zapret-discord-youtube-1[.]9[.]9d[.]rar

resource	yara_rule
static1/unpack001/DiscordFix.exe	upx

resource
unpack001/DiscordFix.exe
unpack001/bin/WinDivert.dll
unpack001/bin/cygwin1.dll
unpack001/bin/winws.exe

zapret-discord-youtube-1.9.9d.rar

SHA256 8ce20cb34585110ef8c0c9a12a7fa4201a72a1b4e551d42579cda1ed2f9f1be9
MD5 69dd9474f38a28e045234a912c4db6d6
SHA1 33871d0b1883f4f91900172b794f98b5a2b32eab
SHA512 b8de955bdbb9b5e32de4920f626ae8a4c768e560af87b4242995ab79873bd155d8ab4a35045048b025b815231f774b8607ec1acb417d3da341cd2b6222be22d1
SSDEEP 196608:rO1Ltv3anc+ltvrLOx0J71a0ksF/+TxlLCYACNpGJsrLqujpJ7PZQWMo3m2D38j+:rgLdqnc+/VJ71nksF+32iSSauVflM6
TLSH
T13DD6339CB65A5EAADB62BD37E35C830E61D37B04601CD45A5A48930CCA50E9F4BCC37D
MD5 SHA1 SHA512 SSDEEP TLSH

DiscordFix.exe

SHA256 0c8d889bba69756ab0b1d8daedecda4eee20f8dff4d0f69eeecae459f555435a
MD5 fdb373f598c5540138418fc9de0e3608
SHA1 94a093864479f37bb609e7d28d73cc4903dd59ef
SHA512 fe92cdfa3b4bf9a5aa4d1fa673313970c221b36aae323228afad7963be1bfc3d63fdb9162c7ef5707561506c8490a5c6e3b66b888ad5fbb00445cf49fc14a5f0
SSDEEP 98304:DtJpQJujpJXVrFcWPZQWM83h9m2D38MyKe3od:DLqujpJ7PZQWMo3m2D38jV
TLSH
T106F53356F8E16BE7C336651963AC8A09710EEB0C62ACC0D45389D34DC775E59EBCC0EA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

12928848

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

LICENSE.txt

SHA256 8ea76af265366af6ef96595705ad21cafab82f2786203ae70d29a970260434dc
MD5 c503677f0456d501cad4eb9d8c84b6c7
SHA1 3bf636db8861015870aa70a8225588b5750455ac
SHA512 591112164951bdab5f569d538f34e841fae4d16cb6907d16145656bc93c24857d4640c13012dafc705d767fc96d66267d2cdfaba6b402eaddd5fe4206e0402bd
TLSH
T10141861E624583A21FC103915A8AACCFF32F509ABF5F6454306AD00CA276455CBFBA68
MD5 SHA1 SHA512 TLSH

README.md

SHA256 86fa594a19f25e5b911be7b88ab55549ef91e7eb9bb49b79c173be05ee8f365d
MD5 1ef74f2eaf734d0b552f0a6ebb3367f0
SHA1 d84f3975ba1e526f9dadf0bda30675a07afb39a6
SHA512 2da3b0a7f7eb93c73e37352353433d146f67e88fe5ab28c28f30ee1c3986d10996702cd122bc793c4b97abbec47c99d39b549353c2bfafb5e7b17d0199ab87ad
SSDEEP 384:gbCTnWQi1uZ77ROAAXbHMMmOODv31gEOa6gUQUl9ycikPrbLCdrpo:gbWnWQiPAAXbsDOSf6EOa6Tl/DTXgrm
TLSH
T1B792DC61529E24DE1601B45BDC047E4E79EB44FF7FBA93A715B02CBE35F2034822E61A
MD5 SHA1 SHA512 SSDEEP TLSH

SHA256SUMS.txt

SHA256 ed2e8b14040a6af35ee88e94344e133c481f3941bb90a353f2f612b79b06acf0
MD5 8133e194ca7dff1da73ba60c6f50f8dc
SHA1 bb86b7325e7134963e1dbe6c6ca5d9253682daf7
SHA512 79f1c43ec236cf4c3a460072f3d8fcb116cacd53cc1c316196c50c4f9839982b93f0eccc02c7029ea1c241ee785b4a80154d668e2085cb75e81ff6e2202cec5f
TLSH
T14E81C8BBA0193C302E8EC206E7D6048A596B55A2F4D6DA8631704BCFC312DB8FD578B1
MD5 SHA1 SHA512 TLSH

bin/WinDivert.dll

IMPHASH 0b649f8e17494bb31b47f6e959a1769c
SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
MD5 b2014d33ee645112d5dc16fe9d9fcbff
SHA1 aa69498562d350f2de06954b133e59fac1e57002
SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
TLSH
T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

31496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

840B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

800B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

bin/WinDivert64.sys

IMPHASH db584dd0570594898805dd67d7ff391c
SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
MD5 89ed5be7ea83c01d0de33d3519944aa5
SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
TLSH
T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Digest

5a:de:d7:5d:6b:eb:31:58:49:f6:98:a7:8f:80:33:de:26:eb:15:19:55:a1:cb:c0:1e:30:37:32:0e:2a:0e:b6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 20, 2022

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

5a:de:d7:5d:6b:eb:31:58:49:f6:98:a7:8f:80:33:de:26:eb:15:19:55:a1:cb:c0:1e:30:37:32:0e:2a:0e:b6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91510107MA7E8Y2876,CN=成都密思听科技有限公司,O=成都密思听科技有限公司,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Sep 20, 2022

SERIALNUMBER=91510107MA7E8Y2876,CN=成都密思听科技有限公司,O=成都密思听科技有限公司,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

SERIALNUMBER=91510107MA7E8Y2876,CN=成都密思听科技有限公司,O=成都密思听科技有限公司,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

01

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 1, 2004 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 11, 2022 - Aug 10, 2033

Subject

SERIALNUMBER=91510107MA7E8Y2876,CN=成都密思听科技有限公司,O=成都密思听科技有限公司,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Serial Number

61:50:19:91:b1:8f:32:38:04:52:51:37:dc:25:00:5a

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2022 - May 25, 2023

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Oct 15, 2014 - Oct 15, 2029

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:0A56-E329-4D4D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:a7:35:bb:2e:c2:64:85:50:29:00:01:00:00:01:a7

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 2, 2022 - May 11, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

10

Entry point

4484

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\WinDivert-2.2.2\install\MSVC\amd64\WinDivert64.pdb

ntoskrnl.exe

RtlCopyUnicodeString KeBugCheckEx IoGetRequestorProcess PsGetProcessId ExUuidCreate ObfDereferenceObject ObfReferenceObject IoWriteErrorLogEntry IoGetCurrentProcess IoFreeMdl IoAllocateMdl IoAllocateErrorLogEntry MmMapLockedPagesSpecifyCache MmBuildMdlForNonPagedPool ExFreePoolWithTag ExAllocatePoolWithTag KeReleaseInStackQueuedSpinLock KeAcquireInStackQueuedSpinLock RtlGetVersion RtlIntegerToUnicodeString

hal

KeQueryPerformanceCounter

ndis.sys

NdisAllocateNetBufferPool NdisFreeNetBufferPool NdisAllocateNetBufferListPool NdisGetDataBuffer NdisAdvanceNetBufferDataStart NdisRetreatNetBufferDataStart NdisFreeNetBufferListPool

fwpkclnt.sys

FwpmTransactionAbort0 FwpmTransactionBegin0 FwpmEngineClose0 FwpmEngineOpen0 FwpsQueryPacketInjectionState0 FwpmProviderAdd0 FwpmProviderDeleteByKey0 FwpsInjectNetworkReceiveAsync0 FwpmSubLayerAdd0 FwpmSubLayerDeleteByKey0 FwpmCalloutAdd0 FwpmCalloutDeleteByKey0 FwpmFilterAdd0 FwpmFilterDeleteByKey0 FwpmTransactionCommit0 FwpsCalloutRegister0 FwpsCalloutUnregisterByKey0 FwpsFlowAssociateContext0 FwpsFlowRemoveContext0 FwpsInjectionHandleCreate0 FwpsInjectionHandleDestroy0 FwpsAllocateNetBufferAndNetBufferList0 FwpsFreeNetBufferList0 FwpsInjectNetworkSendAsync0 FwpsInjectForwardAsync0

wdfldr.sys

WdfVersionBindClass WdfVersionUnbindClass WdfVersionBind WdfVersionUnbind

Name

.text

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

420B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

bin/cygwin1.dll

IMPHASH 8f21c12c4e790805822951d4e4dcad1c
SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
MD5 a1c82ed072dc079dd7851f82d9aa7678
SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
TLSH
T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

