufferListPool
NdisFreeNetBufferListPool
NdisAllocateGenericObject
NdisGetDataBuffer

fwpkclnt.sys

FwpsReleaseClassifyHandle0
FwpsRedirectHandleDestroy0
FwpsRedirectHandleCreate0
FwpsInjectionHandleDestroy0
FwpsInjectionHandleCreate0
FwpsCalloutUnregisterById0
FwpsCalloutRegister2
FwpmFilterAdd0
FwpmCalloutAdd0
FwpmTransactionAbort0
FwpmTransactionCommit0
FwpmTransactionBegin0
FwpmEngineClose0
FwpmEngineOpen0
FwpmBfeStateUnsubscribeChanges0
FwpmBfeStateSubscribeChanges0
FwpmBfeStateGet0
FwpsInjectTransportReceiveAsync0
FwpsFreeNetBufferList0
FwpsAllocateNetBufferAndNetBufferList0
FwpsQueryConnectionRedirectState0
FwpsQueryPacketInjectionState0
FwpsApplyModifiedLayerData0
FwpsAcquireWritableLayerDataPointer0
FwpsAcquireClassifyHandle0
FwpsFlowRemoveContext0
FwpsFlowAssociateContext0

wdfldr.sys

WdfVersionUnbind
WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionBind

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 780B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OemWin2k.inf
WdfCoinstaller01011.dll
.dll windows:6 windows x64 arch:x64

553dfc6cd5891a057991f0695d243342

Code Sign

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:05:dd:42:00:00:00:00:00:14
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

26/03/2012, 21:37

Not After

26/06/2013, 21:37

Subject

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15/09/2005, 21:55

Not After

15/03/2016, 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:4d:e5:97:a7:75:e3:15:7f:7b:00:00:00:00:00:4d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/09/2021, 19:15

Not After

01/09/2022, 19:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:74:37:a3:05:3b:16:9c:08:97:37:aa:12:48:99:06:ef:23:b7:35:ba:d0:5c:1b:29:3d:ae:ca:3c:9a:4a:b2
Signer

Actual PE Digest

13:74:37:a3:05:3b:16:9c:08:97:37:aa:12:48:99:06:ef:23:b7:35:ba:d0:5c:1b:29:3d:ae:ca:3c:9a:4a:b2

Digest Algorithm

sha256

PE Digest Matches

true

3c:aa:50:ed:7a:7b:75:89:86:2f:97:5d:01:74:0e:5b:fe:6f:ba:ea
Signer

Actual PE Digest

3c:aa:50:ed:7a:7b:75:89:86:2f:97:5d:01:74:0e:5b:fe:6f:ba:ea

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WdfCoInstaller01011.pdb

Imports

msvcrt

free
_wtoi
_wcsnicmp
_amsg_exit
malloc
_ultow
_XcptFilter
_initterm
_wcsicmp
__C_specific_handler
_vsnwprintf
memcpy
memset

setupapi

SetupDiGetActualSectionToInstallW
SetupLogErrorW
SetupDiGetDeviceInstallParamsW
CM_Set_DevNode_Problem_Ex
SetupCloseInfFile
SetupOpenInfFileW
SetupCloseLog
SetupDiSetDeviceInstallParamsW
SetupOpenLog
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
SetupGetStringFieldW
SetupPromptReboot
SetupFindFirstLineW
SetupGetLineCountW
SetupFindNextMatchLineW

kernel32

FindClose
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
VerSetConditionMask
GetModuleHandleW
GetVersionExW
GetModuleFileNameW
VerifyVersionInfoW
GetLastError
GetProcAddress
GlobalFree
LocalAlloc
GetWindowsDirectoryW
LocalFree
FreeLibrary
LoadLibraryW
FindFirstFileW
FindResourceW
LoadResource
CreateProcessW
CreateDirectoryW
WaitForSingleObject
OutputDebugStringW
WriteFile
SizeofResource
FormatMessageW
GetExitCodeProcess
TerminateProcess
CreateFileW
SetLastError
GetCurrentThreadId
GetLocalTime
LockResource
RemoveDirectoryW
FindNextFileW
CloseHandle
DeleteFileW
ExpandEnvironmentStringsW
LoadLibraryExW
Sleep
QueryPerformanceCounter
GetCurrentProcessId

advapi32

EventUnregister
EventRegister
QueryServiceConfigW
ChangeServiceConfigW
RegFlushKey
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
EventWrite
QueryServiceStatusEx
RegQueryValueExW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle

shell32

CommandLineToArgvW

user32

IsCharAlphaNumericW
LoadStringW
IsCharAlphaW

shlwapi

PathFileExistsW

Exports

Exports

WdfCoInstaller
WdfPostDeviceInstall
WdfPostDeviceRemove
WdfPreDeviceInstall
WdfPreDeviceInstallEx
WdfPreDeviceRemove

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dbghelp.dll
.dll windows:6 windows x86 arch:x86

fa6b094f828920cf8999743ff0004319

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:03:dc:f6:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:12

Not After

25/07/2011, 19:22

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

8f:30:24:0d:35:ff:73:8c:8f:ce:2e:fe:f2:26:b5:b2:12:d2:d0:aa
Signer

Actual PE Digest

8f:30:24:0d:35:ff:73:8c:8f:ce:2e:fe:f2:26:b5:b2:12:d2:d0:aa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dbghelp.pdb

Imports

msvcrt

_isatty
_write
_lseeki64
??3@YAXPAX@Z
_fileno
_read
__pioinfo
__badioinfo
ferror
wctomb
_snprintf
isleadbyte
mbtowc
_onexit
_lock
__dllonexit
_unlock
_ismbblead
_amsg_exit
_initterm
_XcptFilter
memmove
_iob
__mb_cur_max
strchr
_vsnwprintf
_errno
__CxxFrameHandler
iswspace
calloc
_itoa
_wcsdup
towlower
tolower
_wcslwr
time
_wctime
_ltoa
_strnicmp
_wcsnicmp
_purecall
ctime
malloc
strncmp
isspace
_stricmp
_strlwr
free
wcsrchr
strstr
memcpy
_wcsicmp
qsort
wcschr
wcsstr
wcsncmp
iswxdigit
memset
??2@YAPAXI@Z
iswprint
fflush
fprintf
atol
fclose
__unDName
iswdigit
_CxxThrowException
bsearch
_wfsopen
fread
fseek
wcstol
_wfullpath
_wgetenv
_get_osfhandle
_chsize
_close
_open_osfhandle
ftell
_memicmp
_mbscmp
??1type_info@@UAE@XZ
_wsopen

kernel32

HeapFree
MapViewOfFileEx
GetCurrentDirectoryW
InitializeCriticalSectionAndSpinCount
GetFileType
DeviceIoControl
SetFileAttributesW
CreateFileMappingW
InterlockedIncrement
InterlockedDecrement
LocalFree
FormatMessageW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedExchange
GetThreadSelectorEntry
CreateThread
TerminateThread
VirtualQueryEx
GetPriorityClass
GetThreadPriority
GetThreadTimes
GetThreadContext
ResumeThread
SuspendThread
GetCurrentThreadId
GetSystemTimeAsFileTime
Sleep
GetVersion
GetSystemInfo
LoadLibraryExA
InterlockedCompareExchange
DelayLoadFailureHook
ReadProcessMemory
GetProcessHeap
GetFileAttributesA
SetErrorMode
WriteFile
OutputDebugStringA
VirtualFree
OpenProcess
GetCurrentProcessId
GetModuleHandleA
CreateFileMappingA
MapViewOfFile
DuplicateHandle
VirtualAlloc
VirtualProtect
CreateDirectoryA
UnmapViewOfFile
GetCurrentProcess
SetFilePointer
IsDBCSLeadByte
HeapAlloc
HeapReAlloc
GetVersionExA
InitializeCriticalSection
FindClose
SetLastError
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
CloseHandle
ReadFile
GetFileSize
CreateFileA
GetLastError
TlsSetValue
TlsGetValue
FreeLibrary
LoadLibraryA
TlsAlloc
TlsFree
DeleteCriticalSection
HeapDestroy
HeapCreate
FlushViewOfFile

Exports

Exports

DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
EnumDirTree
EnumDirTreeW
EnumerateLoadedModules
EnumerateLoadedModules64
EnumerateLoadedModulesEx
EnumerateLoadedModulesExW
EnumerateLoadedModulesW64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindDebugInfoFileExW
FindExecutableImage
FindExecutableImageEx
FindExecutableImageExW
FindFileInPath
FindFileInSearchPath
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MapDebugInformation
MiniDumpReadDumpStream
MiniDumpWriteDump
SearchTreeForFile
SearchTreeForFileW
StackWalk
StackWalk64
SymAddSourceStream
SymAddSourceStreamA
SymAddSourceStreamW
SymAddSymbol
SymAddSymbolW
SymCleanup
SymDeleteSymbol
SymDeleteSymbolW
SymEnumLines
SymEnumLinesW
SymEnumProcesses
SymEnumSourceFileTokens
SymEnumSourceFiles
SymEnumSourceFilesW
SymEnumSourceLines
SymEnumSourceLinesW
SymEnumSym
SymEnumSymbols
SymEnumSymbolsForAddr
SymEnumSymbolsForAddrW
SymEnumSymbolsW
SymEnumTypes
SymEnumTypesByName
SymEnumTypesByNameW
SymEnumTypesW
SymEnumerateModules
SymEnumerateModules64
SymEnumerateModulesW64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindDebugInfoFile
SymFindDebugInfoFileW
SymFindExecutableImage
SymFindExecutableImageW
SymFindFileInPath
SymFindFileInPathW
SymFromAddr
SymFromAddrW
SymFromIndex
SymFromIndexW
SymFromName
SymFromNameW
SymFromToken
SymFromTokenW
SymFunctionTableAccess
SymFunctionTableAccess64
SymGetFileLineOffsets64
SymGetHomeDirectory
SymGetHomeDirectoryW
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromAddrW64
SymGetLineFromName
SymGetLineFromName64
SymGetLineFromNameW64
SymGetLineNext
SymGetLineNext64
SymGetLineNextW64
SymGetLinePrev
SymGetLinePrev64
SymGetLinePrevW64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOmapBlockBase
SymGetOmaps
SymGetOptions
SymGetScope
SymGetScopeW
SymGetSearchPath
SymGetSearchPathW
SymGetSourceFile
SymGetSourceFileFromToken
SymGetSourceFileFromTokenW
SymGetSourceFileToken
SymGetSourceFileTokenW
SymGetSourceFileW
SymGetSourceVarFromToken
SymGetSourceVarFromTokenW
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetSymbolFile
SymGetSymbolFileW
SymGetTypeFromName
SymGetTypeFromNameW
SymGetTypeInfo
SymGetTypeInfoEx
SymGetUnwindInfo
SymInitialize
SymInitializeW
SymLoadModule
SymLoadModule64
SymLoadModuleEx
SymLoadModuleExW
SymMatchFileName
SymMatchFileNameW
SymMatchString
SymMatchStringA
SymMatchStringW
SymNext
SymNextW
SymPrev
SymPrevW
SymRefreshModuleList
SymRegisterCallback
SymRegisterCallback64
SymRegisterCallbackW64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymSearch
SymSearchW
SymSetContext
SymSetHomeDirectory
SymSetHomeDirectoryW
SymSetOptions
SymSetParentWindow
SymSetScopeFromAddr
SymSetScopeFromIndex
SymSetSearchPath
SymSetSearchPathW
SymSrvDeltaName
SymSrvDeltaNameW
SymSrvGetFileIndexInfo
SymSrvGetFileIndexInfoW
SymSrvGetFileIndexString
SymSrvGetFileIndexStringW
SymSrvGetFileIndexes
SymSrvGetFileIndexesW
SymSrvGetSupplement
SymSrvGetSupplementW
SymSrvIsStore
SymSrvIsStoreW
SymSrvStoreFile
SymSrvStoreFileW
SymSrvStoreSupplement
SymSrvStoreSupplementW
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnDecorateSymbolNameW
UnmapDebugInformation
WinDbgExtensionDllInit
block
chksym
dbghelp
dh
fptr
homedir
itoldyouso
lmi
lminfo
omap
srcfiles
stack_force_ebp
stackdbg
sym
symsrv
vc7fpo

