sunshine-windows-portable[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

sunshine-windows-portable.zip
Size

14.2MB
MD5

c707641b04bc9ff66dc41a157560bbc9
SHA1

7a5e450349c76c45af3b1aa4660c28f8d7a47367
SHA256

3f77c6fe935ac51e59c66615f4926ce8cf4601840c74c605f3da4b02a1855eed
SHA512

dc01929b523c4e345e33cddbd16c31882ae3900df98e96ee7a17ba14b52d449cb35b4b1a6da646d019bd9a999212d0e5fbbd78d3cf3bd4c2189b46820c86cea1
SSDEEP

393216:rT0rWRy0ifDKX2Wvj8Wst8UCFsmgibYRq8sUESZ/ILtk:f090iA2sGtdCFsPicBC0l

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
static1/unpack001/Sunshine/sunshine.exe	embeds_openssl

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Sunshine/sunshine.exe
unpack001/Sunshine/tools/audio-info.exe
unpack001/Sunshine/tools/ddprobe.exe
unpack001/Sunshine/tools/dxgi-info.exe
unpack001/Sunshine/tools/sunshinesvc.exe
unpack001/Sunshine/zlib1.dll

Files

sunshine-windows-portable.zip
.zip
Sunshine/assets/apps.json
Sunshine/assets/box.png
.png
Sunshine/assets/desktop-alt.png
.png
Sunshine/assets/desktop.png
.png
Sunshine/assets/shaders/directx/convert_yuv420_packed_uv_type0_ps.hlsl
Sunshine/assets/shaders/directx/convert_yuv420_packed_uv_type0_ps_linear.hlsl
Sunshine/assets/shaders/directx/convert_yuv420_packed_uv_type0_ps_perceptual_quantizer.hlsl
Sunshine/assets/shaders/directx/convert_yuv420_packed_uv_type0_vs.hlsl
Sunshine/assets/shaders/directx/convert_yuv420_packed_uv_type0s_ps.hlsl
Sunshine/assets/shaders/directx/convert_yuv420_packed_uv_type0s_ps_linear.hlsl
Sunshine/assets/shaders/directx/convert_yuv420_packed_uv_type0s_ps_perceptual_quantizer.hlsl
Sunshine/assets/shaders/directx/convert_yuv420_packed_uv_type0s_vs.hlsl
Sunshine/assets/shaders/directx/convert_yuv420_planar_y_ps.hlsl
Sunshine/assets/shaders/directx/convert_yuv420_planar_y_ps_linear.hlsl
Sunshine/assets/shaders/directx/convert_yuv420_planar_y_ps_perceptual_quantizer.hlsl
Sunshine/assets/shaders/directx/convert_yuv420_planar_y_vs.hlsl
Sunshine/assets/shaders/directx/convert_yuv444_packed_ayuv_ps.hlsl
Sunshine/assets/shaders/directx/convert_yuv444_packed_ayuv_ps_linear.hlsl
Sunshine/assets/shaders/directx/convert_yuv444_packed_vs.hlsl
Sunshine/assets/shaders/directx/convert_yuv444_packed_y410_ps.hlsl
Sunshine/assets/shaders/directx/convert_yuv444_packed_y410_ps_linear.hlsl
Sunshine/assets/shaders/directx/convert_yuv444_packed_y410_ps_perceptual_quantizer.hlsl
Sunshine/assets/shaders/directx/convert_yuv444_planar_ps.hlsl
Sunshine/assets/shaders/directx/convert_yuv444_planar_ps_linear.hlsl
Sunshine/assets/shaders/directx/convert_yuv444_planar_ps_perceptual_quantizer.hlsl
Sunshine/assets/shaders/directx/convert_yuv444_planar_vs.hlsl
Sunshine/assets/shaders/directx/cursor_ps.hlsl
Sunshine/assets/shaders/directx/cursor_ps_normalize_white.hlsl
Sunshine/assets/shaders/directx/cursor_vs.hlsl
Sunshine/assets/shaders/directx/include/base_vs.hlsl
Sunshine/assets/shaders/directx/include/base_vs_types.hlsl
Sunshine/assets/shaders/directx/include/common.hlsl
Sunshine/assets/shaders/directx/include/convert_base.hlsl
Sunshine/assets/shaders/directx/include/convert_linear_base.hlsl
Sunshine/assets/shaders/directx/include/convert_perceptual_quantizer_base.hlsl
Sunshine/assets/shaders/directx/include/convert_yuv420_packed_uv_ps_base.hlsl
Sunshine/assets/shaders/directx/include/convert_yuv420_planar_y_ps_base.hlsl
Sunshine/assets/shaders/directx/include/convert_yuv444_ps_base.hlsl