202560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredContinueHandler AllocConsole AttachConsole CallNamedPipeA CancelIo CancelSynchronousIo ClearCommBreak ClearCommError CloseHandle CompareStringW ConnectNamedPipe CreateFileA CreateFileW CreateNamedPipeA CreatePipe CreateProcessW CreateRemoteThread CreateSymbolicLinkW CreateTapePartition CreateThread DebugBreak DeleteCriticalSection DeleteProcThreadAttributeList DeviceIoControl DisconnectNamedPipe DuplicateHandle EnterCriticalSection EraseTape EscapeCommFunction ExitProcess ExitThread ExpandEnvironmentStringsW FillConsoleOutputAttribute FillConsoleOutputCharacterW FindFirstVolumeW FindNextVolumeW FindVolumeClose FlushConsoleInputBuffer FlushFileBuffers FlushViewOfFile FreeConsole FreeEnvironmentStringsW FreeLibrary GenerateConsoleCtrlEvent GetBinaryTypeW GetCommModemStatus GetCommState GetCommandLineW GetConsoleCP GetConsoleCursorInfo GetConsoleMode GetConsoleOutputCP GetConsoleProcessList GetConsoleScreenBufferInfo GetConsoleWindow GetCurrentConsoleFontEx GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumberEx GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesA GetFileSize GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetHandleInformation GetLastError GetLocaleInfoA GetLocaleInfoW GetLogicalDriveStringsA GetLogicalDrives GetLogicalProcessorInformationEx GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetNamedPipeClientProcessId GetNumberOfConsoleInputEvents GetOverlappedResult GetPriorityClass GetProcAddress GetProcessAffinityMask GetProcessGroupAffinity GetProcessHeap GetProcessId GetProcessWorkingSetSize GetStartupInfoA GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemWindowsDirectoryW GetTapeParameters GetTapePosition GetTapeStatus GetTempPathW GetThreadContext GetThreadGroupAffinity GetThreadId GetThreadPriority GetTickCount GetTickCount64 GetTimeZoneInformation GetVolumeNameForVolumeMountPointW GetVolumePathNamesForVolumeNameW GlobalAlloc GlobalLock GlobalMemoryStatusEx GlobalSize GlobalUnlock HeapAlloc HeapCreate HeapDestroy HeapFree IdnToAscii IdnToUnicode InitializeCriticalSection InitializeProcThreadAttributeList IsBadStringPtrA IsDebuggerPresent IsProcessInJob LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree LocaleNameToLCID MapViewOfFile MapViewOfFileEx MultiByteToWideChar OpenProcess OpenThread OutputDebugStringA PeekConsoleInputA PeekConsoleInputW PeekNamedPipe PrepareTape PurgeComm QueryDosDeviceW QueryInformationJobObject QueryPerformanceCounter QueryPerformanceFrequency QueryUnbiasedInterruptTime QueueUserAPC RaiseException ReadConsoleInputA ReadConsoleInputW ReadConsoleOutputW ReadFile ReadProcessMemory ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind ScrollConsoleScreenBufferA ScrollConsoleScreenBufferW SetCommBreak SetCommMask SetCommState SetCommTimeouts SetComputerNameExW SetConsoleCP SetConsoleCtrlHandler SetConsoleCursorInfo SetConsoleCursorPosition SetConsoleMode SetConsoleOutputCP SetConsoleTextAttribute SetConsoleTitleW SetConsoleWindowInfo SetEnvironmentVariableW SetErrorMode SetEvent SetFilePointerEx SetHandleInformation SetLastError SetNamedPipeHandleState SetPriorityClass SetProcessAffinityMask SetProcessWorkingSetSize SetStdHandle SetSystemTime SetTapeParameters SetTapePosition SetThreadContext SetThreadGroupAffinity SetThreadPriority SetThreadStackGuarantee Sleep SuspendThread SwitchToThread TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TransmitCommChar UnmapViewOfFile UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualProtectEx VirtualQuery VirtualQueryEx WaitCommEvent WaitForMultipleObjects WaitForSingleObject WaitNamedPipeW WideCharToMultiByte WriteConsoleInputW WriteConsoleOutputW WriteConsoleW WriteFile WriteProcessMemory WriteTapemark

ntdll

NtAccessCheck NtAdjustPrivilegesToken NtAllocateLocallyUniqueId NtAssignProcessToJobObject NtCancelTimer NtClose NtCommitTransaction NtCreateDirectoryObject NtCreateEvent NtCreateFile NtCreateJobObject NtCreateKey NtCreateMutant NtCreateNamedPipeFile NtCreateSection NtCreateSemaphore NtCreateSymbolicLinkObject NtCreateTimer NtCreateTransaction NtDuplicateToken NtFlushBuffersFile NtFsControlFile NtLockFile NtLockVirtualMemory NtMapViewOfSection NtOpenDirectoryObject NtOpenEvent NtOpenFile NtOpenJobObject NtOpenKey NtOpenMutant NtOpenProcessToken NtOpenSection NtOpenSemaphore NtOpenSymbolicLinkObject NtOpenThreadToken NtPrivilegeCheck NtQueryAttributesFile NtQueryDirectoryFile NtQueryDirectoryObject NtQueryEaFile NtQueryEvent NtQueryInformationFile NtQueryInformationJobObject NtQueryInformationProcess NtQueryInformationThread NtQueryInformationToken NtQueryObject NtQueryQuotaInformationFile NtQuerySecurityObject NtQuerySemaphore NtQuerySymbolicLinkObject NtQuerySystemInformation NtQuerySystemTime NtQueryTimer NtQueryTimerResolution NtQueryValueKey NtQueryVirtualMemory NtQueryVolumeInformationFile NtReadFile NtRollbackTransaction NtSetEaFile NtSetEvent NtSetInformationFile NtSetInformationJobObject NtSetInformationThread NtSetInformationToken NtSetQuotaInformationFile NtSetSecurityObject NtSetTimer NtSetValueKey NtSetVolumeInformationFile NtUnlockFile NtUnlockVirtualMemory NtUnmapViewOfSection NtWaitForSingleObject NtWriteFile RtlAbsoluteToSelfRelativeSD RtlAddAccessAllowedAce RtlAddAccessAllowedAceEx RtlAddAccessDeniedAceEx RtlAllocateHeap RtlAppendUnicodeStringToString RtlAppendUnicodeToString RtlCheckRegistryKey RtlCompareUnicodeString RtlConvertSidToUnicodeString RtlCopySid RtlCopyUnicodeString RtlCreateAcl RtlCreateQueryDebugBuffer RtlCreateSecurityDescriptor RtlDestroyQueryDebugBuffer RtlDowncaseUnicodeString RtlEnterCriticalSection RtlEqualPrefixSid RtlEqualSid RtlEqualUnicodeString RtlFirstFreeAce RtlFreeHeap RtlFreeUnicodeString RtlGetAce RtlGetControlSecurityDescriptor RtlGetCurrentTransaction RtlGetDaclSecurityDescriptor RtlGetGroupSecurityDescriptor RtlGetNtVersionNumbers RtlGetOwnerSecurityDescriptor RtlGetVersion RtlIdentifierAuthoritySid RtlInitAnsiString RtlInitUnicodeString RtlInitializeSid RtlLeaveCriticalSection RtlLengthSid RtlNtStatusToDosError RtlPrefixUnicodeString RtlQueryProcessDebugInformation RtlQueryRegistryValues RtlSetControlSecurityDescriptor RtlSetCurrentDirectory_U RtlSetCurrentTransaction RtlSetDaclSecurityDescriptor RtlSetGroupSecurityDescriptor RtlSetOwnerSecurityDescriptor RtlSubAuthorityCountSid RtlSubAuthoritySid RtlUnicodeStringToAnsiString RtlUpcaseUnicodeChar RtlUpcaseUnicodeString