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
devcon.exe
.exe windows:6 windows x64 arch:x64

ce4a5cfcfb0452b87e013f07f4d59f9c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

devcon.pdb

Imports

advapi32

OpenProcessToken
RegQueryValueExW
LookupPrivilegeValueW
AdjustTokenPrivileges
InitiateSystemShutdownExW
RegCloseKey
CloseServiceHandle
OpenSCManagerW
OpenServiceW
RegDeleteValueW
RegSetValueExW

kernel32

GetCurrentProcess
FormatMessageW
lstrlenW
GetLastError
CloseHandle
LocalFree
GetDateFormatW
FreeLibrary
LoadLibraryW
FileTimeToSystemTime
GetProcAddress
GetFullPathNameW
FindFirstFileW
GetFileAttributesW
FindClose
FindNextFileW
GetWindowsDirectoryW
Sleep
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
UnhandledExceptionFilter

msvcrt

wcschr
_wcsicmp
towlower
_wcsnicmp
fputs
__iob_func
wcsrchr
fputws
?terminate@@YAXXZ
memset
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
wprintf
??2@YAPEAX_K@Z
towupper
??3@YAXPEAX@Z
iswalpha

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

ole32

CLSIDFromString

setupapi

SetupScanFileQueueW
SetupDiGetClassDevsExW
SetupDiGetDeviceRegistryPropertyW
SetupDiSetClassInstallParamsW
SetupDiClassNameFromGuidExW
CM_Reenumerate_DevNode_Ex
SetupCopyOEMInfW
SetupDiSetDeviceRegistryPropertyW
SetupDiGetINFClassW
CM_Disconnect_Machine
SetupDiBuildClassInfoListExW
SetupDiCreateDeviceInfoW
SetupDiCreateDeviceInfoList
CM_Connect_MachineW
CM_Locate_DevNode_ExW
CM_Get_DevNode_Status_Ex
SetupDiBuildDriverInfoList
SetupDiGetDeviceInstallParamsW
SetupDiOpenDevRegKey
SetupDiSetSelectedDriverW
SetupGetStringFieldW
CM_Get_Res_Des_Data_Size_Ex
SetupDiEnumDriverInfoW
CM_Free_Log_Conf_Handle
CM_Get_Device_ID_ExW
CM_Get_Next_Res_Des_Ex
SetupCloseFileQueue
SetupDiGetDriverInstallParamsW
CM_Get_Res_Des_Data_Ex
SetupDiOpenClassRegKeyExW
SetupCloseInfFile
SetupOpenFileQueue
SetupDiCallClassInstaller
SetupDiDestroyDriverInfoList
SetupOpenInfFileW
CM_Free_Res_Des_Handle
CM_Get_First_Log_Conf_Ex
SetupDiSetDeviceInstallParamsW
SetupFindFirstLineW
SetupDiGetDriverInfoDetailW
SetupDiGetClassDescriptionExW
SetupDiClassGuidsFromNameExW
SetupDiOpenDeviceInfoW
SetupDiGetDeviceInfoListDetailW
SetupDiCreateDeviceInfoListExW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList

user32

CharNextW
CharPrevW
LoadStringW

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 368B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
htdocs-www-5.13.0.tar
.tar
css/bootstrap-switch.min.css
css/bootstrap.min.css
css/codemirror.min.css
css/codemirror.min.css.map
css/font-awesome.min.css
css/lightbox.min.css
css/morris-0.5.1.css
css/mudfish.css
css/pnotify.custom.min.css
css/quill.bubble.css
css/railroad.css
css/select2.min.css
css/vue-treeselect.min.css
fonts/fontawesome-webfont.eot
fonts/fontawesome-webfont.ttf
fonts/fontawesome-webfont.woff
fonts/glyphicons-halflings-regular.eot
fonts/glyphicons-halflings-regular.ttf
fonts/glyphicons-halflings-regular.woff
games/8_bit_panda.tic
games/stele.tic
images/bg/1.jpg
.jpg
images/close.png
.png
images/favicon.ico
images/free_node.png
.png
images/loading.gif
.gif
images/next.png
.png
images/prev.png
.png
images/tablesorter/asc.gif
.gif
images/tablesorter/bg.gif
.gif
images/tablesorter/desc.gif
.gif
js/axios.min.js
.js
js/axios.min.map
.js
js/bootstrap-switch.min.js
.js
js/bootstrap.min.js
.js
js/codemirror-mode-javascript.min.js
.js
js/codemirror.min.js
.js
js/es6-promise.auto.min.js
.js
js/es6-promise.min.js
.js
js/fuse.js
.js
js/jquery.min.js
.js
js/jquery.sparkline.min.js
.js
js/jquery.tablesorter.min.js
.js
js/loadingoverlay.min.js
.js
js/morris-0.5.1.min.js
.js
js/mousetrap.min.js
.js
js/mudfish.js
.js
js/mudfish_forums.js
.js
js/mustache-2.3.0.min.js
.js
js/pnotify.custom.min.js
.js
js/polyfill-URL.js
.js
js/railroad.js
.js
js/raphael-2.1.0-min.js
.js
js/select2.full.min.js
.js
js/tic80.js
.js
js/tic80.wasm
js/vue-treeselect.min.js
.js
js/vue.js
.js
www/de/advanced/cli.html
.html .js polyglot
www/de/advanced/packet_dump.html
.html .js polyglot
www/de/advanced/process_dump.html
.html .js polyglot
www/de/advanced/traceroute.html
.html .js polyglot
www/de/advanced/wpad.html
.html .js polyglot
www/de/dashboard.html
.html .js polyglot
www/de/dashboard_simple.html
.html .js polyglot
www/de/game_console.html
.html .js polyglot
www/de/i18n_items.js
.js
www/de/item/buy.html
.html .js polyglot
www/de/item/buy/rttmap_basic.html
.html .js polyglot
www/de/item/buy/rttmap_basic_status.html
.html .js polyglot
www/de/item/conf.html
.html .js polyglot
www/de/item/conf_configuration/rttmap_advanced.html
.html .js polyglot
www/de/item/conf_configuration/rttmap_basic.html
.html .js polyglot
www/de/item/conf_configuration/rttmap_basic_status.html
.html .js polyglot
www/de/item/conf_configuration/rttmap_multipath.html
.html .js polyglot
www/de/item/conf_configuration/rttmap_simple.html
.html .js polyglot
www/de/item/custom.html
.html .js polyglot
www/de/item/list.html
.html .js polyglot
www/de/item/manage.html
.html .js polyglot
www/de/item/mode.html
.html .js polyglot
www/de/item/wizard.html
.html .js polyglot
www/de/item/wizard_2.html
.html .js polyglot
www/de/item/wizard_3.html
.html .js polyglot
www/de/nodes/setup.html
.html .js polyglot
www/de/prog.html
.html .js polyglot
www/de/prog_fullvpn_3rdparty_rttmap.html
.html .js polyglot
www/de/prog_fullvpn_mudfish_rttmap.html
.html .js polyglot
www/de/report.html
.html .js polyglot
www/de/search.js
.js
www/de/signin.html
.html .js polyglot
www/de/status/access_log.html
.html .js polyglot
www/de/status/diag.html
.html .js polyglot
www/de/status/memory.html
.html .js polyglot
www/de/status/node_popup.html
.html .js polyglot
www/de/status/nodes.html
.html .js polyglot
www/de/status/processes.html
.html .js polyglot
www/de/status/traffic.html
.html .js polyglot
www/en/.gitignore
www/en/advanced/cli.html
.html .js polyglot
www/en/advanced/packet_dump.html
.html .js polyglot
www/en/advanced/process_dump.html
.html .js polyglot
www/en/advanced/traceroute.html
.html .js polyglot
www/en/advanced/wpad.html
.html .js polyglot
www/en/dashboard.html
.html .js polyglot
www/en/dashboard_simple.html
.html .js polyglot
www/en/game_console.html
.html .js polyglot
www/en/i18n_items.js
.js
www/en/item/buy.html
.html .js polyglot
www/en/item/buy/rttmap_basic.html
.html .js polyglot
www/en/item/buy/rttmap_basic_status.html
.html .js polyglot
www/en/item/conf.html
.html .js polyglot
www/en/item/conf_configuration/rttmap_advanced.html
.html .js polyglot
www/en/item/conf_configuration/rttmap_basic.html
.html .js polyglot
www/en/item/conf_configuration/rttmap_basic_status.html
.html .js polyglot
www/en/item/conf_configuration/rttmap_multipath.html
.html .js polyglot
www/en/item/conf_configuration/rttmap_simple.html
.html .js polyglot
www/en/item/custom.html
.html .js polyglot
www/en/item/list.html
.html .js polyglot
www/en/item/manage.html
.html .js polyglot
www/en/item/mode.html
.html .js polyglot
www/en/item/wizard.html
.html .js polyglot
www/en/item/wizard_2.html
.html .js polyglot
www/en/item/wizard_3.html
.html .js polyglot
www/en/nodes/setup.html
.html .js polyglot
www/en/prog.html
.html .js polyglot
www/en/prog_fullvpn_3rdparty_rttmap.html
.html .js polyglot
www/en/prog_fullvpn_mudfish_rttmap.html
.html .js polyglot
www/en/report.html
.html .js polyglot
www/en/search.js
.js
www/en/signin.html
.html .js polyglot
www/en/status/access_log.html
.html .js polyglot
www/en/status/diag.html
.html .js polyglot
www/en/status/memory.html
.html .js polyglot
www/en/status/node_popup.html
.html .js polyglot
www/en/status/nodes.html
.html .js polyglot
www/en/status/processes.html
.html .js polyglot
www/en/status/traffic.html
.html .js polyglot
www/es/advanced/cli.html
.html .js polyglot
www/es/advanced/packet_dump.html
.html .js polyglot
www/es/advanced/process_dump.html
.html .js polyglot
www/es/advanced/traceroute.html
.html .js polyglot
www/es/advanced/wpad.html
.html .js polyglot
www/es/dashboard.html
.html .js polyglot
www/es/dashboard_simple.html
.html .js polyglot
www/es/game_console.html
.html .js polyglot
www/es/i18n_items.js
.js
www/es/item/buy.html
.html .js polyglot
www/es/item/buy/rttmap_basic.html
.html .js polyglot
www/es/item/buy/rttmap_basic_status.html
.html .js polyglot
www/es/item/conf.html
.html .js polyglot
www/es/item/conf_configuration/rttmap_advanced.html
.html .js polyglot
www/es/item/conf_configuration/rttmap_basic.html
.html .js polyglot
www/es/item/conf_configuration/rttmap_basic_status.html
.html .js polyglot
www/es/item/conf_configuration/rttmap_multipath.html
.html .js polyglot
www/es/item/conf_configuration/rttmap_simple.html
.html .js polyglot
www/es/item/custom.html
.html .js polyglot
www/es/item/list.html
.html .js polyglot
www/es/item/manage.html
.html .js polyglot
www/es/item/mode.html
.html .js polyglot
www/es/item/wizard.html
.html .js polyglot
www/es/item/wizard_2.html
.html .js polyglot
www/es/item/wizard_3.html
.html .js polyglot
www/es/nodes/setup.html
.html .js polyglot
www/es/prog.html
.html .js polyglot
www/es/prog_fullvpn_3rdparty_rttmap.html
.html .js polyglot
www/es/prog_fullvpn_mudfish_rttmap.html
.html .js polyglot
www/es/report.html
.html .js polyglot
www/es/search.js
.js
www/es/signin.html
.html .js polyglot
www/es/status/access_log.html
.html .js polyglot
www/es/status/diag.html
.html .js polyglot
www/es/status/memory.html
.html .js polyglot
www/es/status/node_popup.html
.html .js polyglot
www/es/status/nodes.html
.html .js polyglot
www/es/status/processes.html
.html .js polyglot
www/es/status/traffic.html
.html .js polyglot
www/ja/.gitignore
www/ja/advanced/cli.html
.html .js polyglot
www/ja/advanced/packet_dump.html
.html .js polyglot
www/ja/advanced/process_dump.html
.html .js polyglot
www/ja/advanced/traceroute.html
.html .js polyglot
www/ja/advanced/wpad.html
.html .js polyglot
www/ja/dashboard.html
.html .js polyglot
www/ja/dashboard_simple.html
.html .js polyglot
www/ja/game_console.html
.html .js polyglot
www/ja/i18n_items.js
.js
www/ja/item/buy.html
.html .js polyglot
www/ja/item/buy/rttmap_basic.html
.html .js polyglot
www/ja/item/buy/rttmap_basic_status.html
.html .js polyglot
www/ja/item/conf.html
.html .js polyglot
www/ja/item/conf_configuration/rttmap_advanced.html
.html .js polyglot
www/ja/item/conf_configuration/rttmap_basic.html
.html .js polyglot
www/ja/item/conf_configuration/rttmap_basic_status.html
.html .js polyglot
www/ja/item/conf_configuration/rttmap_multipath.html
.html .js polyglot
www/ja/item/conf_configuration/rttmap_simple.html
.html .js polyglot
www/ja/item/custom.html
.html .js polyglot
www/ja/item/list.html
.html .js polyglot
www/ja/item/manage.html
.html .js polyglot
www/ja/item/mode.html
.html .js polyglot
www/ja/item/wizard.html
.html .js polyglot
www/ja/item/wizard_2.html
.html .js polyglot
www/ja/item/wizard_3.html
.html .js polyglot
www/ja/nodes/setup.html
.html .js polyglot
www/ja/prog.html
.html .js polyglot
www/ja/prog_fullvpn_3rdparty_rttmap.html
.html .js polyglot
www/ja/prog_fullvpn_mudfish_rttmap.html
.html .js polyglot
www/ja/report.html
.html .js polyglot
www/ja/search.js
.js
www/ja/signin.html
.html .js polyglot
www/ja/status/access_log.html
.html .js polyglot
www/ja/status/diag.html
.html .js polyglot
www/ja/status/memory.html
.html .js polyglot
www/ja/status/node_popup.html
.html .js polyglot
www/ja/status/nodes.html
.html .js polyglot
www/ja/status/processes.html
.html .js polyglot
www/ja/status/traffic.html
.html .js polyglot
www/ko/.gitignore
www/ko/advanced/cli.html
.html .js polyglot
www/ko/advanced/packet_dump.html
.html .js polyglot
www/ko/advanced/process_dump.html
.html .js polyglot
www/ko/advanced/traceroute.html
.html .js polyglot
www/ko/advanced/wpad.html
.html .js polyglot
www/ko/dashboard.html
.html .js polyglot
www/ko/dashboard_simple.html
.html .js polyglot
www/ko/game_console.html
.html .js polyglot
www/ko/i18n_items.js
.js
www/ko/item/buy.html
.html .js polyglot
www/ko/item/buy/rttmap_basic.html
.html .js polyglot
www/ko/item/buy/rttmap_basic_status.html
.html .js polyglot
www/ko/item/conf.html
.html .js polyglot
www/ko/item/conf_configuration/rttmap_advanced.html
.html .js polyglot
www/ko/item/conf_configuration/rttmap_basic.html
.html .js polyglot
www/ko/item/conf_configuration/rttmap_basic_status.html
.html .js polyglot
www/ko/item/conf_configuration/rttmap_multipath.html
.html .js polyglot
www/ko/item/conf_configuration/rttmap_simple.html
.html .js polyglot
www/ko/item/custom.html
.html .js polyglot
www/ko/item/list.html
.html .js polyglot
www/ko/item/manage.html
.html .js polyglot
www/ko/item/mode.html
.html .js polyglot
www/ko/item/wizard.html
.html .js polyglot
www/ko/item/wizard_2.html
.html .js polyglot
www/ko/item/wizard_3.html
.html .js polyglot
www/ko/nodes/setup.html
.html .js polyglot
www/ko/prog.html
.html .js polyglot
www/ko/prog_fullvpn_3rdparty_rttmap.html
.html .js polyglot
www/ko/prog_fullvpn_mudfish_rttmap.html
.html .js polyglot
www/ko/report.html
.html .js polyglot
www/ko/search.js
.js
www/ko/signin.html
.html .js polyglot
www/ko/status/access_log.html
.html .js polyglot
www/ko/status/diag.html
.html .js polyglot
www/ko/status/memory.html
.html .js polyglot
www/ko/status/node_popup.html
.html .js polyglot
www/ko/status/nodes.html
.html .js polyglot
www/ko/status/processes.html
.html .js polyglot
www/ko/status/traffic.html
.html .js polyglot
www/ms/.gitignore
www/ms/advanced/cli.html
.html .js polyglot
www/ms/advanced/packet_dump.html
.html .js polyglot
www/ms/advanced/process_dump.html
.html .js polyglot
www/ms/advanced/traceroute.html
.html .js polyglot
www/ms/advanced/wpad.html
.html .js polyglot
www/ms/dashboard.html
.html .js polyglot
www/ms/dashboard_simple.html
.html .js polyglot
www/ms/game_console.html
.html .js polyglot
www/ms/i18n_items.js
.js
www/ms/item/buy.html
.html .js polyglot
www/ms/item/buy/rttmap_basic.html
.html .js polyglot
www/ms/item/buy/rttmap_basic_status.html
.html .js polyglot
www/ms/item/conf.html
.html .js polyglot
www/ms/item/conf_configuration/rttmap_advanced.html
.html .js polyglot
www/ms/item/conf_configuration/rttmap_basic.html
.html .js polyglot
www/ms/item/conf_configuration/rttmap_basic_status.html
.html .js polyglot
www/ms/item/conf_configuration/rttmap_multipath.html
.html .js polyglot
www/ms/item/conf_configuration/rttmap_simple.html
.html .js polyglot
www/ms/item/custom.html
.html .js polyglot
www/ms/item/list.html
.html .js polyglot
www/ms/item/manage.html
.html .js polyglot
www/ms/item/mode.html
.html .js polyglot
www/ms/item/wizard.html
.html .js polyglot
www/ms/item/wizard_2.html
.html .js polyglot
www/ms/item/wizard_3.html
.html .js polyglot
www/ms/nodes/setup.html
.html .js polyglot
www/ms/prog.html
.html .js polyglot
www/ms/prog_fullvpn_3rdparty_rttmap.html
.html .js polyglot
www/ms/prog_fullvpn_mudfish_rttmap.html
.html .js polyglot
www/ms/report.html
.html .js polyglot
www/ms/search.js
.js
www/ms/signin.html
.html .js polyglot
www/ms/status/access_log.html
.html .js polyglot
www/ms/status/diag.html
.html .js polyglot
www/ms/status/memory.html
.html .js polyglot
www/ms/status/node_popup.html
.html .js polyglot
www/ms/status/nodes.html
.html .js polyglot
www/ms/status/processes.html
.html .js polyglot
www/ms/status/traffic.html
.html .js polyglot
www/pt/advanced/cli.html
.html .js polyglot
www/pt/advanced/packet_dump.html
.html .js polyglot
www/pt/advanced/process_dump.html
.html .js polyglot
www/pt/advanced/traceroute.html
.html .js polyglot
www/pt/advanced/wpad.html
.html .js polyglot
www/pt/dashboard.html
.html .js polyglot
www/pt/dashboard_simple.html
.html .js polyglot
www/pt/game_console.html
.html .js polyglot
www/pt/i18n_items.js
.js
www/pt/item/buy.html
.html .js polyglot
www/pt/item/buy/rttmap_basic.html
.html .js polyglot
www/pt/item/buy/rttmap_basic_status.html
.html .js polyglot
www/pt/item/conf.html
.html .js polyglot
www/pt/item/conf_configuration/rttmap_advanced.html
.html .js polyglot
www/pt/item/conf_configuration/rttmap_basic.html
.html .js polyglot
www/pt/item/conf_configuration/rttmap_basic_status.html
.html .js polyglot
www/pt/item/conf_configuration/rttmap_multipath.html
.html .js polyglot
www/pt/item/conf_configuration/rttmap_simple.html
.html .js polyglot
www/pt/item/custom.html
.html .js polyglot
www/pt/item/list.html
.html .js polyglot
www/pt/item/manage.html
.html .js polyglot
www/pt/item/mode.html
.html .js polyglot
www/pt/item/wizard.html
.html .js polyglot
www/pt/item/wizard_2.html
.html .js polyglot
www/pt/item/wizard_3.html
.html .js polyglot
www/pt/nodes/setup.html
.html .js polyglot
www/pt/prog.html
.html .js polyglot
www/pt/prog_fullvpn_3rdparty_rttmap.html
.html .js polyglot
www/pt/prog_fullvpn_mudfish_rttmap.html
.html .js polyglot
www/pt/report.html
.html .js polyglot
www/pt/search.js
.js
www/pt/signin.html
.html .js polyglot
www/pt/status/access_log.html
.html .js polyglot
www/pt/status/diag.html
.html .js polyglot
www/pt/status/memory.html
.html .js polyglot
www/pt/status/node_popup.html
.html .js polyglot
www/pt/status/nodes.html
.html .js polyglot
www/pt/status/processes.html
.html .js polyglot
www/pt/status/traffic.html
.html .js polyglot
www/ru/advanced/cli.html
.html .js polyglot
www/ru/advanced/packet_dump.html
.html .js polyglot
www/ru/advanced/process_dump.html
.html .js polyglot
www/ru/advanced/traceroute.html
.html .js polyglot
www/ru/advanced/wpad.html
.html .js polyglot
www/ru/dashboard.html
.html .js polyglot
www/ru/dashboard_simple.html
.html .js polyglot
www/ru/game_console.html
.html .js polyglot
www/ru/i18n_items.js
.js
www/ru/item/buy.html
.html .js polyglot
www/ru/item/buy/rttmap_basic.html
.html .js polyglot
www/ru/item/buy/rttmap_basic_status.html
.html .js polyglot
www/ru/item/conf.html
.html .js polyglot
www/ru/item/conf_configuration/rttmap_advanced.html
.html .js polyglot
www/ru/item/conf_configuration/rttmap_basic.html
.html .js polyglot
www/ru/item/conf_configuration/rttmap_basic_status.html
.html .js polyglot
www/ru/item/conf_configuration/rttmap_multipath.html
.html .js polyglot
www/ru/item/conf_configuration/rttmap_simple.html
.html .js polyglot
www/ru/item/custom.html
.html .js polyglot
www/ru/item/list.html
.html .js polyglot
www/ru/item/manage.html
.html .js polyglot
www/ru/item/mode.html
.html .js polyglot
www/ru/item/wizard.html
.html .js polyglot
www/ru/item/wizard_2.html
.html .js polyglot
www/ru/item/wizard_3.html
.html .js polyglot
www/ru/nodes/setup.html
.html .js polyglot
www/ru/prog.html
.html .js polyglot
www/ru/prog_fullvpn_3rdparty_rttmap.html
.html .js polyglot
www/ru/prog_fullvpn_mudfish_rttmap.html
.html .js polyglot
www/ru/report.html
.html .js polyglot
www/ru/search.js
.js
www/ru/signin.html
.html .js polyglot
www/ru/status/access_log.html
.html .js polyglot
www/ru/status/diag.html
.html .js polyglot
www/ru/status/memory.html
.html .js polyglot
www/ru/status/node_popup.html
.html .js polyglot
www/ru/status/nodes.html
.html .js polyglot
www/ru/status/processes.html
.html .js polyglot
www/ru/status/traffic.html
.html .js polyglot
www/th/advanced/cli.html
.html .js polyglot
www/th/advanced/packet_dump.html
.html .js polyglot
www/th/advanced/process_dump.html
.html .js polyglot
www/th/advanced/traceroute.html
.html .js polyglot
www/th/advanced/wpad.html
.html .js polyglot
www/th/dashboard.html
.html .js polyglot
www/th/dashboard_simple.html
.html .js polyglot
www/th/game_console.html
.html .js polyglot
www/th/i18n_items.js
.js
www/th/item/buy.html
.html .js polyglot
www/th/item/buy/rttmap_basic.html
.html .js polyglot
www/th/item/buy/rttmap_basic_status.html
.html .js polyglot
www/th/item/conf.html
.html .js polyglot
www/th/item/conf_configuration/rttmap_advanced.html
.html .js polyglot
www/th/item/conf_configuration/rttmap_basic.html
.html .js polyglot
www/th/item/conf_configuration/rttmap_basic_status.html
.html .js polyglot
www/th/item/conf_configuration/rttmap_multipath.html
.html .js polyglot
www/th/item/conf_configuration/rttmap_simple.html
.html .js polyglot
www/th/item/custom.html
.html .js polyglot
www/th/item/list.html
.html .js polyglot
www/th/item/manage.html
.html .js polyglot
www/th/item/mode.html
.html .js polyglot
www/th/item/wizard.html
.html .js polyglot
www/th/item/wizard_2.html
.html .js polyglot
www/th/item/wizard_3.html
.html .js polyglot
www/th/nodes/setup.html
.html .js polyglot
www/th/prog.html
.html .js polyglot
www/th/prog_fullvpn_3rdparty_rttmap.html
.html .js polyglot
www/th/prog_fullvpn_mudfish_rttmap.html
.html .js polyglot
www/th/report.html
.html .js polyglot
www/th/search.js
.js
www/th/signin.html
.html .js polyglot
www/th/status/access_log.html
.html .js polyglot
www/th/status/diag.html
.html .js polyglot
www/th/status/memory.html
.html .js polyglot
www/th/status/node_popup.html
.html .js polyglot
www/th/status/nodes.html
.html .js polyglot
www/th/status/processes.html
.html .js polyglot
www/th/status/traffic.html
.html .js polyglot
www/vi/advanced/cli.html
.html .js polyglot
www/vi/advanced/packet_dump.html
.html .js polyglot
www/vi/advanced/process_dump.html
.html .js polyglot
www/vi/advanced/traceroute.html
.html .js polyglot
www/vi/advanced/wpad.html
.html .js polyglot
www/vi/dashboard.html
.html .js polyglot
www/vi/dashboard_simple.html
.html .js polyglot
www/vi/game_console.html
.html .js polyglot
www/vi/i18n_items.js
.js
www/vi/item/buy.html
.html .js polyglot
www/vi/item/buy/rttmap_basic.html
.html .js polyglot
www/vi/item/buy/rttmap_basic_status.html
.html .js polyglot
www/vi/item/conf.html
.html .js polyglot
www/vi/item/conf_configuration/rttmap_advanced.html
.html .js polyglot
www/vi/item/conf_configuration/rttmap_basic.html
.html .js polyglot
www/vi/item/conf_configuration/rttmap_basic_status.html
.html .js polyglot
www/vi/item/conf_configuration/rttmap_multipath.html
.html .js polyglot
www/vi/item/conf_configuration/rttmap_simple.html
.html .js polyglot
www/vi/item/custom.html
.html .js polyglot
www/vi/item/list.html
.html .js polyglot
www/vi/item/manage.html
.html .js polyglot
www/vi/item/mode.html
.html .js polyglot
www/vi/item/wizard.html
.html .js polyglot
www/vi/item/wizard_2.html
.html .js polyglot
www/vi/item/wizard_3.html
.html .js polyglot
www/vi/nodes/setup.html
.html .js polyglot
www/vi/prog.html
.html .js polyglot
www/vi/prog_fullvpn_3rdparty_rttmap.html
.html .js polyglot
www/vi/prog_fullvpn_mudfish_rttmap.html
.html .js polyglot
www/vi/report.html
.html .js polyglot
www/vi/search.js
.js
www/vi/signin.html
.html .js polyglot
www/vi/status/access_log.html
.html .js polyglot
www/vi/status/diag.html
.html .js polyglot
www/vi/status/memory.html
.html .js polyglot
www/vi/status/node_popup.html
.html .js polyglot
www/vi/status/nodes.html
.html .js polyglot
www/vi/status/processes.html
.html .js polyglot
www/vi/status/traffic.html
.html .js polyglot
www/zh/.gitignore
www/zh/advanced/cli.html
.html .js polyglot
www/zh/advanced/packet_dump.html
.html .js polyglot
www/zh/advanced/process_dump.html
.html .js polyglot
www/zh/advanced/traceroute.html
.html .js polyglot
www/zh/advanced/wpad.html
.html .js polyglot
www/zh/dashboard.html
.html .js polyglot
www/zh/dashboard_simple.html
.html .js polyglot
www/zh/game_console.html
.html .js polyglot
www/zh/i18n_items.js
.js
www/zh/item/buy.html
.html .js polyglot
www/zh/item/buy/rttmap_basic.html
.html .js polyglot
www/zh/item/buy/rttmap_basic_status.html
.html .js polyglot
www/zh/item/conf.html
.html .js polyglot
www/zh/item/conf_configuration/rttmap_advanced.html
.html .js polyglot
www/zh/item/conf_configuration/rttmap_basic.html
.html .js polyglot
www/zh/item/conf_configuration/rttmap_basic_status.html
.html .js polyglot
www/zh/item/conf_configuration/rttmap_multipath.html
.html .js polyglot
www/zh/item/conf_configuration/rttmap_simple.html
.html .js polyglot
www/zh/item/custom.html
.html .js polyglot
www/zh/item/list.html
.html .js polyglot
www/zh/item/manage.html
.html .js polyglot
www/zh/item/mode.html
.html .js polyglot
www/zh/item/wizard.html
.html .js polyglot
www/zh/item/wizard_2.html
.html .js polyglot
www/zh/item/wizard_3.html
.html .js polyglot
www/zh/nodes/setup.html
.html .js polyglot
www/zh/prog.html
.html .js polyglot
www/zh/prog_fullvpn_3rdparty_rttmap.html
.html .js polyglot
www/zh/prog_fullvpn_mudfish_rttmap.html
.html .js polyglot
www/zh/report.html
.html .js polyglot
www/zh/search.js
.js
www/zh/signin.html
.html .js polyglot
www/zh/status/access_log.html
.html .js polyglot
www/zh/status/diag.html
.html .js polyglot
www/zh/status/memory.html
.html .js polyglot
www/zh/status/node_popup.html
.html .js polyglot
www/zh/status/nodes.html
.html .js polyglot
www/zh/status/processes.html
.html .js polyglot
www/zh/status/traffic.html
.html .js polyglot
www/zh_Hant/advanced/cli.html
.html .js polyglot
www/zh_Hant/advanced/packet_dump.html
.html .js polyglot
www/zh_Hant/advanced/process_dump.html
.html .js polyglot
www/zh_Hant/advanced/traceroute.html
.html .js polyglot
www/zh_Hant/advanced/wpad.html
.html .js polyglot
www/zh_Hant/dashboard.html
.html .js polyglot
www/zh_Hant/dashboard_simple.html
.html .js polyglot
www/zh_Hant/game_console.html
.html .js polyglot
www/zh_Hant/i18n_items.js
.js
www/zh_Hant/item/buy.html
.html .js polyglot
www/zh_Hant/item/buy/rttmap_basic.html
.html .js polyglot
www/zh_Hant/item/buy/rttmap_basic_status.html
.html .js polyglot
www/zh_Hant/item/conf.html
.html .js polyglot
www/zh_Hant/item/conf_configuration/rttmap_advanced.html
.html .js polyglot
www/zh_Hant/item/conf_configuration/rttmap_basic.html
.html .js polyglot
www/zh_Hant/item/conf_configuration/rttmap_basic_status.html
.html .js polyglot
www/zh_Hant/item/conf_configuration/rttmap_multipath.html
.html .js polyglot
www/zh_Hant/item/conf_configuration/rttmap_simple.html
.html .js polyglot
www/zh_Hant/item/custom.html
.html .js polyglot
www/zh_Hant/item/list.html
.html .js polyglot
www/zh_Hant/item/manage.html
.html .js polyglot
www/zh_Hant/item/mode.html
.html .js polyglot
www/zh_Hant/item/wizard.html
.html .js polyglot
www/zh_Hant/item/wizard_2.html
.html .js polyglot
www/zh_Hant/item/wizard_3.html
.html .js polyglot
www/zh_Hant/nodes/setup.html
.html .js polyglot
www/zh_Hant/prog.html
.html .js polyglot
www/zh_Hant/prog_fullvpn_3rdparty_rttmap.html
.html .js polyglot
www/zh_Hant/prog_fullvpn_mudfish_rttmap.html
.html .js polyglot
www/zh_Hant/report.html
.html .js polyglot
www/zh_Hant/search.js
.js
www/zh_Hant/signin.html
.html .js polyglot
www/zh_Hant/status/access_log.html
.html .js polyglot
www/zh_Hant/status/diag.html
.html .js polyglot
www/zh_Hant/status/memory.html
.html .js polyglot
www/zh_Hant/status/node_popup.html
.html .js polyglot
www/zh_Hant/status/nodes.html
.html .js polyglot
www/zh_Hant/status/processes.html
.html .js polyglot
www/zh_Hant/status/traffic.html
.html .js polyglot
mudadm.exe
.exe windows:6 windows x86 arch:x86

