General

Malware Config

Signatures

Files

• info.zip

  .zip
• IMG001.scr

  .exe windows:4 windows x86 arch:x86

  7fa974366048f9c551ef45714595665e

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  CompareFileTime

  SearchPathA

  GetShortPathNameA

  GetFullPathNameA

  MoveFileA

  SetCurrentDirectoryA

  GetFileAttributesA

  GetLastError

  CreateDirectoryA

  SetFileAttributesA

  Sleep

  GetTickCount

  GetFileSize

  GetModuleFileNameA

  GetCurrentProcess

  CopyFileA

  ExitProcess

  GetWindowsDirectoryA

  SetFileTime

  GetCommandLineA

  SetErrorMode

  LoadLibraryA

  lstrcpynA

  GetDiskFreeSpaceA

  GlobalUnlock

  GlobalLock

  CreateThread

  CreateProcessA

  RemoveDirectoryA

  CreateFileA

  GetTempFileNameA

  lstrlenA

  lstrcatA

  GetSystemDirectoryA

  GetVersion

  CloseHandle

  lstrcmpiA

  lstrcmpA

  ExpandEnvironmentStringsA

  GlobalFree

  GlobalAlloc

  WaitForSingleObject

  GetExitCodeProcess

  GetModuleHandleA

  LoadLibraryExA

  GetProcAddress

  FreeLibrary

  MultiByteToWideChar

  WritePrivateProfileStringA

  GetPrivateProfileStringA

  WriteFile

  ReadFile

  MulDiv

  SetFilePointer

  FindClose

  FindNextFileA

  FindFirstFileA

  DeleteFileA

  GetTempPathA

  user32

  EndDialog

  ScreenToClient

  GetWindowRect

  EnableMenuItem

  GetSystemMenu

  SetClassLongA

  IsWindowEnabled

  SetWindowPos

  GetSysColor

  GetWindowLongA

  SetCursor

  LoadCursorA

  CheckDlgButton

  GetMessagePos

  LoadBitmapA

  CallWindowProcA

  IsWindowVisible

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  RegisterClassA

  TrackPopupMenu

  AppendMenuA

  CreatePopupMenu

  GetSystemMetrics

  SetDlgItemTextA

  GetDlgItemTextA

  MessageBoxIndirectA

  CharPrevA

  DispatchMessageA

  PeekMessageA

  DestroyWindow

  CreateDialogParamA

  SetTimer

  SetWindowTextA

  PostQuitMessage

  SetForegroundWindow

  wsprintfA

  SendMessageTimeoutA

  FindWindowExA

  SystemParametersInfoA

  CreateWindowExA

  GetClassInfoA

  DialogBoxParamA

  CharNextA

  OpenClipboard

  ExitWindowsEx

  IsWindow

  GetDlgItem

  SetWindowLongA

  LoadImageA

  GetDC

  EnableWindow

  InvalidateRect

  SendMessageA

  DefWindowProcA

  BeginPaint

  GetClientRect

  FillRect

  DrawTextA

  EndPaint

  ShowWindow

  gdi32

  SetBkColor

  GetDeviceCaps

  DeleteObject

  CreateBrushIndirect

  CreateFontIndirectA

  SetBkMode

  SetTextColor

  SelectObject

  shell32

  SHGetPathFromIDListA

  SHBrowseForFolderA

  SHGetFileInfoA

  ShellExecuteA

  SHFileOperationA

  SHGetSpecialFolderLocation

  advapi32

  RegQueryValueExA

  RegSetValueExA

  RegEnumKeyA

  RegEnumValueA

  RegOpenKeyExA

  RegDeleteKeyA

  RegDeleteValueA

  RegCloseKey

  RegCreateKeyExA

  comctl32

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ImageList_Create

  ole32

  CoTaskMemFree

  OleInitialize

  OleUninitialize

  CoCreateInstance

  version

  GetFileVersionInfoSizeA

  GetFileVersionInfoA

  VerQueryValueA

  Sections

  .text

  Size: 23KB - Virtual size: 22KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1024B - Virtual size: 3.7MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 256KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 63KB - Virtual size: 62KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/ExecDos.dll

  .dll windows:6 windows x86 arch:x86

  7dc70b16176744e9eb1a6b125a945c2f

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  CreateFileA

  FlushFileBuffers

  ReadFile

  WriteFile

  CloseHandle

  DuplicateHandle

  CreatePipe

  PeekNamedPipe

  WaitForSingleObject

  Sleep

  GetCurrentProcess

  TerminateProcess

  GetExitCodeProcess

  CreateThread

  GetExitCodeThread

  CreateProcessA

  GetModuleHandleA

  GetProcAddress

  GlobalAlloc

  GlobalFree

  lstrcmpiA

  lstrcatA

  lstrlenA

  lstrcpynA

  lstrcpyA

  user32

  SendMessageA

  GetDlgItem

  FindWindowExA

  GetClassNameA

  wsprintfA

  Exports

  Exports

  exec

  isdone

  wait

  Sections

  .text

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: - Virtual size: 20B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1024B - Virtual size: 816B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 338B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/inetc.dll