GetCommandLineA@0 GetCommandLineW@0 _Exit __argc __argv __assert __assert_func __assertfail __b64_ntop __b64_pton __bsd_qsort_r __check_rhosts_file __chk_fail __cpuset_alloc __cpuset_free __ctype_ptr__ __cxa_atexit __cxa_finalize __cygwin_user_data __dn_comp __dn_expand __dn_skipname __eprintf __errno __fbufsize __flbf __fpclassifyd __fpclassifyf __fpending __fpurge __freadable __freading __fsetlocking __fwritable __fwriting __getpagesize __getreent __gets_chk __gnu_basename __infinity __isinfd __isinff __isnand __isnanf __locale_ctype_ptr __locale_ctype_ptr_l __locale_mb_cur_max __main __mb_cur_max __memcpy_chk __memmove_chk __mempcpy __mempcpy_chk __memset_chk __opendir_with_d_ino __progname __rcmd_errstr __res_close __res_init __res_mkquery __res_nclose __res_ninit __res_nmkquery __res_nquery __res_nquerydomain __res_nsearch __res_nsend __res_query __res_querydomain __res_search __res_send __res_state __sched_getaffinity_sys __signbitd __signbitf __signgam __snprintf_chk __sprintf_chk __srget __srget_r __stack_chk_fail __stack_chk_fail_local __stack_chk_guard __stpcpy_chk __stpncpy_chk __strcat_chk __strcpy_chk __strncat_chk __strncpy_chk __swbuf __swbuf_r __vsnprintf_chk __vsprintf_chk __wrap__ZdaPv __wrap__ZdaPvRKSt9nothrow_t __wrap__ZdlPv __wrap__ZdlPvRKSt9nothrow_t __wrap__Znam __wrap__ZnamRKSt9nothrow_t __wrap__Znwm __wrap__ZnwmRKSt9nothrow_t __xdrrec_getrec __xdrrec_setnonblock __xpg_sigpause __xpg_strerror_r _alloca _check_for_executable _ctype_ _daylight _dll_crt0 _exit _fe_dfl_env _fe_nomask_env _feinitialise _fscanf_r _get_osfhandle _impure_ptr _longjmp _pipe _pthread_cleanup_pop _pthread_cleanup_push _setjmp _setmode _sys_errlist _sys_nerr _timezone _tzname a64l abort abs accept accept4 access acl acl_add_perm acl_calc_mask acl_check acl_clear_perms acl_cmp acl_copy_entry acl_copy_ext acl_copy_int acl_create_entry acl_delete_def_file acl_delete_entry acl_delete_perm acl_dup acl_entries acl_equiv_mode acl_error acl_extended_fd acl_extended_file acl_extended_file_nofollow acl_free acl_from_mode acl_from_text acl_get_entry acl_get_fd acl_get_file acl_get_perm acl_get_permset acl_get_qualifier acl_get_tag_type acl_init acl_set_fd acl_set_file acl_set_permset acl_set_qualifier acl_set_tag_type acl_size acl_to_any_text acl_to_text acl_valid aclcheck aclfrommode aclfrompbits aclfromtext aclsort acltomode acltopbits acltotext acos acosf acosh acoshf acoshl acosl aio_cancel aio_error aio_fsync aio_read aio_return aio_suspend aio_write alarm aligned_alloc alphasort arc4random arc4random_addrandom arc4random_buf arc4random_stir arc4random_uniform argz_add argz_add_sep argz_append argz_count argz_create argz_create_sep argz_delete argz_extract argz_insert argz_next argz_replace argz_stringify asctime asctime_r asin asinf asinh asinhf asinhl asinl asnprintf asprintf at_quick_exit atan atan2 atan2f atan2l atanf atanh atanhf atanhl atanl atexit atof atoff atoi atol atoll basename bcmp bcopy bind bindresvport bindresvport_sa bsearch btowc bzero cabs cabsf cabsl cacos cacosf cacosh cacoshf cacoshl cacosl call_once calloc canonicalize_file_name carg cargf cargl casin casinf casinh casinhf casinhl casinl catan catanf catanh catanhf catanhl catanl catclose catgets catopen cbrt cbrtf cbrtl ccos ccosf ccosh ccoshf ccoshl ccosl ceil ceilf ceill cexp cexpf cexpl cfgetispeed cfgetospeed cfmakeraw cfsetispeed cfsetospeed cfsetspeed chdir chmod chown chroot cimag cimagf cimagl clearenv clearerr clearerr_unlocked clock clock_getcpuclockid clock_getres clock_gettime clock_nanosleep clock_setres clock_settime clog clog10 clog10f clog10l clogf clogl close closedir closelog cnd_broadcast cnd_destroy cnd_init cnd_signal cnd_timedwait cnd_wait confstr conj conjf conjl connect copysign copysignf copysignl cos cosf cosh coshf coshl cosl cpow cpowf cpowl cproj cprojf cprojl creal crealf creall creat csin csinf csinh csinhf csinhl csinl csqrt csqrtf csqrtl ctan ctanf ctanh ctanhf ctanhl ctanl ctermid ctime ctime_r cuserid cwait cygwin_attach_handle_to_fd cygwin_conv_path cygwin_conv_path_list cygwin_create_path cygwin_detach_dll cygwin_dll_init cygwin_internal cygwin_logon_user cygwin_posix_path_list_p cygwin_set_impersonation_token cygwin_split_path cygwin_stackdump cygwin_umount cygwin_winpid_to_pid daemon dbm_clearerr dbm_close dbm_delete dbm_dirfno dbm_error dbm_fetch dbm_firstkey dbm_nextkey dbm_open dbm_store difftime dirfd dirname div dladdr dlclose dlerror dlfork dll_crt0__FP11per_process dll_dllcrt0 dll_entry dlopen dlsym dn_comp dn_expand dn_skipname dprintf drand48 drem dremf dreml dup dup2 dup3 duplocale eaccess ecvt ecvtbuf ecvtf endgrent endhostent endmntent endprotoent endpwent endservent endusershell endutent endutxent environ envz_add envz_entry envz_get envz_merge envz_remove envz_strip erand48 erf erfc erfcf erfcl erff erfl err error error_at_line error_message_count error_one_per_line error_print_progname errx euidaccess execl execle execlp execv execve execvp execvpe exit exp exp10 exp10f exp10l exp2 exp2f exp2l expf expl explicit_bzero expm1 expm1f expm1l fabs fabsf fabsl faccessat facl fchdir fchmod fchmodat fchown fchownat fclose fcloseall fcntl fcvt fcvtbuf fcvtf fdatasync fdim fdimf fdiml fdopen fdopendir feclearexcept fedisableexcept feenableexcept fegetenv fegetexcept fegetexceptflag fegetprec fegetround feholdexcept feof feof_unlocked feraiseexcept ferror ferror_unlocked fesetenv fesetexceptflag fesetprec fesetround fetestexcept feupdateenv fexecve fflush fflush_unlocked ffs ffsl ffsll fgetc fgetc_unlocked fgetpos fgets fgets_unlocked fgetwc fgetwc_unlocked fgetws fgetws_unlocked fgetxattr fileno fileno_unlocked finite finitef finitel fiprintf flistxattr flock flockfile floor floorf floorl fls flsl flsll fma fmaf fmal fmax fmaxf fmaxl fmemopen fmin fminf fminl fmod fmodf fmodl fnmatch fopen fopencookie fork forkpty fpathconf fprintf fpurge fputc fputc_unlocked fputs fputs_unlocked fputwc fputwc_unlocked fputws fputws_unlocked fread fread_unlocked free freeaddrinfo freeifaddrs freelocale fremovexattr freopen frexp frexpf frexpl fscanf fseek fseeko fsetpos fsetxattr fstat fstatat fstatfs fstatvfs fsync ftell ftello ftime ftok ftruncate ftrylockfile fts_children fts_close fts_get_clientptr fts_get_stream fts_open fts_read fts_set fts_set_clientptr ftw funlockfile funopen futimens futimes futimesat fwide fwprintf fwrite fwrite_unlocked fwscanf gai_strerror gamma gamma_r gammaf gammaf_r gcvt gcvtf get_avphys_pages get_current_dir_name get_nprocs get_nprocs_conf get_phys_pages getaddrinfo getc getc_unlocked getchar getchar_unlocked getcontext getcwd getdelim getdomainname getdtablesize getegid getentropy getenv geteuid getgid getgrent getgrgid getgrgid_r getgrnam getgrnam_r getgrouplist getgroups gethostbyaddr gethostbyname gethostbyname2 gethostid gethostname getifaddrs getitimer getline getloadavg getlogin getlogin_r getmntent getmntent_r getmode getnameinfo getopt getopt_long getopt_long_only getpagesize getpass getpeereid getpeername getpgid getpgrp getpid getppid getpriority getprogname getprotobyname getprotobynumber getprotoent getpt getpwent getpwnam getpwnam_r getpwuid getpwuid_r getrandom getrlimit getrusage gets getservbyname getservbyport getservent getsid getsockname getsockopt getsubopt gettimeofday getuid getusershell getutent getutid getutline getutxent getutxid getutxline getw getwc getwc_unlocked getwchar getwchar_unlocked getwd getxattr glob glob_pattern_p globfree gmtime gmtime_r grantpt h_errno hcreate hcreate_r hdestroy hdestroy_r herror hsearch hsearch_r hstrerror htonl htons hypot hypotf hypotl if_freenameindex if_indextoname if_nameindex if_nametoindex ilogb ilogbf ilogbl imaxabs imaxdiv in6addr_any in6addr_loopback index inet_addr inet_aton inet_makeaddr inet_netof inet_network inet_ntoa inet_ntop inet_pton infinity infinityf initgroups initstate insque ioctl iprintf iruserok iruserok_sa isalnum isalnum_l isalpha isalpha_l isascii isascii_l isatty isblank isblank_l iscntrl iscntrl_l isdigit isdigit_l isgraph isgraph_l isinf isinff isinfl islower islower_l isnan isnanf isnanl isprint isprint_l ispunct ispunct_l issetugid isspace isspace_l isupper isupper_l iswalnum iswalnum_l iswalpha iswalpha_l iswblank iswblank_l iswcntrl iswcntrl_l iswctype iswctype_l iswdigit iswdigit_l iswgraph iswgraph_l iswlower iswlower_l iswprint iswprint_l iswpunct iswpunct_l iswspace iswspace_l iswupper iswupper_l iswxdigit iswxdigit_l isxdigit isxdigit_l j0 j0f j1 j1f jn jnf jrand48 kill killpg l64a labs lchown lcong48 ldexp ldexpf ldexpl ldiv lfind lgamma lgamma_r lgammaf lgammaf_r lgammal lgammal_r lgetxattr link linkat lio_listio listen listxattr llabs lldiv llistxattr llrint llrintf llrintl llround llroundf llroundl localeconv localtime localtime_r lockf log log10 log10f log10l log1p log1pf log1pl log2 log2f log2l logb logbf logbl logf login login_tty logl logout logwtmp longjmp lrand48 lremovexattr lrint lrintf lrintl lround lroundf lroundl lsearch lseek lsetxattr lstat lutimes madvise makecontext mallinfo malloc malloc_stats malloc_trim malloc_usable_size mallopt mblen mbrlen mbrtowc mbsinit mbsnrtowcs mbsrtowcs mbstowcs mbtowc memalign memccpy memchr memcmp memcpy memmem memmove mempcpy memrchr memset mkdir mkdirat mkdtemp mkfifo mkfifoat mknod mknodat mkostemp mkostemps mkstemp mkstemps