12e3aede0d6af843de3053968482257e

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15/01/2024, 00:00

Not After

14/04/2035, 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ea:07:e8:ec:e3:5e:0d:20:9b:77:9b:e1:7e:62:70:f2
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

25/04/2024, 00:00

Not After

25/04/2027, 23:59

Subject

CN=Mudfish Networks,O=Mudfish Networks,ST=Gyeongsangnam-do,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22/03/2021, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:43:e6:e2:27:68:f8:7b:89:2e:07:6b:0d:3d:84:95:06:cc:e0:c1
Signer

Actual PE Digest

82:43:e6:e2:27:68:f8:7b:89:2e:07:6b:0d:3d:84:95:06:cc:e0:c1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Work\ttol\bin\mudadm\mudadm.pdb

Imports

advapi32

CheckTokenMembership
FreeSid
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
AllocateAndInitializeSid

dbghelp

SymInitialize
SymFromAddr

iphlpapi

GetAdaptersInfo
GetIpForwardTable

user32

MessageBoxA

winhttp

WinHttpConnect
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpSetOption
WinHttpOpen

ws2_32

inet_ntop
WSAGetLastError
WSAStartup
shutdown
setsockopt
bind
send
connect
inet_ntoa
inet_addr
htonl
ioctlsocket
closesocket
WSASetLastError
listen
select
socket
getaddrinfo
freeaddrinfo
getpeername
getsockname
ntohs
getnameinfo
sendto
__WSAFDIsSet
recv

kernel32

ReadConsoleW
HeapSize
GetTimeZoneInformation
GetProcessHeap
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
SetStdHandle
HeapReAlloc
WideCharToMultiByte
DeleteFileW
MultiByteToWideChar
CreatePipe
GetFileAttributesExW
GetExitCodeProcess
DecodePointer
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapFree
HeapAlloc
SetConsoleCtrlHandler
OutputDebugStringW
GetCommandLineW
GetCommandLineA
SetCurrentDirectoryA
CreateFileA
ReadFile
GetTempPathA
GetTempFileNameA
CloseHandle
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetVersionExA
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
GetProcAddress
LoadLibraryA
LocalFree
FormatMessageA
CreateFileMappingA
OpenFileMappingA
DuplicateHandle
SetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventA
WaitForMultipleObjects
GetCurrentThread
GetThreadPriority
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
GetSystemTime
CreateSemaphoreA
SystemTimeToFileTime
ExpandEnvironmentStringsA
CreateProcessA
RtlCaptureStackBackTrace
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WriteFile
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
CreateProcessW
CreateThread
ExitThread
FreeLibraryAndExitThread
ExitProcess
CreateFileW

Sections

.text
Size: 414KB - Virtual size: 414KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
muddiag.exe
.exe windows:6 windows x86 arch:x86

409e127d02ade663ee134b863f91a76f

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15/01/2024, 00:00

Not After

14/04/2035, 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ea:07:e8:ec:e3:5e:0d:20:9b:77:9b:e1:7e:62:70:f2
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

25/04/2024, 00:00

Not After

25/04/2027, 23:59

Subject

CN=Mudfish Networks,O=Mudfish Networks,ST=Gyeongsangnam-do,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22/03/2021, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:ba:9f:f6:37:9a:8f:09:93:0a:48:a5:72:85:3d:1c:96:95:21:76
Signer

Actual PE Digest

11:ba:9f:f6:37:9a:8f:09:93:0a:48:a5:72:85:3d:1c:96:95:21:76

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Work\ttol\bin\muddiag\muddiag.pdb