  .dll windows:6 windows x86 arch:x86

  2e4d94706c699d2da474aa823430b9a5

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  wininet

  InternetErrorDlg

  HttpQueryInfoA

  HttpEndRequestA

  HttpSendRequestExA

  HttpSendRequestA

  HttpAddRequestHeadersA

  HttpOpenRequestA

  FtpCreateDirectoryA

  FtpOpenFileA

  InternetGetLastResponseInfoA

  InternetSetOptionA

  InternetQueryOptionA

  InternetWriteFile

  InternetSetFilePointer

  InternetReadFile

  InternetConnectA

  InternetCloseHandle

  InternetOpenA

  InternetCrackUrlA

  comctl32

  ord17

  kernel32

  GlobalFree

  GlobalAlloc

  WideCharToMultiByte

  LoadLibraryA

  lstrlenA

  lstrcatA

  lstrcpyA

  lstrcmpiA

  MulDiv

  LocalFree

  LocalAlloc

  GetProcAddress

  GetModuleHandleA

  GetTickCount

  TerminateThread

  CreateThread

  SleepEx

  lstrcmpA

  lstrcpynA

  CreateFileA

  DeleteFileA

  GetFileSize

  ReadFile

  SetFilePointer

  WriteFile

  CloseHandle

  GetLastError

  WaitForSingleObject

  user32

  SendDlgItemMessageA

  SetTimer

  KillTimer

  EnableWindow

  UpdateWindow

  RedrawWindow

  SetWindowTextA

  GetWindowTextA

  GetClientRect

  GetWindowRect

  MessageBoxA

  GetWindowLongA

  SetWindowLongA

  GetParent

  FindWindowExA

  LoadIconA

  IsDialogMessageA

  SystemParametersInfoA

  SetDlgItemTextA

  wsprintfA

  GetMessageA

  TranslateMessage

  DispatchMessageA

  SendMessageA

  PostMessageA

  IsWindow

  DestroyWindow

  ShowWindow

  SetWindowPos

  IsWindowVisible

  CreateDialogParamA

  GetDlgItem

  Exports

  Exports

  get

  head

  post

  put

  Sections

  .text

  Size: 11KB - Virtual size: 10KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 2KB - Virtual size: 15KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $R9/NsCpuCNMiner32.exe

  .exe windows:5 windows x86 arch:x86

  605c19578abec75fc74907473f752c23

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  E:\CryptoNight\bitmonero-master\src\miner\Release\Crypto.pdb

  Imports

  ws2_32

  __WSAFDIsSet

  advapi32

  AdjustTokenPrivileges

  user32

  GetWindowTextA

  kernel32

  GetLocalTime

  GetModuleFileNameW

  GetModuleHandleA

  LoadLibraryA

  LocalAlloc

  LocalFree

  GetModuleFileNameA

  ExitProcess

  Exports

  Exports

  g���Ɖ �������B/���a�t�
  ���1 Zʔĭ�Ԋ�+_�3��DZ���{Sy5�$e�d��Ԋ|5:L�2봬6���bm�2I�����_ą�چ<����%ٽ{Yy)�y��C�*�<E���-�Z�b�=ˤ���ȱ�,��/*|��������H����y��D��=�8<ì�r��o΃�t!�zMx��޵ÄnD�a���دm��4�����}�7�!��� �C�^���E�����,�2��^T}�|����2k�8��:vz�� �a�T ��(���:҃��K#�z'XnN);o� �-ʨ�����y��BݏЩ���?�,:�� �v�b"]�/C�<$fn�'��!c�Ҿ6R�dȹd� !c!�j�lJ��vՃ�B��1C�6�M+'vk��
  [N�>K�]0�22����n�oa�E�A*a�p�j��L�M�ʦ�,�R>`=n�]%�J)���M!�[�<d*���\�
  �h�4j]�,=r_���l���Q#:���4���a��i��}폎�"��񓕻�P�{dF͓��^�����Vmm�-ʭ�k��Fy���l�K!�5�p�O�еG�L{s��5�����j�w0��N��K�M[91�J(�-dH�eˬ�<.Ϭ0]a�l_"~!�^/��g�&�4���PRA��J�4�Nʣ��8hj��Mt�^���C�`��/_T �� ̑�e�KY�>������F �h�S����\�Y/^���Sp+�e��.��P ��3h�I�h5�B�S�ø���qՈ4n���3��s�2���*�=����pm�pl�})��s����xx��N��։z��P��}��H�V����vH��hm`
  �5f^��� �в�������Q֮�C
  *~fs�~�]O\x� ﴾����v2&�*�1t�R=5�xG|��>^.m�풼k�� �����e���W�E���dRܐx�V��!ݾo�������z8��L���2���CH<H' �����2"��G߮v!��b�zv�����AK�x�/�܎�p�|ĸ����T�-�q�R�M��j�>��H��Ы6.sf.��o�Kf �CƁb�� } k�Z���鱼��t�~�j�Z�q�prd�������!����n�
  �PR/b��s����q�Bi)dv�QN�
  ���û���6&��8]�e���R�.�΢��tk]�����!)_뎉}>R��Ρ�T}�O�E���l�\b�V��n�����E����:�Z��;`��t��� ����'E������J`�ï1YU�Pg@t� �f��.g���*���Xߜ<O�ʔ81��������&�����i�$Дr��������*]nH��w���VAe��s��4J0����h�:��,��h9�U�H*7r�J�m�ؠ9��|��Kq��02Ԧ��\�A8� �f� �C��-�^�L̾���"�p
  �N�n0�A�L2��N�� ��c��P�g�d���H�ם)T�H�/�8lu]flַ�o~��.U?�:V�M��Ca�}�� ����B��ȕ�o����x��9m���n���|Nm$*r��B9Y�H���ǭwd���,���J�6��v��BO�!*�ѯ��d��d��n!�,}/#���m��FR��h
  ǜ����+�I�R�C�$�> ����P��T��{��'
  [�ϑ~P0�t�)��6<vt�'�I*\Y���J5䩐�3sV���UJ�7 ��,y�9��ʰ��7�[��د��!
  ��RH��֝���P6��'��W;����>��=Q2����@P:�Ԙ��/��@2b��B��Y�⾍�0{��;���iiuáAp[�m��Zu���F���*��������(�&�π�r ׅ@����8��٪�l�K�ԣ�����ʘ t-�$�6��u��Һ�S\��6��'�
  ��D�d���0���ϖ�@�P���x���T���F/ħ<�O�;����â*���zy��o�f�3#֓1z��ҚG,��Y-�ysQ�Ƕ��?��=������ ��Ow�d'��޼:K.$��4���� ����S4�@��y1��d���� �F�7�E-�xq:�T��nW>w4�8y��Y����M��8I�l(b�u���4l��L� P��hr���R^=odž�0T��-��{�ea iaݍ���p%�G�HZf"�袟�A�3m˪�����]����<CY�dq��=��O�'(�8��:��Z�wD]ɛ�����.������z`-�
  �hP�G �E�ݶ���;���)�]E(D8;����;H�m�v�r�5�,F����ln�э��B�n��Z
  B��ݧ�4�NҾ[F�d�m�����jzC��w�<hw����w�A"�LZ��C/�l�7m�]��|=*�� ���%y#�L��Q�e����� iX9�w@"³ |��g�3
  ���A��,��D��ƀ�U��"HDV�����s��Բ)Y5ңy��*�
  ��ܵ/�uz �ܐ����FGuL4Pr��,�w'�f_�C���;y�`��Q`o���E��x��;�&���g���u?�u�K��`�¾N�5{��Y��B7�?�_��`���?���Yp�{9��C)�����SY�|�:s�ן���s������w�wϠVHEY�-���i�20Y~}����%I���*bȀ��7��Α��ZQ�u26��X�
  [g���$dr�`^���2H����ʎ�V��ݷ�O���TQ�U�t��d�uׯg*��|ṿ ����������t�ڨ�{|�H�3��S���3�(� _���H�:�kd� 8�^o��rU'g�
  �Ly��U�벳��
  ��m��Ok�����k� ��S����vx�Jh�I��&�4���Y�a��ɧG��VE�F�e�[;3�.�F������\�S�����絙����9J����o(��V��� ����q�8�1L06�
  ]���=�6e����+��r_��R�>eH�c���Z��ȱ���8�n��@�E�Z��d��Vz��f���#�=(������z 34X �3Y3 k�Ҳ����s�K���+���%�|M#������eB3/1�=��5\��

  Sections

  .text

  Size: - Virtual size: 636KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: - Virtual size: 156KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: - Virtual size: 183KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 2B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .vmp0

  Size: - Virtual size: 961KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .vmp1

  Size: 1.4MB - Virtual size: 1.4MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 512B - Virtual size: 472B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 636B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• $R9/NsCpuCNMiner64.exe

  .exe windows:5 windows x64 arch:x64

  de374bd0d52433ab46e2fe7e4daf1ffe

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  E:\CryptoNight\bitmonero-master\src\miner\x64\CPU-Release\Crypto.pdb

  Imports

  kernel32

  LCMapStringW

  GetModuleFileNameW

  GetModuleHandleA

  LoadLibraryA

  LocalAlloc

  LocalFree

  GetModuleFileNameA

  ExitProcess

  user32

  MessageBoxW

  advapi32

  AdjustTokenPrivileges

  ws2_32

  select

  Exports

  Exports

  �PhŶޘj�u0�ik�תE��ð,/�J��f���p0u誌8�5�� &{��(WU� y�� ��}b6 �4ˋ��=���i��S�-i&�� �:p�V3��s��]�)�t��V(7��H��3ӫt��h���->9]&mo ��qщ�o�K�!��7�DQ�Fc�T.�y�d.k�O�(|�����m,o��0�^z�.˧CD� ̼�����ғ{�� j�K|9�;�����F���]�: ���l�|<� ����;�g�{j�J�a�y� DGĈ��i��_�'��$-1+T�����_0h�q�r�4���Πr�~S��۱��.�6 !�8��V��/���y\^߯I�cL���;.�9]�#;&n��JeF���YI��s7���+vH���<B��w$��W뫝����[�JӅL�#��F�T���Pz�5]/�<��|O���J��z7:�ד~�1f/g���8���a����5�r��G�r��
  8Uf���u�-F�Ɩ�^RZD�<6׻���3��X��<�8^z�R�^����TP=�7 *�p��E+z?�����)��]�M3p�X�6��2�vQ ����W �䠐Ǿ�&��� k���&��$Qt�e�-�s�A&���Bm3o#ެ6�SО?�D&D�3�"OM3<��|���ѷ�N65�3����u�R�H�X Y���獼E��[�M��9�;5|��j�e�bJ�����n݃�dF��Q3/u"ڣ���[?#��g���a�*��.���Nj�{����ŸD1�������]F��š4���0
  �fuw�x���5{��Y�L��x9���7���Z��Ww-��?��� ��[��3���v��L�!��s��R����-;|cm~�RA��&����ﭠ��Pf8�����M�����:��������B�iE���8R��+}�vى� E���oT:�jLˎ?�:`�~�i�F3B�M��$�NϧC�{`da'<�qE}q�2�\�? ��=~��F\����l���6����d�Rw �՗P7���d����$��������u��5Q�� �@/?$"���h�J�Ǡ1�]�p^�t"��2▾���h�%�q^@,���r!�9
  p����51�g(���'��G�8b������_�_`C�>��cu���9�s�TH-�pb��f����#�4X&�ș&d��3��lp������g|���ѹ`����}��=��I],��!\?rZ����b_e�Sw����Y�G�_]�jτ��iP���=ʊrO~�ZU[�c�D��������=��+�����c\?ծ��-Y�:Gx��#� �Gs�ת�b�S�Oo���aU����[��9f��
  T��1$xML�R�V�]�5=~O�2$��2���������8����b�8�deOP����}o�AVGc�(��}R@^�T·\���(�a7 y�Xv�m��]Y�A�j�@��D]�t����i��l��G��5
  ���wŗ�/�����R�]��][���ٮ�Uz�m(�˵W,
  [��{p�{oC#��Xn�%qK��{ ��i;!)�.�mi�����/f��>T�rc9L�X�� ��p�ŸC����ۖ�`��+tY��Tc� �G:` �6����D��1����,N2����ͥ�YΈ� 4s�E �3ݧ :Q1�(�:F#&Tf���ø[^��uD`�N�&��3&A����p�� �zF�Fq�^j^'�W֘��6'"� ��a-)^��U�a��$ V�xZt�X�K`_��bl��F��DV������\4� �pB;���.8��j�@�@�o栅*b�=cV�A�~e��#D���6Hk�ˡ.VÍ��E6��KȽ���I��p�B�*p��wX�i��&p1�+o�N�ޡL�$O�� F�t����h;E1� �@��y0�`q��h�i�D�"[ᬚ�x�����/��o�ʜ���gs7),A����t!�BD���R��+%nE˟%p��4tksC�"�ӵ������ \f& �=z���$���#%��B����v�Eĸ� ,0,?���@~^8�龪z���1j���k��=��s7yYޯw��!�Đ�#��ĭÞ�~��B��LK�!�R�{8h�!�n���� ��Byvy��U���7O�w�vT����P�E:$N��wWy�'���ƽrk�5$C3��7����N\���Ф����;��"�ʻ5��y�֧��+�ڷ�Y��c%�8���j]{����L��~�����_�'���d[KX��kD���"�%G�: ��K���N��&?�5�����Ŏ�il���#cC3o- ��9!��I̫V�~o��E���˸4����Xo�4���� ��}yU��3f5WK֌��B=ʞ���=��c������<��TK�.s#W��#������7~��2ϓ�)���=��T.uM,���K<1;q.�3^\y&�Ow��j �>�}�yڬ��k�x�*��3}�m-<�0-í�zK\��Q8Qe��\ Ψ�~��ڂ��bK���Oy�VY�0�.ˣ=l��0�?��$x C��u��C���7y�!�9��Q������z�g��沃P���(�q�q4�����0�����~�i���T�0O�`2��ηP�A��<h�C���f��ߖ���@Δ�Ү8�a�/9�*�s��Ǹ����J3|g,�(^�ͥ8uu)>#R����� �N���t���m���0E.�¹S�D�6w��R5\؆�2?�"Q\I{%U|�0��P�����0�vAĬB-�t��r�e{���NzW|�Hq�|H]��ߞ�m�(���_As��r�F�+�6�����k�� �����ڬv(rB�H� �`�a�j�*���:O?��޵�e<��N2p��D+rs����GL�5�D�T{��Wf���:V�˅�6O�LI�,���U��?e�p� d1ءܨL�#�>�u���;�}Ҭ�B����L�9G sF5��ǒ�#����4�~�����^jM�Qn�<lk����K�l�h������@��_�L��\���ZT9_)�e�S���?��Π,�>�

  Sections

  .text

  Size: - Virtual size: 668KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: - Virtual size: 274KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: - Virtual size: 32KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 2B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .vmp0

  Size: - Virtual size: 1.0MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .vmp1

  Size: 1.5MB - Virtual size: 1.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 512B - Virtual size: 128B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 636B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• $R9/Plugins/ExecDos.dll

  .dll windows:6 windows x86 arch:x86

  7dc70b16176744e9eb1a6b125a945c2f

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  CreateFileA

  FlushFileBuffers

  ReadFile

  WriteFile

  CloseHandle

  DuplicateHandle

  CreatePipe

  PeekNamedPipe

  WaitForSingleObject

  Sleep

  GetCurrentProcess

  TerminateProcess

  GetExitCodeProcess

  CreateThread

  GetExitCodeThread

  CreateProcessA

  GetModuleHandleA

  GetProcAddress

  GlobalAlloc

  GlobalFree

  lstrcmpiA

  lstrcatA

  lstrlenA

  lstrcpynA

  lstrcpyA

  user32

  SendMessageA

  GetDlgItem

  FindWindowExA

  GetClassNameA

  wsprintfA

  Exports

  Exports

  exec

  isdone

  wait

  Sections

  .text

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: - Virtual size: 20B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1024B - Virtual size: 816B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 338B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $R9/Plugins/inetc.dll