mktemp mktime mlock mmap modf modff modfl mount mprotect mq_close mq_getattr mq_notify mq_open mq_receive mq_send mq_setattr mq_timedreceive mq_timedsend mq_unlink mrand48 msgctl msgget msgrcv msgsnd msync mtx_destroy mtx_init mtx_lock mtx_timedlock mtx_trylock mtx_unlock munlock munmap nan nanf nanl nanosleep nearbyint nearbyintf nearbyintl newlocale nextafter nextafterf nextafterl nexttoward nexttowardf nexttowardl nftw nice nl_langinfo nl_langinfo_l nrand48 ntohl ntohs on_exit open open_memstream open_wmemstream openat opendir openlog openpty optarg opterr optind optopt optreset pathconf pause pclose perror pipe pipe2 poll popen posix_fadvise posix_fallocate posix_madvise posix_memalign posix_openpt posix_spawn posix_spawn_file_actions_addclose posix_spawn_file_actions_adddup2 posix_spawn_file_actions_addopen posix_spawn_file_actions_destroy posix_spawn_file_actions_init posix_spawnattr_destroy posix_spawnattr_getflags posix_spawnattr_getpgroup posix_spawnattr_getschedparam posix_spawnattr_getschedpolicy posix_spawnattr_getsigdefault posix_spawnattr_getsigmask posix_spawnattr_init posix_spawnattr_setflags posix_spawnattr_setpgroup posix_spawnattr_setschedparam posix_spawnattr_setschedpolicy posix_spawnattr_setsigdefault posix_spawnattr_setsigmask posix_spawnp pow pow10 pow10f pow10l powf powl ppoll pread printf program_invocation_name program_invocation_short_name pselect psiginfo psignal pthread_atfork pthread_attr_destroy pthread_attr_getdetachstate pthread_attr_getguardsize pthread_attr_getinheritsched pthread_attr_getschedparam pthread_attr_getschedpolicy pthread_attr_getscope pthread_attr_getstack pthread_attr_getstackaddr pthread_attr_getstacksize pthread_attr_init pthread_attr_setdetachstate pthread_attr_setguardsize pthread_attr_setinheritsched pthread_attr_setschedparam pthread_attr_setschedpolicy pthread_attr_setscope pthread_attr_setstack pthread_attr_setstackaddr pthread_attr_setstacksize pthread_barrier_destroy pthread_barrier_init pthread_barrier_wait pthread_barrierattr_destroy pthread_barrierattr_getpshared pthread_barrierattr_init pthread_barrierattr_setpshared pthread_cancel pthread_cond_broadcast pthread_cond_clockwait pthread_cond_destroy pthread_cond_init pthread_cond_signal pthread_cond_timedwait pthread_cond_wait pthread_condattr_destroy pthread_condattr_getclock pthread_condattr_getpshared pthread_condattr_init pthread_condattr_setclock pthread_condattr_setpshared pthread_continue pthread_create pthread_detach pthread_equal pthread_exit pthread_getaffinity_np pthread_getattr_np pthread_getconcurrency pthread_getcpuclockid pthread_getname_np pthread_getschedparam pthread_getsequence_np pthread_getspecific pthread_join pthread_key_create pthread_key_delete pthread_kill pthread_mutex_clocklock pthread_mutex_destroy pthread_mutex_getprioceiling pthread_mutex_init pthread_mutex_lock pthread_mutex_setprioceiling pthread_mutex_timedlock pthread_mutex_trylock pthread_mutex_unlock pthread_mutexattr_destroy pthread_mutexattr_getprioceiling pthread_mutexattr_getprotocol pthread_mutexattr_getpshared pthread_mutexattr_gettype pthread_mutexattr_init pthread_mutexattr_setprioceiling pthread_mutexattr_setprotocol pthread_mutexattr_setpshared pthread_mutexattr_settype pthread_once pthread_rwlock_clockrdlock pthread_rwlock_clockwrlock pthread_rwlock_destroy pthread_rwlock_init pthread_rwlock_rdlock pthread_rwlock_timedrdlock pthread_rwlock_timedwrlock pthread_rwlock_tryrdlock pthread_rwlock_trywrlock pthread_rwlock_unlock pthread_rwlock_wrlock pthread_rwlockattr_destroy pthread_rwlockattr_getpshared pthread_rwlockattr_init pthread_rwlockattr_setpshared pthread_self pthread_setaffinity_np pthread_setcancelstate pthread_setcanceltype pthread_setconcurrency pthread_setname_np pthread_setschedparam pthread_setschedprio pthread_setspecific pthread_sigmask pthread_sigqueue pthread_spin_destroy pthread_spin_init pthread_spin_lock pthread_spin_trylock pthread_spin_unlock pthread_suspend pthread_testcancel pthread_timedjoin_np pthread_tryjoin_np pthread_yield ptsname ptsname_r putc putc_unlocked putchar putchar_unlocked putenv puts pututline pututxline putw putwc putwc_unlocked putwchar putwchar_unlocked pwrite qsort qsort_r quick_exit quotactl raise rand rand_r random rawmemchr rcmd rcmd_af read readdir readdir_r readlink readlinkat readv realloc reallocarray reallocf realpath recv recvfrom recvmsg reent_data regcomp regerror regexec regfree remainder remainderf remainderl remove removexattr remque remquo remquof remquol rename renameat renameat2 res_close res_init res_mkquery res_nclose res_ninit res_nmkquery res_nquery res_nquerydomain res_nsearch res_nsend res_query res_querydomain res_search res_send revoke rewind rewinddir rexec rindex rint rintf rintl rmdir round roundf roundl rpmatch rresvport rresvport_af ruserok sbrk scalb scalbf scalbl scalbln scalblnf scalblnl scalbn scalbnf scalbnl scandir scandirat scanf sched_get_priority_max sched_get_priority_min sched_getaffinity sched_getcpu sched_getparam sched_getscheduler sched_rr_get_interval sched_setaffinity sched_setparam sched_setscheduler sched_yield secure_getenv seed48 seekdir select sem_clockwait sem_close sem_destroy sem_getvalue sem_init sem_open sem_post sem_timedwait sem_trywait sem_unlink sem_wait semctl semget semop send sendmsg sendto setbuf setbuffer setcontext setdtablesize setegid setenv seteuid setgid setgrent setgroups sethostent sethostname setitimer setjmp setlinebuf setlocale setlogmask setmntent setpassent setpgid setpgrp setpriority setprogname setprotoent setpwent setregid setreuid setrlimit setservent setsid setsockopt setstate settimeofday setuid setusershell setutent setutxent setvbuf setxattr shm_open shm_unlink shmat shmctl shmdt shmget shutdown sig2str sigaction sigaddset sigaltstack sigdelset sigemptyset sigfillset sighold sigignore siginterrupt sigismember siglongjmp signal signalfd significand significandf sigpause sigpending sigprocmask sigqueue sigrelse sigset sigsetjmp sigsuspend sigtimedwait sigwait sigwaitinfo sin sincos sincosf sincosl sinf sinh sinhf sinhl sinl siprintf sleep snprintf sockatmark socket socketpair spawnl spawnle spawnlp spawnlpe spawnv spawnve spawnvp spawnvpe sprintf sqrt sqrtf sqrtl srand srand48 srandom sscanf stat statfs statvfs stime stpcpy stpncpy str2sig strcasecmp strcasecmp_l strcasestr strcat strchr strchrnul strcmp strcoll strcoll_l strcpy strcspn strdup strerror strerror_l strerror_r strfmon strfmon_l strftime strftime_l strlcat strlcpy strlen strlwr strncasecmp strncasecmp_l strncat strncmp strncpy strndup strnlen strnstr strpbrk strptime strptime_l strrchr strsep strsignal strspn strstr strtod strtod_l strtof strtof_l strtoimax strtok strtok_r strtol strtol_l strtold strtold_l strtoll strtoll_l strtosigno strtoul strtoul_l strtoull strtoull_l strtoumax strupr strverscmp strxfrm strxfrm_l swab swapcontext swprintf swscanf symlink symlinkat sync sys_errlist sys_nerr sys_sigabbrev sys_siglist sysconf sysinfo syslog system tan tanf tanh tanhf tanhl tanl tcdrain tcflow tcflush tcgetattr tcgetpgrp tcgetsid tcsendbreak tcsetattr tcsetpgrp tdelete tdestroy telldir tempnam tfind tgamma tgammaf tgammal thrd_create thrd_current thrd_detach thrd_equal thrd_exit thrd_join thrd_sleep thrd_yield time timegm timelocal timer_create timer_delete timer_getoverrun timer_gettime timer_settime timerfd_create timerfd_gettime timerfd_settime times timezone timingsafe_bcmp timingsafe_memcmp tmpfile tmpnam toascii toascii_l tolower tolower_l toupper toupper_l towctrans towctrans_l towlower towlower_l towupper towupper_l trunc truncate truncf truncl tsearch tss_create tss_delete tss_get tss_set ttyname ttyname_r ttyslot twalk tzset ualarm umask umount uname uname_x ungetc ungetwc unlink unlinkat unlockpt unsetenv updwtmp updwtmpx uselocale usleep utime utimensat utimes utmpname utmpxname valloc vasnprintf vasprintf vdprintf verr verrx versionsort vfiprintf vfork vfprintf vfscanf vfwprintf vfwscanf vhangup vprintf vscanf vsnprintf vsprintf vsscanf vswprintf vswscanf vsyslog vwarn vwarnx vwprintf vwscanf wait wait3 wait4 waitpid warn warnx wcpcpy wcpncpy wcrtomb wcscasecmp wcscasecmp_l wcscat wcschr wcscmp wcscoll wcscoll_l wcscpy wcscspn wcsdup wcsftime wcsftime_l wcslcat wcslcpy wcslen wcsncasecmp wcsncasecmp_l wcsncat wcsncmp wcsncpy wcsnlen wcsnrtombs wcspbrk wcsrchr wcsrtombs wcsspn wcsstr wcstod wcstod_l wcstof wcstof_l wcstoimax wcstok wcstol wcstol_l wcstold wcstold_l wcstoll wcstoll_l wcstombs wcstoul wcstoul_l wcstoull wcstoull_l wcstoumax wcswidth wcsxfrm wcsxfrm_l wctob wctomb wctrans wctrans_l wctype wctype_l wcwidth wmemchr wmemcmp wmemcpy wmemmove wmempcpy wmemset wordexp wordfree wprintf write writev wscanf xdr_array xdr_bool xdr_bytes xdr_char xdr_double xdr_enum xdr_float xdr_free xdr_hyper xdr_int xdr_int16_t xdr_int32_t xdr_int64_t xdr_int8_t xdr_long xdr_longlong_t xdr_netobj xdr_opaque xdr_pointer xdr_reference xdr_short xdr_sizeof xdr_string xdr_u_char xdr_u_hyper xdr_u_int xdr_u_int16_t xdr_u_int32_t xdr_u_int64_t xdr_u_int8_t xdr_u_long xdr_u_longlong_t xdr_u_short xdr_uint16_t xdr_uint32_t xdr_uint64_t xdr_uint8_t xdr_union xdr_vector xdr_void xdr_wrapstring xdrmem_create xdrrec_create xdrrec_endofrecord xdrrec_eof xdrrec_skiprecord xdrstdio_create y0 y0f y1 y1f yn ynf