Sunshine/assets/steam.png
.png
Sunshine/assets/web/apps.html
.html
Sunshine/assets/web/assets/Navbar-13079613.css
Sunshine/assets/web/assets/Navbar-91ee900d.js
.js
Sunshine/assets/web/assets/ResourceCard-5a89ce48.js
Sunshine/assets/web/assets/_plugin-vue_export-helper-8f5add99.css
Sunshine/assets/web/assets/_plugin-vue_export-helper-d86c1f6c.js
.js
Sunshine/assets/web/assets/apps-a776e387.js
.js
Sunshine/assets/web/assets/config-3167b2ff.css
Sunshine/assets/web/assets/config-ea50b428.js
.js
Sunshine/assets/web/assets/css/sunshine.css
Sunshine/assets/web/assets/fa-brands-400-bc844b5b.ttf
Sunshine/assets/web/assets/fa-brands-400-c411f119.woff2
Sunshine/assets/web/assets/fa-regular-400-64f9fb62.ttf
Sunshine/assets/web/assets/fa-regular-400-c732f106.woff2
Sunshine/assets/web/assets/fa-solid-900-1f0189e0.woff2
Sunshine/assets/web/assets/fa-solid-900-31f099c1.ttf
Sunshine/assets/web/assets/fa-v4compatibility-2aca24b3.woff2
Sunshine/assets/web/assets/fa-v4compatibility-a6274a12.ttf
Sunshine/assets/web/assets/index-cc7ed4a1.js
.js
Sunshine/assets/web/assets/locale/de.json
Sunshine/assets/web/assets/locale/en.json
Sunshine/assets/web/assets/locale/en_GB.json
Sunshine/assets/web/assets/locale/en_US.json
Sunshine/assets/web/assets/locale/es.json
Sunshine/assets/web/assets/locale/fr.json
Sunshine/assets/web/assets/locale/it.json
Sunshine/assets/web/assets/locale/ja.json
Sunshine/assets/web/assets/locale/pt.json
Sunshine/assets/web/assets/locale/ru.json
Sunshine/assets/web/assets/locale/sv.json
Sunshine/assets/web/assets/locale/tr.json
Sunshine/assets/web/assets/locale/zh.json
Sunshine/assets/web/assets/password-13eebdce.js
.js
Sunshine/assets/web/assets/pin-a8c4c8fc.js
.js
Sunshine/assets/web/assets/troubleshooting-a6aa304c.js
.js
Sunshine/assets/web/assets/welcome-8126eb23.js
.js
Sunshine/assets/web/config.html
.html
Sunshine/assets/web/images/logo-sunshine-16.png
.png
Sunshine/assets/web/images/logo-sunshine-45.png
.png
Sunshine/assets/web/images/sunshine-locked-16.png
.png
Sunshine/assets/web/images/sunshine-locked-45.png
.png
Sunshine/assets/web/images/sunshine-locked.ico
Sunshine/assets/web/images/sunshine-locked.png
.png
Sunshine/assets/web/images/sunshine-locked.svg
.xml
Sunshine/assets/web/images/sunshine-pausing-16.png
.png
Sunshine/assets/web/images/sunshine-pausing-45.png
.png
Sunshine/assets/web/images/sunshine-pausing.ico
Sunshine/assets/web/images/sunshine-pausing.png
.png
Sunshine/assets/web/images/sunshine-pausing.svg
.xml
Sunshine/assets/web/images/sunshine-playing-16.png
.png
Sunshine/assets/web/images/sunshine-playing-45.png
.png
Sunshine/assets/web/images/sunshine-playing.ico
Sunshine/assets/web/images/sunshine-playing.png
.png
Sunshine/assets/web/images/sunshine-playing.svg
.xml
Sunshine/assets/web/images/sunshine.ico
Sunshine/assets/web/index.html
.html
Sunshine/assets/web/password.html
.html
Sunshine/assets/web/pin.html
.html
Sunshine/assets/web/troubleshooting.html
.html
Sunshine/assets/web/welcome.html
.html
Sunshine/scripts/add-firewall-rule.bat
.bat .vbs
Sunshine/scripts/autostart-service.bat
Sunshine/scripts/delete-firewall-rule.bat
Sunshine/scripts/install-gamepad.bat
.bat .vbs
Sunshine/scripts/install-service.bat
.bat .vbs
Sunshine/scripts/migrate-config.bat
Sunshine/scripts/uninstall-gamepad.bat
Sunshine/scripts/uninstall-service.bat
Sunshine/sunshine.exe
.exe windows:4 windows x64 arch:x64