  .dll windows:6 windows x86 arch:x86

  2e4d94706c699d2da474aa823430b9a5

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  wininet

  InternetErrorDlg

  HttpQueryInfoA

  HttpEndRequestA

  HttpSendRequestExA

  HttpSendRequestA

  HttpAddRequestHeadersA

  HttpOpenRequestA

  FtpCreateDirectoryA

  FtpOpenFileA

  InternetGetLastResponseInfoA

  InternetSetOptionA

  InternetQueryOptionA

  InternetWriteFile

  InternetSetFilePointer

  InternetReadFile

  InternetConnectA

  InternetCloseHandle

  InternetOpenA

  InternetCrackUrlA

  comctl32

  ord17

  kernel32

  GlobalFree

  GlobalAlloc

  WideCharToMultiByte

  LoadLibraryA

  lstrlenA

  lstrcatA

  lstrcpyA

  lstrcmpiA

  MulDiv

  LocalFree

  LocalAlloc

  GetProcAddress

  GetModuleHandleA

  GetTickCount

  TerminateThread

  CreateThread

  SleepEx

  lstrcmpA

  lstrcpynA

  CreateFileA

  DeleteFileA

  GetFileSize

  ReadFile

  SetFilePointer

  WriteFile

  CloseHandle

  GetLastError

  WaitForSingleObject

  user32

  SendDlgItemMessageA

  SetTimer

  KillTimer

  EnableWindow

  UpdateWindow

  RedrawWindow

  SetWindowTextA

  GetWindowTextA

  GetClientRect

  GetWindowRect

  MessageBoxA

  GetWindowLongA

  SetWindowLongA

  GetParent

  FindWindowExA

  LoadIconA

  IsDialogMessageA

  SystemParametersInfoA

  SetDlgItemTextA

  wsprintfA

  GetMessageA

  TranslateMessage

  DispatchMessageA

  SendMessageA

  PostMessageA

  IsWindow

  DestroyWindow

  ShowWindow

  SetWindowPos

  IsWindowVisible

  CreateDialogParamA

  GetDlgItem

  Exports

  Exports

  get

  head

  post

  put

  Sections

  .text

  Size: 11KB - Virtual size: 10KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 2KB - Virtual size: 15KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $R9/Plugins/tftp.exe

  .exe windows:4 windows x86 arch:x86

  3d5bc8b157ed27e9ead41fe3a3e8d3e0

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  wininet

  FtpFindFirstFileA

  FtpGetFileA

  FtpPutFileA

  InternetCloseHandle

  InternetConnectA

  InternetFindNextFileA

  InternetOpenA

  InternetSetOptionA

  kernel32

  AddAtomA

  CloseHandle

  CreateEventA

  CreateMutexA

  CreateSemaphoreA

  DeleteCriticalSection

  DeleteFileA

  DuplicateHandle

  EnterCriticalSection

  ExitProcess

  ExpandEnvironmentStringsA

  FindAtomA

  GetAtomNameA

  GetCurrentProcess

  GetCurrentThread

  GetCurrentThreadId

  GetHandleInformation

  GetLastError

  GetModuleHandleA

  GetProcAddress

  GetProcessAffinityMask

  GetThreadContext

  GetThreadPriority

  GetTickCount

  InitializeCriticalSection

  InterlockedDecrement

  InterlockedExchangeAdd

  InterlockedIncrement

  LeaveCriticalSection

  QueryPerformanceCounter

  QueryPerformanceFrequency

  ReleaseMutex

  ReleaseSemaphore

  ResetEvent

  ResumeThread

  SetEvent

  SetLastError

  SetProcessAffinityMask

  SetThreadContext

  SetThreadPriority

  SetUnhandledExceptionFilter

  Sleep

  SuspendThread

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TryEnterCriticalSection

  VirtualProtect

  VirtualQuery

  WaitForMultipleObjects

  WaitForSingleObject

  msvcrt

  _write

  __getmainargs

  __p__environ

  __p__fmode

  __set_app_type

  _beginthread

  _beginthreadex

  _cexit

  _endthread

  _endthreadex

  _ftime

  _iob

  _onexit

  _setjmp

  _setmode

  abort

  atexit

  calloc

  exit

  fclose

  fopen

  fprintf

  fputc

  fputs

  free

  fscanf

  fwrite

  longjmp

  malloc

  memcmp

  memcpy

  memmove

  memset

  printf

  rand

  realloc

  signal

  sprintf

  srand

  strcmp

  strcpy

  strlen

  strstr

  time

  vfprintf

  Sections

  .text

  Size: 76KB - Virtual size: 75KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 9KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .eh_fram

  Size: 1024B - Virtual size: 928B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 18KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 28B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 32B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• $R9/Stubs/bzip2