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

/4

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

274KB

Virtual Size

273KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

400KB

Virtual Size

399KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

69KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

69KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

/38

Size

512B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

bin/quic_initial_dbankcloud_ru.bin

SHA256 e065870cb0d13152e6132807bbf42218a9e7cd8d96f5602b61674cc540f3a56e
MD5 6422bac6b3e976bab5d21451b834221f
SHA1 5c3cbd90820054aec414e1c6e89f0ed03eb1f1d1
SHA512 0c2b212260fe6a4ef7af91f2e5cb1d9ba117c0654a80b4153301c23f08e63c8921835ae5e66f287b60722e1aee5b122fd18ce856f1aaba52604c0f51d9859205
TLSH
T1F721EA9951EF257024F6430A18E9A4B6594366C74AF68BF351D90CA06CE974B8F09863
MD5 SHA1 SHA512 TLSH

bin/quic_initial_www_google_com.bin

SHA256 f4589c57749f956bb30538197a521d7005f8b0a8723b4707e72405e51ddac50a
MD5 312526d39958d89b1f8ab67789ab985f
SHA1 49a06ceebb13807faaf2a935a716127faff9864d
SHA512 472e88fdd60f9c67f784514a6b699bbefac257657f53a9682a864c0ced474b33f89cf14eb112226ebc9b2c6b07a8f2ec9b25010ccdf98c13370c5c9c6dc2b893
TLSH
T16C21E766D88023896108F64536222E5009B3A4471621258F07292781C83EFEEC1EC0C6
MD5 SHA1 SHA512 TLSH

bin/stun.bin

SHA256 9cd5469309780ca56c0bd97266524a48c7ee529d02c3179cfecb20b260a59641
MD5 0357596c0e38a10a4b99dca2032419cc
SHA1 05fb322426bd56771a1e1873e88626bc98d34563
SHA512 319880f7624ff32720d11b79e5cdc24e24ee482a92cd2224e2175936b54a32916d059f431bf2f0e8ff74cf1be41395a462665e75fd1cf17a2c126d01cc2ee165
TLSH
T181B01200C24B4DA4C014103CC4436A9F84A415D58F00DFC389091E9050CA05E6CC1ACD
MD5 SHA1 SHA512 TLSH

bin/tls_clienthello_4pda_to.bin

SHA256 eefeaf09dde8d69b1f176212541f63c68b314a33a335eced99a8a29f17254da8
MD5 e6d649de132c3c10cb62531ef74f5b73
SHA1 689c7e8d021a99d0a64fee9099fa9012a3528265
SHA512 f7be809482e3098a5a8f79a759d1f8bcdc2e5201ac35f06eb8662afbb8194f2dfacc2c3e64114557de78e935086cad43880be83b0af1611a1aa0bced0facffba
TLSH
T14ED02B87C982745FDF090B7AA5D5C9B9DED3F1EA03CB8F4768058344FAD85B1422208D
MD5 SHA1 SHA512 TLSH

bin/tls_clienthello_max_ru.bin

SHA256 4ee0870abe0a0128600b0095189987ba1d210dae8bf963bc725aff49cf922624
MD5 b2b3e684ce449b60f0bc5a9028221a08
SHA1 32538a43ec8502f0146cd59456646bce7aedd29c
SHA512 19963986a6c0f7265456aeaa4622fd4f8061dc81d1b722fb62f61574f6d96e4b55cfcd256dcfc555bec11ae458ddebb943de25dc1df102dafe99a2b4174b5b38
TLSH
T1CF0128771655D117A54D1F1650E150418585EF447302C7EF3B74D974CAD68C34E75345
MD5 SHA1 SHA512 TLSH

bin/tls_clienthello_www_google_com.bin

SHA256 936c2bee4cfb80aa3c426b2dcbcc834b3fbcd1adb17172959dc569c73a14275c
MD5 41e47557f16690df1781f67c8712714e
SHA1 2f3ca8e75528e0e7797e8f5edfdc582535531913
SHA512 e8b644d7996168e51d8b991b1d263b9d98f7178bdd9a060078cf4f5ef368fa6e864492b3365227aa68d4d079d734f17d8a5755bbab7424f1bb66e82c0b72f1dc
TLSH
T1D601F4AB1D42D11AD9020E1629D7854A51CADA0561138F772705AF11E8C3D97CD10BC9
MD5 SHA1 SHA512 TLSH