27ecaa49167957f3e6bc58f802a9a800

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

AdjustTokenPrivileges
AllocateAndInitializeSid
CheckTokenMembership
CloseServiceHandle
CreateProcessAsUserW
CreateWellKnownSid
CryptAcquireContextA
CryptAcquireContextW
CryptCreateHash
CryptDestroyHash
CryptDestroyKey
CryptEncrypt
CryptGenRandom
CryptGetHashParam
CryptHashData
CryptImportKey
CryptReleaseContext
DeregisterEventSource
FreeSid
GetSecurityInfo
GetTokenInformation
ImpersonateLoggedOnUser
LookupPrivilegeValueA
OpenProcessToken
OpenSCManagerA
OpenServiceA
QueryServiceStatus
RegCloseKey
RegEnumKeyExW
RegEnumValueW
RegGetValueW
RegOpenCurrentUser
RegOpenKeyExW
RegOpenUserClassesRoot
RegOverridePredefKey
RegQueryInfoKeyW
RegQueryValueExW
RegSetKeyValueW
RegisterEventSourceW
ReportEventW
RevertToSelf
SetEntriesInAclA
SetSecurityInfo
StartServiceA

avrt

AvRevertMmThreadCharacteristics
AvSetMmThreadCharacteristicsA

bcrypt

BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptDecrypt
BCryptDeriveKey
BCryptDestroyHash
BCryptDestroyKey
BCryptDestroySecret
BCryptEncrypt
BCryptExportKey
BCryptFinalizeKeyPair
BCryptFinishHash
BCryptGenRandom
BCryptGenerateKeyPair
BCryptGetProperty
BCryptHashData
BCryptImportKey
BCryptImportKeyPair
BCryptOpenAlgorithmProvider
BCryptSecretAgreement
BCryptSetProperty
BCryptSignHash
BCryptVerifySignature

crypt32

CertAddCertificateContextToStore
CertCloseStore
CertCreateCertificateChainEngine
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFindExtension
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertGetCertificateChain
CertGetNameStringA
CertOpenStore
CertOpenSystemStoreW
CryptDecodeObjectEx
CryptQueryObject
CryptStringToBinaryA
PFXImportCertStore

d3d11

CreateDirect3D11DeviceFromDXGIDevice
D3D11CreateDevice

d3dcompiler_47

D3DCompileFromFile

dwmapi

DwmEnableMMCSS

dxgi

CreateDXGIFactory1

iphlpapi

GetAdaptersAddresses
GetBestInterface
GetTcpTable

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
AreFileApisANSI
CancelIoEx
CloseHandle
ConvertFiberToThread
ConvertThreadToFiberEx
CopyFileExW
CreateDirectoryExW
CreateDirectoryW
CreateEventA
CreateEventW
CreateFiberEx
CreateFileA
CreateFileW
CreateHardLinkW
CreateIoCompletionPort
CreateJobObjectW
CreateMutexA
CreateProcessA
CreateProcessW
CreateSemaphoreA
CreateSemaphoreW
CreateThread
CreateWaitableTimerA
CreateWaitableTimerExA
DebugBreak
DeleteCriticalSection
DeleteFiber
DeleteFileW
DeleteProcThreadAttributeList
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindVolumeClose
FlushFileBuffers
FormatMessageA
FormatMessageW
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetActiveProcessorGroupCount
GetCommandLineW
GetConsoleMode
GetConsoleScreenBufferInfo
GetConsoleWindow
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesA
GetFileAttributesW
GetFileInformationByHandle
GetFileSizeEx
GetFileTime
GetFileType
GetFullPathNameW
GetHandleInformation
GetLastError
GetLogicalProcessorInformation
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetNumaHighestNodeNumber
GetNumaNodeProcessorMaskEx
GetOverlappedResult
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetProcessTimes
GetQueuedCompletionStatus
GetStdHandle
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetTempPathW
GetThreadContext
GetThreadGroupAffinity
GetThreadPriority
GetThreadTimes
GetTickCount
GetTimeZoneInformation
GetVersion
GetVolumeInformationW
GetWindowsDirectoryW
HeapAlloc
HeapFree
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeProcThreadAttributeList
InitializeSRWLock
InterlockedPushEntrySList
IsDebuggerPresent
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
MoveFileExA
MoveFileExW
MultiByteToWideChar
OpenEventA
OpenProcess
OutputDebugStringA
PeekNamedPipe
PostQueuedCompletionStatus
QueryInformationJobObject
QueryPerformanceCounter
QueryPerformanceFrequency
QueueUserAPC
RaiseException
ReadConsoleA
ReadConsoleW
ReadFile
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
RemoveDirectoryW
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
SetConsoleCtrlHandler
SetConsoleMode
SetConsoleTextAttribute
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableA
SetEnvironmentVariableW
SetEvent
SetFileAttributesW
SetFileInformationByHandle
SetFilePointer
SetFilePointerEx
SetFileTime
SetHandleInformation
SetLastError
SetPriorityClass
SetProcessAffinityMask
SetProcessShutdownParameters
SetSystemTime
SetThreadAffinityMask
SetThreadContext
SetThreadErrorMode
SetThreadExecutionState
SetThreadGroupAffinity
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
SleepEx
SuspendThread
SwitchToFiber
SwitchToThread
SystemTimeToFileTime
TerminateJobObject
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UpdateProcThreadAttribute
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualLock
VirtualProtect
VirtualQuery
WTSGetActiveConsoleSessionId
WaitForMultipleObjects
WaitForMultipleObjectsEx
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
WriteFile
__C_specific_handler