Imports

advapi32

CheckTokenMembership
FreeSid
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
AllocateAndInitializeSid

dbghelp

SymInitialize
SymFromAddr

gdi32

GetObjectA
SelectObject
GetDeviceCaps
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
GetBitmapBits

iphlpapi

IcmpCloseHandle
IcmpSendEcho
GetIpForwardTable
IcmpCreateFile
GetAdaptersInfo

user32

GetDC
GetDesktopWindow
MessageBoxA
ReleaseDC

winhttp

WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpSetOption
WinHttpOpen

ws2_32

WSAGetLastError
WSAStartup
shutdown
setsockopt
sendto
WSASetLastError
recv
getnameinfo
inet_addr
htonl
ioctlsocket
closesocket
inet_ntop
__WSAFDIsSet
select
bind
connect
listen
socket
getaddrinfo
freeaddrinfo
getpeername
ntohs
getsockname
htons
send
recvfrom
inet_ntoa

kernel32

HeapSize
CreateFileW
GetTimeZoneInformation
GetProcessHeap
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetStdHandle
HeapReAlloc
WideCharToMultiByte
DeleteFileW
CreatePipe
GetFileAttributesExW
GetExitCodeProcess
DecodePointer
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetConsoleCtrlHandler
OutputDebugStringW
HeapAlloc
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
HeapFree
GetCommandLineW
GetCommandLineA
FreeLibraryAndExitThread
ExitThread
CreateThread
CreateProcessW
ExitProcess
WriteConsoleW
GetModuleHandleExW
GetCurrentProcessId
SwitchToThread
SetCurrentDirectoryA
CreateFileA
ReadFile
GetTempPathA
GetTempFileNameA
CloseHandle
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
GetCurrentProcess
GetCurrentThreadId
GetSystemTimeAsFileTime
GetVersionExA
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
GetProcAddress
LoadLibraryA
LocalFree
FormatMessageA
CreateFileMappingA
OpenFileMappingA
DuplicateHandle
SetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventA
WaitForMultipleObjects
GetCurrentThread
GetThreadPriority
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
GetSystemTime
CreateSemaphoreA
SystemTimeToFileTime
ExpandEnvironmentStringsA
CreateProcessA
GetCurrentDirectoryA
CreateDirectoryA
DeleteFileA
FindClose
FindFirstFileA
FindNextFileA
FlushFileBuffers
RemoveDirectoryA
WriteFile
GetComputerNameA
MultiByteToWideChar
RtlCaptureStackBackTrace
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetModuleFileNameW
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
GetStdHandle
GetFileType
SetEndOfFile

Sections

.text
Size: 675KB - Virtual size: 674KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 61KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
muddiag_config.json
mudfish.exe
.exe windows:6 windows x86 arch:x86

a8d6a0f03d02264899d07806ff580488

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15/01/2024, 00:00

Not After

14/04/2035, 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ea:07:e8:ec:e3:5e:0d:20:9b:77:9b:e1:7e:62:70:f2
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

25/04/2024, 00:00

Not After

25/04/2027, 23:59

Subject

CN=Mudfish Networks,O=Mudfish Networks,ST=Gyeongsangnam-do,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22/03/2021, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

dd:83:1f:70:1e:ac:ea:11:f0:cc:ed:05:13:bd:49:aa:5a:23:b9:ab
Signer

Actual PE Digest

dd:83:1f:70:1e:ac:ea:11:f0:cc:ed:05:13:bd:49:aa:5a:23:b9:ab

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Work\ttol\mudfish.pdb

Imports

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegEnumKeyExA
RegSetValueExA
CryptAcquireContextA
CryptGenRandom
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
DeregisterEventSource
CryptGetProvParam
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey

iphlpapi

GetIpForwardTable
DeleteIpForwardEntry
GetAdapterIndex
AddIPAddress
DeleteIPAddress
GetAdaptersInfo
CreateUnicastIpAddressEntry
InitializeUnicastIpAddressEntry
NotifyRouteChange2
CancelMibChangeNotify2
ConvertInterfaceLuidToIndex
CreateIpForwardEntry

ws2_32

getsockopt
WSASetLastError
getnameinfo
freeaddrinfo
getaddrinfo
WSAIoctl
WSAStartup
gethostbyname
gethostbyaddr
socket
setsockopt
sendto
send
WSACleanup
recvfrom
recv
ntohs
ntohl
listen
inet_ntoa
inet_addr
htons
htonl
getsockname
ioctlsocket
connect
closesocket
bind
accept
__WSAFDIsSet
WSAGetLastError
select

user32

MessageBoxW
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW

kernel32

GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapAlloc
HeapFree
OutputDebugStringW
ExpandEnvironmentStringsA
CloseHandle
GetLastError
WaitForSingleObject
CreateProcessA
LocalFree
FormatMessageA
DuplicateHandle
SetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
CreateEventA
Sleep
WaitForMultipleObjects
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetThreadPriority
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
CreateSemaphoreA
RtlCaptureStackBackTrace
GetStdHandle
IsValidCodePage
CreateFileA
ReadFile
WriteFile
GetTempPathA
GetTempFileNameA
SetUnhandledExceptionFilter
QueryPerformanceCounter
QueryPerformanceFrequency
DeviceIoControl
GetOverlappedResult
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
GetVersionExA
MapViewOfFile
DecodePointer
UnmapViewOfFile
FreeLibrary
GetProcAddress
LoadLibraryExW
LoadLibraryA
CreateFileMappingA
OpenFileMappingA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetModuleHandleExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
TlsFree
GetEnvironmentVariableW
GetFileType
GetModuleHandleW
MultiByteToWideChar
SwitchToFiber
DeleteFiber
CreateFiber
WideCharToMultiByte
FormatMessageW
ConvertFiberToThread
ConvertThreadToFiber
LoadLibraryW
FindClose
FindFirstFileW
FindNextFileW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetSystemTime
SystemTimeToFileTime
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetCommandLineW
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStringTypeW
GetProcessHeap
GetTimeZoneInformation
EnumSystemLocalesW
FlushFileBuffers
GetConsoleOutputCP
GetFileSizeEx
SetFilePointerEx
HeapReAlloc
GetCommandLineA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
HeapSize
HeapQueryInformation
SetCurrentDirectoryW
GetCurrentDirectoryW
GetFullPathNameW
FlushViewOfFile
FindFirstFileExW
GetEnvironmentVariableA
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
EncodePointer
RaiseException
GetModuleFileNameW
WriteConsoleW
ExitProcess
CreateThread
ExitThread
FreeLibraryAndExitThread
SetStdHandle
SetConsoleCtrlHandler
CreateFileW
GetDriveTypeW
SetEndOfFile

crypt32

CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 460KB - Virtual size: 460KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 312KB - Virtual size: 587KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sysinit_
Size: 512B - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sysunini
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sysctl_s
Size: 1024B - Virtual size: 644B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

cliinit_
Size: 1024B - Virtual size: 700B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
mudflow.exe
.exe windows:6 windows x86 arch:x86

8ac4bacee1f41091ea5c7c337b6dcbd2

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15/01/2024, 00:00

Not After

14/04/2035, 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ea:07:e8:ec:e3:5e:0d:20:9b:77:9b:e1:7e:62:70:f2
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

25/04/2024, 00:00

Not After

25/04/2027, 23:59

Subject

CN=Mudfish Networks,O=Mudfish Networks,ST=Gyeongsangnam-do,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22/03/2021, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

84:e2:15:46:38:44:5c:ab:aa:47:e3:08:92:b3:6d:2b:0b:31:a2:bc
Signer

Actual PE Digest

84:e2:15:46:38:44:5c:ab:aa:47:e3:08:92:b3:6d:2b:0b:31:a2:bc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Work\ttol\bin\mudflow\mudflow.pdb

Imports

advapi32

AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
DeregisterEventSource

iphlpapi

IcmpCreateFile
IcmpSendEcho
GetIpForwardTable
GetAdaptersInfo
GetIpStatistics
IcmpCloseHandle

user32

MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxA

ws2_32

getsockopt
recvfrom
htons
gethostbyname
getnameinfo
ntohs
getsockname
getpeername
freeaddrinfo
getaddrinfo
socket
listen
WSACleanup
bind
select
__WSAFDIsSet
WSASetLastError
inet_ntop
WSAGetLastError
WSAStartup
shutdown
setsockopt
sendto
send
recv
inet_ntoa
htonl
ioctlsocket
closesocket
inet_addr
connect
accept

kernel32

GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
OutputDebugStringW
GetCurrentProcessId
SwitchToThread
GetLastError
Sleep
SetCurrentDirectoryA
CreateFileA
ReadFile
GetTempPathA
GetTempFileNameA
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentProcess
GetCurrentThreadId
GetSystemTimeAsFileTime
GetVersionExA
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
GetProcAddress
LoadLibraryA
LocalFree
FormatMessageA
CreateFileMappingA
OpenFileMappingA
DuplicateHandle
SetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventA
SetStdHandle
GetCurrentThread
GetThreadPriority
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
GetSystemTime
CreateSemaphoreA
SystemTimeToFileTime
CreateToolhelp32Snapshot
Process32First
Process32Next
HeapReAlloc
SetUnhandledExceptionFilter
GetTickCount
GetModuleHandleExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
TlsFree
GetStdHandle
GetEnvironmentVariableW
GetFileType
WriteFile
GetModuleHandleW
MultiByteToWideChar
SwitchToFiber
DeleteFiber
CreateFiber
WideCharToMultiByte
FormatMessageW
ConvertFiberToThread
ConvertThreadToFiber
FreeLibrary
LoadLibraryW
FindClose
FindFirstFileW
FindNextFileW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
HeapAlloc
FlushFileBuffers
SetCurrentDirectoryW
GetCurrentDirectoryW
GetFullPathNameW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStringTypeW
GetProcessHeap
HeapSize
GetTimeZoneInformation
SetFilePointerEx
GetFileSizeEx
GetConsoleOutputCP
HeapFree
GetCommandLineW
GetCommandLineA
EnumSystemLocalesW
DecodePointer
GetExitCodeProcess
GetFileAttributesExW
CreatePipe
RtlCaptureStackBackTrace
DeleteFileW
WaitForMultipleObjects
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
LoadLibraryExW
EncodePointer
RaiseException
GetModuleFileNameW
WriteConsoleW
ExitProcess
CreateProcessW
CreateThread
ExitThread
FreeLibraryAndExitThread
SetConsoleCtrlHandler
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetEndOfFile

crypt32

CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 443KB - Virtual size: 442KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 93KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
mudovpn.exe
.exe windows:6 windows x86 arch:x86

3bee9275b7c015bfbbe64660340a89f3

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

27/04/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49
Certificate

Issuer

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/05/2019, 00:00

Not After

30/05/2020, 10:48

Subject

CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

b6:a3:0c:06:ce:c6:a7:2f:77:26:8a:60:69:bf:bd:e2
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

29/11/2017, 00:00

Not After

28/11/2020, 23:59

Subject

CN=Mudfish Networks Inc.,OU=Engineering,O=Mudfish Networks Inc.,POSTALCODE=07788,STREET=165\, Magokjungang-ro,L=Gangseo-gu,ST=Seoul,C=KR,2.5.4.18=#13053037373838

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bf:f7:49:54:8f:b6:8d:c2:93:4c:79:e5:2e:94:c0:d1:a2:1d:89:f8
Signer

Actual PE Digest

bf:f7:49:54:8f:b6:8d:c2:93:4c:79:e5:2e:94:c0:d1:a2:1d:89:f8

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Work\ttol\bin\openvpn\Win32-Output\Release\mudovpn.pdb

Imports

ws2_32

shutdown
WSASetLastError
htons
ntohl
select
__WSAFDIsSet
ioctlsocket
setsockopt
sendto
ntohs
WSACleanup
WSAStartup
WSAEventSelect
WSAEnumNetworkEvents
inet_addr
getservbyname
accept
bind
getaddrinfo
socket
connect
recvfrom
getsockopt
inet_ntop
getnameinfo
inet_pton
closesocket
listen
send
inet_ntoa
recv
WSAGetLastError
getsockname
freeaddrinfo
htonl
gethostbyname

crypt32

CryptAcquireCertificatePrivateKey
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertFreeCertificateContext

kernel32

FlushFileBuffers
GetFullPathNameW
HeapReAlloc
CompareStringW
LCMapStringW
GetStringTypeW
HeapAlloc
HeapFree
SetEndOfFile
SetFilePointerEx
GetConsoleCP
GetACP
GetCommandLineW
GetCommandLineA
ReadFile
GetStdHandle
WriteFile
SetConsoleMode
GetConsoleMode
ReadConsoleW
WideCharToMultiByte
GetLastError
LocalFree
FormatMessageA
SetFilePointer
CreateFileW
Sleep
SetConsoleOutputCP
GetCurrentProcess
DuplicateHandle
DeleteFileW
GetCurrentProcessId
GetStartupInfoW
SetConsoleCtrlHandler
SetConsoleTitleA
ReleaseSemaphore
GetModuleFileNameW
GetEnvironmentVariableA
WaitForSingleObject
MultiByteToWideChar
ReadConsoleInputA
SetEvent
GetConsoleTitleA
CloseHandle
ResetEvent
VerSetConditionMask
GetNumberOfConsoleInputEvents
CreateProcessW
VerifyVersionInfoW
CreateEventA
WriteConsoleInputA
IsWow64Process
GetExitCodeProcess
GetCurrentThreadId
GetProcAddress
GetModuleHandleA
GetVersion
GetTickCount
QueryPerformanceCounter
GlobalMemoryStatus
FreeLibrary
LoadLibraryA
GetVersionExA
FlushConsoleInputBuffer
SetLastError
GetTimeZoneInformation
GetCurrentDirectoryW
SetCurrentDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
WriteConsoleW
HeapSize
DecodePointer
RaiseException
GetFileType
SetEnvironmentVariableW
SetEnvironmentVariableA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
SetStdHandle
GetFileAttributesExW
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime

user32

GetProcessWindowStation
MessageBoxA
GetDesktopWindow
GetUserObjectInformationW

advapi32

CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptSetHashParam
CryptCreateHash
CryptSignHashA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
DeregisterEventSource
ReportEventA
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptAcquireContextA
CryptGetProvParam
CryptDestroyKey
CryptEnumProvidersA
RegisterEventSourceA