  .exe windows:4 windows x86 arch:x86

  7fa974366048f9c551ef45714595665e

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  CompareFileTime

  SearchPathA

  GetShortPathNameA

  GetFullPathNameA

  MoveFileA

  SetCurrentDirectoryA

  GetFileAttributesA

  GetLastError

  CreateDirectoryA

  SetFileAttributesA

  Sleep

  GetTickCount

  GetFileSize

  GetModuleFileNameA

  GetCurrentProcess

  CopyFileA

  ExitProcess

  GetWindowsDirectoryA

  SetFileTime

  GetCommandLineA

  SetErrorMode

  LoadLibraryA

  lstrcpynA

  GetDiskFreeSpaceA

  GlobalUnlock

  GlobalLock

  CreateThread

  CreateProcessA

  RemoveDirectoryA

  CreateFileA

  GetTempFileNameA

  lstrlenA

  lstrcatA

  GetSystemDirectoryA

  GetVersion

  CloseHandle

  lstrcmpiA

  lstrcmpA

  ExpandEnvironmentStringsA

  GlobalFree

  GlobalAlloc

  WaitForSingleObject

  GetExitCodeProcess

  GetModuleHandleA

  LoadLibraryExA

  GetProcAddress

  FreeLibrary

  MultiByteToWideChar

  WritePrivateProfileStringA

  GetPrivateProfileStringA

  WriteFile

  ReadFile

  MulDiv

  SetFilePointer

  FindClose

  FindNextFileA

  FindFirstFileA

  DeleteFileA

  GetTempPathA

  user32

  EndDialog

  ScreenToClient

  GetWindowRect

  EnableMenuItem

  GetSystemMenu

  SetClassLongA

  IsWindowEnabled

  SetWindowPos

  GetSysColor

  GetWindowLongA

  SetCursor

  LoadCursorA

  CheckDlgButton

  GetMessagePos

  LoadBitmapA

  CallWindowProcA

  IsWindowVisible

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  RegisterClassA

  TrackPopupMenu

  AppendMenuA

  CreatePopupMenu

  GetSystemMetrics

  SetDlgItemTextA

  GetDlgItemTextA

  MessageBoxIndirectA

  CharPrevA

  DispatchMessageA

  PeekMessageA

  DestroyWindow

  CreateDialogParamA

  SetTimer

  SetWindowTextA

  PostQuitMessage

  SetForegroundWindow

  wsprintfA

  SendMessageTimeoutA

  FindWindowExA

  SystemParametersInfoA

  CreateWindowExA

  GetClassInfoA

  DialogBoxParamA

  CharNextA

  OpenClipboard

  ExitWindowsEx

  IsWindow

  GetDlgItem

  SetWindowLongA

  LoadImageA

  GetDC

  EnableWindow

  InvalidateRect

  SendMessageA

  DefWindowProcA

  BeginPaint

  GetClientRect

  FillRect

  DrawTextA

  EndPaint

  ShowWindow

  gdi32

  SetBkColor

  GetDeviceCaps

  DeleteObject

  CreateBrushIndirect

  CreateFontIndirectA

  SetBkMode

  SetTextColor

  SelectObject

  shell32

  SHGetPathFromIDListA

  SHBrowseForFolderA

  SHGetFileInfoA

  ShellExecuteA

  SHFileOperationA

  SHGetSpecialFolderLocation

  advapi32

  RegQueryValueExA

  RegSetValueExA

  RegEnumKeyA

  RegEnumValueA

  RegOpenKeyExA

  RegDeleteKeyA

  RegDeleteValueA

  RegCloseKey

  RegCreateKeyExA

  comctl32

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ImageList_Create

  ole32

  CoTaskMemFree

  OleInitialize

  OleUninitialize

  CoCreateInstance

  version

  GetFileVersionInfoSizeA

  GetFileVersionInfoA

  VerQueryValueA

  Sections

  .text

  Size: 23KB - Virtual size: 22KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1024B - Virtual size: 3.7MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 8KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• $R9/Stubs/bzip2_solid

  .exe windows:4 windows x86 arch:x86

  099c0646ea7282d232219f8807883be0

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  CompareFileTime

  SearchPathA

  GetShortPathNameA

  GetFullPathNameA

  MoveFileA

  SetCurrentDirectoryA

  GetFileAttributesA

  GetLastError

  CreateDirectoryA

  SetFileAttributesA

  Sleep

  GetTickCount

  CreateFileA

  GetFileSize

  GetModuleFileNameA

  GetCurrentProcess

  CopyFileA

  ExitProcess

  SetFileTime

  GetTempPathA

  GetCommandLineA

  SetErrorMode

  LoadLibraryA

  lstrcpynA

  GetDiskFreeSpaceA

  GlobalUnlock

  GlobalLock

  CreateThread

  CreateProcessA

  RemoveDirectoryA

  GetTempFileNameA

  lstrlenA

  lstrcatA

  GetSystemDirectoryA

  GetVersion

  CloseHandle

  lstrcmpiA

  lstrcmpA

  ExpandEnvironmentStringsA

  GlobalFree

  GlobalAlloc

  WaitForSingleObject

  GetExitCodeProcess

  GetModuleHandleA

  LoadLibraryExA

  GetProcAddress

  FreeLibrary

  MultiByteToWideChar

  WritePrivateProfileStringA

  GetPrivateProfileStringA

  WriteFile

  ReadFile

  MulDiv

  SetFilePointer

  FindClose

  FindNextFileA

  FindFirstFileA

  DeleteFileA

  GetWindowsDirectoryA

  user32

  EndDialog

  ScreenToClient

  GetWindowRect

  EnableMenuItem

  GetSystemMenu

  SetClassLongA

  IsWindowEnabled

  SetWindowPos

  GetSysColor

  GetWindowLongA

  SetCursor

  LoadCursorA

  CheckDlgButton

  GetMessagePos

  LoadBitmapA

  CallWindowProcA

  IsWindowVisible

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  RegisterClassA

  TrackPopupMenu

  AppendMenuA

  CreatePopupMenu

  GetSystemMetrics

  SetDlgItemTextA

  GetDlgItemTextA

  MessageBoxIndirectA

  CharPrevA

  DispatchMessageA

  PeekMessageA

  DestroyWindow

  CreateDialogParamA

  SetTimer

  SetWindowTextA

  PostQuitMessage

  SetForegroundWindow

  wsprintfA

  SendMessageTimeoutA

  FindWindowExA

  SystemParametersInfoA

  CreateWindowExA

  GetClassInfoA

  DialogBoxParamA

  CharNextA

  OpenClipboard

  ExitWindowsEx

  IsWindow

  GetDlgItem

  SetWindowLongA

  LoadImageA

  GetDC

  EnableWindow

  InvalidateRect

  SendMessageA

  DefWindowProcA

  BeginPaint

  GetClientRect

  FillRect

  DrawTextA

  EndPaint

  ShowWindow

  gdi32

  SetBkColor

  GetDeviceCaps

  DeleteObject

  CreateBrushIndirect

  CreateFontIndirectA

  SetBkMode

  SetTextColor

  SelectObject

  shell32

  SHGetPathFromIDListA

  SHBrowseForFolderA

  SHGetFileInfoA

  ShellExecuteA

  SHFileOperationA

  SHGetSpecialFolderLocation

  advapi32

  RegQueryValueExA

  RegSetValueExA

  RegEnumKeyA

  RegEnumValueA

  RegOpenKeyExA

  RegDeleteKeyA

  RegDeleteValueA

  RegCloseKey

  RegCreateKeyExA

  comctl32

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ImageList_Create

  ole32

  CoTaskMemFree

  OleInitialize

  OleUninitialize

  CoCreateInstance

  version

  GetFileVersionInfoSizeA

  GetFileVersionInfoA

  VerQueryValueA

  Sections

  .text

  Size: 23KB - Virtual size: 22KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1024B - Virtual size: 3.7MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 8KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• $R9/Stubs/folder.ico
• $R9/Stubs/icon.ico
• $R9/Stubs/lzma