api-ms-win-crt-convert-l1-1-0

atoi
btowc
mbrtowc
strtod
strtol
strtoll
strtoul
strtoull
wcrtomb
wcstombs
wcstombs_s
wcstoul
wctob

api-ms-win-crt-environment-l1-1-0

__p__environ
_putenv_s
_wgetcwd
getenv

api-ms-win-crt-filesystem-l1-1-0

_findclose
_findfirst64
_findnext64
_fstat64
_fullpath
_lock_file
_stat64
_wfindnext64
_unlock_file
_unlink
_wchdir
_wchmod
_wfindfirst64
_wfullpath
_wmkdir
_wrename
_wstat64
_wunlink

api-ms-win-crt-heap-l1-1-0

_aligned_free
_aligned_malloc
_aligned_realloc
_set_new_mode
calloc
free
malloc
realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func
localeconv
setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr
_fdopen
acos
asin
atan
atan2
ceil
cos
cosh
exp
exp2
exp2f
fabs
floor
floorf
fminf
frexp
hypot
log
log10
log1p
log2
log2f
lround
lroundf
pow
powf
round
sin
sinh
sqrt
sqrtf
tan
tanh

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmpex
longjmp
memchr
memcmp
memcpy
memmove
strchr
strrchr
strstr
wcsrchr
wcsstr

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
__sys_errlist
__sys_nerr
_assert
_beginthreadex
_cexit
_configure_narrow_argv
_crt_atexit
_endthreadex
_errno
_exit
_get_errno
_initialize_narrow_environment
_initterm
_set_app_type
_set_errno
_set_invalid_parameter_handler
abort
exit
perror
raise
signal
strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vfwprintf
__stdio_common_vsprintf
__stdio_common_vsscanf
__stdio_common_vswprintf
__stdio_common_vswprintf_s
_close
_close
_fileno
_fileno
_fseeki64
_ftelli64
_get_osfhandle
_isatty
_lseeki64
_open
_read
_setmode
_sopen
_telli64
_wfopen
_wfsopen
_wopen
_write
_wsopen
fclose
feof
ferror
fflush
fgets
fopen
fopen_s
fputc
fputs
fread
fseek
ftell
fwrite
getc
getwc
putc
puts
putwc
rewind
setvbuf
ungetc
ungetwc

api-ms-win-crt-string-l1-1-0

_memicmp
_strdup
_strdup
_stricmp
_strnicmp
isalnum
isspace
isupper
iswctype
iswspace
isxdigit
mbrlen
memcpy_s
memset
strcat
strcmp
strcoll
strcpy
strcspn
strlen
strncmp
strncpy
strncpy_s
strnlen
strpbrk
strspn
strtok
strtok_s
strxfrm
tolower
towlower
towupper
wcscat
wcscmp
wcscoll
wcscpy
wcscpy_s
wcslen
wcsncpy
wcsnlen
wcsxfrm
wctype

api-ms-win-crt-time-l1-1-0

__daylight
__timezone
__tzname
_difftime64
_ftime64
_ftime64_s
_gmtime64
_gmtime64_s
_localtime64
_localtime64_s
_mktime64
_time64
_tzset
_wutime64
clock
strftime
wcsftime

api-ms-win-crt-utility-l1-1-0

bsearch
qsort
rand
rand_s

ntdll

NtQueryTimerResolution
NtSetTimerResolution
RtlVirtualUnwind
VerSetConditionMask

ole32

CoCreateFreeThreadedMarshaler
CoCreateInstance
CoInitializeEx
CoTaskMemFree
CoUninitialize
GetErrorInfo
PropVariantClear
SetErrorInfo