bin/winws.exe

IMPHASH a4b140fe839e54b299bb799d5e755765
SHA256 affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
MD5 d498e19bc7a79dd1efcb6b928cbe9909
SHA1 e660246d9b5de531d8c6ed563919d2690f47d209
SHA512 03fa6ccc762999e4b5e3c7ed4f4a269d5e7114af52c833842f94fcbca19c3b2edd3c218df247d7616a54d25262f2dc14762a958c620433589ac3c1efa14b379a
SSDEEP 3072:llblEpda/1ZqNUckRoAHzGDIAaSLECf6CuWhs/JSDxIcdDFth2zp:l/TY5czliX5mhYIcdptyp
TLSH
T145145B17F39588F9C462C17896AB5333E932FC452134FA4B9FA4DB212F65E10B12E798
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

cygwin1

__cxa_atexit __errno __getreent __locale_ctype_ptr __main __stack_chk_fail __stack_chk_guard _dll_crt0 _impure_ptr atoi calloc chdir close cygwin_detach_dll cygwin_internal dirname dll_dllcrt0 dup exit fclose fgets fopen fork fprintf fputc fputs fread free fseek fwrite get_current_dir_name getopt_long_only getpid getsockopt inet_ntop inet_pton localtime_r malloc memcmp memcpy memmem memmove open openlog optarg posix_memalign printf putchar puts qsort random realloc setenv setsid setsockopt setvbuf signal snprintf srandom sscanf stat strcasecmp strchr strcmp strdup strerror strlen strncasecmp strncat strncmp strncpy syslog time tolower toupper usleep vfprintf vsnprintf wordexp wordfree

advapi32

RegCloseKey RegEnumKeyExA RegOpenKeyExA RegQueryValueExA RegQueryValueExW RegisterServiceCtrlHandlerA SetServiceStatus StartServiceCtrlDispatcherA

kernel32

CancelIoEx CloseHandle CreateEventW CreateMutexA FormatMessageA GetLastError GetModuleHandleA GetOverlappedResult GetTickCount LocalFree ReleaseMutex SetLastError WaitForSingleObject WideCharToMultiByte

ole32

CoCreateInstance CoInitialize CoUninitialize

oleaut32

SysFreeString

wlanapi

WlanCloseHandle WlanEnumInterfaces WlanFreeMemory WlanOpenHandle WlanQueryInterface

windivert

WinDivertClose WinDivertOpen WinDivertRecvEx WinDivertSend

Name

.text

Size

123KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

392B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

general (ALT).bat

SHA256 c6dff44ea3c7159788077e31a8e35929eab1c0270fb86f5490d44b1fd049a6fc
MD5 cadb63e600829d6d26aaac973d55d89d
SHA1 c737ce586f9c4cc9d68abc62ed9a149f68d5b4c6
SHA512 f9cfbb955e914dd9e1dfdf75d7cca4973bcf81e1dbeebb833e8e247cfea88b571878c8e80a638021234a1034e74ff9451c060c85b03a95d91d488011ef297738
TLSH
T194715DA7E00CDE47F5CDA53EF85FA6A420279C8329D6D452835B89F8CC4EDBD684E484
MD5 SHA1 SHA512 TLSH

general (ALT10).bat

SHA256 7a8b4d861c4448ee3fb4aef61d79bcdbfc3ea0ab043145f643539fbd177c8864
MD5 9a77b713dc626138ec7421f560716a28
SHA1 06281de584a2f7a10b7d2fbd594f518efd7e4c9c
SHA512 6e29b0880be24c85c9398fa21b88453b650a0f09045cc7701bba910aa74118e9f179da85b4db53e19b79ad9cfd524916583f7ac83e02c254a955f9ce8bec2c75
TLSH
T130712C93E00DDE47F48DA97EF85FA5B52027D88368D6D452439B89E8CC0ECBE684E484
MD5 SHA1 SHA512 TLSH

general (ALT11).bat

SHA256 8df459fc47b6becbfd4cc54263ab99ee275a62c8a8097fb4abea236e29e7cc85
MD5 81d21053303452399da6b09313cac0b3
SHA1 f4ab94b0bcbb1e29e6f301f1e30772d64608c0a7
SHA512 e44157ba880e11d3e0688856213e2ff3892ce47ce1013ff38c55a3dc0c376971804d777129fa823511672857905c0981ad856fbfb2cf7cc2b5161af95474826d
SSDEEP 96:nL67mQGB/GRRQ1z/IKdUGB/GR6Vv/GRRQuv/GR65P+RJ5+RRLxD:AmQGB/GRRGgVGB/GRKv/GRRDv/GRuP+M
TLSH
T125914BA3E00DEE46F6CE757EF85FF6A52017C8C328D6D452435B89E8CC0EDB9595A084
MD5 SHA1 SHA512 SSDEEP TLSH

general (ALT12).bat

SHA256 3f28b3788373c4963ba7b4e38112ae965fef2c99a812f023e9d2c736e99cb9c7
MD5 707e7f6492429b89d52a665cb47d2e1f
SHA1 5ce1c89efeda8a2bbf3419d1a7169cdfd08fae23
SHA512 7c85dacf2a739dbe585b3dbea34354da8cfc49c10975f1215ed8bc03baa6fb6f3c57483f8926fd24a104133e90a275c8a5f51f808ee7d9007fa61b08edf847c2
TLSH
T1C0816CA3E00DEE46F6CE757EF85FE6A52017C8C328D6D452435B89E8CC0EDB9594E085
MD5 SHA1 SHA512 TLSH

general (ALT2).bat

SHA256 94a8ef4dc67c5e04100c404604883cee6a7d8ad5d324395ecd71dc8ccb805d80
MD5 802a10c9f71f69ebe61eeae7693ba0e5
SHA1 8548aca5802a54f0bceaac04a6c22767de76f86c
SHA512 a37d97055d38a04e4eef3853cdc7519f1b79cb01a63ccf66fe9558ae678da98e696443cba44847bc28ba08eb15f894b4f8b4fad470a93d0e345004a5ddcf48c5
TLSH
T1D5613957E00DDE4AB68EB83FF89EE5E52017C4C31CD6D452439B89E8C84EDBE494E485
MD5 SHA1 SHA512 TLSH

general (ALT3).bat

SHA256 99c06ea66bdade72d43febbf4e5bd6208351ebd471fa99a39a92253e21526c05
MD5 aa4abe5d986341f92ed5529c58002d5c
SHA1 1d369c8ccbadfdf69d47f27aef30159b7f022243
SHA512 6a67fd0193098890cdba4c0c6a51114eb7f10158d57f078c516a7a303bbff516ef73c7c478c9103d29c7d39b7168f7c26e4980c6389c4639d21583ec5fa86681
TLSH
T1AA719E93E00DDE07F4CD6C3EF84FA6B5201788872CD6C851539B49E8C84EDBA6D4B085
MD5 SHA1 SHA512 TLSH

general (ALT4).bat

SHA256 feee3e7ecdbf3a5a46109b6018144954d793143ad4c889f3273f8ec1e8ac067d
MD5 1a9353401fc545311572880d32a88f78
SHA1 9e005a4a276e9b93f0499bdea7aeae070048d31e
SHA512 86b79c6aa9cda652549cfce001c82eda023e32ddecfdd33d11decbb5afbe9b24fc5eafa5673fa1019a4caddd9ff32855cc6b78753769283f2ad96ebf0d8d44c5
TLSH
T1EE715A93E00CDE42F6CDA53EF86FA6A421279CC318D6D452439B89F8DC0ECBD584E594
MD5 SHA1 SHA512 TLSH

general (ALT5).bat

SHA256 3e0a7026cccc02e6ca968dcd3efe4db94181cea190cecf4ac3e7e60d39d4dbb1
MD5 2d3d8bfe1a53bd8e0d03b8339fc02546
SHA1 9c02f16df41e3b7510209f21910331a7c3ca298f
SHA512 7a00daae8665d3d61134e111bb61a88edc657a09744f15fbf4846580d3e5f156e5ff9ac2fbff31327004a8593f581eaeb14f67a36412a8a22017f4284347ba51
TLSH
T15D413987F00DDE46B08DA87EFC5AA6F5601BD8C35DE1D452539788E4C84EDAE8C4E484
MD5 SHA1 SHA512 TLSH

general (ALT6).bat

SHA256 8ef1e5f6ae38a7a288ba1516293eda9183d7f265210897399f911d8a1e7e62fe
MD5 e6973238d03286140e2469f9616c9edc
SHA1 a01e8061bfc7cb2b93aca815ebcd85bc46145ed7
SHA512 28f8aacc46144648af1d03ede61d4983ee0942469526c49d86c633b63b52b2aeb80ab57b459775ac2b0ef975d1d822907b93171c4999952aecc934a98022d06a
TLSH
T144612753E00DDE4AB68FB83FF85EA6E52017C8C35CD6D452539B89E8C84FDBA494E484
MD5 SHA1 SHA512 TLSH