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 385KB - Virtual size: 384KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
mudrun.exe
.exe windows:6 windows x64 arch:x64

1729b48f80619d9ced0bd5fdd31a27d5

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15/01/2024, 00:00

Not After

14/04/2035, 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ea:07:e8:ec:e3:5e:0d:20:9b:77:9b:e1:7e:62:70:f2
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

25/04/2024, 00:00

Not After

25/04/2027, 23:59

Subject

CN=Mudfish Networks,O=Mudfish Networks,ST=Gyeongsangnam-do,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22/03/2021, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e2:a3:10:ec:92:05:76:66:56:34:48:f7:c8:4e:94:b4:db:d1:40:b9
Signer

Actual PE Digest

e2:a3:10:ec:92:05:76:66:56:34:48:f7:c8:4e:94:b4:db:d1:40:b9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Work\ttol\bin\mudrun\mudrun.pdb

Imports

advapi32

AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegDeleteValueA
RegSetValueExA
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
CryptGenRandom
DeregisterEventSource

dbghelp

SymInitialize
SymFromAddr

iphlpapi

GetIpForwardTable
IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho
GetAdaptersInfo

gdi32

DeleteObject
DeleteDC
CreateCompatibleDC
GetDIBits
GetObjectA
SelectObject

psapi

GetModuleBaseNameA
GetModuleFileNameExA
GetProcessMemoryInfo
EnumProcesses
EnumProcessModules

shell32

ExtractIconExA
Shell_NotifyIconA

shlwapi

PathAppendA
PathRemoveFileSpecA

user32

GetMessageA
TranslateMessage
RegisterWindowMessageA
MessageBoxA
DispatchMessageA
DefWindowProcA
PostQuitMessage
RegisterClassExA
CreateWindowExA
ShowWindow
IsWindowVisible
CreatePopupMenu
AppendMenuA
TrackPopupMenu
SetForegroundWindow
GetCursorPos
LoadCursorA
LoadIconA
GetWindowDC
ReleaseDC
DestroyIcon
GetDesktopWindow
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
GetIconInfo

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

winhttp

WinHttpQueryHeaders
WinHttpAddRequestHeaders
WinHttpCloseHandle
WinHttpOpen
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpConnect
WinHttpSetOption

ws2_32

getsockopt
WSACleanup
closesocket
ioctlsocket
htonl
inet_addr
inet_ntoa
recv
send
sendto
setsockopt
shutdown
WSAStartup
WSAGetLastError
inet_ntop
WSASetLastError
select
bind
connect
listen
socket
getaddrinfo
freeaddrinfo
getpeername
getsockname
ntohs
getnameinfo
__WSAFDIsSet
accept
htons
recvfrom
gethostbyname
inet_pton

kernel32

LCMapStringW
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
SetConsoleCtrlHandler
GetCommandLineW
GetCommandLineA
ExitProcess
GetCPInfo
FreeLibraryAndExitThread
GetLocaleInfoW
CreateThread
CreateProcessW
WriteConsoleW
GetModuleFileNameW
RtlPcToFileHeader
GetFileSizeEx
LoadLibraryExW
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwindEx
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetExitCodeProcess
GetStringTypeW
SetStdHandle
GetTimeZoneInformation
SetCurrentDirectoryW
GetCurrentDirectoryW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetConsoleOutputCP
SetFilePointerEx
GetDateFormatW
GetTimeFormatW
EncodePointer
CompareStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
ExitThread
FileTimeToSystemTime
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
FindNextFileW
FindFirstFileW
FindClose
RtlVirtualUnwind
ConvertThreadToFiber
ConvertFiberToThread
GetCurrentProcessId
SwitchToThread
SetCurrentDirectoryA
CreateFileA
ReadFile
GetTempPathA
GetTempFileNameA
CloseHandle
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
GetCurrentProcess
GetCurrentThreadId
GetSystemTimeAsFileTime
GetVersionExA
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
GetProcAddress
LoadLibraryA
LocalFree
FormatMessageA
CreateFileMappingA
OpenFileMappingA
DuplicateHandle
SetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventA
WaitForMultipleObjects
GetCurrentThread
GetThreadPriority
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
GetSystemTime
CreateSemaphoreA
SystemTimeToFileTime
ExpandEnvironmentStringsA
CreateProcessA
FlushFileBuffers
GetTickCount
CreateFileMappingW
WideCharToMultiByte
FreeLibrary
GetProcessHeap
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
GetSystemInfo
HeapReAlloc
DeleteFileW
DeleteFileA
WaitForSingleObjectEx
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
MultiByteToWideChar
HeapSize
HeapValidate
GetFileAttributesW
CreateFileW
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
HeapFree
HeapCreate
AreFileApisANSI
RaiseException
TryEnterCriticalSection
DeleteCriticalSection
SetHandleInformation
FatalAppExitA
CreatePipe
TerminateProcess
OpenProcess
GetModuleFileNameA
CreateToolhelp32Snapshot
Process32First
Process32Next
RtlCaptureStackBackTrace
SetUnhandledExceptionFilter
GlobalAlloc
GlobalFree
LocalAlloc
GetEnvironmentVariableA
GetModuleHandleExW
InitializeCriticalSectionAndSpinCount
TlsFree
GetStdHandle
GetEnvironmentVariableW
GetFileType
GetModuleHandleW
SwitchToFiber
DeleteFiber
CreateFiber
RtlUnwind

crypt32

CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertOpenStore
CertCloseStore

Sections

.text
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 773KB - Virtual size: 772KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 210KB - Virtual size: 253KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
mudrun.exe.manifest
.xml
mudrun_cert.pem
mudrun_headless.exe
.exe windows:6 windows x64 arch:x64

fd4c10e1006745e3dcfd582954d45148

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15/01/2024, 00:00

Not After

14/04/2035, 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ea:07:e8:ec:e3:5e:0d:20:9b:77:9b:e1:7e:62:70:f2
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

25/04/2024, 00:00

Not After

25/04/2027, 23:59

Subject

CN=Mudfish Networks,O=Mudfish Networks,ST=Gyeongsangnam-do,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22/03/2021, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a3:46:8e:15:55:ee:f3:40:b4:56:4b:37:6e:d1:7e:33:dc:fc:83:b1
Signer

Actual PE Digest

a3:46:8e:15:55:ee:f3:40:b4:56:4b:37:6e:d1:7e:33:dc:fc:83:b1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Work\ttol\bin\mudrun\mudrun_headless.pdb

Imports

advapi32

AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegDeleteValueA
RegSetValueExA
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
CryptGenRandom

dbghelp

SymInitialize
SymFromAddr

iphlpapi

IcmpCreateFile
GetAdaptersInfo
IcmpCloseHandle
IcmpSendEcho
GetIpForwardTable

gdi32

CreateCompatibleDC
SelectObject
GetDIBits
DeleteObject
DeleteDC
GetObjectA

psapi

EnumProcesses
EnumProcessModules
GetModuleBaseNameA
GetProcessMemoryInfo
GetModuleFileNameExA

shell32

ExtractIconExA

shlwapi

PathRemoveFileSpecA
PathAppendA

user32

GetWindowDC
MessageBoxA
GetUserObjectInformationW
ReleaseDC
GetDesktopWindow
DestroyIcon
GetIconInfo
MessageBoxW
GetProcessWindowStation

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

winhttp

WinHttpQueryHeaders
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse

ws2_32

bind
closesocket
ioctlsocket
htonl
inet_addr
inet_ntoa
recv
send
sendto
setsockopt
WSACleanup
getsockopt
shutdown
WSAStartup
WSAGetLastError
inet_ntop
WSASetLastError
select
inet_pton
connect
listen
socket
getaddrinfo
freeaddrinfo
getpeername
getsockname
ntohs
getnameinfo
__WSAFDIsSet
accept
htons
recvfrom
gethostbyname

kernel32

GetCommandLineW
GetCommandLineA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
SetConsoleCtrlHandler
ExitProcess
GetCPInfo
FreeLibraryAndExitThread
ExitThread
CreateThread
CreateProcessW
GetFileSizeEx
GetModuleFileNameW
RtlPcToFileHeader
EncodePointer
LoadLibraryExW
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwindEx
SetStdHandle
GetTimeZoneInformation
SetCurrentDirectoryW
GetCurrentDirectoryW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
SetFilePointerEx
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetConsoleOutputCP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetExitCodeProcess
WriteConsoleW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetCurrentProcessId
SwitchToThread
SetCurrentDirectoryA
CreateFileA
ReadFile
GetTempPathA
GetTempFileNameA
CloseHandle
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
GetCurrentProcess
GetCurrentThreadId
GetSystemTimeAsFileTime
GetVersionExA
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
GetProcAddress
LoadLibraryA
GetStringTypeW
FormatMessageA
CreateFileMappingA
OpenFileMappingA
DuplicateHandle
SetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventA
WaitForMultipleObjects
GetCurrentThread
GetThreadPriority
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
GetSystemTime
CreateSemaphoreA
SystemTimeToFileTime
ExpandEnvironmentStringsA
CreateProcessA
FlushFileBuffers
GetTickCount
CreateFileMappingW
WideCharToMultiByte
FreeLibrary
GetProcessHeap
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
GetSystemInfo
HeapReAlloc
DeleteFileW
DeleteFileA
WaitForSingleObjectEx
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
MultiByteToWideChar
HeapSize
HeapValidate
GetFileAttributesW
CreateFileW
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
HeapFree
HeapCreate
AreFileApisANSI
RaiseException
TryEnterCriticalSection
DeleteCriticalSection
SetHandleInformation
CreatePipe
TerminateProcess
OpenProcess
GetModuleFileNameA
CreateToolhelp32Snapshot
Process32First
Process32Next
RtlCaptureStackBackTrace
SetUnhandledExceptionFilter
GlobalAlloc
GlobalFree
LocalAlloc
GetEnvironmentVariableA
GetModuleHandleExW
InitializeCriticalSectionAndSpinCount
TlsFree
GetStdHandle
GetEnvironmentVariableW
GetFileType
GetModuleHandleW
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
RtlVirtualUnwind
FindClose
FindFirstFileW
FindNextFileW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
LocalFree
RtlUnwind

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore

Sections

.text
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 772KB - Virtual size: 772KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 210KB - Virtual size: 253KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
mudrun_new.ico
mudrun_pkey.pem
mudrun_service.exe
.exe windows:6 windows x64 arch:x64

44a18964ffba16ef6fd2bbcfc4d7928c

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15/01/2024, 00:00

Not After

14/04/2035, 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ea:07:e8:ec:e3:5e:0d:20:9b:77:9b:e1:7e:62:70:f2
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

25/04/2024, 00:00

Not After

25/04/2027, 23:59

Subject

CN=Mudfish Networks,O=Mudfish Networks,ST=Gyeongsangnam-do,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22/03/2021, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3b:73:38:2f:18:61:58:f8:29:2c:25:0c:25:a9:95:a3:0a:8c:bc:b3
Signer

Actual PE Digest

3b:73:38:2f:18:61:58:f8:29:2c:25:0c:25:a9:95:a3:0a:8c:bc:b3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Work\ttol\bin\mudrun_service\mudrun_service.pdb