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW

shell32

ExtractIconExA
SHGetFileInfoW
SHQueryUserNotificationState
ShellExecuteExW
Shell_NotifyIconA

shlwapi

AssocQueryStringW
PathFindExtensionW
PathFindOnPathW
PathIsURLW
UrlGetPartW

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
InitializeConditionVariable
Sleep
SleepConditionVariableCS
SleepConditionVariableSRW
WaitOnAddress
WakeAllConditionVariable
WakeByAddressSingle
WakeConditionVariable

user32

CloseDesktop
CreatePopupMenu
CreateWindowExA
DefWindowProcA
DestroyIcon
DestroyMenu
DestroyWindow
DispatchMessageA
EnumWindows
FindWindowA
GetCursorPos
GetMenuItemInfoA
GetMessageA
GetProcessWindowStation
GetShellWindow
GetSystemMetrics
GetUserObjectInformationW
GetWindowThreadProcessId
InsertMenuA
InsertMenuItemA
LoadImageA
MapVirtualKeyA
MessageBoxW
OpenInputDesktop
PeekMessageA
PostMessageA
PostQuitMessage
RegisterClassA
RegisterClassExA
RegisterWindowMessageA
SendInput
SendMessageA
SendNotifyMessageW
SetForegroundWindow
SetThreadDesktop
ShowWindow
SystemParametersInfoW
TrackPopupMenu
TranslateMessage
UnregisterClassA
UpdateWindow

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

api-ms-win-core-com-l1-1-0

StringFromGUID2

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-kernel32-legacy-l1-1-0

CreateFileMappingA

api-ms-win-core-memory-l1-1-0

MapViewOfFile
UnmapViewOfFile

api-ms-win-core-namedpipe-ansi-l1-1-0

WaitNamedPipeA

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-mm-time-l1-1-0

timeBeginPeriod
timeEndPeriod

oleaut32

SysFreeString
SysStringLen

wldap32

ber_free
ldap_bind_s
ldap_err2string
ldap_first_attribute
ldap_first_entry
ldap_get_dn
ldap_get_values_len
ldap_init
ldap_memfree
ldap_msgfree
ldap_next_attribute
ldap_next_entry
ldap_search_s
ldap_set_option
ldap_simple_bind_s
ldap_sslinit
ldap_unbind_s
ldap_value_free_len

ws2_32

WSAAddressToStringA
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAIoctl
WSARecv
WSARecvFrom
WSAResetEvent
WSASend
WSASendMsg
WSASetEvent
WSASocketW
WSAStringToAddressA
WSAStringToAddressW
WSAWaitForMultipleEvents
freeaddrinfo
getaddrinfo
gethostbyaddr
getnameinfo
getservbyname
getservbyport
inet_ntoa
inet_ntop
inet_pton

wsock32

AcceptEx
GetAcceptExSockaddrs
WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyname
gethostname
getpeername
getsockname
getsockopt
htonl
htons
inet_addr
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

wtsapi32

WTSQueryUserToken

Exports

Exports

opus_custom_decode
opus_custom_decode_float
opus_custom_decoder_create
opus_custom_decoder_ctl
opus_custom_decoder_destroy
opus_custom_decoder_get_size
opus_custom_decoder_init
opus_custom_encode
opus_custom_encode_float
opus_custom_encoder_create
opus_custom_encoder_ctl
opus_custom_encoder_destroy
opus_custom_encoder_get_size
opus_custom_encoder_init
opus_custom_mode_create
opus_custom_mode_destroy
opus_decode
opus_decode_float
opus_decoder_create
opus_decoder_ctl
opus_decoder_destroy
opus_decoder_dred_decode
opus_decoder_dred_decode_float
opus_decoder_get_nb_samples
opus_decoder_get_size
opus_decoder_init
opus_dred_alloc
opus_dred_decoder_create
opus_dred_decoder_ctl
opus_dred_decoder_destroy
opus_dred_decoder_get_size
opus_dred_decoder_init
opus_dred_free
opus_dred_get_size
opus_dred_parse
opus_dred_process
opus_encode
opus_encode_float
opus_encoder_create
opus_encoder_ctl
opus_encoder_destroy
opus_encoder_get_size
opus_encoder_init
opus_get_version_string
opus_multistream_encode
opus_multistream_encode_float
opus_multistream_encoder_create
opus_multistream_encoder_ctl
opus_multistream_encoder_destroy
opus_multistream_encoder_get_size
opus_multistream_encoder_init
opus_multistream_packet_pad
opus_multistream_packet_unpad
opus_multistream_surround_encoder_create
opus_multistream_surround_encoder_get_size
opus_multistream_surround_encoder_init
opus_packet_get_bandwidth
opus_packet_get_nb_channels
opus_packet_get_nb_frames
opus_packet_get_nb_samples
opus_packet_get_samples_per_frame
opus_packet_has_lbrr
opus_packet_pad
opus_packet_parse
opus_packet_unpad
opus_pcm_soft_clip
opus_repacketizer_cat
opus_repacketizer_create
opus_repacketizer_destroy
opus_repacketizer_get_nb_frames
opus_repacketizer_get_size
opus_repacketizer_init
opus_repacketizer_out
opus_repacketizer_out_range
opus_strerror