general (ALT7).bat

SHA256 26b4dd29e5020066660230cf5ea61693dd85b69d15fc11ac967f3adf54fb352f
MD5 a8efa3ed6068b339fd86951c80e84c2f
SHA1 19b7620ecab1c14492f9576defcecadb6589edf5
SHA512 3aba9edd1a5369486b647d60c003bf098d9d45decc76c9a251543934e5ceaae3966c52d6af562a6c733177212d7c5e32534dcd8207d1e1975a8cadaacf3f3f8d
TLSH
T1CD513793F00DDE46B68EA83EFC9AA5F52017C8C35CD6D462539789E8C84EDBE4D4E484
MD5 SHA1 SHA512 TLSH

general (ALT8).bat

SHA256 8612e0b0d5eb757448c4d2ef255abc00ff30f2b7e9087e0c936f7ba479af07e5
MD5 a2865133b7b6bc0adcc51acb7d64ae20
SHA1 5ccf2ac6e98ef57e60adaef840104f94035f776a
SHA512 e0f5aaf76637c1a1934a1eba13e35f6cae87c83741ae26b594ee7ef9e9d1b894f75224992b67f82e48577d009187a2152e0475faedec4a7a0b1410bfd3d06329
TLSH
T162616A93E00CDE46B58CA83EF85FA6B42127DCC32CD2D452539B88F8D84EDBE584E584
MD5 SHA1 SHA512 TLSH

general (ALT9).bat

SHA256 4b8f50bd2b5cd71c0a883461d4a526a2cd9494a87847907807d06c233166c2c9
MD5 4d6ced8c4790b06aba64d176a2ba5e9a
SHA1 4ea98386b069cc339e301da4ce8c777a81fb0111
SHA512 71a6234afd9e08d6999d90b765bba7781063a8e76fee8e8793be0a17b31e4bcea4342da6e4eefd4e7e42ce1edf39d9c1c58120af79e56b45d8337ec8b082c099
TLSH
T170616A93E00DDF46B48D6C7EF89BA5B52017C8872CD6D852539789F8C44EDAE5C4F085
MD5 SHA1 SHA512 TLSH

general (FAKE TLS AUTO ALT).bat

SHA256 0a3744d9a42dd439b3576fa1d031d3d2ef6f93564bdb575a6afb0c8a3a056ac2
MD5 6545370a3d960f825186816b546b2bf2
SHA1 397fcb6722760551b1154c9f77de5ad751760d63
SHA512 de312677efa8c70f2b3d31560e762e85f1cecb3c2b33e1a25f10576ee235edfc4b21d5e825d132acc1784bdb8f91bf8f164b79dd048f869bd6a77c6c5702c6d1
TLSH
T1BE715D93E00DDE47F68D683EFC5FA6A52027C8832CD2C851839B84E8D84EDBE5C4E584
MD5 SHA1 SHA512 TLSH

general (FAKE TLS AUTO ALT2).bat

SHA256 1e9a3d1fe257f10c9355dbef5a45cca9765b57e2ce1f549225c68c86ff1c8d8b
MD5 1ce3caa8f2ffb279c6435ff245db45cf
SHA1 b9c3733fe7978ba5e07eac3a98603a7ababc7f95
SHA512 074d02263602daa4b301b5806d6cbd955fe15fc2bdcdb5e39ac0383354ca2e4e90d5c3d1c3f37a83229c27f3d9590487dddd464d2bdd754ca203812f3879ee20
SSDEEP 96:nL67mQGB/GRRQ1zdDUGB/GRdVv/GRRQuv/GRd5P+Rv5+RRLxB:AmQGB/GRRGdYGB/GR3v/GRRDv/GR3P+k
TLSH
T1FF916A93E00DDE4BF7CEB43EF86FB6A5201798C32CD2D452839B45E8D84EDB9594A190
MD5 SHA1 SHA512 SSDEEP TLSH

general (FAKE TLS AUTO ALT3).bat

SHA256 7679e6f52ce95ed5c554de668286a40f2ac9b845cc69a3619a313f10e43cef46
MD5 3ca95fd9b8109cc6b154d90988f01321
SHA1 047c8ba5d92c347097cbc808015a9c6691fad10c
SHA512 9ce2da012345161d41f9a8e5d6b8e525ccf63063257f6adf9a062cadae6aa1ebfcafe4ff24e90078c7cc684be462da6153d52574ea2b62c47df20a5be8e4681f
SSDEEP 96:nL67mQGB/GRRQ1zp1UGB/GRPVv/GRRQuv/GRP5P+RQ5+RRLxE:AmQGB/GRRGpmGB/GR9v/GRRDv/GRxP+o
TLSH
T154815C93E00DEE4BB6CE743EF85EB6A52017C8C36CD6D452839B85E8CC4EDB95D5A080
MD5 SHA1 SHA512 SSDEEP TLSH

general (FAKE TLS AUTO).bat

SHA256 fa227e6c9527b093d8099018b059c798f89e2984140fd903613e598a71b76276
MD5 4b09787d50d75067b8f7e9a95ef84748
SHA1 73f69d743fc2ee6b5a45fc404e91300e4782140f
SHA512 26eca329de8d26e55a3fdcaa54a24a9a90ad64ccbc8bf4a08f5ac46d5a321f3b8f64959afa0cd035f29a717483f60382a36f8b655710ade352de742fb5893f6a
TLSH
T1E3815D93E00DDE47F5CDB83EF86F76A821279C8328D5D852839A45E8DC4DDBE594B084
MD5 SHA1 SHA512 TLSH

general (SIMPLE FAKE ALT).bat

SHA256 b9f847180ef1da5908870221acf03a469fc0dca87dadf7404350893d24ca02f2
MD5 6697b88f229fff35f241b32de084314f
SHA1 da4dd03adc7b62c693f78fc3b6186344931a2786
SHA512 45029aa794a767aa260fa658f983ff2fd2493ac67c7254d8937db0a36296f91c5a37f860cc7cb53f4e16c745fb0a54e4106e56b2575e4e23762eb126ccb0811b
TLSH
T140714A93E00CDE43F58DA47EF8AFA6A42127D8C319D6D452435B89F8DC0ECBE584E594
MD5 SHA1 SHA512 TLSH

general (SIMPLE FAKE ALT2).bat

SHA256 7ad976ec3968a3dce1e0b54b81e77ec1f925a78eb31930deeaa8359b23201f1a
MD5 19254d284a9643e034b0dc548bdb1dc4
SHA1 1664e1ba9a4efb281c1edb52af503083aec0390f
SHA512 d974a7722a75a67495296558079f79304a07ba3fb6a24c6a4c5709f599e20330ff92021a5f7b3400f6d0b091590ff6f36c27b4a91d5d6846179a5297f0967d24
TLSH
T14E711C93E00DEE47F4CDA97EF85FA5B52027D88368D6D452435B89E9CC0ECBE584E484
MD5 SHA1 SHA512 TLSH

general (SIMPLE FAKE).bat

SHA256 3d8bfbf6758e41c12d3e4975c451e20a92a0cf3a429e3c283d686b92172b2732
MD5 b37665df1f26cc7831732eca575a01e5
SHA1 c64157fde2d68a08784940ee8afa271d18476907
SHA512 9923cab5535bae11f7b9c405f5f9f311148f50d069acb9a63655fe672150f25e27d0e8a8ac80b3f620449a8e1499dbabbddbe8dc26d4071b4778494d3e1cc224
TLSH
T1D0711A93E00DDE47F48DA97EF89EA5B5202798C368D6D452435B89F8CC0ECBE584E484
MD5 SHA1 SHA512 TLSH

general.bat

SHA256 c4f7f5708de5323b55ea85e2ef140c43426352875593eae1c0b94bfc769a4477
MD5 0ac556c85f0d739609285815922d1699
SHA1 cb574075ff568e8802191b8121cb7b2b5a6e7610
SHA512 a784f568b8e2dad26a2f4fdaf190a23e3ad6b4666d75c6a7d11fc8f3296093b59cddc7820b52086188e341f9019e5b0fdf029afaca0d7ff461a23dcf2ea796a8
TLSH
T16A616B97E00DDE4AB68E787FF84EA6E12007C8C35CD2D452439B89E8C84EDBA4D4E484
MD5 SHA1 SHA512 TLSH

lists/ipset-all.txt

SHA256 19123a22bf1108815c07bda3cda8df282b30bd63e4939949928969c0fd195873
MD5 42ad35639873f78e1b2dc5c1039499df
SHA1 0fe009c7e4f670e759fda4668a8b37904215c9fa
SHA512 1676acc285990e44eb382705e0711fcab7fac79348c541c67bee58a49f3223d8fc61dcb895a7d2dc25ff38dec249268aa64e50c952a214f264b5430f9726a907
MD5 SHA1 SHA512

