r77Rootkit 1[.]5[.]2[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

r77Rootkit 1.5.2.zip
Size

830KB
MD5

e35fb35b4031269ef3b37247d561a9ba
SHA1

95dd7ba15205a297bfa0312415f6f57a74f8193e
SHA256

2a3ceec046fc5edd6e1d5f5f6d6fbb591217977a0967e6b0b5ad52c0229c6aad
SHA512

9d9ab799e9cd80f44b2c3c0f4728a01abc4b5bd8b144412a8df85208bd7d8f08c7a55b220e98d425af7706fbbeb6e28d6c46b7178c57c4268830258cee70cf6b
SSDEEP

12288:9+LV15m6ZnHCfsC6ubY7UZYPAK0Wyd//rah9/kBu9qV7a6nLXy5HJXi4nvU/57Bu:MLVbNwau7nKIVehp54cpXil1ELprLIc

Score

3^/10

Malware Config

Signatures

Unsigned PE 10 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$77-Example.exe
unpack001/BytecodeApi.UI.dll
unpack001/BytecodeApi.dll
unpack001/Helper32.dll
unpack001/Helper64.dll
unpack001/Install.exe
unpack001/TestConsole.exe
unpack001/Uninstall.exe
unpack001/r77-x64.dll
unpack001/r77-x86.dll

Files

r77Rootkit 1.5.2.zip
.zip

Password: bytecode77
$77-Example.exe
.exe windows:4 windows x86 arch:x86

Password: bytecode77

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BytecodeApi.UI.dll
.dll windows:4 windows x86 arch:x86

Password: bytecode77

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

A:\Code\GitHub\bytecode-api\BytecodeApi.UI\obj\Debug\BytecodeApi.UI.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BytecodeApi.dll
.dll windows:4 windows x86 arch:x86

Password: bytecode77

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

A:\Code\GitHub\bytecode-api\BytecodeApi\obj\Debug\BytecodeApi.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 315KB - Virtual size: 315KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Examples/ControlPipe.cpp
Examples/InstallShellCode.cpp
Examples/InstallShellCode.cs
Helper32.dll
.dll windows:6 windows x86 arch:x86

Password: bytecode77

be299e73a179766c96cc5eb996d74c75

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

NtQueryInformationProcess

shlwapi

StrStrA
PathFindFileNameW
StrCmpIW
StrCmpW
StrCpyW

kernel32

K32EnumProcessModulesEx
GetExitCodeThread
VirtualAllocEx
ReadProcessMemory
VirtualFreeEx
GetCurrentProcess
K32GetModuleFileNameExW
LocalAlloc
GetModuleHandleA
GetLastError
WriteProcessMemory
GetProcAddress
IsWow64Process
LocalFree
lstrlenW
GetProcessHeap
K32EnumProcesses
HeapAlloc
CloseHandle
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
OpenProcess
HeapFree
WaitForSingleObject

advapi32

GetSidSubAuthority
OpenProcessToken
GetTokenInformation
GetSidSubAuthorityCount
RegCreateKeyExW
RegSetKeySecurity
RegOpenKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryInfoKeyW
RegEnumValueW
RegCloseKey
LookupAccountSidW

Exports

Exports

CreateConfigSystem
Detach
DetachAll
GetProcessList
Inject
InjectAll

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Helper64.dll
.dll windows:6 windows x64 arch:x64

Password: bytecode77

fa100b0171c6c7f7f4129848a32a9572

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ntdll

NtQueryInformationProcess

shlwapi

StrStrA
PathFindFileNameW
StrCmpIW
StrCmpW
StrCpyW

kernel32

K32EnumProcessModulesEx
GetExitCodeThread
VirtualAllocEx
ReadProcessMemory
VirtualFreeEx
K32GetModuleFileNameExW
LocalAlloc
GetModuleHandleA
GetLastError
WriteProcessMemory
GetProcAddress
IsWow64Process
LocalFree
lstrlenW
GetProcessHeap
K32EnumProcesses
HeapAlloc
CloseHandle
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
OpenProcess
HeapFree
WaitForSingleObject

advapi32

GetSidSubAuthority
OpenProcessToken
GetTokenInformation
GetSidSubAuthorityCount
RegCreateKeyExW
RegSetKeySecurity
RegOpenKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryInfoKeyW
RegEnumValueW
RegCloseKey
LookupAccountSidW

Exports

Exports

CreateConfigSystem
Detach
DetachAll
GetProcessList
Inject
InjectAll

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Install.exe
.exe windows:6 windows x86 arch:x86

Password: bytecode77

eb3adbfdfdb25911eaec8fef643f639b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrNCatW
StrStrIW
StrCatW
StrCpyW

kernel32

SizeofResource
GetCurrentProcess
FindResourceA
GetModuleHandleA
LockResource
GetProcAddress
IsWow64Process
ExitProcess
GetProcessHeap
HeapAlloc
lstrlenW
HeapFree
LoadResource

advapi32

RegSetValueExW
CryptAcquireContextW
CryptGenRandom
RegOpenKeyExW
CryptReleaseContext

ole32

CoInitializeSecurity
CoCreateInstance
CoUninitialize
CoInitializeEx

oleaut32

SysFreeString
VariantInit
SysAllocString

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 151KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Install.shellcode
LICENSE.txt
TestConsole.exe
.exe windows:4 windows x86 arch:x86

Password: bytecode77

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 240KB - Virtual size: 239KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Uninstall.exe
.exe windows:6 windows x86 arch:x86