Sections

.text
Size: 25.0MB - Virtual size: 25.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 1024B - Virtual size: 672B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4.7MB - Virtual size: 4.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 368KB - Virtual size: 367KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 549KB - Virtual size: 549KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2.4MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Sunshine/tools/audio-info.exe
.exe windows:4 windows x64 arch:x64

2d53948dd94b755d7007cc48041fe808

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FormatMessageA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDebuggerPresent
IsProcessorFeaturePresent
LeaveCriticalSection
LocalFree
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
__C_specific_handler

api-ms-win-crt-convert-l1-1-0

btowc
mbrtowc
strtoul
wcrtomb
wctob

api-ms-win-crt-environment-l1-1-0

__p__environ
getenv

api-ms-win-crt-filesystem-l1-1-0

_fstat64

api-ms-win-crt-heap-l1-1-0

_set_new_mode
calloc
free
malloc
realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func
localeconv
setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr
_fdopen

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmpex
longjmp
memchr
memcmp
memcpy
memmove
strchr

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
_beginthreadex
_cexit
_configure_narrow_argv
_crt_atexit
_endthreadex
_errno
_exit
_initialize_narrow_environment
_initterm
_set_app_type
_set_invalid_parameter_handler
abort
exit
signal
strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vfwprintf
__stdio_common_vsprintf
_fileno
_fseeki64
_ftelli64
_get_osfhandle
_lseeki64
_read
_wfopen
_write
fclose
fflush
fopen
fputc
fputs
fread
fwrite
getc
getwc
putc
putwc
setvbuf
ungetc
ungetwc

api-ms-win-crt-string-l1-1-0

_strdup
iswctype
memset
strcmp
strcoll
strlen
strncmp
strnlen
strxfrm
tolower
towlower
towupper
wcscoll
wcslen
wcsnlen
wcsxfrm
wctype

api-ms-win-crt-time-l1-1-0

__daylight
__timezone
__tzname
_tzset
strftime
wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

ole32

CoCreateInstance
CoInitializeEx
CoTaskMemFree
CoUninitialize
PropVariantClear

Sections

.text
Size: 817KB - Virtual size: 817KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Sunshine/tools/ddprobe.exe
.exe windows:4 windows x64 arch:x64

eca040ee63f1254763a8a9b9f8feae82

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegDeleteKeyValueW
RegSetKeyValueW

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

kernel32

CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FormatMessageA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDebuggerPresent
IsProcessorFeaturePresent
LeaveCriticalSection
LocalFree
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
__C_specific_handler

api-ms-win-crt-convert-l1-1-0

atoi
btowc
mbrtowc
strtoul
wcrtomb
wctob

api-ms-win-crt-environment-l1-1-0

__p__environ
getenv

api-ms-win-crt-filesystem-l1-1-0

_fstat64

api-ms-win-crt-heap-l1-1-0

_set_new_mode
calloc
free
malloc
realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func
localeconv
setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr
_fdopen

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmpex
longjmp
memchr
memcmp
memcpy
memmove
strchr

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
_beginthreadex
_cexit
_configure_narrow_argv
_crt_atexit
_endthreadex
_errno
_exit
_initialize_narrow_environment
_initterm
_set_app_type
_set_invalid_parameter_handler
abort
exit
signal
strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vfwprintf
__stdio_common_vsprintf
__stdio_common_vswprintf_s
_fileno
_fseeki64
_ftelli64
_get_osfhandle
_lseeki64
_read
_wfopen
_write
fclose
fflush
fopen
fputc
fputs
fread
fwrite
getc
getwc
putc
putwc
setvbuf
ungetc
ungetwc

api-ms-win-crt-string-l1-1-0

_strdup
iswctype
memset
strcmp
strcoll
strlen
strncmp
strnlen
strxfrm
towlower
towupper
wcscoll
wcslen
wcsnlen
wcsxfrm
wctype

api-ms-win-crt-time-l1-1-0

__daylight
__timezone
__tzname
_tzset
strftime
wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

user32

CloseDesktop
OpenInputDesktop
SetThreadDesktop

Sections

.text
Size: 819KB - Virtual size: 819KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Sunshine/tools/dxgi-info.exe
.exe windows:4 windows x64 arch:x64

f83eaf1143b8445a964468809146f257

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

dxgi

CreateDXGIFactory1

kernel32

CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FormatMessageA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDebuggerPresent
IsProcessorFeaturePresent
LeaveCriticalSection
LocalFree
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
__C_specific_handler

api-ms-win-crt-convert-l1-1-0

btowc
mbrtowc
strtoul
wcrtomb
wctob

api-ms-win-crt-environment-l1-1-0

__p__environ
getenv

api-ms-win-crt-filesystem-l1-1-0

_fstat64

api-ms-win-crt-heap-l1-1-0

_set_new_mode
calloc
free
malloc
realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func
localeconv
setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr
_fdopen