Imports

iphlpapi

GetAdaptersInfo
GetIpForwardTable

shlwapi

PathAppendA
PathRemoveFileSpecA

user32

MessageBoxA

ws2_32

setsockopt
sendto
send
recv
WSAStartup
inet_addr
htonl
ioctlsocket
closesocket
shutdown
inet_ntop
WSAGetLastError
WSASetLastError
inet_ntoa

advapi32

OpenSCManagerA
CheckTokenMembership
ConvertStringSidToSidA
SetSecurityInfo
GetSecurityInfo
SetEntriesInAclA
StartServiceCtrlDispatcherA
SetServiceStatus
RegisterServiceCtrlHandlerExA
OpenServiceA
AllocateAndInitializeSid
DeleteService
CreateServiceA
CloseServiceHandle
ReportEventA
RegisterEventSourceA
DeregisterEventSource
FreeSid

kernel32

GetFileAttributesExW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetProcessHeap
FlushFileBuffers
ReadConsoleW
HeapReAlloc
GetTimeZoneInformation
CreateFileW
HeapSize
SetEndOfFile
DeleteFileW
CreatePipe
GetCurrentProcessId
SwitchToThread
SetCurrentDirectoryA
CreateFileA
ReadFile
GetTempPathA
GetTempFileNameA
CloseHandle
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
GetCurrentProcess
GetCurrentThreadId
GetSystemTimeAsFileTime
GetVersionExA
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
GetProcAddress
LoadLibraryA
LocalFree
FormatMessageA
CreateFileMappingA
OpenFileMappingA
DuplicateHandle
SetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventA
WaitForMultipleObjects
GetCurrentThread
GetThreadPriority
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
GetSystemTime
CreateSemaphoreA
SystemTimeToFileTime
WriteFile
ConnectNamedPipe
DisconnectNamedPipe
GetOverlappedResult
TerminateProcess
GetExitCodeProcess
CreateProcessA
OpenProcess
GetModuleFileNameA
CreateNamedPipeA
CreateToolhelp32Snapshot
Process32First
Process32Next
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
WideCharToMultiByte
LCMapStringEx
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
EnumSystemLocalesW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
CreateProcessW
CreateThread
ExitThread
FreeLibraryAndExitThread
SetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
ExitProcess
GetCommandLineA
GetCommandLineW
HeapFree
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
HeapAlloc
OutputDebugStringW
SetConsoleCtrlHandler
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
RtlUnwind

Sections

.text
Size: 737KB - Virtual size: 736KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 150KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
mudrun_tauri.exe
.exe windows:6 windows x64 arch:x64

c315aa3c236434e622e82a87af4c36c1

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15/01/2024, 00:00

Not After

14/04/2035, 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ea:07:e8:ec:e3:5e:0d:20:9b:77:9b:e1:7e:62:70:f2
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

25/04/2024, 00:00

Not After

25/04/2027, 23:59

Subject

CN=Mudfish Networks,O=Mudfish Networks,ST=Gyeongsangnam-do,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22/03/2021, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b5:56:54:aa:8b:4d:d6:cf:17:18:1c:97:78:2d:7f:68:71:94:94:4f
Signer

Actual PE Digest

b5:56:54:aa:8b:4d:d6:cf:17:18:1c:97:78:2d:7f:68:71:94:94:4f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Work\ttol\bin\mudrun_tauri\src-tauri\target\x86_64-pc-windows-msvc\release\deps\mudrun_tauri.pdb

Imports

kernel32

SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
IsDebuggerPresent
GetModuleHandleW
LeaveCriticalSection
DeleteCriticalSection
RtlUnwindEx
RtlPcToFileHeader
ResetEvent
RaiseException
LoadLibraryA
UnhandledExceptionFilter
InitializeSListHead
TryAcquireSRWLockExclusive
lstrlenW
CreateMutexA
EnterCriticalSection
GetTempPathW
GetSystemTimeAsFileTime
GetCurrentThread
CreateThread
GetUserDefaultUILanguage
WriteConsoleW
MultiByteToWideChar
LCIDToLocaleName
LoadLibraryW
IsProcessorFeaturePresent
GetFullPathNameW
ExitProcess
CreateEventW
GetFinalPathNameByHandleW
FindFirstFileW
CreateDirectoryW
CreateFileW
GetFileAttributesW
GetModuleFileNameW
GetLastError
OutputDebugStringA
OutputDebugStringW
EncodePointer
TlsAlloc
CloseHandle
GetCurrentThreadId
LoadLibraryExW
TlsGetValue
GetProcAddress
TlsSetValue
ReleaseSRWLockExclusive
FreeLibrary
GetEnvironmentVariableW
SleepConditionVariableSRW
GetSystemInfo
FindClose
ReleaseMutex
GetProcessHeap
HeapFree
HeapAlloc
SetEvent
WaitForSingleObject
ReleaseSRWLockShared
FormatMessageW
AcquireSRWLockShared
HeapReAlloc
WaitForSingleObjectEx
Sleep
GetModuleHandleA
GetStdHandle
GetConsoleMode
GetFileInformationByHandleEx
GetFileInformationByHandle
QueryPerformanceFrequency
WakeConditionVariable
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
QueryPerformanceCounter
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
SetEnvironmentVariableW
GetCurrentProcess
AcquireSRWLockExclusive
WakeAllConditionVariable
GetCommandLineW
SetFileInformationByHandle
TerminateProcess
GetCurrentProcessId
TlsFree

user32

PostQuitMessage
AppendMenuW
CreateMenu
CheckMenuItem
SetMenuItemInfoW
VkKeyScanW
GetAsyncKeyState
GetKeyboardState
EnableMenuItem
GetSystemMenu
ShowWindow
LoadCursorW
SetCursor
ValidateRect
SetWindowLongW
SendMessageW
GetMessageA
DestroyAcceleratorTable
CreateAcceleratorTableW
SendInput
SetForegroundWindow
DispatchMessageA
InvalidateRgn
SetWindowDisplayAffinity
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
IsProcessDPIAware
GetDC
GetUpdateRect
SystemParametersInfoA
GetWindowLongPtrW
IsWindowVisible
SetWindowPos
GetWindowPlacement
GetClientRect
ClientToScreen
ClipCursor
GetClipCursor
SetWindowPlacement
MonitorFromRect
ShowCursor
PeekMessageW
AdjustWindowRectEx
GetMenu
TrackMouseEvent
GetWindowRect
MonitorFromPoint
ChangeDisplaySettingsExW
EnumDisplayMonitors
GetTouchInputInfo
ScreenToClient
FlashWindowEx
DefWindowProcW
RedrawWindow
PostThreadMessageW
ToUnicodeEx
GetKeyState
MapVirtualKeyExW
GetKeyboardLayout
DestroyIcon
CreateIcon
GetRawInputData
SetCapture
SetWindowLongPtrW
MsgWaitForMultipleObjectsEx
RegisterRawInputDevices
RegisterClassExW
RegisterWindowMessageA
PostMessageW
EnumChildWindows
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetAncestor
GetMessageW
GetForegroundWindow
GetActiveWindow
SetCursorPos
ReleaseCapture
IsIconic
SetMenu
MapVirtualKeyW
DestroyWindow
RegisterTouchWindow
GetSystemMetrics
IsWindow
CreateWindowExW
GetMonitorInfoW
MonitorFromWindow
GetCursorPos
GetWindowLongW
CloseTouchInputHandle

comctl32

RemoveWindowSubclass
DefSubclassProc
SetWindowSubclass

ole32

CoTaskMemFree
CoInitializeEx
CreateStreamOnHGlobal
CoCreateInstance
RegisterDragDrop
CoUninitialize
OleInitialize
CoTaskMemAlloc
RevokeDragDrop

shell32

DragFinish
SHGetKnownFolderPath
ShellExecuteW
SHAppBarMessage
DragQueryFileW

gdi32

GetDeviceCaps
DeleteObject
CreateRectRgn

dwmapi

DwmEnableBlurBehindWindow

uxtheme

SetWindowTheme

advapi32

RegGetValueW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister
SystemFunction036

oleaut32

SysFreeString
SetErrorInfo
GetErrorInfo
SysStringLen

bcrypt

BCryptGenRandom

ntdll

RtlNtStatusToDosError
NtWriteFile

api-ms-win-crt-math-l1-1-0

pow
round
trunc
floor
__setusermatherr

api-ms-win-crt-string-l1-1-0

wcslen
strcpy_s
_wcsicmp
wcsncmp

api-ms-win-crt-convert-l1-1-0

wcstol
_ultow_s

api-ms-win-crt-runtime-l1-1-0

__p___argc
_set_app_type
_exit
exit
__p___argv
_cexit
_initterm_e
_c_exit
abort
_initterm
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
terminate
_crt_atexit
_initialize_narrow_environment
_seh_filter_exe
_register_onexit_function
_initialize_onexit_table
_configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
calloc
malloc
_callnewh
_set_new_mode

Sections

.text
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 168KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
mudrun_tray.exe
.exe windows:6 windows x64 arch:x64

bd15db2644e12ab1a573aa3ee78c013c

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15/01/2024, 00:00

Not After

14/04/2035, 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ea:07:e8:ec:e3:5e:0d:20:9b:77:9b:e1:7e:62:70:f2
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

25/04/2024, 00:00

Not After

25/04/2027, 23:59

Subject

CN=Mudfish Networks,O=Mudfish Networks,ST=Gyeongsangnam-do,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22/03/2021, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:bb:ae:8a:c1:8c:7a:63:f3:2d:8b:c8:57:a5:a9:62:29:89:de:ba
Signer

Actual PE Digest

15:bb:ae:8a:c1:8c:7a:63:f3:2d:8b:c8:57:a5:a9:62:29:89:de:ba

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Work\ttol\bin\mudrun\mudrun_tray.pdb

Imports

advapi32

AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
CloseServiceHandle
OpenSCManagerA
OpenServiceA
QueryServiceStatusEx

iphlpapi

GetAdaptersInfo
GetIpForwardTable

shell32

Shell_NotifyIconA
SHGetKnownFolderPath

user32

RegisterWindowMessageA
GetMessageA
TranslateMessage
DispatchMessageA
DefWindowProcA
PostQuitMessage
RegisterClassExA
CreateWindowExA
ShowWindow
IsWindowVisible
CreatePopupMenu
AppendMenuA
TrackPopupMenu
SetForegroundWindow
GetCursorPos
LoadCursorA
LoadIconA
MessageBoxA

ws2_32

inet_ntoa
closesocket
htonl
inet_addr
recv
send
sendto
setsockopt
shutdown
WSAStartup
WSAGetLastError
inet_ntop
WSASetLastError
bind
connect
listen
select
socket
getaddrinfo
freeaddrinfo
getpeername
ntohs
getsockname
getnameinfo
ioctlsocket

kernel32

SetEndOfFile
GetTimeZoneInformation
HeapSize
ReadConsoleW
CreateFileW
FlushFileBuffers
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
CreateDirectoryW
SetStdHandle
GetStringTypeW
HeapReAlloc
DeleteFileW
MultiByteToWideChar
CreatePipe
GetFileAttributesExW
GetExitCodeProcess
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetConsoleCtrlHandler
OutputDebugStringW
HeapAlloc
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
HeapFree
ExitProcess
GetCommandLineW
GetCommandLineA
GetCPInfo
FreeLibraryAndExitThread
ExitThread
CreateThread
GetCurrentProcessId
SwitchToThread
SetCurrentDirectoryA
CreateFileA
ReadFile
GetTempPathA
GetTempFileNameA
CloseHandle
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
GetCurrentProcess
GetCurrentThreadId
GetSystemTimeAsFileTime
GetVersionExA
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
GetProcAddress
LoadLibraryA
LocalFree
FormatMessageA
CreateFileMappingA
OpenFileMappingA
DuplicateHandle
SetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventA
WaitForMultipleObjects
GetCurrentThread
GetThreadPriority
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
GetSystemTime
CreateSemaphoreA
SystemTimeToFileTime
ExpandEnvironmentStringsA
CreateProcessA
WriteFile
FatalAppExitA
SetNamedPipeHandleState
GetOverlappedResult
TerminateProcess
OpenProcess
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32First
Process32Next
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
CreateProcessW
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
RtlUnwind

Sections

.text
Size: 583KB - Virtual size: 583KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
mudwfp.cat
mudwfp.inf
mudwfp_proxy.exe
.exe windows:6 windows x86 arch:x86

f3907b9ad10952d934133249cd19d0ce

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15/01/2024, 00:00

Not After

14/04/2035, 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ea:07:e8:ec:e3:5e:0d:20:9b:77:9b:e1:7e:62:70:f2
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

25/04/2024, 00:00

Not After

25/04/2027, 23:59

Subject

CN=Mudfish Networks,O=Mudfish Networks,ST=Gyeongsangnam-do,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22/03/2021, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