  .exe windows:4 windows x86 arch:x86

  7fa974366048f9c551ef45714595665e

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  CompareFileTime

  SearchPathA

  GetShortPathNameA

  GetFullPathNameA

  MoveFileA

  SetCurrentDirectoryA

  GetFileAttributesA

  GetLastError

  CreateDirectoryA

  SetFileAttributesA

  Sleep

  GetTickCount

  GetFileSize

  GetModuleFileNameA

  GetCurrentProcess

  CopyFileA

  ExitProcess

  GetWindowsDirectoryA

  SetFileTime

  GetCommandLineA

  SetErrorMode

  LoadLibraryA

  lstrcpynA

  GetDiskFreeSpaceA

  GlobalUnlock

  GlobalLock

  CreateThread

  CreateProcessA

  RemoveDirectoryA

  CreateFileA

  GetTempFileNameA

  lstrlenA

  lstrcatA

  GetSystemDirectoryA

  GetVersion

  CloseHandle

  lstrcmpiA

  lstrcmpA

  ExpandEnvironmentStringsA

  GlobalFree

  GlobalAlloc

  WaitForSingleObject

  GetExitCodeProcess

  GetModuleHandleA

  LoadLibraryExA

  GetProcAddress

  FreeLibrary

  MultiByteToWideChar

  WritePrivateProfileStringA

  GetPrivateProfileStringA

  WriteFile

  ReadFile

  MulDiv

  SetFilePointer

  FindClose

  FindNextFileA

  FindFirstFileA

  DeleteFileA

  GetTempPathA

  user32

  EndDialog

  ScreenToClient

  GetWindowRect

  EnableMenuItem

  GetSystemMenu

  SetClassLongA

  IsWindowEnabled

  SetWindowPos

  GetSysColor

  GetWindowLongA

  SetCursor

  LoadCursorA

  CheckDlgButton

  GetMessagePos

  LoadBitmapA

  CallWindowProcA

  IsWindowVisible

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  RegisterClassA

  TrackPopupMenu

  AppendMenuA

  CreatePopupMenu

  GetSystemMetrics

  SetDlgItemTextA

  GetDlgItemTextA

  MessageBoxIndirectA

  CharPrevA

  DispatchMessageA

  PeekMessageA

  DestroyWindow

  CreateDialogParamA

  SetTimer

  SetWindowTextA

  PostQuitMessage

  SetForegroundWindow

  wsprintfA

  SendMessageTimeoutA

  FindWindowExA

  SystemParametersInfoA

  CreateWindowExA

  GetClassInfoA

  DialogBoxParamA

  CharNextA

  OpenClipboard

  ExitWindowsEx

  IsWindow

  GetDlgItem

  SetWindowLongA

  LoadImageA

  GetDC

  EnableWindow

  InvalidateRect

  SendMessageA

  DefWindowProcA

  BeginPaint

  GetClientRect

  FillRect

  DrawTextA

  EndPaint

  ShowWindow

  gdi32

  SetBkColor

  GetDeviceCaps

  DeleteObject

  CreateBrushIndirect

  CreateFontIndirectA

  SetBkMode

  SetTextColor

  SelectObject

  shell32

  SHGetPathFromIDListA

  SHBrowseForFolderA

  SHGetFileInfoA

  ShellExecuteA

  SHFileOperationA

  SHGetSpecialFolderLocation

  advapi32

  RegQueryValueExA

  RegSetValueExA

  RegEnumKeyA

  RegEnumValueA

  RegOpenKeyExA

  RegDeleteKeyA

  RegDeleteValueA

  RegCloseKey

  RegCreateKeyExA

  comctl32

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ImageList_Create

  ole32

  CoTaskMemFree

  OleInitialize

  OleUninitialize

  CoCreateInstance

  version

  GetFileVersionInfoSizeA

  GetFileVersionInfoA

  VerQueryValueA

  Sections

  .text

  Size: 22KB - Virtual size: 22KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1024B - Virtual size: 247KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 8KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• $R9/Stubs/rar.ico
• $R9/Stubs/uninst
• $R9/Stubs/zlib