Password: bytecode77

30d35e90c7fc045dc052f4030df3d03c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrCatW
PathCombineW

kernel32

SizeofResource
GetCurrentProcess
WriteFile
GetTempPathW
CreateFileW
GetModuleHandleA
Sleep
GetLastError
LockResource
DeleteFileW
LoadResource
K32EnumProcesses
GetProcAddress
GetCurrentProcessId
CreateProcessW
IsWow64Process
ExitProcess
CloseHandle
OpenProcess
K32EnumProcessModulesEx
WaitForSingleObject
TerminateProcess
GetProcessHeap
HeapAlloc
HeapFree
ReadProcessMemory
FindResourceA

advapi32

CryptReleaseContext
RegDeleteValueW
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptAcquireContextW
CryptGenRandom
RegCloseKey
RegDeleteKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
OpenProcessToken

ole32

CoInitializeSecurity
CoUninitialize
CoCreateInstance
CoInitializeEx

oleaut32

SysFreeString
VariantInit
SysAllocString

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
r77-x64.dll
.dll windows:6 windows x64 arch:x64

06296195ab1e0fc9411118f3175d7bd2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
RtlCaptureContext

shlwapi

StrCmpNW
StrToIntW
StrStrW
StrCpyW
StrCmpIW
StrCmpW
StrCatW
StrCmpNIW
PathCombineW
PathFindFileNameW

pdh

PdhGetCounterInfoW

kernel32

OpenProcess
CloseHandle
ReadFile
VirtualProtect
GetCurrentProcess
WriteFile
VirtualAlloc
GetFinalPathNameByHandleW
K32GetModuleFileNameExW
CreateFileW
ResumeThread
GetModuleHandleA
Sleep
GetLastError
VirtualProtectEx
GetThreadContext
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
SetThreadContext
TerminateThread
CreateThread
GetProcessIdOfThread
GetCurrentThread
GetFileType
GetModuleFileNameW
GetCurrentThreadId
SuspendThread
FlushInstructionCache
VirtualFree
VirtualQuery
SetLastError
LoadLibraryExW
HeapReAlloc
TerminateProcess
GetProcessHeap
HeapAlloc
lstrlenW
HeapFree
HeapSize
GetStringTypeW
GetStdHandle
SetStdHandle
LCMapStringW
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
MultiByteToWideChar
GetCommandLineW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
InterlockedFlushSList
RaiseException
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
ExitProcess
GetModuleHandleExW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumValueW

Exports

Exports

ReflectiveDllMain

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
r77-x86.dll
.dll windows:6 windows x86 arch:x86

9471b8fb12294bf90c68765c0102a8d8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

RtlUnwind

shlwapi

StrCmpIW
StrCmpW
StrCpyW
StrCmpNIW
StrCatW
PathCombineW
PathFindFileNameW
StrCmpNW
StrStrW
StrToIntW

pdh

PdhGetCounterInfoW

kernel32

OpenProcess
CloseHandle
ReadFile
VirtualProtect
GetCurrentProcess
WriteFile
VirtualAlloc
GetFinalPathNameByHandleW
K32GetModuleFileNameExW
CreateFileW
ResumeThread
GetModuleHandleA
Sleep
GetLastError
GetThreadContext
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
SetThreadContext
TerminateThread
CreateThread
GetProcessIdOfThread
GetCurrentThread
GetFileType
GetModuleFileNameW
GetCurrentThreadId
SuspendThread
FlushInstructionCache
VirtualFree
VirtualQuery
SetLastError
LoadLibraryExW
TerminateProcess
DecodePointer
GetProcessHeap
HeapAlloc
lstrlenW
HeapFree
GetStdHandle
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
VirtualProtectEx
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
MultiByteToWideChar
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
InterlockedFlushSList
RaiseException
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
ExitProcess
GetModuleHandleExW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumValueW

Exports

Exports

_ReflectiveDllMain@4

Sections

.text
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: bytecode77

Password: bytecode77

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 28KB - Virtual size: 27KB

.rsrc Size: 18KB - Virtual size: 18KB

.reloc Size: 512B - Virtual size: 12B

Password: bytecode77

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 74KB - Virtual size: 74KB

.rsrc Size: 1024B - Virtual size: 880B

.reloc Size: 512B - Virtual size: 12B

Password: bytecode77

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 315KB - Virtual size: 315KB

.rsrc Size: 1024B - Virtual size: 848B

.reloc Size: 512B - Virtual size: 12B

Password: bytecode77

be299e73a179766c96cc5eb996d74c75

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

shlwapi

kernel32

advapi32

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 296B

Password: bytecode77

fa100b0171c6c7f7f4129848a32a9572

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

shlwapi

kernel32

advapi32

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 3KB - Virtual size: 2KB

.pdata Size: 512B - Virtual size: 252B

Password: bytecode77

eb3adbfdfdb25911eaec8fef643f639b

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

.text
Size: 28KB - Virtual size: 27KB

.rsrc
Size: 18KB - Virtual size: 18KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 74KB - Virtual size: 74KB

.rsrc
Size: 1024B - Virtual size: 880B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 315KB - Virtual size: 315KB

.rsrc
Size: 1024B - Virtual size: 848B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 296B

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 3KB - Virtual size: 2KB

.pdata
Size: 512B - Virtual size: 252B

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 151KB - Virtual size: 150KB

.reloc
Size: 512B - Virtual size: 224B

.text
Size: 240KB - Virtual size: 239KB

.rsrc
Size: 21KB - Virtual size: 21KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 512B - Virtual size: 180B

.text
Size: 81KB - Virtual size: 81KB

.rdata
Size: 41KB - Virtual size: 41KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 5KB - Virtual size: 5KB

.detourc
Size: 8KB - Virtual size: 8KB

.detourd
Size: 512B - Virtual size: 24B

_RDATA
Size: 512B - Virtual size: 348B

.reloc
Size: 3KB - Virtual size: 2KB