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmpex
longjmp
memchr
memcmp
memcpy
memmove
strchr

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
_beginthreadex
_cexit
_configure_narrow_argv
_crt_atexit
_endthreadex
_errno
_exit
_initialize_narrow_environment
_initterm
_set_app_type
_set_invalid_parameter_handler
abort
exit
signal
strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vfwprintf
__stdio_common_vsprintf
_fileno
_fseeki64
_ftelli64
_get_osfhandle
_lseeki64
_read
_wfopen
_write
fclose
fflush
fopen
fputc
fputs
fread
fwrite
getc
getwc
putc
putwc
setvbuf
ungetc
ungetwc

api-ms-win-crt-string-l1-1-0

_strdup
iswctype
memset
strcmp
strcoll
strlen
strncmp
strnlen
strxfrm
towlower
towupper
wcscoll
wcslen
wcsnlen
wcsxfrm
wctype

api-ms-win-crt-time-l1-1-0

__daylight
__timezone
__tzname
_tzset
strftime
wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

user32

SetProcessDpiAwarenessContext

Sections

.text
Size: 813KB - Virtual size: 812KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Sunshine/tools/sunshinesvc.exe
.exe windows:4 windows x64 arch:x64

40e2fbfac47129b602b28f84fbbe3af8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

CreateProcessAsUserW
DuplicateTokenEx
OpenProcessToken
RegisterServiceCtrlHandlerExA
SetServiceStatus
SetTokenInformation
StartServiceCtrlDispatcherA

kernel32

AttachConsole
CloseHandle
CreateEventA
CreateFileW
CreateJobObjectW
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FormatMessageA
GenerateConsoleCtrlEvent
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetExitCodeProcess
GetHandleInformation
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetSystemTimeAsFileTime
GetTempPathW
GetThreadContext
GetThreadPriority
GetTickCount
HeapAlloc
HeapFree
InitializeCriticalSection
InitializeProcThreadAttributeList
IsDebuggerPresent
IsProcessorFeaturePresent
LeaveCriticalSection
LocalFree
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetCurrentDirectoryW
SetEvent
SetInformationJobObject
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UpdateProcThreadAttribute
VirtualProtect
VirtualQuery
WTSGetActiveConsoleSessionId
WaitForMultipleObjects
WaitForSingleObject
__C_specific_handler

api-ms-win-crt-convert-l1-1-0

atol
strtoul

api-ms-win-crt-environment-l1-1-0

__p__environ
getenv

api-ms-win-crt-heap-l1-1-0

_set_new_mode
calloc
free
malloc
realloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmpex
longjmp
memchr
memcmp
memcpy
memmove
strchr
wcsrchr

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
_beginthreadex
_cexit
_configure_narrow_argv
_crt_atexit
_endthreadex
_errno
_exit
_initialize_narrow_environment
_initterm
_set_app_type
_set_invalid_parameter_handler
abort
exit
signal
strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vfwprintf
__stdio_common_vsprintf
_read
_write
fputc
fputs
fwrite

api-ms-win-crt-string-l1-1-0

_strdup
memset
strcmp
strlen
strncmp
wcscat_s
wcslen

api-ms-win-crt-time-l1-1-0

__daylight
__timezone
__tzname
_tzset

api-ms-win-crt-utility-l1-1-0

rand_s

Sections

.text
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 672B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Sunshine/zlib1.dll
.dll windows:4 windows x64 arch:x64

149f020ab6fdb4bb3d6cbf7e79214de9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetLastError
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
Sleep
TerminateProcess
TlsGetValue
VirtualProtect
VirtualQuery

api-ms-win-crt-convert-l1-1-0

wcstombs

api-ms-win-crt-environment-l1-1-0

__p__environ
__p__wenviron

api-ms-win-crt-heap-l1-1-0

_set_new_mode
calloc
free
malloc

api-ms-win-crt-private-l1-1-0

memchr
memcpy
memmove

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
__p___wargv
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_errno
_execute_onexit_table
_exit
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_register_onexit_function
abort
strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vfwprintf
__stdio_common_vsprintf
_close
_lseeki64
_open
_read
_wopen
_write
fwrite