  .exe windows:4 windows x86 arch:x86

  7fa974366048f9c551ef45714595665e

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  CompareFileTime

  SearchPathA

  GetShortPathNameA

  GetFullPathNameA

  MoveFileA

  SetCurrentDirectoryA

  GetFileAttributesA

  GetLastError

  CreateDirectoryA

  SetFileAttributesA

  Sleep

  GetTickCount

  GetFileSize

  GetModuleFileNameA

  GetCurrentProcess

  CopyFileA

  ExitProcess

  GetWindowsDirectoryA

  SetFileTime

  GetCommandLineA

  SetErrorMode

  LoadLibraryA

  lstrcpynA

  GetDiskFreeSpaceA

  GlobalUnlock

  GlobalLock

  CreateThread

  CreateProcessA

  RemoveDirectoryA

  CreateFileA

  GetTempFileNameA

  lstrlenA

  lstrcatA

  GetSystemDirectoryA

  GetVersion

  CloseHandle

  lstrcmpiA

  lstrcmpA

  ExpandEnvironmentStringsA

  GlobalFree

  GlobalAlloc

  WaitForSingleObject

  GetExitCodeProcess

  GetModuleHandleA

  LoadLibraryExA

  GetProcAddress

  FreeLibrary

  MultiByteToWideChar

  WritePrivateProfileStringA

  GetPrivateProfileStringA

  WriteFile

  ReadFile

  MulDiv

  SetFilePointer

  FindClose

  FindNextFileA

  FindFirstFileA

  DeleteFileA

  GetTempPathA

  user32

  EndDialog

  ScreenToClient

  GetWindowRect

  EnableMenuItem

  GetSystemMenu

  SetClassLongA

  IsWindowEnabled

  SetWindowPos

  GetSysColor

  GetWindowLongA

  SetCursor

  LoadCursorA

  CheckDlgButton

  GetMessagePos

  LoadBitmapA

  CallWindowProcA

  IsWindowVisible

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  RegisterClassA

  TrackPopupMenu

  AppendMenuA

  CreatePopupMenu

  GetSystemMetrics

  SetDlgItemTextA

  GetDlgItemTextA

  MessageBoxIndirectA

  CharPrevA

  DispatchMessageA

  PeekMessageA

  DestroyWindow

  CreateDialogParamA

  SetTimer

  SetWindowTextA

  PostQuitMessage

  SetForegroundWindow

  wsprintfA

  SendMessageTimeoutA

  FindWindowExA

  SystemParametersInfoA

  CreateWindowExA

  GetClassInfoA

  DialogBoxParamA

  CharNextA

  OpenClipboard

  ExitWindowsEx

  IsWindow

  GetDlgItem

  SetWindowLongA

  LoadImageA

  GetDC

  EnableWindow

  InvalidateRect

  SendMessageA

  DefWindowProcA

  BeginPaint

  GetClientRect

  FillRect

  DrawTextA

  EndPaint

  ShowWindow

  gdi32

  SetBkColor

  GetDeviceCaps

  DeleteObject

  CreateBrushIndirect

  CreateFontIndirectA

  SetBkMode

  SetTextColor

  SelectObject

  shell32

  SHGetPathFromIDListA

  SHBrowseForFolderA

  SHGetFileInfoA

  ShellExecuteA

  SHFileOperationA

  SHGetSpecialFolderLocation

  advapi32

  RegQueryValueExA

  RegSetValueExA

  RegEnumKeyA

  RegEnumValueA

  RegOpenKeyExA

  RegDeleteKeyA

  RegDeleteValueA

  RegCloseKey

  RegCreateKeyExA

  comctl32

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ImageList_Create

  ole32

  CoTaskMemFree

  OleInitialize

  OleUninitialize

  CoCreateInstance

  version

  GetFileVersionInfoSizeA

  GetFileVersionInfoA

  VerQueryValueA

  Sections

  .text

  Size: 23KB - Virtual size: 23KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1024B - Virtual size: 291KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 8KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• $R9/makensis.exe

  .exe windows:4 windows x86 arch:x86

  40bd841bb48fa751c8ce412b2db2cb61

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  gdi32

  DeleteObject

  GetTextExtentPoint32A

  SelectObject

  CreateFontIndirectA

  CreateCompatibleDC

  GetObjectA

  DeleteDC

  user32

  wsprintfA

  CharNextExA

  SendMessageA

  CharNextA

  CharPrevA

  IsWindow

  GetDC

  MapDialogRect

  DestroyWindow

  CreateDialogIndirectParamA

  version

  GetFileVersionInfoA

  GetFileVersionInfoSizeA

  VerQueryValueA

  kernel32

  GetCurrentDirectoryA

  GetLocaleInfoW

  SetEndOfFile

  GetExitCodeProcess

  SetStdHandle

  SetEnvironmentVariableA

  GetOEMCP

  GetACP

  IsBadCodePtr

  IsBadReadPtr

  GetStringTypeW

  GetStringTypeA

  GetUserDefaultLCID

  EnumSystemLocalesA

  CreateEventA

  CloseHandle

  ResetEvent

  WaitForSingleObject

  SetEvent

  WaitForMultipleObjects

  CreateThread

  GetModuleHandleA

  FindClose

  FindNextFileA

  FindFirstFileA

  IsValidCodePage

  SetPriorityClass

  GetCurrentProcess

  OpenEventA

  GetSystemInfo

  CreateFileMappingA

  CreateFileA

  GetTempFileNameA

  GetTempPathA

  MapViewOfFile

  UnmapViewOfFile

  FlushViewOfFile

  GetTimeFormatA

  GetDateFormatA

  FileTimeToSystemTime

  FileTimeToLocalFileTime

  GetFileTime

  CreateProcessA

  GetFileAttributesA

  GetFileSize

  GetFullPathNameA

  GetModuleFileNameA

  GlobalFree

  GlobalAlloc

  SetLastError

  GetLastError

  MultiByteToWideChar

  WideCharToMultiByte

  VirtualAlloc

  VirtualFree

  GetProcAddress

  RtlUnwind

  RaiseException

  HeapFree

  DeleteFileA

  HeapAlloc

  HeapReAlloc

  ExitProcess

  TerminateProcess

  SetConsoleCtrlHandler

  GetTimeZoneInformation

  GetSystemTime

  GetLocalTime

  GetCommandLineA

  GetVersion

  LCMapStringA

  LCMapStringW

  GetCPInfo

  CompareStringA

  CompareStringW

  SetUnhandledExceptionFilter

  GetEnvironmentVariableA

  GetVersionExA

  HeapDestroy

  HeapCreate

  IsBadWritePtr

  WriteFile

  ReadFile

  SetFilePointer

  FlushFileBuffers

  SetHandleCount

  GetStdHandle

  GetFileType

  GetStartupInfoA

  LoadLibraryA

  HeapSize

  UnhandledExceptionFilter

  FreeEnvironmentStringsA

  FreeEnvironmentStringsW

  GetEnvironmentStrings

  GetEnvironmentStringsW

  IsValidLocale

  GetLocaleInfoA

  SetCurrentDirectoryA

  Sections

  .text

  Size: 383KB - Virtual size: 383KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 30KB - Virtual size: 30KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 69KB - Virtual size: 89KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• $R9/pools.txt
• information.vbe

  .vbe .jse