73:5a:a8:79:d3:a5:06:eb:61:5e:c6:4a:0e:ba:86:3c:9d:7a:bc:a4
Signer

Actual PE Digest

73:5a:a8:79:d3:a5:06:eb:61:5e:c6:4a:0e:ba:86:3c:9d:7a:bc:a4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Work\ttol\bin\mudwfp_proxy\Release\mudwfp_proxy.pdb

Imports

kernel32

CreateFileMappingA
LocalFree
GetCurrentProcessId
OpenFileMappingA
GetSystemTimeAsFileTime
FormatMessageA
GetTempFileNameA
MapViewOfFile
QueryPerformanceCounter
TlsSetValue
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
ResumeThread
DuplicateHandle
SetEvent
GetCurrentThread
GetProcAddress
GetThreadPriority
ResetEvent
TlsGetValue
CreateEventA
SetUnhandledExceptionFilter
GetTickCount
DeviceIoControl
ExpandEnvironmentStringsA
CreateThread
SleepEx
CreateProcessA
GetExitCodeProcess
Process32First
CreateToolhelp32Snapshot
Process32Next
WriteConsoleW
SetEndOfFile
ReadConsoleW
CloseHandle
GetVersionExA
LoadLibraryA
CreateFileA
FlushViewOfFile
GetLastError
GetTempPathA
Sleep
UnmapViewOfFile
GetCurrentThreadId
GetCurrentProcess
TlsAlloc
ReadFile
HeapSize
SetFilePointerEx
GetFileSizeEx
GetTimeZoneInformation
GetProcessHeap
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
DecodePointer
FindNextFileW
FindFirstFileExW
FindClose
CreateFileW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
WideCharToMultiByte
MultiByteToWideChar
GetFileType
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetTempPathW
ExitProcess
SetConsoleCtrlHandler
GetStdHandle
WriteFile
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW

user32

MessageBoxA

advapi32

OpenSCManagerA
OpenServiceA
CreateServiceA
QueryServiceStatus
CloseServiceHandle
ControlService
StartServiceA

iphlpapi

GetAdaptersAddresses

ws2_32

getnameinfo
WSACleanup
__WSAFDIsSet
accept
bind
WSAIoctl
select
listen
getaddrinfo
socket
connect
htons
ntohs
WSAGetOverlappedResult
shutdown
WSAStartup
inet_addr
send
inet_ntoa
recv
htonl
sendto
ioctlsocket
setsockopt
WSAGetLastError
recvfrom
WSASetLastError
closesocket

Sections

.text
Size: 146KB - Virtual size: 145KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tap0901.cat
tap0901.sys
.sys windows:6 windows x64 arch:x64

741e65dbed0bdb03af558a33e0336da1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\users\samuli\openvpn-build\openvpn-cron2\tap-win32\amd64\tap0901.pdb

Imports

ntoskrnl.exe

KeBugCheckEx
KeAcquireSpinLockRaiseToDpc
KeRemoveQueueDpc
RtlCreateSecurityDescriptor
IoReleaseCancelSpinLock
ZwOpenFile
RtlFreeAnsiString
ZwSetSecurityObject
IofCompleteRequest
ZwClose
KeInsertQueueDpc
MmMapLockedPagesSpecifyCache
RtlFreeUnicodeString
KeReleaseSpinLock
KeInitializeDpc
RtlUnicodeStringToAnsiString
MmMapLockedPages
RtlAnsiStringToUnicodeString
RtlUnicodeToMultiByteN
__C_specific_handler

ndis.sys

NdisMRegisterAdapterShutdownHandler
NdisAllocateMemoryWithTag
NdisReadConfiguration
NdisTerminateWrapper
NdisMDeregisterDevice
NdisMDeregisterAdapterShutdownHandler
NdisMSetAttributesEx
NdisInitializeWrapper
NdisFreeMemory
NdisMRegisterMiniport
NdisCloseConfiguration
NdisMRegisterDevice
NdisMRegisterUnloadHandler
NdisMIndicateStatus
NdisMIndicateStatusComplete
NdisMSleep
NdisOpenConfiguration

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
uninstaller.exe
.exe windows:4 windows x86 arch:x86

56a78d55f3f7af51443e58e0ce2fb5f6

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15/01/2024, 00:00

Not After

14/04/2035, 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ea:07:e8:ec:e3:5e:0d:20:9b:77:9b:e1:7e:62:70:f2
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

25/04/2024, 00:00

Not After

25/04/2027, 23:59

Subject

CN=Mudfish Networks,O=Mudfish Networks,ST=Gyeongsangnam-do,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22/03/2021, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

aa:7a:64:f0:eb:cf:7f:80:0c:ad:34:50:bc:6d:a6:55:ea:87:10:53
Signer

Actual PE Digest

aa:7a:64:f0:eb:cf:7f:80:0c:ad:34:50:bc:6d:a6:55:ea:87:10:53

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW

shell32

SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
CreateFileW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

fc0224e99e736751432961db63a41b76

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfW

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 662B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsExec.dll
.dll windows:4 windows x86 arch:x86

c1c7505e1e6e929ebb6b9100e55b050a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
IsTextUnicode

user32

wsprintfW
CharNextExA
SendMessageW
FindWindowExW
CharNextW
CharPrevW

kernel32

CreatePipe
DeleteFileW
lstrcmpiW
GetCommandLineW
ExitProcess
Sleep
TerminateProcess
GlobalReAlloc
MultiByteToWideChar
IsDBCSLeadByteEx
ReadFile
PeekNamedPipe
GetExitCodeProcess
WaitForSingleObject
GetTickCount
lstrcpyW
CreateProcessW
GetStartupInfoW
CreateFileMappingW
GetVersion
GetCurrentProcess
lstrcpynW
lstrlenW
lstrcatW
CloseHandle
UnmapViewOfFile
MapViewOfFile
GlobalFree
CreateFileW
CopyFileW
GetTempFileNameW
GlobalAlloc
GetModuleFileNameW
GetProcAddress
GetModuleHandleA

Exports

Exports

Exec
ExecToLog
ExecToStack

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
wintun.dll
.dll windows:6 windows x86 arch:x86

85d06bb8dccb5014c9a7a3146af5ef48

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:63:d5:fc:a7:28:88:2f:36:ff:1b:df:5d:85:f0:ba
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/12/2018, 00:00

Not After

14/12/2021, 12:00

Subject

SERIALNUMBER=4227913,CN=WireGuard LLC,O=WireGuard LLC,L=Boulder,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13044f68696f,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

43:08:7b:e6:e4:6f:97:89:4a:6c:3c:14:6c:cb:ca:a9:c4:46:23:57:4e:a7:6b:cc:2c:f8:a4:7c:b8:9a:8f:17
Signer

Actual PE Digest

43:08:7b:e6:e4:6f:97:89:4a:6c:3c:14:6c:cb:ca:a9:c4:46:23:57:4e:a7:6b:cc:2c:f8:a4:7c:b8:9a:8f:17

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Jason A. Donenfeld\Projects\wintun\Release\x86\wintun.pdb

Imports

kernel32

HeapCreate
GetCurrentProcess
LoadLibraryExA
CloseHandle
HeapDestroy
GetProcAddress
LocalFree
GetModuleHandleW
IsWow64Process
HeapFree
SetLastError
WaitForSingleObject
CreateFileW
OpenProcess
QueueUserWorkItem
CreateEventW
Sleep
GetLastError
SetEvent
HeapAlloc
GetCurrentProcessId
GetProcessTimes
RemoveDirectoryW
DeleteFileW
FormatMessageW
EnterCriticalSection
CreatePrivateNamespaceW
OpenPrivateNamespaceW
LeaveCriticalSection
InitializeCriticalSection
CreateBoundaryDescriptorW
CreateMutexW
ReleaseMutex
ClosePrivateNamespace
AddSIDToBoundaryDescriptor
DeleteCriticalSection
DeleteBoundaryDescriptor
ExpandEnvironmentStringsW
HeapReAlloc
CreateDirectoryW
SizeofResource
WriteFile
LockResource
LoadResource
FindResourceW
GetWindowsDirectoryW
VirtualFree
DeviceIoControl
VirtualAlloc
InitializeCriticalSectionAndSpinCount
ReadFile
SetHandleInformation
CreatePipe
GetExitCodeThread
CreateThread
CreateProcessW
DecodePointer
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapSize
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
FreeLibrary
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InterlockedFlushSList
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStringTypeW
SetFilePointerEx
SetStdHandle
WriteConsoleW

ntdll

NtQuerySystemInformation
RtlNtStatusToDosError
RtlGetNtVersionNumbers
NtQueryKey
NtQuerySystemTime

Exports

Exports

WintunAllocateSendPacket
WintunCloseAdapter
WintunCreateAdapter
WintunDeleteDriver
WintunEndSession
WintunGetAdapterLUID
WintunGetReadWaitEvent
WintunGetRunningDriverVersion
WintunOpenAdapter
WintunReceivePacket
WintunReleaseReceivePacket
WintunSendPacket
WintunSetLogger
WintunStartSession

Sections

.text
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 348KB - Virtual size: 347KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

56a78d55f3f7af51443e58e0ce2fb5f6

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3fCertificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89Certificate

Extended Key Usages

Key Usages

ea:07:e8:ec:e3:5e:0d:20:9b:77:9b:e1:7e:62:70:f2Certificate

Extended Key Usages

Key Usages

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68Certificate

Extended Key Usages

Key Usages

29:a4:c0:44:62:77:64:62:b7:c9:42:c4:6c:88:05:aa:b8:02:83:c2Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

Sections

.text Size: 25KB - Virtual size: 25KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1KB - Virtual size: 128KB

.ndata Size: - Virtual size: 64KB

.rsrc Size: 4KB - Virtual size: 4KB

fc0224e99e736751432961db63a41b76

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 1024B - Virtual size: 867B

.data Size: 512B - Virtual size: 120B

.reloc Size: 1024B - Virtual size: 662B

5e62e8e248e7364886b604bd1fcf4c13

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

Exports

Exports

Sections

.text Size: 1024B - Virtual size: 714B

.rdata Size: 1024B - Virtual size: 705B

.data Size: 512B - Virtual size: 104B

.reloc Size: 512B - Virtual size: 240B

c1c7505e1e6e929ebb6b9100e55b050a

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

user32

kernel32

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

ea:07:e8:ec:e3:5e:0d:20:9b:77:9b:e1:7e:62:70:f2
Certificate

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

29:a4:c0:44:62:77:64:62:b7:c9:42:c4:6c:88:05:aa:b8:02:83:c2
Signer

.text
Size: 25KB - Virtual size: 25KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 128KB

.ndata
Size: - Virtual size: 64KB

.rsrc
Size: 4KB - Virtual size: 4KB

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 1024B - Virtual size: 867B

.data
Size: 512B - Virtual size: 120B

.reloc
Size: 1024B - Virtual size: 662B

.text
Size: 1024B - Virtual size: 714B

.rdata
Size: 1024B - Virtual size: 705B

.data
Size: 512B - Virtual size: 104B

.reloc
Size: 512B - Virtual size: 240B

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 420B

33:00:00:00:4d:e5:97:a7:75:e3:15:7f:7b:00:00:00:00:00:4d
Certificate

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

53:e3:04:27:93:57:bf:97:80:72:fe:62:a7:41:38:95:3c:d5:ab:c2:61:bd:0e:64:97:35:e3:50:22:78:20:a5
Signer

.text
Size: 17KB - Virtual size: 17KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 21KB

.pdata
Size: 1024B - Virtual size: 780B

INIT
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 52B

61:02:92:4a:00:00:00:00:00:20
Certificate

61:05:dd:42:00:00:00:00:00:14
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:07:02:dc:00:00:00:00:00:0b
Certificate

33:00:00:00:4d:e5:97:a7:75:e3:15:7f:7b:00:00:00:00:00:4d
Certificate

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

13:74:37:a3:05:3b:16:9c:08:97:37:aa:12:48:99:06:ef:23:b7:35:ba:d0:5c:1b:29:3d:ae:ca:3c:9a:4a:b2
Signer

3c:aa:50:ed:7a:7b:75:89:86:2f:97:5d:01:74:0e:5b:fe:6f:ba:ea
Signer

.text
Size: 55KB - Virtual size: 55KB

.data
Size: 512B - Virtual size: 18KB

.pdata
Size: 1KB - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 1.6MB - Virtual size: 1.6MB