api-ms-win-crt-string-l1-1-0

memset
strlen
strncmp

api-ms-win-crt-time-l1-1-0

__daylight
__timezone
__tzname
_tzset

api-ms-win-crt-utility-l1-1-0

rand_s

Exports

Exports

_dist_code
_length_code
_tr_align
_tr_flush_bits
_tr_flush_block
_tr_init
_tr_stored_block
_tr_tally
adler32
adler32_combine
adler32_combine64
adler32_z
compress
compress2
compressBound
crc32
crc32_combine
crc32_combine64
crc32_combine_gen
crc32_combine_gen64
crc32_combine_op
crc32_z
deflate
deflateBound
deflateCopy
deflateEnd
deflateGetDictionary
deflateInit2_
deflateInit_
deflateParams
deflatePending
deflatePrime
deflateReset
deflateResetKeep
deflateSetDictionary
deflateSetHeader
deflateTune
deflate_copyright
get_crc_table
gz_error
gz_intmax
gzbuffer
gzclearerr
gzclose
gzclose_r
gzclose_w
gzdirect
gzdopen
gzeof
gzerror
gzflush
gzfread
gzfwrite
gzgetc
gzgetc_
gzgets
gzoffset
gzoffset64
gzopen
gzopen64
gzopen_w
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzseek64
gzsetparams
gztell
gztell64
gzungetc
gzvprintf
gzwrite
inflate
inflateBack
inflateBackEnd
inflateBackInit_
inflateCodesUsed
inflateCopy
inflateEnd
inflateGetDictionary
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateResetKeep
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
inflateValidate
inflate_copyright
inflate_fast
inflate_table
uncompress
uncompress2
zError
z_errmsg
zcalloc
zcfree
zlibCompileFlags
zlibVersion

Sections

.text
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 288B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

27ecaa49167957f3e6bc58f802a9a800

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

avrt

bcrypt

crypt32

d3d11

d3dcompiler_47

dwmapi

dxgi

iphlpapi

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

ntdll

ole32

setupapi

shell32

shlwapi

api-ms-win-core-synch-l1-2-0

user32

userenv

api-ms-win-core-com-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-namedpipe-ansi-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-mm-time-l1-1-0

oleaut32

wldap32

ws2_32

wsock32

wtsapi32

Exports

Exports

Sections

.text Size: 25.0MB - Virtual size: 25.0MB

.rodata Size: 1024B - Virtual size: 672B

.data Size: 114KB - Virtual size: 113KB

.rdata Size: 4.7MB - Virtual size: 4.7MB

.pdata Size: 368KB - Virtual size: 367KB

.xdata Size: 549KB - Virtual size: 549KB

.bss Size: - Virtual size: 2.4MB

.edata Size: 3KB - Virtual size: 2KB

.idata Size: 28KB - Virtual size: 27KB

.CRT Size: 512B - Virtual size: 112B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 120KB - Virtual size: 120KB

.reloc Size: 109KB - Virtual size: 108KB

2d53948dd94b755d7007cc48041fe808

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

.text
Size: 25.0MB - Virtual size: 25.0MB

.rodata
Size: 1024B - Virtual size: 672B

.data
Size: 114KB - Virtual size: 113KB

.rdata
Size: 4.7MB - Virtual size: 4.7MB

.pdata
Size: 368KB - Virtual size: 367KB

.xdata
Size: 549KB - Virtual size: 549KB

.bss
Size: - Virtual size: 2.4MB

.edata
Size: 3KB - Virtual size: 2KB

.idata
Size: 28KB - Virtual size: 27KB

.CRT
Size: 512B - Virtual size: 112B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 120KB - Virtual size: 120KB

.reloc
Size: 109KB - Virtual size: 108KB

.text
Size: 817KB - Virtual size: 817KB

.data
Size: 13KB - Virtual size: 12KB

.rdata
Size: 78KB - Virtual size: 78KB

.pdata
Size: 45KB - Virtual size: 45KB

.xdata
Size: 63KB - Virtual size: 63KB

.bss
Size: - Virtual size: 3KB

.idata
Size: 6KB - Virtual size: 6KB

.CRT
Size: 512B - Virtual size: 104B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 5KB

.text
Size: 819KB - Virtual size: 819KB

.data
Size: 12KB - Virtual size: 12KB

.rdata
Size: 128KB - Virtual size: 128KB

.pdata
Size: 45KB - Virtual size: 45KB

.xdata
Size: 63KB - Virtual size: 63KB

.bss
Size: - Virtual size: 3KB

.idata
Size: 7KB - Virtual size: 6KB

.CRT
Size: 512B - Virtual size: 104B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 5KB