lists/ipset-all.txt.backup

SHA256 1fb91430a8594b2632d41a87b5bf071ce851ffb5b4d470b965d1db2b60d3ee94
MD5 159fbec389464bf9d2719641f9f5e0cc
SHA1 75374875a220cd3a9dda7db00cfd8fe1bb474fc2
SHA512 9d2dfcf79de4ce4caff1343bb7a11721b2a4bd4239eed745d1d16290e8762fd28b152e54792317ee9b9c2bc4c9c783d07312e8674242120b623f97efafdb69e2
SSDEEP 1536:yRVsx0/6EWkNeuDC3BByxwKVHoTORc/47mDgTIgmKI+5o3eho4nn2O/LxqVd5+Ap:sdTIgmKI+5oQbnY
TLSH
T17CB45F7132BE5EF09581B3EA23DB81647AFBE1C634F6F2608B4FA57129220417D59D23
MD5 SHA1 SHA512 SSDEEP TLSH

lists/ipset-exclude.txt

SHA256 96c03954012765ce4ab03b9c30f29ab1ca1b698c6752224d03828e6d182eb0fc
MD5 240532f20e114cd6de2906ebc86d683e
SHA1 f7d4b6e1ec084e64c367ac11f5fe21fff454fb68
SHA512 809e9961b2952acff12fb27b31895f9e7c0d70433363cdd8fd61bd522ffa835e7d403de3419092145673e10644aa0803d0e244d9cfff8d8bf784e783713f799a
TLSH
T147C09271516912FB0F876B21A13E0326F9475BCB26F37D64A36C5286EC504096029920
MD5 SHA1 SHA512 TLSH

lists/list-exclude.txt

SHA256 cef044825cfc9e0f073cd040587e0bb2184d1cbb7a013ef6532da2cc34028de8
MD5 24c9a1a106d5ae764547dd6dd167ef2f
SHA1 549ae24995eab02bb5af04e986dbfcf210fce7b1
SHA512 24c35f0dbff26ffd0d4cec4c8a45c2826189b54759e29deb52cbba5ee821801d9f59f404c927b83557de362ed3cb619fdf976a17820c85a246e51b49d4849dff
TLSH
T16F31ACB0D80424515698F48BD4A67F44A839323A81C0ECCAA7E8DC8C27C2295BFCFA71
MD5 SHA1 SHA512 TLSH

lists/list-general.txt

SHA256 9bcd915e90635562ad7332eab9b7e6ecce420ee344762423037ac6eff01d9dab
MD5 ca3279a7be4e68fc595c51fc63cb5194
SHA1 31f7aff9aa1dd32129e68b2d1be2d26e7ee37ccb
SHA512 afe29c9962a114b7df361b7127ec8c139105bbcb2e01055f3b477191537d9e9e51afc83d47a79f3ea0ee8e22184be7b37b1417bb9f2a962d9864cc313f9b94ef
TLSH
T14B11F253A1A99750271ED4E4145463A02394B4F11CCFE6E39B6FC19F09093FAB3D0EA7
MD5 SHA1 SHA512 TLSH

lists/list-google.txt

SHA256 1e59f9d487f7bce12091c838151713d0a8d31c3aae20afefebb38206f2cd8232
MD5 a47c9cc57d60596de04f785df7384fb3
SHA1 91fd0465aae6fc84a0164531bc08683e67f57aba
SHA512 739d2a53cbe969e675d37a63dead91fc68278861fe2948e65300bd61bfaf95758cd83fa52493456746cb6aaff09705bfd35050875cbf5b57a110e41fb38c7dc4
TLSH
T1F7E04F87780E809F4202ECC818F0654DB62CF23586DEEAF4DD61D03E70ADB4A34C18E2
MD5 SHA1 SHA512 TLSH

service.bat

SHA256 8a3278e676abbc7b52d5cfd2bc5d89275844a3a662a4de5f42d5ffebba6df6aa
MD5 96fa63730dd984ded6dd593b833bd06c
SHA1 c88f1dd313f887237bc6a92e3149aed4b24a2ca1
SHA512 ce15ac99e9263e11407188aa47dd864f3abec8f13d3a9021fb5ae412203ac34ad8e571995a90a35dec6bb8d73c019cb027ff771092f31076eacb12d109b0faa8
SSDEEP 49152:UhhUuysW0/q51QrdBXX5TXjPWGFUnKHUplpHTLc7JsJoD375xGGsXLP4reJEZ5+6:W
TLSH
T171F6CF320683BCBD3FAD3D85A0012E496C5D7A1B11689359BBC934BA63ED5A4CE3CD74
MD5 SHA1 SHA512 SSDEEP TLSH

utils/check_updates.enabled

SHA256 c823a2779ca11474ada5ece9c37cc825f71c54fbc1525d9b0cf3dbc7879abb09
MD5 c45d8fbde4e335ed2d438d81bf5e6b5d
SHA1 c78adef3e4f3601b3bfcab9d16467709e4242f13
SHA512 6a3f31efd1d6c20ca61c515cda8e13d684a87cafb2b8ed940b24fe5d195c14c9b159af906d6dbad7e2befdfa75c311a96f792e342aadb2e0be15c7fe148d83f0
MD5 SHA1 SHA512

utils/targets.txt

SHA256 4c953196e2649478c267450fc80cef121ef96bc50656ef75336b9589c0808cea
MD5 0260e9fef4eaf980bda2c0118c2693e1
SHA1 90a1202ac88ed738059639a7925be7fe1c7d34ed
SHA512 845f2be911a0f51aa10fc0c9417f8cf0e06015cf5b87d02c686e02b3af15f89b81e8163ee1185e571f13a6e908d08ab211587397840219699ab893d18ff8d57c
TLSH
T19C219B93F152C4B0025A84DCE400B2ACFB0A411F678A60EBF04F509F3B047F482FB696
MD5 SHA1 SHA512 TLSH

utils/test zapret.ps1

SHA256 f31ced248fee999c780d1361d2a244ff2a63c7feb57f5678176367ef5d2b0e15
MD5 82c0648c9e124331bb53a8bef9555492
SHA1 4c7d3f3a50a15c8d3bf4176186ca5554971056c9
SHA512 0d73dbaf63a0ae0c2edccde6fbcf2a4855d98bc1c13784cdbd7538e3b113190f187b232bda7b82b1c2a9d69244c388c2a500f92c9ccc5089640312c54762a599
SSDEEP 384:jAakddb1Xz1jbdZxP//nnXVqcNm5tVZuyci8EULNW2pyBw61H1UVnVd8QGeSH9Yz:jzk3xXFc5tHtciOswyBw61H1Kd8auA
TLSH
T1DD03B72AB90A106A52735BBF9C416104FF57417B800D16D0BD9CA0D87FF492ECA79EEB
MD5 SHA1 SHA512 SSDEEP TLSH

Sharing

General

Malware Config

Signatures

File Explorer

zapret-discord-youtube-1.9.9d.rar

DiscordFix.exe

generic

LICENSE.txt

README.md

SHA256SUMS.txt

bin/WinDivert.dll

advapi32

kernel32

generic

bin/WinDivert64.sys

ntoskrnl.exe

hal

ndis.sys

fwpkclnt.sys

wdfldr.sys

generic

bin/cygwin1.dll

kernel32

ntdll

generic

bin/quic_initial_dbankcloud_ru.bin

bin/quic_initial_www_google_com.bin

bin/stun.bin

bin/tls_clienthello_4pda_to.bin

bin/tls_clienthello_max_ru.bin

bin/tls_clienthello_www_google_com.bin

bin/winws.exe

cygwin1

advapi32

kernel32

ole32

oleaut32

wlanapi

windivert

generic

general (ALT).bat

general (ALT10).bat

general (ALT11).bat

general (ALT12).bat

general (ALT2).bat

general (ALT3).bat

general (ALT4).bat

general (ALT5).bat

general (ALT6).bat

general (ALT7).bat

general (ALT8).bat

general (ALT9).bat

general (FAKE TLS AUTO ALT).bat

general (FAKE TLS AUTO ALT2).bat

general (FAKE TLS AUTO ALT3).bat

general (FAKE TLS AUTO).bat

general (SIMPLE FAKE ALT).bat

general (SIMPLE FAKE ALT2).bat

general (SIMPLE FAKE).bat

general.bat

lists/ipset-all.txt

lists/ipset-all.txt.backup

lists/ipset-exclude.txt

lists/list-exclude.txt

lists/list-general.txt

lists/list-google.txt

service.bat

utils/check_updates.enabled

utils/targets.txt

utils/test zapret.ps1